Simple Quantum Key Distribution with qubit-based synchronization and a self-compensating polarization encoder

Widespread adoption of Quantum Key Distribution (QKD) in current telecommunication networks will require the development of simple, low cost and stable systems. Current QKD implementations usually include separate sub-systems to implement auxiliary tasks such as temporal synchronization and polarization basis tracking. Here we present a QKD system with polarization encoding that performs synchronization, polarization compensation and QKD with the same optical setup without requiring any changes or any additional hardware. Polarization encoding is performed by a self-compensating Sagnac loop modulator which exhibits high stability and the lowest intrinsic QBER ever reported by an active polarization source fully implemented using only commercial oﬀ-the-shelf components. We tested our QKD system over a ﬁber-optic channel, tolerating up to 43 dB of total losses and representing an important step towards technologically mature QKD systems.


I. INTRODUCTION
A major challenge for today's communication networks is to ensure safe exchange of sensitive data between distant parties.However, the rapid development of quantum information protocols towards the quantum computer [1], poses a substantial threat for current cybersecurity systems.In fact, quantum routines such as Shor's factorization algorithm [2][3][4] could potentially render today's cryptographic schemes obsolete and completely insecure.Fortunately, Quantum Key Distribution (QKD) represents a solution to this catastrophic scenario.By leveraging on the principles of quantum mechanics and the characteristics of photons, QKD allows two distant parties, conventionally called Alice and Bob, to distill a perfectly secret key and bound the shared information with any adversarial eavesdropper [5].Furthermore, QKD is an interesting solution for applications requiring long term privacy since algorithmic and technological advances for both classical and quantum computation do not threaten the security of keys generated with QKD.
Since its first proposal by Bennet and Brassard in 1984 [6], QKD has received much attention and several experiments have shown its feasibility by exploiting different photonic degrees of freedom in free-space, optical fiber, or even satellite links [7][8][9][10][11][12][13][14][15][16][17].Recent developments have focused mainly in rendering QKD implementations simpler and more robust, aiming for compatibility with standard communication networks and widespread usage.This has led, for example, to the introduction of selfcompensated modulators for different photonic degrees of freedom such as time-bin [18], mean photon number [19], and polarization [20], all based on Sagnac interferometric configurations.Also, simpler QKD protocols have been introduced such as a three-state and one-decoy state version of the BB84 protocol which simplifies the requirements of the quantum state encoder [21] and can provide higher rates in the finite-key scenario [22].
A critical aspect of QKD systems is the distribution of a temporal reference between the transmitter (Alice) and the receiver (Bob).This is crucial for at least two reasons.First, it allows to discriminate between the quantum signal and the noise introduced by either the quantum channel or detector defects.Secondly, it allows to correlate the qubit sequence transmitted by Alice with the detection events recorded by Bob.This correlation enables the distillation of the quantum secure cryptographic key.The transmission of the temporal reference is usually achieved by optically sending a decimated version of Alice's clock.This requires the use of a secondary fiber channel [23], or complex time or wavelength multiplexing schemes to separate the quantum information from the classical light pulses [11].Also, Global Navigation Satellite Systems (GNSS) can be used to synchronize Alice and Bob since these systems can give precise temporal references [17,24,25].All these approaches, however, add complexity to the QKD implementations.
Polarization-encoded QKD in fiber-optic links has been studied to great extent, mainly encouraged by the simplicity of the receiver, which can be completely passive and requires only standard components [21,23,26,27].Unfortunately, this type of link has an important drawback given by the natural birefringence of optical fibers, which causes the polarization state of transmitted photons to change continuously and in an unpredictable fashion [28].Several approaches have been conceived to counteract these random polarization drifts, most of them requiring auxiliary laser pulses and complex time or wavelength multiplexing schemes [29], which add unwanted complexity to the QKD setups.A different approach was introduced by Ding et al. that used the revealed portion of the sifted key [30], produced during the error correction and privacy amplification procedures, to detect and compensate the polarization drifts of the fiber link.
Here we present a simple polarization encoded QKD experiment exploiting a 26 km fiber-optic link and using the simplified three-state and one-decoy (two intensity levels) protocol proposed by Grünenfelder et al. [21].The QKD source is comprised of the POGNAC polarization modulator, which exhibits high stability and a low intrinsic Quantum Bit Error Rate (QBER) [20].The temporal synchronization is performed using the Qubit4Sync method, with no need for auxiliary time reference, by sending a public qubit sequence at preestablished times [31].Predetermined qubit sequences are also exploited to monitor and compensate the polarization drift introduced by the 26 km of optical fiber, with an approach somewhat similar to the work of Ding et al. [30].The reduced complexity of both the transmitter and the receiver, as well as the robustness and stability demonstrated by our implementation, represent an important technological step towards mature QKD systems.

