Near-term quantum-repeater experiments with nitrogen-vacancy centers: Overcoming the limitations of direct transmission
Filip Rozpędek, Raja Yehia, Kenneth Goodenough, Maximilian Ruf, Peter C. Humphreys, Ronald Hanson, Stephanie Wehner, David Elkouss
NNear-term quantum-repeater experiments with nitrogen-vacancy centers: Overcomingthe limitations of direct transmission
Filip Rozpędek,
1, 2, ∗ Raja Yehia,
1, 3, ∗ Kenneth Goodenough,
1, 2, ∗ Maximilian Ruf,
1, 2
Peter C. Humphreys,
1, 2
Ronald Hanson,
1, 2
Stephanie Wehner,
1, 2 and David Elkouss QuTech, Delft University of Technology, Lorentzweg 1, 2628 CJ Delft, The Netherlands Kavli Institute of Nanoscience, Delft University of Technology, Lorentzweg 1, 2628 CJ Delft, The Netherlands Sorbonne Université, CNRS, Laboratoire d’Informatique de Paris 6, F-75005 Paris, France
Quantum channels enable the implementation of communication tasks inaccessible to their clas-sical counterparts. The most famous example is the distribution of secret keys. However, in theabsence of quantum repeaters, the rate at which these tasks can be performed is dictated by thelosses in the quantum channel. In practice, channel losses have limited the reach of quantum pro-tocols to short distances. Quantum repeaters have the potential to significantly increase the ratesand reach beyond the limits of direct transmission. However, no experimental implementation hasovercome the direct transmission threshold. Here, we propose three quantum repeater schemes andassess their ability to generate secret key when implemented on a setup using nitrogen-vacancy (NV)centers in diamond with near-term experimental parameters. We find that one of these schemes -the so-called single-photon scheme, requiring no quantum storage - has the ability to surpass thecapacity - the highest secret-key rate achievable with direct transmission - by a factor of 7 for adistance of approximately 9.2 km with near-term parameters, establishing it as a prime candidatefor the first experimental realization of a quantum repeater.
I. INTRODUCTION
There exist communication tasks for which quantumresources allow for qualitative advantages. Examplesof such tasks include clock synchronization [1–4], dis-tributed computation [5], anonymous information trans-mission [6, 7], and the distribution of secret keys [8, 9].While some of these tasks have been implemented overshort distances, their implementation over long distancesremains a formidable challenge.One of the main hurdles for long-distance quantumcommunication is the loss of photons, whether it isthrough fiber or free-space. Unfortunately, the no-cloning theorem [10] makes the amplification of the trans-mitted quantum states impossible. For tasks such as thegeneration of shared secret key or entanglement, this lim-its the corresponding generation rate to scale at best lin-early in the transmissivity η of the fiber joining two dis-tant parties [11–13].Luckily, while quantum mechanics prevents us fromovercoming the effects of losses through amplification, itis possible to do so using repeater stations [14–16]. For-mally, we call a quantum repeater a device that allowsfor a better performance than can be achieved over thedirect communication channel alone [17]. This perfor-mance is measured differently for different tasks, suchas secret-key generation or transmission of quantum in-formation. Consequently, the optimal performance thatcan be achieved over the direct channel without usingrepeaters, called the channel capacity, is also differentfor these two tasks. Here we will assess our proposed re-peater schemes for the task of secret-key generation, as it ∗ These three authors contributed equally; [email protected] is easier to realize experimentally. Our formal definitionof a repeater—as opposed to a relative definition with re-spect to some setup of reference—endows the demonstra-tion of a quantum repeater with a fundamental meaningthat cannot be affected by future technological develop-ments in the field.However, a successful experimental implementation ofa quantum repeater has not yet been demonstrated. Thisis mainly due to the additional noise introduced by such aquantum repeater. While the implementation of a singlequantum repeater does not necessarily imply that thatsetup can be scaled up to a larger number of repeaternodes (due to the effects of noise and decoherence), thefirst demonstration of a functioning quantum repeaterwill form an important step toward practical quantumcommunication and the quantum internet [18].A multitude of quantum repeater schemes have beenput forward [15, 19–29], each with their own strengthsand weaknesses. It should be noted here that most of theearlier repeater proposals aim at overcoming transmis-sion losses using heralded entanglement generation andcompensate for noise arising in quantum memories us-ing two-way entanglement distillation. However, some ofthe schemes, e.g. , those in Refs. [24–26] introduce errorcorrection to overcome operational errors while those inRefs. [27–29] use error correction also for dealing withlosses. Although a priori it is not clear which of thoseschemes will perform best with current or near-term ex-perimental parameters, it is clear that operating on largenumber of qubits in each repeater node, necessary for theimplementation of error correction, is a significant exper-imental challenge. Therefore, it is not expected that thefirst realizations of quantum repeaters will be based onlarge error-correction schemes. Hence, here we will fo-cus on simple schemes without encoding, leaving out alsoentanglement distillation. We will discuss entanglement a r X i v : . [ qu a n t - ph ] J un distillation in the context of our findings in the discussionat the end of the article.In this work, we propose three such schemes and to-gether with the fourth scheme analyzed before [17, 30],we assess their performance for generating secret key.We consider their implementation based on nitrogen-vacancy centers in diamond (NV centers), a system whichhas properties making it an excellent candidate for long-distance quantum communication applications [31–40].The four considered schemes are the following: the“single sequential quantum repeater node” (first pro-posed and studied in Ref. [30], then further analyzed inRef. [17]), the single-photon scheme (proposed originallyin the context of remote entanglement generation [41],also studied in the context of secret-key generation with-out quantum memories [42]), and two schemes whichare a combination of the first two. See Fig. 1 for aschematic overview of the repeater proposals consideredin this work.We compare the secret-key rate of each of theseschemes to the highest theoretically achievable secret-key rate using direct transmission, the secret-key capac-ity of the pure-loss channel [13]. We show that one ofthese schemes, the single-photon scheme , can surpass thesecret-key capacity by a factor of 7 for a distance of ≈ . km with near-term parameters. This shows the viabilityof this scheme for the first experimental implementationof a quantum repeater.In Sec. II, we discuss and detail the different re-peater proposals that will be assessed in this work. InSec. III, we expand on how the different components ofthe repeater proposals would be implemented experimen-tally. Sec. IV details how to calculate the secret-key rateachieved with the quantum repeater proposals from themodeled components. In Sec. V we discuss how to assessthe performance of a quantum repeater. The compar-ison of the different repeater proposals is performed inSec. VI, which allows us to conclude with our results inSec. VII. The numerical results of this article were pro-duced with a PYTHON and a
MATHEMATICA script, whichare available upon request.
II. QUANTUM REPEATER SCHEMES
In the following section, we present the quantum re-peater schemes that will be assessed in this work. Allthese schemes use NV-center-based setups which involvememory nodes consisting of an electron spin qubit actingas an optical interface and possibly an additional carbon C nuclear spin qubit acting as a long-lived quantummemory. Specifically, the optical interface of the elec-tron spin allows for the generation of spin-photon entan-glement, where the photonic qubits can then be transmit-ted over large distances. The carbon nuclear spin acts asa long-lived memory, but can be accessed only throughthe interaction with the electron spin. Here, we brieflygo over all the proposed schemes, consider why they are
FIG. 1. Schematic overview of the four quantum repeaterschemes assessed in this paper. From top to bottom: the Sin-gle Sequential Quantum Repeater (SiSQuaRe) scheme (A),the single-photon scheme (B), the Single-Photon with Addi-tional Detection Setup (SPADS) scheme (C) and the Single-Photon Over Two Links (SPOTL) scheme (D). The purpleparticles represent NV electron spins capable of emitting pho-tons (red wiggly arrows) while the yellow particles representcarbon C nuclear spins. Dark blue squares depict the beamsplitters used to erase the which-way information of the pho-tons, followed by blue photon detectors. For more details onthe different proposals, see Sec. II. interesting from an experimental perspective, and discusstheir advantages and disadvantages.
A. The Single Sequential Quantum Repeater(SiSQuaRe) scheme
The first scheme that we discuss here was proposedand analyzed in Ref. [30] and further studied in Ref. [17].The scheme involves a node holding two quantum mem-ories in the middle of Alice and Bob (see Fig. 2). Thismiddle node tries to send a photonic qubit, encoded inthe time-bin degree of freedom, that is entangled withone of the quantum memories, through a fiber to Alice.This is attempted repeatedly until the photon success-fully arrives, after which Alice performs a BB84 [8] ora six-state measurement [43, 44]. By performing such ameasurement, the quantum memory will be steered intoa specific state depending on the measurement outcome.Now the same is attempted on Bob’s side. After Bob has
FIG. 2. Schematic overview of the SiSQuaRe scheme. TheNV center in the middle first attempts to generate an entan-gled photon-electron pair, after which it tries to send the pho-ton through the fiber to Alice. Alice then directly measuresthe photon, using either a BB84 or a six-state measurement.Then after the state of the electron spin is swapped to the car-bon C nuclear spin, the same is attempted on Bob’s side.After both Alice and Bob measured a photon, a Bell-statemeasurement is performed on the two quantum states heldby the middle node. Alice and Bob can use their measure-ment outcomes together with the outcome of the Bell-statemeasurement to generate a single raw bit of key. measured a photon, the middle node performs a Bell-state measurement on both quantum memories. Usingthe classical information of the outcome of the Bell-statemeasurement, Alice and Bob can generate a single rawbit. In our model, the middle node has only one pho-tonic interface (corresponding to the NV electron spin),and hence has to send the photon sequentially first toAlice and then to Bob.While trying to send a photon to Bob, the state storedin the middle node will decohere. A possible way to com-pensate for the effects of decoherence is to introduce a so-called cut-off [17]. The cut-off is a limit on the numberof attempts we allow the middle node to try and send aphoton to Bob. If the cut-off is reached, the stored stateis discarded, and the middle node attempts again to senda photon to Alice. Since the scheme starts from scratch,we are effectively trading off the generation time versusthe quality of our state. By optimizing over the cut-off,it is possible to considerably increase the distance overwhich secret key can be generated [17].
Setup and scheme
We will now describe the exact procedure of thisscheme, when Alice and Bob use a nitrogen-vacancy cen-ter in diamond as quantum memories and as a photonsource. The scheme that we study is the following:(1) The quantum repeater attempts to generate an en-tangled qubit-qubit state between a photon andits electron spin, and sends the photon to Alicethrough a fiber.(2) The first step is repeated until a photon arrivesat Alice’s side, after which she performs a BB84or a six-state measurement. The electron state isswapped to the carbon spin.(3) The quantum repeater attempts to do the same onBob’s side while the state in the carbon spin is kept stored. This state will decohere during the nextsteps.(4) Repeat until a photon arrives at Bob’s side, whowill perform a BB84 or a six-state measurement. Ifthe number of attempts n reaches the cut-off n ∗ ,restart from step 1.(5) The quantum repeater performs a Bell-state mea-surement and communicates the result to Bob.(6) All the previous steps are repeated until sufficientdata have been generated. B. The single-photon scheme
Cabrillo et al . [41] devised a procedure that allows forthe heralded generation of entanglement between a sepa-rated pair of matter qubits (their proposal discusses spe-cific implementation with single atoms, but the schemecan also be applied to other platforms such as NV centersor quantum dots) using linear optics. For the atomic en-semble platform this scheme also forms a building blockof the Duan, Lukin, Cirac, Zoller (DLCZ) quantum re-peater scheme [20]. Here we will refer to this scheme asa single-photon scheme as the entanglement generationis heralded by a detection of only a single photon. Thisrequirement of successful transmission of only a singlephoton from one node makes it possible for this schemeto qualify as a quantum repeater (see below for moredetails).The basic setup of the single-photon scheme consistsof placing a beam splitter and two detectors between Al-ice and Bob, with both parties simultaneously sending aphotonic quantum state toward the beam splitter. Thetransmitted quantum state is entangled with a quantummemory, and the state space of the photon is spanned bythe two states corresponding to the presence and absenceof a photon. Immediately after transmitting their pho-tons through the fiber, both Alice and Bob measure theirquantum memories in a BB84 or six-state basis (see thediscussion of which quantum key distribution protocol isoptimal for each scheme in Sec. IV B and in Sec. VI A).Note that this is equivalent to preparing a specific stateof the photonic qubit and therefore is closely linked tothe measurement device independent quantum key dis-tribution (MDI QKD) [45] as discussed in Appendix I.However, preparing specific states that involve the su-perposition of the presence and absence of a photon onits own is generally experimentally challenging. The NVimplementation allows us to achieve this task precisely bypreparing spin-photon entanglement and then measuringthe spin qubit. Afterwards, by conditioning on the clickof a single detector only, Alice and Bob can use the in-formation of which detector clicked to generate a singleraw bit of key; see Appendix E and Ref. [41] for moreinformation.The main motivation of this scheme is that, informally,we only need one photon to travel half the distance be-tween the two parties to get an entangled state. Thisthus effectively reduces the effects of losses, and in theideal scenario the secret-key rate would scale with thesquare root of the total transmissivity η , as opposed tolinear scaling in η (which is the optimal scaling withouta quantum repeater [46]).However, one problem that one faces when implement-ing this scheme is that the fiber induces a phase shifton the transmitted photons. This shift can change overtime, e.g. due to fluctuations in the temperature and vi-brations of the fiber. The uncertainty of the phase shiftinduces dephasing noise on the state, reducing the qualityof the state.To overcome this problem, a two-photon scheme wasproposed by Barrett and Kok [47], which does not placesuch high requirement on the optical stability of thesetup. Specifically, in the Barrett and Kok scheme theproblem of optical phase fluctuations is overcome by re-quiring two consecutive clicks and performing additionalspin-flip operations on both of the remote memories.The Barrett and Kok scheme has seen implementationin many experiments [48–51]. However, the requirementof two consecutive clicks implies that a setup using onlythe Barrett and Kok scheme with two memory nodes willnever be able to satisfy the demands of a quantum re-peater. Specifically, the probability of getting two con-secutive clicks will not be higher than the transmissivityof the fiber between the two parties and therefore willnot surpass the secret-key capacity.In the single-photon scheme, on the other hand, thedephasing caused by the unknown optical phase shift isovercome by using active phase-stabilization of the fiberto reduce the fluctuations in the induced phase. Thistechnique has been used in the experimental implemen-tations of the single-photon scheme for remote entangle-ment generation using quantum dots [52, 53], NV cen-ters [31] and atomic ensembles [54]. For experimental de-tails relating to NV implementation, we refer the readerto Sec. III. This phase-stabilization technique effectivelyreduces the uncertainty in the phase, allowing us to sig-nificantly mitigate the resulting dephasing noise; see Ap-pendix A for mathematical details.In contrast to the Barrett and Kok scheme, the single-photon scheme cannot produce a perfect maximally en-tangled state, even in the case of perfect operations andperfect phase-stabilization. This is because losses in thechannel result in a significant probability of having bothnodes emitting a photon which can also lead to a sin-gle click in one of the detectors, yet the memories will beprojected onto a product state. As we discuss below, thisnoise can be traded versus the probability of success ofthe scheme by reducing the weight of the photon-presenceterm in the generated spin-photon entangled state. Thisis discussed in more detail below and the full analysis ispresented in Appendix E.The single-photon scheme with phase-stabilization is a FIG. 3. Schematic overview of the single-photon scheme. Al-ice and Bob simultaneously transmit a photonic state fromtheir NV centers toward a balanced beam splitter in the cen-ter. This photonic qubit, corresponding to the presence andabsence of a photon, is initially entangled with the NV elec-tron spin. If only one of the detectors (which can be seen atthe top of the figure) registers a click, Alice and Bob can usethe information of which detector clicked to generate a singleraw bit of key. promising candidate for a near-term quantum repeaterwith NV centers. We note here that recently other QKDschemes that use the MDI framework have been pro-posed. These schemes, similar to our proposal, use single-photon detection events to overcome the linear scaling ofthe secret-key rate with η [42, 55, 56]. In these propos-als, in contrast to our single-photon scheme, no quan-tum memories are used, but instead Alice and Bob sendphase-randomized optical pulses to the middle heraldingstation. Setup and scheme
In the setup of the single-photon scheme, Alice andBob are separated by a fiber where in the center there isa beam splitter with two detectors (see Fig. 3). They willboth create entanglement between a photonic qubit anda stored spin and send the photonic qubit to the beamsplitter.Alice and Bob thus perform the following,(1) Alice and Bob both prepare a state | ψ (cid:105) =sin θ |↓(cid:105) | (cid:105) + cos θ |↑(cid:105) | (cid:105) where |↓(cid:105) ( |↑(cid:105) ) refers to thedark (bright) state of the electron-spin qubit, | (cid:105) ( | (cid:105) ) indicates the absence (presence) of a photon,and θ is a tunable parameter.(2) Alice and Bob attempt to both separately send thephotonic qubit to the beam splitter.(3) Alice and Bob both perform a six-state measure-ment on their memories.(4) The previous steps are repeated until only one ofthe detectors between the parties clicks.(5) The information of which detector clicked gets sentto Alice and Bob for classical correction.(6) All the previous step are repeated until sufficientdata have been generated.The parameter θ can be chosen by preparing a non-uniform superposition of the dark and bright state of theelectron spin | ψ (cid:105) = sin θ |↓(cid:105) + cos θ |↑(cid:105) via coherent mi-crowave pulses. This is done before applying the opticalpulse to the electron which entangles it with the presenceand absence of a photon. The parameter θ can then betuned in such a way as to maximize the secret-key rate.In the next section, we will briefly expand on some ofthe issues arising when losses and imperfect detectors arepresent. We defer the full explanation and calculationsuntil Appendix E. Realistic setup
In any realistic implementation of the single-photonscheme, a large number of attempts is needed before aphoton detection event is observed. Furthermore, a sin-gle detector registering a click does not necessarily meanthat the state of the memories is projected onto the max-imally entangled state. This is due to multiple reasons,such as losing photons in the fiber or in some other lossprocess between the emission and detection, arrival of theemitted photons outside of the detection time windowand the fact that dark counts generate clicks at the de-tectors. Photon loss in the fiber effectively acts as ampli-tude damping on the state of the photon when using thestate space spanned by the presence and absence of thephoton [13, 57]. Dark counts are clicks in the detectors,caused by thermal excitations. These clicks introducenoise, since it is impossible to distinguish between clickscaused by thermal excitations and the photons travelingthrough the fiber if they arrive in the same time window.All these sources of loss and noise acting on the photonicqubits are discussed in detail in Appendix A. Finally, wenote that we assume here the application of non-number-resolving detectors. This can lead to additional noise inthe low-loss regime, since the event in which two pho-tons got emitted cannot be distinguished from the single-photon emission events even if no photons got lost. How-ever, in any realistic loss regime this is not a problem,since the probability of two such photons arriving at theheralding station is quadratically suppressed with respectto events where only one photon arrives. In the realis-tic regime, almost all the noise coming from the impos-sibility of distinguishing two-photon from single-photonemission events is the result of photon loss. Namely, if atwo-photon emission event occurs and the detector reg-isters a click, then with dominant probability it is due toonly a single photon arriving, while the other one beinglost. Hence the use of photon-number-resolving detec-tors would not give any visible benefit with respect tothe use of the non-number-resolving ones. For a detailedcalculation of the effects of losses and dark counts for thesingle-photon scheme, see Appendix E.
