Secret key distillation across a quantum wiretap channel under restricted eavesdropping

03/07/2019 ∙ by Ziwen Pan, et al. ∙ 0

The theory of quantum cryptography aims to guarantee unconditional information-theoretic security against an omnipotent eavesdropper. In many practical scenarios, however, the assumption of an all-powerful adversary is excessive and can be relaxed considerably. In this paper we study secret key distillation across a lossy and noisy quantum wiretap channel between Alice and Bob, with a separately parameterized realistically lossy quantum channel to the eavesdropper Eve. We show that under such restricted eavesdropping, the key rates achievable can exceed the secret key distillation capacity against an unrestricted eavesdropper in the quantum wiretap channel. Further, we show upper bounds on the key rates based on the relative entropy of entanglement. This simple restricted eavesdropping model is widely applicable, e.g., to free-space quantum optical communication, where realistic collection of light by Eve is limited by the finite size of her optical aperture. Future work will include calculating bounds on the amount of light Eve can collect under various realistic scenarios.

READ FULL TEXT VIEW PDF
POST COMMENT

Comments

There are no comments yet.

Authors

page 1

page 2

page 3

page 4

This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

I Introduction

Quantum key distribution (QKD) theoretically promises unconditional security in the physical layer. Bennett and Brassard [1]

developed the first QKD protocol (BB84), whose security is guaranteed by the no-cloning theorem of quantum mechanics and one-time-pad encryption 

[2]. Numerous commercial products are available today that implement variants of the decoy-state BB84 (DS-BB84) protocol [3]

based on polarization qubits encoded in weak coherent state pulses.

While discrete variable (DV) protocols such as the DS-BB84 showcase the power of quantum cryptography, the key rates achievable are low and the systems are difficult to integrate with existing telecommunication systems. Hence, nowadays there is a thrust to develop QKD systems that can overcome these challenges. In this regard, continuous variable (CV)-QKD schemes, e.g., based on coherent laser light and heterodyne detection are being viewed as viable solutions [4, 5].

Traditionally, the security proofs of quantum key distribution against a wiretapping adversary, an eavesdropper Eve, assume that Eve can perform any operation allowed by the laws of quantum physics on the transmitted light, and has access to all the light that is lost in transmission. However, this is not the case in some realistic applications, especially in free-space communication channel where it is reasonable to consider a potential Eve who is restricted in her information collection capabilities.

In this work, we present a secure key rate analysis for a secret key distillation scheme over a quantum wiretap channel from a sender Alice to receiver Bob, where the eavesdropper Eve is restricted to receive only a fraction of the photons lost in transmission as shown in Fig. 1. As a result, some of the light is rendered inaccessible to any of the parties involved and lost to the environment. Such a restriction is widely applicable, e.g., in optical wireless communication [6], where a realistic Eve would be limited by the size of the aperture of her receiver, or be forbidden to collect light from an exclusion zone around Alice-to-Bob line of sight. We consider both passive eavesdropping where Eve injects the vacuum state into the channel, and an instance of active eavesdropping, where Eve injects a thermal state into the channel. 111Note that other possible restrictions on Eve include, e.g., a noisy quantum memory [7] of finite size and coherence time, and a noisy communication channel where some of the noise is well characterized and provably of non-adversarial origin, which does not benefit Eve either. However, in this work, we focus on the restricted light collection capability of Eve. The analysis would include both direct and reverse reconciliation [8, 9] as they improve differently under restricted eavesdropping.

Fig. 1: Entanglement-based model for quantum communication over a wiretap channel of transmissivity from Alice to Bob under restricted eavesdropping. Alice prepares an entangled pure state and sends through the channel to Bob while retaining with herself. Bob receives at the output of the channel. The restriction on the eavesdropper Eve is modeled by a pure loss beam splitter of transmissivity . Eve is shown to inject a state into the channel to Bob, which could be a vacuum state (passive attack) or a thermal state (active attack). Then Eve collects and can perform any operations allowed by the physics law to eavesdrop. is considered lost in the process of Eve’s collecting action and thus inaccessible to any party.

The main findings of our analysis include the following:

  • Invoking the Hashing inequality [10] for secret key distillation over a communication channel with one-way public discussion, we write down lower bounds on asymptotic achievable key rates under the restricted eavesdropping model. We show that these key rates can exceed the direct transmission capacity of the channel in a traditional unrestricted eavesdropping model. This implies both higher key rates as well as longer transmission distances.

  • We provide upper bounds on the key rates under the restriction on Eve based on the relative entropy of entanglement (). In the case of the pure loss channel, the upper bound closely matches the achievable rate with heterodyne detection and reverse reconciliation.

  • We present a comparison of a CVQKD protocol based on Gaussian modulated coherent states and heterodyne detection, and the DS-BB84 DVQKD protocol based on polarization encoding of weak coherent states, under both passive and active restricted eavesdropping models.

