Practical scheme for long distance side-channel-free quantum key distribution with weak coherent states only
aa r X i v : . [ qu a n t - ph ] J un Practical scheme for long distance side-channel-free quantum key distribution withweak coherent states only
Xiang-Bin Wang, , , ∗ , Xiao-Long Hu , and Zong-Wen Yu State Key Laboratory of Low Dimensional Quantum Physics, Department of Physics,Tsinghua University, Beijing 100084, China Synergetic Innovation Center of Quantum Information and Quantum Physics, University of Science and Technology of ChinaHefei, Anhui 230026, China Data Communication Science and Technology Research Institute, Beijing 100191, China Jinan Institute of Quantum technology, SAICT, Jinan 250101, Peoples Republic of China
We show that a side-channel-free (SCF) source does not have to be an ideal source by introducingthe idea of mapping from ideal source. We propose a 3-state no-touch protocol for quantum keydistribution (QKD) where Alice and Bob does not modulate any light sent out, the only thing thedo is to send (or not send, in sending-or-not protocol). The reference light are from independentLasers. We show that, the protocol is side-channel-free (i.e., both source side channel free andmeasurement device independent) and there is no modulation to the weak beams for QKD coding,except for sending or not sending. Calculation shows that one can reach a side-channel-free securedistance over 300 km using only coherent-state source. We use worst-case analysis which takesno limitation to the channel or detection loss for security. Our protocol is immune to all adversedue to side channels such as the photon frequency spectrum, emission time, propagation direction,spatial angular moment, and so on. Numerical simulations show that our scheme can reach aside-channel-free result for quantum key distribution over a distance longer than 200 km given thesingle-photon-interference misalignment error rate of 30%, and a distance longer than 300 km giventhe single-photon-interference misalignment error rate of 10%. Our no-touch idea can also applyto phase-coding twin-field QKD protocols. The no-touch idea also applies to twin-field QKD withphase coding.
Introduction
Quantum key distribution (QKD) canprovide unconditional security based on the laws of quan-tum physics [1, 2] even though Eve can completely controlthe channel. However, in practice[3–11], there are side-channel effects due to the device imperfections. Eventhough a perfect single-photon source is applied, thereare still some side-channel effects which can be disas-trous to the security. For example, there could be basis-dependent synchronization errors in pulse emitting andEve can make use of this to judge the basis of the emit-ted pulse. In general, all pulses are living in an infi-nite dimensional space. Though we use the coding space(e.g., polarization) for QKD, Eve can do his attack inanother space such as frequency space to obtain informa-tion. Although one can prepare all coding states usingone diode, the problem is still there because one needs modulate the different states in coding space. This canlead to state difference in other spaces, and Eve can makeuse of this to obtain information without disturbing thequantum states in coding space. As we shall show latter,given a lossy channel, by taking side channel attacks tothe source, Eve can actually almost obtain full informa-tion of a QKD result without disturbing the states. Inthis letter, we show how to efficiently solve this issue.We propose a scheme to realize the side-channel-free 3-state source. Applying our proposed source scheme to ∗ email: [email protected] a measurement-device-independent QKD (MDI-QKD),we can have a side-channel attack free QKD protocolfor both the source and measurement device. Althoughsome existing protocols can also achieve the goal of side-channel-free security [14, 15], our protocol presented hereis the only one that bases on the easy coherent states andthere is no demanding on the local detection efficiency aswas requested in the entanglement based protocol. Side-channel attack.
