Deterministic Quantum Key Distribution with Untrusted Relay and Finite Sources

Kang, Guo-Dong; Zhang, Li-Jun; Wu, Xiao-Lu; Zhou, Qing-Ping; Fang, Mao-Fa

doi:10.2478/qic-2025-0029

Full Article

1.

Introduction

Quantum key distribution (QKD) [1,2], whose security relies on the fundamental laws of quantum mechanics, is one of the most successful directions in practice in quantum information processing. Since Bennett and Brassard proposed the first standard one-way QKD protocol, namely the BB84 [1], for nearly four decades of efforts, the security proof problem of these BB84-type QKD protocols have been solved in ideal-devices settings [3–6], and the communication distance has been extended from the early 32cm [7] to 1200km satellite-to-ground [8]. In practice, the imperfect factors of QKD devices, such as imperfect single-photon sources, channel decay, and imperfect photon detectors, are vulnerable to powerful eavesdroppers, thus reducing the key performances and even compromising the security of QKD. Recently, the decoy technique [9,10] and the measurement-device-independent (MDI) proposal [11] not only close nearly all (except the characteristic of the sources) of the main current loopholes in real-life QKD devices but also significantly improve the key performance with imperfect single-photon sources. Later, MDI-QKD protocols with imperfect sources were presented, making QKD more robust in real-world applications [12,13]. However, most one-way QKD protocols are nondeterministic (in the post-processing, bases reconciliation is needed, and nearly half of the effective signal sources are sifted off to obtain raw key bits, which reduces the key rate by nearly half). Another relatively new proposal, deterministic QKD (DQKD), was proposed to amend the nondeterministic factor of one-way QKD. The two classical deterministic protocols are the Ping-Pong (PP) protocol and the LM05 protocol [14,15]. The distinct feature of the DQKD is the two-way (forward and backward) quantum channel, usually called TWQKD. The security proof is more complex as Eve can invade it in both the quantum forward channel (QFC) and the quantum backward channel (QBC). Over the past two decades, through hard work, the security of TWQKD has been proven under ideal-device settings [16–19]. It demonstrated that the performance of TWQKD can even surpass that of one-way QKD within a specific distance range, showing great potential to achieve good performance [20]. However, due to its two-way nature, TWQKD is more vulnerable when considering the loopholes of imperfect measurement devices. Eve can use it to steal partial or even complete key information [21], and the communication distance limit is relatively shorter than that of one-way QKD. Remarkably, Lu et al. take the first step to prove that DQKD is MDI secure in the QBC, while the photon detector at Alice’s side for check mode (to ensure security, check the fidelity of the QFC) is assumed to be perfect [22]. In this paper, we propose a DQKD protocol to double the limit transmission distance under the assumption that all measurement detectors, the relay, is untrusted (controlled by Eve). Later, we refer to it as the untrusted relay DQKD (UR-DQKD). The main work of this paper is to derive the performance formula for the UR-DQKD based on the current technology of QKD devices with finite sources.

The rest of this paper is arranged as follows. Details of the UR-DQKD protocol are presented in Section 2, whose key performance formula and simulation results are given in Section 3. Finally, a discussion and conclusion are made in Section 4.

2.

Protocol

As in Figure 1, without loss of generality, Bob and Alice run the protocol according to the following steps.

