Measurement-Device-Independent Quantum Key Distribution Based on Decoherence-Free Subspaces with Logical Bell State Analyzer

Abstract

Measurement-device-independent quantum key distribution (MDI-QKD) enables two legitimate users to generate shared information-theoretic secure keys with immunity to all detector side attacks. However, the original proposal using polarization encoding is sensitive to polarization rotations stemming from birefringence in fibers or misalignment. To overcome this problem, here we propose a robust QKD protocol without detector vulnerabilities based on decoherence-free subspaces using polarization-entangled photon pairs. A logical Bell state analyzer is designed specifically for such encoding. The protocol exploits common parametric down-conversion sources, for which we develop a MDI-decoy-state method, and requires neither complex measurements nor a shared reference frame. We have analyzed the practical security in detail and presented a numerical simulation under various parameter regimes, showing the feasibility of the logical Bell state analyzer along with the potential that double communication distance can be achieved without a shared reference frame.

1. Introduction

Quantum key distribution (QKD) [1,2,3], as one of the most outstanding and mature applications of quantum information science, allows for the establishment of shared secure keys among two remote communication parties. Since the proposal of the first QKD protocol—BB84 protocol [4], enormous amount of endeavors have been dedicated to increase the performance of QKD. So far, the communication distance has reached 1000 km [5] and the bit rate has exceeded 110 Mb$·{\mathrm{s}}^{-1}$ [6].

Despite the unconditional security guaranteed by postulates of quantum mechanics in theory, the practical security of QKD can be compromised due to the deviations between real-life implementations and idealized models in security proofs. As photon detectors are usually complicated and cumbersome to calibrate, they are vulnerable to many kinds of sophisticated attacks [7,8,9]. Fortunately, measurement-device-independent QKD (MDI-QKD) protocol [10] closes all detector side channels and has attracted numerous studies in various scenarios due to its brevity. The original MDI-QKD protocol uses polarization encoding [11,12,13]; moreover, many other encoding forms have been well-studied both theoretically and experimentally [14,15,16,17,18].

In practice, one of the most significant problems that hinders the development of polarization-encoding QKD systems is polarization rotation stemming from birefringence effects in single mode fibers [19], as there exist external perturbations and small fluctuations in their material anisotropy [20]. The scheme proposed by Boileau et al. [21], which is a variant of BB84 protocol, aimed to overcome this problem by encoding two timely separated photons into the so-called decoherence-free subspace (DFS), span$\left\{\right|0_L\rangle =|HV\rangle ,|1_L\rangle =|VH\rangle \}$, where the subindex L stands for logical, and H and V denote horizontal and vertical polarized photons, respectively. For the scheme to work, the delay caused by polarization mode dispersion is supposed to be smaller than the coherence time of the photon, which holds in most practical circumstances currently, so the birefringence acts just as a rotation $U\left(t\right)$ on the polarization modes. Another constraint is that the photon pair experiences collective rotation $U{\left(t\right)}^{\otimes 2}$, thus the orthogonality between horizontal and vertical polarization mode is conserved. We remark that this constraint is significantly weaker than that of reference-frame-independent QKD (RFI-QKD) protocol [22], which is only insensitive to rather slow variance of the reference frame during the whole communication process. In a recent work by Tang et al. [23], the divide-and-conquer strategy is applied to develop the free-running RFI-QKD scheme, which weakens the aforementioned constraint on drifting speed to some extent, but its tolerance of reference frame drifting is still not as strong as Boileau et al.’s scheme.

In this work, we generalize the scheme of Boileau et al. to an MDI version by solving two main obstacles: lack of logical Bell state measurement and decoy-state analysis for polarization-entangled photon pairs. We develop a logical Bell state analyzer and MDI-decoy-state method [19,24,25] specifically for practical parametric down-conversion (PDC) sources. Our logical Bell state analyzer is easy to implement with current technology and exploits cross-Kerr nonlinearities, which have found wide applications in quantum information processing tasks [26,27,28,29]. In addition, the MDI-decoy-state method enables us to estimate the contribution from single-photon-pair states more accurately [30,31,32], greatly extending the communication distance. Our protocol enjoys MDI characteristics and RFI features simultaneously, with built-in robustness against collective polarization rotation noise. The scheme does not require complex entanglement measurements and is stable even in presence of some imperfections of the logical Bell state analyzer.

The rest of this paper is organized as follows. We introduce the MDI-QKD protocol based on DFS and investigate its robustness in Section 2. In Section 3, we present the setup of the logical Bell state analyzer. In Section 4, we perform a security analysis on the MDI-QKD system, followed by simulation results of the key rate in Section 5. In Section 6, we discuss several experimentally relevant problems and potential improvements of the protocol. Finally, we conclude the paper in Section 7.

2. Protocol

In the scheme of MDI-QKD protocol based on DFS, two communication parties named Alice and Bob generate polarization-entangled photon pairs independently. The key information is encoded into the relative phase between $|0_L\rangle$ and $|1_L\rangle$. After some pre-processing operations, they send the states to an untrusted relay Charlie that is located in the middle. Several post-processing operations followed by logical Bell state measurement (BSM) are expected to be performed by the measurement site, as illustrated in Figure 1. Even in presence of collective rotation induced by birefringence or misaligned reference frame, Alice and Bob’s key information can be correctly correlated conditioned on the measurement results announced by the relay. Detailed steps of our protocol with decoy-state method are presented below.

