Secure Coherent-state Quantum Key Distribution Protocols with Efficient Reconciliation

G. Van Assche¹, S. Iblisdir^1,2 and N. J. Cerf¹

Table of Contents

Abstract

1 Introduction

Quantum key distribution (QKD), also called quantum cryptography, allows two parties, Alice and Bob, to share a secret key that can be used for encrypting messages using a classical cipher, e.g., the one-time pad. The main interest of such a key distribution scheme is that any eavesdropping is, in principle, detectable as the laws of quantum mechanics imply that measuring a quantum state generally disturbs it.

The resources required by QKD comprise a source of non-orthogonal quantum states on Alice's side, a quantum channel conveying these states to Bob, a measuring apparatus on Bob's side, and a (public) authenticated classical channel between Alice and Bob. In addition to being used to generate a secret key, the quantum channel is subject to probing by the legitimate parties, so as to determine how many secret bits can be generated.

Most interest in QKD has been devoted to protocols involving (an approximation to) a single-photon source on Alice's side and a single-photon detector on Bob's side (see [1] and the references therein). However, protocols involving quantum continuous variables have been considered with an increasing interest [2, 3, 4, 5]. Of special importance are coherent-state protocols [6, 7]. The quantum source at Alice's side randomly generates coherent states of a light mode with Gaussian-distributed quadratures, and Bob's measurements are homodyne measurements. These protocols seem to allow for facilitated implementations and higher secret-key generation rates than the protocols involving single-photon sources [7].

Consequently, there is an increasing interest for studying the security of coherent state protocols under general classes of attacks. Individual Gaussian attacks are considered in [6, 7], and are found to be optimal in the more general class of finite-width non-Gaussian incoherent attacks [8]. Individually-probed collective attacks are also considered in [9, 10]. The recent techniques of [11, 12] do not make any assumptions on the eavesdropper's technology and are also considered in [9, 10] for coherent state protocols, although giving lower secret key rates.

In this paper, we study the security of a prepare-and-measure QKD protocol [6, 7] by establishing its equivalence to an entanglement purification (EP) protocol, which produces maximally-entangled qubit pairs. A maximally-entangled qubit pair is by definition completely factored from its environment, and thus the values obtained by measuring each side are fully correlated and secret. The equivalent prepare-and-measure QKD protocol also enjoys this property. This particular technique thus allows one to relieve from any assumptions on the eavesdropper's strategy and was used in [13] to assess the security of the BB84 protocol and in [3] for a squeezed state protocol. More recently, this technique was extended to the case of coherent state protocols [14].

To show the equivalence between a QKD protocol and of an EP protocol, one has to explicitly take into account the secret key distillation, that is, the techniques used to make Alice's and Bob's keys equal (reconciliation) and fully secret (privacy amplification). In [13], the EP protocol uses CSS quantum codes [15, 16], which are equivalent in QKD to reconciliation with syndromes of binary linear codes and privacy amplification by multiplication with a parity-check matrix. In contrast to BB84, the modulation of coherent states in the protocol we consider here is continuous, therefore producing continuous key elements from which to extract a secret key. Reconciliation of a Gaussian-distributed key was studied in [17], and a generic protocol called sliced error correction was designed so as to distill a binary key.

In contrast to [14], the EP protocol is constructed in such a way that it is equivalent to a QKD protocol with sliced error correction for reconciliation. The advantage is the higher secret key rate and the better resistance to attenuation that one can achieve. In particular, more than one maximally-entangled pair (or secret key bit) can be produced per coherent state. Furthermore, thanks to its generality, the asymptotic efficiency of the EP protocol inherits to some extent from the asymptotic efficiency of the classical reconciliation protocol.

The paper is organized as follows. First, in Sec. 2, we macroscopically describe the formal EP protocol and its equivalent QKD protocol that are used throughout the paper. Then, in Sec. 3, we show how the channel can be probed so as to determine the number of secret key bits that Alice and Bob can generate. The encoding of qubits, that is, the generalization of sliced error correction to EP, is described in Sec. 4. Then, Sec. 5 deals with the important particular case of an attenuation channel. Finally, the asymptotic properties of the qubit encoding scheme are detailed in Sec. 6.

2 From Entanglement Purification to Secret Key Distillation

After we review the case of EP using CSS codes and its equivalence to BB84, we give a high-level description of a QKD protocol based on EP. We consider this protocol as formal, that is, we do not expect a physical implementation of it. Instead, we propose a prepare-and-measure QKD protocol, derived from the formal one, which also encompasses error correction and privacy amplification.

2.1 Binary CSS codes

In the case of BB84, the CSS codes can readily be used to establish the equivalence between an EP protocol and a QKD protocol [13]. Since we will use CSS codes as an ingredient for the EP and QKD protocols below, let us briefly review their properties.

