Phase-Matching Quantum Cryptographic Conferencing
Shuai Zhao, Pei Zeng, Wen-Fei Cao, Xin-Yu Xu, Yi-Zheng Zhen, Xiongfeng Ma, Li Li, Nai-Le liu, Kai Chen
PPhase-Matching Quantum Cryptographic Conferencing
Shuai Zhao,
1, 2
Pei Zeng, Wen-Fei Cao,
1, 2
Xin-Yu Xu,
1, 2
Yi-ZhengZhen,
4, 1, 2
Xiongfeng Ma, ∗ Li Li,
1, 2, †
Nai-Le liu,
1, 2, ‡ and Kai Chen
1, 2, § Hefei National Laboratory for Physical Sciences at Microscale and Department of Modern Physics,University of Science and Technology of China, Hefei, Anhui 230026, People’s Republic of China CAS Center for Excellence and Synergetic Innovation Center of Quantum Information and Quantum Physics,University of Science and Technology of China, Hefei, Anhui 230026, People’s Republic of China Center for Quantum Information, Institute for Interdisciplinary Information Sciences,Tsinghua University, Beijing 100084, People’s Republic of China Institute for Quantum Science and Engineering, Southern University of Science and Technology,Shenzhen, Guangdong 518055, People’s Republic of China
Quantum cryptographic conferencing (QCC) holds promise for distributing information-theoretic secure keysamong multiple users over long distance. Limited by the fragility of Greenberger-Horne-Zeilinger (GHZ) state,QCC networks based on directly distributing GHZ states at long distance still face big challenge. Another twopotential approaches are measurement device independent QCC and conference key agreement with single-photon interference, which was proposed based on the post-selection of GHZ states and the post-selection ofW state, respectively. However, implementations of the former protocol are still heavily constrained by thetransmission rate η of optical channels and the complexity of the setups for post-selecting GHZ states. Mean-while, the latter protocol cannot be cast to a measurement device independent prepare-and-measure scheme.Combining the idea of post-selecting GHZ state and recently proposed twin-field quantum key distribution pro-tocols, we report a QCC protocol based on weak coherent state interferences named phase-matching quantumcryptographic conferencing, which is immune to all detector side-channel attacks. The proposed protocol canimprove the key generation rate from O ( η N ) to O ( η N − ) compared with the measurement device independentQCC protocols. Meanwhile, it can be easily scaled up to multiple parties due to its simple setup. PACS numbers: 03.65.Ud, 03.67.HK, 03.67.-a
I. INTRODUCTION
Quantum network [1–10], aimed at realizing quantum in-formation tasks among multiple parties, is playing more andmore important roles in burgeoning quantum information pro-cessing including quantum computing [11], quantum com-munication [12] and quantum metrology [13]. QuantumCryptographic Conferencing (QCC) network [14–19], whichdistributes information-theoretic secure keys among multipleparties over long distance, is one of the most promising ap-plications in quantum information science. With the rapid de-velopment of quantum information processing, QCC networkis of great potential to improve the security of the communi-cations in networks. For example, QCC network can be usedto broadcast message to users securely. So far, several pro-tocols are proposed to realize QCC networks. The first pro-tocol is based on the predistribution of multi-party entangle-ment states [14–16]. These presentations require the predistri-bution of Greenberger-Horne-Zeilinger (GHZ) entanglementstate [20], which is initially introduced to verify Bell’s theo-rem [21, 22]. Though great endeavours have been made toimprove preparation of multipartite GHZ states [23–29], thelow intensity and fragility of the GHZ states make its apply-ing to practical QCC network facing big challenge within cur-rent technology. The second protocol is measurement device ∗ [email protected] † [email protected] ‡ [email protected] § [email protected] independent QCC (MDI-QCC) which is based on the post-selection of GHZ state [17]. Once a successful detection eventoccurs, a GHZ state is shared among multiple parties [30].Thus, multiple parties can distribute secret key bits amongthem by the post-selected entanglement states. Further, themeasurement device can be controlled by an untrusted thirdparty, Eve. Therefore, according to the measurement deviceindependent quantum key distribution (MDI-QKD) idea [31](see also [32]), it is immune to all detector side-channel at-tacks. Combined with decoy-state method [33], MDI-QCCnetwork is promised more reasonably to be realized in ex-periments within current technology. The third protocol isthe conference key agreement with single photon interference(single-photon CKA) [18], which is based on post-selectionof the W state [34]. However, the single-photon CKA pro-tocol cannot be cast to a MDI prepare-and-measure scheme.Meanwhile, the signal pulses cannot be substituted by coher-ent states, and the local qubits have to resort to quantum mem-ories. Thus, the feasibility of single-photon CKA requires fur-ther investigation [18].Recently, twin-field quantum key distribution (TF-QKD) and phase-matching quantum key distribution (PM-QKD) [35–44] are reported to overcome the repeater-less rate-distance limit [45] of quantum key distribution (QKD). By in-troducing single-photon interference, these protocols achievekey generation rates scaling with the square-root of the chan-nel transmittance O ( √ η ) which exceeds the rate-distancelimit without quantum repeaters. Here η is the transmissionrate of the optical channel between two users. At the sametime, their measurement device can be controlled by an un-trusted third party, which is also immune to all detector side- a r X i v : . [ qu a n t - ph ] J un EveBS BSBS1 BS …… FC FCFC
FIG. 1. Schematic setup for N -party PM-QCC network. φ , φ and φ N ∈ [ , π ) label the random phases for parties P , P and P N , re-spectively. The k , k and k N ∈ { , } label the random bits for par-ties P , P and P N , respectively. D L ( D R ) : the left (right) detectorof the first measurement branch. D L ( D R ) : the left (right) detectorof the second measurement branch. D L N − ( D R N − ) : the left (right)detector of the ( N − ) -th measurement branch. BS: Beam Splitter.FC: Fiber Channel. channel attacks [31]. These new types of QKD protocols havealso been realized [46–50] and shown to extend the distanceof repeaterless fibre QKD to over 500 km [50].In this paper, we present a new QCC network protocolby combining ideas of phase-matching weak coherent pulses(WCPs) interference and post-selecting GHZ states, namedas phase-matching quantum cryptographic conferencing (PM-QCC). As shown in Appendix A and B, successful WCPsinterference events imply successful post-selection of multi-party GHZ states within the GHZ state basis: | ψ j , i i ··· i N − (cid:105) = √ [ | i i · · · i N − (cid:105) + ( − ) j | i ¯ i · · · ¯ i N − (cid:105) ] , (1)where j ( i m ) ∈ { , } is called phase (amplitude) bit, 1 ≤ m ≤ N −
1, ¯ i m is logical negation of i m . Resorting to the entan-glement distillation protocol [51], one can distill the perfectN-qubit GHZ state: | Φ + (cid:105) = √ ( | · · · (cid:105) + | · · · (cid:105) ) N , (2)which can be used to generate secret key bits among N parties.In terms of the presented PM-QCC network, since the mea-surement device can be untrusted, it is immune to all detec-tor side-channel attacks. Owing to its simpler setup struc-ture compared with MDI-QCC networks based on GHZ an-alyzer [30, 52], one can extend PM-QCC to more users eas-ily. Similar to the TF-QKD protocol, the key generation rateof the presented PM-QCC network can be improved to scalewith η N − , whereas that of MDI-QCC network scales with η N . Here, η is the transmission rate of the optical channelfrom each party to the untrusted third party, Eve. Practically,there might be small-scale interference between N (cid:48) parties ( N (cid:48) parties are near-neighbor connected, and 2 ≤ N (cid:48) ≤ N ) insteadof perfect interference of N parties. It is demonstrated that thesmall-scale N (cid:48) -party PM-QCC can still be realized securelywith key generation rates scaling with η N (cid:48) − . II. PM-QCC NETWORK
Supposing that N parties P , P , · · · , P N plan to conduct aquantum cryptographic conference task, see Fig. 1. They canencode their random bits in their phase randomized coherentpulses. The encoded coherent pulses are sent to the untrustedthird party, Eve, who is supposed to perform interference mea-surements. The N -party PM-QCC network works as follows:Step.1 Preparation : Party P randomly generates one bit k ∈{ , } and one coherent pulse with a random phase φ ∈ [ , π ) . Then, he encodes the random bit tothe coherent pulse and get a phase randomized co-herent pulses | e i ( φ + π k ) √ µ (cid:105) . Similarly, parties P , · · · , P N prepare their phase randomized coherent pulses | e i ( φ + π k ) √ µ (cid:105) , · · · , | e i ( φ N + π k N ) √ µ N (cid:105) , respectively.As shown in Fig. 1, the settings for P , P N are differentfrom that for P , · · · , P N − in the experimental setup.Thus, the intensities of the weak coherent pulses usedby parties P , P N are set to be µ , µ N ∈ { µ > ν > ω > τ > · · · > } , while the intensities for parties P , · · · , P N − are set to be µ t ∈ { µ > ν > ω > τ > · · · > } (2 ≤ t ≤ N − µ areused as signal pulses and the pulses with intensities { ν , ω , τ , · · · , } are used as decoy pulses.Step.2 Measurement : All the parties send their pulses directlyto the untrusted third party Eve. By design, an honestEve splits each pulse of parties P , · · · , P N − into twoseparated coherent pulses using 50 : 50 beam splitters(BS1) to perform interference measurements as shownin Fig. 1. Eve measures the received pulses and recordsmeasurement results. Here, successful detection eventsare defined as coincidence clicks of N − Announcement : Eve announces measurement resultsfor successful detection events. Then, all the parties an-nounce their random phases φ , φ · · · φ N and their ran-domly chosen intensities µ , µ , · · · , µ N , respectively.Step.4 Sifting : When a successful detection event is an-nounced by Eve, the N parties P , P , · · · , P N keeptheir random bits k , k · · · k N , respectively. A suc-cessful detection event is one of 2 N − coincident clickevents in the set { D L D L · · · D L N − , D R D L · · · D L N − , · · · , D R D R · · · D R N − } . Here, D L l ( R l ) means that onlythe detector D L l ( D R l ) clicks in the l -th measurementbranch. According to Eve’s announcements, they co-operate to flip theirs bits to make their encoded phasesthe same with that of events D L D L · · · D L N − . Then, P , P , · · · , P N keep their random bits only when the phase-matching conditions are satisfied: | φ − φ | = π , | φ − φ | = π , · · · , | φ N − − φ N | = π and theirintensities are 2 µ = µ t = µ N (2 ≤ t ≤ N − | φ − φ | = | φ − φ | = · · · , | φ N − − φ N | = Parameter estimation and key distillation : The abovesteps are repeated enough times to distill the raw keybits. From the data set generated by the signal pulses,the users can directly estimate the gain Q µ and marginalquantum bit error rates (QBER) E Z µ , P P , E Z µ , P P , · · · , E Z µ , P P N from the measurement results. From the dataset generated by the decoy pulses, the users can esti-mate the phase error E X µ according to decoy-state meth-ods (see Appendix D for details). Finally, they distillprivate key bits by performing error correction and pri-vacy amplification on the raw key.For the coherent pulse interference measurement on the l -th(1 ≤ l ≤ N −