FIG. 4. Schematic overview of the SPADS scheme. First,the two NV centers run the single-photon scheme, such thatAlice measures her electron spin directly after every attempt.After success, the middle node swaps its state to the carbonspin. Then the middle node generates electron-photon entan-gled pairs where the photonic qubit is encoded in the time-bindegree of freedom and sent to Bob. This is attempted untilBob successfully measures the photon or until the cut-off isreached. If the cut-off is reached, the scheme gets restarted,otherwise the middle node performs an entanglement swap-ping on its two memories and communicates the classical out-come to Alice and Bob, who can correct their measurementoutcomes to obtain a bit of raw key.
C. Single-Photon with Additional Detection Setup(SPADS) scheme
The third scheme that we consider here is theSingle-Photon with Additional Detection Setup (SPADS)scheme, which is effectively a combination of the single-photon scheme and the SiSQuaRe scheme as shown inFig. 4. If the middle node is positioned at two-thirds ofthe total distance away from Alice, the rate of this setupwould scale, ideally, with the cube root of the transmis-sivity η .This scheme runs as follows:(1) Alice and the repeater run the single-photonscheme until success, however, only Alice performsher spin measurement immediately after each spin-photon entanglement generation attempt. Thismeasurement is either in a six-state or BB84 ba-sis.(2) The repeater swaps the state of the electron spinonto the carbon spin.(3) The repeater runs the second part of the SiSQuaRescheme with Bob. This means it generates spin-photon entanglement between an electron and thetime-bin encoded photonic qubit. Afterwards, itsends the photonic qubit to Bob. This is repeateduntil Bob successfully measures his photon in asix-state or BB84 basis or until the cut-off n ∗ isreached, in which case the scheme is restarted withstep 1.(4) After Bob has received the photon and communi-cated this to the repeater, the repeater performs aBell-state measurement on its two quantum mem-ories and communicates the classical result to Bob.(5) All the previous steps are repeated until sufficientdata have been generated.The motivation for introducing this scheme is twofold.First, we note that by using this scheme we divide the to-tal distance between Alice and Bob into three segments:two segments corresponding to the single-photon sub-scheme and the third segment over which the time-bin-encoded photons are sent. This gives us one additionalindependent segment with respect to the single-photon orthe SiSQuaRe scheme on their own. Hence, for distanceswhere no cut-off is required, we expect the scaling of thesecret-key rate with the transmissivity to be better thanthe ideal square root scaling of the previous two schemes.Furthermore, dividing the total distance into more seg-ments should also allow us to reach larger distances be-fore dark counts become significant. When consideringthe resources necessary to run this scheme, we note thatthe additional third node needs to be equipped only witha photon detection setup.Second, we note that the SPADS scheme can also benaturally compared to the scenario in which an NV centeris used as a single-photon source for direct transmissionbetween Alice and Bob. Both the setup for the SPADSscheme and such direct transmission involve Alice usingan NV for emission and Bob having only a detector setup.Hence, the SPADS scheme corresponds to inserting a newNV node (the repeater) between Alice and Bob withoutchanging their local experimental setups at all. This mo-tivates us to compare the achievable secret-key rate ofthe SPADS scheme and direct transmission. We performthis comparison on a separate plot in Sec. VI. D. Single-Photon Over Two Links (SPOTL)scheme
The final scheme that we study here is the Single-Photon Over Two Links (SPOTL) scheme, and it is an-other combination of the single-photon and SiSQuaReschemes. A node is placed between Alice and Bob whichtries to sequentially generate entanglement with theirquantum memories by using the single-photon scheme(see Fig. ). The motivation for this scheme is that, whileusing relatively simple components and without impos-ing stricter requirements on the memories than in theprevious schemes, its secret-key rate would ideally scalewith the fourth root of the transmissivity η . Setup and scheme
The setup that we study is the following:(1) Alice and the repeater run the single-photonscheme until success with the tunable parameter θ = θ A . However, only Alice performs her spinmeasurement immediately after each spin-photonentanglement generation attempt. This measure-ment is in a six-state basis. FIG. 5. Schematic overview of the setup for the SPOTLscheme. This scheme is a combination of the SiSQuaRe andsingle-photon scheme. Instead of sending photons directlythrough the fiber as in the SiSQuaRe scheme, entanglementis established between the middle node and Alice and Bobusing the single-photon scheme. (2) The repeater swaps the state of the electron spinonto the carbon spin.(3) Bob and the repeater run the single-photon schemeuntil success or until the cut-off n ∗ is reached, inwhich case the scheme is restarted with step 1. Thetunable parameter is set here to θ = θ B . Again,only Bob performs his spin measurement immedi-ately after each spin-photon entanglement genera-tion attempt and this measurement is in a six-statebasis.(4) The quantum repeater performs a Bell-state mea-surement and communicates the result to Bob.(5) All the previous steps are repeated until sufficientdata have been generated.We note that for larger distances the optimal cut-off be-comes smaller. Then, since we lose the independence ofthe attempts on both sides, the scaling of the secret-keyrate with distance is expected to drop to √ η , which is thesame as for the single-photon scheme. However, the totaldistance between Alice and Bob is now split into four seg-ments. Alice and Bob thus send photons over only onefourth of the total distance. Thus, this scheme shouldbe able to generate key over much larger distances thanthe previous ones, as the dark counts will start becomingsignificant for larger distances only. III. NV-IMPLEMENTATION
Having proposed different quantum repeater schemes,we now move on to describe their experimental im-plementation based on nitrogen-vacancy centers in dia-mond [58]. This defect center is a prime candidate for arepeater node due to its packaged combination of a brightoptical interface featuring spin-conserving optical tran-sitions that enable high-fidelity single-shot readout [59]and individually addressable, weakly coupled C mem-ory qubits that can be used to store quantum states in arobust fashion [33, 60]. Moreover, second-long coherencetimes of an NV electron spin have been achieved recentlyby means of dynamical decoupling sequences [32].By applying selective optical pulses and coherent mi-crowave rotations, we first generate spin-photon entan-glement at an NV center node [50]. To generate entan-glement between two distant NV electron spins, theseemitted photons are then overlapped on a central beamsplitter to remove their which-path information. Subse-quent detection of a single photon heralds the generationof a spin-spin entangled state [50]. For all schemes basedon single-photon entanglement generation, we need toemploy active phase-stabilization techniques to compen-sate for phase shifts of the transmitted photons, whichwill reduce the entangled state fidelity, as introduced inSec. II B. These fluctuations arise from both mechani-cal vibrations and temperature-induced changes in op-tical path length, as well as phase fluctuations of thelasers used during spin-photon entanglement generation.This problem can be mitigated by using light reflected offthe diamond surface to probe the phase of an effectivelyformed interferometer between the two NV nodes and thecentral beam splitter, and by feeding the acquired errorsignal back to a fiber stretcher that changes the relativeoptical path length [31].The electron spin state can be swapped to a surround-ing C nuclear spin to free up the single optical NV inter-face per node for a subsequent entangling round; a weak(approx. few kHz), always-on, distance-dependent mag-netic hyperfine interaction between the electron and Cspin forms the basis of a dynamical decoupling based uni-versal set of nuclear gates that allow for high-fidelity con-trol of individual nuclear spins [33, 34, 37, 38]. Crucially,the so-formed memory can retain coherence for thou-sands of remote entangling attempts despite stochasticelectron spin reset operations, quasi static noise, and mi-crowave control infidelities during the subsequent prob-abilistic entanglement generation attempts [38, 61] (seeAppendix B for details).In the NV node containing both the electron and car-bon nuclear spin, it is also possible to perform a de-terministic Bell-state measurement on the two spins.Specifically, a combination of two nuclear-electron spingates and two sequential electron spin state measure-ments reads out the combined nuclear-electron spin statein the Z and X bases, enabling us to discriminate all fourBell states [62].For an NV center in free space, only ∼ of photonsare emitted in the zero-phonon line (ZPL) that can beused for secret-key generation. This poses a key chal-lenge for a repeater implementation, since this meansthat the probability of successfully detecting an emit-ted photon is low. Therefore, we consider a setup inwhich the NV center is embedded in an optical cavitywith a high ratio of quality factor Q to mode volume V to enhance this probability via the Purcell effect inthe weak coupling regime [63]. This directly translatesinto a lower optical excited state lifetime that is bene-ficial to shorten the time window during which we de-tect ZPL photons after the beam splitter, reducing theimpact of dark counts on the entangled state. Addition- ally, a cavity introduces a preferential mode into whichthe ZPL photons are emitted that can be picked up ef-ficiently. This leads to a higher expected collection ef-ficiency than the non cavity case [40]. Enhancement ofthe ZPL has been successfully implemented for differ-ent cavity architectures, including photonic crystal cavi-ties [64–71], microring resonators [72], whispering gallerymode resonators [73, 74] and open, tunable cavities [75–77]. However, cavity-assisted entanglement generationhas not yet been demonstrated for these systems, limitedpredominantly by broad optical lines of surface-proximalNV centers. Therefore, we focus on the open, tunablemicrocavity approach [78], since it has the potential forincorporating micron-scale diamond slabs inside the cav-ity, while allowing to keep high Q/V values and provid-ing in situ spatial and spectral tunability [79]. In thesediamond slabs, an NV center can be microns away fromsurfaces, potentially allowing to maintain bulklike opticaland spin properties as needed for the considered repeaterprotocols.
IV. CALCULATION OF THE SECRET-KEYRATE
With the modeling of each of the components of thedifferent setups in hand, the performance of each setupcan be estimated. The performance of a setup is as-sessed in this paper by its ability to generate secret keybetween two parties, Alice and Bob. We note here thatthe ability of a quantum repeater to generate secret keycan be measured in two different ways - in its through-put and its secret-key rate . The throughput is equal tothe amount of secret key generated per unit time, whilethe secret-key rate equals the amount of secret key gen-erated per channel use . In this paper, we will focus onthe secret-key rate only. This is because it allows us tomake concrete information-theoretical statements aboutour ability to generate secret key. Moreover, we note thatthe secret-key rate is also more universal in the sense thatit can be easily converted into the throughput by multi-plying it with the repetition rate of our scheme (numberof attempts we can perform in a unit time). It mustbe also noted here that demonstrating repeater schemesthat achieve higher throughput than the currently avail-able QKD systems based on direct transmission will bea great challenge. This is because the sources of pho-tonic states used within those QKD systems operate atthe GHz repetition rates, while the performance of the re-peater schemes will be limited by many additional factorssuch as transmission latency and time of local operationsat the memory nodes. These issues are not captured bythe secret-key rate directly. Nevertheless, as mentionedbefore, the universality of the secret-key rate allows forthe interconversion between the two quantities. We fur-ther discuss the differences between the throughput andsecret-key rate in Sec. VI E.The secret-key rate R is equal to R = Y rN modes , (1)where Y and r are the yield and secret-key fraction, re-spectively. The yield Y is defined as the average numberof raw bits generated per channel use and the secret-keyfraction r is defined as the amount of secret key thatcan be extracted from a single raw bit (in the limit ofasymptotically many rounds). Here N modes is the num-ber of optical modes needed to run the scheme. Time-bin encoding requires two modes while the single-photonscheme uses only one mode. Hence, N modes = 2 for allthe schemes that use time-bin encoding in at least oneof the arms of the setup. For the schemes that use onlythe single-photon subschemes as their building blocks, wehave that N modes = 1 .In the remainder of this section, we will briefly detailhow to calculate the yield and secret-key fraction, fromwhich we can estimate the secret-key rate of each scheme. A. Yield
The yield depends not only on the used scheme but alsoon the losses in the system. We model the general emis-sion and transmission of photons through fibers from NVcenters in diamond as in Fig. 6. That is, with probability p ce spin-photon entanglement is generated and the pho-ton is coupled into a fiber. The photons that successfullygot coupled into the fiber might not be useful for quan-tum information processing since they are not coherent.Thus, we filter out those photons that are not emitted atthe zero-phonon line, reducing the number of photons bya further factor of p zpl . Then, over the length of the fiber,a photon gets lost with probability − η f = 1 − e − LL ,where L is the attenuation length and η f is the transmis-sivity. After exiting the fiber, the photon gets registeredas a click by the detector with probability p det . Finally,the photon gets accepted as a successful click if the clickhappens within the time window t w of the detector (seeAppendix A for more details).The yield can then be calculated as the reciprocal ofthe expected number of channel uses needed to get onesingle raw bit, Y = 1 E [ N ] , (2)with N being the random variable that models thenumber of channel uses needed for generating a singleraw bit. Yield of the single-photon scheme
The yield of the single-photon scheme is relatively easyto calculate, since the single condition heralding the suc-
Collection efficiency p ce Emission into ZPL p zpl Fiber transmissivity η f Detector efficiency p det FIG. 6. The model of photon-loss proccesses occurring in ourrepeater setups. The parameter p ce is the photon-collectionefficiency, which includes the probability that the photon issuccessfully coupled into the fiber. Only photons emitted atthe zero-phonon line (ZPL) can be used for quantum informa-tion processing. All non-ZPL photons are filtered out, suchthat a fraction p zpl of the photons remains. The photonsare then transmitted through a fiber with transmissivity η f .Such successful transmissions are registered by the detectorwith probability p det . Additionally, a significant fraction ofphotons can arrive in the detector outside of the detectiontime window t w . Such photons will effectively also get dis-carded. Here we describe the total efficiency of our apparatusby a single parameter, p app = p ce p zpl p det . cess of the scheme is a single click in one of the detectorsin the heralding station. Therefore, the yield Y is simplythe probability that an individual attempt will result ina single click in one of the detectors. This probabilitywill depend on the losses in the system, dark counts andthe angle θ . A full calculation of the yield is given inAppendix E. Yield of the SiSQuaRe, SPADS, and SPOTL schemes
The SiSQuaRe, SPADS, and SPOTL schemes requiretwo conditions for the heralding of the successful gener-ation of a raw bit, namely the scheme needs to succeedboth on Alice’s and Bob’s side independently. In thiscase we are going to take a very conservative perspectiveand assume the total number of channel uses to be thesum of the required channel uses on Alice’s and Bob’sside of the memory repeater node, E [ N ] = E [ N A + N B ] . (3)Moreover, every time Bob reaches n ∗ attempts, both par-ties start the scheme over again. The cut-off increasesthe average number of channel uses, thus decreasing theyield. Denoting by p A and p B the probability that a sin-gle attempt of the subscheme on Alice’s and Bob’s siderespectively succeeds, we find (see Appendix C for thederivation) E [ N A + N B ] = 1 p A (cid:16) − (1 − p B ) n ∗ (cid:17) + 1 p B . (4) B. Secret-key fraction
The secret-key fraction is the fraction of key that canbe extracted from a single raw state. It is a function ofthe average quantum bit error rates in the X , Y , and Z basis [80, 81] (QBER), and depends on the protocol(such as the BB84 [8] or six-state protocol [43, 44]) andclassical postprocessing used (such as the advantage dis-tillation post-processing [81]) .Here we consider the entanglement-based version of theBB84 and six-state protocols. That is, Alice and Bobboth perform measurements on their local qubits whichshare quantum correlations. We note that both the BB84and the six-state protocol can in principle be run eitherin a symmetric or asymmetric way. Symmetric meansthat the probabilities of performing measurements in allthe used bases are the same, while for asymmetric pro-tocols they can be different. We note in the asymptoticregime, which is the regime that we consider here, it ispossible to set this probability bias to approach unityand still maintain security [82]. Unfortunately, for tech-nical reasons, within our model it is not possible to runan asymmetric six-state protocol when time-bin-encodedphotons are used [17].Moreover, as we mentioned above, it is also possibleto apply different types of classical postprocessing of theraw key generated through the BB84 or the six-state pro-tocol. In particular, here we consider two types of postprocessing: the standard one-way error correction and amore involved two-way error correction protocol calledadvantage distillation, which can tolerate much more er-rors. Specifically, here we consider the advantage distil-lation protocol proposed in Ref. [81], as this advantagedistillation protocol has high efficiency (in particular, inthe scenario of no noise, the efficiency of this protocolequals unity). Hence, in our model we effectively con-sider two protocols for generating secret key: BB84 withstandard one-way error correction and six-state with ad-vantage distillation. We refer the reader to Appendix Gfor the mathematical expressions for the secret-key frac-tion for all the considered protocols.Now we can state explicitly which QKD protocols willbe considered for each scheme, which in turn depends onthe type of measurements that Alice and Bob performin that scheme. There are two physical implementationsof measurements that Alice and Bob perform, depend-ing on the scheme under consideration. That is, theyeither measure a quantum state of a spin or of a time-binencoded photons. Since the fully asymmetric six-stateprotocol with advantage distillation has higher efficiencythan both symmetric and asymmetric BB84 protocolwith one-way error correction, we will use this six-stateprotocol for both the single-photon and SPOTL scheme.The SiSQuaRe and SPADS schemes involve direct mea-surement on time-bin encoded photons. Hence, for theseschemes, we consider the maximum of the amount of keythat can be obtained using the fully asymmetric BB84protocol and the symmetric six-state protocol with ad- vantage distillation (which can tolerate more noise, buthas three times lower efficiency than the fully asymmetricBB84 protocol).To estimate the QBER, we model all the noisy andlossy processes that take place during the protocol run.From this, we calculate the qubit error rates and yield,from which we can retrieve the secret-key fraction. Weinvite the interested reader to read about the details ofthese calculations in Appendices E and F. The derivationof the QBER and the yield for the SiSQuaRe scheme isperformed in Ref. [17]. Moreover, in this work we intro-duce certain refinements to the model which we discussin Appendix D. With the QBER in hand, we can calcu-late the resulting secret-key fraction for the consideredprotocols as presented in Appendix G.We note here that we consider only the secret-key ratein the asymptotic limit, and that we thus do not have todeal with non-asymptotic statistics. V. ASSESSING THE PERFORMANCE OFQUANTUM REPEATER SCHEMES
In this section, we will detail four benchmarks that willbe used to assess the performance of quantum repeaters.The usage of such benchmarks for repeater assessmenthas been done in Refs. [17, 30], and achieving a rategreater than such benchmarks can be seen as milestonestoward the construction of a quantum repeater.The considered benchmarks are defined with respectto the efficiencies of processes involving photon losswhen emitting photons at NV centers, transmitting themthrough an optical fiber and detecting them at the endof the fiber as described in Sec. IV A and as shown inFig. 6.Having this picture in mind, we can now proceed topresent the considered benchmarks. The first three ofthese benchmarks are inspired by fundamental limits onthe maximum achievable secret-key rate if Alice and Bobare connected by quantum channels which model quan-tum key distribution over optical fiber without the use ofa (possible) quantum repeater.