Preparation. First, Bob sends a communication request to Alice through an authenticated classical channel. Then, according to a random bit string with length N, denoted as b = b₁b₂ … b_N with b_i ∈ {0, 1} and i ∈ {1, 2, …, N}, Bob prepares and sends N qubits, written as a density matrix $ρ_{B} = \otimes_{i = 1}^{N} ρ_{B}^{i}$ {\rho _B} = \otimes _{i = 1}^N\rho _B^i, to Alice. Where $ρ_{B}^{i} = \sum \frac{1}{4} | φ^{i} 〉〈 φ^{i} |, | φ^{i} 〉$ \rho _B^i = \sum {{1 \over 4}} \left| {{\varphi ^i}} \right\rangle \left\langle {{\varphi ^i}} \right|,\left| {{\varphi ^i}} \right\rangle denotes the state of the i-th qubit that is randomly (with probability 1/4)in one of the four states: {Z_B : |0〉, |1〉}, {X_B : |+〉, |–〉}. {|0〉, |1〉} represent the eigenstates of the Pauli operator Z, and | $\pm 〉 = \frac{1}{\sqrt{2}} | 0 〉 \pm | 1 〉$ | \pm \rangle = {1 \over {\sqrt 2 }}|0\rangle \pm |1\rangle represent the eigenstates of the Pauli operator X. Alice responses to the request from Bob and prepares a random bit string with length N, denoted as a = a₁a₂ … a_N with a_i ∈ {0, 1} and i ∈ {1, 2, …, N}. Then, after receiving the i-th qubit $ρ_{B}^{i}$ {\rm{qubit}}\rho _B^i, Alice randomly chooses between the control mode (CM) with probability P_C and the encoding mode (EM) with probability P_E, P_E + P_C = 1.
Encoding mode. In the EM, Alice randomly (with equal probability) performs with two operators, I and iϒ, on the k-th qubit |φ^k〉 to encode bits a_k. Where a_k is part of a, and it will be used as the raw key bits. The unitary operator I = |0〉〈0| + |1〉〈1| encodes bit a_k = 0 and iϒ = |0〉〈1| – |1〉〈0| encodes bit a_k = 1. iϒ flips on all four prepared states as follows: iϒ|0〉 = –|1〉, iϒ|1〉 = |0〉, iϒ|+〉 = |–〉, iϒ|–〉 = –|+〉. After passing through the EM, all encoded qubits are sent to t+he UR.
Control mode. In the control mode (CM), according to the rest part of a, denoted as a_j, j ∈ [1, N] and j ≠ k. Alice randomly (with equal probability) performs the Pauli Z operator (a_j = 0) or the Pauli X operator (a_j = 1) on the j-th qubit |φ^j〉 and then sends them to the UR.

Here, we emphasize that instead of measuring all the qubits from the CM and the EM by legitimate parties, Bob delegates the decoding measurement process to Eve and informs Eve the basis of |φⁱ〉 through an authenticated classic channel. Eve measures each of Alice’s qubits via Bob’s basis in the UR, and then reports all of the measurement results (N bits), denoted as E_i, to Bob. Without noise, in the EM, Eve’s measurement outcomes are E_k : a_k ⊕ b_k, while in the CM, Eve’s outcomes are more complex, i.e., E_j = b_j if the basis used by Alice matches the basis chosen by Bob, otherwise, E_j are randomly to be 0 or 1.
Security Check. Alice announces the serial number j of each |φ^j〉 and the corresponding control operator that is used in the CM. According to Alice’s announcement, Bob computes the quantum bit error rate (QBER) of a_j, denoted as Q_CM. If Q_CM exceeds the security threshold, they regard Eve as having seriously invaded the quantum channel and abort the rest of the bits.
Key distillation. If Q_CM is acceptable, Alice randomly announces part of the a_k to compute the QBER of a_k, denoted as Q_EM. If Q_EM is acceptable (note, in the asymptotic case Q_EM = Q_CM), Alice and Bob perform the error-correction (EC) and the privacy amplification (PA) to distillate the final secure key bits.

Here, a photon delay with a small time slot may be needed in Alice’s module, as Bob only tells Eve the basis of $ρ_{B}^{i}$ \rho _B^i to execute the decoding measurement after Alice announces receiving a qubit. Note that photon delay is not a significant obstacle, as substantial progress has been made in [23].

3.

Performance

3.1.

Security Basis and Rigorous Proof

Here, we first emphasize and list the assumptions on which the security of this protocol is based.