1) measurement branch, there would be onlyone detector click if the encoded phases of two pulses withequal intensities are matched, i.e. D L l (or D R l ) would click if ∆ φ l = | φ l + π k l − ( φ l + + π k l + ) | = π ). This is vital inthe security of PM-QCC network.In the above N -party PM-QCC network, the random phases φ , φ , · · · , φ N that P , P , · · · , P N attach to their pulses are con-tinuous. Thus, the precise phase-matching condition | φ m − φ m + | = π is hard to realize. Moreover, we suppose thatthe lasers of P , P , · · · , P N are perfectly locked which is alsoimpractical in experiments. To overcome these problems, weintroduce the phase-compensation method [35, 36] that canhelp to conduct phase matching and phase reference. Foran arbitrary party P m , the phase interval [ , π ) is cut into M slices { ∆ j m } with 0 ≤ j m ≤ M − ∆ j m = [ π M j m , π M ( j m + )) .In the Announcement step, what N parties P , P , · · · , P N an-nounce are their phase slice indexes j , j , · · · , j N instead oftheir exact phases φ , φ , · · · , φ N , respectively. Then, in the Sifting step, party P m and P m + only need to compare theirslices indexes, | j m + j am − j m + | mod M = M /
2, where j am ∈ { , , · · · , M − } is an adjusted slice index to compensatethe deviation of phase reference for parties P m and P m + . Inpractice, j am can be determined in the Parameter estimation step by minimizing the QBER. Although there will be intrin-sic misalignment errors in the sifting induced by the coarsesplit of the phase interval, this makes phase-sifting practicalwithout affecting the security [36].
III. SECURITY ANALYSIS
Without loss of generality, we consider an entanglement-based protocol that party P m prepares entanglement states be-tween his virtual qubits and his WCPs instead of directlypreparing WCPs (see Appendix B for detail). Thus, its se-curity analysis applies to the entanglement distillation argu-ment [16, 53, 54]. Following the entanglement distillationargument [53, 54], to generate a sequence of almost perfect BS1 BSBSBSBS1 (a)
BSBS branch 2branch 1 BS (b) FIG. 2. (a) The PM-QCC protocol with phase matching condition φ = φ = ··· φ N = φ satisfied. (b) Equivalent PM-QCC protocol af-ter Eve’s splitting with phase matching condition φ = φ = ··· φ N = φ satisfied. Eve splits each pulse of parties P , ··· , P N − into twoseparated coherent pulses using a beam splitter BS1 to perform inter-ference measurements. Once a success detection event is achieved,the encoded phases of N parties are correlated with each other. p , p L , ··· , p N : path modes after Eve’s splitting. D L ( D R ) : the left(right) detector of the first measurement branch. D L ( D R ) : the left(right) detector of the second measurement branch. D L N − ( D R N − ) :the left (right) detector of the ( N − ) -th measurement branch. BS:Beam Splitter. secure key bits, parties P , P , · · · , P N only need to share a se-quence of almost perfect GHZ states in term of monogamy ofentanglement [55, 56]. Therefore, what we are facing now isto distill almost perfect GHZ states [51].As described in Step.4, when phase matching condition issatisfied, encoded random bits are kept. Without loss of gen-erality, the phases are supposed to be φ = φ = · · · = φ . InFig. 2(a), the WCP with random phase φ of party P arrivingat the 50 : 50 beam splitter BS1 is split into two WCPs with Three - party PM - QCC * Three - party PM - QCCThree - party MDI - QCC - - - - - Distance L ( km ) between one user and the measurement station K ey g e n e r a t i on r a t e R ( p e r pu l se ) FIG. 3. Key generation rate R of three-party PM-QCC, three-partyPM-QCC ∗ (without phase post-selection in signal pulses) and MDI-QCC network versus transmission distance L . The simulation re-sult is obtained with parameters from Ref. [17] that the dark-countrate p d = × − , the loss rate of the channel α = . / km,the detection efficiency η d = f = .
16, the misalignment error for MDI-QCC e MDI d = .
5% andthe phase misalignment error for PM-QCC* e δ = . M for PM-QCC is optimized at different transmissiondistances. the same encoded phases. | e i ( φ + π k ) √ µ (cid:105) BS1 −−→ | e i ( φ + π k ) (cid:112) µ / (cid:105)| e i ( φ + π k ) (cid:112) µ / (cid:105) , (3)where φ + π k is the encoded phase of party P . The WCPsfrom party P is split into two branches to interfere with P and P respectively. Similarly, WCPs from parties P , · · · , P N − are split. The third party, Eve, performs interfere mea-surement for all N parties. Now, the protocol is equivalent tothat of Fig. 2(b).Let us consider the entanglement based protocol of PM-QCC (see Appendix B). Once there is a success detectionevent, virtual qubits in N parties are entangled together. Afterthe distillation protocol (see Appendix A), perfect GHZ statesare shared between N parties. Finally, they can generate secretkey bits from the distillation of the GHZ state [15–17]. Thecorresponding key generation rate is R N − party =( M ) N − Q µ [ − f · max { H ( E Z µ , P P ) , H ( E Z µ , P P ) , · · · , H ( E Z µ , P P N ) } − H ( E X µ )] , (4)where H ( x ) = − x log ( x ) − ( − x ) log ( − x ) is the binaryentropy function. The E Z µ , P P m (2 ≤ m ≤ N ) is the marginalQBER of parties P and P m and can be estimated from Eve’smeasurement results directly. The E X µ is the phase error ratewhich is an intrinsic error of the protocol and can be estimatedwith the help of the decoy-state method in experiments (seeAppendix C and D). The Q µ is the overall gain, and M isinduced by phase post-selection in the phase compensationmethod which can be optimized according to the experimentalparameters [35, 36].As shown in Eq. 4, there is a prefactor ( M ) N − which isinduced by the phase post-selecting process in the key gen-eration rate. It might cause descending in key generation rate when the number of user increases. According to Ap-pendix B, the PM-QCC protocol is still secure even when thephase choices in the signal pulses are announced before Eve’smeasurement if one can estimate the phase error accurately.Thus, the phase compensation method just provides a practicaland secure way to align the phases for signal pulses. Then, ifone can realize accurate and secure phase reference in his (orher) lab, the PM-QCC protocol can be improved to a versionPM-QCC* without phase post-selection in signal pulses (seeAppendix E for detail). It has also been demonstrated in newvariants for TF-QKD and PM-QKD protocols [38, 39, 42–44]. In the PM-QCC*, the factor ( M ) N − can be improved to1, and the key generation rate is R ∗ N − party = Q ∗ µ [ − f · max { H ( E Z ∗ µ , P P ) , H ( E Z ∗ µ , P P ) , · · · , H ( E Z ∗ µ , P P N ) } − H ( E X ∗ µ )] . (5)where Q ∗ µ is the overall gain, E Z ∗ µ , P P , E Z ∗ µ , P P , E Z ∗ µ , P P aremarginal QBERs and E X ∗ µ is the phase error rate. Need tonote that the signal pulses from the parties can no longer beregarded as photon number states since the phase random-ization for signal pulses has been cancelled out in the PM-QCC* protocol. Thus, the above mentioned decoy states dis-cussion for the PM-QCC protocol becomes unsuitable for thePM-QCC* protocol, and more delicate decoy-state method isrequired to evaluate the phase error rate in the signals (see Ap-pendix E) [40, 42, 43]. For example, as in [42], the estimationof phase error rate is converted to the estimation of the yieldsfor the photon number state, which can be estimated usingphase randomized decoy states. Thus, the phase randomizeddecoy states with different intensities can in principle be usedto constraint the phase error rate E X µ tightly and we leave it forfurther studies. Three - party PM - QCCThree - party PM - QCC with four decoy statesFour - party PM - QCC - - - - - Distance L ( km ) between one user and the measurement station K ey g e n e r a t i on r a t e R ( p e r pu l se ) FIG. 4. Key generation rate R for 3-party PM-QCC, 3-party PM-QCC with four decoy states ( ν , ω , τ ,0) and 4-party PM-QCC ver-sus transmission distance L . Parameters adopted in simulation arederived from Ref. [57]: the dark-count rate p d = . × − , theloss rate of the channel α = . / km, the detection efficiency η d = f = . IV. PERFORMANCE OF PM-QCC NETWORK
Without loss of generality, the channels between party P m and measurement station are supposed to be symmetric. Toshow the performance of PM-QCC network, we consider the3-party PM-QCC network, 3-party PM-QCC* network andcompare our protocol with MDI-QCC network [17] using thefollowing experimental parameters: the intrinsic fiber channelloss α = . / km, detection efficiency of threshold single-photon detector η d = p d = − , errorcorrection efficiency f = .
