Large-alphabet encoding for higher-rate quantum key distribution

: The manipulation of high-dimensional degrees of freedom provides new opportunities for more eﬃcient quantum information processing. It has recently been shown that high-dimensional encoded states can provide signiﬁcant advantages over binary quantum states in applications of quantum computation and quantum communication. In particular, high-dimensional quantum key distribution enables higher secret-key generation rates under practical limitations of detectors or light sources, as well as greater error tolerance. Here, we demonstrate high-dimensional quantum key distribution capabilities both in the laboratory and over a deployed ﬁber, using photons encoded in a high-dimensional alphabet to increase the secure information yield per detected photon. By adjusting the alphabet size, it is possible to mitigate the eﬀects of receiver bottlenecks and optimize the secret-key rates for diﬀerent channel losses. This work presents a strategy for achieving higher secret-key rates in receiver-limited scenarios and marks an important step toward high-dimensional quantum communication in deployed ﬁber networks.

Representative plot of secret-key rate versus channel length for a traditional two-dimensional QKD protocol, assuming a 5 Gbps modulation rate, a 0.2 dB/km channel loss, a 1 kcps background count rate, a 93% detector efficiency, and a 100 ns detector reset time after each detection event. These detector performance characteristics were chosen to correspond with the high efficiency telecom band single photon detection system reported in [22], and the effects of detector reset time on observed count rate were modeled following [37]. Three regions are denoted: I. At short distances, 0-90 km (or correspondingly, low losses, 0-18 dB), the secret-key rate is limited by detector saturation. II. For higher losses (normal operation), the secret-key rate decays exponentially with distance. III. At even higher losses (> 300 km), a cutoff is reached when Bob's received photon rate becomes comparable to his detectors' background count rate. At this point, the error rate grows and the secret-key rate drops abruptly.
QKD has been demonstrated using position-momentum [8], spatial modes in multicore fibers [9,10], time-energy [11][12][13][14][15][16], and orbital angular momentum (OAM) modes [17][18][19], as well as combinations of polarization and OAM modes [20]. Of these, time-energy encoding is appealing for its compatibility with a large portion of existing telecommunications infrastructure -which lowers the barriers to widespread adoption of QKD. Indeed, the time-energy correlations are robust over transmission in both fiber and free-space channels and are preserved when passing through wavelength-division multiplexing.
In high-dimensional temporal encoding, the time-slot position of a pulse within a multi-timeslot symbol-frame determines its coded symbol. Classically, this encoding is known as pulse position modulation (PPM), and combined with single-photon detection, it achieves near-optimal performance in terms of bits per detected photon [21]. A pulse coded into a symbol comprising M time slots can convey up to log 2 M bits of information, as illustrated in Fig. 1(a). The rate of transmitted symbols, R T , is ideally R T = R c /M, where R c is the system clock rate. Assuming constant R c , PPM exhibits a trade-off between the alphabet size M and R T : an increase in the former directly corresponds to a decrease in the latter. We take advantage of this trade-off to maximize the secret-key rate in the presence of receiver saturation. Figure 1(b) is a representative plot of secret-key rate versus channel length for binary encoding with realizable parameters. Three regimes of distance/loss are indicated. In normal operation (Region II), the secret-key rate decreases exponentially with distance until the received photon flux is comparable to the background counts of the detector(s). In this regime, binary encoding works well and high-dimensional encoding does not offer any performance benefit. At distances/losses beyond the exponential rate-loss cutoff point (Region III), the correlations between sender and receiver are masked by the background and no secure keys can be generated. However, at short distances, i.e., low losses (Region I), the secret-key rate is limited when some component of the receiver hardware -such as the single-photon detectors or the readout electronics -is saturated by the incoming photon flux, as illustrated in Fig. 1(b). In this regime, which extends to approximately 90 km for these parameters, high-dimensional encoding can be used to increase the secret-key rate above the maximum binary-encoded rate.
Here we focus on using high-dimensional encoding to maximize secret-key rates over metropolitan-area distances of tens of kilometers. This work is complementary to previous research which has tended to focus on extending the range of QKD links well beyond tens of kilometers to inter-city lengths of hundreds of kilometers [23][24][25][26]: deployed QKD networks will include a variety of links, including long distance inter-city links, as well as shorter, metropolitanarea-scale links. Each link type will potentially have different optimal operating points and technologies.