First, the sources are security, i.e., the preparation basis of |φⁱ〉 is not leaked to Eve before step 3, or in other words, the bit string b is unknown to Eve before step 3. Pre-shared entanglement between |φⁱ〉 and Eve’s ancilla |ε〉_E is also excluded.
Second, Alice’s bit string a is not leaked to Eve. Alice has free will to choose the encoding and the control operators randomly.
Third, Eve can access quantum memory devices that have for arbitrary long coherence time.

Based on the above assumptions, we can infer that the security basis of this protocol is founded on two key points. First, Eve cannot distinguish between the qubits that pass through the EM and the ones that pass through the CM until Alice’s announcements in step 4. Second, the density matrix of $ρ_{B}^{i}$ \rho _B^i is invariant under Alice’s operations in the EM (CM), $ρ_{A B ∣ E M (C M)}^{i} = ρ_{B}^{i} = \frac{I}{2}$ \rho _{AB\mid EM(CM)}^i = \rho _B^i = {I \over 2}. Thus, in the view of Eve, the evolution of $ρ_{i}^{B}$ \rho _i^B has nothing to do with Bob’s preparation bases. Then, three conclusions can be drawn in the following.

Eve cannot get any information about the encoding bits a_k from the measurement results E_k : a_k ⊕ b_k.
In the view of Eve, this protocol is equivalent to the one in which Alice randomly uses four operations {I, iY, Z, X} for encoding. Thus, due to the CM, Eve will inevitably introduce QBER if she tries to get the information of a_k via attacks.

We first consider the ideas of the so-called zero-error attacks [24,25]. Suppose that, in the i-th round, Eve emits a fake state $| φ_{E}^{i} 〉$ \left| {\varphi _E^i} \right\rangle , randomly in the bases {Z, X}, to Alice and then tries to extract Alice’s encoding bits ak by measuring $| φ_{E}^{a_{k}} 〉$ \left| {\varphi _E^{{a_k}}} \right\rangle in the UR after passing |φ_E〉. through the EM(CM)(|φ_E〉 is transformed to be $| φ_{E}^{a_{k}} 〉)$ \left. {\left| {\varphi _E^{{a_k}}} \right\rangle } \right). Through this attack, on the one hand, Eve can get all the information of a_k after Alice announces the index i of each EM(CM) round. On the other hand, Eve will inevitably introduce errors when she reports, honestly or dishonestly, the measurement results E_k to Bob for EC and PA. Eve faces two folds in each round as she has a 1/2 probability of misguessing Bob’s preparation basis: if Alice chooses the CM, the error rate of the measurement result is Q_CM; If Eve, to escape from being detected by the CM, tampers with a measurement result (i.e.,1 → 0) with a probability p_t(0 ≤ p_t ≤ 1) and reports it to Bob, it will cause errors if Alice had chosen the EM in this round, the error rate is denoted as Q_EM. It is easy to figure out that Q_EM = 0.5 • p_t • (1 – P_CM) and Q_CM = 0.25 • (1 – p_t) • P_CM. By the above attacks (individual attacks), Eve can get all of ak at the cost of introducing the maximum noise, $Q_{C M}^{\max} = 0.25 • P_{C M}$ Q_{CM}^{\max } = 0.25 \bullet {P_{CM}}. For specific, in this protocol, we set P_CM = 0.25, thus $Q_{C M}^{\max} = 6.25 % (Q_{E M} = 0)$ Q_{CM}^{\max } = 6.25\% \left( {{Q_{EM}} = 0} \right) which can be easily detected by Alice and Bob. Of course, theoretically speaking, P_CM can be arbitrarily chosen within the interval (0, 1) by legitimate parties, i.e., set P_CM = 0.125 and so on. The only difference is that increasing the value of P_CM increases security of the protocol, but at the expense of the encoding rate. It is proper to choose PCM = 0.25, which guarantees both security (typically, the error rate of information transfer on a standard optical fiber with length 120∼400km is below 5%) and a relatively high encoding rate of this UR-DQKD. Therefore, Eve should balance her strategy to keep Q_CM = Q_EM, while Alice and Bob can fight against this kind of attack by setting the noise threshold, Q_CM = Q_EM = Q_max ≈ 5.4%. Then the security of this protocol can be well captured by considering collective attacks.

