Simple protocol for secure decoy-state quantum key distribution

Simple protocol for secure decoy-state quantum key distribution with a loosely controlled sourceXiang-Bin Wang a͒Department of Physics,Tsinghua University,Beijing100084,ChinaCheng-Zhi Peng b͒Department of Physics,Tsinghua University,Beijing100084,China;Hefei National Laboratory forPhysical Sciences at Microscale,University of Science and Technology of China,Hefei,Anhui230026,China;and Department of Modern Physics,University of Science and Technology of China,Hefei,Anhui230026,ChinaJian-Wei Pan c͒Department of Physics,Tsinghua University,Beijing100084,China;Hefei National Laboratory forPhysical Sciences at Microscale,University of Science and Technology of China,Hefei,Anhui230026,China;and Department of Modern Physics,University of Science and Technology of China,Hefei,Anhui230026,China;and Physikalisches Institut,Universität Heidelberg,Philosophenweg12,69120Heidelberg,Germany͑Received3October2006;accepted10December2006;published online18January2007͒The method of decoy-state quantum key distribution requests different intensities of light pulses.Existing theory has assumed exact control of intensities.Here the authors propose a simple protocol which is secure and efficient even there are errors in intensity control.In their protocol,decoy pulses and signal pulses are generated from the same father pulses with a two-value attenuation.Given the upper bound offluctuation of the father pulses,their protocol is secure provided that the two-value attenuation is done exactly.They propose to use unbalanced beam splitters for a stable attenuation.©2007American Institute of Physics.͓DOI:10.1063/1.2431718͔Recently,some methods1–9have been proposed for se-cure quantum key distribution10–12͑QKD͒with coherent states.13–15One of these methods is the so-called decoy-state method1–6where Alice randomly changes the intensity of her pulses among a few values͑e.g.,three values:0,␮,and␮Ј͒or infinite values and then she can verify the fraction of single-photon counts in the raw key.With this information,a securefinal key can be distilled by using the separate theo-retical results.16So far a number of experiments on decoy-state QKD have been done17–21in opticalfiber or in free space,in po-larization space,or with phase coding.However,the existing theory of decoy-state method assumes the exact control of pulse intensities.A problem met in practice is how to carry out the decoy-state method efficiently given the inexact con-trol of pulse intensity.As we have shown22actually one can verify the single-photon counts rather efficiently with simple tomography even though the intensityfluctuations of each light pulses are large.However,doing it in that way Alice needs additional operation of tomography.Here we present a simpler protocol for decoy-state method QKD.Here we shall consider the effects of inexact control of␮and␮Јin a decoy-state protocol requesting three intensities ͕0,␮,␮Ј͖.͑Actually,all decoy-state protocols with a few in-tensities,e.g.,two or four intensities3,5have the same basic problem of inexact control of␮and␮Ј.