Starting from the Einstein-Podolski-Rosen (EPR) state

Let C1 and C2 be two binary error correcting codes of n bits (i.e., C1 and C2 are vector spaces of F2n) with parity check matrices H1 and H2, resp. They are chosen such that {0}⊂C2⊂C1⊂F2n. A CSS code is a k-dimensional subspace of Hn, the Hilbert space of n qubits, with k=dim⁡C1-dim⁡C2 [15, 16]. The code C1 allows to correct bit errors, while C2⊥ (the dual code of C2) allows to correct phase errors—one important property of the CSS codes is to be able to correct bit errors and phase errors independently.

For entanglement purification, Alice and Bob must compare their syndromes, both for bit errors and phase errors. The relative syndrome determines the correction that Bob must apply to align his qubits to Alice's. Translating this into the BB84 protocol, one can show [13] that the relative syndrome for bit errors in the EP protocol is equal to the relative syndrome for bit errors that Alice and Bob would have reconciled in the BB84 protocol. So, reconciliation can be done using the C1 code. Phase errors of the EP protocol do not have such a direct equivalent in the BB84 protocol: The prepare-and-measure protocol works as if Alice measured her part of the state in the {|0〉,|1〉} basis, thereby discarding information on the phase. However, one does not really need to correct the phase errors in the BB84 protocol. Instead, if C2⊥ would be able to correct them in the EP protocol, the syndrome of C2 in C1 of Alice and Bob's bit string turns out to be a valid secret key in the prepare-and-measure protocol. Stated otherwise, H1 determines the syndrome Alice has to send to Bob to perform reconciliation, while H2 determines the way the final key is computed for privacy amplification.

Overall, the number of secret key bits is thus k=dim⁡C1-dim⁡C2, provided that C1 (resp. C2⊥) is small enough to correct all the bit (resp. phase) errors. When considering asymptotically large block sizes, the CSS codes can produce

We conclude this section by noting that the bit error rate eb determines the number of bits revealed by reconciliation (asymptotically h⁡(eb)), whereas the phase error rate ep determines the number of bits discarded by privacy amplification due to eavesdropping (asymptotically h⁡(ep)).

2.2 Quantum key distribution based on entanglement purification

In BB84, the modulation of qubits can be transposed as if Alice prepares a |φ+〉 state and measures her part. In the case of the QKD protocol with Gaussian-modulated coherent states, the formal state that Alice prepares is of course different, as it must reduce to the proper modulation when Alice measures her part. We define the formal state as:

where g⁡(x,p) denotes a bi-variate Gaussian distribution g⁡(x,p)=G1⁡(x)⁢G2⁡(p). The kets |x〉, |p〉, |x+i⁢p〉 are shorthand notations for respectively a x-quadrature eigenstate with eigenvalue x, a p-quadrature eigenstate with eigenvalue p and a coherent state whose x mean value equals x and whose p mean value equals p. The subscripts a1, a2 (resp. b) denote that the system is lying on Alice's side (resp. Bob's side).

The state (2.3) does not have a direct physical meaning. In particular, the systems a1 and a2 must be understood as classical pointers, e.g., resulting from the (formal) homodyne measurement of an EPR state as studied in [18].

In the entanglement purification picture, the b part of the system is sent to Bob (and possibly attacked by Eve) and the a part stays at Alice's station. If Alice measures x in a1 and p in a2, the state is projected as if Alice sent Bob a coherent state centered on x+i⁢p.

Let us now describe the EP protocol, which reduces to the prepare-and-measure QKD protocol described further.

• Alice creates l+n copies of the state |Ψ〉, of which she sends the b part to Bob.
• Bob acknowledges reception of the states.
• Out of the l+n states, n will serve for estimation purposes. These states are chosen randomly and uniformly by Alice, who informs Bob about their positions.
• For the remaining l states, Alice and Bob perform entanglement purification, so as to produce r⁢l (0≤r≤1) states very close to |φ+〉. Measured in the computational bases, the produced states yield r⁢l secret bits on both Alice's and Bob's sides.

The details of the EP procedure, which uses CSS codes as an ingredient, are given in Sec. 4, while the estimation is detailed in Sec. 3.

2.3 Prepare-and-measure quantum key distribution

By virtually measuring the a part of the state |Ψ〉, the protocol above reduces to the following one.

• Alice modulates l+n coherent states |x+i⁢p〉 that she sends to Bob. The choice of the values of x and p follow the distribution |g⁡(x,p)|2=G1⁡(x)⁢G2⁡(p).
• Bob acknowledges reception of the states.
• Out of the l+n states, n will serve for estimation purposes. These states are chosen randomly and uniformly by Alice, who informs Bob about their positions.
• For the remaining l states, Bob measures x. Alice and Bob perform secret key distillation (reconciliation and privacy amplification), so as to produce r⁢l secret bits.

The reconciliation and privacy amplification procedures are based on classical error correcting codes, which derive from the CSS codes used in the formal EP protocol.

