Security proof of practical quantum key distribution with detection-efficiency
mismatch
Yanbao Zhang
NTT Research Center for Theoretical Quantum Physics
NTT Basic Research Lab, Japan
Based on the joint work arXiv:2004.04383 with Patrick J. Coles, Adam Winick, Jie Lin, and Norbert LΓΌtkenhaus
1
β Detection-efficiency mismatch due to manufacturing and setup
*Detectors considered in this work are threshold detectors.
β Detection-efficiency mismatch induced by Eve
π1
π2
Polarized photons
PBS
Why detection-efficiency mismatch mattersοΌ
It is difficult to build two detectors with identical efficiency.
π1
π2
Polarized photons
PBS
Zhao et al., Phys. Rev. A 78, 042333 (2008)
spatial-mode-dependent temporal-mode-dependent
Rau et al., IEEE J. Quantum Electron. 21, 6600905 (2014)Sajeed et al., Phys. Rev. A 91, 062301 (2015) Chaiwongkhot et al., Phys. Rev. A 99, 062315 (2019)
2
β Efficiency mismatch helps Eve to attack QKD systems.
β Efficiency mismatch can cause fake violations of an entanglement witness.
Lydersen et al., Nat. Photon. 4, 686 (2010) Gerhardt et al., Nat. Commun. 2, 349 (2011)
Problems caused by efficiency mismatch
In the presence of efficiency mismatch, the detection events are not fair samples. If only detection events are used, a Bell inequality can be violated even using classical light [Gerhardt et al., Phys. Rev. Lett. 107, 170404 (2011)].
3
Source-replacement description[Bennett, Brassard, Mermin, PRL 68, 557 (1992); Curty, Lewenstein, LΓΌtkenhaus, PRL 92, 217903 (2004); Ferenczi, LΓΌtkenhaus, PRA 85, 052310 (2012)]
| Ϋ§πΉ π΄π΄β² = (| Ϋ§H π΄| Ϋ§H π΄β² + | Ϋ§V π΄| Ϋ§V π΄β²)/ 2
Alice Entanglementsource
π΄
π΄β² sentto Bob
POVM
{ππ₯π΄ = Ϋ§|ππ₯ ΰ΅»ππ₯|}
AliceSingle-photon
source
x β 0,1,2,3
x {ππ₯ = 1/4, Ϋ§ππ₯
ππ₯ β {H, V, D, A}
Prepare & Measure BB84 [Bennett and Brassard (1984)]
Protocol analyzed in this work
Random numberβ’ Assumption: Aliceβs and Bobβs labs are
secure and trusted.
β’ Use of the entanglement-based scheme for security analysis.
1) ππ΄π΄β² ππ΄π΅.
2) Aliceβs measurements are ideal.
β’ Warning: System π΄β² is two-dimensional, but the system π΅ arriving at Bob can be infinite-dimensional.
β’ Detection-efficiency mismatch exists in Bobβs measurement setup.
π΄β² sentto Bob
4
Active Detection Passive Detection
Bobβs measurements & efficiency mismatch
PR β Polarization RotatorPBS β Polarizing Beam Splitter50/50 BS β 50/50 Beam Splitter
PR PBS
H/D
V/A
50/50 BS
PBSH/V
PBSD/A
A
V
D
H
Mode H/D V/A
1 π1 π2
2 π2 π1
Efficiency mismatch model considered Mode H V D A
1 π1 π2 π2 π2
2 π2 π1 π2 π2
3 π2 π2 π1 π2
4 π2 π2 π2 π1
Efficiency mismatch model considered
*Our method works for arbitrary, characterized efficiency mismatch.
2
Random bit b
Mode 2
Mode 1Mode 1
3
4
5
Obstacle to proving security with efficiency mismatch
β’ Without efficiency mismatch, the squashing model exists. A qubit-based security proof still applies.
[Beaudry, Moroder, LΓΌtkenhaus, Phys. Rev. Lett. 101, 093601 (2008);
Tsurumaru and Tamaki, Phys. Rev. A 78, 032302 (2008)]
β’ With efficiency mismatch, the above squashing model doesnβt work.
β’ Previous security proofs with efficiency mismatch assume that the system arriving at Bob contains at most one photon. [Fung et al., Quantum Inf. Comput. 9, 131 (2009); Lydersen and Skaar, Quant. Inf. Comp. 10, 0060 (2010);
Bochkov and Trushechkin, Phys. Rev. A 99, 032308 (2019); Ma et al., Phys. Rev. A 99, 062325 (2019)]
Our contribution: We develop a method to handle the infinite-dimensional system
received by Bob.