II. SETUP
The experimental setup is sketched in Fig. 1.A gainswitched distributed feedback (DFB) laser source outputs a 50 MHz stream of phase-randomized pulses with 270 ps of full-width-at-half-maximum temporal duration at 1550 nm wavelength.The light pulses first pass through a Lithium Niobate intensity modulator (IM) used to set the intensity levels required by the decoystate method.The pulses then enter the POGNAC polarization modulator (see Ref. [20] for a full description) realized using only standard commercial off-theshelf (COTS) fiber components.
The photons emerge from the POGNAC with a polarization state given by where the phases φ e and φ can be set by carefully timing the applied voltage on a Lithium Niobate phase modu-lator (φ-Mod).This was achieved with the Zynq-7000 ARM/FPGA System-on-a-Chip (SoC, manufactured by Xilinx), which in our implementation overlooks the operation of the QKD source.
If no voltages are applied by the SoC, the polarization state remains unchanged, i.The optical pulses then encounter a variable optical attenuator (VOA) which weakens the light to the single photon level.A 99:1 beam splitter (BS) is used to estimate the intensity level of the pulses: the 1% output port is directed to a gated InGaAs/InP Single Photon Avalanche Diode (SPAD, manufactured by Micro Photon Device Srl [32]), while the other output port is directed to Quantum Channel (QC).In our implementation the QC is formed by a 26 km spool of G.655 dispersion-shifted fiber with 0.35 dB/km of loss followed by a VOA.This VOA allows us to introduce further channel loss in order to test our system's resilience.
Alice sends key-generation states with probability p Z A = 0.9 (p X A = 0.1), while the two intensity levels are µ 1 ≈ 0.80 and µ 2 ≈ 0.28, which are sent with probabilities p µ1 = 0.7 and p µ2 = 0.3 respectively.These parameters are close to optimal according to our simulations and Ref. [22].The random bits used to run the protocol are obtained from the Source-Device-Independent quantum random generator based on optical heterodyne measurements described in Ref. [33].
The fiber receiving setup consists of a 90:10 fiber BS setting the detection probabilities of the two measurement bases to p Z B = 0.9 and p X B = 0.1.Each output arm of the BS is connected to an automatic polarization controller (APC) and a polarizing beam splitter (PBS).The four outputs are sent to four superconductive nanowire single-photon detectors (SNSPDs, manufactured by ID Quantique SA) cooled to 0.8 K.The detection efficiencies are around 85% for the detectors in the Z basis, whereas it is 90% and 30% for the |+ and |− detectors, respectively.As discussed in Refs.[17,34], some events are randomly discarded in post-processing to balance the different efficiencies.All the detectors are affected by about 200 Hz of free-running intrinsic dark count rate.The SNSPD detections are recorded by the quTAG time-todigital converter (TDC, manufactured by qutools GmbH) with 1 ps of temporal resolution and jitter of 10 ps.

A. Syncronization
In this work, we use the Qubit4Sync algorithm to synchronize Alice and Bob's clocks using the same qubits exchanged during the QKD protocol.This means that the setup does not need any synchronization subsystem, which is usually implemented with a pulsed laser or GNSS clock to share an external time reference.The synchronization method is described in detail in Ref. [31].
Here we report the main features of the algorithm.The synchronization is done in post-processing, adjusting the times in which Bob expects to receive the qubits from Alice.For this, Bob needs to determine at which frequency (in his time reference) the qubits are arriving at the detectors and the absolute time in which the first qubit should arrive.Our approach is to compute the frequency from the time-of-arrival measurements.To recover the absolute time, we send an initial public string encoded in the first L states.By correlating this string with the one received by Bob, it is possible to distinguish which state received by Bob is the first one sent by Alice, hence the absolute time of the first qubit.This is the typical technique used for instance by the GPS receiver to synchronize with the satellite signal [35].The novelty we introduce is a fast correlation algorithm requiring lower computational cost than the algorithms based on sparse fast Fourier transform.This allows us to calculate, in real-time, the position of the maximum correlation peak of long synchronization strings, which are required to cope with the high losses of a quantum channel.