Now we consider the security bound for this protocol under the general collective attacks [26]. Eve performs the attacks ${\overset{⌢}{𝒰}}_{E}$ {_E} on each $ρ_{B}^{i}$ \rho _B^i and her initial ancilla |ε〉_E, then, after Alice’s encoding operation ${\overset{⌢}{O}}_{a_{k}} = {I^{a_{k} = 0}, i ϒ^{a_{k} = 1}}$ {_{{a_k}}} = \left\{ {{I^{{a_k} = 0}},i{Y^{{a_k} = 1}}} \right\}, she extracts a_k at any time from the entire quantum system $ρ^{A B E | {\hat{O}}_{a_{k}}} = \sum_{a_{k}} {\overset{⌢}{O}}_{a_{k}} {{\overset{⌢}{𝒰}}_{E} (ρ_{B}^{k} \otimes | ε 〉_{E} 〈 ε |) {\overset{⌢}{𝒰}}_{E}^{†}} {\overset{⌢}{O}}_{a_{k}}^{†} (a_{k} = 0, 1)$ {\rho ^{ABE\left| {{{\hat O}_{{a_k}}}} \right.}} = \sum\nolimits_{{a_k}} {{{}_{{a_k}}}} \left\{ {{{}_E}\left( {\rho _B^k \otimes |\varepsilon {\rangle _E}\langle \varepsilon |} \right)_E^\dag } \right\}\;_{{a_k}}^\dag \left( {{a_k} = 0,\;1} \right) after completing the decoding measurement in the UR (She can randomly report the measurement results to Bob at the premise of maintaining the balance Q_CM = Q_EM = Q_max ≈ 5.4%). The maximum amount of information that Eve can get from $ρ^{A B E | {\overset{⌢}{O}}_{a_{k}}}$ {\rho ^{ABE\left| {{{}_{{a_k}}}} \right.}} is I_E = h(Q_EM) in a depolarizing quantum channel (QC) (we emphasize that the depolarizing quantum channel can characterize the noise of most of the current optical quantum hardware in practice), where h(x) (the binary Shannon entropy) is given by h(x) = –x log₂ x – (1 – x) log₂ (1 – x). Under ideal settings (perfect single-photon sources, no channel losses, and perfect photon-detector efficiency), the key rate of this protocol is given by (details of the rigorous security proof are presented in Appendix A). 1 $K = 1 - 2 h (Q_{E M}),$ K = 1 - 2h\left( {{Q_{EM}}} \right),

It reveals that the quantum channel noise in this protocol constrains Eve’s ability to steal the maximum amount of information.