3 Error Rates Estimation using Tomography

In QKD protocols derived from EP, an important step is to show how one can infer the bit and phase error rates of the samples that compose the key. A fraction of the samples sent by Alice to Bob are sacrificed so as to serve as test samples. By randomly choosing them within the stream of data, they are statistically representative of the whole stream.

In [3, 13], one can simply make measurements and directly count the number of bit and phase errors from the results. This is possible since Bob's apparatus can measure both bit and phase values. In [14], however, it is not possible to measure directly phase errors. Yet some data post-processing can be applied on measurements so as to infer the number of phase errors in the stream of data. In this section, we wish to show that we can extend this to more general (and more efficient) encodings of qubits (in the EP picture) or bits (in the derived QKD protocol).

The encoding of bits will be described in a further section—for the moment, the qubit pair system (i.e., one among possibly several ones), which Alice and Bob will process using CSS codes, is abstractly represented by its Pauli operators acting in a1: Zs (phase flip) and Xs (bit flip), and in b: Ze and Xe. (The subscripts s and e stand for slice and estimator, resp., to follow the convention of the following sections.) The bit errors are assumed to be easy to determine, that is, Zs has a diagonal expansion in |x〉a1〈x|, and Ze can directly be determined by a single homodyne measurement on b. This ensures, in the derived prepare-and-measure QKD protocol, that Alice knows the bit value she sent, and Bob can determine the received bit value. A measurement of the observable XsIa2Xe associated to the phase error rate, however, cannot be implemented by a single homodyne measurement on b. Therefore, we have to invoke quantum tomography with a quorum of operators [19] to get an estimate of the phase error rate.

3.1 Estimating phase errors in the average state

In the EP picture, let ρ(n) be the state of the n samples used for estimation of the phase error rate (i.e., n instances of the a1a2b system). To count the number of phase errors in a set of n samples, one needs to measure O=XsIa2Xe on the n samples and sum the results (with Ia2 the identity in the system a2). This is equivalent to measuring O(n)=∑iIa1a2b⊗i-1⊗XsIa2Xe⊗Ia1a2b⊗n-i. If the true phase error probability in the n+l samples is ep, the error variance is σ12=2⁢ep(1-ep)/n, and thus the probability of making an estimation error of more than Δ is [3, 13] asymptotically exp⁡(-Δ2n/4ep(1-ep)). It is easy to see that

If the measurement of O=XsIa2Xe cannot be made directly, one instead looks for a quorum of operators Qλ such that O=∫ⅆλ⁢o⁡(λ)⁢Qλ; estimating 〈O〉 comes down to measuring several times Qλ for values of λ chosen randomly and independently of each other, and averaging the results weighted by o⁡(λ): O≈∑i⁡o⁡(λi)⁢Qλi [19]. If the values of λ are chosen independently of the sample index on which Qλ is applied, we get unbiased results, as Tr⁡(O⁢ρ)=Eλ⁡[Tr⁡(Qλ⁢ρ)], with E the expectation. Of course, the estimation of Tr⁡(O⁢ρ) with a quorum cannot be perfect and an estimation variance σ22 must also be considered and added, σ2=σ12+σ22.

3.2 Estimating phase errors using coherent states and homodyne detection

We now explain how the phase error rate can be estimated, in principle, using coherent states modulated in both quadratures and homodyne detection in all quadratures.

It is clear that the knowledge of matrix elements of the average state ρ gives the knowledge of 〈O〉. Let ρ0=|Ψ〉〈Ψ| be the state that Alice and Bob would share if the transmission was perfect. Since the a part of the system stays at Alice's station, we only need to learn about how the b part of the system is affected. In the prepare-and-measure picture, let T be the completely positive (CP) map that maps the states sent by Alice onto the states received by Bob, (Id⊗T)⁡(ρ0)=ρ. In particular, let the coherent state |x+i⁢p〉〈x+i⁢p| be mapped onto ρT⁡(x+i⁢p) and the (pseudo-)position state |x〉〈x′| be mapped onto ρT⁡(x,x′). The functions ρT⁡(x+i⁢p) and ρT⁡(x,x′) are related by the following identity:

By inspecting Eq. (3.3), it seems that due to the factors e-S2/8⁢N0 and e-D2/8⁢N0, two different CP-maps T and T′ may make ρT⁡(x+i⁢p) and ρT′⁡(x+i⁢p) only vanishingly different. It thus seems unlikely that Eq. (3.3) should allow us to extract the coefficients ρT⁡(x+S+D,x+S-D). However, assuming that T depends only on a finite number of parameters, a variation of these parameters will induce a measurable variation of ρT⁡(x+i⁢p). We will now discuss why it is reasonable to make such an assumption.