High-dimensional prepare-and-measure QKD experiment
To demonstrate high-rate, large-alphabet QKD, we focus on dispersive-optics QKD (DO-QKD) [27], a high-dimensional QKD protocol based on time-energy encoding, with basis transformations produced by group velocity dispersion (GVD). We previously proved the security of this scheme against arbitrary collective attacks [27] and implemented the scheme using entangled photon pairs in the laboratory [14]. Recent theoretical work has extended the security to hold against general attacks [28]. The present work is a prepare-and-measure (P&M), decoy-state version of DO-QKD.
In P&M DO-QKD, Alice and Bob derive shared information from timing correlations between the prepared pulse time and the measured pulse time. This information can be derived when Alice and Bob prepare and measure using the same basis. When they use different bases, the correlations are degraded and provide no shared information. Decoy states provide protection against photon number splitting (PNS) attacks [29][30][31].
The general protocol architecture is pictured in Fig. 2. Alice's transmitter generates a sequence of PPM-encoded pulses that will become the raw key. The transmitter prepares signalintensity states, with probability P µ , by attenuating the optical pulses to an average intensity of µ photons/pulse, and the transmitter also prepares decoy-intensity states, with probability P ν = 1 − P µ , by attenuating the optical pulses to an average intensity of ν photons/pulse.
The transmitter prepares these pulses either in the time basis, with probability P T , by sending them directly across the communication channel, or in the energy basis, with probability P E = 1 − P T , by applying sufficiently strong GVD to the pulse in order to stretch the pulse across many time-slots within the PPM symbol-frame, before sending the stretched pulse across the communication channel.
At the other end of the communication channel, Bob's receiver measures either in the time basis -by sending the photons directly to a time-resolving single-photon detection system -or in the energy basis -by applying GVD of equal magnitude but opposite strength as used by Alice before sending the photons to a time-resolving single-photon detection system. We assume that Bob's basis choice probabilities are the same as Alice's.
The protocol's security proof requires that for each transmitted pulse, the choices of preparation basis and transmission intensity must be random to an eavesdropper, Eve, but known to Alice. Similarly, the protocol's security proof also requires that for each received pulse, the choice of measurement basis must be random to Eve but known to Bob. However, to increase the probability that Alice and Bob both choose the same basis, we can set P T > 1/2; i.e., Alice and Bob both preferentially choose the time basis. Under this asymmetric basis selection, the protocol remains secure against Eve if the timing correlations are analyzed separately for each basis [32].
After the prepared pulse times and basis choices, as well as the measured pulse times and basis choices, are recorded, Alice and Bob convert the measurement results into shared secret keys through a series of classical post-processing steps. First, Alice and Bob demodulate their PPM streams, giving each a sequence of symbols. They then perform sifting -they publicly announce their basis choices in order to post-select only the symbols that are encoded and decoded using the same basis and therefore should be strongly correlated. Alice then announces the transmitted intensities in order to divide the post-selected symbols into signal-intensity and decoy-intensity symbols. Some of the symbols -all of the energy basis, signal-intensity symbols; an equal number of randomly selected time basis, signal-intensity symbols; and all of the decoy-intensity symbols from both bases -are publicly announced in order to estimate timing correlations and symbol-error rates (SERs), which are used to calculate the maximum information accessible to Eve [31,33]. The SER is the high-dimensional analog of the quantum bit error rate (QBER) in binary-encoded QKD; it is the fraction of symbols that were encoded and decoded using the same basis but whose values do not match. The remaining signal-intensity symbols are input to first an error-correction code, and then to a privacy amplification code, both of which sacrifice a portion of the symbol sequence, resulting in a shorter, error-free sequence of symbols shared between Alice and Bob and secret from any eavesdropper, up to an agreed upon probability of failure ε s [33][34][35].