Here we argue that, in this protocol, Eve can not obtain more information by performing the general coherent attack mentioned in the LM05 protocol [15] than the one via the above general collective attack. In the coherent attack, in each round, Eve performs the first unitary attack ${\overset{⌢}{𝒰}}_{1}$ {_1} on |φⁱ〉 with one of her ancillas |ε〉_E and stores the resulting ancillas |ε_X〉_E after the first attack. Then, after passing |φⁱ〉 through the EM(CM), Eve performs the second unitary attack ${\overset{⌢}{𝒰}}_{2} on | φ_{a_{i}}^{i} 〉$ {_2}{\rm{ on }}\left| {\varphi _{{a_i}}^i} \right\rangle with her fresh ancilla |η〉_E and stores the resulting ancillary states |η_ϒ〉_E. Of course, the second attack includes the resulting state of the first ancilla, where X and Y denote, respectively, the indices of her ancillary nonorthogonal vectors (i.e., X = 00,01,10,11, ϒ = 000000,000001,…,111111). This attack aims to create coherence between |ε_X〉_E and |η_ϒ〉_E thus creating coherence between |φⁱ〉 and $| φ_{a_{k}}^{i} 〉$ \left| {\varphi _{{a_k}}^i} \right\rangle . Eve takes advantage of the coherence to make an optimal guess of a_k by measuring |ε_X_E, |η_ϒ〉_E and $| φ_{a_{k}}^{i} 〉$ \left| {\varphi _{{a_k}}^i} \right\rangle after step 3. From equation (14) in Ref. [15], we can figure out that the QBER Eve can introduce is Q_EM = 1/2 – 1/8(1 + cosx)². Setting x = x′ in equation (13) of Ref. [15], we can obtain the upper bound of I_AE = 1 – h [(1 + sinx)/2], where cos x = 〉ε₀₀|ε₁₁〉 specifies the angle between ε₀₀ and ε₁₁ (two normalized and nonorthogonal vectors of Eve’s first ancilla). Then finally, we can obtain the upper bound of $I_{A E} = 1 - h (\frac{1 + \sqrt{1 - 4 {(ζ - 1 / 2)}^{2}}}{2})$ {I_{AE}} = 1 - h\left( {{{1 + \sqrt {1 - 4{{(\zeta - 1/2)}^2}} } \over 2}} \right) under the coherent attack, where $ζ = \sqrt{1 - 2 Q_{C M}}$ \zeta = \sqrt {1 - 2{Q_{CM}}} . It takes the maximum(I_AE ≈ 0.54) at the cost of introducing the maximum noise (Q_EM ≈ 18%) under the coherent attack (ensuring the key rate K = 0). While in this protocol, I_E takes its maximum (I_E ≈ 0.5) at Q_EM ≈ 11.4% under the collective attack (ensuring the key rate K = 0). Note that Alice breaks the coherence in the CM (Alice randomly performs the Pauli Z operator or the Pauli X operator in the CM), thus, the maximum Q_CM that Eve can introduce is equal for any coherent and incoherent attack. With the noise threshold Q_CM = Q_EM = Q_max ≈ 5.4%, the upper bound of I_AE = 0.157 under the general coherent attack, while I_E = h(Q_CM) = 0.303 under the general collective attack. It indicates that, in this protocol, the general coherent attack is not the optimal one for Eve as the CM breaks the coherence between |φⁱ〉 and $| φ_{a_{k}}^{i} 〉$ \left| {\varphi _{{a_k}}^i} \right\rangle .

3.2.

Performance Formula

In this section, we derive the performance formula for this protocol, close to the real-world QKD system. We first present the reasonable models of the devices for this protocol, based on current technology.

We assume that Bob uses single photons as the source (SPS). In each round, Bob successfully emits a singlephoton state to the quantum channel with probability P₁ (efficiency of single-photon state collection) or a vacuum state due to random losses with the probability P₀, P₁ + P₀ = 1. Note that high-performance single-photon sources (SPS) have made significant progress in recent QKD experiments and P₁ can be over 99% in practice [27]. Here we set P₁ = 90%.

The quantum channel (optical fiber) transmittance t_AB can be expressed as $t_{A B} = 10^{- \frac{β L_{A B}}{10}}$ {t_{AB}} = {10^{ - {{\beta {L_{AB}}} \over {10}}}} where, β is the decay coefficient of the fiber between Alice and Bob, and L_AB is the length of the fiber.

We consider a threshold photon detector in the UR that cannot resolve the photon number of each photon pulse, but can only distinguish a vacuum pulse from a non-vacuum pulse.

Then, the total efficiency of the QKD system is η = t_ABη_AB, where η_AB = t_At_Bη_E denotes the total transmittance of the devices in Alice and Bob’s sides (t_At_B) and the UR (η_E). Here, the efficiency of the photon delay on Alice’s side, which can be nearly unity with today’s technology, is merged into the UR.

