Source monitoring for continuous-variable quantum key distribution
aa r X i v : . [ qu a n t - ph ] D ec Source monitoring for continuous-variable quantum keydistribution
Jian Yang, Xiang Peng ∗ and Hong Guo † CREAM Group, State Key Laboratory of Advanced Optical Communication Systems andNetworks (Peking University) and Institute of Quantum Electronics, School of ElectronicsEngineering and Computer Science, Peking University, Beijing 100871, PR ChinaE-mail: ∗ [email protected] E-mail: † [email protected] Abstract.
The noise in optical source needs to be characterized for the security ofcontinuous-variable quantum key distribution (CVQKD). Two feasible schemes, based oneither active optical switch or passive beamsplitter are proposed to monitor the variance ofsource noise, through which, Eve’s knowledge can be properly estimated. We derive thesecurity bounds for both schemes against collective attacks in the asymptotic case, and findthat the passive scheme performs better. ource monitoring for continuous-variable quantum key distribution
1. Introduction
Continuous-variable quantum key distribution (CVQKD) encodes information into thequadratures of optical fields and extracts it with homodyne detection, which has highere ffi ciency and repetition rate than that of the single photon detector [1]. CVQKD, especiallythe GG02 protocol [2], is hopeful to realize high speed key generation between two parties,Alice and Bob.Besides experimental demonstrations [3, 4], the theoretical security of CVQKD has beenestablished against collective attacks [5, 6], which has been shown optimal in the asymptoticallimit [7]. The practical security of CVQKD has also been noticed in the recent years, andit has been shown that the source noise in state preparation may be undermine the securekey rate [8]. In GG02, the coherent states should be displaced in phase space followingGaussian modulation with variance V . However, due to the imperfections in laser source andmodulators, the actual variance is changed to V + χ s , where χ s is the variance of source noise.An method to describe the trusted source noise is the beamsplitter model [8, 9]. Thismodel has a good approximation for source noise, especially when the transmittance ofbeamsplitter T A approaches 1, which means that the loss in signal mode is negligible.However, this method has the di ffi culty of parameter estimation to the ancilla mode of thebeamsplitter, without the information of which, the covariance matrix of the system arenot able to determine. In this case, the optimality of Gaussian attack [10, 11] should bereconsidered [12], and we have to assume that the channel is linear to calculate the securekey rate. To solve this problem, we proposed an improved source noise model with generalunitary transformation [12]. Without extra assumption on quantum channel and ancilla state,we are able to derive a tight security bound for reverse reconciliation, as long as the varianceof source noise χ s can be properly estimated. The optimality of Gaussian attack is kept withinthis model.The remaining problem is to estimate the variance of source noise properly. Without sucha source monitor, Alice and Bob can not discriminate source noise from channel excess noise,which is supposed to be controlled by the eavesdropper (Eve) [13]. In practice, source noise istrusted and is not controlled by Eve. So, such untrusted source noise model just overestimatesEve’power and leads to an untight security bound. A compromised method is to measure thequadratures of Alice’s actual output states each time before starting experiment. However,this work is time consuming, and in QKD running time, the variance of source noise mayfluctuate slowly and deviate from preliminary result. In this paper, we propose two real-timeschemes, that the active switch scheme and the passive beamsplitter scheme to monitor thevariance of source noise, with the help of which, we derive the security bounds asymptoticallyfor both of them against collective attacks, and discuss their potential applications when finitesize e ff ect is taken into account. ource monitoring for continuous-variable quantum key distribution
2. Source monitoring in CVQKD
In this section, we introduce two real-time schemes to monitor the variance of source noisefor the GG02 protocol, based on our general model. Both schemes are implemented in the so-called prepare and measurement scheme (P&M scheme) [14], while for the ease of theoreticalresearch, here we analyze their security in the entanglement-based scheme (E-B scheme). Thecovariance matrix, used to simplify the calculation, is defined by [14] γ i j = Tr[ ρ { (ˆ r i − d i ) , (ˆ r j − d j ) } ] , (1)where operator ˆ r i − = ˆ x i , ˆ r i = ˆ p i , mean value d i = h ˆ r i i = Tr[ ρ ˆ r i ], ρ is the density matrix, and {} denotes the anticommutator.In E-B scheme, Alice prepares EPR pairs, measuring the quadratures of one mode withtwo balanced homodyne