• State preparation: In each round, Alice pumps her phase randomized type-II PDC source using appropriate intensities to generate polarization-entangled states with half of the expected photon pair number generated by one pulse, ${\lambda }_a$, randomly selected from $\{\mu ,\nu ,0\}$ according to probability distribution $\left\{p_{\mu },p_{\nu },p_0\right\}$. The single-photon-pair state prepared by Alice is $\frac{1}{\sqrt{2}}\left({|HV\rangle }_{12}+\exp \left[i(\pi K_a+\frac{\pi }{2}{B}_a)\right]{|VH\rangle }_{12}\right)$, where $K_a\in \{0,1\}$ is the encoded bit, $B_a\in \{0,1\}$ corresponds to bases $\{Z,X\}$, 1 and 2 label the two optical modes of the PDC source, and mode 2 is delayed by $\Delta t$ with respect to mode 1. Then, she delays her vertical polarization mode by $\Delta t^{\prime }$, where $\Delta t^{\prime }<\Delta t$. Similarly, the single-photon-pair state prepared by Bob is $\frac{1}{\sqrt{2}}\left({|HV\rangle }_{34}+\exp \left[i(\pi K_b+\frac{\pi }{2}{B}_b)\right]{|VH\rangle }_{34}\right)$ where mode 4 is also delayed by $\Delta t$ with respect to mode 3, and ${\lambda }_b$ is randomly chosen from $\{\mu ,\nu ,0\}$ with the same probability distribution. Then, he delays his vertical polarization mode by $\Delta t^{\prime }$ as well.
• Measurement: Alice and Bob send the signals to Charlie, who is supposed to perform

  (1)

  Polarization randomization using a set of wave plates to make the protocol independent of specific environment and reference frame,

  (2)

  Delay for the horizontal polarization mode of both incoming signals by $\Delta t^{\prime }$, such that both photons of the states in DFS are delayed once,

  (3)

  Phase scrambling to project the single-photon-pair states into the DFS, which can be done by exploiting Pockel cells driven by quantum random number generators (QRNG),

  (4)

  Logical BSM using the logical Bell state analyzer.

  Additionally, Charlie needs to set the polarization controllers in the logical BSM apparatus to act as nothing in some randomly selected rounds retained for parameter estimation, which we call sampling rounds. The other rounds where both polarization controllers act as half-wave plates are named BSM rounds. Charlie publicly announces the results of parity check measurements and click patterns of the four single-photon-detectors in all rounds, together with the time-bins in which the detectors click and the location of sampling rounds.
• Postselection: Alice and Bob postselect the BSM rounds where one two-fold coincidence detection is followed by another two-fold coincidence detection after $\Delta t$. They determine which logical Bell states are the input states successfully projected onto according to Charlie’s announcement (see Section 3). Events with unsuccessful logical BSM are discarded.
• Sifting: The parties announce ${\lambda }_{a,b}$ and $B_{a,b}$ in the remaining rounds via an authenticated public channel. After discarding the rounds where their bases are unmatched, one communication party, say, Bob, should flip part of his bits to make his bit strings correctly correlated with Alice’s, depending on the logical Bell states identified (see

  Table 1. Either Alice or Bob needs to flip her or his bits based on the successful logical BSM results.

  Alice and Bob’s Basis	Logical Bell State
  	${\mathbf{\Phi }}_{\mathit{L}}^{+}$	${\mathbf{\Phi }}_{\mathit{L}}^{-}$	${\mathbf{\Psi }}_{\mathit{L}}^{+}$	${\mathbf{\Psi }}_{\mathit{L}}^{-}$
  Z basis	No flip	flip	No flip	flip
  X basis	flip	No flip	No flip	flip

  ).
• Parameter estimation: For BSM rounds, Alice and Bob estimate the quantum bit error rate $E_{\mu \mu }^Z$ in Z basis with intensity setting $\left({\lambda }_a,{\lambda }_b\right)=\left(\mu ,\mu \right)$. Raw data in Z and X basis are used to estimate the single-photon-pair yield $Y_{11}^Z$ and single-photon-pair QBER $e_{11}^X$, respectively, via decoy-state method introduced in Section 4. For sampling rounds, they use data with intensity setting $\left(\mu ,0\right)$ and $\left(0,\mu \right)$ to estimate the probability that their single-photon-pair states are projected into the DFS, denoted as $p_a$ and $p_b$, respectively.
• Key distillation: The parties use data of BSM rounds in Z basis with intensity setting $\left(\mu ,\mu \right)$ to generate a key. They run error correction and privacy amplification based on $p_a,p_b,E_{\mu \mu }^Z,Y_{11}^Z$ and $e_{11}^X$ to distill the final secure key.

We now show the correctness and robustness against collective polarization rotations of our protocol. Since the birefringence effect experienced by Alice and Bob’s states are independent, here we focus on the evolution of Alice’s states in the DFS, which we write as $\alpha |H{V}_T\rangle +\beta |V_{T}H\rangle$ without loss of generality, where ${\left|\alpha \right|}^2+{\left|\beta \right|}^2=1$. The subscript T indicates the delay by $\Delta t^{\prime }$. As the above state transmitting through fibers, the polarization modes experience a rotation represented by an element in the group $U\left(2\right)$. The resulting polarizations can be expanded in Charlie’s own basis $\left\{|H^{\prime }\rangle ,|V^{\prime }\rangle \right\}$ as following up to a global phase,

$$\begin{array}{cc}\hfill & U\left|H\right.〉=e^{-i\left(\varphi +\omega \right)/2}cos\frac{\theta }{2}\left|H^{\prime }\right.〉+e^{i\left(\varphi -\omega \right)/2}sin\frac{\theta }{2}\left|V^{\prime }\right.〉,\hfill \\ \hfill & U\left|V\right.〉=-e^{-i\left(\varphi -\omega \right)/2}sin\frac{\theta }{2}\left|H^{\prime }\right.〉+e^{i\left(\varphi +\omega \right)/2}cos\frac{\theta }{2}\left|V^{\prime }\right.〉,\hfill \end{array}$$

(1)

where $\theta \in \left[0,\pi \right],\varphi \in \left[0,2\pi \right),\omega \in \left[0,4\pi \right)$. Then, Charlie’s delay operation for his horizontal polarization mode $H^{\prime }$ would lead the states to evolve as