From the above models, the performance formula for this protocol can be written as 2 $K_{finite} \geq P_{E M} • g {ϒ_{1} [1 - h (e_{1})] - f_{E C} h (e_{g})},$ {K_{{\rm{finite }}}} \ge {P_{EM}} \bullet g\left\{ {{Y_1}\left[ {1 - h\left( {{e_1}} \right)} \right] - {f_{EC}}h\left( {{e_g}} \right)} \right\},

Details of each term in Equation (2) are listed below.

The factor P_EM is the probability of implementing the EM, and g is the total gain in the UR from Bob’s SPS.
ϒ₁ is defined as the yield of a single-photon pulse, i.e., the condition probability of a detection event in the UR given that Bob sends out a single-photon pulse. Note that ϒ₀ (typically 10⁻⁵ ~ 10 ⁻⁶) is the background detection rate that is independent of the SPS detection.
e₁ and e_g are, respectively, the error rate of single-photon pulses and the overall QBER. f_EC ≥ 1 is the directional error correction efficiency.

Usually, g and e_g can be obtained directly from experiments, while the parameters ϒ₁ and e₁ must be estimated tightly. Here, we give the theoretically expected bound of each term in Equation (2) to get the bound of K_finite.

The total gain g is given by 3 $g = \sum_{i = 0}^{i = 1} ϒ_{i} P_{i} = ϒ_{0} P_{0} + ϒ_{1} P_{1} .$ g = \sum\limits_{i = 0}^{i = 1} {{Y_i}} {P_i} = {Y_0}{P_0} + {Y_1}{P_1}.

The total QBER is given by 4 $e_{g} • g = \sum_{i = 0}^{1} e_{i} ϒ_{i} P_{i} = e_{0} ϒ_{0} P_{0} + Q_{E M} ϒ_{1} P_{1},$ {e_g} \bullet g = \sum\limits_{i = 0}^1 {{e_i}} {Y_i}{P_i} = {e_0}{Y_0}{P_0} + {Q_{EM}}{Y_1}{P_1}, where, Q_EM in Equation (4) is the QBER induced by optical devices, thus attributed to Eve. In a depolarizing quantum channel with high visibility, Q_EM typically is 1%~5%. e₀ in Equation (4) denotes the error rate of the random background, and is reasonably set to be 0.5.

Based on the assumption presented in [28], in the finite sources scenario, the lower bound of ϒ₁ in this protocol can be written as 5 $ϒ_{1}^{L} = ϒ_{0} + (1 - ϒ_{0}) η - δ_{ϒ 1} / g,$ Y_1^L = {Y_0} + \left( {1 - {Y_0}} \right)\eta - {\delta _{Y1}}/g, where δ_ϒ1 denotes the statistic fluctuation of the single-photon gain.

The upper bound of e₁ is given by 6 $e_{1}^{𝒰} = \frac{e_{g} + δ_{e}}{ϒ_{1}^{L}},$ e_1^u = {{{e_g} + {\delta _e}} \over {Y_1^L}}, where δ_e is the statistic fluctuation of e_g in a finite source scenario.

According to the law of large numbers and the finite sources theorem [29–31], δ_ϒ1 and δ_e are, respectively, given by 7 $δ_{ϒ_{1}} = \sqrt{\frac{2 \ln (1 / ε_{P E}) + 4 \ln (N + 1)}{4 N}},$ {\delta _{{Y_1}}} = \sqrt {{{2\ln \left( {1/{\varepsilon _{PE}}} \right) + 4\ln (N + 1)} \over {4N}}} , 8 $δ_{e} = \sqrt{\frac{2 \ln (1 / ε_{P E}) + 4 \ln (N • P_{E M} + 1)}{4 N • P_{E M}}} .$ {\delta _e} = \sqrt {{{2\ln \left( {1/{\varepsilon _{PE}}} \right) + 4\ln \left( {N \bullet {P_{EM}} + 1} \right)} \over {4N \bullet {P_{EM}}}}} .