detectors, and then send the other mode to Bob. It is easy to verifythat the covariance matrix of an EPR pair is γ AB = V I √ V − σ z √ V − σ z V I , (2)where V = V A + V A corresponds to Alice’s modulationvariance in the P&M scheme. However, due to the e ff ect of source noise, the actual covariancematrix is changed to γ AB = V I √ V − σ z √ V − σ z ( V + χ s ) I , (3)where χ s is the variance of source noise. As mentioned in [12], we assume this noise isintroduced by a neutral party, Fred, who purifies ρ AB and introduces the source noise witharbitrary unitary transformation. In this section, we show how to monitor χ s with our activeand passive schemes, and derive the security bounds in the infinite key limit. A method of source monitoring is to use an active optical switch, controlled by a true randomnumber generator (TRNG), combined with a homodyne detection. The entanglement-basedversion [15] of this scheme is illustrated in Fig. 1, where we randomly select parts of signalpulses, measure their quadratures and estimate their variance. In the infinite key limit, thepulses used for source monitor should have the same statistical identities with that sent to Bob.Comparing the estimated value with the theoretical one, we are able to derive the variance ofsource noise, and the security bound can be calculated by [12] K OS = (1 − r ) × [ β × I ( a : b ) − S ( E : b )] , (4)where r is the sampling ratio of source monitoring, I ( a : b ) is the classical mutual informationbetween Alice and Bob, S ( E : b ) is the quantum mutual information between Eve and Bob, ource monitoring for continuous-variable quantum key distribution EPR
Alice
Optical SwitchSource Monitor F Bob
Channel HomodyneDetector A B F F B B ( , ) ! Figure 1. (color online). Entanglement-based model for the optical switch scheme. Alicemeasures one mode of EPR pairs and projects the other mode to coherent states, and thensends it to Bob. F represents the neutral party, Fred, who introduces the source noise. Usinga high-speed optical switch driven by TRNG, we can measure part of the signal sent to B andestimate the variance of source noise ∆ V in the infinite key limit. and β is the reconciliation e ffi ciency. After channel transmission, the whole system can bedescribed by covariance matrix γ FAB γ FAB = F F F F ′ F T F F F ′ F T F T V I p η ( V − σ z ( F ′ ) T ( F ′ ) T p η ( V − σ z η ( V + χ s + χ ) I , (5)where χ s is the variance of source noise, 2 × F i j is related to Fred’s two-modestate, η is the transmittance and χ = (1 − η ) /η + ǫ is the channel noise and ǫ is the channelexcess noise. In practice, the covariance matrix can be estimated with experimental data withsource monitor and parameter estimation. Here, for the ease of calculation, we assume thatparameters η and ǫ have known values.Given γ FAB , the classical mutual information I ( a : b ) can be directly derived, while S ( E : b ) can not, since the ancilla state F is unknown in our general model. Fortunately, wecan substitute γ FAB with another state γ ′ FAB when calculating S ( E : b ) [12], where γ ′ FAB = I I V + χ s ) I p η [( V + χ s ) − σ z p η [( V + χ s ) − σ z η ( V + χ s + χ ) I , (6)and we have shown that such substitution provides a tight bound for reverse reconciliation.Here, we have assumed that the pulses generated in Alice is i.i.d., and the true randomnumber plays an important role in this scheme, without which, the sampled pulses may havedi ff erent statistical characters from signal pulses sent to Bob. The asymptotic performance ofthis scheme will be analyzed in sec. III. Though the active switch scheme is intuitive in theoretical research, it is very not convenientin the experimental realization, since the high speed optical switch and an extra TRNG are ource monitoring for continuous-variable quantum key distribution − r ) due to the sampling ratio. Inspiredby [16], we propose a passive beam splitter scheme to simplify the implementation. Asillustrated in Fig. 2, a beamsplitter is used to separate mode B into two parts. One mode, M ,is monitored by Alice, and the other, B , is sent to Bob.The security bound of passive beam splitter scheme can be calculated in a similar waythat we substitute the whole state ρ FAB M with ρ ′ FAB M . The covariance of its subsystem, ρ AB M , can be written as γ ′ AB M = ( V + χ s ) I p ( V + χ s ) − σ z p ( V + χ s ) − σ z ( V + χ s ) I
00 0 I , (7)where mode M is initially in the vacuum state. The covariance matrix after beam splitter is γ ′ AB M = ( I A ⊗ S BM BS ) T γ AB M ( I A ⊗ S BM BS ) , (8)where I A ⊗ S BM BS = I √ T I √ − T I − √ − T I √ T I . Then, mode B is sent to Bob through quantum channel, characterized by ( η, χ ). Thecalculation of S ( E : b ) in this scheme is a little more complex, since an extra mode M isintroduced by the beamsplitter. We omit the detail of calculation here, which can be derivedfrom [14]. The performance of this scheme is discussed in the next section.
