Experimental demonstration of Gaussian protocols for one-sided device-independent quantum key distribution

Nonlocal correlations, a longstanding foundational topic in quantum information, have recently found application as a resource for cryptographic tasks where not all devices are trusted, for example in settings with a highly secure central hub, such as a bank or government department, and less secure satellite stations which are inherently more vulnerable to hardware"hacking"attacks. The asymmetric phenomena of Einstein-Podolsky-Rosen steering plays a key role in one-sided device-independent quantum key distribution (1sDI-QKD) protocols. In the context of continuous-variable (CV) QKD schemes utilizing Gaussian states and measurements, we identify all protocols that can be 1sDI and their maximum loss tolerance. Surprisingly, this includes a protocol that uses only coherent states. We also establish a direct link between the relevant EPR steering inequality and the secret key rate, further strengthening the relationship between these asymmetric notions of nonlocality and device independence. We experimentally implement both entanglement-based and coherent-state protocols, and measure the correlations necessary for 1sDI key distribution up to an applied loss equivalent to 7.5 km and 3.5 km of optical fiber transmission respectively. We also engage in detailed modelling to understand the limits of our current experiment and the potential for further improvements. The new protocols we uncover apply the cheap and efficient hardware of CVQKD systems in a significantly more secure setting.

Quantum systems have information theoretic properties that include both extensions and limitations with respect to their classical counterparts.On the one hand quantum systems can exhibit entangled correlations whose strength exceeds all classical limitations [1], while on the other hand the uncertainty between complementary observables must obey fundamental quantum relations [2].By considering entropic versions of these uncertainty relations [3][4][5][6][7] an intimate connection between entanglement and uncertainty has recently been derived [8,9].In principle this has been know since the seminal work of Einstein, Podolsky and Rosen (EPR) [10] but was only recently quantified to derive an entropic uncertainty relation including the possibility of quantum correlations [8].
Beyond fundamental interest, Ref. [8] demonstrated the usefulness of such relations by compactly re-deriving the secret key rate for the BB84 discrete variable quantum key distribution (DVQKD) protocol.The derivation of similar relations for the smooth min-and max-entropies [11], which are appropriate in the non-asymptotic setting, eventually resulted in finite-size bounds for DVQKD that are both general and tight [12].Furthermore, security proofs of device independent (DI) QKD protocols, in which stronger subsets of quantum correlations are used to remove the requirement for the experimental devices themselves to be trusted [13][14][15], have also proved amenable to these entropic relations [16].Finally, entropic relations also naturally lend themselves to situations where only one party's devices are untrusted.This possibility, first noted in [11] was subsequently used to prove the security of an experimentally challenging, but feasible, proposal for one-sided device independent (1sDI) DVQKD protocols which are strongly related to the concept of EPR steering [17].An extension Ref. [11] to the infinite dimensional Hilbert spaces relevant for CV-QKD [33] has also been applied to propose a discretised 1sDI-CVQKD protocol that accounted for finite-size effects [18,19] and a demonstration of scheme independent of Bob's devices only, has recently been carried out [20].
In this Letter we pursue the study of device independence for CVQKD and show that the hardware advantages that drastically improve the ease of detection-loophole free steering tests [24][25][26], also render 1sDI-CVQKD practical in the near term.Firstly we briefly review progress in entropic uncertainty relations and find culminating in a recently derived uncertainty relation for continuously valued measurements on infinitedimensional systems, e.g.position and momentum measurements of a harmonic oscillator [27,28].This relation was independently found by [29] although the latter derivation is incomplete.Applying this relation to the entire family of Gaussian CVQKD protocols we find that the consequent bounds are quite loose with respect to existing results.However, analysing these bounds from the perspective of one-sided device independence, we find that several of the protocols considered are in fact inherently 1sDI, with the key rate displaying an elegant connection to the relevant steering parameter.An analysis of their performance over realistic channels shows that 1sDI-CVQKD protocols are feasible, reasonably robust to losses, and hence more practical than their discrete variable counterparts.We also demonstrate the surprising result that 1sDI-CVQKD is possible, albeit over a more limited range, using only coherent states.