The secret key rate K, in bits/s, is the product of the detected photon rate R p , in counts/s, and the secure photon information efficiency r, in bits. The value of R p is ultimately limited by the receiver saturation rate. The value of r is a function of the alphabet size M, the SER -which depends upon the pulse width and real-world system fluctuations and disturbances, the operating point choices of {P µ , P ν , P T , P E }, the efficiency of the error correction code, and the agreed-upon value of ε s . The details of how these factors determine r are discussed in the Appendix and also in [27,31,33]. The value of M is, in turn, limited by the worst timing resolution of either the transmitter or the receiver system. The operating point that optimizes the secret-key rate K achieves a complex balance between the conflicting goals of sharing maximum information between Alice and Bob and sharing minimum information with Eve -while operating within the constraints of the system hardware and real-world system fluctuations and disturbances.

Experimental system and demonstration
The implemented transmitter used a superluminescent diode (InPhenix) with tens of nanometers of optical bandwidth which was filtered to 25 GHz (0.2 nm), centered at 1559 nm, by a tunable bandpass filter. This continuous beam was modulated by a lithium niobate electro-optic modulator (JDSU) controlled by a PPM sequence produced by a 12.5 GHz pulse pattern generator (PPG; Anritsu). Preparing in the time-basis was performed by using this output pulse sequence, whereas preparing in the energy-basis was performed by inserting a dispersion module with 10,000 ps/nm of GVD (Proximion). Preparing in the signal or decoy intensities consisted of manually adjusting a variable optical attenuator (VOA; JDSU) to give µ = 0.5 photons/pulse for signal intensities, or ν = 0.05 photons/pulse for decoy intensities. These intensity values were chosen to maximize R p while maintaining security. An optical circulator was included at the output of Alice's transmitter for protection against Trojan horse attacks [36].
The receiver used superconducting-nanowire single-photon detectors (SNSPDs), made of niobium nitride (NbN), capable of detecting hundreds of millions of photons per second with 68% detection efficiency and dark count rates of several thousand per second [37]. The timing resolution was 50 − 100 ps. The receiver timing resolution limits the minimum time-slot duration that the transmitter can use. The SNSPD system had a single optical fiber coupled to four interleaved nanowires, which were individually read out by a commercial time-to-digital converter (Picoquant Hydraharp 400). This interleaved nanowire structure is functionally equivalent to a passive 1x4 optical splitter followed by four individual detectors. The time-to-digital converter had a dead time of 70 − 80 ns per channel, which gave the receiver system a saturated detected pulse rate of about 50 MHz. Measurements in the time basis were performed by sending the received pulses directly to the SNSPD system, whereas measurements in the energy basis were performed by inserting a dispersion compensation module with -10,000 ps/nm of GVD (Proximion) just before the SNSPD system. The insertion loss of the dispersion compensation module was 4 dB. There were some additional losses, totaling 6 dB, in the receiver due to lossy optical connectors and the blocking effects of high photon flux on the SNSPDs.
The system performance was characterized over three channel configurations, referred to as: the back-to-back configuration, the fiber-spool configuration, and the deployed-fiber configuration. The back-to-back configuration had the transmitter and the receiver in the same laboratory, connected by a short patch cable with 0.1 dB loss. The fiber-spool configuration had the transmitter and the receiver in the same laboratory, connected by a 41-km spool of standard SMF-28 single-mode fiber with 7.6 dB loss. The deployed-fiber configuration had the transmitter and the receiver located in physically separate laboratories, connected by a 43-km span of deployed telecom fiber with 12.7 dB loss.
This deployed fiber channel is one of pair of dark fibers running parallel to each other between MIT and Lincoln Laboratory, as illustrated in Fig. 2. This channel was subject to significant realworld temperature fluctuations and acoustic perturbations which introduced relative timing drifts between the transmitter and the receiver, thereby degrading the DO-QKD protocol performance by obscuring the timing correlations. This effect was mitigated by including out-of-band, periodic optical synchronization pulses sent from the transmitter and detected at the receiver with a linear photodiode to act as a shared timing reference.
In the fiber-spool and deployed-fiber configurations, the long fibers introduce additional GVD, which degrades the timing correlations between Alice's prepared pulses and Bob's measured pulses. This GVD is precompensated using a spool of dispersion-compensating fiber in the transmitter.