*In parallel with us, Trushechkin recently developed an alternative method [arXiv:2004.07809].
Mutiphoton state Single-photon stateSquashing
6
Alice Bob
Announcement Announcement
Sifting Sifting
Key map Key map
Brief introduction to a numerical approach for security proof
ππ΄π΅
Measurement {ππ₯π΄} Measurement {ππ¦
π΅}
1. A protocol can be described by a set of POVMs {ππ₯π΄β ππ¦
π΅ } (measurements), Kraus operator π’
(announcements and sifting), and Key map π΅ (forming key). The state ππ΄π΅ is constrained by observations ππ΄π΅ π₯, π¦ --- the expectation values of POVMs.
QKD protocol
Key rate: πΎ = πΌ β π» π΄ π΅ , where πΌ forprivacy amplification and π» π΄ π΅ for errorcorrection. *Collective attacks are considered, and the key is defined by Alice.
πΌ = minππ΄π΅
π· π’ ππ΄π΅ ||π΅(π’ ππ΄π΅ )
ΰ΅ππ΄π΅ β₯ 0, Tr ππ΄π΅ = 1
Tr (ππ₯π΄ β ππ¦
π΅ ππ΄π΅)= ππ΄π΅ π₯, π¦
Key-rate calculation
2. Once description is given, the key rate (privacy amplification part) takes the form of min π(ππ΄π΅) , where one needs to minimize π depending on ππ΄π΅ (Eveβs attack).
3. As π is a convex function, we can calculate both a lower bound and an upper bound on minπ(π).
Winick, LΓΌtkenhaus, Coles, Quantum 2, 77 (2018)
Coles, Metodiev, LΓΌtkenhaus, Nat. Commun. 7, 11712 (2016)
7
Dimension reduction by flag-state squasherβ’ Key observation: Each POVM element ππ¦
π΅ , π¦ β 1,2, β¦ , π½ , is block-diagonal with respect
to various photon-number subspaces.
β’ For a photon-number cutoff π (π β€ π)- and (π > π)-photon subspaces
Original POVM:
ππ¦π΅=
ππ¦,πβ€ππ΅ 0
0 ππ¦,π>ππ΅
Squashed POVM:
ΰ·©ππ¦ΰ·¨π΅ =
ππ¦,πβ€ππ΅ 0
0 | Ϋ§π¦ |π¦Ϋ¦
For an arbitrary input state ππ©, Tr (π΄ππ©ππ©) = Tr ( ΰ·©π΄π
ΰ·©π©π¦(ππ©)), β π.
Hπβ€π
β
Hπ>π
r
ππ¦,π>ππ΅ | Ϋ§π¦ |π¦Ϋ¦
Squasher π¦β
Hπβ€π
Hπ½
Two equivalent descriptions of the measurement process.
The description using the squasher Ξ is pessimistic, as it allows Eve to completely learn Bobβs outcome when π > π.
A lower bound on ππβ€π is required when using the squasher Ξ.
Infinite dimensional
Finite dimensional
Bob Bob
8
Hπβ€π
Step 1: Reducing the dimension
Step 2: Bounding the photon-number distribution
Overview of our method
minππ΄ΰ·©π΅
π· π’ ππ΄ ΰ·¨π΅ ||π΅(π’ ππ΄ ΰ·¨π΅ )
ΰ΅
ππ΄ ΰ·¨π΅ β₯ 0, Tr ππ΄ ΰ·¨π΅ = 1
Tr (ππ₯π΄ β ΰ·©ππ¦
ΰ·¨π΅ ππ΄ ΰ·¨π΅)=ππ΄π΅ π₯, π¦
Tr(Ξ β€πππ΄ ΰ·¨π΅) β₯ ππ
Accordingly, we need only to solve a finite-dimensional convex optimization problem,and so we can obtain non-trivial lower bounds of the secret key rate.
Our key-rate calculation
*ππ΄ ΰ·¨π΅ is finite-dimensional;
* The operators ΰ·©ππ¦ΰ·¨π΅ depend
on efficiency mismatch.
* Ξ β€π is the projector onto the (β€-π)-photon subspace.
Hπβ€π
βHπ>π
r
ππ¦,π>ππ΅ | Ϋ§π¦ |π¦Ϋ¦
Squasher π¦βHπ½
Infinite dimensional
Bob BobFinite
dimensional
Hπβ€π
9
*Similar bounds have been used for security proofs of QKD without efficiency mismatch, see [LΓΌtkenhaus, PRA 59, 3301 (1999) and Koashi et al., arXiv:0804.0891].