Entropic uncertainty relations for continuous variable systems.-Originally,entropic uncertainty relations were derived assuming one starts without any additional information or with only classical information describing the system in question, i.e. the density matrix [3][4][5][6][7].The more general case, allowing for quantum side information, was derived in [8] though only for finite dimensional Hilbert spaces and observables with a discrete spectrum, and proceeds as follows.Consider a pair of observables {x A , pA } with a complementarity c = max p A ,x A | x A |p A | 2 where {|x A , |p A } are the eigenvectors of the observables.These are to be measured on a state A which is potentially entangled with another state, B, leading to the the following relation for the uncertainty in the pair of observables including access to B [8], Here S(A|B) = S(AB) − S(B) where S(X) = −tr (ρ X log ρ X ) is the conditional von Neumann entropy of the state ρ AB whereas S(x A |B) is the conditional von arXiv:1405.6593v2[quant-ph] 10 Sep 2014 Neumann entropy of the observable x A measured on A given by, with H(x A ) = − x A p(x A ) log p(x A ) the classical Shannon entropy.Preempting applications to QKD, one can also consider that the state ρ AB could have suffered some decoherence which is purified by an environment, or eavesdropper, such that ρ AB = tr E (|ABE ABE|).Using the purity of the overall state (i.e.S(AB) = S(E)) one can recast (1) to find [8], These results have since seen several generalisations both to different entropies and to positive-operator values measurements (POVM's) {X i A , P j A } [11,30,31] for ∞ where ||A|| ∞ = max ψ ψ|A |ψ is the infinity or operator norm.However, these results are only valid for measurements with a finite number of discrete outcomes made on states living in a finite-dimensional Hilbert space.For the purposes of CVQKD we will require an uncertainty relation valid for infinite-dimensional Hilbert spaces and continuousvalued measurements.In particular, we are interested in homodyne measurements of the canonically conjugate quadratures x = â+â † , p = i(â † −â) satisfying [x, p] = i where = 2 and â and â † are bosonic creation and annihilation operators.
Just such a relation has been recently developed, building an earlier result for discrete variables on infinite dimensional Hilbert spaces [33] which was first extended to countably infinite measurements which could then be applied by to a discretised version of a homodyne detection [27].Deriving results for continuous spectra by taking infinite precision limits these coarse-grained POVM's had previously been extensively studied for the Shannon entropies [34][35][36][37], and an analogous procedure for the quantum conditional von Neumann entropy was utilised by Ferenczi [29] and Berta et al. [27] although the former proof is incomplete.An alternative derivation was also provided by Frank and Lieb [28].The final result is the following relation for homodyne detection upon infinite dimensional Hilbert spaces [27][28][29], Application to CVQKD.-The most common CVQKD protocols are the Gaussian state protocols which encode information in the quadratures of the optical field which are described exactly by operators like x and p described above.One can use squeezed [38,39] or coherent [40] states, and measure with either homodyne detection, switching between quadratures, or heterodyne detection [41,42] where both are measured simultaneously.One could also use Gaussian entangled states [43] and these approaches have been shown to be equivalent [44].The communicating parties, called Alice and Bob in this context, can also use either a direct reconciliation (DR) scheme where Alice sends corrections to Bob or a reverse reconciliation (RR) [45] which allows for losses above 50%.One can also achieve this loss-tolerance via a post-selection protocol which discards some of the key in order to retain a more correlated subset [46].
Previous work proved the security of CVQKD in the asymptotic limit against individual [40-42, 45, 46, 46] and collective [47-53, 56, 57] attacks.Finally the proofs were raised to the level of the most general coherent attacks by use of the de Finetti theorem [54] adapted to infinite dimensions [55] which shows that collective attacks are in fact optimal.
