Detector-Device-Independent Quantum Key Distribution
Charles Ci Wen Lim, Boris Korzh, Anthony Martin, Felix Bussieres, Rob Thew, Hugo Zbinden
DDetector-device-independent quantum key distribution
Charles Ci Wen Lim, ∗ Boris Korzh, † Anthony Martin, F´elix Bussi`eres, Rob Thew, and Hugo Zbinden
Group of Applied Physics, University of Geneva,Chemin de Pinchat 22, CH-1211 Geneva 4, Switzerland
Recently, a quantum key distribution (QKD) scheme based on entanglement swapping, calledmeasurement-device-independent QKD (mdiQKD), was proposed to bypass all detector side-channelattacks. While mdiQKD is conceptually elegant and offers a supreme level of security, the experimen-tal complexity is challenging for practical systems. For instance, it requires interference between twowidely separated independent single-photon sources, and the rates are dependent on detecting twophotons - one from each source. Here we experimentally demonstrate a QKD scheme that removesthe need for a two-photon system and instead uses the idea of a two-qubit single-photon (TQSP) tosignificantly simplify the implementation and improve the efficiency of mdiQKD in several aspects.
Quantum key distribution (QKD) enables the ex-change of cryptographic keys between two separatedusers, Alice and Bob, who are connected by a poten-tially insecure quantum channel [1–4]. Unlike conven-tional key distribution schemes, the security of QKD de-pends only on the principles of quantum physics and canbe proven information-theoretically secure. However, de-spite the potential of QKD, one still has to be prudentabout potential side-channel attacks that may lead to se-curity failures. For example, it has been shown that withdetector blinding techniques, it is possible to remotelyhack the measurement unit of some QKD systems [5].Although it is possible to implement appropriate counter-measures for specific attacks, one may be wary that theadversary, Eve, could devise new detector control strate-gies, unforeseen by the users.To prevent all known and yet-to-be-discovered de-tector side-channel attacks, a measurement-device-independent QKD (mdiQKD) protocol was proposed [6].In this scheme, Alice and Bob each randomly prepareone of the four Bennett Brassard (BB84) states [1]and send it to a third party, Charlie, whose role is tointroduce entanglement between Alice and Bob via aBell-state measurement (BSM) [7, 8]. Obviously, Aliceand Bob do not have to trust Charlie since any othernon-entangling measurement would necessarily introducesome noise between them. In practice, mdiQKD canbe implemented with phase-randomized weak coherent(BB84) states (WCSs), using either time-bin encodedqubits [9, 10] or polarization-encoded qubits [11, 12]. Tomeet the assumption that Alice and Bob send single pho-tons, as required by mdiQKD, they randomly vary theintensity of their laser pulses and use the decoy-statemethod [13–15] to estimate the fraction of single-photonstates sent to and detected by Charlie.Unfortunately, mdiQKD possesses many drawbacks.Firstly, the achievable secure key rates (SKR) are sig-nificantly lower compared to conventional prepare and ∗ [email protected] † [email protected] measure (P&M) QKD systems [16–19]. This is mainlybecause a two-photon BSM relies on coincidence detec-tions, meaning that the SKR scales with ( η det P ( µ )) ,where η det is the single photon detector (SPD) efficiencyand P ( µ ) is the probability of the source emitting asingle-photon [20]. Another factor is that a two-photonBSM implemented with linear optics is at most 50% ef-ficient [21–23] and, when using WCSs, the results fromone of the bases cannot be used for the raw-key gener-ation due to an inherent 25% error rate [9, 11]. Fur-thermore, the resource overhead in the finite-key sce-nario [24] is significantly larger compared to commonP&M schemes [19, 25], due to the need to apply thedecoy-state method twice (once for each source), in-creasing the statistical fluctuations. For example, at150 km, Alice and Bob would have to send at least10 laser pulses to Charlie before key distillation ispossible [24]. Finally, the technological complexity ofmdiQKD is greater due to the use of two-photon inter-ference, requiring both photons to be indistinguishablein all degrees of freedom (DOFs): temporal, polarizationand