Suppose we use a two-basis QKDprotocol, such as the BB84 protocol and the 3-state pro-tocol, where there are X basis and Z basis in the pro-tocol. Suppose we use the photon polarization for thecoding space. In the existing methods in generatingthe different coding states, we need either use differentdiodes to generate different coding states or use only onediode together with randomly chosen modulations, suchas flipping, rotation, phase shift, etc. Any of these op-erations can cause differences in the space beyond thecoding space. We consider such type of side-channel ef-fects. Suppose the frequency spectrums are a little bitdifferent for different coding states or different bases. Inprinciple, by detecting frequency difference, Eve has achance to know the state in coding space almost exactlywithout disturbing the photon states in coding space.As another example, if different coding states are actu-ally emitted at different time, Eve may just measure thephoton with a very precise clock and she can sometimesknow the coding state almost exactly if the photon wavepacket collapses at certain time intervals. Also, Eve maymake use of the channel loss, she can choose to block allthose photons on which the side-channel attack done byher is not successful. Thus, small bias of a qubit in thewhole space may flaw the whole protocol. Therefore, to make the source side-channel-free, weneed a no-touch protocol: sending all states by the samedevice and not touching anything sent out.
Here we pro-pose our no-touch protocol where all light are sent by thesame device and no onetouches any light sent out, nei-ther the weak beam not the strong reference light. Weshall use the idea of mapping.
Definitions.
For ease of presentation, we first definea source. For an ideal 3-state [16, 17] source P , everyoutput is one from three ideal states in set {| z i , | z i , | x + i = 12 ( | z i + | z i ) } (1)where, | z i and | z i are exactly orthogonal to each in cod-ing space (such as the polarization), but they are identi-cal in all other spaces. States | z i and | z i are normallyregarded as in Z basis and | x + i is regarded as in X ba-sis. They are all single-photon states. The probabilitydistribution for each states is constant, p z / , p z / , p x = 1 − p z . (2)In our paper, we shall consider the whole space state forthe real-life source. We define a real-life source in thisway: At any time i , the output state is one element ofthe set S i = {|Z i , |Z i , |X + i} (3)with constant probability distribution P ( S i ) = { p z / , p z / , p x = 1 − p z } . (4)Note that the states can be time dependent, i.e., at dif-ferent time i , the elements in set S i can be different.We name this S i above characteristic set for the source.We name the probability distribution P ( S i ) character-istic probability distribution . Two sources are identicalif their characteristic sets and characteristic probabil-ity distributions are identical. By this definition, wehave actually defined a source by its characteristic set and characteristic probability distribution . Straightly, anideal source can also be defined in this way.States emitted from the ideal source are always strictlythe ones requested by the theoretical protocol. Thesestates should be identical to the requested ones in codingspace and they should be strictly identical to each otherin other spaces. For example, if we use the polarizationspace for coding, all states should have the identical fre-quency spectrum. If we use the ideal BB84 source or theideal 3-state source there will be no side-channel effect ofthe source and the MDI-QKD will be completely secure.Unfortunately, the so called ideal source does not existin real-life world. To make a side-channel free source, weshould not depend on making and ideal source techni-cally. We should use the idea of mapping . The idea of mapping from secure source.