The paper is organized as follows: Sections II and III describe the methods employed in establishing the achievable key rates and the upper bounds on secret key distillation under restricted eavesdropping. These methods apply to passive as well as active eavesdropping, and direct and reverse information reconciliation schemes. In Section IV, we present the results obtained by applying these methods to the entanglement-based model for secret key distillation based on the two-mode squeezed vacuum state and heterodyne detection. In Section V, we present results comparing achievable key rates (under the restricted eavesdropping model) in CVQKD with Gaussian modulated coherent states and heterodyne detection, and in DS-BB84 protocol. We conclude with a summary in Section VI.

Ii Achievable rates for secret key distillation under restricted eavesdropping

Consider the entanglement-based model for bipartite secret key distillation shown in Fig. 1, where Alice prepares an asymptotically large number of independent and identically distributed (i.i.d.) copies of an entangled pure state and transmits the systems through a wiretap channel. In this limit, the optimal attack for an eavesdropper Eve is known to be a collective attack [11], namely wherein she performs an identical symbol-by-symbol active attack on each transmission, resulting in i.i.d. copies of a bipartite state being shared between Alice and Bob.

Let us first recall key rate analysis for secret key distillation against an unrestricted Eve ( in Fig. 1).

Ii-a Unrestricted Eve

In traditional security analysis for key distillation over a quantum wiretap channel, where the eavesdropper Eve is assumed to have access to all the light that is lost in transmission, she holds the full purification of the state . In other words, Eve holds a quantum system such that the systems , and are in a pure state satisfying . In the case of a thermal noise channel with loss, Eve holds the purification of both the state she injected into the channel as well as the output of the channel to Bob, namely a pure state , being the purifying system of Eve’s input . Note that the systems in this case can be thought of as one joint purifying system . Hence the system in subsequent discussion in this section also includes the case of the thermal noise channel.

When either Alice or Bob performs a measurement, Devetak and Winter [10] proved an achievable rate () for secret key distillation from the resulting state with one-way public classical communication assistance—a result known as the Hashing inequality. Here CQQ stands for “Classical-Quantum-Quantum”, indicating that either Alice or Bob has performed a measurement on her/his quantum system, while the other and Eve are yet to measure their respective quantum systems. For example, in a reverse reconciliation scheme, Bob performs a measurement, while Eve and Alice retain their quantum systems unmeasured. (Likewise, CCQ stands for “Classical-Classical-Quantum”, which indicates that both the communicating parties have performed measurements. reflects the corresponding achievable key rate, and will be discussed in Section V in the context of QKD protocols.)

The Hashing lower bound on the key rate for direct reconciliation, namely when Alice measures system to give rise to a classical outcome that is publicly communicated to Bob is given by

(1)

Here the state is

(2)

and the quantum mutual information quantities and are the following Holevo information quantities

(3)
(4)

where denotes the von Neumann entropy. We also have

(5)
(6)
(7)
(8)

where is the density matrix of system conditioned on the measurement result . and each represents a complete (usually orthonormal) basis of system and . Since each conditional state is a pure state, we have . This leads to

(9)
(10)
(11)
(12)
(13)
(14)
(15)

which is the expression for coherent information [10, 12] of . Here Eq. (13) follows from the fact that the marginal states of systems and for the states and are the same. Equation (14) follows from the fact that for a tripartite pure state , .

For reverse reconciliation, similarly, by changing the roles of Alice and Bob, we arrive at an expression for a Hashing lower bound on the secret key distillation rate given by

(16)

Here the state is

(17)

and is the classical outcome of measuring Bob’s quantum system . Now if is a pure state, is also a pure state, which gives us . And similar to the direct reconciliation case this leads to

(18)
(19)
(20)
(21)
(22)
(23)
(24)

which is the expression for reverse coherent information [13, 10, 14] of . Similarly here Eq. (22) follows from the fact that the marginal states of systems and for the states and are the same. Equation (23) follows from the fact that for a tripartite pure state , . And we also have

(25)
(26)
(27)
(28)

Ii-B Restricted Eve

When Eve only has restricted access to the wiretapped light, i.e., in Fig. 1, she does not have access to the full purification of the bipartite state shared between Alice and Bob. That is, the systems , , and are not in a pure state anymore. It is rather together with the system , which is lost to the environment, that these systems are in a pure state .

In the direct reconciliation case after Alice measures system into a classical register , with the tripartite state between Alice, Bob and Eve being , we have

(29)
(30)

The second term now does not vanish. Similarly, in reverse reconciliation case we have

(31)
(32)

Iii Upper Bound for Secret Key Distillation under Restricted Eavesdropping

In this Section, we recall the relative entropy of entanglement [15] of a channel (), which serves as an upper bound on the entanglement and secret key distillation capacities of the channel under unrestricted eavesdropping when assisted by unlimited two-way classical communication assistance between the communicating parties, and apply it to the restricted eavesdropping model.

Definition 1

The relative entropy of entanglement of a channel is defined as [16]

(33)

where

(34)

, and is the relative entropy between states and . When the support of contains that of ,

(35)

While the relative entropy of entanglement is the relative entropy of a state with its closest separable (SEP) state in Hilbert space, the relative entropy of entanglement of a channel is the relative entropy of entanglement of the state distributed across the channel optimized over all possible inputs to the channel.