Note, ϒ₁ should be tightly estimated over all N pulses, while δ_e should be tightly estimated only over the pulses from the EM, and this protocol has four outcomes of the positive operator-valued measurement, POVM, in the UR). Then, with the above Equations (3)–(8), we can calculate the lower bound of K_finite. Simulation results of Equation (2) are presented in Figure 2 with the parameters of today’s QKD technology, as listed in Table 1.

Table 1.

Experimental parameters of today’s QKD technology.

β(dB/km)	Q_EM	ϒ₀	η_E	f_EC	ε_PE
0.2	1.5%∽5%	8 × 10⁻⁸	14.5% ∽ 45%	1.15	10⁻⁸

Figure 2 shows that: the finite lengths of sources have significant effects on the limit transmission distance; with Q_EM = 1.5%, N ≥ 10⁸, cut off those key rates below 10⁻⁸, the performance is over 248km∽10⁻⁸ bits/pulse, and the limit transmission distance can be extended over 320 km with N ≥ 10¹²; even with Q_EM = 5%, much higher than the current value in practice, the performance is over 143km∽10⁻⁸ bits/pulse, and the limit transmission distance can be extended over 180 km with N ≥ 10¹².

Figure 3 shows that: the UR-DQKD doubles the performance of the current DQKD, and the effect of the finite lengths of sources is negligible when N is large enough, i.e., N ≥ 10¹⁶; brief comparison with the performance of the MDI-QKD, i.e., the dashed line in Figure 3 in Ref. [32], the key rate and the limit transmission distance of this protocol perform better than that of the MDI-QKD. All critical parameters for comparison are the same as those in Table 1 (Q_EM = 1.5%, ϒ₀ = 8 × 10⁻⁸, η_E = 14.5%, f_EC = 1.15, and β = 0.2) except for the sources: infinite decoy states of coherent pulses in the MDI-QKD, finite SPS based on the recent experiment progress in this protocol. Theoretically speaking, for the MDI-QKD with infinite decoy states, besides the signal coherent pulses with intensity μ_Alice = μ_Bob = μ, Alice and Bob send infinite faint coherent pulses with intensities v_i(v_i ∈ {v₁, ν₂, …, v_m}, m → ∞, and v_i < μ) to the UR to tightly estimate the gain Y₁₁ and the error rate e₁₁ of the key rate equation (B31) in Ref. [32], which makes the key rate of the MDI-QKD with infinite coherent pulses asymptotic to that of the MDI-QKD with infinite single photons. Note that the optimal μ, approximately 0.2∽0.6, slightly varies with the transmission distance L_AB and is numerically optimized in Figure 3. Therefore, under the above conditions, it is justified to make a performance comparison between the infinite decoy states MDI-QKD and this UR-DQKD with finite SPS.

4.

Conclusion and Discussion

In this work, we propose a UR-DQKD protocol. The main work of this paper focuses on deriving the lower bound of the performance formula for it with a practical model based on today’s technology. Moreover, with the current parameters, the simulation results show that this protocol can achieve good performance. It nearly doubles the performance of the current DQKD employing a trusted relay [15] and outperforms the MDI-QKD within a considerable distance (320km). It is foreseeable that the performance will be over 470km∽10⁻⁸ bits/pulse if the critical parameters of the QKD system are set to the optimal values of today’s technology, i.e., use ultralow-loss fiber (β = 0.17) and high-efficiency detector (η_E ≥ 45%) [33], thus expected to be comparable with the performance of the PM-QKD [32]. We also note the recent progress in the experimental demonstration of quantum secure direct communication (QSDC) with single-photons and entanglement-pairs, which also indicates the potential of achieving high-performance MDI-DQKD with current devices (over 200km with relatively high secure key rates) [34]. In conclusion, this protocol is feasible with today’s technology, allowing high-performance, secure networks with a relay controlled by an untrusted third party.

Deterministic Quantum Key Distribution with Untrusted Relay and Finite Sources

Full Article

Paradigm

My account