$$\begin{array}{cc}\hfill & U^{\otimes 2}\left(\alpha \left|H{V}_T\right.〉+\beta \left|V_{T}H\right.〉\right)\stackrel{\mathrm{Delay}{H}^{\prime }}{⟶}\hfill \\ \hfill & \alpha \left({cos}^2\frac{\theta }{2}\left|H_T^{\prime }{V}_T^{\prime }\right.〉+sin\frac{\theta }{2}cos\frac{\theta }{2}{e}^{i\varphi }\left|V^{\prime }{V}_T^{\prime }\right.〉-sin\frac{\theta }{2}cos\frac{\theta }{2}{e}^{-i\varphi }\left|H_T^{\prime }{H}_{TT}^{\prime }\right.〉-{sin}^2\frac{\theta }{2}\left|V^{\prime }{H}_{TT}^{\prime }\right.〉\right)\hfill \\ \hfill +& \beta \left({cos}^2\frac{\theta }{2}\left|V_T^{\prime }{H}_T^{\prime }\right.〉+sin\frac{\theta }{2}cos\frac{\theta }{2}{e}^{i\varphi }\left|V_T^{\prime }{V}^{\prime }\right.〉-sin\frac{\theta }{2}cos\frac{\theta }{2}{e}^{-i\varphi }\left|H_{TT}^{\prime }{H}_T^{\prime }\right.〉-{sin}^2\frac{\theta }{2}\left|H_{TT}^{\prime }{V}^{\prime }\right.〉\right)\hfill \\ \hfill \equiv & \left[\left({\delta }_1+1\right)/2\right]\left(\alpha \left|H_T^{\prime }{V}_T^{\prime }\right.〉\right.\left.+\beta \left|V_T^{\prime }{H}_T^{\prime }\right.〉\right)+\left[\left({\delta }_1-1\right)/2\right]\left(\alpha \left|V^{\prime }{H}_{TT}^{\prime }\right.〉+\beta \left|H_{TT}^{\prime }{V}^{\prime }\right.〉\right)\hfill \\ \hfill +& \left[\left({\delta }_2+{\delta }_3\right)/2\right]\left(\alpha \left|H_T^{\prime }{H}_{TT}^{\prime }\right.〉+\beta \left|H_{TT}^{\prime }{H}_T^{\prime }\right.〉\right)+\left[\left({\delta }_2-{\delta }_3\right)/2\right]\left(\alpha \left|V^{\prime }{V}_T^{\prime }\right.〉+\beta \left|V_T^{\prime }{V}^{\prime }\right.〉\right)\hfill \end{array}$$

(2)

where ${\delta }_1=cos\theta$, ${\delta }_2=isin\theta sin\varphi$, and ${\delta }_3=-sin\theta cos\varphi$ [21]. The parameters satisfy ${\left|{\delta }_1\right|}^2+{\left|{\delta }_2\right|}^2+{\left|{\delta }_3\right|}^2=1$ and are completely dependent on the explicit form of U. From Equation (2), we can see that Charlie can recover the encoded key information with certainty by postselecting the states where both photons are delayed once, i.e., they are separated by $\Delta t$. In addition, in order to guarantee successful postselection, Charlie needs to perform polarization randomization to both photons before his delay operations, otherwise $\left({\delta }_1+1\right)/2$ may vanish in all rounds in some extreme circumstances. As the rotation is equivalent to be uniformly distributed over $U\left(2\right)$ after polarization randomization, we can calculate the probability of postselection by means of the Harr measure,

$$\begin{array}{c}\hfill \frac{1}{16{\pi }^2}{\int }_0^{2\pi }\mathrm{d}\varphi {\int }_0^{4\pi }\mathrm{d}\omega {\int }_0^{\pi }{\left({cos}^2\frac{\theta }{2}\right)}^{2}sin\theta \mathrm{d}\theta =\frac{1}{3}.\end{array}$$

(3)

Likewise, Charlie has the probability of 1/3 to postselect Bob’s encoded states. Therefore, the joint probability of successful postselection of both parties’ states is 1/9.

The RFI characteristic of our protocol is embodied in the fact that Alice, Bob, and Charlie’s operations are all performed in their local reference frame. Combined with the logical Bell state measurement apparatus introduced in the next section, our protocol is thus similar to the original MDI-QKD protocol and can overcome the problem of polarization rotations induced by birefringence effects or reference frame misalignment.

3. Logical Bell State Measurement

The crucial component of MDI-QKD protocol is the projection of Alice and Bob’s input signals onto maximally entangled states. Thus, in the protocol based on 2-dimensional DFS spanned by $\left\{\right|0_L\rangle =|HV\rangle ,|1_L\rangle =|VH\rangle \}$, one has to perform logical BSM. We have designed a logical Bell state analyzer, which is shown in Figure 2. The apparatus is able to completely discriminate four logical Bell states

$$\begin{array}{c}\hfill |{\Phi }_L^{\pm }\rangle =\frac{1}{\sqrt{2}}\left(|HVHV\rangle \pm |VHVH\rangle \right),\end{array}$$

(4)

$$\begin{array}{c}\hfill |{\Psi }_L^{\pm }\rangle =\frac{1}{\sqrt{2}}\left(|HVVH\rangle \pm |VHHV\rangle \right),\end{array}$$

(5)

each of which contains two logical qubits encoded by two orthogonally polarized photons.

In Figure 2, we represent the optical modes by orange wave packets, and the two probe coherent pulses should overlap with the time-bins, respectively. The vertical lines together with circles denote cross-phase modulation via Kerr effect. The $D_{1H},D_{1V},D_{2H},and D_{2V}$ denote four single-photon detectors. We restrict our discussion to single-photon-pair states in this section. Due to postselection, one only needs to consider the incoming states from either party of the form $\frac{1}{\sqrt{2}}\left(|HV\rangle +e^{i\varphi }|VH\rangle \right),\varphi \in \{0,\pi /2,\pi ,3\pi /2\}$. Remember that photons 1 and 3 are in the same time-bin; photons 2 and 4 are in another time-bin delayed by $\Delta t$. The key observation is that photons 1 and 3 have identical polarization, i.e., even parity, in $|{\Phi }_L^{\pm }\rangle$, whereas they have orthogonal polarization, i.e., odd parity, in $|{\Psi }_L^{\pm }\rangle$; the same is true for photons 2 and 4. Therefore, one can divide the four logical Bell states into two groups with a parity check measurement (PCM).