B. Polarization compensation scheme
Mechanical and temperature fluctuations lead to variations in the natural birefringence of fiber optics, transforming the polarization state of the photons that travel through the fiber.This transformation is troublesome for QKD since it causes Alice and Bob to effectively have different polarization reference frames.As a consequence of this mismatch the QBER increases, lowering the Secure Key Rate (SKR) up to the point where no quantum secure key can be established.To prevent this a polarization compensation system must be utilized.
Here we propose a polarization compensation scheme that exploits a shared public string, not necessarily related to the synchronization string.Every second, the shared string of 10 6 states is transmitted by Alice en-coded using weak coherent pulses in the Z basis with µ 1 intensity.Bob detects the sequence and after performing the temporal synchronization routine he estimates the QBER of his recorded sequence.Bob still has to estimate the X basis QBER.For this purpose, at the end of each interval Alice reveals the basis used to encode the QKD qubits that follow the public string.This process is actually the standard reconciliation procedure of QKD.Since in this protocol only one state is transmitted in the X basis, Bob can immediately estimate the QBER.
The estimated QBER values are then fed into an optimization algorithm which controls the APCs of Bob's setup.The APCs in our setup have 4 different piezoelectric 1-D actuators, alternately at 0 • and 45 • to the horizontal plane, that stress and strain the optical fibers, changing the polarization of the light that traverses them [36].Our optimization algorithm loops through the 4 actuators sequentially.At each round, the position of an actuator is changed with a step size proportional to the measured QBER.If such change causes a reduction in the measured QBER, our algorithm keeps changing the position of the same actuator in the same direction, always with a step size proportional to the measured QBER.Instead, if an increased QBER is measured the algorithm reverses the direction of motion for the actuator.Only one reversal is permitted per round, after which the next actuator is selected and a new round begins.
Compared to the approach of Ding et al. [30], our approach has the advantage that only the reconciliation step is required to obtain sufficient information to run the polarization compensation algorithm.This allows for a greater tracking speed which is necessary to stabilize links with polarization drift of few Hz bandwidth.Also, the length of the shared string and its transmission frequency can be changed to best match the requirements of the fiber optical link.Furthermore, the public string can be transmitted in an interleaved fashion together with the QKD qubits at predetermined times.

A. POGNAC intrinsic stability and low QBER
In Fig. 2, the intrinsic stability of our QKD polarization source is reported.This measurement was performed by sending a pseudo-random qubit sequence of {|0 , |1 , |+ } states and measuring the QBER of the sifted string recovered by Bob.To remove all fluctuations not attributable to the source, the QC was bypassed.Furthermore, the 90:10 BS was replaced with a 50:50 BS in order to have comparable statistics for both measurement bases.Every second the QBER was estimated for both the Z key-generation basis and the X control basis.In 45 minutes an average QBER of Q Z = 0.07 ± 0.02% was measured for the Z basis while the average QBER for the X was Q X = 0.02 ± 0.01%.These measurements corroborate the results of Ref. [20] and demonstrate in-FIG.2. Intrinsic Stability of the POGNAC source at 50 MHz repetition rate.The average QBER measured for the keygeneration basis was QZ = 0.07 ± 0.02% (dashed red line) while an average QX = 0.02 ± 0.01% (dashed green line) was measured for the control basis.
trinsic stability of the POGNAC polarization modulator.Furthermore, with over 30 dB of extinction ratio between orthogonal states, the average QBER here reported is, to the best of our knowledge, the lowest for any active QKD source fully implemented using exclusively COTS components.