Iii-1 Unrestricted Eve

Using the relative entropy of entanglement, Pirandola et al. (PLOB) [17] gave an upper bound to the energy-unconstrained, two-way unlimited Local Operations and Classical Communication (LOCC)-assisted entanglement and secret key distillation capacity of lossy and noisy bosonic channels. For a pure loss channel of transmissivity , the relative entropy of entanglement upper bound is given by . Since this upper bound matches the reverse coherent information lower bound [13], the above rate characterizes the capacity. (See also [18] for a strong converse theorem for the upper bound.)

For a thermal noise channel of transmissivity and thermal noise , which is the mean photon number in the thermal state that Eve injects into the channel, the relative entropy of entanglement upper bound is known to be [17] , where [19]

(36)

is the von Neumann entropy of a thermal state of mean photon number .

The bipartite separable quantum states closest in relative entropy divergence to a two-mode entangled quantum states shared across the channel that are required in giving the above bounds are found using the Positive-Partial Transpose (PPT) criterion for separability of quantum states [20, 21].

Iii-2 Restricted Eve

In the restricted eavesdropping model in Fig. 1, the state of interest now is the tripartite state , which is purified by the fourth system that Eve possesses (unlike the unrestricted case, where system does not exist and the state of interest is bipartite). We apply the PPT criterion across the bipartition and and give relevant upper bounds in this scenario. See Appendix A for details of the calculation.

Iv Achievable Rate and Upper Bound Derivation with Numerical Results

In this Section, we apply the methods of secure key rate (SKR) analysis and upper bounds presented in Secs. II and III to bosonic pure loss and thermal noise channels fed with an input two-mode squeezed vacuum (TMSV) state . The achievable rates are given for heterodyne detection either at Alice or Bob, which correspond to direct and reverse information reconciliation scenarios, respectively.

Iv-a Achievable Rates

Iv-A1 Pure Loss Channel

First we will show the achievable rate with direct reconciliation, namely where Alice performs heterodyne detection on her system, as depicted in Fig. 2. Assuming a TMSV state input, we calculate the achievable rate for this setup.

Fig. 2: Entanglement-based model for secret key distillation over a pure loss bosonic channel based on heterodyne detection and direct reconciliation. Here Alice performs heterodyne measurement of system and this projects the system of the TMSV state (with mean photon number per mode) onto a coherent state . She then sends side information in the classical channel to Bob to help him distill keys from his system. Here vacuum states are injected from and denoting a pure loss channel. The restriction on Eve is imposed by letting only a fraction of the wiretapped light reach her receiver.

Since the heterodyne measurement on projects the other part of the TMSV onto a coherent state , we know that the state at the beam splitters’ outputs conditioned on measurement result , namely , , are also coherent states with attenuated amplitudes. Since they are pure states we have

(37)

So, using Eq. (30), we have

(38)
(39)

where is the average photon number in the light Alice transmits to Bob, which leads to

(40)

Equation (40[22] gives the limiting value of the key rate when the input photon number is taken to infinity. This limit can be shown to be the optimal input strength that maximizes the key rate. Notice that the dependence of the direct reconciliation achievable rate in Eq. (40) on Eve’s restriction is in the denominator inside the log function. Thus, restricting Eve’s received power can help increase the achievable rate beyond the rate achievable against an unrestricted Eve ( in Eq. (40)), namely . It is interesting to note that the increase in achievable rate is accomplished without affecting the channel from Alice to Bob, but rather by modifying the channel from Alice to Eve.

In the case of an unrestricted Eve and direct reconciliation, we need to have to attain a positive key rate in Eq. (40). Similarly for the key rate to be greater than zero in the restricted Eve case, we need to have . This condition captures the limitation of direct reconciliation with regard to the transmission distance, namely that the key rate vanishes beyond a threshold distance.

Fig. 3: Entanglement-based model for secret key distillation over a pure loss bosonic channel based on heterodyne detection and reverse reconciliation. Here Bob performs heterodyne measurement on his system ; the states injected from and are vacuum states.

Now, consider the case of reverse reconciliation, as depicted in Fig. 3. Here, Bob performs heterodyne measurement on his system and sends side information through a classical communication channel to Alice to help her distill secret key. Using Eq. (32), and recognizing that is a continuous variable, we get

(41)
(42)
(43)

and

(44)

Since in this case the post-measurement conditional states are not pure, we derived the covariance matrix of corresponding states and calculated the von Neumann entropies, which turns out as shown in Eq. (42). Since the argument of the functions in Eq. (42

) have no dependence on the probability distribution of

, we get Eq. (43) by integrating over . Taking the limit of input mean photon number , we obtain the optimal achievable rate given in Eq. (44).

Equation (44), when , reduces to , which is also the PLOB bound based on , discussed in Sec. IV-B, and hence the capacity. If we compare Eq. (44) for with pure loss unrestricted model capacity , not only do we have showing up in the denominator inside the logarithm, but we also have one correction term: . This correction term changes differently with compared to the first term . Unlike the case with the unrestricted Eve, we find that the achievable rate with reverse reconciliation is not always better than the rate with direct reconciliation.