͒For clarity,lets us first consider an ideal protocol with exact intensity control, as shown in Fig.1͑a͒.At any time t,if Alice wants to send a pulse of intensity␮or␮Ј,shefirst produces a father pulse of intensity⍀.After that she attenuates the pulse by A͑t͒=␮/⍀or A͑t͒=␮Ј/⍀randomly and a pulse of intensity␮or ␮Јis produced randomly and sent out to Bob.In this idealprotocol,both⍀and A͑t͒are controlled exactly.For practical use,we propose a similar protocol as shown in Fig.1͑b͒.Alice wants to produce an intensity⍀for the father pulse.She then takes the same random attenua-tions as that in the ideal protocol.Here we assume that Alice can control the attenuation factors of A͑t͒exactly͑either ␮/⍀or␮Ј/⍀͒but she cannot control⍀exactly.͓To control the instantaneous attenuation A͑t͒exactly we can use unbal-anced beam splitters as we are going to show.͔At each time, she has actually produced intensities of͕⍀t͖for the father pulses.Although we can never control the intensity exactly,a͒Electronic mail:xbwang@ b͒Electronic mail:pcz@c͒Electronic mail:jian-wei.pan@physi.uni-heidelberg.de FIG.1.͑a͒Ideal protocol that Alice can produce constant intensity⍀for the father pulse;therefore intensities␮and␮Јare controlled exactly.͑b͒Real protocol used in practice.At each time,Alice wants to produce intensity⍀for the father pulse,however,she actually produces͕⍀t͖at each time t. Consequently,the intensities of output pulses are͕␮i͖and͕␮iЈ͖.We assumethat Alice can control the attenuator A͑t͒exactly in a real protocol.After a father pulse is produced,Alice randomly choose the attenuation factor by A͑t͒=␮/⍀or A͑t͒=␮Ј/⍀.Here the subscript t is from1to N+NЈ,subscript i for͕␮i͖is from1to N,and subscript i for͕␮iЈ͖is from1to NЈ.APPLIED PHYSICS LETTERS90,031110͑2007͒0003-6951/2007/90͑3͒/031110/3/$23.00©2007American Institute of Physics90,031110-1Downloaded 23 Sep 2009 to 210.45.72.58. Redistribution subject to AIP license or copyright; see /apl/copyright.jspby our currently existing technology,we can definitely con-trol the intensity in a small range,say,e.g.,controlling the fluctuation within ±5%of ⍀.That is to say,Alice knows the upper bound of ͕⍀t ͖.We denote such an upper bound value as ⍀M .Given this upper-bound value ⍀M ,the setup in Fig.1͑b ͒is equivalent to a virtual setup as shown in Fig.2͑a ͒.In the virtual protocol shown in Fig.2͑a ͒,every time a father pulse of constant intensity ⍀M is first produced and then the pulse is attenuated randomly,with attenuation factors of A Ј͑t ͒=⍀t /⍀M .Alice cannot control this A Ј͑t ͒.After this attenua-tion,a pulse of intensity ⍀t is produced.Note that A Ј͑t ͒is independent of ␮and ␮Ј,since we can imagine that Alice decides to use ␮or ␮Јafter the attenuation A Ј͑t ͒.Since all attenuators are inside Alice’s laboratory,it makes no differ-ence if Alice exchanges the order of attenuators A ͑t ͒and A Ј͑t ͒.The physical meaning of order exchange is that Alice first decides to use ␮or ␮Јand then arrange the attenuation A Ј͑t ͒which is independent of Alice’s decision of using ␮or ␮Ј.This is just the virtual protocol in Fig.2͑b ͒.In Fig.2͑b ͒,after the pulse passes A ͑t ͒but before passes A Ј͑t ͒,the inten-sity should be either ␮˜=͑␮/⍀͒⍀M or ␮˜Ј=͑␮Ј/⍀͒⍀M ex-actly .That is to say,during the virtual stage between A ͑t ͒and A Ј͑t ͒,the light intensities of each pulses are either ex-actly ␮˜or exactly ␮˜Ј.But after a pulse passes through A Ј͑t ͒,the intensity is changed to inexact values of ␮i or ␮i Ј.For the security proof of the real setup in Fig.1͑b ͒,we show the following lemma first.Lemma .The setup in Fig.2͑b ͒is