*We use the bounds established in [Y Z and N. LΓΌtkenhaus, PRA 95, 042319 (2017)] for entanglement verification with efficiency mismatch. An alternative bound for active detection with efficiency mismatch was recently derived by Trushechkin, arXiv:2004.07809.
Photon-number distribution boundsβ’ Let π be an observable that depends on both the photon number π and the efficiency
mismatch (e.g., double click or cross click).
β’ π is block-diagonal. WLOG ππ΄π΅ is block-diagonal, i.e., ππ΄π΅= Οπ=0β ππ ππ΄π΅
π.
ππ --- the probability that the system arriving at Bob has π photons.
If we can find π-dependent bounds
π‘obs,π = Tr (ππ΄π΅π
π)β₯ απ‘obs, πβ€π
min , βπ β€ π,
π‘obs, π>πmin , βπ > π,
then we have
π‘obs = Οπ=0β ππ Tr ππ΄π΅
ππ β₯ ππβ€ππ‘obs, πβ€π
min + 1 β ππβ€π π‘obs, π>πmin .
ππβ€π β₯π‘obs, π>π
min β π‘obs
π‘obs, π>πmin β π‘obs, πβ€π
min.π‘obs, πβ€π
min is less than π‘obs, π>πmin
10
PR PBS
H/D
V/AMode H/D V/A
1 π1=1 π2=π
2 π2=π π1=1
Efficiency mismatch model considered
Random bit b
ππβ€π for active detection
The observable π can be the double-click operator π· or the effective-error operator.
πobs,π = Tr (ππ΄π΅π
π·)β₯ απ
21 β 22βπ , π is even;
π
21 β 21βπ , π is odd.
Photon number π
π=1, numerical
π=0.2, numerical
π=1, analytical
π=0.2, analytical
πo
bs,
πm
in
*The numerical results are obtained by solving SDPs [Y Z and N. LΓΌtkenhaus, PRA 95, 042319 (2017)].
*The analytical bounds are motivated and improvethe results in [Trushechkin, arXiv:2004.07809].
Due to the monotonic behavior of πobs, πmin ,
ππβ€π β₯πobs, π+1
min β πobs
πobs, π+1min
, βπ.
*Our method works for arbitrary, characterized efficiency mismatch.
11
50/50 BS
PBSH/V
PBSD/A
A
V
D
H Mode H V D A
1 π1=1 π2=π π2=π π2=π
2 π2=π π1=1 π2=π π2=π
3 π2=π π2=π π1=1 π2=π
4 π2=π π2=π π2=π π1=1
Efficiency mismatch model considered
ππβ€π for passive detection
The observable π can be the cross-click operator πΆ.
Photon number π
π ob
s,π
min
π=1
π=0.8
π=0.6
π=0.4
π=0.2
*The numerical results are obtained by solving SDPs [Y Z and N. LΓΌtkenhaus, PRA 95, 042319 (2017)].
*The numerical bounds coincide with the analytical ones.
Due to the monotonic behavior of πobs, πmin ,
ππβ€π β₯πobs, π+1
min β πobs
πobs, π+1min
, βπ.
πobs,π = Tr (ππ΄π΅π
πΆ)β₯ 1 + 1 β π π β 2 1 βπ
2
π.
*Our method works for arbitrary, characterized efficiency mismatch.
12
Data simulationWe simulate experimental observations ππ΄π΅ π₯, π¦ according to a toy model
β’ at each round Alice prepares a signal state (according to the protocol),
β’ the channel between Alice and Bob is specified by
π‘ --- the single-photon transmission probability,
Ο --- the depolarization noise,
π --- the multiphoton probability, i.e., the probability that a single photon randomly depolarized π photons (in our simulation π = 2),
β’ Bob performs a measurement (according to the protocol).
*If Bobβs detectors are coupled to several spatial-temporal modes, the optical signal is distributed uniformly at random over these modes.
Task: Lower-bound the key rate given ππ΄π΅ π₯, π¦ and characterized efficiency mismatch.
*For this particular case, ππ΄π΅ π₯, π¦ are determined by the channel parameters (π‘, Ο, π)as well as the detector model.
*Our security analysis doesnβt require characterizing the channel between Alice and Bob (i.e., Eveβs attack). Particularly, we donβt assume that the system received by Bob is finite-dimensional.
13
Key rates with trusted loss (in the absence of mismatch)
Active detection
Passive detection
Identical efficiency π of Bobβs detectors
Key
rat
e (b
its)
*For data simulation, π‘π = 0.1,Ο = 0.05, π = 0.05.
*ππ΄π΅ π₯, π¦ doesnβt change with π.