The first of these benchmarks we consider here isalso the most stringent one, the so-called capacity of thepure-loss channel . The capacity of the pure-loss channelis the maximum achievable secret-key rate over a channelmodeling a fiber of transmissivity η f , and is given by [13] − log (1 − η f ) . (5)This is the maximum secret-key rate achievable, mean-ing that even if Alice and Bob had perfect unboundedquantum computers and memories, they could not gen-erate secret key at a larger rate. If, by using a quan-tum repeater setup, a higher rate can be achieved than − log (1 − η f ) , we are certain our quantum repeater setupallowed us to do something that would be impossible withdirect transmission. Surpassing the secret-key capacity0has been widely used as a defining feature of a quantumrepeater [11–13, 17, 23, 30, 83–88]. Unfortunately, andas could be expected, surpassing the capacity is experi-mentally challenging. This motivates the introduction ofother, easier to surpass, benchmarks. These benchmarksare still based on (upper bounds on) the secret-key ca-pacity of quantum channels which model realistic imple-mentations of quantum communications over fibers. The second benchmark is built on the idea of in-cluding the losses of the apparatus into the transmissivityof the fiber. The resultant channel with all those lossesincluded we call here the extended channel . The bench-mark is thus equal to − log (1 − η f p app ) . (6)Here p app describes all the intrinsic losses of the devicesused, that is, the collection efficiency p ce at the emit-ting diamond, the probability that the emitted photon iswithin the zero-phonon line p zpl (which is necessary forgenerating quantum correlations), and photon detectionefficiency p det , so that p app = p ce p zpl p det . The third benchmark we consider is the so-called thermal channel bound , which takes into account the ef-fects of dark counts. The secret-key capacity of the ther-mal channel has been studied extensively [13, 86–92]. Weconsider the following bound on the secret-key capacityof the thermal channel, − log (cid:104) (1 − η f p app ) ( η f p app ) n (cid:105) − g ( n ) , (7)if n ≤ η f p app − η f p app , and otherwise zero [13]. Here n isthe average number of thermal photons per channel useand is equal to t w , the time window of the detector,times the average number of dark counts per second; seeRef. [17] for more details. The function g ( x ) is definedas g ( x ) ≡ ( x + 1) log ( x + 1) − x log ( x ) . We note herethat the time window of the detector t w is not fixed in ourmodel but is optimized over for every distance in orderto achieve the highest possible secret-key rate. Hence,in this benchmark we fix t w = 5 ns which is the short-est duration of the time window that we consider in oursecret-key rate optimization.Finally, the secret-key rate achieved with direct trans-mission using the same devices can be seen as the fourthbenchmark . Specifically, here we mean the secret-keyrate achieved when Alice uses her electron spin to gen-erate spin-photon entanglement and sends the time-bin-encoded photon to Bob. She then measures her electronspin while Bob measures the arriving photon. However,to take a conservative view, we will only use this directtransmission benchmark for the SPADS scheme. This ismotivated by the fact that for both the SPADS schemeand the direction transmission scheme, the experimentalsetups on Alice’s and Bob’s side are the same, ensuringthat the two rates can be compared fairly. We note thatsimilarly as in the modeled secret-key rates achievablewith our proposed repeater schemes, also for this direct transmission benchmark we optimize over the time win-dow t w for each distance.The secret-key capacity stated in Eq. (5) is the mainbenchmark that we consider. Surpassing it establishesthe considered scheme as a quantum repeater. The twoexpressions in Eqs. (6) and (7) and the achieved rate withdirect transmission are additional benchmarks, whichguide the way toward the implementation of a quantumrepeater. We define all the considered benchmarks forthe channel with the same fiber attenuation length L asthe channel used for the corresponding achievable secret-key rate. VI. NUMERICAL RESULTS
We now have a full model of the rate of the presentedquantum repeater protocols as a function of the under-lying experimental parameters. In this section, we willfirst state all the parameters required by our model andthen present the results and conclusions drawn from thenumerical implementation of this model. In particular,in Sec. VI A, we will first provide a deeper insight intothe benefits of using the six-state protocol and advan-tage distillation in specific schemes. In Sec. VI B, wedetermine the optimal positioning of the repeater nodesfor our schemes and investigate the dependence of thesecret-key rate achievable with those schemes on the pho-ton emission angle θ and the cutoff n ∗ for the appropriateschemes. In Sec. VI C, we then use the insights acquiredin the previous section to compare the achievable secret-key rates for all the proposed repeater schemes with thesecret-key capacity and other proposed benchmarks. Inparticular, we show that the single-photon scheme signifi-cantly outperforms the secret-key capacity and hence canbe used to demonstrate a quantum repeater. Finally, inSec. VI D, we determine the duration of the experimentthat would allow us to demonstrate such a quantum re-peater with the single-photon scheme.The parameters that we will use are either parametersthat have been achieved in an experiment or correspondto expected parameters when the NV center is embeddedin an optical Fabry-Perot microcavity. The parameterswe will use are listed in Table 1.To be now more specific, the photon collection effi-ciency p ce and the probability of emitting into the zero-phonon line p zpl are the two crucial parameters relyingon the implementation of the optical cavity. The quotedvalue of p ce has not been experimentally demonstratedyet, while the value of p zpl has not been demonstratedin the context of quantum communication. All the otherindependent parameters in the above list that are not re-lated to the setup with a cavity have been demonstratedin experiments relevant for remote entanglement gener-ation. The parameters that have not been discussed inthe main text are discussed in the appendixes.1 Parameter Notation Value
Dephasing of C due to interaction a / per attempt [38, 61]Dephasing of C with time a / per second [60]Depolarizing of C due to interaction b / per attempt [38]Depolarizing of C with time b / per second [60]Memory-photon entanglement preparation time t prep µ s [48]Depolarizing parameter for the measurement of the electron spin F m . [31]Depolarizing parameter for two qubit gates in quantum memories F g . [33]Dephasing parameter for the memory-photon state preparation F prep . [48]Collection efficiency p ce . [40, 48]Emission into the zero-phonon line p zpl . [77]Detector efficiency p det . [48]Dark count rate d per second [48]Characteristic time of the NV emission τ . ns [77, 93]Detection window offset t offsetw . ns [48]Attenuation length L . km [48]Refractive index of the fiber n ri . [94]Optical phase uncertainty of the spin-spin entangled state ∆ φ . ◦ [31]TABLE I. Parameters used for the nitrogen-vacancy center setups considered in this paper. A. Comparing BB84 and six-state advantagedistillation protocols
We first investigate here when the BB84 or six-stateadvantage distillation protocol performs better. It wasshown in Ref. [17] that in the SiSQuaRe scheme there isa trade-off — for the low-noise regime (small distances)the fully asymmetric BB84 protocol is preferable, whilein the high-noise regime (large distances) the problem ofnoise can be overcome by using a six-state protocol sup-plemented with advantage distillation. This technique al-lows us to increase the secret-key fraction at the expenseof reducing the yield by a factor of three, since a six-stateprotocol in which Alice and Bob perform measurementson photonic qubits does not allow for the (fully) asym-metric protocol within our model. Numerically, we findthat for the SPADS and SPOTL scheme advantage dis-tillation is necessary to generate nonzero secret-key atany distance. This is due to the fact that there is asignificant amount of noise in these schemes. Thus, forthe SPADS (SPOTL) scheme the (a)symmetric six-stateprotocol with advantage distillation is optimal.To provide more insight into the performance of thosedifferent QKD schemes for different parameter regimes,we plot the achievable secret-key fraction for the SPADSand SPOTL schemes as a function of the depolarizingparameter due to imperfect electron spin measurement F m in Fig. 7 (see Appendix B for the discussion of thecorresponding noise model). Noise due to imperfect mea-surements is one of the significant noise sources in oursetup, since the SPADS scheme involves three and theSPOTL scheme four single-qubit measurements on thememory qubits. The data have been plotted for a fixeddistance of . L , where L = 0 . km is the atten-uation length of the fiber. Moreover, since on this plotwe aim at maximizing only the secret-key fraction overthe tunable parameters, we set the cutoff n ∗ to one and the detection time window t w to 5 ns (the smallest detec-tion time window we use) for both schemes. Furthermore,within the single-photon subscheme the heralding stationis always placed exactly in the middle between the twomemory nodes. We also consider the positioning of thememory repeater node to be two-thirds away from Alicefor the SPADS scheme and in the middle for the SPOTLscheme as discussed in the next section. For the SPOTLscheme we also assume θ A = θ B , which we will justify inthe next section.We see that for the current experimental value of F m = 0 . both schemes can generate key only if theadvantage distillation postprocessing is used. As F m in-creases, we observe that for the SPADS scheme first thesix-state protocol without advantage distillation and thenthe BB84 protocol start generating key. For the SPOTLscheme the value of F m at which the six-state protocolwithout advantage distillation starts generating key ismuch larger than the corresponding value of F m for anyof the studied protocols for the SPADS scheme. Thisis because the SPOTL scheme involves more noisy pro-cesses than the SPADS scheme. This also provides an ap-proximate quantification of the benefit of using advantagedistillation. Specifically, looking at the SPOTL scheme,it can be observed that while at the current experimen-tal value of F m = 0 . , advantage distillation allows forgenerating key, but at a higher value of the depolariz-ing parameter F m = 0 . , still no key can be generatedwith standard one-way post-processing. Moreover, wesee that utilizing advantage distillation for the SPADSscheme allows for the generation of key, even with verynoisy measurements when F m = 0 . . We also observetwo distinct scalings of the secret-key fraction with F m in the regime where nonzero amount of key is generated.These two scalings depend on whether we use a symmet-ric or asymmetric protocol. Specifically, for the SPADSscheme the symmetric six-state protocol is used. There-2 F m S e c r e t - k e y f r a c t i o n SPADS, BB84SPADS, 6-statesSPADS, 6-states, adv. dist.SPOTL, 6-statesSPOTL, 6-states, adv. dist.
FIG. 7. Secret-key fraction as a function of the depolarizingparameter due to noisy measurement F m for the total distanceof . L . We see that for the current experimental value of F m = 0 . (marked with a dashed black vertical line) bothschemes can generate key only if the advantage distillationpost-processing is used. As F m increases, the protocols thatdo not utilize advantage distillation also start generating key.We also see that the curves can be divided into two groups interms of their slope in the regime where they generate nonzeroamount of key. Those two groups correspond to the scenar-ios where a fully asymmetric (bigger slope) or a symmetric(smaller slope) protocol is used. For all the plotted proto-cols, the cutoff n ∗ is set to one and t w = 5 ns (the smallestdetection time window we use) to maximize the secret-keyfraction. Moreover, for each value of F m , we optimize thesecret-key fraction over the angle θ . For the SPOTL schemewe assume θ A = θ B . For the SPADS scheme, we position therepeater node 2/3 of the total distance away from Alice andin the middle between Alice and Bob for the SPOTL scheme. fore, the corresponding two curves have a slope that isapproximately three times smaller than the other threecurves corresponding to the protocols that run in thefully asymmetric mode. B. Optimal settings
We see that the above described repeater schemes in-clude several tunable parameters. These parameters arethe cut-off n ∗ for Bob’s number of attempts until restart,the angle θ in the single-photon scheme, and the position-ing of the repeater. These parameters can be optimizedto maximize the secret-key rate. Here we will approachthis optimization in a consistent way: We gradually re-strict the parameter space by making specific observa-tions based on numerical evidence.The first claim that we will make is in relation to the optimal positioning of the repeater. In Ref. [17], we haveconjectured that for the SiSQuaRe scheme the middle positioning of the repeater is optimal. For the single-photon scheme, we want the probability of transmittingthe photons from each of the two nodes to the beam-splitter heralding station to be equal. This effectivelysets the target state between the electron spins to be themaximally entangled state. Hence, if we restrict ourselvesto the case where the emission angles θ of both Aliceand Bob are the same, then it is natural to position theheralding station symmetrically in the middle betweenthem. Hence, the only nonobvious optimal positioning isfor the SPADS and SPOTL scheme.For the SPADS scheme, positioning the repeater attwo-thirds of the relative distance away from Alice couldintuitively be expected to be optimal. This is becausethe single-photon scheme runs on two segments: Alice–beam-splitter, beam-splitter–repeater, while the one halfof the SiSQuaRe scheme runs only over a single segmentbetween the repeater and Bob. By segment, we meanhere a distance over which we need to be able to inde-pendently transmit a photon. In Fig. 8, we show thesecret-key rate as a function of the relative positioningof the repeater for a set of different total distances. Wesee there that despite the fact that positioning the re-peater at two-thirds is not always optimal, it is a goodenough positioning for all distances for our purposes. Foreach data point on the plot, we independently optimizeover the cut-off n ∗ , the angle θ of the single-photon sub-scheme, and the duration of the detector time window t w .The SPOTL scheme has the same symmetry as theSiSQuaRe scheme, in the sense that the part of thescheme performed on Alice’s side is exactly the same ason Bob’s side. This symmetry is only broken by the se-quential nature of the scheme. Since we have alreadyobserved that the middle positioning is optimal for theSiSQuaRe scheme, we expect to see the same behaviorfor the SPOTL scheme. Indeed, we confirm this expec-tation numerically in Fig. 9. Here for each data point weindependently optimize over the cut-off n ∗ , the angle θ A ( θ B ) of the single-photon subscheme on Alice’s (Bob’s)side, and the duration of the detection time window.To conclude, we will always place the heralding sta-tion within the single-photon (sub)protocol exactly in themiddle between the two corresponding memory nodes.Moreover, we will also always place the memory repeaternode in the middle for the SPOTL scheme and two-thirdsof the distance away from Alice for the SPADS scheme.Having established the optimal positioning of the re-peater, we look into the relation between θ A and θ B forthe SPOTL scheme. We observe that the relative errorresulting from optimizing the secret-key rate over a sin-gle angle θ A = θ B rather than two independent ones issmaller than for all distances. Hence, from now on wewill restrict ourselves to optimizing only over one angle θ for the SPOTL scheme.Having resolved the issues of the optimal positioning ofthe repeater for all schemes and reducing the number ofangles to optimize over for the SPOTL scheme to one, we3 S e c r e t - k e y r a t e L L L L FIG. 8. Secret-key rate as a function of the relative position-ing of the repeater for few different total distances for theSPADS scheme. The total distances are expressed in termsof the fiber attenuation length L = 0 . km. We see thatpositioning the repeater two-thirds of the distance away fromAlice (marked by the vertical black dashed line) is a goodpositioning for all the distances. For each total distance con-sidered and each positioning, the secret-key rate is optimizedover the cutoff n ∗ , the angle θ , and the time window of thedetector t w . S e c r e t - k e y r a t e L L L L FIG. 9. Secret-key rate as a function of the relative position-ing of the repeater for few different total distances for theSPOTL scheme. The total distances are expressed in termsof