unconditionally secure if Alice regards it as a three-intensity decoy-state protocol with each light intensities being randomly chosen from ͕0,␮˜,␮˜Ј͖.Proof .First we suppose Eve controls A Ј͑t ͒.The dashed square can be regarded as an exact source for a decoy-stateprotocol using intensities 0,␮˜,and ␮˜Ј.As it has been known already,decoy-state method with exact intensity control is secure given whatever channel.Here what Eve can do is first using A Ј͑t ͒for attenuation and then do whatever.This is only a type of specific channel therefore cannot be used to cheat Alice and Bob.In the setup of Fig.2͑b ͒,actually the attenu-ator A Ј͑t ͒is not controlled by Eve,definitely the setup issecure because Eve cannot attack the protocol better with her power being reduced.Alternatively,we imagine that A Ј͑t ͒is controlled by Alice’s friend,Clare.If Alice choose to disre-gard Clare’s existence then to Alice this is just a decoy-stateprotocol with exactly controlled intensities of ␮˜and ␮˜Ј.Given this lemma,we immediately have the following theorem.Theorem.The setup shown in Fig.1(b)is uncondition-ally secure even though there are intensity fluctuations in values ␮and ␮Јif (1)the values of ͕⍀t ͖are upper bounded by ⍀M ,͑2͒attenuation A ͑t ͒is exactly controlled,and (3)Alice assumes that she had used exact intensities of ͕0,␮͑⍀M /⍀͒,␮Ј͑⍀M /⍀͖͒in calculating the fraction of single-photon counts and distilling the final key .The proof is simply that the final light pulses produced in Fig.1͑b ͒and final light pulses produced in Fig.2͑b ͒are identical.While the scheme in Fig.2͑b ͒has been proven to be secure by our Lemma.The question remaining is then how to make stable at-tenuations A ͑t ͒used above.We can realize A ͑t ͒by beam splitters as shown in Fig.3.First,we attenuate each father pulses ͑⍀t ͒by a fixed attenuation factor of A 0=͑␮+␮Ј͒/⍀.͑A 0can be realized by an unbalanced beamsplitter.͒Second,after this A 0attenuation,we split the beam by a ␮:␮Јbeam splitter and then either the transmitted beam b or the re-flected beam b Јwill be blocked and the other one will be guided to the optical fiber and sent to Bob.Suppose the ideal protocol with parameters ␮e and ␮e Јwould produce a good key rate in a certain experimental condition.Alice can try to use any intensities around ␮e and ␮e Јand then assumes that she had used larger intensities for security.One good choice is that Alice tries to produce ͕0,␮e /␭,␮e Ј/␭͖with ␭=⍀M /⍀for quantum communication with Bob and then assumes to have used ͕0,␮e ,␮e Ј͖.For simplicity,we shall only consider this option hereafter.The actual efficiency of the protocol can be concluded by a real experiment.But we can still roughly estimate the efficiency theoretically on what should be found if we did the experiment.One can calculate the final key rate 5,16if he knows fraction of single-photon counts and the quantum bit error rate ͑QBER ͒.We consider the normal case where there is no Eve.and the channel transmittance is linear.We shall first compare the key rate of the following two protocols:our protocol with channel transmittance ␩͓protocol P ͑␩͔͒and the ideal proto-col with channel transmittance ␩/␭͓protocol P 0͑␩/␭͔͒.In both protocols they will assume exact values 0,␮e ,and ␮e Јin the calculation of single-photon counts and final key distilla-tion.However,in protocol P ͑␩͒,Alice