In Fig. 4 (a), we plot the SKR as a function of the restriction on Eve for a channel transmissivity of . When high values of are assumed, which includes the unrestricted Eve’s case (), we find that reverse reconciliation gives a higher achievable rate than direct reconciliation. However when low values of are assumed the rate with direct reconciliation is seen to exceed the rate with reverse reconciliation.

Fig. 4: (a) Secure key rate against restricted eavesdropping over a pure loss channel with TMSV state and heterodyne detection. Direct reconciliation vs. reverse reconciliation rates as a function of . Here the channel transmissivity is set to . (b) Direct reconciliation vs. reverse reconciliation achievable rate as a function of channel loss in dB with . The channel capacity against an unrestricted Eve is also shown for comparison.

In Fig. 4 (b), we plot the direct and reverse reconciliation achievable rates as a function of the channel transmissivity for a given value of the restriction on Eve . Since channel loss usually increases as transmission distance increases, we can see that the reverse reconciliation scheme has a longer useful transmission distance than the direct reconciliation scheme, which is similar to the case when Eve is unrestricted as was shown in  [13]. However, here both direct reconciliation and reverse reconciliation can achieve rates that are higher than the unrestricted Eve’s capacity, which was achievable with reverse reconciliation.

Iv-A2 Thermal Noise Channel

For the thermal noise channel, Eve’s input to the channel is now a thermal state of mean photon number .

Since the thermal state is not a pure state, we need to take into account its purifying system . So, here we assume that Eve holds a TMSV with mean photon number . She injects one mode into the channel while keep the other mode as a purification and then does a joint operation on systems and .

Fig. 5: Entanglement-based model for secret key distillation over a thermal noise bosonic channel based on heterodyne detection and direct reconciliation. Here Alice performs heterodyne measurement and sends side information to Bob to help him distill secret keys. Eve holds a TMSV with mean photon number per mode and injects one of the modes into the channel, actively inducing noise.

First we look at the case of direct reconciliation, depicted in Fig. 5. Again using Eq. (30), we have

(45)
(46)
(47)

Here the state is

(48)

s are the symplectic eigenvalues of the reduced covariance matrix of modes

and . Finally, we have

(49)

Here if we compare Eq. (49) with the direct reconciliation achievable rate for an unrestricted Eve case over the thermal noise channel [17] , we can see that shows up in the denominator inside the logarithm function in a way similar to the case of the pure loss channel. However, here we still have a correction term , which vanishes when .

Fig. 6: Entanglement-based model for secret key distillation over a thermal noise bosonic channel based on heterodyne detection and reverse reconciliation. Here Bob performs heterodyne measurement and sends side information to Alice to help her distill secret keys. Eve holds a TMSV with mean photon number per mode and injects one of the modes into the channel, actively inducing noise.

Now, for the reverse reconciliation case depicted in Fig. 6, we use Eq. (32) to obtain our results

(50)
(51)
(52)

Here the state is

(53)

() are the symplectic eigenvalues of the covariance matrix corresponding to system and () are the symplectic eigenvalues of the covariance matrix corresponding to the post-measurement system after the measurement of Bob’s state . Finally, we have

(54)

In Eq. (54) we have showing up in the denominator inside the log function compared to the reverse reconciliation achievable rate for thermal noise channels under unrestricted Eve’s case . Also, we have correction terms of which the exact form is given below:

(55)
(56)
(57)
(58)
(59)
(60)
(61)
(62)
(63)
Fig. 7: Achievable rates, direct reconciliation vs. reverse reconciliation, as a function of input mean photon number in the input signal. With different choices of the channel parameters direct reconciliation can have a higher or lower rate than reverse reconciliation. In both figures direct and reverse SKR increase with increasing input power and saturate to some value while different values change the comparison between direct and reverse reconciliation.

With the above results Eqs. (55)-(63), we first plot the direct and reverse reconciliation achievable rates as functions of the input mean photon number in Fig. 7.

Here in Fig. 7, we can see that the achievable rate for both direct reconciliation and reverse reconciliation is increasing with increasing input mean photon number . So is optimal. Also, depending on the channel parameters, either direct or reverse reconciliation could have the higher rate.

For the figures below, unless specified otherwise, the achievable rate is plotted with taken to infinity.

Fig. 8: Achievable rate as a function of input mean photon number of thermal noise state with , , .
Fig. 9: Achievable rate as a function of transmissivity with , , .
Fig. 10: Achievable rate as a function of with , , .

In Figs. 8-10, we separately plot the direct and reverse reconciliation achievable rates as functions of the thermal noise strength , channel transmissivity , and the restriction factor . We can see that both direct and reverse reconciliation key rates decrease with increasing noise, increasing and increasing channel loss ().

Since reverse reconciliation generally gives us a greater transmission range than direct reconciliation (see Fig. 9 as transmissivity usually decreases with increasing transmission distance for a given channel), below we show achievable rates with reverse reconciliation for different parameters. We also plot the capacity of the pure loss channel against the unrestricted Eve, , for comparison. In Fig. 11, we show that even though generally with increasing noise the SKR goes down and tends to have a shorter transmission distance, with small it is still possible to exceed the pure loss unrestricted Eve’s capacity for some values of channel loss. Then we fix the noise and change in Fig. 12. It is shown that for different values of noise, even when noise is very high, a small can improve the achievable rate dramatically.