For these particular results, our security analysis
β’ assumes that at most two photons are received by Bob (and so a flag-state squasher is not used).
β’ when π = 1, returns the same key rates as using the usual squashing model [Beaudry, Moroder, LΓΌtkenhaus, Phys. Rev. Lett. 101, 093601 (2008); Tsurumaru and Tamaki, Phys. Rev. A 78, 032302 (2008)].
β’ suggests that more secret keys can be distilled when the trusted loss inside of Bobβs lab, (1 β π), increases and the untrusted loss over transmission, 1 β π‘ , decreases.
14
Key rates for active detection with efficiency mismatch
One mode, assuming β€ 2 photons
π2
Key
rat
e (b
its)
*For data simulation, π‘ = 0.5,Ο = 0.05, π = 0.05.
Mode H/D V/A
1 π1=0.2 π2
Efficiency mismatch studied
One mode, flag-state squahser
β’ When applying a flag-state squasher, we choose the photon-number cutoff π = 2.
β’ The larger the efficiency mismatch, the lower the key rate is.
β’ Making assumptions on Eveβs attack would overestimate the key rate.
15
Key rates for active detection with efficiency mismatch
One mode, assuming β€ 2 photons
π2
Key
rat
e (b
its)
*For data simulation, π‘ = 0.5,Ο = 0.05, π = 0.05.
Mode H/D V/A
1 π1=0.2 π2
2 π2 π1=0.2
Efficiency mismatch studied
One mode, flag-state squahser
Two modes, flag-state squasher
β’ When applying a flag-state squasher, we choose the photon-number cutoff π = 2.
β’ The larger the efficiency mismatch, the lower the key rate is.
β’ Making assumptions on Eveβs attack would overestimate the key rate.
β’ Mode-dependent mismatch helps Eve to attack the QKD system.
16
Key rates for passive detection with efficiency mismatch
One mode, assuming β€ 2 photons
π2
Key
rat
e (b
its)
*For data simulation, π‘ = 0.5,Ο = 0.05, π = 0.05.
Efficiency mismatch studied
One mode, no photon-# assumption
β’ When applying a flag-state squasher, we choose a photon-number cutoffπ = 2 (for one mode) or π = 1 (for four modes).
β’ The larger the efficiency mismatch, the lower the key rate is.
β’ Making assumptions on Eveβs attack would overestimate the key rate.
Mode H V D A
1 π1=0.2 π2=π π2=π π2=π
17
Key rates for passive detection with efficiency mismatch
One mode, assuming β€ 2 photons
π2
Key
rat
e (b
its)
*For data simulation, π‘ = 0.5,Ο = 0.05, π = 0.05.
Efficiency mismatch studied
One mode, no photon-# assumption
Four modes, no photon-# assumption
β’ When applying a flag-state squasher, we choose a photon-number cutoffπ = 2 (for one mode) or π = 1 (for four modes).
β’ The larger the efficiency mismatch, the lower the key rate is.
β’ Making assumptions on Eveβs attack would overestimate the key rate.
β’ Mode-dependent mismatch helps Eve to attack the QKD system.
Mode H V D A
1 π1=0.2 π2=π π2=π π2=π
2 π2=π π1=0.2 π2=π π2=π
3 π2=π π2=π π1=0.2 π2=π
4 π2=π π2=π π2=π π1=0.2
18
Summary
β’ Constructed a flag-state squasher to reduce the system dimension.*The flag-state squasher can be applied to other protocols, see Li and LΓΌtkenhaus, arXiv:2007.08662.
β’ Established bounds on photon-number distribution directly from experimental observations.
β’ Proved the security of a prepare & measure BB84 protocol in the presence of efficiency mismatch without a photon-number limit.
β’ Illustrated the individual effects of trusted loss and untrusted loss on the key rate.
Finite key analysis can also be handled by numerical approach (see the talk βNumerical Calculations of Finite Key Rate for General Quantum Key Distribution Protocolsβ by Ian George).
19
Summary
β’ Constructed a flag-state squasher to reduce the system dimension.*The flag-state squasher can be applied to other protocols, see Li and LΓΌtkenhaus, arXiv:2007.08662.
β’ Established bounds on photon-number distribution directly from experimental observations.
β’ Proved the security of a prepare & measure BB84 protocol in the presence of efficiency mismatch without a photon-number limit.
β’ Illustrated the individual effects of trusted loss and untrusted loss on the key rate.
Finite key analysis can also be handled by numerical approach (see the talk βNumerical Calculations of Finite Key Rate for General Quantum Key Distribution Protocolsβ by Ian George).
Thank you! [email protected]
Top Related