3. Simulation and Discussion
In this section, we analyze the performance of both schemes with numerical simulation. Asmentioned above, the simulation is restricted to the asymptotic limit. The case of finite sizewill be discussed later. To show the performance of source monitor schemes, we illustrate thesecure key rate in Fig. 3, in which the untrusted noise scheme is included for comparison.For the ease of discussion, the imperfections in practical detectors are not included in oursimulation, the e ff ect of which have been studied previously [4]. EPR
Alice
Optical SwitchSource Monitor
Bob
Channel HomodyneDetector ( , ) ! EPR
Alice
Beamsplitter
Source Monitor F Bob
Channel HomodyneDetector A B F F B B ( , ) ! M Figure 2. (color online). Entanglement-based model for the beamsplitter scheme. The opticalswitch in Fig.1 is replaced by a beamsplitter. Alice and Bob are able to estimate the sourcenoise by measuring mode M with the homodyne detection. ource monitoring for continuous-variable quantum key distribution −3 −2 −1 Distance (km) S e c u r e k e y r a t e Figure 3. (color online). A comparison among the secure key rate of untrusted noise scheme,optical switch scheme and beam splitter scheme for the GG02 protocol, which are in dashline, dot-dash line and solid line, respectively. Typical values are used for each parameter.The modulation variance is V =
40, the source noise is χ s = .
1, the channel excess noise is ǫ = .
1, and the reconciliation e ffi ciency is β = .
8. The sample ration in the optical switchscheme is r = .
5, and the transmittance in the beam splitter scheme is T = . As shown in Fig. 3, secure key rate of each scheme is limited within 30km, where largeexcess noise ǫ ∼ . untrusted source noise scheme has the shortest securedistance, because it ascribes the source noise into channel noise, which is supposed to beinduced by the eavesdropper. In fact, source noise is neutral and can be controlled neitherby Alice and Bob, nor by Eve. So, this scheme just overestimates Eve’s power by supposingshe can acquire extra information from source noise, which lower the secure key rate of thisscheme.Both the active and passive schemes have longer secure distance than the untrusted noisescheme, since they are based on the general source noise model, which does not ascribe sourcenoise into Eve’s knowledge. The active switch scheme has lower secure key rate in the shortdistance area. This is mainly because that the random sampling process intercepts parts of thesignal pulses to estimate the variance of source noise, which reduces the repetition rate withratio r . Nevertheless, it does not overestimate Eve’s power [12]. As a result, the secure keydistance is improved.Both the secure key rate and secure distance of beam splitter scheme are superior thanthat of other schemes, when the transmittance is set to be 0 .
5, equal to the sampling rate r in optical switch scheme, where no extra vacuum noise is introduced. This phenomena isquite similar to the ”noise beat noise” scheme [14], which improves the secure key rate byintroduce an extra noise into Bob’s side. Though such noise lowers the mutual information ource monitoring for continuous-variable quantum key distribution Figure 4. (color online). Secure key rate as a function of distance d and transmittance T , inwhich T varies from 0 .
01 to 0 .
99. The colored parts illustrates the area with positive securekey rate, the empty parts illustrates to insecure area, and the abscissa values of boundary pointscorresponds to the secure distance. between Alice and Bob, it also makes Eve more di ffi cult to estimate Bob’s measurement result.With the help of simulation, we find a similar phenomenon in the beam splitter scheme, thevacuum noise reduces mutual information S ( b : E ) more rapidly than its e ff ect on I ( a : b ).A preliminary explanation is that the sampled pulse in optical switch scheme is just usedto estimate the noise variance, while in beam splitter model it increases Eve’s uncertaintyon Bob’s information. Combined with advantages in experimental realization, beam splitterscheme should be a superior choice.To optimize the performance of passive beam splitter scheme, we illustrate the securekey rate in Fig. 4 for di ff erent beam splitter transmittance T A . The maximal secure distanceabout 34km is achieved when T ∼ .