frequency.Here we report on the implementation of a QKDscheme that overcomes the aforementioned limitationsbut is still secure against all detector side-channel at-tacks. This bridges the gap between the superior perfor-mance and practicality of P&M QKD schemes and theenhanced security offered by mdiQKD. Note that a sim-ilar scheme, following the same basic idea, has been pro-posed elsewhere [26]. Our scheme, henceforth referredto as detector-device-independent QKD (ddiQKD), es-sentially follows the idea of mdiQKD, however, insteadof encoding separate qubits into two independent pho-tons, we exploit the concept of a two-qubit single-photon(TQSP). This scheme has the following advantages: (1)it requires only single-photon interference, (2) the linear-optical BSM is 100% efficient [27], (3) the secret key ratescales linearly with the SPD detection efficiency and (4)it is expected that in the finite-key scenario the minimumclassical post-processing size is similar to that of P&MQKD schemes. In the following we outline the main con-cepts and demostrate a proof-of-principle experiment. a r X i v : . [ qu a n t - ph ] O c t BSMAlice’s labSingle-photonsource Bob’s labOptical channel
FIG. 1. The conceptual setup. Alice encodes her qubit | ψ A (cid:105) p in the polarization DOF of a single photon, sends it to Bobwho encodes his qubit | ψ B (cid:105) s in the spatial DOF using a 50/50beam splitter (BS) and a phase modulator (PM). Bob thenperforms a complete and deterministic Bell-State measure-ment (BSM) on both qubits using a half-wave plate (HWP),polarizing beam splitters (PBS) and single-photon detectors(SPDs). Components inside the shaded regions of Alice andBob’s labs are trusted devices, whilst the SPDs are untrusted. The protocol works as follows; see Fig. 1. Alice firstprepares a single photon in the qubit state | ψ A (cid:105) p chosenat random from the following set of BB84 states: | ψ A (cid:105) p ∈ r | + (cid:105) = √ ( | H (cid:105) + | V (cid:105) ) , |−(cid:105) = √ ( | H (cid:105) − | V (cid:105) ) , | + i (cid:105) = √ ( | H (cid:105) + i | V (cid:105) ) , |− i (cid:105) = √ ( | H (cid:105) − i | V (cid:105) ) , where the subscript p indicates this is a qubit in the po-larization DOF of the photon. Alice sends | ψ A (cid:105) p to Bobvia an untrusted quantum channel. Upon reception ofthe photon, Bob encodes his random qubit state | ψ B (cid:105) s in the spatial DOF (hence the subscript “ s ”). To achievethis, Bob sends the photon to a 50/50 beam splitter (BS).We denote | u (cid:105) and | (cid:96) (cid:105) the states of the basis defined bythe “upper” and “lower”arms after the BS, respectively.He then applies a phase ϕ chosen at random in the set { , π/ , π, π/ } on the lower arm to prepare the state | ψ B (cid:105) s = ( | u (cid:105) + e iϕ | (cid:96) (cid:105) ), yielding BB84 states in the spa-tial modes. Both DOFs have so far been created andmanipulated independently of each other, and thus thetwo-qubit state can be written as | ψ A (cid:105) p ⊗ | ψ B (cid:105) s .We then define the following Bell states: | Φ ± (cid:105) = 1 √ | H (cid:105) p | u (cid:105) s ± | V (cid:105) p | (cid:96) (cid:105) s ) , (1) | Ψ ± (cid:105) = 1 √ | H (cid:105) p | (cid:96) (cid:105) s ± | V (cid:105) p | u (cid:105) s ) . (2)A complete and deterministic BSM of these states isrealized by first applying the unitary transformation | Hu (cid:105) → | V u (cid:105) and | V u (cid:105) → | Hu (cid:105) on the upper arm us-ing a half-wave plate (HWP), followed by recombinationof the arms on a 50/50 BS, and finally by a projection inthe {| H (cid:105) , | V (cid:105)} basis using two PBSs on the two outputarms followed by four SPDs. In this way, a click on each a) | Φ + (cid:105) + − + i − i + − + i − i b) | Ψ + (cid:105) + − + i − i + − + i − i c) | Ψ − (cid:105) + − + i − i + − + i − i d) | Φ − (cid:105) + − + i − i + − + i − i TABLE I. Theoretical and experimentally observed probabil-ities for each Bell state. Rows and columns correspond toAlice’s and Bob’s states | ψ A (cid:105) p and | ψ B (cid:105) s , respectively. Givena certain Bell state k , for each | ψ A (cid:105) p there are four possible | ψ B (cid:105) s : white cells should happen with probability Pr[ k ] = 0,light grey cells with Pr[ k ] = 1 / k ] = 1 /