The PCM exploits two probe coherent states, each of which is aligned with one time-bin, along with cross-Kerr nonlinearities. As shown in Figure 2, the phase of the probe states are modulated by the photon numbers in the corresponding paths via Kerr effect. Without loss of generality, we suppose the polarization state of photons 1 and 3 are ${a|H\rangle }_1{|H\rangle }_3+{b|H\rangle }_1{|V\rangle }_3+{c|V\rangle }_1{|H\rangle }_3+{d|V\rangle }_1{|V\rangle }_3$, where ${\left|a\right|}^2+{\left|b\right|}^2+{\left|c\right|}^2+{\left|d\right|}^2=1$. Then the evolution of it together with the upper coherent state in Figure 2 is as follows [33]:

$$\begin{array}{cc}\hfill & \left({a|H\rangle }_1{|H\rangle }_3+{b|H\rangle }_1{|V\rangle }_3+{c|V\rangle }_1{|H\rangle }_3+{d|V\rangle }_1{|V\rangle }_3\right)|\alpha \rangle \hfill \\ \hfill ⟶& \left({a|H\rangle }_1{|H\rangle }_3+{d|V\rangle }_1{|V\rangle }_3\right)|\alpha \rangle +{b|H\rangle }_1{|V\rangle }_3|\alpha e^{-2i\theta }{\rangle +c|V\rangle }_1{|H\rangle }_3|\alpha e^{+2i\theta }\rangle .\hfill \end{array}$$

(6)

For homodyne measurement of the X quadrature, the phase shift $+2\theta$ and $-2\theta$ will produce identical probability distribution of the outcome, so they are indistinguishable. Therefore, if the upper probe state picks up zero phase shift in the measurement, then the output state of photons 1 and 3 will be ${a|H\rangle }_1{|H\rangle }_3+{d|V\rangle }_1{|V\rangle }_3$; if the probe state picks up $2\theta$ phase shift, then the output state of photon 1 and 3 will be ${b|H\rangle }_1{|V\rangle }_3+{c|V\rangle }_1{|H\rangle }_3$, up to a normalization factor. The same conclusions can be drawn for the lower probe coherent state.

Thus, when the outcomes of two X-quadrature measurements are both 0, we denote this result of PCM as “even”, and the corresponding logical Bell states should be $|{\Phi }_L^{\pm }\rangle$; when the outcomes of two X-quadrature measurement are both $2\theta$, we denote this result of PCM as “odd”, and the corresponding logical Bell states should be $|{\Psi }_L^{\pm }\rangle$. All other cases are considered as failure and discarded.

Further, to discriminate $|{\Phi }_L^{+}\rangle$ with $|{\Phi }_L^{-}\rangle$ and $|{\Psi }_L^{+}\rangle$ with $|{\Psi }_L^{-}\rangle$, we perform Hadamard transformations on the photons, rotating the polarization of each photon by 45 degrees counterclockwise. Then, the four logical Bell states evolve as

$$\begin{array}{cc}\hfill |{\Phi }_L^{+}\rangle ⟶\frac{1}{2\sqrt{2}}& (|HHHH\rangle -|HHVV\rangle +|HVHV\rangle -|HVVH\rangle \hfill \\ \hfill & -|VHHV\rangle +|VHVH\rangle -|VVHH\rangle +|VVVV\rangle ),\hfill \end{array}$$

(7)

$$\begin{array}{cc}\hfill |{\Phi }_L^{-}\rangle ⟶\frac{1}{2\sqrt{2}}& (|HVVV\rangle -|VHVV\rangle +|VVHV\rangle -|VVVH\rangle \hfill \\ \hfill & -|HHHV\rangle +|HHVH\rangle -|HVHH\rangle +|VHHH\rangle ),\hfill \end{array}$$

(8)

$$\begin{array}{cc}\hfill |{\Psi }_L^{+}\rangle ⟶\frac{1}{2\sqrt{2}}& (|HHHH\rangle -|HHVV\rangle -|HVHV\rangle +|HVVH\rangle \hfill \\ \hfill & +|VHHV\rangle -|VHVH\rangle -|VVHH\rangle +|VVVV\rangle ),\hfill \end{array}$$

(9)

$$\begin{array}{cc}\hfill |{\Psi }_L^{-}\rangle ⟶\frac{1}{2\sqrt{2}}& (|HVVV\rangle -|VHVV\rangle -|VVHV\rangle +|VVVH\rangle \hfill \\ \hfill & +|HHHV\rangle -|HHVH\rangle -|HVHH\rangle +|VHHH\rangle ).\hfill \end{array}$$

(10)

We can see that all components of $|{\Phi }_L^{+}\rangle$ and $|{\Phi }_L^{-}\rangle$ are orthogonal to one another. Therefore, after analyzing the polarizations by means of PBSs, $|{\Phi }_L^{+}\rangle$ and $|{\Phi }_L^{-}\rangle$ will result in completely different click events of $D_{1H},D_{1V},D_{2H}$, and $D_{2V}$. The $|{\Psi }_L^{+}\rangle$ and $|{\Psi }_L^{-}\rangle$ can be discriminated in the same manner. Take the first term of Equation (7) as an example: if Charlie observes “odd” of the PCM result together with two successive coincidence detections of $D_{1H}$ and $D_{2H}$ separated by $\Delta t$, then ${\Psi }_L^{+}$ is identified. We summarize the PCM results and click patterns in

Table 2. The PCM result and click patterns of all four logical Bell states, each of which can result in eight corresponding detection events. The logical Bell states are successfully identified only when a two-fold coincidence detection happens at some time, say $t_0$, and another two-fold coincidence happens at time $t_0+\Delta t$ subsequently.

PCM Result	${\mathit{t}}_0$	${\mathit{t}}_0+\mathbf{\Delta }\mathit{t}$	Bell State	PCM Result	${\mathit{t}}_0$	${\mathit{t}}_0+\mathbf{\Delta }\mathit{t}$	Bell State
even/odd	$D_{1H}{D}_{2H}$	$D_{1H}{D}_{2H}$	${\Phi }_L^{+}$/${\Psi }_L^{+}$	even/odd	$D_{1H}{D}_{2H}$	$D_{1H}{D}_{2V}$	${\Phi }_L^{-}$/${\Psi }_L^{-}$
	$D_{1H}{D}_{2V}$	$D_{1H}{D}_{2V}$			$D_{1H}{D}_{2V}$	$D_{1H}{D}_{2H}$
	$D_{1H}{D}_{2H}$	$D_{1V}{D}_{2V}$			$D_{1H}{D}_{2H}$	$D_{1V}{D}_{2H}$
	$D_{1H}{D}_{2V}$	$D_{1V}{D}_{2H}$			$D_{1H}{D}_{2V}$	$D_{1V}{D}_{2V}$
	$D_{1V}{D}_{2H}$	$D_{1H}{D}_{2V}$			$D_{1V}{D}_{2H}$	$D_{1H}{D}_{2H}$
	$D_{1V}{D}_{2V}$	$D_{1H}{D}_{2H}$			$D_{1V}{D}_{2V}$	$D_{1H}{D}_{2V}$
	$D_{1V}{D}_{2H}$	$D_{1V}{D}_{2H}$			$D_{1V}{D}_{2H}$	$D_{1V}{D}_{2V}$
	$D_{1V}{D}_{2V}$	$D_{1V}{D}_{2V}$			$D_{1V}{D}_{2V}$	$D_{1V}{D}_{2H}$

.