16, misalignment error for MDI-QCC e MDI d = .
5% and phase error for PM-QCC* e PM-QCC* δ = . L =
80 km. The key rate is improved by approximately2 orders of magnitude around L =
200 km. For the PM-QCC*without phase-matching condition in signal pulses, the keygeneration can be well beyond that MDI-QCC around L = η N − , whereas that of MDI-QCCnetwork scales with η N (see Appendix F). TABLE I. The performance for PM-QCC network at N =
3. The keygeneration rate R , mean photon number µ and phase slice number M are optimized with p d = . × − , η d = f = .
16 and α = . / km at different transmission distance L . R ( bits per pulse ) L ( Km ) µ M . × −
50 0 . . × −
80 0 . . × −
100 0 . . × −
150 0 . . × −
200 0 . To demonstrate the scalability and the decoy-state methodof PM-QCC network, we simulate the PM-QCC networkat N = ν > ω > τ > η d = p d = . × − , the performance of PM-QCC network at N = N = µ and phase slice numbers M for given parameters at N = µ , ν , ω and τ for given parameters and M =
13. For ex-ample, the key generation rate is R = . × − (bits perpulse) at L =
150 (km) with µ = . ν = . ω = . τ = . × − . Furthermore, we simu-late the PM-QCC at N = N (cid:48) parties( N (cid:48) parties are near-neighbor connected, and 2 ≤ N (cid:48) ≤ N ) in-stead of perfect interference of N parties. In this case, ac-cording to Step.1 of the PM-QCC network, the weak coherentpulses prepared by parties at broken points are |√ µ (cid:105) insteadof | (cid:112) µ / (cid:105) (the encoded phase is omit here). While, as shownin Fig. 1, the intensities of weak coherent pulses arriving atthe third party are equal in an inference branch. Therefore,higher amounts of weak coherent pulses are lost during thetransmission for broken points compared with that for unbro-ken points. It is demonstrated that the secure reduced small-scale PM-QCC networks can also be constructed among N (cid:48) parties with key generation rate R reduced PM − QCC ∝ η N (cid:48) − (seeAppendix G for detail). V. CONCLUSION AND OUTLOOK
Based on the multiparty weak coherent pulses interference,we present a new protocol named as phase matching quan-tum cryptographic conferencing (PM-QCC) network that candistribute information-theoretic secure keys among N parties.In the merit of simpler setup, the PM-QCC network can beconveniently generalized to N parties and can go beyond theexisting QCC networks. Firstly, similarly to the MDI-QCCnetwork, the PM-QCC network is immune to all detectorside-channel attacks since the measurement device can be un-trusted. Secondly, compared with the MDI-QCC networksbased on the GHZ analyzer, the PM-QCC can be more eas-ily extended to multiple users due to simpler setup structure.Thirdly, the key generation rate of the presented PM-QCCnetwork can be improved to scale with η N − , whereas thatof MDI-QCC network scales with η N . Fourthly, consider-ing practical cases that small-scale interferences between N (cid:48) parties instead of perfect interferences of N parties, the small-scale N (cid:48) -party PM-QCC can still be realized. Finally, basedon the setup of the PM-QCC network, GHZ state distributionnetworks can be constructed directly, which may be of greatpotential for other implementations in quantum informationscience.During the preparation of this manuscript, a related workbased on the post-selection of W state [34] has been reportedin Ref. [18] which is named as conference key agreement withsingle-photon interference (single-photon CKA). Comparedwith the single-photon CKA, the proposed protocol is an es-sentially different protocol. Specifically, the proposed proto-col is a MDI prepare-and-measure scheme, while, the single-photon CKA cannot be cast to a MDI prepare-and-measurescheme in which all the parties have to measure their localqubits and trust the measurement results. Meanwhile, the sig-nal qubits sent to the measurement station cannot be replacedby coherent states, and the local qubits have to resort to quan-tum memories in the single-photon CKA. Thus, the feasibilityof the single-photon CKA requires further investigation [18]. VI. ACKNOWLEDGMENTS
We acknowledge Feihu Xu for insightful discussion.This work has been supported by the Chinese Academyof Science, the National Fundamental Research Program,the National Natural Science Foundation of China (GrantsNo.11575174, No.11374287, No.11574297, No.11875173,and No.11674193), the National Key R&D Program of China(Grants No.2017YFA0303900 and No.2017YFA0304004),the Anhui Initiative in Quantum Information Technologies, aswell as the Zhongguancun Haihua Institute for Frontier Infor-mation Technology.
Appendix A: Distillation of GHZ State
Inspired by the quantum key distribution protocol based onentanglement distillation [53, 54], multi-party quantum con-ference key distribution protocols based on entanglement dis-tillation are proposed to securely distribute random bits be-tween multiple users [15–17]. The security of phase matchingquantum cryptographic conferencing network (PM-QCC) isbased on the distillation of N-qubit GHZ state [51] | Φ + (cid:105) = √ ( | · · · (cid:105) + | · · · (cid:105) ) N , (A1)which is stabilized by a group of stabilizer generators, S = XXXX · · · X , S = ZZII · · · I , S = ZIZI · · · I , S = ZIIZ · · · I , ... S N − = ZIII · · · Z , (A2)where X = (cid:32) (cid:33) , Z = (cid:32) − (cid:33) , I = (cid:32) (cid:33) are Paulimatrices. The corresponding N-qubit GHZ state basis is | ψ j , i i ··· i N − (cid:105) = √ [ | i i · · · i N − (cid:105) + ( − ) j | i ¯ i · · · ¯ i N − (cid:105) ] , (A3)where j , i m ∈ { , } , 1 ≤ m ≤ N −
1, ¯ i m is logical negation of i m . If j = i m = − S ( S m ). It means that there is a phase error (bit error) to theoriginal GHZ state. Thus, j (or i m ) is also called phase (oramplitude) bit. Using the multipartite hashing method [51],the yield of distillation of the pure N-qubit GHZ state is D = − max { H ( E Z µ , P P ) , H ( E Z µ , P P ) , · · · , H ( E Z µ , P P N ) } − H ( E X µ ) , (A4)where E Z µ , P P m represents the bit flip error rate of parties P and P m corresponding to the stabilizer S m − . The E X µ is the BS1 BSBSBSBS1 (a)
BSBSBSBS branch 1branch 2
BSBS branch N-1 (b)
FIG. 5. (a) The entanglement based version of N -party PM-QCCnetwork. (b) The equivalent entanglement based version of N -party PM-QCC network with virtual sources after Eve’s splitting.In the Fig. 5(a) and Fig. 5(b), random phases are supposed to be φ = φ = ··· = φ . Here, we omit the virtual qubits for simplic-ity in subfigure (b). p , p L , ··· , p N : path modes after Eve’s split-ting. D L ( D R ) : the left (right) detector of the first measurementbranch. D L ( D R ) : the left (right) detector of the second measure-ment branch. D L N − ( D R N − ) : the left (right) detector of the ( N − ) -thmeasurement branch. BS: Beam Splitter. C π : the control phase gate. phase flip error corresponding to the stabilizer S , H ( x ) = − x log ( x ) − ( − x ) log ( − x ) is the binary entropy function. Appendix B: Security Analysis for PM-QCC