Due to the finite variance of the modulation of coherent states, the probability of emission of a large number of photons vanishes—this intuitively indicates that we only need to consider the description of T for a bounded number of emitted photons. More precisely, one can consider the emission of w joint copies of the state ρ0b=Tra⁡(ρ0). For w sufficiently large ρ0b⊗w can be represented in the typical subspace Γδ⁡(ρ0b) of dimension not greater than 2w⁢(H⁡(ρ0b)+δ), for any δ>0 [20], where H⁡(ρ) is the Von Neumann entropy of a state ρ. The probability mass of ρ0b⊗w outside the typical subspace can be made arbitrarily small and does not depend on the eavesdropping strategy. This means that the support for the input of T has finite dimension, up to an arbitrarily small deviation.

The number of photons received by Bob can also be upper bounded. Alice and Bob can first assume that no more than nmax photons are received. This fact may depend on a malicious eavesdropper, so Bob has to do hypothesis testing. The test comes down to estimating 〈Π〉 with Π=∑n>nmax|n〉〈n|. If the threshold is well chosen so that n>nmax never occurs, we can apply the central limit theorem and upper bound the probability that 〈Π〉>ε for any chosen ε>0. The positivity of the density matrices implies that the off-diagonal coefficients are also bounded. We can thus now express ρT⁡(x+i⁢p) as ρT⁡(x+i⁢p)=∑n,n′≤nmaxρT⁡(x+i⁢p,n,n′)⁢|n〉〈n′|. Note that the test can be implemented either by explicitly measuring the intensity of the beam (therefore requiring an additional photodetector) or by exploiting the correlation between the high intensity of the beam and the high absolute values obtained when doing homodyne measurements in all directions.

Finally, the estimation of the coefficient of |n〉〈n′| can be done with arbitrarily small statistical error using homodyne detection in all directions [19, 21]. This is achieved by considering the quorum of operators (xθ)0≤θ<2⁢π, where xθ=cos⁡θx+sin⁡θp denotes the amplitude of the quadrature in direction θ. Considering a finite combination of arbitrarily small statistical errors on parameters also gives arbitrarily small overall statistical error on the phase error rate.

4 Encoding of Multiple QuBits in an Oscillator

Reconciliation and privacy amplification are integral parts of the prepare-and-measure protocols derived from entanglement purification protocols. In our case, we wish to derive a prepare-and-measure protocol with sliced error correction (SEC) [17] as reconciliation, which allows us to obtain a higher secret key rate and a better resistance to losses than in [14]. We therefore need to describe an entanglement purification procedure that reduces to SEC when the corresponding prepare-and-measure protocol is derived. An overview of SEC is proposed next.

4.1 Sliced error correction with invertible mappings

We here recall the main principles of SEC in a form that is slightly different from the presentation in [17]. To suit our needs, we here describe SEC in terms of invertible functions giving the slices and the estimators—the invertibility property will be required when we generalize SEC to entanglement purification. Also, from the generality of [17], two parameters are fixed here: Binary error correction is operated by sending syndromes of classical linear error-correcting codes (ECC), and we momentarily restrict ourselves to the case of scalar values.

Suppose Alice and Bob have l pairs of correlated random variables (X1,X1′),…,(Xl,Xl′), with Xi,Xi′∈R, i=1…l, from which they intend to extract common bits.

First, Alice wishes to convert each of her variables X into m bits and thereby defines m binary functions: S1⁡(X),…,Sm⁡(X). To make the mapping invertible, she also defines a function S¯⁡(X) such that mapping from X to the vector (S¯⁡(X),S1…m⁡(X)) is bijective. As a convention, the range of S¯⁡(X) is [0;1]. The mapping from R to [0;1]×{0,1}m:

Concretely, the functions Si⁡(X) implicitly cut the real line into intervals (see [17] for more details), whereas S¯⁡(X) indicates where to find X within a given interval.

Then, we can assemble the bits produced by the l random variables X1…Xl into m l-bit vectors. To each bit vector ("slice") Si⁡(X1…l)=(Si⁡(X1),…,Si⁡(Xl)), is associated an ECC that Alice and Bob agreed upon. To proceed with the correction, Alice sends the syndrome ξib=Hib⁢Si⁡(X1…l) to Bob over the public authenticated channel, where Hib is the lib×l parity check matrix of the ECC associated to slice i. Alice also sends S¯⁡(X1…l).