Fig. 11: Achievable rate as a function of channel loss in dB with different choices of .
Fig. 12: Achievable rate as a function of channel loss in dB with different values of .

Iv-B Upper Bounds

In this Section we apply the method discussed in Section III and Appendix A to get upper bounds for secret key distillation under restricted eavesdropping.

Iv-B1 Pure Loss Channel

First we look at the pure loss case. An upper bound on the secret key distillation capacity under the restricted eavesdropping model considered here follows from the broadcast channel result [23, Eq. (26)] [24, Eq. (8)] as:

(64)
Fig. 13: Broadcast channel shown in [23, 24], where a single sender sends information to receivers , and through different lossy channels. Here the signal state is sent out from while only vacuum states are injected from and . This can be viewed as equivalent to our model if we consider mode as an inaccessible system, and as the eavesdropper Eve.

Here the notation means that the closest separable state for the relative entropy entanglement calculation is a state separating system from systems . In Ref. [23, 24], the key to obtaining the above bound was the different physical realizations of the same broadcast channel, one of them being as shown in Fig. 13. Since only vacuum states are injected from and in Fig. 13, it is equivalent to our model in Fig. 1 with and . Thus, the upper bound expression for our restricted eavesdropping case is obtained as

(65)

In Fig. 14 we apply Eq. (65) to compare the upper bound with the lower bound for different values of . We plot the relative entropy entanglement upper bound and the lower bound for three values, denoted by different colors. Here the lower bound is taken as the maximum of direct and reverse reconciliation rates.

Fig. 14: Relative entropy of entanglement upper bounds (UB ) and lower bounds with different values of thermal noise.

Here we can see that when is close to 1, the upper bound almost matches the lower bound. And they match each other when which corresponds to the unrestricted case [17]. However when decreases the upper bound becomes looser, but still highly constrain the region in which the capacity for secret key distillation can lie.

One interesting thing to see from Fig. 14 is that the region where direct reconciliation gives a higher rate than reverse reconciliation has a large overlap with the region where the upper bound and lower bound are closest to each other. For example, when in Fig. 14 the upper bound and lower bound diverge from each other close to the point where direct reconciliation starts to give a lower rate than reverse reconciliation. Another observation from the plot is that when decreases the lower bound tends to decrease slower with increasing channel loss at least when channel loss is low.

Iv-B2 Thermal Noise Channel

Next, we look at the thermal noise channel. We plot the relative entropy of entanglement upper bound calculated as described in Appendix A along with the lower bounds of Eqs. (49) and (54) in Fig. 15. Here we can see that when noise is introduced into the channel the upper bound becomes looser compared to the pure loss channel, which is similar to what was found for unrestricted eavesdropping [17]. These gaps between our upper bounds and lower bounds narrow the search region for this problem’s capacity.

Fig. 15: Relative entropy of entanglement upper bounds (UB ) and lower bounds with different values of .

V Comparison between CV and DVQKD under Restricted Eavesdropping

In this Section, we present a comparison between achievable rates against a restricted Eve for the Gaussian-modulated CVQKD protocol (with coherent states, heterodyne detection and reverse reconciliation) and the corresponding lower bounds for the DV protocol DS-BB84 () that are derived in Appendix B. For better illustration, we also include the upper bounds from Sec. IV-B.

Fig. 16: Comparison of achievable rates for secret key distillation from TMSV state with heterodyne detection and reverse reconciliation vs. DS-BB84 protocol over a pure loss channel. We choose different values of to show the difference between two protocols. For DS-BB84 (see Appendix B) we set and .

First we look at the pure loss channel. In Fig. 16, we plot the CV achievable rate with reverse reconciliation () and the CV reverse secure key rate when heterodyne detection is performed on both communication sides (), and compare with . Here the CCQ case corresponds to actual CVQKD, where Alice sends Gaussian modulated coherent states and Bob performs heterodyne detection. For generality, in a thermal noise channel (when this goes back to the pure loss channel):

(66)
(67)

the state is

(68)

Here and

are classical differential entropy of corresponding probability distribution and conditional probability distribution. In Fig. 

16, we can see in the pure loss channel for any value of input power, the CV reverse reconciliation scheme generally has rates that are higher than DS-BB84. Also in the analysis of DS-BB84 there is an optimal input photon number which is why we see the peak in those green curves whereas the optimal input photon number in the CV scheme is infinity, and hence the rate keeps increasing with increasing input photon number.

Fig. 17: Comparison between SKRs from: 1. Entanglement-based secret key distillation scheme with heterodyne detection and reverse reconciliation (CQQ), 2. Gaussian modulation reverse reconciliation CVQKD with heterodyne detection (CCQ), 2. DS-BB84 protocol with similar restricted eavesdropping case. Here noise . For DS-BB84 (see Appendix B) we set , and .

Next we look at the thermal noise channel. In Fig. 17, we can see that both and increase with increasing , whereas the DV rate first increases then decreases. This shows us that the optimal input photon number is different between two schemes. We can also see that although in the pure loss channel CVQKD always have higher SKR than DS-BB84, in a thermal noise channel DS-BB84 can have higher rate for certain channel parameters and input mean photon number.