had done her best to produce 0,␮e /␭,␮e Ј/␭for quantum communication.In both protocols,Alice and Bob can find the valuesofFIG.2.Equivalent virtual protocols.Our real protocol in Fig.1͑b ͒is equiva-lent to a virtual protocol as shown in part ͑a ͒of this figure.Here Alice first produces a constant intensity ⍀M for each father pulses and then attenuates each of them by attenuator A Ј͑t ͒.After A Ј͑t ͒,the pulse intensity is ⍀t .It makes no difference to the output light if we exchange the order of A ͑t ͒and A Ј͑t ͒;therefore ͑a ͒is equivalent to ͑b ͒.In part ͑b ͒,we can also regard the dashed square as our source and A Ј͑t ͒as part of thechannel.FIG.3.Realizing A ͑t ͒by unbalanced beam splitters.A 0:a constant attenu-ator with attenuation factor ͑␮+␮Ј͒/⍀,this can be realized by an unbal-anced beam splitter.BS:a ␮:␮Јbeam splitter.OS:optical switcher.OF:optical fiber.Downloaded 23 Sep 2009 to 210.45.72.58. Redistribution subject to AIP license or copyright; see /apl/copyright.jspS␮e =1−e−␩␮e/␭+d B and S␮eЈ=1−e−␩␮eЈ/␭+dBas the countingrate͑yields͒of pulses of intensities͑or assumed intensities͒of␮e and␮eЈ,respectively,where d B is the dark count rate of Bob’s detector.We have the following joint equations2to calculate the single-photon transmittance for both protocols,e−␮e s0+␮e e−␮e s1+cs c=S␮e,e−␮eЈs0Ј+␮eЈe−␮eЈs1Ј+ͩ␮eЈ␮eͪ2e␮e−␮eЈs cЈഛS␮eЈ.͑1͒Here c=1−e−␮e−␮e e−␮e.Parameters of s x are counting rates for states͉x͗͘x͉from x pulses͑x=0,1͒,s c is the counting rate of state␳c͑state of those multiphoton pulses͒from␮e pulses. Parameters s xЈare counting rates of the same state as defined for s x,but they are for those states from␮eЈpulses only.The values of s0and s0Јcan be deduced from the observed count-ing rate of those vacuum pulses.͑For the two-intensity protocol,5one can assume s0=s0Ј=0for the minimum key rate.͒Asymptotically,s x=s xЈand s c=s cЈ.Given afinite num-ber of pulses,s x and s xЈcan be a bit different but the possible range of difference can be bounded by classical statistics2,3,5 with exponential certainty therefore minimum values of s1 and s1Јcan be calculated numerically.Since s1and s1Јvalues for both protocols are calculated from the same equations with same parameters,the value of verified single-photon transmittance͑s1,s1Ј͒of our protocol P͑␩͒is equal to that of the ideal protocol P0͑␩/␭͒.This indicates that the two pro-tocols should have the same fraction of single-photon counts for each intensity.If the QBER is determined by dark counts,alignment error and transmission error,the value in our protocol should be the same with͑or a bit less than͒that of the ideal protocol P0͑␩/␭͒.Given all these values requested for thefinal key distil-lation are the same for the two protocols,we conclude that that the key rate of our protocol P͑␩͒is the same with that of the ideal protocol P0͑␩/␭͒.In the case that the intensityfluc-tuation is bounded by5%in our protocol͑i.e.,␭=1.05͒and the light intensity decreases by a half for every15km in both protocols,the QKD distance of our protocol is only shorter than that of the ideal protocol by less than1.06km if we request the same key rate for two protocols.Similar cal-culation shows that even the maximumfluctuation is20%, the shortened distance is less than4km.This shows that the secure distance of currently existing experiments18,19would keep on