However, as discussed in Refs. [27,28,29], the X-quadrature measurement in the PCM has an intrinsic probability to misidentify the phase shift of the probe state, resulting in erroneous identification of the parity of input states. We denote this error probability as $P_e$, and its analytical expression is $P_e=\mathrm{erfc}\left(\sqrt{2}\alpha {\theta }^2\right)/2$ according to Refs. [29,33]. For instance, suppose the parity of photons 1 and 3 is even, then the upper X-quadrature measurement will give the intended outcome 0 with probability $1-P_e$ while giving the wrong outcome 2$\theta$ with probability $P_e$. The existence of this error probability indicates unavoidable imperfection of our logical Bell state analyzer and may compromise the secure key rate of our protocol. Nevertheless, $P_e$ can be effectively suppressed to the order of ${10}^{-2}$ by applying small cross-Kerr nonlinearities and high probe intensity, as pointed out in Refs. [28,29]. In Section 5, we study the impact of various $P_e$ on the secure key rate where we assume the two X-quadrature measurements have identical and independent error probability.

4. Security Analysis

The logical BSM apparatus introduced in the above section makes our protocol naturally immune to all detector side attacks as the apparatus is located in the third party. Practically, our protocol still faces two tough security problems in real implementations.

One problem is the potential attack utilizing the 2-dimensional complementary space, span$\left\{\right|HH\rangle ,|VV\rangle \}$, in the global 4-dimensional space, which we call complementary space attack. We restrict our discussion in the context of collective attacks [2], i.e, in each round the system is attacked identically and independently of the preceding, and we do not consider the coherent attacks that utilize the complementary space. A malicious eavesdropper Eve who applies the complementary space attack can coherently alter the single-photon-pair state from either party that reaches Charlie to the form of $c_1|H^{\prime }{V}_T^{\prime }\rangle +c_2|V_T^{\prime }{H}^{\prime }\rangle +c_3|H^{\prime }{H}^{\prime }\rangle +c_4|V_T^{\prime }{V}_T^{\prime }\rangle$, where the complex coefficients $c_i$ are controlled by Eve. Such states can survive the postselection perfectly after Charlie’s delay operation for his $H^{\prime }$ mode and may potentially provide Eve some advantages. As countermeasures, the phase scrambling and sampling procedure, first introduced in Ref. [34], are employed in our protocol.

The phase scrambling procedure is designed to perform projections into the DFS. It applies a Pockel cell driven by quantum random number generators [35,36] to add a phase shift uniformly chosen from $\left\{0,\frac{\pi }{2},\pi ,\frac{3\pi }{2}\right\}$ to Charlie’s $V^{\prime }$ mode. This step can be done with Charlie’s delay operations simultaneously, as illustrated in Figure 1b. If we denote the density operator of the above state $c_1|H^{\prime }{V}_T^{\prime }\rangle +c_2|V_T^{\prime }{H}^{\prime }\rangle +c_3|H^{\prime }{H}^{\prime }\rangle +c_4|V_T^{\prime }{V}_T^{\prime }\rangle$ as $\rho$, then after phase scrambling it becomes

$$\begin{array}{cc}\hfill {\rho }^{\prime }& =\frac{1}{4}\left(U_0\rho U_0^{†}+U_{\frac{\pi }{2}}\rho U_{\frac{\pi }{2}}^{†}+U_{\pi }\rho U_{\pi }^{†}+U_{\frac{3\pi }{2}}\rho U_{\frac{3\pi }{2}}^{†}\right)\hfill \\ \hfill & =\left(\begin{array}{cccc}{\left|c_3\right|}^2& 0& 0& 0\\ 0& {\left|c_1\right|}^2& c_1{c}_2^{*}& 0\\ 0& c_1^{*}{c}_2& {\left|c_2\right|}^2& 0\\ 0& 0& 0& {\left|c_4\right|}^2\end{array}\right),\hfill \end{array}$$

(11)

where $U_{\varphi }={\left(\begin{array}{cc}1& 0\\ 0& e^{i\varphi }\end{array}\right)}^{\otimes 2},\varphi \in \left\{0,\frac{\pi }{2},\pi ,\frac{3\pi }{2}\right\}$ denotes the phase shift operation. As one can see, the phase scrambling maintains the state’s quantum information in the DFS while the coherence with the complementary space is destroyed; the interplay between the two subspaces are thus broken. In other words, the state is projected inside the DFS with some probability. Denote this projection probability for Alice and Bob as $p_a$ and $p_b$, respectively. As for the events where the states of either party are projected outside the subspace, Alice and Bob assume that Eve has complete knowledge about the key information of these events [34]. Therefore, only events for which both parties’ states remain in the DFS are considered in the key rate formula (see Equation (16)). Note that the projection results are unknowable in principle using the phase scrambling method. Notwithstanding, as privacy amplification is applied to all effective events where logical Bell states are successfully identified, Alice and Bob do not need to exactly know the projection results.