Four different PPM alphabet sizes were used, M ∈ 4, 8, 16, 32. For all M, the time-slots were 240 ps long, corresponding to a system clock rate of R c = 4.17 GHz, which was chosen to be approaching the maximum clock rate supported by the receiver system. The high-speed capabilities of the transmitter allowed the actual optical pulses contained within the time-slots to be 50 ps long, which reduced the SER by mitigating the effects of intersymbol interference. Each symbol-frame comprised the alphabet M time-slots followed by two empty guard time-slots. The transmitted symbol rate was then R c /(M + 2), and the detected frame rate was the product of the transmitted symbol rate, the average transmitted photon number, and the channel transmission.
The DO-QKD secret-key rate capabilities of the three channel configurations were characterized by taking large data sets for the two preparation bases, the two measurement bases, and the two pulse intensities, separately. An optimized secret-key rate capability was then determined for a combined data set, consisting of 10 9 received pulses, by numerically optimizing the values of P µ and P T to maximize the secret-key rate. This analysis used security parameter ε s = 10 −10 and a multi-layer low-density parity-check (LDPC) code [38] for error reconciliation.

Results
In the back-to-back configuration, the maximum secret-key rate capability was 23 Mbps with M = 16. In the fiber-spool configuration, the maximum secret-key rate capability was 5.3 Mbps with M = 8. In the deployed-fiber configuration, the maximum secret-key rate capability was 1.2 Mbps with M = 4. Table 1 summarizes the optimum rate cases for the three channel configurations. Figure 3(a) plots these experimental results along with theoretical secret-key rates as functions of channel loss. In Fig. 3(a), there is a data point and theoretical curve corresponding to the optimal alphabet size for each of the three channel configurations. The three channel configurations each had slightly different measured timing correlation values and each theoretical curve was computed using the corresponding measured values; thus, we should not directly compare the curves to determine the universally optimal alphabet size for a given loss. For a given channel configuration, however, we can determine the optimal alphabet size. To further illustrate this point, Fig. 3(a) also includes a theoretical curve showing the performance for M = 2 over the deployed fiber channel. For these channel losses and timing correlation values, choosing M = 4 outperforms M = 2. Figure 3(b) displays the secret-key rate capabilities obtained for each alphabet size in the three test cases, showing that the optimal alphabet size increases as the loss decreases.

Discussion
High-dimensional encoding can improve the rate or efficiency of quantum information processing, compared to binary encoding. Here, we have used high-dimensional encoding in quantum key distribution to mitigate the effects of receiver bottlenecks. For receiver-limited scenarios, such as relatively low-loss metro-scale fiber links, high-dimensional DO-QKD allows us to increase the realizable secret-key rate by adjusting the alphabet size.
The optimal M to maximize the secret-key rate depends most strongly on Bob's received photon rate, which is in turn a function of channel loss and also of the transmitted symbol rate. If Bob had an ideal receiver, the highest secret-key rate would be obtained for the fastest transmitted  Each theoretical curve is based on the experimental parameters (e.g., detector timing jitter) observed in the corresponding the channel configuration. The theoretical secret-key rate for M = 2 over the deployed fiber channel is also plotted for reference. (b) Experimental secret-key rates for all alphabet sizes of each channel configuration. Loss increases from left to right. The optimal M increases as loss decreases. For experimental convenience, we did not increase the alphabet size once it became apparent that doing so would not increase the secret-key rate. symbol rate, which occurs for M = 2. However, Bob's receiver hardware is usually rate-limited. The limit may be due to the single-photon detectors themselves; for instance, SNSPDs exhibit reset times ranging from a few nanoseconds [37,[39][40][41] to several tens of nanoseconds [22,41,42], depending on the choice of superconductor. The readout electronics can also limit the receiver count rate, as is the case for the commercial time-tagger in our system and also for the high-rate BB84 demonstration of [1]. When Bob's receivable photon rate is limited, increasing M to values greater than two allows Alice and Bob to effectively produce secret keys even during the reset time. Thus, at short distances and correspondingly low losses, we can expect a bottleneck due to the maximum count rate of Bob's receiver. In this receiver-limited regime, it is advantageous to increase M to encode as much information as possible in each detected photon while keeping the receiver near saturation. Our receiver saturated at received photon rates around 50 Mcps, but the transmitted symbol rate for M = 2 was greater than 1 Gcps. For the channel configurations we examined, the channel losses were insufficient to prevent the receiver from saturating at such high transmitted symbol rates. To prevent saturation, we also needed to reduce the transmitted symbol rates by increasing M, and Fig. 3(b) demonstrates that the optimal M increased as channel loss decreased.