exceeding100km if they had used the proposed method here.Since currently existing experimental results18,19have not adopted our protocol͑producing differ-ent intensities from the same laser device with attenuation͒, it should be interesting to redo the decoy-state QKD experi-ment using our protocol for a more secure result.The authors thank Dong Yang,Jun Zhang,and Xian-Min Jin for many helps.This work is partially supported by the National Fundamental Researchy Program of China and the Hi-Tech R&D Program of China.1W.-Y.Hwang,Phys.Rev.Lett.91,057901͑2003͒.2X.-B.Wang,Phys.Rev.Lett.94,230503͑2005͒.3X.-B.Wang,Phys.Rev.A72,012322͑2005͒.4H.-K.Lo,X.Ma,and K.Chen,Phys.Rev.Lett.94,230504͑2005͒;H.-K. Lo,IEEE,International Symposium on Information Theory(ISIT),2004͑IEEE,New York,2004͒,p.137.5X.Ma,B.Qi,Y.Zhao,and H.-K.Lo,Phys.Rev.A72,012326͑2005͒. 6J.W.Harrington,e-print quant-ph/0503002.7R.Ursin,F.Tiefenbacher,T.Schmitt-Manderbach,H.Weier,T.Scheidl, M.Lindenthal,B.Blauensteiner,T.Jennewein,J.Perdigues,P.Trojek,JB. Oemer,M.Fuerst,M.Meyenburg,J.Rarity,Z.Sodnik,C.Barbieri,H. Weinfurter,and A.Zeilinger,e-print quant-ph/0607182.8V.Scarani,A.Acin,G.Robordy,and N.Gisin,Phys.Rev.Lett.92, 057901͑2004͒;C.Branciard,N.Gisin,B.Kraus,and V.Scarani,Phys. Rev.A72,032301͑2005͒.9M.Koashi,Phys.Rev.Lett.93,120501͑2004͒;K.Tamaki,N. Lükenhaus,M.Loashi,and J.Batuwantudawe,e-print quant-ph/0608082. 10C.H.Bennett and G.Brassard,in Proceedings of the IEEE International Conference on Computers,Systems,and Signal Processing͑IEEE, New York,1984͒,pp.175–179.11N.Gisin,G.Ribordy,W.Tittel,and H.Zbinden,Rev.Mod.Phys.74,145͑2002͒.12M.Dusek,N.Lütkenhaus,and M.Hendrych,in Progress in Optics,edited by E.Wolf͑Elsevier,New York,in press͒,V ol.49.13M.Bourennane, F.Gibson, A.Karlsson, A.Hening,P.Jonsson,T. Tsegaye,D.Ljunggren,and E.Sundberg,Opt.Express4,383͑1999͒;D. Stucki,D.Stucki,N.Gisin,O.Guinnard,G.Ribordy,and H.Zbinden, New J.Phys.4,41͑2002͒;H.Kosaka,Electron.Lett.39,1199͑2003͒;C. Gobby,Z.L.Yuan,and A.J.Shields,Appl.Phys.Lett.84,3762͑2004͒; X.-F.Mo,Opt.Lett.30,2632͑2005͒;G.Wu,J.Chen,Y.Li,L.-L.Xu,and H.-P.Zeng,e-print quant-ph/0607099.14B.Huttner,N.Imoto,N.Gisin,and T.Mor,Phys.Rev.A51,1863͑1995͒;H.P.Yuen,Quantum Semiclassic.Opt.8,939͑1996͒.15G.Brassard,N.Lütkenhaus,T.Mor,and B.C.Sanders,Phys.Rev.Lett. 85,1330͑2000͒;N.Lütkenhaus,Phys.Rev.A61,052304͑2000͒;N. Lütkenhaus and M.Jahma,New J.Phys.4,44͑2002͒.16H.Inamori,N.Lütkenhaus,and D.Mayers,e-print quant-ph/0107017;D. Gottesman,H.K.Lo,N.Lütkenhaus,and J.Preskill,Quantum -put.4,325͑2004͒.17Y.Zhao,B.Qi,X.Ma,H.-K.Lo,and L.Qian,Phys.Rev.Lett.96, 070502͑2006͒;Y.Zhao,B.Qi,X.Ma,H.-K.Lo,and L.Qian,ISIT ͑Harbin,2006͒,p.2094.18Cheng-Zhi Peng,Jun Zhang,Dong Yang,Wei-Bo Gao,Huai-Xin Ma,Hao Yin,He-Ping Zeng,Tao Yang,Xiang-Bin Wang,and Jian-Wei Pan, Phys.Rev.Lett.98,010505͑2007͒.19D.Rosenberg,J.W.Harrington,P.R.Rice,P.A.Hiskett,C.G.Peterson, R.J.Hughes,J.E.Nordholt,A.E.Lita,and S.W.Nam,Phys.Rev.Lett. 98,010503͑2007͒.20T.Schmitt-Manderbach,H.Weier,M.Fürst,R.Ursin,F.Tiefenbacher,T. Scheidl,J.Perdigues,Z.Sodnik,C.Kurtsiefer,J.G.Rarity,A.Zeilinger, and H.Weinfurter,Phys.Rev.Lett.98,010504͑2007͒.21Z.L.Yuan,A.W.Sharpe,and A.J.Shields,Appl.Phys.Lett.90,011118͑2007͒.22Xiang-Bin Wang,e-print quant-ph/0609081.Downloaded 23 Sep 2009 to 210.45.72.58. Redistribution subject to AIP license or copyright; see /apl/copyright.jsp。