Neglecting detector and reconciliation efficiencies one can show that the RR secret key rate is lower bounded by [52,53,58], where denotes the classical mutual information between Alice and Bob, with H(x) = dx p(x) log p(x) being the continuous Shannon entropy of the measurement strings and is the Holevo bound.Substituting (A2) and (A3) in (A1) and comparing with (A4) we have, Substituting the uncertainty relation (3) and recalling that S(p Thus we have bounded the secret key by an expression that depends only upon the conditional Shannon entropies and the complementarity of the measurements, both of which are directly accessible to Alice and Bob.Furthermore one can show via a variational calculation that for any probability distribution p(x) the corresponding Shannon entropy is maximised for a Gaussian distribution of the same variance.In other words, Alice and Bob can bound their secret key rate for this protocol by measuring Bob's conditional variance.Substituting the Shannon entropy for a Gaussian distribution [59] and c = 1/4π we arrive at a final expression for the key rate of with the DR expression obtained by simply permuting the labels of Alice and Bob.This result was also calculated in Ref. [29], however the proof there was incomplete as it relied on the assumption of the applicability of the entropic uncertainty relation.Moreover, it was incorrectly concluded that this method would never predict positive key for coherent state or heterodyne protocols.
In fact, the extension to the other Gaussian protocols is straightforward and given in the Appendix.For example the key rate for the DR protocol with coherent states and homodyne detection is given by Unfortunately these bounds are actually more pessimistic than previous results [52,53] as the uncertainty relation becomes quite loose in the relevant case of large losses.Nonetheless for some of the Gaussian protocols these bounds can be shown to allow 1sDI-CVQKD for reasonable parameters and it is to this application that we now turn.
One-sided device-independent CVQKD.-Animportant benefit of utilising entropic uncertainty relations in QKD proofs is that they lend themselves towards onesided device independent (1sDI) protocols [11,17].These are relaxed versions of fully DI schemes [13][14][15][16], in which all devices are untrusted and the security is guaranteed via a detection-loophole-free Bell violation [60].The only assumptions that need to be made are the security of the stations, the causal independence of the measurement trials and a trusted source of randomness for choosing measurement settings.For 1sDI-QKD protocols only one side, Alice or Bob, is untrusted and the security is now ensured through the recently classified steering inequalities [61].The 1sDI nature of entropic proofs is manifest in expressions like (A7) in that it depends only upon measuring a known observable upon one side.Specifically, in the derivation of (A7) we only need to know that Bob is measuring either xB or pB in order to apply the entropic uncertainty relation.Although we write expressions V x B |x A , as this is what will be measured in most experiments, Alice could be making any measurement and the security would still hold provided the conditional variance was sufficiently small.
In [17] 1sDI-DVQKD protocols are analysed and although within reach of present technology are very challenging, significantly more so than standard DVQKD as one must perform a detection-loophole-free steering test.This is difficult because on the untrusted side one cannot post-select away events where there is no single-photon detection, which necessitates high detection efficiencies [21][22][23].This is in stark contrast to the CV case, where steering is demonstrated via homodyne measurements which are unconditional and thus immune to detection loopholes.In fact it has since been shown [62] that CV steering is equivalent to the so-called Einstein-Podolsky-Rosen violation [10] which has been experimentally fea-sible for over 20 years [24] and now sees very strong violations [25,26].