It should be noted that although we did not perform fast basis or intensity switching in our demonstration, the addition of such steps would not affect the demonstrated rate capabilities of the system. At the transmitter, basis switching can be done by adding a fast switch; any loss incurred can be compensated by adjusting the transmitter's variable attenuator. Intensity switching can be done by programming the transmitter's variable attenuator. At the receiver, basis switching can be done by adding a passive beamsplitter and a second detector unit. Additionally, our transmitted PPM sequence relied upon a predetermined pseudorandom stream, allowing us to fully characterize our system. The use of a high-quality random number generator would not affect the demonstrated rate capabilities of the system. Finally, the magnitude of the applied GVD should vary with M in order to stretch the pulse across the full temporal duration of the symbol-frame. For these proof-of-principle experiments, we were limited to a single pair of normal/anomalous GVD elements whose magnitude, 10,000 ps/nm, is approximately the median required value for the M considered in our demonstration.
An alternate strategy to mitigate the effects of the receiver's dead time involves using either a passive splitter or an active switching system [43,44] to distribute the incoming photons between a larger number of single-photon detectors. However, this approach can be resource-intensive, as it requires multiple detectors and readout channels and, for the active case, a switching system that is both fast and low-loss. The switching rate must match the incoming photon rate, and the loss must be low enough such that the resulting secret-key rate is higher than what could be obtained using high-dimensional encoding. Switches with both of these characteristics are not available. Additionally, it is likely that practical, deployed systems will be subject to size, weight, power, and cost constraints, further making the alternate strategy of adding a bank of detector systems unfeasible. In contrast, high-dimensional encoding does not significantly increase the receiver hardware complexity or cost because the high-dimensional decoding is performed by software.
The high-dimensional time-energy encoding investigated here offers the ability to optimize the secret-key rate by varying the alphabet size M in response to both receiver capabilities and channel loss. This is most beneficial when Bob's receiver is saturated, which often occurs over metropolitan-area distances of tens of kilometers. We have demonstrated the secret-key rate capabilities of a high-dimensional, prepare-and-measure QKD protocol over different channel losses, both in the laboratory and over a 43-km deployed telecom fiber, and shown that as the channel loss decreases, the optimal alphabet size increases. These proof-of-principle experiments demonstrate the benefits of a QKD scheme designed to adapt to the constraints of a particular link implementation, representing a strategy for optimizing high-rate secure quantum communication in metropolitan areas.

A. Secure photon information efficiency
In this appendix, we briefly describe the secure photon information efficiency r. The secure photon information efficiency quantifies Alice and Bob's information advantage over Eve, who we assume can mount arbitrary collective attacks. In the asymptotic regime of infinitely long keys, the secure photon information efficiency for DO-QKD with decoy-state analysis is where βI (A; B) is Alice and Bob's reconciled mutual information, F LB µ is a lower bound on the fraction of Bob's detection events that came from a single-photon transmission by Alice, and χ UB (A; E) is an upper bound on Eve's Holevo information [27,31,45]. By measuring the covariance matrix associated with the correlation between prepared pulse time and measured pulse time [27,45] and by monitoring the quantum channel using weak-intensity decoy states [29][30][31], Alice and Bob can bound the information accessible to Eve. Any information that Alice and Bob share in excess of this bound will be secure. The decoy state measurements contribute to the estimation of both F LB µ and χ UB (A; E). In the more realistic regime of finite-length keys, Eq. (1) is true except with a finite failure probability that corresponds to the predetermined security parameter ε s [33][34][35]. Operationally, ε s is the tolerated failure probability of the entire protocol, where failure means that at the conclusion of the protocol and unbeknownst to Alice and Bob, Eve holds information about the output key. In practice, the failure probability quantifies the effects of finite sample sizes on error correction, privacy amplification, and parameter estimation [35]. The parameters related to decoy states are also affected in the finite-key regime [33]. Table 2 lists numerical values of these security-related parameters for the three channel configurations. We also note that recent theoretical work has extended the security of DO-QKD to hold against general attacks [28].