Fortunately,the ideal source is not the only secure source. A real-lifesource is secure if it can be mapped from an ideal source.We say that a real-life source S can be mapped from anideal source P , if there is a quantum process M underwhich the characteristic set and the characteristic proba-bility distribution of the ideal source can be transformedto the ones of the real-life source S . Theorem 1 . If the (virtual) source P is secure, then thereal-life source S is also secure if there exists a quantumprocess M that can map source P to source S . The finalkey of a QKD protocol using source S can be calculateby assuming that the virtual source P were used.This conclusion is rather obvious. Suppose S is inse-cure, then in a QKD protocol where the ideal source P is applied, Eve can first use the quantum process M totransform it into source S and then attack the QKD pro-tocol as if the protocol used source S . This means thatif S is not secure then P is not secure either. Note that,a real-life source with character set S i can change fromtime to time at different time i , it can be regarded asif the source that the ideal source P is in use providedthere exists a time-dependent map that transforms thestate set in Eq.(1) to set S i .Consider an example Theorem 2 : A source with characteristic set S i = {|Z i , |Z i , |X + i = √ ( e iδ |Z i + e iδ |Z i ) } is side chan-nel free.This is because such a source can be mapped froman ideal source by simple unitary transformation. Thesource here is much easier than the ideal source. Forexample, we can, at any time first produce a two-modestate and then randomly determine whether to block anymode. In our application, we shall use twin field [19] withthe sending-or-not protocol[22].Note that beyond the coding space, states |Z i , |Z i can be different, e.g., different wave shapes, differentpropagation directions, different frequency spectrums,different emission time and so on, each of them can beeven multi-photon states with different photon numbers .However, since there exists the following (unitary) quan-tum process | z i −→ e iδ |Z i ; | z i −→ e iδ |Z i that maps the ideal source P into the real source S , thereal source is secure if the ideal source is secure accord-ing to our Theorem 1 . In calculating the secure finalkey, we just go ahead to do it as if the ideal source wereapplied. Here we have actually assumed |Z i and |Z i orthogonal to each other. This condition is not requiredin general because we can use non-trace-preserving maps,but in our application we don’t need so. The source intwin-field quantum key distribution (TF-QKD) is a twomode source and they are always orthogonal in two-modephoton number space (state | i and | i ).Straightly, we also have similar conclusion for a 4-statesource: Theorem 3 : A source with characteristic set S i = {|Z i , |Z i , |X ±i = √ ( e iδ |Z i ± e iδ |Z i ) } is sidechannel free. Practical side-channel free QKD using no-touch pro-tocol.
Note that, a side channel free source itself cannot complete the side channel free QKD. We must em-ploy a protocol which is measurement device indepen-dent. However, here we can not simply turn to the decoystate method[6–8], for, we have kept in the mind thatthe decoy state single-photon pulse and the signal-statesingle-photon pulse are in general different in the wholespace. Hence we can only use weak pulse with worst-case analysis. Luckily, we can employ the novel idea ofTF-QKD[19] proposed recently followed by a number ofvariants[20–22]. There, the channel transmission changesto square root of normal ones. We consider the followingimproved sending-or-not-sending protocol [22].Lets first consider a virtual 3-state sending-or-notprotocol[22] using the idea of TF-QKD[19]. There aretwo parties, Alice and Bob are one party, Eve (Charlie)is the other party. Say, Alice and Bob initially create atwo-mode state coherent state of | r µ e iρ Ai i| r µ e iρ Bi i (5)For this moment we only consider the single-photon statethere |X + i = 1 √ e iρ Bi |Z i + e iρ Ai |Z i ) } (6)where ρ Ai and ρ Bi are global phases of the coherent statesof each mode. This is a two-mode state with mode A ,(state |Z i which is state | i in Fock space) controlledby Alice and mode B (state |Z i which is state | i inFock space) controlled by Bob. Obviously, in principle,there exists an ideal single-photon state | √ ( | z i + | z i ) = √ ( | i + | i ) from which a unitary quantum process cantransform it to state |X + i in Eq.(6). They each then randomly determine to Block or sendher (his) photon or not. And also, they each always senda strong reference light from another independent laserdevice. But they know the phase difference of pulses oftwo laser device every time, say δ Ai for Alice’s side and δ Bi at Bob’s side. They can know this by interferingstrong pulses from different laser device. Note that, Aliceor Bob has never touched their weak light beams for QKDin the whole process, to these weak beams, the only thingthey each need to do is simply sending or not sending.