the fiber attenuation length L = 0 . km. We see thatpositioning the repeater in the middle between Alice and Bob(marked by the vertical black dashed line) is a good position-ing for all the distances. For each total distance consideredand each positioning the secret-key rate is optimized over thecutoff n ∗ , the angles θ A and θ B and the time window of thedetector t w . now investigate how our secret-key rate depends on theremaining parameters. These parameters are the angle θ , the cut-off n ∗ , and the duration of the detection timewindow t w . The optimal time window follows a simplebehavior for all schemes: For short distances, the prob-ability of getting a dark count p d is negligible comparedto the probability of detecting the signal photon. Hence,for those distances we can use a time window of 30 nsto make sure that almost all the emitted photons whichare not polluted by the photons from the optical excita-tion pulse arrive inside the detection time window. Wealways need to sacrifice the photons arriving within thetime t offsetw after the optical pulse has been applied tofilter out the photons from that pulse; see Appendix Afor details. Then, for larger distances where p d starts tobecome comparable with the probability of detecting thesignal photon, the duration of the time window is grad-ually reduced. This reduces the effect of dark counts atthe expense of having more photons arriving outside ofthe time window. See Appendix A for the modeling ofthe losses resulting from photons arriving outside of thetime window.The dependence of the secret-key rate on the angle θ ,the tunable parameter that Alice and Bob choose in theirstarting state | ψ (cid:105) = sin θ |↓(cid:105) | (cid:105) +cos θ |↑(cid:105) | (cid:105) in the single-photon scheme, is more complex. We observe that theoptimal value of θ is closer to π for schemes that involvemore noisy processes. Informally, this means that Aliceand Bob send ‘fewer’ photons toward the beam splitterto overcome the noise coming from events in which bothnodes emit a photon. At π however, no photons areemitted and the rate drops down to zero. We illustratethis in Figs. 10, 11, and 12. We see that for the SPADSand SPOTL scheme, there is only a restricted regime ofthe angle θ for which one can generate nonzero amount ofkey. In particular, the SPOTL scheme requires a largernumber of noisy operations, and therefore cannot toleratemuch noise arising from the effect of photon loss in thesingle-photon subscheme. This means that there is onlya small range of θ that allows for production of secretkey. The single-photon scheme involves fewer operationsand can tolerate more noise, and so lower values of theparameter θ still allow for the generation of key.We also investigate the dependence of the rate on thecut-off. Both the SPADS and SPOTL scheme requirea lower cut-off than the SiSQuaRe scheme; see Figs. 13and 14. This is caused by the fact that each of theminvolves more noisy operations, and hence less noise tol-erance is possible. C. Achieved secret-key rates of the quantumrepeater proposals
Now we are ready to present the main results, thesecret-key rate for all the considered schemes as a func-tion of the total distance when optimized over θ , the cut-off n ∗ , and the duration of the time window t w . We4 S e c r e t - k e y r a t e x Single-photon
FIG. 10. Secret-key rate as a function of the θ angle for thesingle-photon scheme for the total distance of . L , where L = 0 . km. We see that there is a relatively large range ofangles for which nonzero amount of key can be generated. Foreach value of θ , the secret-key rate is optimized over the timewindow t w . The kink on the plot is a consequence of the factthat the six-state protocol with advantage distillation involvesoptimization over two subprotocols. compare the rates to the benchmarks from Sec. V.In Fig. 15, we plot the rate of all four of the quantumrepeater schemes as a function of the distance betweenAlice and Bob. We observe that already for realistic near-term parameters, the single-photon scheme can outper-form the secret-key capacity of the pure-loss channel bya factor of 7 for a distance of ≈ . km.We have also investigated what improvements wouldneed to be done in order for the SPADS and SPOTLschemes to also overcome the secret-key capacity. An ex-ample scenario in which the SPADS scheme outperformsthis repeaterless bound includes better phase stabiliza-tion such that ∆ φ = 5 ◦ and reduction of the decoherenceeffects in the carbon spin during subsequent entangle-ment generation attempts such that a = 1 / and b = 1 / . Further improvement of these effectivecoherence times to a = 1 / and b = 1 / al-lows the SPOTL scheme to also overcome the secret-keycapacity. We note that maintaining coherence of thecarbon-spin memory qubit for such a large number ofsubsequent remote entanglement-generation attempts isexpected to be possible using the method of decoherence-protected subspaces [38, 61].As mentioned before, the SPADS scheme can be natu-rally compared against the benchmark of the direct trans-mission using NV as a source. The results are depictedin Fig. 16. We see that the SPADS scheme easily over-comes the NV-based direct transmission and the thermalbenchmark for larger distances for which these bench-marks drop to zero. S e c r e t - k e y r a t e x SPADS
FIG. 11. Secret-key rate as a function of the θ angle forthe SPADS scheme for the total distance of . L , where L = 0 . km. We see that due to more noisy processesthe range of θ that allows us to generate key is much morerestricted than for the single-photon scheme. For each valueof θ , the secret-key rate is optimized over the cutoff n ∗ andthe time window t w . S e c r e t - k e y r a t e x SPOTL
FIG. 12. Secret-key rate as a function of the angle θ = θ A = θ B for the SPOTL scheme for the total distance of . L ,where L = 0 . km. We see that, due to the increasedamount of noisy processes, this scheme requires θ to be in amuch narrower regime than for the single-photon and SPADSschemes, as can be seen by comparing the plot with the plotsin Figs. 10 and 11. This corresponds to the overwhelmingdominance of the dark state of the spin (no emission of thephoton) in order to avoid any extra noise coming from thephoton loss. For each value of θ , the secret-key rate is opti-mized over the cutoff n ∗ and the time window t w . n * S e c r e t - k e y r a t e x SiSQuaReSPADS
FIG. 13. Secret-key rate as a function of the cut-off for theSiSQuaRe and SPADS scheme for the total distance of . L ,where L = 0 . km. We see that the SPADS scheme re-quires a lower cut-off than the SiSQuaRe scheme because itinvolves more noisy operations. For each value of the cutoff n ∗ , we optimize the secret-key rate over the time window t w and for the SPADS scheme also over the θ angle. The kinkfor the SiSQuaRe scheme arises because of the optimizationover the fully asymmetric one-way BB84 protocol and sym-metric six-state protocol with advantage distillation, whichitself involves optimization over two subprotocols. n * S e c r e t - k e y r a t e x SPOTL
FIG. 14. Secret-key rate as a function of the cut-off forthe SPOTL scheme for the total distance of . L , where L = 0 . km. We see that due to the large number of noisyoperations, this scheme requires a low cut-off in order to beable to generate key. For each value of the cutoff n ∗ we op-timize the secret-key rate over the time window t w and the θ angle. In Fig. 15, we observe that for the SPOTL scheme,the total distance over which key can be generated is sig-nificantly smaller than for the SPADS scheme. This isdespite the fact that the full distance is divided into foursegments. The rather weak performance of this schemeis because it involves a larger number of noisy opera-tions. As a result, the scheme can tolerate little noisefrom the single-photon subscheme, requiring the angle θ to be close to π , as can be seen in Fig. 12. Hence,the probability of photon emission becomes greatly di-minished and so the distance after which dark countsstart becoming significant is much smaller than for theSPADS scheme. To overcome this problem, one wouldneed to reduce the amount of noise in the system. Oneof the main sources of noise is the imperfect single-qubitmeasurement. Hence, we illustrate the achievable ratesfor the scenario with the boosted measurement depolar-izing parameter F m = 0 . in Fig. 17. Additionally, inthis plot we also consider the application of probabilisticfrequency conversion to the telecom wavelength at which L = 22 km. Frequency conversion has already beenachieved experimentally in the single-photon regime withsuccess probability of [95]. This is also the successprobability that we consider here. The correspondingbenchmarks have also been plotted for the new channelwith L = 22 km. We see in Fig. 17 that with the im-proved measurement and using frequency conversion, theSPOTL scheme allows now to generate secret key overmore than 550 km. We also see that under those con-ditions the single-photon scheme can also overcome thesecret-key capacity of the telecom channel. D. Runtime of the experiment
While the theoretical capability of an experimentalsetup to surpass the secret-key capacity is a necessary re-quirement to claim a working quantum repeater, it doesnot necessarily mean that this can be experimentally ver-ified in practice. Indeed, if a quantum repeater proposalonly surpasses the secret-key capacity by a narrow mar-gin at a large distance, the running time of an experimentcould be too long for practical purposes. In this sec-tion, we will discuss an experiment which can validate aquantum repeater setup and calculate the running timeof such an experiment, where we demonstrate that thesingle-photon scheme could be validated to be a quan-tum repeater within 12 hours.A straightforward way of validating a quantum re-peater would consist of first generating secret-key, calcu-lating the achieved (finite-size) secret-key rate and thencomparing the rate with the secret-key capacity. How-ever, this requires a large number of raw bits to be gen-erated, partially due to the loose bounds on finite-sizesecret-key generation. What we propose here is an ex-periment where the QBER and yield are separately esti-mated to be within a certain confidence interval. Then,if with the (worst-case) values of the yield and the QBER6 L unit)10 S e c r e t - k e y r a t e SiSQuaReSingle-photonSPADSSPOTLSecret-key capacitySecret-key capacity (Ext.)Thermal benchmark
FIG. 15. Rate of all studied quantum repeater schemes as a function of the distance between Alice and Bob, expressed in theunits of L = 0 . km. We also plot the different benchmarks from Sec. V. We see that the single-photon scheme outperformsthe secret-key capacity. For the achievable rates, the secret-key rate is optimized over the cutoff n ∗ , the angle θ , and the timewindow t w independently for each distance. the corresponding asymptotic secret-key rate still confi-dently beats the benchmarks, one could claim that, in theasymptotic regime, the setup would qualify as a quantumrepeater.As we show in Appendix H, it is possible to run thesingle-photon scheme over a distance of L ≈ . kmfor approximately 12 hours to find with high confidence( ≥ − . × − ) that the scheme beats the capacity[see Eq. (5)] at that distance by a factor of at least 3. E. Discussion and future outlook
It is worth noting that our figure of merit — thesecret-key rate — is weakly impacted by the latency oftransmission, which grows linearly with distance for theSiSQuaRe, SPADS, and SPOTL schemes. Its only ef-fect on the secret-key rate is the resulting decoherencetime in the quantum memories while the memory nodesawait the success or failure signals. This decoherencedue to the waiting time is negligible in comparison to thenoise due to interaction, arising from subsequent entan-glement generation attempts. On the other hand, this latency would clearly be very visible in low throughputof these schemes. The single-photon scheme, on the otherhand, has an advantage of the repetition rate being lim-ited only by the local processing of the memory nodes,which would result in a higher throughput. We observethis fact in the modest expected duration of the exper-iment, even in the high-loss regime needed for overcom-ing the secret-key capacity. It is worth noting that whilethe single-photon scheme maintains constant latency forQKD, there exist schemes where such constant latencycan be maintained also for remote entanglement genera-tion; see e.g. Ref. [96]. It is hence clear that there arecertain important properties of an efficient quantum re-peater scheme that are not captured by the secret-keyrate. However, achieving high throughputs for arbitrarydistances would require almost all the components to beefficient in terms of rates and memories to be of high qual-ity in terms of operational and long-storage fidelities. Itis clear that demonstrating all these features together ina single experiment is still a future goal. The advantageof the secret-key rate is that overcoming the secret-keycapacity would form a crucial step toward an implemen-tation of an efficient and practical, long-distance quan-7 L unit)10 S e c r e t - k e y r a t e NV direct transmissionSPADSSecret-key capacitySecret-key capacity (Ext.)Thermal benchmark
FIG. 16. Comparison of the SPADS scheme with the rateachievable using the direct transmission, with NV being thephoton source. The secret-key rates for those schemes areplotted as a function of the distance between Alice and Bob,expressed in the units of L = 0 . km. We also plot thedifferent benchmarks. We see that the SPADS scheme eas-ily overcomes the direct transmission and the thermal bench-mark (see Sec. V). For the secret-key rate achievable withthe SPADS scheme, we perform optimization over the cutoff n ∗ , the angle θ , and the time window t w independently foreach distance. Similarly, we also optimize the secret-key rateachievable with direct transmission over the time window t w . tum repeater architecture whose validity would carry aninformation-theoretic significance and will therefore betotally independent of any hardware-based reference sce-nario.In our model, we have identified a significant amountof noise arising in the system. As a result, we find that itis not always beneficial to just divide the fixed distanceinto more elementary links. Hence, it is a natural ques-tion whether this noise could be eliminated e.g. usingentanglement distillation. In fact, for the noise arisingdue to photon loss in the single-photon scheme, not onlydoes there exist an efficient distillation procedure [97, 98],but it has also already been demonstrated in the NVplatform [33]. Moreover, in the ideal case of noiseless op-erations and storage, a scheme based on generating twoentangled states through the single-photon scheme andthen distilling them as demonstrated in Ref. [33] shouldeffectively also be able to overcome the secret-key capac-ity [35] and provide a significant boost by completelyremoving the noise due to photon loss. Furthermore,an implementation of such a distillation-based remoteentanglement generation scheme would alleviate the re-quirement of the optical phase stabilisation of the sys-tem. Therefore, this distillation-based scheme could be a natural fifth candidate for a proof of principle repeater.Nevertheless, we believe that the fidelities of quantumoperations and the effective coherence times of the mem-ories used in this paper might need to be improved beforethis distillation would prove useful. VII. CONCLUSIONS
We analyzed four experimentally relevant quantum re-peater schemes on their ability to generate secret key.More specifically, the schemes were assessed by contrast-ing their achievable secret-key rate with the secret-keycapacity of the channel corresponding to direct trans-mission. The secret-key rates have been estimated us-ing near-term experimental parameters for the NV cen-ter platform. The majority of these parameters have al-ready been demonstrated across multiple experiments. Aremaining challenging element of our proposed schemesis the implementation of optical cavities. These cavitieswould enable the enhancement of both the photon emis-sion probability into the zero-phonon line and the photoncollection efficiency to the desired level.With these near-term experimental parameters, our as-sessment shows the viability of one of the schemes, thesingle-photon scheme, for the first experimental demon-stration of a quantum repeater. In fact, the single-photonscheme achieves a secret-key rate more than seven timesgreater than the secret-key capacity. We also estimatedthe duration of an experiment to conclude that a ratelarger than the secret-key capacity is achievable. Theduration of the experiment would be approximately 12hours.Finally, we show that a scheme based on concatenat-ing the single-photon scheme twice (i.e., the SPOTLscheme), has the capability to generate secret-key atlarge distances. However, this requires converting the fre-quency of the emitted photons to the telecom wavelengthand modestly improving the fidelity at which measure-ments can be performed.