For the sampling procedure aiming to estimate $p_a$ and $p_b$, because the polarization controllers act as nothing, Charlie’s measurement is just projections in $\left\{|H^{\prime }\rangle ,|V^{\prime }\rangle \right\}$ basis for each photon. Therefore, employing the intensity setting $\left({\lambda }_a,{\lambda }_b\right)=\left(\mu ,0\right)$ and $\left(0,\mu \right)$, i.e., either party sends vacuum, enables Alice and Bob to effectively measure $p_a$ and $p_b$ through observing the detectors’ responses in the sampling rounds, respectively. If Eve indeed performs the complementary space attack, Alice (Bob) would find unexpectedly high detection rates for specific click patterns such as $D_{1H\left(2H\right)}$ or $D_{1V\left(2V\right)}$ clicks twice with time interval $\Delta t$ in the sampling rounds. We remark that the proportion of the sampling rounds among all rounds can be rather small in the asymptotic scenario. In Appendix C, we present a simple method to calculate $p_a$ and $p_b$ in a certain scenario. In a realistic experiment, imperfections of optical systems can also give rise to the estimated probabilities $p_a,p_b$ being less than 1 and their dependence on the communication distance [34].

The other problem stems from the probabilistic nature of PDC sources. Recall that the output state of Alice’s type-II PDC source can be written as [37,38]

$$\begin{array}{cc}\hfill |{\Psi }_a\rangle & =\frac{1}{{cosh}^2{\chi }_a}\sum _{n_a=0}^{\infty }{e}^{i{n}_a\theta }\sqrt{n_a+1}{tanh}^{n_a}{\chi }_a|{\Phi }_{n_a}\rangle ,\hfill \\ \hfill |{\Phi }_{n_a}\rangle & =\frac{1}{n_a!\sqrt{n_a+1}}{\left(H_1^{†}{V}_2^{†}+e^{i(\pi K_a+\frac{\pi }{2}{B}_a)}{V}_1^{†}{H}_2^{†}\right)}^{n_a}|\mathrm{vacuum}\rangle \hfill \\ \hfill & =\frac{1}{\sqrt{n_a+1}}\sum _{m_a=0}^{n_a}\exp \left[i{m}_a(\pi K_a+\frac{\pi }{2}{B}_a)\right]\hfill \\ \hfill & ·{|H\rangle }_1^{\otimes n_a-m_a}{|V\rangle }_1^{\otimes m_a}{|H\rangle }_2^{\otimes m_a}{|V\rangle }_2^{\otimes n_a-m_a},\hfill \end{array}$$

(12)

where ${\chi }_a$ is a real number corresponding to Alice’s pumping intensity, $H_1^{†}$ denotes the creation operator of the horizontal polarized photon in mode 1, and similar notation for the others. One can calculate that ${\lambda }_a={sinh}^2{\chi }_a$ is half of the expected photon pair number of $|{\Psi }_a\rangle$. The single-photon-pair state is of the form $\frac{1}{\sqrt{2}}\left({|HV\rangle }_{12}+\exp \left[i(\pi K_a+\frac{\pi }{2}{B}_a)\right]{|VH\rangle }_{12}\right)$ and is maximally entangled. However, the multiple-photon-pair states, $|{\Phi }_{n_a}\rangle$ for $n_a\ge 2$, open a window for Eve to perform a photon number splitting attack [39,40,41,42], granting her full knowledge about the parties’ key information. Fortunately, this security loophole can be fixed up by decoy-state methods [30,31,32]. Yin et al. proposed a decoy-state method for the original scheme of Boileau et al. and improved the key rate scaling from $O\left({\eta }^4\right)$ to $O\left({\eta }^2\right)$ [42]. Yet in the MDI scenario, widely-used MDI-decoy-state methods are specifically designed for coherent light sources [19,24,25]; similar analysis for PDC sources is still missing. In this work, we present a three-intensity MDI-decoy-state method with PDC sources to counter the photon number splitting attack.

Here we assume Alice and Bob’s quantum channels are symmetric, i.e., have identical transmittance; the analysis for asymmetric situations can be done with the methods in Refs. [19,43]. As described in Section 2, Alice (Bob) randomly selects ${\lambda }_{a\left(b\right)}$ from $\{\mu ,\nu ,0\}$, where $\mu$ corresponds to signal state and the others correspond to decoy states. After randomizing the phase $\theta$, the output density operator of Alice’s PDC source is

$${\rho }_{{\lambda }_a}=\frac{1}{2\pi }{\int }_0^{2\pi }|{\Psi }_a\rangle \langle {\Psi }_a|\mathrm{d}\theta =P_{n_a}\left({\lambda }_a\right)|{\Phi }_{n_a}\rangle \langle {\Phi }_{n_a}|,$$

(13)

where $P_{n_a}\left({\lambda }_a\right)=\frac{(n_a+1){\lambda }_a^{n_a}}{{(1+{\lambda }_a)}^{n_a+2}}$ is the probability to get $n_a$-photon pair. That is, the phase randomized PDC source emits nothing but a classical mixture of $n_a$-photon-pair states $|{\Phi }_{n_a}\rangle$, analogous to the fact that a phase randomized coherent state is equivalent to a mixture of Fock states. Therefore, by similar arguments in Refs. [30,31,32], Eve cannot differentiate the original intensity of any signal but only has access to the photon pair number $n_a$ and $n_b$. Define yield $Y_{n_a{n}_b}^{Z\left(X\right)}$ to be the conditional probability of an effective event in $Z\left(X\right)$ basis given that Alice’s PDC source emits an $n_a$-photon-pair state and Bob’s emits an $n_b$-photon-pair state, and $e_{n_a{n}_b}^{Z\left(X\right)}$ to be the corresponding quantum bit error rate (QBER) of such signals. Then, these quantities must have no dependence on the intensity setting $\left({\lambda }_a,{\lambda }_b\right)$, enabling us to write down the following sets of equations:

$$\begin{array}{cc}\hfill Q_{{\lambda }_a{\lambda }_b}^{Z\left(X\right)}& =\sum _{n_a,n_b=0}^{\infty }{P}_{n_a}\left({\lambda }_a\right)P_{n_b}\left({\lambda }_b\right)Y_{n_a{n}_b}^{Z\left(X\right)},\hfill \end{array}$$

(14)

$$\begin{array}{cc}\hfill E_{{\lambda }_a{\lambda }_b}^{Z\left(X\right)}{Q}_{{\lambda }_a{\lambda }_b}^{Z\left(X\right)}& =\sum _{n_a,n_b=0}^{\infty }{P}_{n_a}\left({\lambda }_a\right)P_{n_b}\left({\lambda }_b\right)e_{n_a{n}_b}^{Z\left(X\right)}{Y}_{n_a{n}_b}^{Z\left(X\right)},\hfill \end{array}$$