This completes their real-life source.To relate our earlier work[22], we consider a unitarymap transforming ideal states | z i , | z i to |Z i , |Z i . Wecan just say that they are using a 3-state source withcharacteristic set Y = {| z i , | z i , | ˜ x + i = 1 √ e iρ Bi | z i + e iρ Ai | z i ) } (7)in the QKD protocol, although there is a different real lifesource. And they will do post selection by the criterion1 − cos( δ Ai − δ Bi ) ≤ | λ | (8) Real protocol . At each time window i , they each firstcreate a coherent state of intensity µ/ They each know the phase difference between the inde-pendent laser pulse and the laser pulse for QKD statecoding but Eve does not know. Eve is supposed tomake use the reference light interference information todo phase compensation to the QKD coding beams beforemeasure them. At any time i , they each randomly deter-mine whether it is an X -window or a Z -window. If she(he) determines an X -window, she (he) will send out her(his) mode of coherent state for sure. If it is a Z -window,she (he) with a small probability ǫ decides to send outher (his) coherent state, and with a probability 1 − ǫ notsending her (his) coherent state. A two-mode state sentout is called an X -basis state ( Z -basis state) if both of them determine an X -window ( Z − window ) correspond-ing to the state. Consider those two-mode states in set C which are the cases that both of them have determineda Z -window but only one of them have decided to send.Any effective events (events that Eve observes only onedetector clicking) corresponding to single-photon statesin set C produces an un-tagged bit in Z -basis.In the actual case, their initial state is a coherent stateinstead of single-photon state. However, if they never an-nounce the phase information, it is just a classical mix-ture of different photon-number states. Therefore onecan still use the conclusion of single-photon states withworst-case analysis as shown in the supplement, based onthe tagged model. In our protocol, they post announcethe phase information of X -basis states only. However,as was shown in Ref.[22], the tagged model[5] is still validgiven such announcement because they only use Z -basisbits for key distilltion.After Charlie announces the measurement outcome,Alice (Bob) randomly chooses some Z -windows and an-nounces whether she (he) has sent a coherent state atthat window. The each also announces which windowshave been chosen as X -windows. In this way, they canknow the error rate in both bases. N f = n − n H ( e ph ) − n t f H ( E Z ) (9) N f : number of final bits, n : number of bits caused bysingle-photon state from set C which includes in those Z windows when Alice has decided to send while Bob de-cides not sending or Alice decides not sending while Bobdecides sending. n t : total number of bits, say, for an ef-fective event, if Alice (Bob) has not sent, she (he) regardsit as bit 0 (1), if she (he) has sent, she (he) regards it asa bit 1 (0); H ( x ) = − x log x − (1 − x ) log(1 − x ): binaryentropy function, and f : error correction efficiency fac-tor. E Z : observed error rate of bits caused in Z windows. e ph : phase-flip error rate for those n . (Numbers n , n t ,should deduct those test bits.) Here e ph is the single-photon phase-flip rate in Z basis from C , by worst-caseanalysis, as detailed in the supplement. E Z is the bit-fliprate. The number of bit-flips is the number of effectiveevents caused by those cases that both have sent a co-herent state and the cases that neither has sent anythingin Z -windows. Security of a 3-state single-photon source based on a4-state single-photon source.
Similar to [18], we canrelate the security of our 3-state single-photon protocolhere to the 4-state single-photon protocol[22]. There, atany single shot, a set of four candidature state is crested,as set F = {| z i , | z i , | ˜ x ±i = √ ( e iρ Ai | z i ± e iρ Bi | z i ) } . They can obtain the value for e ph ( E Z ) as requestedin Eq.(20) by directly observing the errors of X -basis( Z − basis) bits. Definitely, we can choose to realize the4-state protocol by using a source emitting 3 random setsof pulses: set F + contains state | ˜ x + i only, set F X con-tains state | ˜ x + i , | ˜ x −i randomly, and set C contains allstates in Z basis. Instead of directly observing the num-ber of errors in X basis, one can first observe number ofcorrect counts and wrong counts (counts by different de-tectors) for set F + , combine this with the total numberof counts by different detectors for states from set F X ,we can deduce the number of correct counts and wrongcounts for states | ˜ x + i and states | ˜ x −i in set F X . Usingthis value, we can continue the protocol for final key dis-tillation. Note that, in the estimation process, we neverneed to know which states in set F X is | ˜ x + i and whichstate is | ˜ x −i there. This means, we can replace the statesin set F X by a set of states prepared in Z basis, since thetwo sets have the same density operator and Eve cannotdistinguish them. This means, although we have onlyused three states, {| z i , | z i , | ˜ x + i} , we can deduce theerror rate in X basis faithfully by worst-case analysis[18]as shown in the supplement.In our real protocol, we use coherent states of inten-sity µ/ n and e ph in Eq.(20) inthe supplement. The numerical results of key rate withrespect to distance is shown in Fig. 1. We have takenoptimized values of sending probability ǫ and intensity µ/ Intensity fluctuation.