For the Gaussian CV states relevant to QKD, steering is demonstrated by a violation of the condition on the conditional variances, E = V x B |x A V p B |p A ≥ 1 for Alice steering Bob [61].Comparison with Eq. (A7) shows that for the RR key rate K > 0 if and only if E < 2 e 2 ≈ 0.55, with the corresponding relation between the DR and E following straightforwardly.In other words, the condition for positive one-sided device independent key is more stringent than EPR steering, similarly to the case for DVQKD [17].Thus for EPR states and homodyne detection any positive key is by definition 1sDI, independent of Alice for RR and Bob for DR.However this device independence does not necessarily extend to the protocols involving heterodyne detection This is essentially because the proof to derive rates such as (A11) depends upon characterising the beamsplitter on the supposedly untrusted side thereby invalidating the device-independence.Alternatively, recall that a steering demonstration requires a measurement choice by the untrusted party which doesn't take place if they heterodyne detect.Nonetheless the remaining protocols, with the heterodyne detection taking place in the trusted station, are still implementable with high efficiency sources and detection opening the way to 1sDI-CVQKD protocols with current technology.This means that for real EPR states both DR and RR are secure provided all parties are homodyning, while Bob may safely heterodyne for an RR protocol and Alice may heterodyne for a DR protocol.Finally, for DR protocols where Alice, who controls the source, is trusted we may also safely make the equivalence between prepare and measure (P&M) and entanglementbased (EB) schemes.Remarkably, this means that for direct reconciliation it is possible to generate 1sDI key using only coherent states.We summarise which of the 16 possible protocols are 1sDI in Table .I.
To evaluate performance we consider a Gaussian channel, an excellent model for real fibre optic cable, characterised by a transmission T and an excess noise parameter ξ given in units of shot noise.The noise parameter can be thought of as the noise input to the channel in the sense that a pure state with variance of unity would have a variance 1 + T ξ after the channel.Neglecting imperfections such as detector and reconciliation efficiency this is the chief factor limiting range.In Fig. 1 we plot the secure regions for all 4 distinct 1sDI protocols (there are two redundancies between P&M and EB schemes).The best performing scheme is the RR EPR scheme where both parties homodyne.In the limit of low excess noise this scheme is secure for up to 73% loss.For very low noises the next best scheme is the RR protocol where Bob heterodyne detects but for higher noises the DR protocol with both parties homodyning (or alternatively where Alice sends squeezed states) performs better.Finally, although the DR coherent state scheme performs the poorest it is still secure up to around 33% loss.These results show that 1sDI-CVQKD is surprisingly robust to decoherence.To give a rough idea of the maximum range of these protocols we consider a standard optical fibre for which the transmission is related to the distance d in kilometres via T = 10 −.02d .We choose a low, but achievable excess noise of ξ = .002as measured in [72] and find that for this kind of channel the homodyne-homodyne RR EPR protocol is by far the best performing allowing for 1SDI security out to almost 30km.
Conclusions.-We have applied an entropic uncertainty relation that is valid for continuous measurements and infinite dimensional Hilbert spaces to the Gaussian CVQKD protocols and demonstrated that in the limit of infinitely long key one can derive bounds for several protocols that are one-sided device independent.Remarkably we find that even protocols based on sending coherent states can be made independent of Bob's detectors (usually the target of side channel attacks) for low-loss and low-noise channels.The protocols involving EPR states and homodyne detection were substantially more robust allowing independence from Alice's devices for up to 42% pure loss and independence of Bob's devices for up to 73% loss pure loss.Our key rates also make explicit the connection to the relevant steering parameter, confirming the link between the asymmetric nonlocality of EPR steering and the asymmetric performance of 1sDI-CVQKD protocols using different reconciliation directions.
Several comments on extensions and directions for future work are in order, beginning with the prospect for extending this security proof to include finite size effects and comparison with the results in Refs.[18][19][20].There, the authors follow a similar program of applying entropic uncertainty relations, in this case to the smooth minentropies, allowing them to account for all finite size effects while providing an extremely general proof, but only for DR homodyne protocols and are limited to short distances (5km or less) even with extremely high levels of squeezing.Very recently, an extension to RR homodyne protocols, for both the asymptotic and finite-size regimes, secure up to 15km has also appeared [19].It appears very promising then, that these techniques could be adapted to prove the finite-size security of all the other protocols presented here.