We also plot the comparison between CVQKD and DS-BB84, where the rate of DS-BB84 is optimized over input photon number. The rate for CVQKD is for optimal, i.e., infinite, input photon number. We also plot the capacity against an unrestricted Eve and the relative entropy of entanglement upper bound for reference.

Fig. 18: Comparison between CVQKD SKR and optimized DS-BB84 SKR. Upper bound and unrestricted Eve’s capacity are given as reference lines.

In Fig. 18 we show the comparison between optimized DV and CV rates with thermal noise as a function of the channel loss. We can see that although generally CVQKD has a higher rate, it appears that its achievable rate doesn’t offer a longer distance.

Vi Conclusions and Summary

In summary, we showed lower bounds (achievable rates) for secret key distillation under restricted eavesdropping across pure loss and thermal noise channels based on heterodyne detection. We showed that putting a reasonable restriction on Eve can increase the key rate and extend the transmission range under the same channel conditions. We also showed that unlike the case in unrestricted eavesdropping model, in restricted eavesdropping model direct reconciliation has a potential of providing higher secure key rate under certain channel parameters. Furthermore, for the pure loss channel, we calculated upper bounds using the relative entropy of entanglement, and showed that the former bounds are fairly close to the achievable rates with heterodyne detection, thus nearly being the capacity under the restricted Eve model. We also showed a comparison of achievable rates between Gaussian modulation CVQKD and DS-BB84 protocol under restricted eavesdropping. All our results capture how the key rates and the transmission distances can increase with the assumption of restricted eavesdropping.

One possible avenue for future work is to find the better detection scheme than heterodyne detection or tighter upper bounds under restricted eavesdropping.

Vii Acknowledgements

KPS thanks Mark M. Wilde for valuable discussions. The authors thank Tim Ralph for pointing us to a related work [25]. The authors also gratefully acknowledge financial support from General Dynamics on a QIS IRAD project, and the Office of Naval Research for funding under the Communications and Networking with Quantum Operationally-Secure Technology for Maritime Deployment (CONQUEST) program under contract number N00014-16-C2069, and a MURI program on free-space QKD under contract number N00014-13-1-0627.