There could be intensity fluctu-ation for the laser beams at each side. Say, at each side,the actual intensity value is µ Ai / , µ Bi /
2. Given this, thevirtually post selected single-photon entangled states arenot exactly on the states requested in
Theorem 2 . Thiscan be easily fixed by using the idea in [23]: Suppose µ M / i , each side has usedthe constant exact intensity µ M / µ Ai / µ Bi / µ M / S i = {|Z i , |Z i , |X + i = α |Z i + β |Z i} , which can be mapped either from thesource {| z i , | z i , | ˜ x + i = √ ( α | α | z i + β | β | z i ) } or fromthe source {| z i , | z i , x + i = √ ( | z i + | z i ) } with a non-trace-preserving map (here | α | + | β | = 1, but | α | 6 = | β | ). distance(km) -14 -12 -10 -8 -6 -4 -2 k e y r a t e pe r pu l s e E a =0E a =0.1E a =0.2E a =0.3 FIG. 1: Log scale of the key rate as a function of the distancebetween Alice and Bob with different misalignment error rate. E a : single-photon misalignment error. But here we have used coherent state source and we needto take the worst-case analysis, with assuming anothervalue of µ in the calculation. These will be reported elsewhere. Numerical simulation.
Assume detector dark countrate to be 10 − with detection efficiency of 80%, a lin-ear lossy channel with transmittance η = 0 . − L/ km ,and the correction efficiency is f = 1 .
16. The results ofnumerical simulation are shown in Fig. 1.
No-touch protocol with phase-coding TF-QKD
Ourno-touch idea can obviously apply to phase-codingprotocols[20, 21] of TF-QKD[19]. Say, instead of sepa-rate the random phase shift and coding phase shift, atany time, Alice (Bob) just send a reference light from anindependent Laser device with her weak light beam forQKD coding. They can know the the phase differencevalue between the strong reference light and the weaklight for QKD coding by detecting the interference ofstrong pulses phase-locked with them. They rememberthis value r A , r B . If there is a count, Alice will ran-domly announce R = r A or R = r ′ A = r A ± π , (both r A , r ′ A should be in [0 , π ), this determines the + or − in r ′ A ). Bob will, take post-selection by a phase-slice cri-terion similar to Eq.(8) To a post-selected event, a bitvalue 0 or 1 is created dependent on Alice has chosen toannounce r A or ri A . It should be interesting to studywhether the no-touch phase-coding protocols can also beside-channel-free. Concluding Remarks.
We have proposed a no-touchQKD protocol with a 3-state source. We show that thisprotocol side-channel-free, i.e., both source side-channel-free and measurement device independent. We presentgeneral conditions with theorems for side channel free 3-state source. Our protocol is immune to all adverse dueto side channels such as the photon frequency spectrum,emission time, propagation direction, spatial angular mo-ment, and so on. Our result here is side-channel-freebut not entirely device-independent. It’s security stilldepends on some conditions, such as the randomness indeciding sending or not, the lower bound of fraction ofsingle-photons and vacuums of coherent states, and therandomness of the global phase in a coherent state.