ACKNOWLEDGEMENTS
The authors would like to thank Koji Azuma, TimCoopmans, Axel Dahlberg, Suzanne van Dam, Roelandter Hoeven, Norbert Kalb, Victoria Lipinska, Marco Lu-camarini, Gláucia Murta, Matteo Pompili, and JérémyRibeiro for helpful discussions and feedback. This workwas supported by the Dutch Technology Foundation(STW), the Netherlands Organization for Scientific Re-search (NWO) through a VICI grant (RH), a VIDI grant(SW), the European Research Council through a Start-ing Grant (RH and SW), the Ammodo KNAW award(RH) and the QIA project (funded by European Union’sHorizon 2020, Grant Agreement No. 820445).8 S e c r e t - k e y R a t e SiSQuaReSingle-photonSPADSSPOTLSecret-key capacitySecret-key capacity (Ext.)Thermal benchmark
FIG. 17. Secret-key rate as a function of distance in units of km for transmission at telecom channel with L = 22 km, alongwith the benchmarks from Sec. V. We consider an improved measurement depolarizing parameter of F m = 0 . . The frequencyconversion efficiency is assumed to be 0.3. We observe that the SPOTL scheme allows for the generation of secret-key over adistance of more than 550 km. For the achievable rates, the secret-key rate is optimized over the cutoff n ∗ , the angle θ and thetime window t w independently for each distance.[1] R. Jozsa, D. S. Abrams, J. P. Dowling, and C. P.Williams, Physical Review Letters , 2010 (2000).[2] M. Krčo and P. Paul, Physical Review A , 024305(2002).[3] J. Preskill, arXiv preprint quant-ph/0010098 (2000).[4] V. Giovannetti, S. Lloyd, and L. Maccone, Nature ,417 (2001).[5] T. P. Spiller, K. Nemoto, S. L. Braunstein, W. J. Munro,P. van Loock, and G. J. Milburn, New Journal ofPhysics , 30 (2006).[6] M. Christandl and S. Wehner, in International Confer-ence on the Theory and Application of Cryptology andInformation Security (Springer, 2005) pp. 217–235.[7] G. Brassard, A. Broadbent, J. Fitzsimons, S. Gambs,and A. Tapp, in
International Conference on the Theoryand Application of Cryptology and Information Security (Springer, 2007) pp. 460–473.[8] C. H. Bennett and G. Brassard, in
International Confer-ence on Computer System and Signal Processing, IEEE,1984 (1984) pp. 175–179.[9] A. K. Ekert, Physical Review Letters , 661 (1991).[10] J. L. Park, Foundations of Physics , 23 (1970). [11] M. Takeoka, S. Guha, and M. M. Wilde, Nature Com-munications , 5235 (2014).[12] M. Takeoka, S. Guha, and M. M. Wilde, InformationTheory, IEEE Transactions on , 4987 (2014).[13] S. Pirandola, R. Laurenza, C. Ottaviani, and L. Banchi,Nature Communications , 15043 EP (2017).[14] H.-J. Briegel, W. Dür, J. I. Cirac, and P. Zoller, Phys-ical Review Letters , 5932 (1998).[15] N. Sangouard, C. Simon, H. De Riedmatten, andN. Gisin, Reviews of Modern Physics , 33 (2011).[16] W. J. Munro, K. Azuma, K. Tamaki, and K. Nemoto,Selected Topics in Quantum Electronics, IEEE Journalof , 78 (2015).[17] F. Rozpędek, K. D. Goodenough, J. Ribeiro, N. Kalb,V. C. Vivoli, A. Reiserer, R. Hanson, S. Wehner, andD. Elkouss, Quantum Science and Technology , 034002(2018).[18] H. J. Kimble, Nature , 1023 (2008).[19] W. Dür, H.-J. Briegel, J. Cirac, and P. Zoller, PhysicalReview A , 169 (1999).[20] L.-M. Duan, M. Lukin, J. I. Cirac, and P. Zoller, Nature , 413 (2001). [21] C. Simon, H. De Riedmatten, M. Afzelius, N. San-gouard, H. Zbinden, and N. Gisin, Physical ReviewLetters , 190503 (2007).[22] N. Sangouard, C. Simon, B. Zhao, Y.-A. Chen,H. De Riedmatten, J.-W. Pan, and N. Gisin, Physi-cal Review A , 062301 (2008).[23] S. Guha, H. Krovi, C. A. Fuchs, Z. Dutton, J. A. Slater,C. Simon, and W. Tittel, Physical Review A , 022357(2015).[24] L. Jiang, J. M. Taylor, K. Nemoto, W. J. Munro,R. Van Meter, and M. D. Lukin, Physical Review A , 032325 (2009).[25] W. Munro, K. Harrison, A. Stephens, S. Devitt, andK. Nemoto, Nature Photonics , 792 (2010).[26] N. K. Bernardes and P. van Loock, Physical Review A , 052301 (2012).[27] W. Munro, A. Stephens, S. Devitt, K. Harrison, andK. Nemoto, Nature Photonics , 777 (2012).[28] S. Muralidharan, J. Kim, N. Lütkenhaus, M. D. Lukin,and L. Jiang, Physical Review Letters , 250501(2014).[29] K. Azuma, K. Tamaki, and H.-K. Lo, Nature Commu-nications , 6787 (2015).[30] D. Luong, L. Jiang, J. Kim, and N. Lütkenhaus, Ap-plied Physics B , 1 (2016).[31] P. C. Humphreys, N. Kalb, J. P. Morits, R. N. Schouten,R. F. Vermeulen, D. J. Twitchen, M. Markham, andR. Hanson, Nature , 268 (2018).[32] M. H. Abobeih, J. Cramer, M. A. Bakker, N. Kalb,M. Markham, D. J. Twitchen, and T. H. Taminiau,Nature Communications , 2552 (2018).[33] N. Kalb, A. A. Reiserer, P. C. Humphreys, J. J. Baker-mans, S. J. Kamerling, N. H. Nickerson, S. C. Benjamin,D. J. Twitchen, M. Markham, and R. Hanson, Science , 928 (2017).[34] T. H. Taminiau, J. Cramer, T. van der Sar, V. V. Do-brovitski, and R. Hanson, Nature Nanotechnology ,171 (2014).[35] S. B. van Dam, P. C. Humphreys, F. Rozpędek,S. Wehner, and R. Hanson, Quantum Science and Tech-nology , 034002 (2017).[36] M. Blok, N. Kalb, A. Reiserer, T. Taminiau, andR. Hanson, Faraday Discussions , 173 (2015).[37] J. Cramer, N. Kalb, M. A. Rol, B. Hensen, M. S. Blok,M. Markham, D. J. Twitchen, R. Hanson, and T. H.Taminiau, Nature Communications (2016).[38] A. Reiserer, N. Kalb, M. S. Blok, K. J. van Bemme-len, T. H. Taminiau, R. Hanson, D. J. Twitchen, andM. Markham, Physical Review X , 021040 (2016).[39] W. Gao, A. Imamoglu, H. Bernien, and R. Hanson,Nature Photonics , 363 (2015).[40] S. Bogdanovic, S. B. van Dam, C. Bonato, L. C. Coenen,A. Zwerver, B. Hensen, M. S. Liddy, T. Fink, A. Reis-erer, M. Loncar, and R. Hanson, Applied Physics Let-ters , 171103 (2017).[41] C. Cabrillo, J. I. Cirac, P. Garcia-Fernandez, andP. Zoller, Physical Review A , 1025 (1999).[42] M. Lucamarini, Z. Yuan, J. Dynes, and A. Shields,Nature , 400 (2018).[43] D. Bruß, Physical Review Letters , 3018 (1998).[44] H. Bechmann-Pasquinucci and N. Gisin, Physical Re-view A , 4238 (1999).[45] H.-K. Lo, M. Curty, and B. Qi, Physical Review Letters , 130503 (2012). [46] S. Pirandola, arXiv preprint arXiv:1601.00966 (2016).[47] S. D. Barrett and P. Kok, Physical Review A , 060310(2005).[48] B. Hensen, H. Bernien, A. Dréau, A. Reiserer, N. Kalb,M. Blok, J. Ruitenberg, R. Vermeulen, R. Schouten,C. Abellán, et al. , Nature , 682 (2015).[49] B. Hensen, N. Kalb, M. Blok, A. Dréau, A. Reiserer,R. Vermeulen, R. Schouten, M. Markham, D. Twitchen,K. Goodenough, et al. , Scientific Reports (2016).[50] H. Bernien, B. Hensen, W. Pfaff, G. Koolstra, M. Blok,L. Robledo, T. Taminiau, M. Markham, D. Twitchen,L. Childress, et al. , Nature , 86 (2013).[51] P. Maunz, D. Moehring, S. Olmschenk, K. Younge,D. Matsukevich, and C. Monroe, Nature Physics ,538 (2007).[52] R. Stockill, M. Stanley, L. Huthmacher, E. Clarke,M. Hugues, A. Miller, C. Matthiesen, C. Le Gall,and M. Atatüre, Physical Review Letters , 010503(2017).[53] A. Delteil, Z. Sun, W.-b. Gao, E. Togan, S. Faelt, andA. Imamoğlu, Nature Physics , 218 (2016).[54] C. W. Chou, H. de Riedmatten, D. Felinto, S. V.Polyakov, S. J. van Enk, and H. J. Kimble, Nature , 828 EP (2005).[55] K. Tamaki, H.-K. Lo, W. Wang, and M. Lucamarini,arXiv preprint arXiv:1805.05511 (2018).[56] X. Ma, P. Zeng, and H. Zhou, Physical Review X ,031043 (2018).[57] J. S. Ivan, K. K. Sabapathy, and R. Simon, PhysicalReview A , 042311 (2011).[58] M. W. Doherty, N. B. Manson, P. Delaney, F. Jelezko,J. Wrachtrup, and L. C. L. Hollenberg, Physics Reports , 1 (2013).[59] L. Robledo, L. Childress, H. Bernien, B. Hensen,P. F. A. Alkemade, and R. Hanson, Nature , 574(2011).[60] P. C. Maurer, G. Kucsko, C. Latta, L. Jiang, N. Y. Yao,S. D. Bennett, F. Pastawski, D. Hunger, N. Chisholm,M. Markham, et al. , Science , 1283 (2012).[61] N. Kalb, P. Humphreys, J. Slim, and R. Hanson, Phys-ical Review A , 062330 (2018).[62] W. Pfaff, B. Hensen, H. Bernien, S. B. van Dam, M. S.Blok, T. H. Taminiau, M. J. Tiggelman, R. N. Schouten,M. Markham, D. J. Twitchen, et al. , Science , 532(2014).[63] E. M. Purcell, H. C. Torrey, and R. V. Pound, PhysicalReview , 37 (1946).[64] D. Englund, B. Shields, K. Rivoire, F. Hatami,J. Vučković, H. Park, and M. D. Lukin, Nano Letters , 3922 (2010).[65] J. Wolters, A. W. Schell, G. Kewes, N. Nüsse, M. Scho-engen, H. Döscher, T. Hannappel, B. Löchel, M. Barth,and O. Benson, Applied Physics Letters , 141108(2010).[66] T. Van Der Sar, J. Hagemeier, W. Pfaff, E. C. Heeres,S. M. Thon, H. Kim, P. M. Petroff, T. H. Oosterkamp,D. Bouwmeester, and R. Hanson, Applied Physics Let-ters , 193103 (2011).[67] A. Faraon, C. Santori, Z. Huang, V. M. Acosta, andR. G. Beausoleil, Physical Review Letters , 033604(2012).[68] B. J. Hausmann, B. J. Shields, Q. Quan, Y. Chu,N. P. De Leon, R. Evans, M. J. Burek, A. S. Zibrov,M. Markham, D. J. Twitchen, H. Park, M. D. Lukin, and M. Loncar, Nano Letters , 5791 (2013).[69] J. C. Lee, D. O. Bracher, S. Cui, K. Ohno, C. A. McLel-lan, X. Zhang, P. Andrich, B. Alemán, K. J. Russell,A. P. Magyar, I. Aharonovich, A. Bleszynski Jayich,D. Awschalom, and E. L. Hu, Applied Physics Letters , 261101 (2014).[70] L. Li, T. Schröder, E. H. Chen, M. Walsh, I. Bayn,J. Goldstein, O. Gaathon, M. E. Trusheim, M. Lu,J. Mower, M. Cotlet, M. L. Markham, D. J. Twitchen,and D. Englund, Nature Communications , 6173(2015).[71] J. Riedrich-Möller, S. Pezzagna, J. Meijer, C. Pauly,F. Mücklich, M. Markham, A. M. Edmonds, andC. Becher, Applied Physics Letters , 221103 (2015).[72] A. Faraon, P. E. Barclay, C. Santori, K. M. C. Fu, andR. G. Beausoleil, Nature Photonics , 301 (2011).[73] P. E. Barclay, K. M. C. Fu, C. Santori, A. Faraon, andR. G. Beausoleil, Physical Review X , 011007 (2011).[74] M. Gould, E. R. Schmidgall, S. Dadgostar, F. Hatami,and K. M. C. Fu, Physical Review Applied , 2 (2016).[75] H. Kaupp, C. Deutsch, H. C. Chang, J. Reichel, T. W.Hänsch, and D. Hunger, Physical Review A , 053812(2013).[76] S. Johnson, P. R. Dolan, T. Grange, A. A. Trichet,G. Hornecker, Y. C. Chen, L. Weng, G. M. Hughes,A. A. Watt, A. Auffèves, and J. M. Smith, New Jour-nal of Physics , 122003 (2015).[77] D. Riedel, I. Söllner, B. J. Shields, S. Starosielec, P. Ap-pel, E. Neu, P. Maletinsky, and R. J. Warburton, Phys-ical Review X , 031040 (2017).[78] D. Hunger, T. Steinmetz, Colombe, Y., C. Deutsch,T. W. Hänsch, and J. Reichel, New Journal of Physics (2010).[79] E. Janitz, M. Ruf, M. Dimock, A. Bourassa, J. Sankey,and L. Childress, Physical Review A , 043844 (2015).[80] V. Scarani, H. Bechmann-Pasquinucci, N. J. Cerf,M. Dušek, N. Lütkenhaus, and M. Peev, Reviews ofModern Physics , 1301 (2009).[81] S. Watanabe, R. Matsumoto, T. Uyematsu, andY. Kawano, Physical Review A , 032312 (2007).[82] H.-K. Lo, H. F. Chau, and M. Ardehali, Journal ofCryptology , 133 (2005).[83] A. Khalique and B. C. Sanders, JOSA B , 2382(2015).[84] H. Krovi, S. Guha, Z. Dutton, J. A. Slater, C. Simon,and W. Tittel, Applied Physics B , 1 (2016). [85] M. Pant, H. Krovi, D. Englund, and S. Guha, PhysicalReview A , 012304 (2017).[86] K. Goodenough, D. Elkouss, and S. Wehner, New Jour-nal of Physics , 063005 (2016).[87] E. Kaur and M. M. Wilde, Physical Review A ,062318 (2017).[88] K. Sharma, M. M. Wilde, S. Adhikari, and M. Takeoka,New Journal of Physics , 063025 (2018).[89] N. Davis, M. E. Shirokov, and M. M. Wilde, PhysicalReview A , 062310 (2018).[90] C. Ottaviani, R. Laurenza, T. P. Cope, G. Spedalieri,S. L. Braunstein, and S. Pirandola, in Quantum In-formation Science and Technology II , Vol. 9996 (In-ternational Society for Optics and Photonics, 2016) p.999609.[91] R. Laurenza, S. L. Braunstein, and S. Pirandola, Sci-entific reports , 15267 (2018).[92] R. Laurenza, S. Tserkis, S. L. Braunstein, T. C. Ralph,and S. Pirandola, arXiv preprint arXiv:1808.00608(2018).[93] M. Fox, Quantum optics: an introduction , Vol. 15 (Ox-ford University Press, 2006).[94] R. Paschotta,
Encyclopedia of Laser Physics and Tech-nology (John Wiley & Sons, Hoboken, New Jersey,2008).[95] S. Zaske, A. Lenhard, C. A. Keßler, J. Kettler, C. Hepp,C. Arend, R. Albrecht, W.-M. Schulz, M. Jetter,P. Michler, et al. , Physical Review Letters , 147404(2012).[96] C. Jones, D. Kim, M. T. Rakher, P. G. Kwiat, andT. D. Ladd, New Journal of Physics , 083015 (2016).[97] E. T. Campbell and S. C. Benjamin, Physical ReviewLetters , 130502 (2008).[98] N. H. Nickerson, J. F. Fitzsimons, and S. C. Benjamin,Physical Review X , 041041 (2014).[99] I. L. Chuang, D. W. Leung, and Y. Yamamoto, PhysicalReview A , 1114 (1997).[100] O. Gittsovich, N. J. Beaudry, V. Narasimhachar, R. R.Alvarez, T. Moroder, and N. Lütkenhaus, Physical Re-view A , 012325 (2014).[101] S. R. Jammalamadaka and A. Sengupta, Topics in cir-cular statistics , Vol. 5 (World Scientific, 2001).[102] G. Murta, F. Rozpędek, J. Ribeiro, D. Elkouss, andS. Wehner, In preparation (2018).[103] R. Renner, arXiv preprint quant-ph/0512258 (2005).
Appendix A: Losses and noise on the photonic qubits
In this appendix, we describe how the losses and noise affect our photonic qubits. In particular, we first recall howthe two types of encoding result in the losses acting as different quantum channels on the states. Then, we studythe effects of a finite detector time window. More specifically, we first show that the arrival of a photon outside thetime window is equivalent to all the other loss processes. Second, we calculate the probability of registering a darkcount within the time window. We also show how to model the noise arising from those dark counts for the SiSQuaReand SPADS schemes. Finally, we calculate the dephasing induced by the unknown phase shift for the single-photonscheme.1
Effects of losses for the different encodings
The physical process of probabilistically losing photons corresponds to different quantum channels depending onthe qubit encoding. In our repeater schemes we use two types of encoding: time-bin and presence or absence of aphoton. For a time-bin encoded qubit in the ideal scenario of no loss we always expect to obtain a click in one ofthe detectors. Hence, loss of a photon resulting in a no-click event raises an erasure flag which carries the failureinformation. Therefore, it is clear that for this encoding the physical photon loss process corresponds to an erasurechannel with the erasure probability given by one minus the corresponding transmissivity, D ( ρ ) = ηρ + (1 − η ) |⊥(cid:105)(cid:104)⊥| . (A1)Here |⊥(cid:105) is the loss flag, corresponding to the nondetection of a photon. Since we are only interested in the quantumstate of the system for the successful events when a detection event has occurred, we effectively post-select on thenon-erasure events. For presence or absence encoding, the situation is different since now there is no flag availablethat could explicitly tell us whether a photon got lost or not. In fact, for this encoding the photon loss results inan amplitude-damping channel applied to the photonic qubit. Here, the damping parameter equals one minus thetransmissivity of the channel [99]. Effects of the detector time window
The detector only registers clicks that fall within a certain time window. It is a priori not clear what kind of noisyor lossy channel should be used to model the loss of information due to nondetection of photons arriving outsideof the time window. This is because in a typical loss process we have a probabilistic leakage of information to theenvironment. In the scenario considered here, the situation is slightly different as effectively no leakage occurs, butrather certain part of the incoming signal effectively gets discarded. Here we will show that despite this qualitativedifference, within our model this process can effectively be modeled as any other loss process.Now, let us provide a brief description of the physics of this process. First, the detection time window is chosensuch that the probability of detecting a photon from the optical excitation pulse used to entangle the electron spinwith the photonic qubit is negligible [48]. For that reason, the detection time window is opened after a fixed offset t offsetw with respect to the beginning of the decay of the optical excited state of the electron spin. We note that for theconsidered enhancement of the ZPL-emission using the optical cavity, we predict the characteristic time of the NVemission τ to be approximately half of the corresponding value of τ if no cavity is used [48, 77, 93]. Therefore, herewe consider the scenario where the duration of the optical excitation pulse is made twice shorter with respect to theone used in Ref. [48]. This will allow us to filter out the unwanted photons from the excitation pulse by setting t offsetw to half of the offset used in Ref. [48].Second, we note that the detection time window cannot last too long; specifically, it needs to be chosen such thatthere is a good trade-off between detecting coherent and non-coherent (i.e., dark counts) photons. In this subsection,we will discuss the effects of photons arriving outside of this time window and the effects of registering dark countswithin this time window. a. Losses from the detector time window The NV center emits a photon through an exponential decay process with characteristic time τ . Therefore theprobability of detecting a photon during a time window starting at t offsetw and lasting for t w is p in ( t w ) = 1 τ (cid:90) t offsetw + t w t offsetw dt exp (cid:18) − tτ (cid:19) = exp (cid:18) − t offsetw τ (cid:19) − exp (cid:18) − t offsetw + t w τ (cid:19) . (A2)Clearly the process of a photon arriving outside of the time window is qualitatively different from the loss processwhere the photons get lost to the environment. In the remainder of this section, we will now look at the differencebetween these two phenomena in more detail.The emission process of the NV center is a coherent process over time. Consider a generic scenario in which wedivide the emission time into two intervals, denoted by “in” and “out”, respectively. Coherent emission then meansthat the state of the photon emitted by the electron spin in state |↑(cid:105) will be | ψ (cid:105) = √ p in | (cid:105) in | (cid:105) out + (cid:112) − p in | (cid:105) in | (cid:105) out . (A3)2Now let us come back to our specific model, in which the “in” mode corresponds to the interval (cid:2) t offsetw , t offsetw + t w (cid:3) and the “out” mode to all the