Bob would like to recover S1…m⁡(X1…l) from his knowledge of X1…l′, ξ1…mb and S¯⁡(X1…l). To do so, he also converts each of his variables X1…l′ into m bits, but he does so in a consecutive manner. He tries to produce bits that are best correlated to Alice's and takes advantage of the corrected bits of slices j<i before trying to estimate the bits of slice i. In particular, to produce bits that are best correlated to Alice's first slice S1⁡(X1…l), he uses a function E1⁡(X′,S¯⁡(X)), which gives his best estimate on Alice's corresponding bit S1⁡(X) given the known correlations between X and X′. By applying the function E1 on all the variables X1…l′ and S¯⁡(X1…l), Bob is able to construct a string of l bits that is equal to Alice's up to some error rate e1b. Given the knowledge of ξ1b and assuming the adequacy of the ECC, Bob has enough information to determine S1⁡(X1…l) with high probability. Then, for slice i>1, he estimates Si⁡(X1…l) using the estimator function Ei⁡(X′,S¯⁡(X),β1,…,βi-1), where βj is the random variable indicating Bob's knowledge of Sj⁡(X), so that βj=Sj⁡(X) with arbitrarily high probability. (Note that the estimators can also be written as jointly working on l samples at once: Ei⁡(X1…l′,S¯⁡(X1…l),ξ1b,…,ξi-1b), but we will preferably use the previous notation for its simplicity since, besides the ECC decoding, all the operations are done on each variable X or X′ independently.)

We also need a supplementary function to ensure that the process on Bob's side is described using bijective functions: E¯⁡(X′,S¯⁡(X),β1,…,βm) (or jointly E¯⁡(X1…l′,S¯⁡(X1…l),ξ1b,…,ξmb)). As a convention, the range of E¯⁡ is [0;1]. E¯ is chosen so that the mapping E defined below is invertible,

Similarly to S, the functions E1…m of E cut the real line into intervals. However, these intervals are adapted as a function of the information sent by Alice, so as to estimate Alice's bits more reliably. Like for S¯, the function E¯ indicates where to find X′ within an interval.

The mapping S summarizes Alice's process of conversion of her real values X into m bits (plus a continuous component). The mapping E represents the bits (and a continuous component) produced by Bob from his real values X′ and his knowledge of S¯⁡(X) and of the syndromes ξ1…mb. The bits produced by the functions Ei are not yet corrected by the ECC, even though they take as input the corrected values of the previous slices Sj⁡(X), j<i. The description of the mapping E with the bits prior to ECC correction allows us to easily express the bit error rate between Alice's slices and Bob's estimators and thereby to deduce the size of the parity matrices of the ECCs needed for the binary correction. Simply, we define eib=Pr[Si⁡(X)≠Ei⁡(X′,S¯⁡(X),S1…i-1⁡(X))]. As the block size l→∞, there exist ECCs with size lib→l⁢h⁡(eib) and arbitrarily low probability of decoding error. The number of common (but not necessarily secret) bits produced by SEC is therefore asymptotically equal to H⁡(S1…m⁡(X))-∑i=1mh⁡(eib) per sample [17].

The generalization of the SEC to a quantum entanglement purification protocol is examined next.

4.2 Quantum sliced error correction

From classical binary error correcting codes, one can construct CSS quantum codes and use them to extract EPR pairs from noisy qubit pairs. We will now show that, similarly, from SEC, it is possible to construct an encoding and decoding procedure, which when applied on entangled quantum oscillator systems, also allows to extract pure EPR pairs. Such a purification protocol is formal, as it would of course be very difficult to implement in practice.

The purification uses a few quantum registers, which we now list. Alice's system a1 is split into m qubit systems s1…m and a continuous register s¯. On Bob's side, the system b is split into m qubit systems e1…m and a continuous register e¯. He also needs m qubit registers s1…m′ for temporary storage. All these registers must of course be understood per exchanged sample: As Alice generates l copies of the state |Ψ〉, the legitimate parties use l instances of the registers listed above.

The usual bit-flip and phase-flip operators X and Z, resp., can be defined as acting on a specific qubit register among the systems si and ei. E.g., Zsi is defined as acting on si only. These operators are used by Alice and Bob to construct the CSS codes that produce entangled qubits, which are in turn used to produce EPR pairs in the registers siei for i=1…m. Since each CSS code operates in its own register pair, the action of one does not interfere with the action of the other. It is thus possible to extract more than one EPR pair |φ+〉 per state |Ψ〉. If asymptotically efficient binary codes are used, the rate or EPR pairs produced is R=∑i(1-h⁡(eib)-h⁡(eip)), where eib (resp. eip) indicates the bit error rate (resp. the phase error rate) [13].

The process that defines the content of the registers is described next.

4.2.1 The mappings QS and QE

First, we define the unitary transformation QS: L2⁡(R)→L2⁡([0;1])⊗H⊗m by its application on the basis of quadrature eigenstates:

Figure 4.1: Schematic description of QS

For each slice i, Alice and Bob agree on a CSS code, defined by its parity matrices Hib for bit error correction and Hip for phase error correction. For the entanglement purification, let us assume that Alice computes the syndromes of the CSS code with a quantum circuit. For each slice, she produces lib qubits in the state |ξib〉 and lip qubits in the state |ξip〉 that she sends to Bob over a perfect quantum channel, so that the syndromes are received without any distortion. In the entanglement purification picture, the syndromes can be transmitted over a non-perfect channel if they are encoded using appropriate error correcting codes. Also, after reduction to a prepare-and-measure protocol, this perfect transmission is actually done over the public authenticated channel. Alice also sends the s¯ system to Bob.