References

  • [1] C. H. Bennet and G. Brassard, “Proceedings of the ieee international conference on computers, systems and signal processing, bangalore, india, 1984,” 1984.
  • [2] V. Scarani, H. Bechmann-Pasquinucci, N. J. Cerf, M. Dušek, N. Lütkenhaus, and M. Peev, “The security of practical quantum key distribution,” Rev. Mod. Phys., vol. 81, pp. 1301–1350, Sep 2009. [Online]. Available: https://link.aps.org/doi/10.1103/RevModPhys.81.1301
  • [3] H.-K. Lo, X. Ma, and K. Chen, “Decoy state quantum key distribution,” Phys. Rev. Lett., vol. 94, p. 230504, Jun 2005. [Online]. Available: https://link.aps.org/doi/10.1103/PhysRevLett.94.230504
  • [4] F. Laudenbach, C. Pacher, C.-H. F. Fung, A. Poppe, M. Peev, B. Schrenk, M. Hentschel, P. Walther, and H. Hübel, “Continuous-variable quantum key distribution with gaussian modulation—the theory of practical implementations,” Advanced Quantum Technologies, vol. 1, no. 1, p. 1800011, 2018.
  • [5] E. Diamanti and A. Leverrier, “Distributing secret keys with quantum continuous variables: Principle, security and implementations,” Entropy, vol. 17, no. 9, pp. 6072–6092, 2015. [Online]. Available: http://www.mdpi.com/1099-4300/17/9/6072
  • [6] M. Uysal and H. Nouri, “Optical wireless communications — an emerging technology,” in 2014 16th International Conference on Transparent Optical Networks (ICTON), July 2014, pp. 1–7.
  • [7] S. Wehner, C. Schaffner, and B. M. Terhal, “Cryptography from noisy storage,” Phys. Rev. Lett., vol. 100, p. 220502, Jun 2008. [Online]. Available: https://link.aps.org/doi/10.1103/PhysRevLett.100.220502
  • [8] F. Grosshans and P. Grangier, “Reverse reconciliation protocols for quantum cryptography with continuous variables,” arXiv preprint quant-ph/0204127, 2002.
  • [9] F. Grosshans, N. J. Cerf, J. Wenger, R. Tualle-Brouri, and P. Grangier, “Virtual entanglement and reconciliation protocols for quantum cryptography with continuous variables,” arXiv preprint quant-ph/0306141, 2003.
  • [10] I. Devetak and A. Winter, “Distillation of secret key and entanglement from quantum states,” in Proceedings of the Royal Society of London A: Mathematical, Physical and Engineering Sciences, vol. 461, no. 2053.   The Royal Society, 2005, pp. 207–235.
  • [11] R. Renner and J. I. Cirac, “de finetti representation theorem for infinite-dimensional quantum systems and applications to quantum cryptography,” Phys. Rev. Lett., vol. 102, p. 110504, Mar 2009. [Online]. Available: https://link.aps.org/doi/10.1103/PhysRevLett.102.110504
  • [12] B. Schumacher and M. A. Nielsen, “Quantum data processing and error correction,” Phys. Rev. A, vol. 54, pp. 2629–2635, Oct 1996. [Online]. Available: https://link.aps.org/doi/10.1103/PhysRevA.54.2629
  • [13] R. García-Patrón, S. Pirandola, S. Lloyd, and J. H. Shapiro, “Reverse coherent information,” Physical review letters, vol. 102, no. 21, p. 210501, 2009.
  • [14] M. Horodecki, P. Horodecki, and R. Horodecki, “Unified approach to quantum capacities: towards quantum noisy coding theorem,” Physical review letters, vol. 85, no. 2, p. 433, 2000.
  • [15] V. Vedral, M. B. Plenio, M. A. Rippin, and P. L. Knight, “Quantifying entanglement,” Phys. Rev. Lett., vol. 78, pp. 2275–2279, Mar 1997. [Online]. Available: https://link.aps.org/doi/10.1103/PhysRevLett.78.2275
  • [16] M. Tomamichel, M. M. Wilde, and A. Winter, “Strong converse rates for quantum communication,” IEEE Transactions on Information Theory, vol. 63, no. 1, pp. 715–727, 2017.
  • [17] S. Pirandola, R. Laurenza, C. Ottaviani, and L. Banchi, “Fundamental limits of repeaterless quantum communications,” Nature communications, vol. 8, p. 15043, 2017.
  • [18] M. M. Wilde, M. Tomamichel, and M. Berta, “Converse bounds for private communication over quantum channels,” IEEE Transactions on Information Theory, vol. 63, no. 3, pp. 1792–1817, March 2017.
  • [19] A. Serafini, Quantum Continuous Variables: A Primer of Theoretical Methods, 1st Edition 1st Edition, Ed.   CRC Press, 2017.
  • [20] M. Horodecki, P. Horodecki, and R. Horodecki, “Separability of mixed states: necessary and sufficient conditions,” Physics Letters A, vol. 223, no. 1, pp. 1 – 8, 1996. [Online]. Available: http://www.sciencedirect.com/science/article/pii/S0375960196007062
  • [21] A. Peres, “Separability criterion for density matrices,” Phys. Rev. Lett., vol. 77, pp. 1413–1415, Aug 1996. [Online]. Available: https://link.aps.org/doi/10.1103/PhysRevLett.77.1413
  • [22] A. S. Holevo and R. F. Werner, “Evaluating capacities of bosonic gaussian channels,” Physical Review A, vol. 63, no. 3, p. 032312, 2001.
  • [23] T. Masahiro et al., “Unconstrained distillation capacities of a pure-loss bosonic broadcast channel,” in Information Theory (ISIT), 2016 IEEE International Symposium on.   IEEE, 2016, pp. 2484–2488.
  • [24] M. Takeoka, K. P. Seshadreesan, and M. M. Wilde, “Unconstrained capacities of quantum key distribution and entanglement distillation for pure-loss bosonic broadcast channels,” Physical review letters, vol. 119, no. 15, p. 150501, 2017.
  • [25] N. Hosseinidehaj, N. Walk, and T. C. Ralph, “Optimal realistic attacks in continuous-variable quantum key distribution,” arXiv preprint arXiv:1811.05562, 2018.
  • [26] L. Lami, A. Serafini, and G. Adesso, “Gaussian entanglement revisited,” New Journal of Physics, vol. 20, no. 2, p. 023030, 2018.
  • [27] R. Simon, “Peres-horodecki separability criterion for continuous variable systems,” Phys. Rev. Lett., vol. 84, pp. 2726–2729, Mar 2000. [Online]. Available: https://link.aps.org/doi/10.1103/PhysRevLett.84.2726
  • [28] G. Adesso and F. Illuminati, “Gaussian measures of entanglement versus negativities: Ordering of two-mode gaussian states,” Physical Review A, vol. 72, no. 3, p. 032334, 2005.
  • [29] In practice, the quantum bit error rate is a measured quantity. So, in order to quantify the DS-BB84 protocol’s SKR, we will evaluate on the presumption that Eve does not affect Alice’s single-photon transmissions, in which case is due entirely to the presence of dark counts.

Appendix A Calculating the Relative Entropy of Entanglement Upper Bound

The covariance matrix of an mode Gaussian state is the real symmetric matrix defined by

(69)

where ”{}” denotes the anticommutator . represents the grouped quadrature operators of the modes involved

(70)
(71)

and denotes the quadrature means

(72)

A valid quantum covariance matrix satisfies the Heisenberg uncertainty principle given by

(73)

where

Calculating the upper bounds for the pure loss and thermal noise channels involves finding the closest separable state to the Gaussian entangled state shared across the channel when one share of a TMSV input is transmitted through the channel. This is accomplished using the positive partial transpose (PPT) criterion, which is a necessary and sufficient condition for separability of 1-vs-mode bipartite Gaussian states [26, 27]. The PPT criterion, for a Gaussian state, translates into a condition on its covariance matrix [26, 27]. For a two-mode covariance matrix , the condition reads

(74)

where . Equation (74) is to be understood as the Heisenberg uncertainty principle after one of the two modes has been time reversed, i.e., (in this case the second mode), which corresponds to partial transposition.