times t ≥ lying outside of this interval ( t = 0 is the earliest possible emission time).Here, the emission into the “in” mode occurs with probability p in ( t w ) . Hence the spin-photon state resulting from theemission by the α |↓(cid:105) + β |↑(cid:105) spin state is | ψ (cid:105) = α |↓(cid:105) | (cid:105) in | (cid:105) out + β |↑(cid:105) (cid:16)(cid:112) p in ( t w ) | (cid:105) in | (cid:105) out + (cid:112) − p in ( t w ) | (cid:105) in | (cid:105) out (cid:17) . (A4)If the presence or absence encoding is used, such a photonic qubit is then transmitted to the detector. Since only thespin and the “in” mode of the photon will be measured, we can now trace out the “out” mode: ρ = (cid:16) | α | + | β | p in ( t w ) (cid:17) | φ (cid:105)(cid:104) φ | + | β | (1 − p in ( t w )) |↑(cid:105)(cid:104)↑| ⊗ | (cid:105)(cid:104) | in , (A5)where | φ (cid:105) = 1 (cid:113) | α | + | β | p in ( t w ) (cid:16) α |↓(cid:105) | (cid:105) in + β (cid:112) p in ( t w ) |↑(cid:105) | (cid:105) in (cid:17) . (A6)Note that this state can be obtained by passing the photonic qubit of the state | ψ (cid:105) = α |↓(cid:105) | (cid:105) + β |↑(cid:105) | (cid:105) (A7)through the amplitude-damping channel with the damping parameter given by − p in ( t w ) . Hence we can concludethat for the photon number encoding, the possibility of the photon arriving outside of the time window of the detectorcan be modeled in the same way as any other photon loss process, namely an amplitude-damping channel applied tothat photonic qubit.In the case of time-bin encoding we effectively have four photonic qubits, since now we have an “in” and “out” modefor both the early (denoted by “e”) and the late (denoted by “l”) time window. We assume here that the slots do notoverlap. That is, a photon emitted in the “out” mode of the early time window is always distinct from any photonin the late time window. This can be achieved by making the time gap between the “in” modes of the early and latewindow long enough. In this case, the emission process results in a state | ψ (cid:105) = α |↓(cid:105) (cid:16)(cid:112) p in ( t w ) | (cid:105) e, in | (cid:105) e, out | (cid:105) l, in | (cid:105) l, out + (cid:112) − p in ( t w ) | (cid:105) e, in | (cid:105) e, out | (cid:105) l, in | (cid:105) l, out (cid:17) (A8) + β |↑(cid:105) (cid:16)(cid:112) p in ( t w ) | (cid:105) e, in | (cid:105) e, out | (cid:105) l, in | (cid:105) l, out + (cid:112) − p in ( t w ) | (cid:105) e, in | (cid:105) e, out | (cid:105) l, in | (cid:105) l, out (cid:17) . (A9)Again, tracing out the “out” modes results in a state ρ = p in ( t w ) | φ (cid:105)(cid:104) φ | + (1 − p in ( t w )) (cid:16) | α | |↓(cid:105)(cid:104)↓| + | β | |↑(cid:105)(cid:104)↑| (cid:17) ⊗ | (cid:105)(cid:104) | e,l , (A10)where | φ (cid:105) = α |↓(cid:105) | (cid:105) e | (cid:105) l + β |↑(cid:105) | (cid:105) e | (cid:105) l = α |↓(cid:105) | e (cid:105) + β |↑(cid:105) | l (cid:105) . (A11)Here | (cid:105) e,l corresponds to the loss flag from which we see that for the time-bin encoding the possible arrival of aphoton outside of the time window results in an erasure channel with the erasure probability given by [1 − p in ( t w )] .Hence this process can be also modeled as any other loss process for this encoding.We have just shown that for both photon presence or absence and time-bin encodings the process of the photonarriving outside of the time window can be modeled by the source which prepares photons in a coherent superpositionof the “in” and “out” modes and the detector tracing out (losing) the “out” modes. We have also shown that those twoelements combined together result effectively in a loss process corresponding to the same channel as any other loss pro-cess for that encoding (amplitude damping for photon presence or absence and erasure channel for time-bin encoding).However, between the source and the detector, there are other lossy or noisy components resulting in other quantumchannels that need to be applied before the tracing out of the “out” mode at the detector. Now we show that for allloss and noise processes that occur in our model, the tracing out of the “out” mode can be mathematically commutedthrough all those additional noise and/or lossy processes. This means that the tracing out can be applied directlyafter the source, such that the above described reductions to amplitude-damping or erasure channel can be applied.3Consider the quantum channels acting on the photonic qubits of the form N = (cid:88) i p i N i in ⊗ N i out . (A12)Effectively, these are the channels that do not couple the “in” and “out” modes. Since in reality “in” and “out” modescorrespond to different time modes, their coupling would require some kind of memory inside the channel. Hence wecan think of the above defined channels as channels without memory. Now it is clear that for a quantum state ρ thatamong its registers includes both the “in” and the “out” mode, we have that tr out [ N ( ρ )] = tr out (cid:34)(cid:88) i p i N i in ⊗ N i out ( ρ ) (cid:35) = (cid:88) i p i N i in ( ρ in ) . (A13)Now, first tracing out the “out” modes and then applying the channel N (only the “in” part can be applied now) alsoresults in (cid:80) i p i N i in ( ρ in ) at the output. Hence, the tracing out of the “out” modes commutes with all the channels thatare of the form (A12), which correspond to channels without memory. Clearly, the noise and/or loss processes thatoccur before the detection, such as photon loss or dephasing due to uncertainty in the optical phase of the photon,belong to this class of channels. In particular, this means that for photon presence or absence the amplitude dampingdue to photon loss in the channel and due to photon arrival outside of the time window can be both combined intoone channel with the single damping parameter given by − ηp in ( t w ) ( η denotes the transmissivity due to the lossprocess, e.g., the transmissivity of the fiber). The same applies to time-bin encoding where we now have a singleerasure channel with erasure probability − ηp in ( t w ) .To conclude, the arrival of the photon outside of the time window can be modeled in the same way as any other lossprocess for both photon encodings used and therefore we can now redefine the detector efficiency p (cid:48) det = p det p in ( t w ) and the total apparatus efficiency p (cid:48) app = p ce p zpl p (cid:48) det . We can then define η total = p (cid:48) app η f as the total transmissivity,with probability η total a photon will be successfully transmitted from the sender to the receiver. b. Dark counts within the detector time window Photon detectors are imperfect, and due to thermal excitations, they will register clicks that do not correspondto any incoming photons. These undesired clicks are called dark counts and can effectively be seen as a source ofnoise. The magnitude of this noise depends on the ratio between the probability of detecting the signal photon andmeasuring a dark count. Clearly, dark counts become a dominant source of noise when the probability of detectingthe signal photon becomes comparable to the probability of a dark count click. The probability p d of getting at leastone dark count within the time window t w of awaiting the signal photon is given by p d = 1 − exp( − t w d ) , where d isthe dark count rate of the detector [17].In the SiSQuaRe scheme, Alice and Bob perform measurements on time-bin-encoded photons. The same appliesto Bob in the SPADS scheme. Since at least two detectors are required to perform this measurement, the presenceof dark counts means that the outcome may lie outside of the qubit space. Moreover, this measurement needs to betrusted. In consequence, a squashing map needs to be used to process the multi-click events in a secure way. Here, asan approximation, we consider the squashing map for the polarization encoding [100] in the same way as described inRef. [17]. Hence, this measurement can also be modeled as a perfect measurement preceded by a depolarizing channelwith parameter α , which depends on whether the BB84 or six-state protocol is used. The parameter α is given by [17] α A/B,
BB84 = p (cid:48) app η B (1 − p d )1 − (1 − p (cid:48) app η A/B )(1 − p d ) , (A14) α A/B, six-state = p (cid:48) app η A/B (1 − p d ) − (1 − p (cid:48) app η A/B )(1 − p d ) . (A15)Here η A/B denotes the transmissivity of the fiber between the memory repeater node and Alice’s (Bob’s) detectorsetup. Finally we note that dark counts increase the probability of registering a successful measurement event. Forthe optical measurement schemes utilizing the squashing map, the probability of registering a click in at least onedetector is given by [17] p A/B, BB = 1 − (1 − p (cid:48) app η A/B )(1 − p d ) , (A16) p A/B, six-state = 1 − (1 − p (cid:48) app η A/B )(1 − p d ) . (A17)The effect of dark counts in the single-photon scheme, which carries over to the SPOTL scheme, is analyzed inAppendix E.4 Noise due to optical phase uncertainty
Another important noise process affecting photonic qubits is related to the fact that for the photon presenceor absence encoding the spin-photon entangled state will also depend on the optical phase of the apparatus used.Specifically, it will depend on the phase of the lasers used to generate the spin photon entanglement as well as theoptical phase acquired by the photons during the transmission of the photonic qubit. Knowledge about this phase iscrucial for being able to generate entanglement through the single-photon scheme. In any realistic setup, however,there would be a certain degree of the lack of knowledge about this phase acquired by the photons. Since in the endwhat matters is the knowledge about the relative phase between the two photons, we can model this source of noise asthe lack of knowledge of the phase on only one of the incoming photonic qubits. This noise process can be effectivelymodeled as dephasing. In this section, we will show that the phase uncertainty induces dephasing with a parameter λ equal to λ = I (cid:16) φ ) (cid:17) I (cid:16) φ ) (cid:17) + 12 , (A18)where ∆ φ is the uncertainty in the phase and I ( I ) is the Bessel function of order ( ). Let us assume that forAlice, the local phase of the photonic qubit has a Gaussian-like distribution on a circle, with standard deviation ∆ φ as observed in Ref. [31]. This motivates us to model the distribution as a von Mises distribution [101]. The von Misesdistribution reads f ( φ ) = e κ cos( φ − µ ) πI ( κ ) . (A19)Here µ is the measure of location, i.e., it corresponds to the center of the distribution, κ is a measure of concentrationand can be effectively seen as the inverse of the variance, and I is the modified Bessel function of the first kind oforder 0. One can then show [101] that (cid:90) π − π dφf ( φ ) e ± iφ = I ( κ ) I ( κ ) e ± iµ . (A20)Since we are only interested in the noise arising from the lack of knowledge about the phase rather than the actualvalue of this phase, without loss of generality we can assume µ = 0 . Moreover, the experimental parameter that weuse here is effectively the standard deviation of the distribution ∆ φ and therefore we can write κ = φ ) .Hence, let us write the spin-photon entangled state that depends on the optical phase φ : (cid:12)(cid:12) ψ ± ( φ ) (cid:11) = sin( θ ) |↓ (cid:105) ± e iφ cos( θ ) |↑ (cid:105) . (A21)Now, the lack of knowledge about this phase leads to a mixed state: (cid:90) π − π f ( φ ) (cid:12)(cid:12) ψ ± ( φ ) (cid:11)(cid:10) ψ ± ( φ ) (cid:12)(cid:12) dφ = sin ( θ ) |↓ (cid:105)(cid:104)↓ | + cos ( θ ) |↑ (cid:105)(cid:104)↑ |± sin( θ ) cos( θ ) (cid:90) π − π f ( φ )( e iφ |↑ (cid:105) (cid:104)↓ | + e − iφ |↓ (cid:105) (cid:104)↑ | ) dφ . (A22)Let us now try to map this state onto a dephased state: λ (cid:12)(cid:12) ψ ± (0) (cid:11)(cid:10) ψ ± (0) (cid:12)(cid:12) + (1 − λ ) (cid:12)(cid:12) ψ ∓ (0) (cid:11)(cid:10) ψ ∓ (0) (cid:12)(cid:12) = sin ( θ ) |↓ (cid:105)(cid:104)↓ | + cos ( θ ) |↑ (cid:105)(cid:104)↑ |± sin( θ ) cos( θ )(2 λ − |↑ (cid:105) (cid:104)↓ | + |↓ (cid:105) (cid:104)↑ | ) , (A23)Hence, we observe that λ − I (cid:16) φ ) (cid:17) I (cid:16) φ ) (cid:17) . (A24) → λ = I (cid:16) φ ) (cid:17) I (cid:16) φ ) (cid:17) + 12 . (A25)5 Appendix B: Noisy processes in NV-based quantum memories
In our setups we use C nuclear spins in diamond as long-lived memory qubits next to a Nitrogen Vacancy (NV)electron spin taking the role of a communication qubit. In this appendix, we will detail our model of the noisyprocesses in the NV.The electron spin can be manipulated via microwave pulses and an optical pulse is used to create and send a photonentangled with it. This operation is noisy and can be modeled as having a dephasing noise of parameter F prep . Thismeans that, if the desired generated target state between the photon and the electron spin was | ψ + (cid:105) , we actually havea mixture F prep | ψ + (cid:105)(cid:104) ψ + | + (1 − F prep )( I ⊗ Z ) | ψ + (cid:105)(cid:104) ψ + | ( I ⊗ Z ) .Information can be stored via a swapping of the electron spin state to the long living nuclear C spin. Throughthis swap operation we also free the communication qubit to be used for consecutive remote entanglement generationattempts. Because of the interaction with its environment, a quantum state stored in a C spin quantum memoryundergoes an evolution that we model with a dephasing and a depolarizing channel with noise parameters λ =(1 + e − an ) / and λ = e − bn , respectively. The form of the parameters a and b in general depends on the scheme. Forthe SiSQuaRe, SPADS and SPOTL schemes, there are two distinct effects that cause this decoherence: one inducedby the time it takes to generate entanglement between the middle node and Bob, and one induced by the always-onhyperfine coupling between the electron spin and the carbon spin inside the middle NV node. This coupling becomesan additional source of decoherence for the carbon spin during probabilistic attempts to generate remote entanglementusing the electron spin [38, 61]. We model the decoherence effect on the qubit stored in the carbon spin of the middlenode by a dephasing channel with parameter λ , D λ dephase ( ρ ) = λ ρ + (1 − λ ) ZρZ , (B1)and depolarizing channel with parameter λ , D λ depol ( ρ ) = λ ρ + (1 − λ ) I D , (B2)where λ and λ quantify the noise. The parameters depend as follows on the number of attempts n , λ = F T = 1 + e − an , (B3) λ = F T = e − bn , (B4)where a and b are given by a = a + a (cid:16) L s n ri c + t prep (cid:17) , (B5) b = b + b (cid:16) L s n ri c + t prep (cid:17) . (B6)Here n ri is the refractive index of the fiber, c is the speed of light in vacuum, t prep is the time it takes to prepare forthe emission of an entangled photon, and L s is the distance the signal needs to travel before the repeater receives theinformation about failure or success of the attempt. Let L B denote the distance between the memory repeater nodeand Bob. Then for the SiSQuaRe and SPADS schemes L s = 2 L B , since in each attempt first the quantum signalneeds to travel to Bob, who then sends back to the middle node the classical information about success or failure.For the SPOTL scheme L s = L B , since in this case both the quantum and the classical signals need to travel onlyhalf of the distance between the middle node and Bob since the signals are exchanged with the heralding station,which is located halfway between the middle memory node and Bob. The parameters a and b quantify the noisedue to a single attempt at generating an entangled spin-photon, induced by stochastic electron spin reset operations,quasi static noise, and microwave control infidelities. The parameters a and b quantify the noise during storage persecond.Gates and measurements in the quantum memory are also imperfect. We model those imperfections via twodepolarizing channels. The first one acts on a single qubit with depolarizing parameter λ = F m corresponding tothe measurement of the electron spin. The second one acts on two qubits with depolarizing parameter λ = F g corresponding to applying a two-qubit gate to both the electron spin and the C spin. This means that every time ameasurement is done on a e − qubit of a quantum state ρ , it is actually done on D F m depol ( ρ ) . Also a swapping operationbetween the e − spin and the nuclear spin (done experimentally via two two-qubit gates; see main text) leads to anerror modeled by a depolarizing channel of parameter F swap = F g . Following the same logic, a Bell state measurementwill cause the state to undergo an evolution given by a depolarizing channel. Specifically, following the decompositionof the Bell measurement into elementary gates for the NV implementation as described in Sec. III, this evolutionwill consist of a depolarizing channel with parameter F g acting on both of the measured qubits and the depolarizingchannel with parameter F m acting only on the electron spin qubit.6 Appendix C: Expectation of the number of channel uses with a cut-off
In this appendix, we derive an analytical formula for the expectation value of the number of channel uses betweenAlice and Bob needed to generate one bit of raw key for the SiSQuaRe, SPADS, and SPOTL schemes, E [ N ] = 1 p A · (1 − (1 − p B ) n ∗ ) + 1 p B . (C1)For these three schemes, we implement a cut-off which is used to prevent decoherence. Each time the number of channeluses between the repeater node and Bob reaches the cut-off n ∗ , the entire protocol restarts from the beginning. Here,we take a conservative view and define the number of channel uses N between Alice and Bob as the sum N A + N B ,where N A ( N B ) corresponds to the number of channel uses between Alice (Bob) and the middle node. From thelinearity of the expectation value, we have that E [ N A + N B ] = E [ N A ] + E [ N B ] . (C2)We denote by p A and p B the probability of a successful attempt on Alice’s and Bob’s side respectively. Bob’snumber of channel uses follows a geometric distribution with parameter p = p B , so that E [ N B ] = p B . Without thecut-off, Alice’s number of channel uses would follow a geometric distribution with parameter p = p A . However, thecut-off parameter adds additional channel uses on Alice side. Since the probability that Bob succeeds within n ∗ trialsis p succ = 1 − (1 − p B ) n ∗ , we in fact have that Alice’s number of channel uses follows a geometric distribution withparameter p (cid:48) A = p A p succ . Hence, it is straightforward to see that E [ N A + N B ] = 1 p (cid:48) A + 1 p B (C3) = 1 p A (1 − (1 − p B ) n ∗ ) + 1 p B . (C4) Appendix D: SiSQuaRe scheme analysis