1, about 10 km longer than that when T ∼ .
5. Combinedwith the discussion above, this result can be understood as a balance between the e ff ects ofthe noise on I ( a : b ) and S ( b : E ), induced by beamsplitter. When T A is too small, I ( a : b )also decreases rapidly, which limits the secure distance.
4. Finite size e ff ect The performance of source monitor schemes above is analyzed in asymptotical limit. Inpractice, the real-time monitor will concern the finite-size e ff ect, since the variance of sourcenoise may change slowly. A thorough research in finite size e ff ect is beyond the scope ofthis paper, because the security of CVQKD in finite size is still under development, that the ource monitoring for continuous-variable quantum key distribution ff ect of block size, for a givendistance. Taking the active optical switch scheme for example, with a similar method in [17],the maximum-likelihood estimator ˆ σ s is given byˆ σ s = m m X i = y i − V , (9)where ( m ˆ σ s /σ s ) ∼ χ ( m − y i is the measurement result of source monitor, and σ s = χ s isthe expected value of the variance of source noise. For large m , the χ distribution convergesto a normal distribution. So, we have σ ≈ ˆ σ s − z ǫ SM ˆ σ s √ √ m (10)where z sm is such that 1 − erf( z sm / √ = ǫ SM , and ǫ S M is the failure probability. The reason whywe choose ˆ σ min is that given the values of η ( V + χ s + χ ) and η , estimated by Bob, the minimumof χ s corresponds to the maximum of channel noise χ , which may be fully controlled by Eve.The extra variance ∆ m χ s due to the finite size e ff ect in source monitor is ∆ m χ s ≈ z SM ˆ σ s √ √ m . (11)For ǫ S M ∼ − , we have z ǫ S M ≈ .
5. As analyzed in [17], if the distance between Aliceand bob is 50 km ( T ∼ − ), The block length should be at least 10 , which corresponds to ∆ m χ s ∼ − induced by the finite size e ff ect in source monitor. Compared with the channelexcess noise of 10 − , the e ff ect of finite size in source monitor is very slight. Due to the highrepetition rate in CVQKD, Alice and Bob are able to accumulate such a block within severalminutes, during which the source noise may change slightly.
5. Concluding Remarks
In conclusion, we propose two schemes, the active optical switch scheme and the passivebeamsplitter scheme, to monitor the variance of source noise χ s . Combined with previousgeneral noise model, we derive tight security bounds for both schemes with reversereconciliation in the asymptotic limit. Both schemes can be implemented under currenttechnology, and the simulation result shows an better performance of our schemes, comparedwith the untrusted source noise model. Further improvement in secure distance can beachieved, when the transmittance T A is optimized.In practise, the source noise varies slowly. To realize real-time monitoring, the finite sizee ff ect should be taken into account, that the block size should not be so large, that the sourcenoise has changed significantly within this block, and the block size should not be too small,that we can not estimate the source noise accurately. The security proof of CVQKD with finiteblock size has not been established completely, since the optimality of collective attack andGaussian attack has not been shown in finite size. Nevertheless, we derive the e ff ective sourcenoise induced by the finite block size, and find its e ff ect is not significant in our scheme. So,our schemes may be helpful to realize real-time source monitor in the future. ource monitoring for continuous-variable quantum key distribution Acknowledgments
This work is supported by the Key Project of National Natural Science Foundation of China(Grant No. 60837004), National Hi-Tech Research and Development (863) Program. Theauthors thank Yujie Shen, Bingjie Xu and Junhui Li for fruitful discussion.
References [1] Scarani V, Bechmann-Pasquinucci H, Cerf N J, Duˇsek M, L¨utkenhaus N, and Peev M 2009
Rev. Mod. Phys. Phys. Rev. Lett. Nature
Phys. Rev. A Phys. Rev. Lett. Phys. Rev. Lett. Phys. Rev. Lett.
Phys. Rev. A Phys. Rev. A Phys. Rev. Lett. Phys. Rev. Lett. Phys. Rev. A J. Phys. B: At. Mol. Opt. Phys. Ph.D. thesis
ULB Bruxelles[15] Grosshans F, Cerf N J, Wenger J, Tualle-Brouri R, and Grangier P 2003
Quantum Inf. Comput. Opt. Lett. Phys. Rev. A81