2. The experimentally observed probabilities arewritten in each cell.
SPD corresponds to a projection on one of the four Bellstates; see Fig. 1.To show how the raw key establishment functions,let us first define the mutually unbiased bases B X = {| + (cid:105) , |−(cid:105)} and B Y = {| + i (cid:105) , |− i (cid:105)} . The bit to be es-tablished is encoded in Alice’s state, i.e. | + (cid:105) and | + i (cid:105) encode bit 0, and |−(cid:105) and |− i (cid:105) encode bit 1. After themeasurement phase, Bob uses an authenticated channelto announce the success of the BSM and reveals the ba-sis he used to encode his qubit. Subsequently, Alice an-nounces whether Bob’s basis choice was compatible withhers. Bob can then determine Alice’s bit value accord-ing to Table I, which shows all of the possible combina-tions. For example, if | ψ B (cid:105) s = | + (cid:105) , the bit is 0 if he de-tected | Φ + (cid:105) or | Ψ + (cid:105) , and 1 otherwise. If more than onedetector clicked, Bob announces a successful BSM andassigns a random bit value. Importantly, the knowledgeof the bases used by Alice and Bob, along with whichof the Bell states Bob obtained, does not reveal Alice’sbit. Hence, Eve does not gain information on the key bycontrolling Bob’s detectors.From a security point of view, it is important to con-sider carefully the operation of Bob’s device. Strictlyspeaking, the mathematical description of his qubit, out-lined previously, holds only if the light state entering thefirst BS is a single-photon excitation of a single optical-temporal mode. As with any other QKD scheme, it isnot possible to guarantee this. Indeed, Eve may sendmulti-photon states through the quantum channel andbreak the qubit description. However, such an attackis only detrimental if she can interact with Bob’s pre-pared states, for instance, by making unambiguous statediscrimination measurements on them [28]. This is notpossible since the adversary can only interact with Al-ice’s qubits. Additionally, if the input is a multi-photonstate, with very high probability, more than one detec-tor clicks, in which case Bob would pick a random bitvalue, increasing the errors in the raw bit string. This isdue to the fact that the optical linear circuit of the BSMrandomizes the encoded state.The security of our scheme requires that the final lightstate (just before the SPDs), taken over all possible en-coding choices, is independent of the input light state.In particular, for any input state with a given n -photonexcitation, the average final state after passing throughthe linear optical circuit is a fixed state. This require-ment is in fact similar to the one used in the securityanalysis of BB84, where the average of the BB84 stateshas to be independent of the basis choice [29]. Once thisrequirement is met, the security of the scheme can beobtained following proof techniques for the BB84 QKDscheme. A common method to prove the security of P&MQKD schemes is to consider an equivalent entanglement-based version, where Alice and Bob make random mea-surements on bipartite quantum states distributed by theadversary. To this end, we point to a formalism thatallows us to see Bob’s linear optical circuit as randommeasurements made on some entangled bipartite state.First, let us relate the two different DOFs, i.e. A p , B p denoting the polarization states of Alice and Bob re-spectively, while B s denotes Bob’s spatial state. SinceAlice is able to prepare the four polarization BB84 