(15)

where $Q_{{\lambda }_a{\lambda }_b}^{Z\left(X\right)}$ and $E_{{\lambda }_a{\lambda }_b}^{Z\left(X\right)}{Q}_{{\lambda }_a{\lambda }_b}^{Z\left(X\right)}$ are overall gain and overall QBER in $Z\left(X\right)$ basis given intensity setting $\left({\lambda }_a,{\lambda }_b\right)$, respectively. These quantities are directly accessible in experiments after the sifting step. With the above equations, we obtain the following bounds for the Z-basis single-photon-pair yield $Y_{11}^Z$ and X-basis single-photon-pair QBER $e_{11}^X$ following the Gaussian eliminations in Refs. [19,24,25]:

$$\begin{array}{cc}\hfill {\underset{\overline{}}{Y}}_{11}^Z=& \left\{{\left(\frac{\mu }{1+\mu }\right)}^3\left[{\left(1+\nu \right)}^4{Q}_{\nu \nu }^Z+Q_{00}^Z-{\left(1+\nu \right)}^2\left(Q_{\nu 0}^Z+Q_{0\nu }^Z\right)\right]\right.\hfill \\ \hfill & \left.-{\left(\frac{\nu }{1+\nu }\right)}^3\left[{\left(1+\mu \right)}^4{Q}_{\mu \mu }^Z+Q_{00}^Z-{\left(1+\mu \right)}^2\left(Q_{\mu 0}^Z+Q_{0\mu }^Z\right)\right]\right\}/4{\left(\frac{\mu }{1+\mu }\right)}^2{\left(\frac{\nu }{1+\nu }\right)}^2\left(\frac{\mu }{1+\mu }-\frac{\nu }{1+\nu }\right),\hfill \\ \hfill {\overline{e}}_{11}^X=& \left[{\left(1+\nu \right)}^4{E}_{\nu \nu }^X{Q}_{\nu \nu }^X+E_{00}^X{Q}_{00}^X-{\left(1+\nu \right)}^2\left(E_{\nu 0}^X{Q}_{\nu 0}^X+E_{0\nu }^X{Q}_{0\nu }^X\right)\right]{\left(\frac{\mu }{1+\mu }\right)}^2\left(\frac{\mu }{1+\mu }-\frac{\nu }{1+\nu }\right)\hfill \\ \hfill & /\left\{{\left(\frac{\mu }{1+\mu }\right)}^3\left[{\left(1+\nu \right)}^4{Q}_{\nu \nu }^X+Q_{00}^X-{\left(1+\nu \right)}^2\left(Q_{\nu 0}^X+Q_{0\nu }^X\right)\right]\right.\left.-{\left(\frac{\nu }{1+\nu }\right)}^3\left[{\left(1+\mu \right)}^4{Q}_{\mu \mu }^X+Q_{00}^X-{\left(1+\mu \right)}^2\left(Q_{\mu 0}^X+Q_{0\mu }^X\right)\right]\right\}.\hfill \end{array}$$

The detailed derivation of the above equations are given in Appendix A. Note that the complementary space attack we considered before clearly does not compromise the fact that $Y_{n_a{n}_b}^{Z\left(X\right)}$ and $e_{n_a{n}_b}^{Z\left(X\right)}$ are independent of $\left({\lambda }_a,{\lambda }_b\right)$ and it does not couple with the photon number splitting attack, as the former mainly targets single-photon-pair states, whereas the latter steals information from multiple-photon-pair states. Indeed, Eve can perform complementary space attack to multiple-photon-pair states in principle, but such an attack does not increase her knowledge about the keys thanks to decoy-state methods.

Consequently, equipped with the logical Bell state analyzer and methods to perform projection into the DFS and MDI-decoy-state analysis, we can prove that the security of the protocol is identical to the standard MDI-QKD protocol [10] by using the virtual qubit idea in Lo and Chau’s security proof [44] together with arguments in Ref. [34]. In the asymptotic limit, the key rate formula is given by the GLLP method [45]

$$\begin{array}{cc}\hfill R& \ge P_{11}^Z{\underset{\overline{}}{Y}}_{11}^Z\left[1-h\left({\overline{e}}_{11,AB}^X\right)-(1-p_a{p}_b)\right]\hfill \\ \hfill & -Q_{\mu \mu }^{Z}f\left(E_{\mu \mu }^Z\right)h\left(E_{\mu \mu }^Z\right),\hfill \end{array}$$

(16)

where $1-p_a{p}_b$ represents projection loss, ${\underset{\overline{}}{Y}}_{11}^Z$ is the lower bound of Z-basis single-photon-pair yield, $h\left(x\right)=-x{log}_{2}x-(1-x){log}_2(1-x)$ is the binary Shannon entropy function, f > 1 is the error correction inefficiency function, $P_{11}^Z=p_z^2{P}_1{\left(\mu \right)}^2$ denotes the joint probability that both Alice and Bob send single-photon-pair states in Z-basis with $p_z$ being the Z-basis probability, and ${\overline{e}}_{11,AB}^X$ is the upper bound of X-basis single-photon-pair QBER over the events where Alice and Bob’s single-photon-pair states both remain in the DFS. The ${\overline{e}}_{11,AB}^X$ can be estimated asymptotically from the following identity (the subscript $\overline{A}$ ($\overline{B}$) denotes projection outside Alice’s (Bob’s) DFS):

$$\begin{array}{cc}\hfill e_{11}^X& =p_a{p}_b{e}_{11,AB}^X+\left(1-p_a\right)\left(1-p_b\right)e_{11,\overline{A}\overline{B}}^X\hfill \\ \hfill & +\left(1-p_a\right)p_b{e}_{11,\overline{A}B}^X+p_a\left(1-p_b\right)e_{11,A\overline{B}}^X.\hfill \end{array}$$

(17)

It is easy to see that $e_{11,\overline{A}B}^X$ and $e_{11,A\overline{B}}^X$ are on the order of dark count rate $p_d$, whereas $e_{11,\overline{A}\overline{B}}^X$ is on the order of $p_d^2$. Therefore, one can set the upper bound $e_{11,AB}^X$ by

$$e_{11,AB}^X\le \frac{e_{11}^X}{p_a{p}_b}\le \frac{{\overline{e}}_{11}^X}{p_a{p}_b}\equiv {\overline{e}}_{11,AB}^X.$$

(18)

Using Equations (16) and (18), we have performed a numerical simulation to analyze the performance of our protocol under various parameter regimes.