The analysis of the SiSQuare scheme has been performed in [17]. In this work we use the estimates of the yield andQBER as derived in [17] with the following modifications:(1) For the calculation of the yield, we now adopt a conservative perspective and calculate the number of channeluses as E [ N A + N B ] , as derived in Appendix C, rather than E [ max ( N A , N B )] . Note that E [ max ( N A , N B )] ≤ E [ N A + N B ] ≤ E [ max ( N A , N B )] .(2) The total depolarizing parameter for gates and measurements F gm defined in Ref. [17] is now decomposedinto individual operations as described in Appendix B. That is, in this work depolarization due to imperfectoperations on the memories is expressed in terms of depolarizing parameter due to imperfect measurement, F m ,and imperfect two-qubit gate, F g . Since in the analysis of the SiSQuaRe scheme we only deal with Bell diagonalstates, the overall noise due to imperfect swap gate and the Bell measurement leads to F gm = F g F m .(3) In Ref. [17], we have assumed the duration of the detection time window to be fixed to 30 ns and assumed thatall the emitted photons will fall into that time window. Here, similarly as for other schemes, we perform a morerefined analysis in which we include the trade-off between the duration of the time window and the dark countprobability as described in Appendix A. Appendix E: Single-photon scheme analysis
In this appendix, we provide a detailed analysis of the single-photon scheme between two remote NV-center nodes.This section is structured as follows. First, we describe the creation of the spin-photon entangled state followed bythe action of the lossy channel on the photonic part of this state, including the noise due to the uncertainty in thephase of the state induced by the fiber. Second, we apply the optical Bell measurement. Then we evaluate the effectof dark counts, which introduce additional errors to the generated state. Finally, we calculate the yield of this schemeand extract the QBER from the resulting state.7
Spin-photon entanglement and action of a lossy fiber on the photonic qubit
First, both Alice and Bob generate spin-photon entangled states, parameterized by θ . As we will later see, thisparameter allows for trading off the quality of the final entangled state of the two spins with the yield of the generationprocess. The ideal spin-photon state would then be described as (cid:12)(cid:12) ψ + (cid:11) = sin ( θ ) |↓(cid:105) | (cid:105) + cos ( θ ) |↑(cid:105) | (cid:105) . (E1)The preparation of the spin-photon entangled state is not ideal. That is, the spin-photon entangled state is notactually as described above, but rather of the form (see Appendix B) ρ = F prep (cid:12)(cid:12) ψ + (cid:11)(cid:10) ψ + (cid:12)(cid:12) + (1 − F prep )( I ⊗ Z ) (cid:12)(cid:12) ψ + (cid:11)(cid:10) ψ + (cid:12)(cid:12) ( I ⊗ Z ) = F prep (cid:12)(cid:12) ψ + (cid:11)(cid:10) ψ + (cid:12)(cid:12) + (1 − F prep ) (cid:12)(cid:12) ψ − (cid:11)(cid:10) ψ − (cid:12)(cid:12) . (E2)Here, (cid:12)(cid:12) ψ − (cid:11) = sin ( θ ) |↓(cid:105) | (cid:105) − cos ( θ ) |↑(cid:105) | (cid:105) . (E3)For the next step, we need to consider two additional noise processes that affect the photonic qubits before theoptical Bell measurement is performed. The first one is the loss of the photonic qubit. This can happen at theemission, while filtering the photons that are not of the required ZPL frequency, in the lossy fiber, in the imperfectdetectors, or due to the arrival outside of the time window in which detectors expect a click. All these losses can becombined into a single loss parameter η = η total = p ce p zpl √ η f p (cid:48) det , (E4)with η f = exp (cid:16) − LL (cid:17) , where L is the distance between the two remote NV-center nodes in the scheme (see Fig. 6and Appendix A). Hence, a photon is successfully transmitted through the fiber and detected in the middle heraldingstation with probability η . Now we note that the action of the pure-loss channel on the qubit encoded in the presenceor absence of a photon corresponds to the action of the amplitude-damping channel with the damping parameter − η [99].The second process that effectively happens at the same time as loss is the dephasing noise arising from the opticalinstability of the apparatus as described in Appendix A. We note that the amplitude-damping and dephasing channelcommute; hence, it does not matter in which order we apply the two noise processes corresponding to the loss of thephotonic qubit and unknown drifts of the phase of the photonic qubit in our model. Here, we first apply the dephasingdue to the lack of knowledge of the phase on Alice’s photon and then amplitude damping on both photons due to allthe loss processes.Following the model in Appendix A, the lack of knowledge about the optical phase will effectively transform Alice’sstate to ρ A = ( F prep λ + (1 − F prep )(1 − λ )) (cid:12)(cid:12) ψ + (cid:11)(cid:10) ψ + (cid:12)(cid:12) + ((1 − F prep ) λ + F prep (1 − λ )) (cid:12)(cid:12) ψ − (cid:11)(cid:10) ψ − (cid:12)(cid:12) . (E5)where λ = I (cid:16) φ ) (cid:17) I (cid:16) φ ) (cid:17) + 12 . (E6)Now we can apply all the transmission losses modeled as the amplitude-damping channel. The action of this channelon the photonic part of the state ρ results in the state that we can describe as follows. First, let us introduce two newstates: (cid:12)(cid:12) ψ ± η (cid:11) = 1 (cid:113) sin ( θ ) + η cos ( θ ) (sin ( θ ) |↓(cid:105) | (cid:105) ± √ η cos ( θ ) |↑(cid:105) | (cid:105) ) . (E7)Then, after the losses and before the Bell measurement, the state of Alice can be written as ρ (cid:48) A = (cid:0) sin ( θ ) + η cos ( θ ) (cid:1) (cid:0) ( F prep λ + (1 − F prep )(1 − λ )) (cid:12)(cid:12) ψ + η (cid:11)(cid:10) ψ + η (cid:12)(cid:12) + ((1 − F prep ) λ + F prep (1 − λ )) (cid:12)(cid:12) ψ − η (cid:11)(cid:10) ψ − η (cid:12)(cid:12)(cid:1) + (1 − η ) cos ( θ ) |↑(cid:105)(cid:104)↑| | (cid:105)(cid:104) | , (E8)and for Bob ρ (cid:48) B = (cid:0) sin ( θ ) + η cos ( θ ) (cid:1) (cid:0) F prep (cid:12)(cid:12) ψ + η (cid:11)(cid:10) ψ + η (cid:12)(cid:12) + (1 − F prep ) (cid:12)(cid:12) ψ − η (cid:11)(cid:10) ψ − η (cid:12)(cid:12)(cid:1) + (1 − η ) cos ( θ ) |↑(cid:105)(cid:104)↑| | (cid:105)(cid:104) | . (E9)8 States after the Bell measurement
Now we need to perform a Bell measurement on the photonic qubits within the states ρ (cid:48) A and ρ (cid:48) B . Here weconsider the scenario with non-photon-number-resolving detectors. Assuming for the moment the scenario withoutdark counts, we have at most two photons in the system. Hence we can consider three possible outcomes of ouroptical measurement: left detector clicked, right detector clicked, and none of the detectors clicked. The measurementoperators can be easily derived by noting that in our scenario without dark counts, each of the detectors can betriggered either by one or two photons and no cross clicks between detectors are possible due to the photon-bunchingeffect. Then we can apply the reverse of the beam splitter mode transformations to the projectors on the eventswith one or two photons in each of the detectors to obtain these projectors in terms of the input modes. Finally, wetruncate the resulting projectors to the qubit space since in our scenario it is not possible for more than one photonto be present in each of the input modes of the beam splitter. In this way we obtain the following measurementoperators: A = (cid:12)(cid:12) Ψ + (cid:11)(cid:10) Ψ + (cid:12)(cid:12) + 1 √ | (cid:105)(cid:104) | ,A = (cid:12)(cid:12) Ψ − (cid:11)(cid:10) Ψ − (cid:12)(cid:12) + 1 √ | (cid:105)(cid:104) | ,A = | (cid:105)(cid:104) | . (E10)These outcomes occur with the following probabilities: p = p = η cos ( θ ) (cid:16) − η ( θ ) (cid:17) , (E11) p = (1 − η cos ( θ )) . (E12)The post-measurement state of the two spins for the outcome A is ρ = 2 sin ( θ )2 − η cos ( θ ) (cid:0) a (cid:12)(cid:12) Ψ + (cid:11)(cid:10) Ψ + (cid:12)(cid:12) + b (cid:12)(cid:12) Ψ − (cid:11)(cid:10) Ψ − (cid:12)(cid:12)(cid:1) + cos ( θ )(2 − η )2 − η cos ( θ ) |↑↑(cid:105)(cid:104)↑↑| . (E13)Here, (cid:12)(cid:12) Ψ ± (cid:11) = 1 √ |↓↑(cid:105) ± |↑↓(cid:105) ) , (E14) a = λ ( F prep + (1 − F prep ) ) + 2 F prep (1 − F prep )(1 − λ ) , (E15) b = (1 − λ )( F prep + (1 − F prep ) ) + 2 F prep (1 − F prep ) λ . (E16)For the outcome A , the postmeasurement state of the spins is the same up to a local Z gate which Bob can applyfollowing the trigger of the A outcome. The postmeasurement state of the spins for the outcome A , that is, whennone of the detector clicked, is ρ = 1[1 − η cos ( θ )] (cid:0) sin ( θ ) |↓↓(cid:105)(cid:104)↓↓| + (1 − η ) cos ( θ ) sin ( θ ) ( |↓↑(cid:105)(cid:104)↓↑| + |↑↓(cid:105)(cid:104)↑↓| ) + (1 − η ) cos ( θ ) |↑↑(cid:105)(cid:104)↑↑| (cid:1) . (E17)This is a separable state and so events corresponding to outcome A (that is, no click in any of the detectors) will bediscarded as failure. However, dark counts on our detectors can make us draw wrong conclusions about which of thethree outcomes we actually obtained.The effect of dark counts can be seen as follows(1) We measured A (no actual detection) but one of the detectors had a dark count. This event will happen withprobability p p d (1 − p d ) and will make us accept the state ρ . Note that this is a classical state so applicationof the Z correction by Bob does not affect this state at all.(2) We measured A or A but we also got a dark count in the other detector. This event will happen withprobability ( p + p ) p d . This will effectively lead us to rejection of the desired state ρ . Hence, effectively ρ willonly be accepted if we measured A or A but the other detector did not have a dark count, which will happenwith probability ( p + p )(1 − p d ) .9 The yield and QBER
Taking dark counts into account, we see that the yield of the single-photon scheme, which is just the probability ofregistering a click in only one of the detectors, will be Y = ( p + p )(1 − p d ) + 2 p p d (1 − p d ) = 2(1 − p d ) (cid:104) η cos ( θ ) (cid:16) − η ( θ ) (cid:17) + (1 − η cos ( θ )) p d (cid:105) . (E18)The effective accepted state after a click in one of the detectors will then be ρ out = 1 Y (( p + p )(1 − p d ) ρ + 2 p p d (1 − p d ) ρ ) . (E19)Note that both Alice and Bob perform a measurement on their electron spins immediately after each of the spin-photon entanglement generation events. This measurement causes an error modeled as a depolarizing channel ofparameter F m on each qubit, which means that after a successful run of the single-photon protocol, the effective stateshared by Alice and Bob including the noise of their measurements will be given by ρ AB = F m ρ out + (1 − F m ) F m (cid:20) I ,A ⊗ tr A [ ρ out ] + tr B [ ρ out ] ⊗ I ,B (cid:21) + (1 − F m ) I ,AB . (E20)One can then extract the QBER for this state in all the three bases using the appropriate correlated/anti-correlatedprojectors such that: e z = Tr[( | (cid:105)(cid:104) | + | (cid:105)(cid:104) | ) ρ AB ] , (E21) e xy = Tr(( | + −(cid:105)(cid:104) + −| + |− + (cid:105)(cid:104)− + | ) ρ AB ) = Tr(( | y y (cid:105)(cid:104) y y | + | y y (cid:105)(cid:104) y y | ) ρ AB ) . (E22)Here | + (cid:105) and |−(cid:105) denote the two eigenstates of X and | y (cid:105) and | y (cid:105) denote the two eigenstates of Y . We note thatfor our model of the single-photon scheme the QBER in X and Y bases are the same and therefore we denote bothby a single symbol e xy . Appendix F: SPADS and SPOTL schemes analysis
In order to compute the quantum bit error rate (QBER) of the Single-Photon with Additional Detection Setup(SPADS) scheme and the Single-Photon Over Two Links (SPOTL) scheme, we derive step by step the quantum stateshared between Alice and Bob. The following results have been found using
Mathematica . Finally, we also calculatethe yield of the SPADS and SPOTL schemes.
Generation of elementary links
Single-photon scheme on Alice side
The application of the single-photon scheme on Alice’s side leads Alice and the quantum repeater to share a stategiven in Eq. (E19). This state can be rewritten as ρ A-QR e = A (cid:12)(cid:12) Ψ + (cid:11)(cid:10) Ψ + (cid:12)(cid:12) + B (cid:12)(cid:12) Ψ − (cid:11)(cid:10) Ψ − (cid:12)(cid:12) + C ( | (cid:105)(cid:104) | + | (cid:105)(cid:104) | ) + D | (cid:105)(cid:104) | + E | (cid:105)(cid:104) | , (F1)with A = A ( θ A , Y A ) , B = B ( θ A , Y A ) , C = C ( θ A , Y A ) , D = D ( θ A , Y A ) and E = E ( θ A , Y A ) . Here, we have that A ( θ, Y ) = 1 Y ( θ ) sin ( θ ) η (1 − p d ) (cid:2) ( F prep + (1 − F prep ) ) λ + 2 F prep (1 − F prep )(1 − λ ) (cid:3) , (F2) B ( θ, Y ) = 1 Y ( θ ) sin ( θ ) η (1 − p d ) (cid:2) ( F prep + (1 − F prep ) )(1 − λ ) + 2 F prep (1 − F prep ) λ (cid:3) , (F3) C ( θ, Y ) = 2 Y cos ( θ ) sin ( θ ) p d (1 − p d )(1 − η ) , (F4) D ( θ, Y ) = 1 Y cos ( θ ) (cid:0) − η ) η (1 − p d ) + η (1 − p d ) + 2(1 − η ) p d (1 − p d ) (cid:1) , (F5) E ( θ, Y ) = 2 Y sin ( θ ) p d (1 − p d ) . (F6)In the above Y denotes the yield or the probability of success of the single-photon scheme and is given by Eq. (E18).Subscript A indicates that in that expression for the yield and for each of the above defined coefficients we use θ = θ A .Moreover, we have made here the following change of notation with respect to the Appendix E, |↓(cid:105) → | (cid:105) and |↑(cid:105) → | (cid:105) .0 SWAP gate in the middle node
In the next step, a SWAP gate is applied in the middle node to transfer the electron state to the nuclear spin ofthe NV center. This causes a depolarizing noise of parameter F swap = F g (see Appendix A). The resulting state canthen be written as ρ A-QR C = F swap ρ A-QR e + (1 − F swap ) tr QR [ ρ A-QR e ] ⊗ I . (F7) The procedure on Bob’s side
We now use the electron spin of the quantum repeater to generate the second quantum state. Here, the proceduresfor the SPADS and SPOTL schemes diverge.In the procedure for the SPADS scheme, the quantum repeater generates a spin-photon entangled state where thephotonic qubit is encoded in the time-bin degree of freedom. Since the spin-photon entangled state is imperfect, theelectron and the photon share a state ρ QR e − B = F prep (cid:12)(cid:12) Ψ + (cid:11)(cid:10) Ψ + (cid:12)(cid:12) + (1 − F prep ) (cid:12)(cid:12) Ψ − (cid:11)(cid:10) Ψ − (cid:12)(cid:12) . (F8)Here we use the following labeling for time-bin encoded early and late modes of the photon: | e (cid:105) = | (cid:105) , | l (cid:105) = | (cid:105) . Thisphoton is then sent toward Bob’s detector. The lossy channel acts on such a time-bin encoded qubit as an erasurechannel and so the quantum spin-photon state of the successful events in which the photonic qubit successfully arrivesat the detector is unaffected by the lossy channel.For the SPOTL scheme, the repeater’s electron spin and Bob’s quantum memory generate a second state of theform given in Eq. (E19). We can rewrite this state as ρ QR e − B = A (cid:12)(cid:12) Ψ + (cid:11)(cid:10) Ψ + (cid:12)(cid:12) + B (cid:12)(cid:12) Ψ − (cid:11)(cid:10) Ψ − (cid:12)(cid:12) + C ( | (cid:105)(cid:104) | + | (cid:105)(cid:104) | ) + D | (cid:105)(cid:104) | + E | (cid:105)(cid:104) | , (F9)with A = A ( θ B , Y B ) , B = B ( θ B , Y B ) , C = C ( θ B , Y B ) , D = D ( θ B , Y B ) , and E = E ( θ B , Y B ) . Decoherence in the quantum memories
Decoherence of the carbon spin in the middle node can be modeled identically for both the SPADS and SPOTLscheme.During the n < n ∗ attempts to generate the state ρ QR e -B , the carbon spin in the middle node holding half of thestate ρ A-QR C will decohere. Using the decoherence model discussed in Appendix B, decoherence of the carbon spinwill thus give us ρ (cid:48) A-QR C = F T [ F T ρ A-QR C + (1 − F T )( I ⊗ Z ) ρ A-QR C ( I ⊗ Z ) † ] + (1 − F T ) tr QR [ ρ A-QR C ] ⊗ I . (F10)For key generation, Alice (SPADS and SPOTL schemes) and Bob (SPOTL scheme) can actually measure their electronspin(s) immediately after the generation of spin photon entanglement, preventing the effect of decoherence on thesequbit(s). Noise due to measurements
Measurement of the qubits of Alice and Bob
In the SPADS scheme, Alice performs a measurement on her electron spin immediately after each of the spin-photonentanglement generation events to prevent any decoherence with time of this qubit. This measurement causes an errormodeled as a depolarizing channel of parameter F m . Bob, on the other hand, performs a measurement on a photonicqubit that is encoded in the time-bin degree of freedom. His measurement utilizes the squashing map so that wecan model the noise arising from this measurement as a depolarizing channel with parameter α B as described in1Appendix A. Hence, the total state just before the Bell measurement is given by ρ A − QR − B = F m α B ρ (cid:48) A-QR C ⊗ ρ QR e − B + (1 − F m ) α B I ,A ⊗ tr A [ ρ (cid:48) A-QR C ] ⊗ ρ QR e − B + (1 − α B ) F m ρ (cid:48) A-QR C ⊗ tr B [ ρ QR e − B ] ⊗ I ,B − F m )(1 − α B ) tr AB [ ρ (cid:48) A-QR C ⊗ ρ QR e − B ] ⊗ I ,AB . (F11)For the SPOTL scheme, both Alice and Bob perform a measurement on their electron spins immediately after eachof the spin-photon entanglement generation events. This measurement causes an error modeled as a depolarizingchannel of parameter F m on each qubit, which means that after both Alice and Bob succeeded in performing thesingle-photon scheme with the repeater, the total, four-qubit state just before the Bell-measurement and includingthe noise of the measurements of Alice and Bob will be given by ρ A − QR − B = F m ρ (cid:48) A-QR C ⊗ ρ QR e − B + (1 − F m ) F m (cid:20) I ,A ⊗ tr A [ ρ (cid:48) A-QR C ] ⊗ ρ QR e − B + ρ (cid:48) A-QR C ⊗ tr B [ ρ QR e − B ] ⊗ I ,B (cid:21) + (1 − F m ) tr AB [ ρ (cid:48) A-QR C ⊗ ρ QR e − B ] ⊗ I ,AB . (F12) Bell state measurement