statescorrectly, it is equivalent to consider the entanglementbased version, where Alice first prepares a two-qubitmaximally entangled state, | Φ + (cid:105) , and then performs aprojective measurement on one half of the state to pre-pare the other half for Bob. Mathematically, we have, M x ⊗ I | Φ + (cid:105)(cid:104) Φ + | A p B p ⊗ | s (cid:105)(cid:104) s | B s , where M x is the positive-operator valued measure (POVM) element correspondingto preparation x ∈ { + , − , + i, − i } and | s (cid:105) B s is an auxil-iary state related to the spatial DOF.Second, Alice sends the quantum systems B p and B s using a single photon through the quantum channel toBob. At this point, the resulting state is not necessarilya single photon state; it may be a multi-photon state. Inthis case, the state, after tracing out system A p , is de-scribed by a bipartite density operator, ρ C p C s , whose di-mension is unknown but fixed, i.e. it could be any n -photon light state. Note that we changed the subscript B to C to reflect the action of the quantum channel. Toproceed, we use a result from Ref. [30, Lemma. 1], whichsays that if, for any input state, the linear optical cir-cuit (parameterized by ϕ ) outputs a state that is fixedon the average, then the encoding can be seen as a puri-fied measurement acting on the same input state and onehalf of a bipartite pure state, where the other half of thebipartite is the same output state. More formally, let thelinear optical circuit be described by a set of completelypositive trace-preserving maps, {E ϕ } ϕ , taking the inputquantum system C s to an output quantum system D s ,such that for any input quantum state ρ C s , the outputquantum state is fixed over all possible encoding choices,i.e. 1 / (cid:80) ϕ E ϕ ( ρ C s ) = ρ D s for any ρ C s . Then, the linearoptical circuit is equivalent to making a joint measure- FIG. 2. Experimental realization of the ddiQKD proto-col. Labelled components include, dense wavelength divi-sion multiplexers (DWDM), bandpass filter (F), waveplates(WP), Soleil-Babinet compensator (SB), polarization con-trollers (PC), phase modulator (PM), 50/50 beam splitters(BS), polarizing beam splitters (PBS) and single-photon de-tectors (SPD). ment { F ϕC s K s } ϕ on the same input state, ρ C s , and onehalf of a bipartite pure state, | σ (cid:105) K s D s , living in a jointquantum system K s ⊗ D s , where the other half givesthe fixed state ρ D s . Therefore, the purification providesa method to analyze the security of our scheme in anentanglement-based picture, where Alice makes randomBB84 measurements on one half of a bipartite quantumstate, and Bob makes random purified measurements onthe other half.Finally, the security of ddiQKD follows directly fromthat of the BB84 QKD scheme, with the additional ben-efit that detectors are excluded from the security analy-sis. In particular, the security can be obtained by usingthe entropic uncertainty relation proof technique [25, 31]:in the asymptotic limit, and under the approximationthat the BB84 polarization states are prepared correctly,the secret key fraction is ∝ − h ( Q ), where h is thebinary entropy function and Q is the error rate of thesifted key. In fact, the finite-key security performance ofddiQKD is expected to be similar to the one of the single-photon BB84 [31] since only single-photon detections arerequired on Bob’s side. Likewise, for a more practicalimplementation using the decoy-state method for WCS,we expect the security performance