5. Simulation

The goal of the simulation is to demonstrate the feasibility of the logical Bell state analyzer and MDI-decoy-state method instead of the precise relation between the key rate and fiber length. For this purpose, we assume the absence of birefringence effects and polarization randomization, together with perfect alignment of Alice’s, Bob’s, and Charlie’s reference frames for simplicity, otherwise the number of optical modes would double and the complexity would significantly increase. The robustness of the scheme of Boileau et al. has already be verified experimentally [34], and we believe it is directly applicable in the MDI implementation of our protocol.

In the simulation, we consider inefficient threshold detectors with non-zero dark count rate. Moreover, we neglect the dead time of the detectors and assume that all the detectors are identical for simulation purposes. The cost of sampling is omitted in our simulation, and we also apply a truncation on photon-pair numbers for convenience, with more details given in Appendix B. The simulation parameters are chosen as follows: the detector efficiency ${\eta }_d$ is 50%, the dark count rate $p_d$ is ${10}^{-6}$, the error correction efficiency $f=1.1$, the attenuation coefficient of the fiber is $\alpha =0.16\mathrm{dB}/\mathrm{km}$, the probability of choosing Z basis is 15/16, and the intensity probabilities are $p_0=2^{-8},p_{\nu }=2^{-7},p_{\mu }=1-p_0-p_{\nu }$. The resulting lower bound on key rates versus communication distance between the communication parties with different projection probability $p_{a\left(b\right)}$ are illustrated in Figure 3. We have also plotted the key rate of the scheme of Yin et al. [42] with a dashed line for comparison, where the same assumptions are made except for no projection loss. The emission intensities are optimized to be $\mu =0.12,\nu =0.01$ in both versions.

From Figure 3, one can see that our MDI version protocol can tolerate higher optical loss than the BB84 version of Yin et al. The maximal distance and key rate decrease as the projection probabilities $p_{a\left(b\right)}$ get lower, i.e., the case that Eve performs a stronger complementary space attack. Our protocol can still achieve a decent communication distance even at $p_{a\left(b\right)}=0.7$. For $p_{a\left(b\right)}$ less than this value, the communication distance and key rate drop rapidly.

Furthermore, we investigate the impact of the error probability $P_e$ of X-quadrature measurements on the performance with identical parameters as in Figure 3. We range $P_e$ from 0 to $0.2$ and plot the asymptotic key rates given no projection loss in Figure 4, and find that the communication distance and key rate are hardly influenced when $P_e$ is suppressed below ${10}^{-2}$ as noted before, indicating the robustness of our protocol against this intrinsic imperfection of the logical Bell state analyzer.

6. Discussion

Remarkably, one of the key advantages of our protocol is the immunity of all possible detection attacks naturally inherited from the MDI framework. Moreover, the need for nontrivial alignment of reference frames are removed in implementation and the protocol can tolerate the noise induced by birefringence effects in single mode fibers, making it a very promising candidate in intracity quantum networks with accessible fiber infrastructure and space-to-ground quantum communication scenarios [46,47].

From a practical perspective, however, the construction of the logical Bell state analyzer remains a technological challenge because it is generally hard to make large Kerr nonlinearities. Previously we have specified the error probability of X-quadrature measurements $P_e=\mathrm{erfc}\left(\sqrt{2}\alpha {\theta }^2\right)/2$, which originates from the overlap between the probability distributions of measurement outcomes. Efficient discrimination of logical Bell states only demands small error probability, thus operation in the regime of small cross-Kerr nonlinearities is possible. In view of the QKD system performance, as long as $\alpha {\theta }^2>1.2$, there is little impact on the key rate and communication distance. For realistic coherent states with $\alpha \sim {10}^6$, it is sufficient to apply small nonlinearities on the order of $\theta \sim {10}^{-3}$ [27,29]. Such size is much smaller than that required to perform controlled-phase gate directly between photons, i.e., $\theta \sim \pi$, and is experimentally achievable via electromagnetically induced transparencies [48,49] or doped optical fibers [50,51].

Another inevitable problem that is of concern to experimentalists is the requirement of four-fold coincidence detection, which results in the poor key rate scaling $O\left({\eta }^2\right)$ and short communication distances. We remark that there already exists protocols using hybrid logical basis [52,53], i.e., encoding a logical qubit with two degrees of freedom of a single photon, and their MDI versions have been proposed [54,55]. Although these schemes can only tolerate orthogonal rotations such as reference frame misalignment and cannot overcome the birefringence problem where the phase of polarization modes may shift, they indeed raise the key rate scaling to $O\left(\eta \right)$ and solve the inefficiency problem.

Nevertheless, the main contribution of this work is the first design of MDI-QKD protocol based on the scheme of Boileau et al. [21] by devising a suitable logical Bell state analyzer together with the development of MDI-decoy-state method for PDC sources. Application of heralded PDC sources [56,57] in the setup can increase the efficiency of our systems, although the MDI-decoy-state method needs to be correspondingly revised. We note that one plausible improvement is the mode-pairing scheme [58,59] as in our protocol the two photons are separated in two predetermined time-bins. Pairing two-fold coincidence detections in nonadjacent time-bins can make the key rate scales linearly with transmittance, in principle. What is more, it is intriguing to study whether the error probability in our logical Bell state analyzer will open a security loophole. We leave these as open questions.

7. Conclusions

In summary, we have presented a measurement-device-independent quantum key distribution protocol based on decoherence-free subspace with decoy-state method for parametric down-conversion sources and shown its unconditional security. Two major attacks are tackled in the security analysis. A complete logical Bell state analyzer is designed tailored for the decoherence-free subspace. The protocol enables the communication parties to estimate the projection probability into decoherence-free subspace easily with some intensity settings not used for key generation. Through numerical simulations, we show that our scheme can double the secure transmission distance compared with the BB84 version. We also evaluate the effect of inherent imperfections in the logical Bell state analyzer and show that it have negligible influence on the key rate in the asymptotic case.