Then, the slice estimators are defined as the unitary transformation QE from L2⁡([0;1])⊗H⊗m⊗L2⁡(R) to L2⁡([0;1])⊗H⊗m⊗H⊗m⊗L2⁡([0;1]):

Figure 4.2: Schematic description of QE and the use of the systems s1…m′

Assume that Bob first calculates, using a quantum circuit, the first slice estimator (classically: E1(X′,S¯⁡(X))), which does not depend on any syndrome. That is, he applies the following mapping, defined on the bases of s¯ and b: |s¯〉s¯|x′〉b→|s¯〉s¯|E1⁡(x′,s¯)〉e1|E¯1⁡(x′,s¯)〉e¯1 (up to normalization), where the function E¯1 is needed only to make the mapping unitary. From the l qubits in the l systems e1 and the syndrome sent by Alice |ξ1b〉, there exists a quantum circuit that calculates the relative syndrome of Alice's and Bob's bits, that is a superposition of the classical quantities ξ1b⊕H1bE1⁡(X1…l). From this, a quantum circuit calculates the coset leader of the syndrome, that is (a superposition of) the most probable difference vector between Alice's and Bob's qubits. An extra l-l1b blank qubits are needed for this operations; we assume they are all initialized to |0〉:

Following this approach for the next slices, we can define: |s¯〉s¯|s1〉s1′|E1⁡(x′,s¯)〉e1|E¯1⁡(x′,s¯)〉e¯1→|s¯〉s¯|s1〉s1′|E1⁡(x′,s¯)〉e1|E2⁡(x′,s¯,s1)e2|E¯2⁡(x′,s¯,s1)〉e¯2, and reasonably assume that the bit value given in s1′ is equal to Alice's S1⁡(X). This reasoning can be applied iteratively, so as to fill the system s1…m′ with all the corrected bit values, and with an extra step to set E¯⁡(x′,s¯,s1…m) in e¯.

As a last step, Bob can revert the ECC decoding operations and come back to the situation where he has blank qubits in s1…m′ as depicted in Fig. 4.2.

Finally, the qubits produced by QE can be transformed into EPR pairs using the CSS codes and the syndromes Alice sent to Bob.

4.2.2 Phase coherence

Neither the unitary transformation QS nor QE take into account the modulation of the coherent state in the p-quadrature. By ignoring what happens in the a2 system of Eq. (2.3), the reduced system ρa1b lacks phase coherence:

Actually, we could formally include this a2-dependent operation in the QE mapping, by adding |p〉a2 to its input and output (unmodified) and by multiplying by a factor of the form ei⁢x′⁢p/4⁢N0 in Eq. (4.4), with N0 the vacuum fluctuations. For notation simplicity, however, we mention it here without explicitly writing it.

Also, for the simplicity of the notation in the next section, we can assume without loss of generality that the coefficients of |Ψ〉 in the x-basis of b are real, after adjustment by Bob as a function of p.

4.2.3 Construction of S¯ and E¯

Let us now make explicit the construction of the functions S¯ and E¯. First assume, for simplicity, that we have only one slice (m=1)—for this we do not write the slice index as a subscript. The mapping has thus the following form:

Let us take some state ρ of the systems ss¯ee¯. In the entanglement purification picture, our goal is to be able to extract entangled pairs in the subsystem ρse=TrAll∖{s,e}⁡(ρ). We thus want ρ to be a product state of the form ρse⊗ρs¯e¯. If S¯⁡(X) contains information about S⁡(X), or if E¯⁡(X′,S¯⁡(X),S⁡(X)) contains information about E⁡(X′,S¯⁡(X)), the subsystem ρse will not be pure. In the prepare-and-measure picture, information on S⁡(X) in S¯⁡(X) will be known to Eve and therefore may not be considered as secure. Note that information in E¯⁡(…) is not disclosed, but since it is excluded from the subsystems from which we wish to extract entanglement (or secrecy), any correlation with e¯ will reduce the number of entangled qubits (or secret bits); or stated otherwise, the calculated number of secret bits will be done as if E¯⁡(…) was public. As an extreme example, if S⁡(X) and E⁡(X′,S¯⁡(X)) are perfectly correlated and if S⁡(X) can be found directly as a function of S¯⁡(X), then ρse will be of the form ρse=p0⁢|00〉〈00|+p1⁢|11〉〈11|, which does not allow us to extract any EPR pairs, or equivalently, does not contain any secret information. Consequently, S¯ and E¯ should be as statistically independent as possible of S and E.