to be similar to theone in Ref. [25].We implemented a proof-of-principle experiment as il-lustrated in Fig. 2. We started with the generationof a pair of correlated photons by type-0 SPDC in afiber-pigtailed periodically-poled lithium-niobate waveg-uide (PPLN-WG) [32]. The waveguide was pumped witha continuous wave diode laser (Toptica DL100) at 780 nmand the signal and idler photons were deterministicallyseparated by dense wavelength division multiplexers at1563.9 nm (200 GHz) and 1556.6 nm (100 GHz), re- . . . . . . . | + i Φ + Ψ + Ψ − Φ − | + i i π π π . . . . . . . |−i π π π π | − i i Phase setting of Bob N o r m a li s edde t e c t i onp r obab ili t y FIG. 3. Experimental Bell-state measurement outcomes as a function of the phase setting inside Bob’s interferometer. Foursets of measurements are shown, one for each of the possible states sent by Alice. spectively. The idler photon was detected by a free-running InGaAs single-photon detector (ID QuantiqueID220). The polarization of the heralded signal photonwas set to | + (cid:105) before passing through a Soleil-Babinet,which allowed us to rotate the state around the equa-tor of the Bloch sphere and prepare Alice’s single-photonstate. Bob’s device consisted of a balanced interferome-ter, with a polarization controller in the upper arm act-ing as a HWP and a piezo phase modulator in the lowerarm. The outputs of the BSM corresponding to | Φ − (cid:105) and | Ψ − (cid:105) were delayed by 2.5 ns before being combined usingtwo PBSs (see Fig. 2) with the other two outputs, whichallowed the use of two detectors for all four outcomes.Bob’s free-running InGaAs SPDs were cooled with a Stir-ling cooler to − o C and had a dark count rate of lessthan 50 cps at 25% efficiency [33]. The detection eventswere recorded by a time-to-digital converter (TDC). The g (2) (0) of the single photons at Alice was about 10 − in a1 ns coincidence window. Due to the extremely low darkcount probability of the InGaAs detectors, the probabil-ity of having a double detection at Bob was < − .To analyze the detection outcomes for all combinationsof Alice and Bob’s settings, we fixed the state preparedby Alice and scanned the phase of Bob’s interferometer.Figure 3 shows four curves, one for each of the polar-ization states chosen by Alice, representing the normal-ized probability of each Bell-state being announced atany given phase setting in Bob’s interferometer. Themeasurement points were fitted in order to calculate thevisibility, with the highest average value obtained being99 . ± .
5% for the |− i (cid:105) input state at Bob and the lowestvalue of 96 . ± .
1% for the |−(cid:105) state. Table I showsthe theoretical Bell-state announcement probability for every combination of Alice and Bob’s settings. We com-plete this correlation table with the experimental resultsby selecting points from Fig. 3 closest to the desired set-tings for Bob. One can see that the experimental valuescoincide with the prediction and the overall quantum biterror rate, Q , was 1 . ± . [1] C. H. Bennett and G. Brassard, in Proc. IEEE Int. Conf.Comp. Sys. Sig. Process. (Bangalore, 1984) pp. 175–179.[2] N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, Rev.Mod. Phys. , 145 (2002).[3] V. Scarani, H. Bechmann-Pasquinucci, N. Cerf,M. Duˇsek, N. L¨utkenhaus, and M. Peev, Reviews ofModern Physics , 1301 (2009).[4] H.-K. Lo, M. Curty, and K. Tamaki, Nat. Photon. ,595 (2014).[5] L. Lydersen, C. Wiechers, C. Wittmann, D. Elser,J. Skaar, and V. Makarov, Nat. Photonics , 686 (2010).