For a general entangled two-mode covariance matrix of the form

(75)

the closest separable state can be obtained by writing down a covariance matrix

(76)

(where is an unknown parameter) and determining using Eq. (74) for . The value of such that the smallest eigenvalue of is zero is found to be [28, 17]

(77)

and the covariance matrix for the value of in Eq. (77) corresponds to a separable quantum state. The relative entropy between the states corresponding to in Eq. (75) and in Eq. (76) for given by Eq. (77), when optimized over the input mean photon number gives the upper bounds mentioned in Sec. III against traditional unrestricted eavesdropping [17].

While the closest separable state gives the tightest relative entropy of entanglement upper bound, a close enough separable state still gives a valid upper bound. We give an upper bound for the restricted eavesdropping model by extending the above method. For the three-mode entangled covariance matrix of the form

(78)

that we have in the restricted eavesdropping model, we write down a covariance matrix

(79)

where is an unknown parameter and numerically solve for such that the smallest eigenvalue of is zero. Here,

(80)

The relative entropy between the states corresponding to and of Eqs. (78) and (79) optimized over the input mean photon number is the upper bound we plot in Secs. IV-B and V. The reason for choosing in this form is to simplify the optimization complexity (with only one variable to be solved) and also because we are only concerned with the separability between modes and in the task of distilling secret key (covariance terms other than the covariance between mode and are thus left unchanged). In above calculation we are actually studying the separability of mode and , which is similar to what was discussed in [24] where a second receiver party (Charlie) in broadcast channel assists the communication between Alice and Bob. Also the reason for not considering separating mode from mode is because that would just be studying a quantum channel with different transmissivity with no restrictions on Eve.

Appendix B Restricted Eve Secure Key Rate for DS-BB84

In this appendix we derive the SKR for DS-BB84 with a restricted Eve that we used in Sec. V. As a prelude, however, we reprise a result from [2]—using notation that will be convenient for what follows—for an unrestricted Eve. In both cases, the SKRs are asymptotic-regime results for photon-number splitting attacks. Moreover, for both cases we assume that Alice and Bob use polarization encoding in which all four polarization states are equally likely. In particular, Alice uses a weak coherent-state source that transmits signal-state pulses—containing photons per pulse on average at a rate states/s—over an Alice-to-Bob channel with transmissivity

. She also transmits sufficient decoy states to accurately estimate—in the asymptotic regime—the fraction of her signal pulses that contain single photons. Bob uses 50–50 active basis selection and a pair of single-photon detectors each with quantum efficiency

and dark counts on average per pulse interval .

When Eve is unrestricted, we must assume that she can interact with all the light Alice sends to Bob. From [2] we then have that

(81)

where is Alice and Bob’s Shannon information (in bits/s) and is Alice and Eve’s Shannon information (in bits/s). Alice and Bob’s Shannon information obeys

(82)

where: is the event that Bob gets a total of 1 click from his two detectors during a signal-pulse interval when Alice and Bob use the same basis, making the probability of a sift event; is the sift event in which Bob’s detector click is from the detector associated with the wrong polarization, making the raw-key error probability, a quantity usually called the quantum bit error rate [29];

(83)

is the binary entropy function; and is Alice and Bob’s reconciliation penalty. In words, this formula states that is the sift rate , i.e., the rate at which Alice and Bob choose the same basis and Bob gets a total of 1 click from his detectors, multiplied by Alice and Bob’s Shannon information per sift event , i.e., the entropy of Alice’s transmission to Bob minus the information leaked during reconciliation.

To find Alice and Eve’s Shannon information rate, consider what happens when Alice transmits an -photon signal pulse. When , Eve gets no information. When , Eve gets partial information, but this comes at the expense of her creating errors. When , Eve gets complete information by means of a photon-number splitting attack. Consequently, Alice and Eve’s Shannon information rate obeys

(84)

where is the event that Alice’s signal pulse contains photons. Here, equals Alice and Bob’s sift rate multiplied by the entropy of Alice’s transmission to Bob reduced by entropies of the sift events associated with Alice’s transmission of a 0 photon signal pulse and those of the sift events associated with Alice’s transmission of a 1 photon signal pulse and Eve’s interaction therewith.

The probabilities necessary to instantiate the preceding Shannon information expressions are easily found. The probability of a sift event equals the probability of a click on one of Bob’s detectors and no click on the other detector:

(85)

where is the overall Alice-to-Bob transmissivity (the channel transmissivity times the detector quantum efficiency) and we have used statistically independent Poisson statistics for the counts generated by each detector. We have that , where the joint probability of Alice sending 0 photons and that transmission’s resulting in a sift event is

(86)

Similarly we have that , where the joint probability of Alice sending 1 photon and that transmission’s resulting in a sift event is

(87)
(88)

Bob’s conditional error probability for a sift event, given Alice sent 1 photon, is thus

(89)