We define S¯ and E¯ as the following cumulative probability functions: S¯⁡(x)=Pr⁡[X≤x|S⁡(X)=S⁡(x)] and E¯⁡(x′,s¯,s)=Pr⁡[X′≤x′|S¯⁡(X)=s¯,S⁡(X)=s,E⁡(X′,s¯)=E⁡(x′,s¯)]. By definition, these functions are uniformly distributed between 0 and 1, independently of the other variables available to the party calculating it (Alice for S¯ and Bob for E¯). These functions also enjoy the property of making the subsystem ρse pure in absence of eavesdropping (i.e., when ρ is pure), indicating that this choice of S¯ and E¯ does not introduce more impurity in ρse than ρ already has.

For a pure state |ψ〉=∫ⅆxⅆx′f⁡(x,x′)|x〉a1|x′〉b, with |x〉a1 (resp. |x′〉b) an x-eigenstate in a1 (resp. in b), the application of QS and QE gives:

When more than one slice is involved, the functions S¯ and E¯ are defined similarly:

5 The Attenuation Channel

We now apply the slicing construction and display some results on the rates one can achieve in an important practical case. These results serve as an example and do not imply an upper bound on the achievable rates or distances. Instead, they can be viewed as lower bounds on an achievable secure rate in the particular case of an attenuation channel with given losses. Stated otherwise, this section simulates the rates we would obtain in a real experiment where Alice and Bob would be connected by an attenuation channel. For more general properties of the construction, please refer to Sec. 6.

The purpose of this section is twofold. First, we wish to illustrate the idea of the previous section and show that it serves realistic practical purposes. Beyond the generality of the sliced error correction, its implementation may be easier than it first appears. Furthermore, the purification (resp. distillation) of more than one qubit (resp. bit) per sample is useful, as illustrated below.

Second, it is important to show that the construction works in a case as important as the attenuation channel. Clearly, requesting that a QKD protocol yields a non-zero secret key rate under all circumstances is unrealisitic—an eavesdropper can always block the entire communication. On the other hand, a QKD protocol that would always tell Alice and Bob that zero secure bits are available would be perfectly secure but obviously also completely useless. Of course, between these two extreme situations, the practical efficiency of a QKD protocol is thus important to consider.

The attenuation channel can be modeled as if Eve installed a beam-splitter in between two sections of a lossless line, sending vacuum at the second input. We here assume that Alice sends coherent states with a modulation variance of 31⁢N0, with N0 the vacuum fluctuations, which gives Alice and Bob up to I⁡(A;B)=2.5 common bits in absence of losses or noise. This matches the order of magnitude implemented in [7]. We define the slices S1 and S2 by dividing the real axis into four equiprobable intervals labeled by two bits, with S1 representing the least significant bit and S2 the most significant one. More precisely, S1⁡(x)=0 when x≤-τ or 0<x≤τ and S1⁡(x)=1 otherwise, with τ=2×31⁢N0⁢erf-1⁡(1/2), and S2⁡(x)=0 when x≤0 and S2⁡(x)=1 otherwise.

In this constructed example, we wish to calculate the theoretical secret key rate we would obtain in an identical setting. For various loss values, the secret key rates are evaluated by numerically calculating Tr⁡((Zsi⊗Zei)⁢ρ), to obtain the bit error rates of slices i=1,2 and Tr⁡((Xsi⊗Xei)⁢ρ) to obtain the phase error rates. Then, assuming asymptotically efficient binary codes, the rate is R=R1+R2=∑i=1,2(1-h⁡(eib)-h⁡(eip)).

Using this two-slice construction, we were able to get the EPR rates described in Fig. 5.1. For the case with no losses, it is thus possible to distill R=0.752+0.938=1.69 EPR pairs per sample. Also, note that the phase error rate increases faster with the attenuation for ρ2 than for ρ1, with ρi=ρsiei=TrAll∖{si,ei}⁡(ρ). This intuitively follows from the fact that the information Eve can gain from her output of the beam splitter affects first the most significant bit contained in S2⁡(X).

Due to the higher bit error rate in ρ1, it was not possible to distill EPR pairs in slice 1 with losses beyond 0.7 dB. It was however still possible to distill EPR pairs in slice 2, up to 1.4 dB losses (about 10km with fiber optics with losses of 0.15dB/km). This result does not pose any fundamental limit, as it can vary with the modulation variance and with the choice of the functions S1 and S2. Note that the slice functions could be optimized in various ways, one of which being to use other intervals (as done in [17], not necessary equiprobable and possibly chosen as a function of the losses), and another being to consider multi-dimensional slices as explained in the next section.

Finally, note that although this example involves a Gaussian channel, this particularity is not exploited here and such a calculation can be as easily done for a non-Gaussian attack.

6 Asymptotic Behavior

In this section, we study the behavior of the slice construction when the slice and slice estimator mappings take as input a block of w states, with w arbitrarily large. In [17], the classical sliced error correction is shown to reduce to Slepian-Wolf coding [22] (asymmetric case with side-information) when using asymptotically large block sizes. We here study the quantum case, which is different at least by the fact that privacy amplification is explicitly taken into account.