[6] H.-K. Lo, M. Curty, and B. Qi, Phys. Rev. Lett. ,130503 (2012).[7] E. Biham, B. Huttner, and T. Mor, Phys. Rev. A ,2651 (1996).[8] H. Inamori, Algorithmica , 340 (2008).[9] A. Rubenok, J. A. Slater, P. Chan, I. Lucio-Martinez,and W. Tittel, Phys. Rev. Lett. , 130501 (2013).[10] Y. Liu, T.-Y. Chen, L.-J. Wang, H. Liang, G.-L. Shentu,J. Wang, K. Cui, H.-L. Yin, N.-L. Liu, L. Li, X. Ma, J. S.Pelc, M. M. Fejer, C.-Z. Peng, Q. Zhang, and J.-W. Pan,Phys. Rev. Lett. , 130502 (2013).[11] T. Ferreira da Silva, D. Vitoreti, G. B. Xavier, G. C.do Amaral, G. P. Tempor˜ao, and J. P. von der Weid,Phys. Rev. A , 052303 (2013).[12] Z. Tang, Z. Liao, F. Xu, B. Qi, L. Qian, and H.-K. Lo,Phys. Rev. Lett. , 190503 (2014).[13] W.-Y. Hwang, Phys. Rev. Lett. , 57901 (2003).[14] H.-K. Lo, X. Ma, and K. Chen, Phys. Rev. Lett. ,230504 (2005).[15] X.-B. Wang, Phys. Rev. Lett. , 230503 (2005).[16] A. R. Dixon, Z. L. Yuan, J. F. Dynes, A. W. Sharpe,and A. J. Shields, Appl. Phys. Lett. , 161102 (2010).[17] A. Tanaka, M. Fujiwara, K.-i. Yoshino, S. Takahashi,Y. Nambu, A. Tomita, S. Miki, T. Yamashita, Z. Wang,M. Sasaki, and A. Tajima, IEEE J. Quantum Electron. , 542 (2012).[18] N. Walenta, A. Burg, D. Caselunghe, J. Constantin,N. Gisin, O. Guinnard, R. Houlmann, P. Junod, B. Ko-rzh, N. Kulesza, M. Legr´e, C. C. W. Lim, T. Lunghi,L. Monat, C. Portmann, M. Soucarros, R. T. Thew,P. Trinkler, G. Trolliet, F. Vannel, and H. Zbinden, NewJ. Phys. , 013047 (2014), 1309.2583.[19] B. Korzh, C. C. W. Lim, R. Houlmann, N. Gisin, M. J.Li, D. Nolan, B. Sanguinetti, R. Thew, and H. Zbinden, (2014), arXiv:1407.7427.[20] For a WCS P ( µ ) = µe − µ , where µ < η det are 10 −
30% for practical InGaAs SPDs.[21] L. Vaidman and N. Yoran, Phys. Rev. A , 116 (1999).[22] N. L¨utkenhaus, J. Calsamiglia, and K.-A. Suominen,Phys. Rev. A , 3295 (1999).[23] R. Valivarthi, I. Lucio-Martinez, A. Rubenok, P. Chan,F. Marsili, V. B. Verma, M. D. Shaw, J. A. Stern, J. A.Slater, D. Oblak, S. W. Nam, and W. Tittel, Opt. Ex-press , 24497 (2014).[24] M. Curty, F. Xu, W. Cui, C. C. W. Lim, K. Tamaki, andH.-K. Lo, Nat. Commun. (2014).[25] C. C. W. Lim, M. Curty, N. Walenta, F. Xu, andH. Zbinden, Phys. Rev. A , 022307 (2014).[26] P. Gonzalez, L. Rebon, T. F. da Silva, M. Figueroa,C. Saavedra, M. Curty, G. Lima, G. B. Xavier, andW. A. T. Nogueira, (2014), arXiv:1410.1422.[27] D. Boschi, S. Branca, F. De Martini, L. Hardy, andS. Popescu, Phys. Rev. Lett. , 1121 (1998).[28] V. Scarani, A. Ac´ın, G. Ribordy, and N. Gisin, Phys.Rev. Lett. , 057901 (2004).[29] D. Gottesman, H.-K. Lo, N. Lutkenhaus, and J. Preskill,Quant. Inf. Comput. , 325 (2004).[30] N. J. Beaudry, M. Lucamarini, S. Mancini, and R. Ren-ner, Phys. Rev. A , 62302 (2013).[31] M. Tomamichel, C. C. W. Lim, N. Gisin, and R. Renner,Nat. Commun. , 634 (2012).[32] S. Tanzilli, A. Martin, F. Kaiser, M. De Micheli, O. Al-ibart, and D. Ostrowsky, Las. Photon. Rev. , 115(2012).[33] B. Korzh, N. Walenta, T. Lunghi, N. Gisin, andH. Zbinden, Appl. Phys. Lett. , 081108 (2014).[34] Q. Liu, A. Lamas-Linares, C. Kurtsiefer, J. Skaar,V. Makarov, and I. Gerhardt, Rev. Sci. Instrum. (2014).[35] N. Gisin, S. Fasel, B. Kraus, H. Zbinden, and G. Ri-bordy, Phys. Rev. A , 22320 (2006).[36] F. Xu, M. Curty, B. Qi, and H.-K. Lo, (2014),arXiv:1409.5157.[37] T. Lunghi, J. B. Brask, C. C. W. Lim, Q. Lavigne,J. Bowles, A. Martin, H. Zbinden, and N. Brunner,(2014), arXiv:1410.2790.[38] B. Korzh, N. Walenta, R. Houlmann, and H. Zbinden,Opt. Express21