B. Polarization drift compensation with 26 km of optical fiber
To test our polarization drift compensation algorithm we performed a 6 hour long run with the QC including both a 26 km optical fiber spool and ≈ 10 dB of additional attenuation set by the VOA.
On average, the detected bits of the shared polarization compensation string in the Z basis were ≈ 8 × 10 3 while the sifted bits from the control basis were ≈ 3×10 3 .This allowed to correct the polarization drift with an average QBER measured for the key-generation basis of Q Z = 0.3 ± 0.1% while an average Q X = 0.2 ± 0.1% for FIG. 3. QBER Measurment for a 6 hour long acquisition along a 26 km optical fiber channel.The average QBER measured for the key-generation basis was QZ = 0.3 ± 0.1% (dashed blue line) while an average QX = 0.2 ± 0.1% (dashed yellow line) was measured for the control basis.the control basis, for six hours of continuous operation.The results are reported in Fig. 3.After the experimental run, we noted a lower detection efficiency of 45% for the detectors of the Z basis.This was due to a nonoptimal polarization rotation of the photons entering the SNSPD detectors, which are polarization sensitive.This reduced detection efficiency did not hamper the polarization drift compensation algorithm demonstrating its robustness even in non-optimal conditions.

C. QKD secure key rate for different channel losses
To test the performances of our simple QKD system with qubit-based synchronization and self-compensating polarization encoder, as well as its resistance to channel losses, several runs were executed each with increased losses.The losses were added increasing the attenuation of the VOA after the 26 km of fiber.As before, a pseudorandom qubit sequence of {|0 , |1 , |+ } was transmitted at a repetition rate of 50 MHz, where the first L qubits of the sequence formed the publicly known synchronization string.For each run the SKR was calculated in the asymptotic limit: , where t is the duration of each acquisition, h(•) is the binary entropy, f = 1.06 is the Shannon inefficiency of typical error correction algorithms, while s Z,0 and s Z,1 are the lower bounds on the number of vacuum and single-photon detections in the Z basis, calculated as in Ref. [22] but without finite-key corrections.The results are presented in Fig. 4.
As shown in Ref. [31], if the background and dark counts are not considered, the synchronization can be established up to 40 dB of total channel losses with L = 10 6 .A longer string, with L = 10 7 , could be used to synchronize up to 50 dB of losses.In our experiment, the presence of dark counts lowers the bounds by about 6 dB.Indeed, using a synchronization string of length L = 10 6 , we performed several QKD runs with losses up to 34 dB.With L = 10 7 , we successfully ran QKD protocols up to the channel loss at which the key rate drops to zero.In the QKD run with highest losses, we achieved a secure key rate of 80 bits per second at 43 dB total channel losses, corresponding to about 215 km of SMF28 fiber (0.2 dB/km) or 253 km of ultralow-loss fiber (0.17 dB/km).It is important to note that our QKD implementation withstands up to 44 dB of total channel loss, as reported in the SKR ∞ simulation of Fig. 4. Our results prove that the Qubit4Sync method properly works even at the highest losses tolerated by our QKD implementation.

IV. CONCLUSIONS
Here, we have presented a simple polarization encoded QKD implementation with qubit-based synchronization and a self-compensating polarization modulator.Its simple design reduces the complexity for both the QKD transmitter and receiver.In fact, the same optical setup is used for three different tasks, i.e. synchronization, polarization compensation and QKD, without requiring any changes of the working parameters of the setup or any additional hardware.The QKD transmitter shows high intrinsic stability and the lowest average QBER ever reported for an active polarization source developed using only COTS components.The SKR in the asymptotic limit was assessed for a 26 km fiber-optic channel with additional channel losses resulting in 80 secure bits per second at 43 dB of total channel losses, demonstrating resilience to high channel losses for both our QKD implementation and the Qubit4Sync algorithm.The simplicity of our QKD implementation renders it compatible with many different scenarios, ranging from urban QKD fiber links [37] to free-space satellite QKD links via Cube-Sats [38], where a small footprint and low energy consumption are of critical importance.Our implementation is particularly promising for free-space QKD [10,11,17] since polarization is not significantly affected by atmospheric propagation [39] and long term stability is required, especially for links with satellites in Medium Earth Orbit [40] or part of a GNSS constellation [41].

FIG. 4 .
FIG.4.Sifted and secure key rate as a function of total channel losses.The crosses represent the experimental runs performed with the Qubit4Sync method, while the lines show the results of our simulation based on the physical parameters of our experiment.Error bars are standard deviations, obtained by simulating 1000 repetitions of the experiment.