A second avenue would be to revisit the restrictions, or lack thereof, made about the eavesdropper including physical assumptions about the quantum memory available to Eve [64][65][66], which has already seen application in DI-DVQKD [67].Another candidate to further extend the range of these protocols would be the noiseless linear amplifier [68,69] which has already been proposed for application to fully DI-DVQKD [70] as well as Bell tests [71].Even more appealing may be the measurement based versions of these amplification schemes [56,57] that have recently been experimentally demonstrated [73] In light of these results it appears that several 1sDI-CVQKD protocols are within the reach of current technology and multiple possibilities exist to extend the secure range of such schemes to long distances.as mentioned before the proof relies on the assumption of the applicability of the entropic uncertainty relation to infinite dimensional Hilbert spaces.Furthermore Ferenczi argues that since for coherent states the directly measured conditional variances are always greater than 1 the above procedure would never predict a positive key rate for coherent state protocols.However this conclusion comes from a mistaken application of the key rate formulae as we now demonstrate.

b. Coherent States and Homodyne Detection
Consider a DR coherent state protocol, which in the entanglement based picture involves Alice making a heterodyne detection upon her arm of an EPR pair.Thus she first mixes her mode with vacuum resulting in two modes A 1 and A 2 upon which she measured x and p respectively.Bob is still making a homodyne detection, randomly switching between the quadratures.We will consider the case where Bob measures x, with the other case following straightforwardly.The DR key rate is then given by, After Alice's projective measurement upon A 2 the state ρ A1BE is pure and we can again apply the entropic uncertainty relation to write, Now this formula might pose a problem, in that we do not measure p upon mode A 1 , but this can be circumvented if we trust the devices, specifically the beamsplitter, in Alice's station for we then have H(p A1 |p B ) = H(p A2 |p B ) which is measured.We therefore have, For reverse reconciliation the key rate is given by, The final protocols involve Bob making a heterodyne measurement upon coherent states, or alternatively both parties making heterodyne measurements upon an twomode squeezed vacuum.Thus there are now four modes involved A 1 and B 1 upon which x is measured and A 2 and B 2 upon which p is measured.We can consider the x and p channels separately.Note that this is actually an underestimation of the key rate as it essentially allowing Eve to devote all her resources to estimating the x and p measurements separately whereas she must in fact estimate both simultaneously.The DR key rate for x is given by,

FIG. 1 :
FIG.1: Secure regions for 1sDI-CVQKD protocols for a Gaussian channel parameterised by a transmission T and excess noise ξ.For each protocol secure communication is possible for all channels above the corresponding line.Reverse and direct reconciliation schemes are plotted in red and blue respectively while a dashed line indicates a heterodyne detection by the trusted party.

TABLE I :
The 6 out of 16 CVQKD protocols that are 1sDI.The subscript indicates who's devices are untrusted, e.g.B indicates a protocol is independent of Bob's devices.The coloured line segments identify each protocol with it's loss and noise tolerance in Fig.1, with some of the protocols being degenerate between the P&M and EB versions.
A11)Once again, the quantity V p B |p A is not measured directly, but provided we trust Alice's beamsplitter we haveV p B |p A = 2V p B |p A 2 −1 allowing us to evaluate the bound.c.Squeezed States and Heterodyne DetectionThese protocols are essentially mirror images coherent state homodyne schemes since, in the EB picture, we now have Alice making homodyne measurements and Bob making heterodyne measurements.We now have Alice swapping between x and p measurements while Bob splits up his mode measuring x upon B 1 and p upon B 2 .The DR key rate is given by,K ≥ S(x A |E) − H(x A |x B1 ) ≥ log 4π − S(p A |B) − H(x A |x B1 ) ≥ log 4π − H(p A |p B ) − H(x A |x B1 ) ≥ log 2 e V p A |p B V x A |x B 1 (A12)where we will need to trust the beamsplitter in Bob's station to obtainV p A |p B = 2V p A |p B 2 − 1 from the directly measured conditional variance.The RR key rate is given by,K ≥ S(x B1 |E) − H(x B1 |x A ) ≥ log 4π − S(p B1 |A) − H(x B1 |x A ) ≥ log 4π − H(p B1 |p A ) − H(x B1 |x A ) ≥ log 2 e V p B 2 |p A V x B 1 |x A (A13)where we have again used the form of Bob's beamsplitter to write V p B 2 |p A = V p B 1 |p A .