Appendix: worst-case analysissingle-photon case
Consider a random subset of | ˜ x + i states we have sent, F + . Suppose there are ˜ N + elementsfor set F + . Consider a random subset F Z for Z basisstates including 2 ˜ N + states. States in subset set F z canbe regarded as that they had been prepared in X basiswith half of them in state | ˜ x + i and half of them in state | ˜ x −i . We don’t directly observe the error rate in X basisin set F Z (because we have no way to do so). But we candeduce it by the observed results on set F + and set F Z .They are: { ˜ n +0 , ˜ n +1 } ; { ˜ n Z , ˜ n Z } (10)where, ˜ n +0 , ˜ n +1 are the numbers of detected correct out-come (detected by detector D ) and wrong outcome (de-tected by detector D ) for states in F + ; ˜ n Z , ˜ n Z are thenumber of events detected by detector D , D , respec-tively for states in set F Z . Note that we define a correctdetected event in X basis by this: Detector D clicks fora state originally prepared in state | x + i or detector D clicks for a state originally prepared in | x −i . We alsodefine a wrong detected events in X basis: Detector D clicks for a state originally prepared in state | x + i or de-tector D clicks for a state originally prepared in | x −i .Asymptotically, we have the value of phase flip error ratein Z basis by deducing error rate in X basis for set F z by e ph = ˜ n +1 + ˜ n − ˜ n Z + ˜ n Z (11)and ˜ n − = ˜ n Z − ˜ n +0 . worst-case analysis of key-rate dependent parameters forcoherent states We consider two random sets, c X and c Z .Set c X contains N X pulse pairs from X basis. Set c Z contains N Z pulses from set C , which contains all thosepulses of Z basis when Alice decides sending and Bobdecides not sending, and Alice decides not sending andBob decides sending. Denote N Z as the number of pulsesin set c Z . To apply the relation e ph = ˜ n +1 + ˜ n − ˜ n Z + ˜ n Z , (12)we need the condition N Z µe − µ/ / N X µe − µ . (13) Observed data: { n X , n X } ; { n Z , n Z } (14)where n X , n X : the number of clicks of detector D , D due to pulse pairs from set c X ; n Z , n Z : number of clicksof detector D , D due to the pulses from set c Z .Denote n Z = n Z + n Z to be the total counts due toset c Z . Our goal is to formulate upper bound of e ph andlower bound of n in eq.(20). There is a single-photonsubset ˜ c X in set c X . Due to this subset, we have the lowerbound value of number of counts of D (correct counts)by˜ n +0 ≥ n X − Y N X e − µ − N X (1 − e − µ − µe − µ ) . (15)and upper bound value of D counts (wrong counts) by˜ n +1 ≤ n X − Y N X e − µ (16)where Y k ( k = 0 ,
1) is the two-mode vacuum yield fordetector k clicking only. Consider ˜ c Z , a subset of c Z ,containing all single-photon pulses from c Z . This sub-set, if every single-photon pulse had been prepared in X -basis, its wrong click number ˜ n − (number of wrongclicks due to pulses originally prepared in coding state | x −i ) is given by ˜ n − = ˜ n Z − ˜ n +0 . (17)Denote the number of counts from set ˜ c Z to be ˜ n Z =˜ n Z + ˜ n Z where ˜ n Z , ˜ n Z are number of counts of de-tector D , D respectively, due to pulses in set ˜ c Z . Wehave˜ n Z ≥ ( n Z + n Z ) − N Z (1 − e − µ/ − µe − µ/ / − Y N Z e − µ/ (18)where Y = Y + Y , and we also have e ph = ˜ n +1 + ˜ n − ˜ n Z ≤ n X + n Z − ˜ n +0 ˜ n Z (19)Given equations (15)(18)(19), we can calculate the keyrate by N f = n − n H ( e ph ) − n t f H ( E Z ) (20)now, with n = (˜ n Z /N Z ) N C (21)and N C is the number of pulses in set C . [1] C.H. Bennett and G. Brassard, in Proc. of IEEE Int.Conf. on Computers, Systems, and Signal Processing (IEEE, New York, 1984), pp. 175-179.