Before the entanglement swapping, we have a total state ρ A − QR − B . We now perform a Bell state measurementon the two qubits in the middle node. The error coming from this measurement is modeled by concatenation ofdepolarizing channels (see Appendix A), which means that the measurement is actually performed on ρ fin = F g F m ρ A − QR − B + F g (1 − F m ) tr QR e [ ρ A − QR − B ] ⊗ I ,QR e − F g ) tr QR [ ρ A − QR − B ] ⊗ I ,QR . (F13)While ρ (cid:48) A-QR C is not Bell diagonal for the SPADS scheme, ρ QR e − B is, and so we find that taking into account theclassical correction (which will be performed on the measured bit-value by Alice and Bob) the four cases correspondingto different measurement outcomes are equivalent. This means that if we model the correction to be applied to thequantum state rather than the classical bit, then the four post-measurement bipartite states shared between Aliceand Bob are exactly the same.For the SPOTL scheme, both ρ (cid:48) A-QR C and ρ QR e − B are not Bell diagonal which means that the resulting state ofqubits of Alice and Bob after the Bell state measurement depends on the outcome of this Bell measurement and thosefour corresponding states are not equivalent under local unitary corrections. In fact, the two states correspondingto the Φ ± outcomes and the two states corresponding to the Ψ ± outcomes are pairwise equivalent under local Paulicorrections. Hence, we will derive two different QBER corresponding to the following different resulting states sharedbetween Alice and Bob, ρ Φ ,AB = ( I A ⊗ U Φ ± ,B ) Tr QR (cid:20) ( I ⊗ | Φ ± (cid:105)(cid:104) Φ ± | ⊗ I ) ρ fin ( I ⊗ | Φ ± (cid:105)(cid:104) Φ ± | ⊗ I ) † Tr( ρ fin ( I ⊗ | Φ ± (cid:105)(cid:104) Φ ± | ⊗ I )) (cid:21) ( I ⊗ U Φ ± ,B ) † , (F14) ρ Ψ ,AB = ( I A ⊗ U Ψ ± ,B ) Tr QR (cid:20) ( I ⊗ | Ψ ± (cid:105)(cid:104) Ψ ± | ⊗ I ) ρ fin ( I ⊗ | Ψ ± (cid:105)(cid:104) Ψ ± | ⊗ I ) † Tr( ρ fin ( I ⊗ | Ψ ± (cid:105)(cid:104) Ψ ± | ⊗ I )) (cid:21) ( I ⊗ U Ψ ± ,B ) † . (F15)Here U Φ ± ,B and U Ψ ± ,B denote the four Pauli corrections implemented by Bob after the corresponding outcome of theBell measurement. Note that for the SPADS scheme ρ Φ ,AB = ρ Ψ ,AB . The yield and QBER a. Yield
For both the SPADS and SPOTL scheme, we calculate the yield as the inverse of the number of channel usesrequired to generate one bit of raw key, Y = 1 / E [ N ] , where E [ N ] is given by Eq. (C1). For the SPOTL scheme in thatformula we use p A = Y A ( p B = Y B ), where Y A ( Y B ) denotes the yield of the single-photon scheme on Alice’s (Bob’s)side given by Eq. (E18). For the SPADS scheme, p A takes the same form as for the SPOTL scheme (but is nowcalculated for two thirds of the total distance between Alice and Bob rather than half), while p B is the probability ofregistering a click in Bob’s optical detection setup as in the SiSQuaRe scheme.2 Extraction of the qubit error rates
By projecting these final corrected states onto the correct subspaces, we can obtain the qubit error rates e z and e xy (with our model we find that for both SPADS and SPOTL schemes the error rates in X and Y bases are the same).The state shared between Alice and Bob after the Pauli correction will always be the same for the SPADS scheme.Thus, there is only a single QBER e z and e xy independently of the outcome of the Bell measurement. For the SPOTLscheme that is not the case, there will be two sets of QBER corresponding to the states ρ Φ ,AB and ρ Ψ ,AB : e z, Φ = Tr[( | (cid:105)(cid:104) | + | (cid:105)(cid:104) | ) ρ Φ ] , (F16) e z, Ψ = Tr[( | (cid:105)(cid:104) | + | (cid:105)(cid:104) | ) ρ Ψ ] , (F17) e xy, Φ = Tr[( | + −(cid:105)(cid:104) + −| + |− + (cid:105)(cid:104)− + | ) ρ Φ ] = Tr(( | y y (cid:105)(cid:104) y y | + | y y (cid:105)(cid:104) y y | ) ρ Φ ) , (F18) e xy, Ψ = Tr[( | + −(cid:105)(cid:104) + −| + |− + (cid:105)(cid:104)− + | ) ρ Ψ ] = Tr[( | y y (cid:105)(cid:104) y y | + | y y (cid:105)(cid:104) y y | ) ρ Ψ ] . (F19)Again, for the SPADS scheme e z, Φ = e z, Ψ = e z and e xy, Φ = e xy, Ψ = e xy . Averaging the qubit error rates
We have now derived the qubit error rates as a function of the experimental parameters. For the SPOTL scheme,we now average the QBER over the two outcomes to get the final average QBER, (cid:104) e z (cid:105) = (cid:104) p Ψ e z, Ψ + p Φ e z, Φ (cid:105) , (F20) (cid:104) e xy (cid:105) = (cid:104) p Ψ e xy, Ψ + p Φ e xy, Φ (cid:105) , (F21)where p Ψ ( p Φ ) is the probability of measuring one of the | Ψ (cid:105) ( | Φ (cid:105) ) states in the Bell measurement and (cid:104)· · · (cid:105) is foundby averaging the expression over the number of Bob’s attempts n with the geometric distribution within the first n ∗ trials. For the SPADS scheme (cid:104) e z (cid:105) and (cid:104) e xy (cid:105) can be averaged directly. The dependence on n arises from thedecoherence terms F T and F T . Indeed, those terms correspond to the decoherence in the middle node during theattempts on Bob’s side. Denoting by p B the probability that in a single attempt Bob generates entanglement withthe quantum repeater using the single-photon scheme for the SPOTL scheme and using direct transmission of thetime-bin encoded qubit from the repeater to Bob for the SPADS scheme, we have that the exponentials in thoseexpressions can be averaged as follows [17] (cid:104) e − cn (cid:105) = p B e − c − (1 − p B ) n ∗ − (1 − p ) n ∗ e − cn ∗ − (1 − p B ) e − c . (F22) Appendix G: Secret-key fraction and advantage distillation
In this section, we review the formulas for the secret-key fraction for the QKD protocols used in our model as afunction of the QBER.
One-way BB84 protocol
For the fully asymmetric BB84 protocol with standard one-way post-processing, the secret-key fraction is givenby [80, 82] r = 1 − h ( e x ) − h ( e z ) , (G1)where h ( x ) is the binary entropy function. Note that this formula is symmetric under the exchange of e x and e z ; thatis, the secret-key fraction is the same independent of whether we extract the key in the Z or X basis. As we will seelater in this section, this is not the case for the six-state protocol with advantage distillation.3 Six-state protocol with advantage distillation
Now we shall examine the six-state protocol with advantage distillation of Ref. [81]. For the purpose of this section,following the notation of Ref.[81], we shall denote the four Bell states as | ψ ( x , z ) (cid:105) = 1 √ | (cid:105) | x (cid:105) + ( − z | (cid:105) | x ( mod (cid:105) ) , (G2)for x , z ∈ { , } . We then write the Bell-diagonal state as ρ AB = (cid:88) x , z ∈{ , } p xz | ψ ( x , z ) (cid:105) (cid:104) ψ ( x , z ) | . (G3)The considered advantage distillation protocol is described in Ref. [81]. It is shown there that if the key is extractedin the Z basis, then the secret-key fraction for the fully asymmetric six-state protocol supplemented with this two-waypostprocessing technique is given by r six-state = max (cid:26) − H ( P XZ ) + P ¯ X (1)2 h (cid:18) p p + p p ( p + p )( p + p ) (cid:19) , P ¯ X (0)2 [1 − H ( P (cid:48) XZ )] (cid:27) , (G4)where P ¯ X (0) = ( p + p ) + ( p + p ) , (G5) P ¯ X (1) = 2( p + p )( p + p ) , (G6) p (cid:48) = p + p ( p + p ) + ( p + p ) , (G7) p (cid:48) = 2 p p ( p + p ) + ( p + p ) , (G8) p (cid:48) = p + p ( p + p ) + ( p + p ) , (G9) p (cid:48) = 2 p p ( p + p ) + ( p + p ) , (G10) P XZ ( P (cid:48) XZ ) is the probability distribution over the coefficients p xz ( p (cid:48) xz ) and H ( P XZ ) ( H ( P (cid:48) XZ ) ) is the Shannon entropyof this distribution.Now let us have a look at how to link the Bell coefficients p xz with our QBER e z and e xy (for all our schemes, theestimated QBER in the X basis is the same as in the Y basis). In this section, we assume the target state that Aliceand Bob want to generate is | ψ ( , ) (cid:105) . Note that in the analysis in Appendixes E and F it is the state | ψ ( , ) (cid:105) that isa target, but of course the secret-key fraction analysis is independent of which Bell state is a target state as they areall the same up to local Pauli rotations. Hence, the relation between the Bell-diagonal coefficients and the QBER is p + p = e z , (G11) p + p = e xy , (G12) p + p = e xy , (G13) p + p + p + p = 1 . (G14)Therefore, p = 1 − e z − e xy ,p = e xy − e z ,p = p = e z . (G15)And so, P ¯ X (0) = 1 − e z + 2 e z , (G16) P ¯ X (1) = 2(1 − e z ) e z . (G17)4It is important to note that for the above described advantage distillation, the amount of generated secret keydepends on the basis in which it is extracted, as has been shown in Ref. [102]. Let us now have a look at the amountof key that can be extracted in the X and Y bases. As has been shown in Ref. [102], the secret-key fraction in thesecases is also given by Eq. (G4) but now the Bell coefficients depend on QBER in the following way: p = 1 − e z − e xy ,p = e xy − e z ,p = p = e z . (G18)And so, P ¯ X (0) = 1 − e xy + 2 e xy ,P ¯ X (1) = 2(1 − e xy ) e xy . (G19)We note that we have assumed here that in the case of key extraction in Y basis, either Alice or Bob applies a localbit flip in the Y basis to the shared state, as the target state | ψ (0 , (cid:105) is anticorrelated in that basis.In Ref. [102] it has been also observed that in the considered case of having the QBER in the X and Y basesbeing equal, the six-state protocol with advantage distillation allows us to extract more key if it is extracted in thebasis with higher QBER. This observation determines the basis that we use for extracting key for the single-photonand the SPOTL schemes that use fully asymmetric six-state protocol with advantage distillation. Specifically, for thesingle-photon scheme we observe higher QBER in the Z basis, while for the SPOTL scheme the QBER is higher inthe X and Y bases. Therefore, these are the bases that we choose to use for extracting key for those schemes.For the SiSQuaRe and SPADS schemes, the symmetric six-state protocol is used. Hence, for those schemes wegroup the raw bits into three groups corresponding to three different key-extraction bases and we extract the keyseparately for each of these bases. Finally, to obtain the final secret-key fraction, we note that for the symmetricsix-state protocol we also need to include sifting; that is, only one third of all the raw bits were obtained by Alice andBob measuring in the same basis (the raw bits for the protocol runs in which they measured in different bases arediscarded). Hence, if we denote by r i the secret-key fraction obtained from the group of raw bits in which both Aliceand Bob measured in the basis i , the final secret-key fraction for the six-state protocol for those schemes is given by r = 13 (cid:18) r x + 13 r y + 13 r z (cid:19) . (G20)Clearly, in our case we have r x = r y = r xy . One-way six-state protocol
In Fig. 7 we have also plotted the secret-key fraction for the one-way six-state protocol. For the fully asymmetricprotocol and the case in which the key is extracted in the Z basis, it is given by [80] r = 1 − e z h (cid:18) e x − e y ) /e z (cid:19) − (1 − e z ) h (cid:18) − ( e x + e y + e z ) / − e z (cid:19) − h ( e z ) . (G21)Although this formula does not appear to be symmetric under the permutation of e x , e y , e z , it is in fact invariantunder this permutation [103]. This means that for the symmetric one-way six-state protocol, in our case the finalsecret-key fraction is given by the expression in Eq. (G21) multiplied by the sifting efficiency of one-third. Appendix H: Runtime of the experiment
In this section, we will detail how to perform an experiment that will be able to establish that a setup can surpassthe capacity of a quantum channel modeling losses in a fiber (see Eq. (5)). This experiment can validate a setup toqualify as a quantum repeater, without explicitly having to generate secret-key. We show then that, for the listedparameters in the main text, the single-photon scheme can be certified to be a quantum repeater within approximately12 hours.5The experiment is based on estimating the yield of the scheme and the individual QBER of the generated states.More specifically, here we will calculate the probability that, assuming our model is accurate and each individual runis independent and identically distributed, the observed estimates of the yield and the individual QBER are largerand smaller, respectively, than some fixed threshold values. If, with these threshold values for the yield and QBER,the calculated asymptotic secret-key rate still surpasses the capacity, we can claim a working quantum repeater. Theexperiment consists of first performing n attempts at generating a state between Alice and Bob, from which theyield can be estimated by calculating the ratio of the successful attempts and n . Then, the QBER in each basis isestimated by Alice and Bob measuring in the same basis in each of the successful attempts.Central to our calculation is the fact that, for n instances of a Bernoulli random variable with probability p , theprobability that the number of observed successes S ( n ) is smaller or equal than some value k is equal to P ( S ( n ) ≤ k ) = k (cid:88) i =0 (cid:18) ni (cid:19) p i (1 − p ) n − i . (H1)Assuming the outcomes of our experiment are independent and identically distributed, the observed yield ¯ Y satisfies P (cid:0) ¯ Y ≤ ( Y − t Y ) (cid:1) = P (cid:0) n ¯ Y ≤ n ( Y − t Y ) (cid:1) = (cid:98) n ( Y − t Y ) (cid:99) (cid:88) i =0 (cid:18) ni (cid:19) Y i (1 − Y ) n − i , (H2)where Y − t Y is the lower threshold. Let us make this more concrete with a specific calculation. For a distance of L the yield is equal to ≈ . × − . Setting the maximum deviation in the yield to ¯ Y = Y − t Y with t Y = 2 . × − and the number of attempts to n = 5 × (which corresponds to approximately a runtime of 12 hours assuming asingle attempt takes . × − s, corresponding to t prep and a single-shot readout lasting . × − s), we find that P (cid:0) ¯ Y ≤ ( Y − t Y ) (cid:1) ≤ . · − . (H3)Similarly, for the individual errors { e k } k ∈{ x,y,z } in the three bases we have that P (¯ e k ≥ ( e k + t k )) = P ( m · ¯ e k ≥ m ( e k + t k )) = m (cid:88) i = (cid:100) m ( e k + t k ) (cid:101) (cid:18) mi (cid:19) ( e k ) i (1 − e k ) m − i . (H4)Here we set m = (cid:4) n ( Y − t Y ) (cid:5) , which is an estimate for the number of raw bits that Alice and Bob obtain frommeasurements in each of the three bases, for the total n attempts of the protocol. All the raw bits from those threesets are then compared to estimate the QBER in each of the three bases. Note that we gather the same amount ofsamples for each basis, even when an asymmetric protocol would be performed. Setting t i = t = 0 . , ∀ i ∈ { x, y, z } and, as before, n = 5 × , we find, at a distance of L where e z ≈ . and e y = e x ≈ . , that P (¯ e z ≥ ( e z + t )) ≤ . × − , (H5) P (¯ e y ≥ ( e y + t )) = P (¯ e x ≥ ( e x + t )) ≤ . × − . (H6)Then, with probability at least (1 − P (¯ e x ≥ ( e x + t ))) (1 − P (¯ e y ≥ ( e y + t ))) (1 − P (¯ e z ≥ ( e z + t ))) (cid:0) − P (cid:0) ¯ Y ≤ ( Y − t Y ) (cid:1)(cid:1) ≥ − . × − , (H7)none of the observed QBER and yield exceed their threshold conditions. The corresponding lowest secret-key rate forthese parameters (with a yield of Y − t Y and QBER of e x + t x , e y + t y , e z + t z ) is ≈ . × − , which we observeis greater than the secret-key capacity by a factor ≈ . (see Eq.(5)) at a distance of L , since the secret-keycapacity equals − log (cid:0) − e − (cid:1) (cid:46) . × − .Thus, with high probability we can establish that the single-photon scheme achieves a secret-key rate significantlygreater than the corresponding secret-key capacity for a distance of L ≈ . km within approximately 12 hours.6 Appendix I: MDI QKD
We note here that the single-photon scheme for generating key is closely linked to the measurement-device-independent (MDI) QKD protocol [45]. In particular, it is an entanglement-based version of a scheme in whichAlice and Bob prepare and send specific photonic qubit states to the heralding station in the middle, where the qubitsare encoded in the presence or absence of the photon. We note that in the ideal case of the single-photon scheme, thespin-photon state is given in Eq. (E1). For the six-state protocol the spin part of this state is then measured in the X , Y , or Z basis at random according to a fixed probability distribution (this probability distribution dictates whetherwe use symmetric or asymmetric protocol). Considering the probabilities of the individual measurement outcomes,this is equivalent to the scenario in which Alice and Bob choose one of the three set of states at random according tothe same probability distribution and prepare each of the two states from that set with the probability equal to thecorresponding measurement outcome probability. These sets do not form bases, as the two states within each set arenot orthogonal. We will therefore refer to these sets here as “pseudobases”. Depending on the chosen pseudobasis,they prepare one of the six states encoding the bit value of “0” or “1” in that pseudobasis. These states and thecorresponding preparation probabilities are the following:(1) pseudo-basis 1: {| (cid:105) , | (cid:105)} with probabilities { sin θ, cos θ } ,(2) pseudo-basis 2: { sin θ | (cid:105) + cos θ | (cid:105) , sin θ | (cid:105) − cos θ | (cid:105)} with probabilities { , } ,(3) pseudo-basis 3: { sin θ | (cid:105) + i cos θ | (cid:105) , sin θ | (cid:105) − i cos θ | (cid:105)} with probabilities { , } .These states are then sent toward the beam-splitter station. The station performs the standard photonic Bell-state measurement and sends the outcome to both Alice and Bob. Alice and Bob discard all the runs for which thebeam-splitter station measured A (recall the measurement operators in Eq. (E10)). They then exchange the classicalinformation about their pseudo-basis choice and keep only the data for the runs in which they both used the samebasis. For those data they apply the following post-processing in order to obtain correlated raw bits(1) Pseudo-basis 1: For both outcomes A and A , Bob flips the value of his bit.(2) Pseudo-basis 2: For the outcome A , they do nothing; for the outcome A , Bob flips the value of his bit.(3) Pseudo-basis 3: For the outcome A , they do nothing; for the outcome A1