Without loss of generality, we consider an entanglementbased version that party P m (1 ≤ m ≤ N ) prepares entangle-ment states between virtual qubits and his WCPs instead ofdirectly preparing WCPs. Thus, its security analysis applies tothe entanglement distillation argument [16, 53, 54]. As shownin Fig. 5(a), there is a virtual qubit at each party | + (cid:105) = √ ( | (cid:105) + | (cid:105) ) . The party P m prepares an entanglement state using a controlphase gate C π = | (cid:105)(cid:104) | U o + | (cid:105)(cid:104) | U π between the virtual andweak coherent pulse(WCP) that | Ψ (cid:105) m = √ [ | (cid:105)| e i φ √ µ m (cid:105) + | (cid:105)| e i ( φ + π ) √ µ m (cid:105) ] , (B1)where U ( π ) will attach a phase of 0 ( π ) to the WCP. Withoutloss of generality, the phases of parties P , P , · · · , P N are sup-posed to be φ = φ = · · · = φ N = φ . The WCPs are sent tountrusted third party, Eve, to perform interference measure-ments with other parties. While, the virtual qubits are kept at each party. As is stated in the main text, the WCP with randomphase φ of party P m passing through the 50 : 50 beam splitterBS1 is split into two WCPs with the same encoded phases. | e i ( φ + π k m ) √ µ (cid:105) BS1 −−→ | e i ( φ + π k m ) (cid:112) µ / (cid:105) ⊗ | e i ( φ + π k m ) (cid:112) µ / (cid:105) , (B2)where φ + π k m is the encoded phase of party P m . The proto-col is the equivalent entanglement based protocol of Fig. 2(b).Since the neighbor WCPs are of the same intensity, the onlydifference is their phases. Thus, the WCPs in each branch canbe regarded as from one virtual WCP source | e i φ √ µ (cid:105) , and theprotocol is straightforwardly equivalent to that in Fig. 5(b). Inthe protocol of Fig. 5(b), the N -party sate evolves as | + (cid:105) P | + (cid:105) P · · · | + (cid:105) P N ∞ ∑ n = e − µ / ( e i φ √ µ C †1 ) n n ! ∞ ∑ n = e − µ / ( e i φ √ µ C †2 ) n n ! · · · ∞ ∑ n N − = e − µ / ( e i φ √ µ C † N − ) n N − n N − ! | vac (cid:105) BS −→ ∞ ∑ n , n , ··· , n N − = | + (cid:105) P | + (cid:105) P · · · | + (cid:105) P N e − µ / ( µ ) n n ! ( e i φ p †1 + e i φ p †2 L √ ) n e − µ / ( µ ) n n ! ( e i φ p †2 R + e i φ p †3 L √ ) n · · · e − µ / ( µ ) nN − n N − ! ( e i φ p † ( N − ) R + e i φ p † N √ ) n N − | vac (cid:105) C π −→ N / ∞ ∑ n , n , ··· , n N − = e − ( N − ) µ / ( µ ) n + n + ··· + nN − n ! n ! · · · n N − ! [ | (cid:105)| (cid:105) · · · | (cid:105) ( e i φ p †1 + e i φ p †2 L √ ) n ( e i φ p †2 R + e i φ p †3 L √ ) n · · · ( e i φ p † ( N − ) R + e i φ p † N √ ) n N − + · · · + | (cid:105)| (cid:105) · · · | (cid:105) ( − e i φ p †1 − e i φ p †2 L √ ) n ( − e i φ p †2 R − e i φ p †3 L √ ) n · · · ( − e i φ p † ( N − ) R − e i φ p † N √ ) n N − ] | vac (cid:105) = ( N − ) / ∞ ∑ n , n , ··· , n N − = e − ( N − ) µ / ( µ ) n + n + ··· + nN − n ! n ! · · · n N − ! · { ∑ i , i , ··· , i N − ∈{ , } √ [ | i i · · · i N − (cid:105) + ( − ) n + n + ··· + n N − | i ¯ i · · · ¯ i N − (cid:105) ][ e i φ p †1 + ( − ) i e i φ p †2 L √ ] n [ ( − ) i e i φ p †2 R + ( − ) i e i φ p †3 L √ ] n · · · [ ( − ) i N − e i φ p † ( N − ) R + ( − ) i N − e i φ p † N √ ] n N − }| vac (cid:105) , = ( N − ) / · ∑ i , i , ··· , i N − ∈{ , } { √ [ | i i · · · i N − (cid:105) + | i ¯ i · · · ¯ i N − (cid:105) ] √ p even | even (cid:105) µ + √ [ | i i · · · i N − (cid:105) − | i ¯ i · · · ¯ i N − (cid:105) ] √ p odd | odd (cid:105) µ } , (B3)where C † i is the creation operator of the i -th virtual source, | vac (cid:105) is the vacuum state, √ p even and √ p odd are normalizedcoefficients of pure state | even (cid:105) µ and | odd (cid:105) µ (see Eq. B11 toEq. B13) , p †1 , p †2 L , p †2 R , · · · are the creation operator of the cor-responding path mode after the BS1s. The BSs act asBS = √ (cid:32) − (cid:33) . For example, considering the beams interfere at the second BSshown in the first branch of Fig. 5(b). For input beams opticalmodes p †1 and p †2 L , the output modes L †1 and R †1 are (cid:32) L †1 R †1 (cid:33) = √ (cid:32) − (cid:33) · (cid:32) p †1 p †2 L (cid:33) , (B4)where L †1 ( R †1 ) means the output path mode to detector D † L ( D † R ) for branch 1 in Fig. 5(b). Then, we have p †1 + ( − ) i p †2 L √ BS −→ (cid:40) L †1 if i = , R †1 if i = . (B5)Thus, when i = D L clicks, while when i = D R clicks. From Eq. B3, once there is asuccess coincidence event that only one detector clicks in eachbranch, a GHZ state of N parties is post-selected successfullysuch that | Ψ j , i i ··· i N − (cid:105) = √ [ | i i · · · i N − (cid:105) + ( − ) j | i ¯ i · · · ¯ i N − (cid:105) ] , (B6)where, j = n + n + · · · + n N − . One can obtain the phaseerror correlation immediately e Xn , n , ··· , n N − = (cid:40) , for j ∈ odd ,0 , for j ∈ even . (B7)The phase error rate is determined by different photon numbercomponents. Note that similar phase-error property is shownin a improved analysis of PM-QKD [58]. When n + n + · · · + n N − ∈ odd , e Xn , n , ··· , n N − = n + n + · · · + n N − ∈ even , e Xn , n , ··· , n N − =
0. Using the correlation of Eq. B7 andEq. B3, the total phase error rate E X µ can be estimated as E X µ = p odd · Y odd µ Q µ , (B8)where Y odd µ is the overall yield for odd number component,and Q µ is the overall gain of signal pulses.Following the entanglement distillation argument [53, 54],to generate a sequence of almost perfectly secure key bits, P , P , · · · , P N only need to share a sequence of almost perfectGHZ states in term of monogamy of entanglement [55, 56].From Eq. A4, the key generation rate of the PM-QCC networkis R N − party =( M ) N − Q µ [ − f · max { H ( E Z µ , P P ) , H ( E Z µ , P P ) , · · · , H ( E Z µ , P P N ) } − H ( E X µ )] , (B9)where ( M ) N − is the prefactor induced by phase post-selection which can be optimized according to the experimen-tal parameters [35, 36].What is counter-intuitive in the security analysis of thephase-matching protocol is that parties P , P , · · · , P N willannounce their random phases φ , φ , · · · , φ N after Eve’s an-nouncements of his measurement results. If the phases are notannounced by P , P , · · · , P N , the weak coherent pulses can beregarded as the mixture of different photon number states inwhich their phases are meaningless to the untrusted party, Eve.While, after the announcement, their pulses can no longer beregarded as the mixture of photon number states. Here, we will show that the PM-QCC protocol is secure against thephase announcements.Firstly, the random phases are announced after Eve’s an-nouncements. Thus, Eve’s announcement strategies cannotdepend on parties P , P , · · · , P N ’s phase information.Secondly, the security analysis is based on entanglementdistillation. After the phase announcement, one can still dis-till perfect GHZ states which are decoupled from Eve accord-ing to the monogamy of entanglement. Specifically, let usconsider the Beam splitting attack as an example in whichEve manages to get the key information using the announcedphases.In the Beam splitting attack, Eve can modulate transmis-sion rates of the channels. For example, she using a beamsplitter with transmission rate η to simulate a lossy chan-nel. The reflection signal beams are intercepted to Eve’sregisters, then the transmission beams are sent to interfer-ometer through perfect channels. After the phase announce-ments, Eve would extract some information from the inter-cepted beams according to the phase announcements. FromEq. B3, we know that the state arriving at the detectors canbe sort to n + n + · · · + n N − ∈ even or odd . Without lossof generality, we consider only the components that would re-sult in the detection events D L D L · · · D L N − in Eq. B3. Thecorrelated components are1 √ ( | · · · (cid:105) + | · · · (cid:105) ) √ p even | even (cid:105) µ + √ ( | · · · (cid:105) − | · · · (cid:105) ) √ p odd | odd (cid:105) µ , (B10)where | even (cid:105) µ ( | odd (cid:105) µ ) = √ p even ( odd ) ∑ n + n + ··· + n N − ∈ even ( odd ) e − ( N − ) µ / ( µ ) n + n + ··· + nN − n ! n ! · · · n N − ! { [ p †1 + ( − ) i p †2 L √ ] n ⊗ [ ( − ) i p †2 R + ( − ) i p †3 L √ ] n ⊗ · · ·⊗ [ ( − ) i N − p † ( N − ) R + ( − ) i N − p † N √ ] n N − }| vac (cid:105) , (B11) p even = ∑ n + n + ··· + n N − ∈ even e − ( N − ) µ ( µ ) n + n + ··· + n N − n ! n ! · · · n N − ! , = e − ( N − ) µ cosh [( N − ) µ ] (B12) p odd = − p even = e − ( N − ) µ sinh [( N − ) µ ] (B13)with i = i = · · · = i N − = φ .When the phases are not announced, | even (cid:105) µ ( | odd (cid:105) µ ) is amixture of photon number states from Eve’s perspective afterthe phase randomization. While, if the phases are announced, | even (cid:105) µ ( | odd (cid:105) µ ) can no longer be regarded as a mixture of photon number states. Considering the Beam splitting attackusing beam splitters with transmission rate η , the Eq. B10 canbe rewritten as1 √ [ | · · · (cid:105)| (cid:114) ( − η ) µ (cid:105)| (cid:114) ( − η ) µ (cid:105) · · · | (cid:114) ( − η ) µ (cid:105) + | · · · (cid:105)| − (cid:114) ( − η ) µ (cid:105)| − (cid:114) ( − η ) µ (cid:105) · · · | − (cid:114) ( − η ) µ (cid:105) ] (cid:113) p ηµ even | even (cid:105) ηµ + √ [ | · · · (cid:105)| (cid:114) ( − η ) µ (cid:105)| (cid:114) ( − η ) µ (cid:105) · · · | (cid:114) ( − η ) µ (cid:105)− | · · · (cid:105)| − (cid:114) ( − η ) µ (cid:105)| − (cid:114) ( − η ) µ (cid:105) · · · | − (cid:114) ( − η ) µ (cid:105) ] (cid:113) p ηµ odd | odd (cid:105) ηµ = √ ( | · · · (cid:105) + | · · · (cid:105) )[ (cid:113) p ( − η ) µ even | even (cid:105) ( − η ) µ (cid:113) p ηµ even | even (cid:105) ηµ + (cid:113) p ( − η ) µ odd | odd (cid:105) ( − η ) µ (cid:113) p ηµ odd | odd (cid:105) ηµ ]+ √ ( | · · · (cid:105) − | · · · (cid:105) )[ (cid:113) p ( − η ) µ odd | odd (cid:105) ( − η ) µ (cid:113) p ηµ even | even (cid:105) ηµ + (cid:113) p ( − η ) µ even | even (cid:105) ( − η ) µ (cid:113) p ηµ odd | odd (cid:105) ηµ ] , (B14)where | even (cid:105) ηµ ( | odd (cid:105) ηµ ) interferes before phase announce-ments, and cannot be used for eavesdropping. (cid:113) p ηµ odd is thenormalization coefficient for pure state | odd (cid:105) ηµ , and similarfor other coefficients. While, | even (cid:105) ( − η ) µ and | odd (cid:105) ( − η ) µ are intercepted by Eve, and can not be decoupled from privatequbits after phase announcements. Further, one can derivethat (cid:113) p ( − η ) µ even | even (cid:105) ( − η ) µ (cid:113) p ηµ even | even (cid:105) ηµ + (cid:113) p ( − η ) µ odd | odd (cid:105) ( − η ) µ (cid:113) p ηµ odd | odd (cid:105) ηµ = (cid:113) p µ even | even (cid:105) µ , (cid:113) p ( − η ) µ odd | odd (cid:105) ( − η ) µ (cid:113) p ηµ even | even (cid:105) ηµ + (cid:113) p ( − η ) µ even | even (cid:105) ( − η ) µ (cid:113) p ηµ odd | odd (cid:105) ηµ = (cid:113) p µ odd | odd (cid:105) µ . (B15)From Eq. B8, the phase error is estimated for coherent stateswith intensity µ . Meanwhile, as shown in Eq. B15, the phaseerror after the phase announcement can also be estimated byEq. B8. This means that the phase error induced by the phaseannouncement has been estimated in Eq. B8, and can be cor-rected during the entanglement distillation protocol accordingto Eq. B9. Thus, the PM-QCC protocol is secure against thephase announcements.Furthermore, supposing that we can estimate the phase er-ror accurately in Eq. B8, the PM-QCC protocol is still se-cure even when the phase choices in the signal pulses areannounced before Eve’s measurement according to Eq. B15.Thus, the phase compensation method just provides a practi-cal and secure way to align phases for signal pulses, and the PM-QCC protocol can be improved to a version without phasepost-selection in signal pulses (see Appendix E for detail). Appendix C: Parameter Estimation for PM-QCC
Experimentally, the overall gain Q µ and marginal bit errorrates (QBER) E Z µ , P P , E Z µ , P P , · · · , E Z µ , P P N can be directly es-timated from the announced results. However, the phase error E X µ can not be measured directly in experiments. We can adoptthe decoy-state method to estimate the phase error rate E X µ .As shown in Fig. 5(b), supposing the phase matching con-dition | j m + j am − j m + | mod M = M / Q µ , and the QBER E Z , µ can be estimated as Q µ , = P ( D L ) + P ( D R ) , E Z , µ = P ( D L ) P ( D L ) + P ( D R ) , (C1)where P ( D L ) means the probability that only detector D L clicks in branch 1, P ( D R ) means the probability that only thedetector D R clicks in branch 1. Because of the independencebetween the detection events of each branch when the phasesare matched, the the gain and QBERs for other branches canbe estimated as Q µ , t = Q µ , and E Z , t µ = E Z , µ (2 ≤ t ≤ N − Q µ and the marginal QBER E Z µ , P P m between parties P and P m are Q µ = ( Q µ , ) N − = p odd Y odd µ + p even Y even µ , (C2a) E Z µ , P P m = (cid:98) m − (cid:99) ∑ k = C k + m − ( E Z , µ ) k + ( − E Z , µ ) m − k − , (C2b)0where C k + m − is the Binomial coefficient, (cid:98) x (cid:99) is the Floor func-tion, Y odd µ ( Y even µ )is the overall yield for odd (even) photonnumber component. With the help of decoy-state method, wecan estimate p odd Y odd µ from Eq. C2a (see Appendix D for de-tail). Then, the phase error rate E X µ can be estimated by Eq. B7and Eq. B8.Without loss of generality, one can derive the gain Q µ , and the QBER E Z , µ for branch 1 [36] when the phasematching condition | j + j a − j | mod M = M / k = k =
0. Supposing the phase reference deviation φ is constrained to φ ∈ [ − π M , π M ) with the help of the phase-compensation method, the phase of parties P and P areuniformly distributed on φ ∈ [ π M j , π M ( j + )) and φ ∈ [ π M j + φ , π M ( j + ) + φ ) . To be simple and consistent withRef. [36], we take j =
0. Thus, φ ∈ [ , π M ) , φ ∈ [ φ , π M + φ ) . (C3)As shown in Fig. 5, the evolution of the encoded state ofparties P and P in branch 1 is | e i φ (cid:112) η µ / (cid:105) p ⊗ | e i φ (cid:112) η µ / (cid:105) p L BS −→ | (cid:112) η µ / ( e i φ + e i φ ) (cid:105) L ⊗ | (cid:112) η µ / ( e i φ − e i φ ) (cid:105) R . (C4)where the transmission efficiency η consists of channel lossesand detection efficiencies. From Eq. C4, the pulses hittingdetectors D L and D R are independent. The probabilities ofclick and non-click events for D L and D R can be directlycalculated that P ( ¯ L ) = ( − p d ) exp ( − η µ cos φ δ ) , P ( L ) = − P ( ¯ L ) , P ( ¯ R ) = ( − p d ) exp ( − η µ sin φ δ ) , P ( R ) = − P ( ¯ R ) . (C5)where P ( L ) ( P ( ¯ L ) ) is the click (non-click) probability of de-tector D L , P ( R ) ( P ( ¯ R ) ) is the click (non-click) probabilityof detector D R and φ δ = φ − φ . The successful detectionprobabilities for branch 1 are, P ( D L ) = P ( L ) P ( ¯ R ) , P ( D R ) = P ( ¯ L ) P ( R ) , (C6)respectively. Then, the gain Q µ , of branch1 is [36] Q µ , = P ( D L ) + P ( D R ) ≈ − e − ηµ + p d e − ηµ , (C7)where the approximation is obtained by ignoring sin φ δ witha small φ δ and ignoring the higher order term p d ( − e − ηµ + p d e − ηµ ) . For given φ δ , the QBER is [36] E Z , µ ( φ δ ) = P ( D R ) P ( D L ) + P ( D R ) ≈ e − ηµ Q µ , ( p d + η µ sin φ δ ) . (C8)where the approximation is obtained by taking e ηµ sin φδ ≈ + η µ sin φ δ with a small φ δ and ignoring the higher orderterm p d ( p d + η µ sin φ δ ) . From Eq. C3 and φ ∈ [ − π M , π M ) ,the QBER E Z , µ is of the form E Z , µ = M π (cid:90) π M − π M d φ (cid:90) π M − π M d φ δ f φ ( φ δ ) E Z , µ ( φ δ )= ( p d + η µ e δ ) e − ηµ Q µ , , (C9)where e δ = π M − M π sin π M . Here, f φ ( φ δ ) is the probabilitydistribution of φ δ for given φ , f φ ( φ δ ) = ( M π ) [ φ δ + ( π M − φ )] , φ δ ∈ [ φ − π M , φ ) , ( M π ) [ − φ δ + ( π M + φ )] , φ δ ∈ [ φ , φ + π M ) . Appendix D: Decoy states analysis for PM-QCC
As stated in the main text, the signal pulses with intensity µ are only used to estimate the gain Q µ and marginal quan-tum bit error rates (QBER) E Z µ , P P , E Z µ , P P , · · · , E Z µ , P P N . Thephase error E X µ are estimated from decoy pulses in intensityset { ν , ω , τ , · · · , } . The phase choices and intensities of theusers are announced after Eve’s announcement. Eve’s attacksare independent of signal pulses and decoy pulses. Thus, thedecoy states can by used to estimate the phase error E X µ in thesignal pluses.Considering the decoy pulses, the virtual sources in eachbranch of the protocol of Fig. 5(b) are simultaneously random-ized if the phase-matching conditions are satisfied: | φ − φ | = π , | φ − φ | = π , · · · , | φ N − − φ N | = π . For sim-plicity, we take N = φ = φ = · · · = φ N = φ , the virtualsource under phase-matching condition is [58]12 π (cid:90) π d φ | e i φ √ µ (cid:105) C | e i φ √ µ (cid:105) C (cid:104) e i φ √ µ | C (cid:104) e i φ √ µ | C = ∞ ∑ k P µ ( k ) | k (cid:105)(cid:104) k | , (D1)where P µ ( k ) = e − µ ( µ ) k k ! is the probability of generating k photons in the virtual source, | k (cid:105) = [ √ ( C †1 + C †2 )] k √ k ! | vac (cid:105) and k = n + n is the total photon number of branch 1 and branch2. Then the overall Q µ (Eq. C2a) and phase error rate E X µ (Eq. B8) are turn to be Q µ = ∞ ∑ k P µ ( k ) · Y k , (D2a)1 E X µ = ∑ k ∈ odd P µ ( k ) Y k Q µ , = − ∑ k ∈ even P µ ( k ) Y k Q µ , = − e − µ · Y Q µ − e − µ ( µ ) · Y Q µ − · · · , ≤ − e − µ · Y Q µ − e − µ ( µ ) · Y Q µ , ≤ E X , U µ = − e − µ · Y Q µ − e − µ ( µ ) · Y L Q µ , (D2b)where Y k ∈ [ , ] is the yield when k photon are generated in the virtual source and Y L is the lower bound of the yield when2 photons are generated in the virtual source. E X , U µ is the up-per bound of the phase error rate. The first inequality is ob-tained by setting high-order terms including Y , Y , · · · to 0.The second inequality is obtained by substituting Y with itslower bound Y L . From Eq. D2a, one can obtain a set of overallgain with different decoy states which can be used to estima-tion the Yield Y k . For 3-party PM-QCC protocol, four decoystates with intensities { ν > ω > τ > } are adopted to esti-mate the Y L using the Gaussian elimination method [44, 59].e ν Q ν = Y + ν Y + ( ν ) Y + ( ν ) Y + ( ν ) Y + · · · , e ω Q ω = Y + ω Y + ( ω ) Y + ( ω ) Y + ( ω ) Y + · · · , e τ Q τ = Y + τ Y + ( τ ) Y + ( τ ) Y + ( τ ) Y + · · · , Q = Y , (D3)where Q ν , Q ω , Q τ and Q are overall gains for different decoystates. From Eq. D3, one can cancel out the terms of Y , Y and Y with the Gaussian elimination method and generate an equation given by G = G · Y + G · Y + G · Y + · · · , (D4)where G =[ ω ( ν ) − ν ( ω ) ][ τ ( e ω Q ω − Q ) − ω ( e τ Q τ − Q )] − [ τ ( ω ) − ω ( τ ) ][ ω ( e ν Q ν − Q ) − ν ( e ω Q ω − Q )] , (D5a) G = [ ω ( ν ) − ν ( ω ) ][ τ ( ω ) − ω ( τ ) ] − [ τ ( ω ) − ω ( τ ) ][ ω ( ν ) − ν ( ω ) ] , (D5b) G = [ ω ( ν ) − ν ( ω ) ][ τ ( ω ) − ω ( τ ) ] − [ τ ( ω ) − ω ( τ ) ][ ω ( ν ) − ν ( ω ) ] , (D5c)...Since ν > ω > τ >
0, one can see that G , G > G , G · · · < Y L is obtained by setting Y = Y = · · · = Y k ∈ [ , ] (see [60] for reference), Y L = { [ ω ( ν ) − ν ( ω ) ][ τ ( e ω Q ω − Q ) − ω ( e τ Q τ − Q )] − [ τ ( ω ) − ω ( τ ) ][ ω ( e ν Q ν − Q ) − ν ( e ω Q ω − Q )] } [ ω ( ν ) − ν ( ω ) ][ τ ( ω ) − ω ( τ ) ] − [ τ ( ω ) − ω ( τ ) ][ ω ( ν ) − ν ( ω ) ] . (D6)The upper bound of the phase error rate is E X , U µ = − e − µ · Y Q µ − e − µ ( µ ) · Y L Q µ . (D7) Thus, the lower bound of the key generation rate for 3-party2PM-QCC is R − party ≥ R L − party = ( M ) Q µ [ − f · max { H ( E Z µ , P P ) , H ( E Z µ , P P ) } − H ( E X , U µ )] . (D8)The above decoy-state method can be directly generalizedto N ≥ N ≥ E X µ shown in Eq. D10b. Specifically, basedon the structure of the N-party GHZ state, there are more thantwo interference branches in the virtue protocol of Fig. 5(b).If some of the branches have no photons, the correspondingyield Y k will be rather small. Thus, in order to obtain a tightupper bound of E X µ with Eq. D2b, one need more decoy statesto estimate the high-order terms of the yield Y k with the Gaus-sian elimination method shown from Eq. D3 to D6. Here,we shown the main steps to conduct the presented decoy-statemethod as follows:Step.1 For N-party PM-QCC protocol, the randomized virtualsource under phase-matching condition φ = φ = · · · = φ N = φ is12 π (cid:90) π d φ | e i φ √ µ (cid:105) C · · · | e i φ √ µ (cid:105) C N − (cid:104) e i φ √ µ | C · · · (cid:104) e i φ √ µ | C N − = ∞ ∑ k P ( N − ) µ ( k ) | k (cid:105)(cid:104) k | , (D9)where P ( N − ) µ ( k ) = e − ( N − ) µ [( N − ) µ ] k k ! is the probabil-ity of generating k photons in the virtual source, | k (cid:105) = [ √ N − ( C †1 + C †2 + ··· + C † N − )] k √ k ! | vac (cid:105) and k = n + n + · · · + n N − is the total photon number of all the branches.Step.2 Then the overall Q µ (Eq. C2a) and phase error rate E X µ (Eq. B8) are turn to be Q µ = ∞ ∑ k P ( N − ) µ ( k ) · Y k , (D10a) E X µ = ∑ k ∈ odd P ( N − ) µ ( k ) Y k Q µ , = − ∑ k ∈ even P ( N − ) µ ( k ) Y k Q µ , = − e − ( N − ) µ · Y Q µ − e − ( N − ) µ [( N − ) µ ] · Y Q µ − · · · , ≤ − e − ( N − ) µ · Y Q µ − e − ( N − ) µ [( N − ) µ ] · Y Q µ − · · ·− e − ( N − ) µ [( N − ) µ ] N cut N cut ! · Y N cut Q µ , ≤ E X , U µ = − e − ( N − ) µ · Y Q µ − e − ( N − ) µ [( N − ) µ ] · Y L Q µ − · · ·− e − ( N − ) µ [( N − ) µ ] N cut N cut ! · Y LN cut Q µ , (D10b)where N cut is the cut number to bound the phase errorrate, and N cut = N − N ) if N is odd (even)Step.3 The Gaussian elimination method shown in Eq. D3 toD6 is adopt to estimate the lower bounds Y L , · · · , Y LN cut .To estimate the high-order terms Y Lk , one only need toadd extra linear constraints to Eq. D3 by adding extradecoy states, say { ν , ω , τ , · · · , } , to construct Eq. D4.Then, one can directly obtain the high-order terms Y Lk from Eq. D4.Step.4 With the lower bounds Y L , · · · , Y LN cut , one can obtain theupper bound of the phase error rate E X , U µ according toEq. D10b.Definitely, from the view of linear program, to well boundthe yield Y N cut , N cut + N inthe presented decoy-state method. On the other hand, if oneadopts the decoy-state estimation using the data when dif-ferent parties send out different intensities, one can generatemore decoy-state constraints of Eq. D3. In this case, whenthe number of parties N gets larger, the number of constraintsalso increases. This has already been studied in quantum keydistribution, for example, see [42, 44]. From this point ofview, when N gets larger, one may not need more decoy statesfor each party. We remark that, similar problems have beensolved in a different scenario in [61] where few decoy-statesettings are enough to generate a good estimation of the yieldthat each of the N parties send out one photon. Thus, withmore advanced decoy-state method, it is possible to reducethe required decoy-state number for each party. Appendix E: PM-QCC* without phase post-selection in thesignal pulses
As stated in Appendix B, supposing that we can estimatethe phase error accurately, the PM-QCC protocol is still se-3cure even when the phase choices in the signal pulses are an-nounced before Eve’s measurement. Without loss of general-ity, the phase choices for signal pulses of party P i can be setto φ i =
0. The PM-QCC* without phase post-selection in thesignal pulses run as follows:Step.1
Preparation : The pulses are divided to be signalmode with intensity µ and decoy mode with inten-sities { ν , ω , τ , · · · , } . In the signal mode, Party P randomly generates one bit k ∈ { , } and a coher-ent pulse |√ µ (cid:105) . Then, he encodes the random bit tothe coherent pulse and get a encoded coherent pulses | e i π k √ µ (cid:105) . Similarly, parties P , · · · , P N get encodedcoherent pulses | e i π k √ µ (cid:105) , · · · , | e i π k N √ µ N (cid:105) , respec-tively. In the decoy mode, party P randomly gener-ates one bit k ∈ { , } and a coherent pulse with ran-dom phase φ ∈ [ , π ) . Then, he encodes the randombit to the coherent pulse and get a phase randomizedcoherent pulses | e i ( φ + π k ) √ µ (cid:105) . Similarly, parties P , · · · , P N prepare their phase randomized coherent pulses | e i ( φ + π k ) √ µ (cid:105) , · · · , | e i ( φ N + π k N ) √ µ N (cid:105) , respectively.As shown in Fig. 1, the experimental setup is asymmet-ric for parties P , P N and P , · · · , P N − . Thus, the in-tensities of the weak coherent pulses for parties P , P N are set to be µ , µ N ∈ { µ > ν > ω > τ > · · · > } ,while the intensities for parties P , · · · , P N − are set tobe µ t ∈ { µ > ν > ω > τ > · · · > } (2 ≤ t ≤ N −
1) forsignal and decoy pulses. The pulses corresponding withintensity µ are signal pulses and the pulses correspond-ing with intensities { ν , ω , τ , · · · , } are used as decoypulses.Step.2 Measurement : Same as PM-QCC.Step.3
Announcement : Same as PM-QCC.Step.4
Sifting : Same as PM-QCC.Step.5
Parameter estimation and Key distillation : Theabove steps are repeated enough times to distill theraw key bits. From the data set generated by the sig-nal pulses, the users can directly estimate the gain Q ∗ µ and marginal quantum bit error rates (QBER) E Z ∗ µ , P P , E Z ∗ µ , P P , · · · , E Z ∗ µ , P P N from the measurement results.From the data set generated by the decoy pulses, theusers can estimate the phase error E X ∗ µ according todecoy-state methods. Finally, they distill private keybits by performing error correction and privacy amplifi-cation on the raw key.According to Appendix D, the decoy states are simultane-ously randomized under phase-matching condition, and theabove mentioned decoy-state method can be directly usedto estimate the phase error E X µ in signal mode for the PM-QCC protocol. However, in the PM-QCC* protocol the signalpulses from the parties can no longer be regarded as photonnumber states since the phase randomization for signal pulseshas been cancelled out. Thus, the above decoy states dis-cussion becomes unsuitable for the PM-QCC* protocol, and more delicate decoy-state method is required to evaluate thephase error rate in the signals [40, 42, 43]. For example, asin [42], the estimation of phase error rate is converted to theestimation of the yields for the photon number state, whichcan be estimated using phase randomized decoy states. Thus,the phase randomized decoy states with different intensitiescan in principle be used to constraint the phase error rate E X µ tightly and we leave if for further studies. The gain Q ∗ µ , ofbranch1 is Q ∗ µ , = Q µ , , (E1)the QBER is E Z ∗ , µ = P ( D R ) P ( D L ) + P ( D R )= ( − p d )( e − ηµ ( − e δ ) ) · ( − ( − pd )( e − ηµ e δ )) Q ∗ µ , , (E2)where e δ is the phase misaligned error for signal mode duringthe phase reference. From the Eq. C2a, Eq. C2b and Eq. B8,the overall gain, Marginal QBERs and phase error are Q ∗ µ = Q µ , (E3a) E Z ∗ µ , P P m = (cid:98) m − (cid:99) ∑ k = C k + m − ( E Z ∗ , µ ) k + ( − E Z ∗ , µ ) m − k − , (E3b) E X ∗ µ = E X µ . (E3c)According to a former discussion on PM-QKD [40], one cansimply suppose that a sufficient parameter estimation can bemade by a complete characterization of Eve’s measurementoperators. As a result, the estimated phase error rate E X ∗ µ isequal to the detected fraction of the odd photon number com-ponent in the infinite-key regime. Then, the key generationrate for PM-QCC protocol without phase-matching conditionin signal modes is R ∗ N − party = Q ∗ µ [ − f · max { H ( E Z ∗ µ , P P ) , H ( E Z ∗ µ , P P ) , · · · , H ( E Z ∗ µ , P P N ) } − H ( E X ∗ µ )] . (E4) Appendix F: Comparison with MDI-QCC
We compare the performance of PM-QCC with that ofMDI-QCC in Ref. [17] when N =
3. The key rate of MDI-QCC in simulation is R MDI − QCC = Q Z [ − H ( e BX )] − H ( E Z ∗ µνω ) f Q Z µνω , (F1)where E Z ∗ µνω = max { H ( E ZAB µνω ) , H ( E ZAC µνω ) } , Q Z µνω ( E Z ∗ µνω ) is thegain (QBER) of the Z basis, Q Z is the gain of single photoncomponent, e BX is the single photon QBER of the X basis,4 f is the error correction efficiency and H ( x ) = − x log ( x ) − ( − x ) log ( − x ) is the binary entropy function.From Eq. C2a, one can obtain that Q µ ∝ η N − , where η = e − α L / is the transmission rate of the optical channel, α is the corresponding loss rate, L is the distance from eachparty to the measurement station. Thus, the key generaterate R PM − QCC ∝ η N − . Nevertheless, in measurement de-vice independent quantum cryptographic conferencing (MDI-QCC) [17], one can calculate that Q Z ∝ η when dark-countrate p d =
0. Intuitively, N photons are coincidentally de-tected by N different detectors for N -party MDI-QCC net-works based on the GHZ state analyzer [30] with coincidenceprobability P co ∝ η N . Then, we obtain that R MDI − QCC ∝ η N according to Eq. F1. Therefore, the presented PM-QCC canimprove the key generation rate from O ( η N ) to O ( η N − ) . BS BSBS1
FCFC BS FC BS1 Eve BS1
FC FC
Failed (a)
BSBS1
Eve (b)
BSBS
Eve (c)
FIG. 6. (a) The 3-party PM-QCC network and the 2-party PM-QKD protocol reduced from the 5-party PM-QCC network. In somerounds of 5-party PM-QCC only sets { P , P , P } and { P , P } aresuccessfully interfered, while, the interference of { P , P } failed. (b)The entanglement based PM-QKD protocol for parties P and P . (c)The equivalent entanglement based PM-QKD protocol for P and P with virtual source. BS: Beam Splitter. FC: Fiber Channel. C π : thecontrol phase gate. Appendix G: Reduce to Small-scale PM-QCC Networks
Practically, the N -party PM-QCC network might not workperfectly, i.e. there might not be perfect N -party interferencesof the weak coherent states. We consider the case that N (cid:48) -party inferences ( N (cid:48) parties are near-neighbor connected, and2 ≤ N (cid:48) ≤ N ) are realized in some rounds of N -party PM-QCCnetwork. For example, as shown in Fig. 6(a), only the inter-ferences of sets { P , P , P } and { P , P } are realized, while,the interference of { P , P } failed in the 5-party PM-QCC net-work. According to Step.1 of the PM-QCC network, the co- herent pulses sent by parties at the broken point are |√ µ (cid:105) in-stead of | (cid:112) µ / (cid:105) (here,we omit the phase information). Con-sidering asymmetric mean photon numbers for two arms of aninterference branch, we show that reduced small-scale PM-QCC networks and PM-QKD protocol can also be realizedsecurely. TABLE II. The performance for the reduced 3-party PM-QCC net-work shown in Fig. 6(a). The key generation rate R , mean pho-ton number µ and phase slice number M are optimized with p d = . × − , η d = f = .
16 and α = . / km at differenttransmission distance L . R reduced 3-party ( bits per pulse ) L ( Km ) µ M . × −
50 0 . . × −
100 0 . Without loss of generality, we consider the interference ofparties P and P as shown in Fig. 6(b). The virtual entangle-ment based PM-QKD protocol with a virtual weak coherentstate source | e i φ √ µ V (cid:105) ( µ V = µ a + µ b ) is shown in Fig. 6(c).For the above small-scale PM-QCC network and PM-QKDprotocol, the average number of photons for parties at theboundary are not equal. The weak coherent pulses after en-coding of parties P and P are | e i φ a √ µ a (cid:105) and | e i φ b √ µ b (cid:105) , re-spectively, with µ a = µ and µ b = µ . As shown in Fig. 6(b),the weak coherent states arriving for interference are equal,i.e. | e i φ a √ η a µ a (cid:105) and | e i φ b √ η b µ b (cid:105) with η a µ a = η b µ b = ηµ .According to Eq. C4 ∼ C9, the gain and QBER of this branchwith asymmetric average number of photons are equal to theoriginal branch. Q (cid:48) µ V , = Q µ , E (cid:48) Z , µ V , = E Z , µ . (G1)Meanwhile, higher amounts of weak coherent pulses are lostduring the transmission. This will result in a lower key gen-eration rate for small-scale PM-QCC network or PM-QKDprotocol, which is embodied in the estimation of E X µ fromEq. B8. Specifically, we present the performance of the re-duced 3-party PM-QCC network from 5-party PM-QCC net-work shown in Fig. 6(a) in Table. II. In practice, the coher-ent pulses and phase slices M might be pre-optimized for big-ger PM-QCC network, and the key generation rate for the re-duced 3-party PM-QCC network might decrease to a lowerlevel compared with the results in Table. II. However, ac-cording to Eq. G1, the gain of this asymmetric branch stillscales with Q (cid:48) µ V , ∝ η . Thus, a key generation rate scaleswith R reduced PM − QCC ∝ η N (cid:48) − can also be obtained accordingto Eq. B9 for the N (cid:48) parties PM-QCC network.Therefore, the N -party PM-QCC network can be reduced tosmall-scale PM-QCC networks and PM-QKD protocols whenthere are only parts of the N parties are interfered altogether. [1] C. Elliott, New J. Phys. , 46 (2002). [2] C. Elliott, A. Colvin, D. Pearson, O. Pikalo, J. Schlafer, andH. Yeh, arXiv: quant-ph/0503058 (2005). [3] M. Peev, C. Pacher, R. Alléaume, C. Barreiro, J. Bouda,W. Boxleitner, T. Debuisschert, E. Diamanti, M. Dianati, J. F.Dynes, et al. , New J. Phys. , 075001 (2009).[4] F. Xu, W. Chen, S. Wang, Z. Yin, Y. Zhang, Y. Liu, Z. Zhou,Y. Zhao, H. Li, D. Liu, et al. , Chin. Sci. Bul. , 2991 (2009).[5] D. Stucki, M. Legré, F. Buntschu, B. Clausen, N. Felber,N. Gisin, L. Henzen, P. Junod, G. Litzistorf, P. Monbaron, et al. ,New J. Phys. , 123001 (2011).[6] H. J. Kimble, Nature , 1023 (2008).[7] S.-K. Liao, W.-Q. Cai, J. Handsteiner, B. Liu, J. Yin, L. Zhang,D. Rauch, M. Fink, J.-G. Ren, W.-Y. Liu, et al. , Phys. Rev. Lett. , 030501 (2018).[8] S. Wehner, D. Elkouss, and R. Hanson, Science (2018).[9] M. Caleffi, A. S. Cacciapuoti, and G. Bianchi,arXiv:1805.04360 (2018).[10] D. Castelvecchi, Nature (2018).[11] A. Steane, Rep. Pro. Phys. , 117 (1998).[12] N. Gisin and R. Thew, Nat. photon. , 165 (2007).[13] V. Giovannetti, S. Lloyd, and L. Maccone, Phys. Rev. Lett. ,010401 (2006).[14] S. Bose, V. Vedral, and P. L. Knight, Phys. Rev. A , 822(1998).[15] K. Chen and H.-K. Lo, Quantum Inf. Comput. , 689 (2007).[16] K. Chen and H.-K. Lo, in Proceedings of the 2005 IEEE Inter-national Symposium on Information Theory (IEEE, Adelaide,Australia, 2005) pp. 1607–1611.[17] Y. Fu, H.-L. Yin, T.-Y. Chen, and Z.-B. Chen, Phys. Rev. Lett. , 090501 (2015).[18] F. Grasselli, H. Kampermann, and D. Bruß, New J. Phys. ,123002 (2019).[19] G. Murta, F. Grasselli, H. Kampermann, and D. Bruß, arXivpreprint arXiv:2003.10186 (2020).[20] D. M. Greenberger, M. A. Horne, and A. Zeilinger, in Bell’stheorem, quantum theory and conceptions of the universe (Springer, 1989) pp. 69–72.[21] J. S. Bell, Phys. , 195 (1964).[22] N. Brunner, D. Cavalcanti, S. Pironio, V. Scarani, andS. Wehner, Rev. Mod. Phys. , 419 (2014).[23] M. Bourennane, M. Eibl, S. Gaertner, N. Kiesel, C. Kurtsiefer,M. ˙Zukowski, and H. Weinfurter, Fortschritte der Physik:Progress of Physics , 273 (2003).[24] J.-W. Pan, Z.-B. Chen, C.-Y. Lu, H. Weinfurter, A. Zeilinger,and M. ˙Zukowski, Rev. Mod. Phys. , 777 (2012).[25] T. Monz, P. Schindler, J. T. Barreiro, M. Chwalla, D. Nigg,W. A. Coish, M. Harlander, W. Hänsel, M. Hennrich, andR. Blatt, Phys. Rev. Lett. , 130506 (2011).[26] X.-L. Wang, L.-K. Chen, W. Li, H.-L. Huang, C. Liu, C. Chen,Y.-H. Luo, Z.-E. Su, D. Wu, Z.-D. Li, et al. , Phys. Rev. Lett. , 210502 (2016).[27] C. Song, K. Xu, W. Liu, C.-P. Yang, S.-B. Zheng, H. Deng,Q. Xie, K. Huang, Q. Guo, L. Zhang, et al. , Phys. Rev. Lett. , 180511 (2017).[28] L.-K. Chen, Z.-D. Li, X.-C. Yao, M. Huang, W. Li, H. Lu,X. Yuan, Y.-B. Zhang, X. Jiang, C.-Z. Peng, et al. , Optica ,77 (2017).[29] X.-L. Wang, Y.-H. Luo, H.-L. Huang, M.-C. Chen, Z.-E. Su,C. Liu, C. Chen, W. Li, Y.-Q. Fang, X. Jiang, et al. , Phys. Rev.Lett. , 260502 (2018).[30] J. Qian, X.-L. Feng, and S.-Q. Gong, Phys. Rev. A , 052308(2005).[31] H.-K. Lo, M. Curty, and B. Qi, Phys. Rev. Lett. , 130503(2012).[32] S. L. Braunstein and S. Pirandola, Phys. Rev. Lett. , 130502(2012). [33] H.-K. Lo, X. Ma, and K. Chen, Phys. Rev. Lett. , 230504(2005).[34] W. Dür, G. Vidal, and J. I. Cirac, Phys. Rev. A , 062314(2000).[35] M. Lucamarini, Z. Yuan, J. Dynes, and A. Shields, Nature ,400 (2018).[36] X. Ma, P. Zeng, and H. Zhou, Phys. Rev. X , 031043 (2018).[37] K. Tamaki, H.-K. Lo, W. Wang, and M. Lucamarini,arXiv:1805.05511 (2018).[38] X.-B. Wang, Z.-W. Yu, and X.-L. Hu, Phys. Rev. A , 062323(2018).[39] C. Cui, Z.-Q. Yin, R. Wang, W. Chen, S. Wang, G.-C. Guo, andZ.-F. Han, Phys. Rev. Applied , 034053 (2019).[40] J. Lin and N. Lütkenhaus, Phys. Rev. A , 042332 (2018).[41] Z.-W. Yu, X.-L. Hu, C. Jiang, H. Xu, and X.-B. Wang, Sci.Rep. , 3080 (2019).[42] M. Curty, K. Azuma, and H.-K. Lo, Npj Quantum Inf. , 64(2019).[43] K. Maeda, T. Sasaki, and M. Koashi, Nat. commun. , 1(2019).[44] F. Grasselli and M. Curty, New J. Phys. , 073001 (2019).[45] S. Pirandola, R. Laurenza, C. Ottaviani, and L. Banchi, Nat.commun. , 15043 (2017).[46] S. Wang, D.-Y. He, Z.-Q. Yin, F.-Y. Lu, C.-H. Cui, W. Chen,Z. Zhou, G.-C. Guo, and Z.-F. Han, Phys. Rev. X , 021046(2019).[47] M. Minder, M. Pittaluga, G. Roberts, M. Lucamarini, J. Dynes,Z. Yuan, and A. Shields, Nat. Photon. , 334 (2019).[48] Y. Liu, Z.-W. Yu, W. Zhang, J.-Y. Guan, J.-P. Chen, C. Zhang,X.-L. Hu, H. Li, C. Jiang, J. Lin, et al. , Phys. Rev. Lett. ,100505 (2019).[49] X. Zhong, J. Hu, M. Curty, L. Qian, and H.-K. Lo, Phys. Rev.Lett. , 100506 (2019).[50] X.-T. Fang, P. Zeng, H. Liu, M. Zou, W. Wu, Y.-L. Tang, Y.-J. Sheng, Y. Xiang, W. Zhang, H. Li, et al. , Nat. Photon. , 1(2020).[51] E. N. Maneva and J. A. Smolin, Contemp. Math. , 203(2002).[52] J.-W. Pan and A. Zeilinger, Phys. Rev. A , 2208 (1998).[53] H.-K. Lo and H. F. Chau, science , 2050 (1999).[54] P. W. Shor and J. Preskill, Phys. Rev. Lett. , 441 (2000).[55] B. M. Terhal, IBM J. Res. Dev. , 71 (2004).[56] M. Koashi and A. Winter, Phys. Rev. A , 022309 (2004).[57] H.-L. Yin, T.-Y. Chen, Z.-W. Yu, H. Liu, L.-X. You, Y.-H. Zhou,S.-J. Chen, Y. Mao, M.-Q. Huang, W.-J. Zhang, et al. , Phys.Rev. Lett. , 190501 (2016).[58] P. Zeng, W. Wu, and X. Ma, Phys. Rev. Applied , 064013(2020).[59] F. Xu, M. Curty, B. Qi, and H. K. Lo, New J. Phys. , 113007(2013).[60] X. Ma, arXiv:0808.1385v1 (2008).[61] X. Yuan, Z. Zhang, N. Lütkenhaus, and X. Ma, Phys. Rev. A94