[2] N. Gisin, G. Ribordy, W. Tittel, et al. , Rev. Mod. Phys. , 145 (2002); N. Gisin and R. Thew, Nature Photonics, , 165 (2006); M. Dusek, N. L¨utkenhaus, M. Hendrych,in Progress in Optics VVVX , edited by E. Wolf (Elsevier,2006); V. Scarani, H. Bechmann-Pasqunucci, N.J. Cerf, et al. , Rev. Mod. Phys. , 1301 (2009).[3] B. Huttner, N. Imoto, N. Gisin, et al. , Phys. Rev. A ,1863 (1995); H.P. Yuen, Quantum Semiclassic. Opt. ,939 (1996).[4] G. Brassard, N. L¨utkenhaus, T. Mor, et al. , Phys. Rev.Lett. , 1330 (2000); N. L¨utkenhaus, Phys. Rev. A ,052304 (2000); N. L¨utkenhaus and M. Jahma, New J.Phys. , 44 (2002).[5] H. Inamori, N. L¨utkenhaus, and D. Mayers, EuropeanPhysical Journal D, , 599 (2007), which appeared inthe arXiv as quant-ph/0107017; D. Gottesman, H.K. Lo,N. L¨utkenhaus, et al. , Quantum Inf. Comput. , 325(2004).[6] W.-Y. Hwang, Phys. Rev. Lett. , 057901 (2003).[7] X.-B. Wang, Phys. Rev. Lett. , 230503 (2005).[8] H.-K. Lo, X. Ma, and K. Chen, Phys. Rev. Lett. ,230504 (2005).[9] X.-B. Wang, C.-Z. Peng, J. Zhang, et al. Phys. Rev. A , 042311 (2008); J.-Z. Hu and X.-B. Wang, Phys. Rev.A, , 012331(2010).[10] X.-B. Wang, T. Hiroshima, A. Tomita, et al. , PhysicsReports , 1(2007).[11] X.-B. Wang, L. Yang, C.-Z. Peng, et al. , New J. Phys. , 075006 (2009).[12] H.-K. Lo, M. Curty, and B. Qi, Phys. Rev. Lett. ,130503 (2012).[13] X.-B. Wang, Phys. Rev. A , 012320 (2013); M. Curty,F. Xu, W. Cui et al. , Nat. Commun. , 3732 (2014); Z.-W. Yu, Y.-H. Zhou, and X.-B. Wang, Phys. Rev. A ,062339 (2013); F. Xu, H. Xu, and H.-K. Lo, Phys. Rev.A , 052333 (2014); Z.-W. Yu, Y.-H. Zhou, and X.-B.Wang, Phys. Rev. A , 032318 (2015); Y.-H. Zhou, Z.-W. Yu, X.-B. Wang. Phy. Rev. A , 042324 (2016). [14] D. Mayers and A. C.-C. Yao, in Proceedings of the 39thAnnual Symposium on Foundations of Computer Science(FOCS98) (IEEE Computer Society, Washington, DC,1998), p. 503; A. Acin, N. Brunner, N. Gisin, et al. , Phys.Rev. Lett. , 230501 (2007); V. Scarani, and R. Renner,Phys. Rev. Lett. , 302008 (2008); V. Scarani, and R.Renner, in ,(University of Tokyo, Tokyo 30 Jan1 Feb 2008) See alsoarXiv:0806.0120[15] S.L. Braunstein and S. Pirandola, Phys. Rev. Lett. ,130502 (2012).[16] S. N. Molotkov and S. S. Nazin, J. Exp. Theor. Phys.63, 924 (1996); S. N. Molotkov, J. Exp. Theor. Phys. 87,288 (1998); B.-S. Shi, Y.-K. Jiang and G.-C. Guo, Appl.Phys. B 70, 415 (2000).[17] C.-H. F. Fung and H.-K. Lo, Phys. Rev. A 74, 042342(2006).[18] K. Tamaki, M. Curty, G. Kato, H.-K. Lo, and K. Azuma,Phys. Rev. A90, 052314(2014).[19] M. Lucamarini ,Z.L. Yuan, J.F. Dynes, & A.J. Shields,Nature 557, pages 400C403 (2018)[20] Xiongfeng Ma, Pei Zeng, Hongyi Zhou,arXiv:1805.05538, 2018, Phase-matching quantumkey distribution [21] K. Tamaki, H.K. Lo, W. Wang, and M. Lucamarini,arXiv:1805.05511, 2018,
Information theoretic security ofquantum key distribution overcoming the repeaterless se-cret key capacity bound. [22] Xiang-Bin Wang, Zongwen Yu, and Xiao-long Hu,arXiv:1805.09222, 2018,