For simplicity of the notation, we will study the asymptotic behavior in the case of an individually-probed channel only (although Eve's measurement can be collective). A study of periodic probing with period much smaller than the key size would give the same results, since in both cases it allows us to consider a sequence of identical random experiments and to study the typical case. However, joint attacks, with width as large as the key size, are outside the scope of this section, as the statistical tools presented here would not be suitable.

It is important to stress out that we here investigate what the secret key rates would be if the actual channel is an individually-probed one. The use of the protocol of this paper still requires to evaluate the phase error rate in all cases and this quantity is sufficient to determine the number of secret key bits. In the case of joint attacks, the secret key rates stated in the special cases below would then differ from the one obtained using the phase error rate.

6.1 Direct reconciliation

We thus here consider a block of w states and the functions S, S¯, E and E¯ on blocks of w variables as well. Among the qubits produced by QS, there is a certain number of them whose disclosed value allows Alice and Bob to correct (almost) all bit errors for the remaining slices. Then, among the remaining slices, a certain number of qubits allows Alice and Bob to correct (almost) all phase errors for the rest of the qubits. These last qubits are thus equivalent to secret key bits in the prepare-and-measure protocol.

We consider the following state, with the action of the channel modeled as joining system b with that of an eavesdropper Eve, and with p left out as a public classical parameter:

Consider a mapping U from R to a finite set U of size 2m, for some sufficiently large m, such that I⁡(U⁡(X);X′)≥I⁡(X;X′)-εU. Let S¯⁡(X) be the remaining continuous information not contained in U⁡(X), defined as in Sec. 4.2.3. Let x⁡(s¯,u) be the mapping that recovers x from S¯⁡(x) and U⁡(x).

We here recall some definitions from [23]. For a given value of s¯(w) and p(w) (s¯(w),p(w)∈Rw), a HSW code [20, 24] B is a subset of Uw such that the corresponding w-wide states |φ(w)⁡(x(w)⁡(s¯(w),u(w)),p(w))b(w),eve, u(w)∈B, can be distinguished by Bob with probability at least 1-ε. A privacy amplification (PA) set E is a subset of Uw such that the sum of the corresponding states ∑u(w)∈E|φ(w)⁡(x(w)⁡(s¯(w),u(w)),p(w))〉b(w),eve factors Eve. Finally, a key generation code B is a HSW code that can be divided into a collection of non-overlapping PA sets B=∪kEk. In the sequel, we drop the w superscript for simplicity.

Consider three consecutive ranges I=1…|I|, J=|I|+1…|I|+|J|, K=|I|+|J|+1…|I|+|J|+|K| with sizes |I|=⌈w⁢H⁡(U⁡(X)|X′)+ε⌉, |J|=⌈w⁢I⁡(U⁡(X);E)⌉ and |K|=⌊w⁢I⁡(U⁡(X);X′)-w⁢I⁡(U⁡(X);E)-ε⌋. Note that |I|+|J|+|K|≤w⁢H⁡(U⁡(X))+2≤w⁢m+2. These three ranges will correspond to three kind of slices in the derived prepare-and-measure protocol: SI, SJ and SK. SI will give Bob enough information to perform error correction, SJ will contain bits, equal between Alice and Bob, which will be sacrificed with PA since they are not necessarily secret, and SK will contain equal and secret bits (i.e., key bits).

From [23], it is possible to cover the space of w⁢m+2-bit vectors with 2|I| key generation codes CsI of size 2|J|+|K|. To each element of Uw, we assign a |I|-bit vector that identifies the key generation code it belongs to; this defines the first |I| slices SI⁡(X).

By providing the bit syndromes ξIb to Bob, he can identify SI⁡(X)=sI and the associated key generation code CsI. By definition, he has enough information to identify an element within it. Such an element can be uniquely labeled by a |J|+|K|-bit vector, thereby defining SJ and SK. So, there exists a mapping that maps |sI〉sI′|φ⁡(x⁡(s¯,u),p)〉b,eve onto |sI〉sI′|sJK〉eJK|φ′⁡(x⁡(s¯,u),p)〉e¯,eI,eve with probability at least 1-ε, and thus eib≤ε, ∀i∈J∪K.

Each key generation code contains 2|K| PA sets of size 2|J| each [23]. The labeling can be such that SK corresponds to the identification of the PA set and SJ the element inside the PA set.

Providing the phase syndromes ξJp to Bob gives him enough information to determine the phase of Alice's qubits in sJ. If the phase errors are corrected by Bob, measuring or tracing out subsystems sJeJ is equivalent to summing the slices in J over all possible bit values and thus factoring out Eve. More precisely, with s¯, sI and p fixed (and the corresponding subsystems not shown), and with |sj*〉sj*=2-1/2⁢(|0〉sj+(-1)sj*⁢|1〉sj) (and similarly for ej and sj′), the system after correction of sI is of the form: