In this section we describe a decoy-state BB84 MDI-QKD protocol, taken from Ref. [140], which we will later use to construct a measurement-device-independent quantum USS scheme, similar to the AWKA scheme presented in Chapter 6.
1. State preparation. Alice chooses a bit value r ∈ {0, 1} uniformly at random and encodes it into a phase-randomised coherent state with three possible intensities – a signal intensity, as, and two decoy intensities, ad1 and ad2. The bit is encoded using either the X or Z basis. The intensity level and encoding basis are chosen randomly by Alice, each with probability pa,α, where
a ∈ {as, ad1, ad2} and α ∈ {X, Z}. Bob does exactly the same, independently to Alice.
2. State distribution. Alice and Bob send their state to Eve using a quantum channel.
3. Measurement. If Eve is honest, she makes a Bell state measurement on the received signals. Whether Eve acted honestly or not, she informs Alice and Bob of whether or not her measurement was successful. If successful, she declares the Bell state obtained as the measurement outcome.
4. Sifting. If Eve reports a successful result, Alice and Bob communicate their intensity and basis settings using an authenticated classical channel. For each Bell state k, we define two groups of sets: Zka,b and Xka,b. The sets group the signals according to basis choice (if Alice and Bob choose different bases the signals are discarded), and further by the chosen intensity levels and measure- ment outcome. The a, b superscript denotes the intensity chosen by Alice and Bob respectively, and k denotes the Bell state measurement outcome declared by Eve. Steps 1–4 are repeated until |Zka,b| ≥ Mka,b and |Xka,b| ≥ Nka,b for all a, b and k. The choice of Mka,b and Nka,b will depend on the post-processing techniques used and the desired security level. After this, Bob modifies his bits according to the declared measurement outcome to correctly correlate them with those of Alice. The modifications necessary are shown in Table 7.1.
5. Parameter estimation. Alice and Bob together choose nk random bits from
Xas,bs
k to form the bit strings Xk held by Alice, and Xk0 held by Bob. The
remaining Rk bits from Xkas,bs are used to compute the error rate, E as,bs k = 1 Rk P lrl ⊕ r 0
l, where rl and r0l are Alice’s and Bob’s bits, respectively. After
this the bits in Rk are discarded. If Ekas,bs > Etol for all k, then Alice and
Bob abort the protocol. If Eas,bs
k ≤ Etol, Alice and Bob use Zka,b and X a,b k to
estimate s−k,0, s−k,1and φ+k,1. The parameter s−k,0is a lower bound for the number of bits in Xk where Alice sent a vacuum state. Similarly, s−k,1 is a lower bound
for the number of bits in Xk arising from when Alice and Bob both sent a
single-photon state. φ+k,1 is an upper bound for the single-photon phase error rate. If φ+k,1> φtol, the corresponding strings Xk and Xk0 are discarded.
6. Error correction. For those k that passed the parameter estimation step, Bob obtains an estimate ˜Xkof Xk using an information reconciliation scheme.
For this, Alice sends him λEC,k bits of error correction data.
7. Privacy amplification. If k passed the error correction step, Alice and Bob apply a random universal hash function to Xk and ˜Xk to extract two shorter
strings with higher secrecy. The concatenation of these strings for all non- aborted k values forms the secret key, S.
Alice’s & Bob’s basis Bell state reported by Eve |ψ−i |ψ+i |φ−i |φ+i
Z Bit flip Bit flip – –
X Bit flip – Bit flip –
Table 7.1: Processing of data in the sifting stage. The Bell states are defined as |ψ−i =√1
2(|01i −
|10i), |ψ+i =√1
2(|01i + |10i), |φ +i = √1
2(|00i + |11i) and |φ −i = √1
2(|00i − |11i).
MDI-QKD security
A central aim of any QKD protocol analysis is to find the maximum length of the generated key, S, held by Alice and Bob, such that S can be proven to be almost perfectly secret (as per Definition 3.3). A crucial element in finding the length of the generated key is expressing Eve’s uncertainty on the sifted key Xk (before error
correction and privacy amplification) in terms of her min-entropy. For the protocol above Hk min(Xk|E) ≥ s−k,0+ s − k,1[1 − h(φ + k,1)] − 2 log2 2 0k˜k ' s−k,0+ s − k,1[1 − h(φ + k,1)], (7.1)
where k ≥ 0k + ˜k. The approximation on the second line is valid because the
logarithmic term is small compared to the preceding two terms. For clarity, and since it does not impact our later results, we omit explicit references to the logarithmic term.
Advantages of MDI-QKD
As discussed above, the major advantage of MDI-QKD is that it removes all possible detector side-channel attacks, thus bringing theory further in line with practical implementations. On top of this, the scheme also enjoys a number of secondary advantages discussed below.
First, a severe practical limitation of all QKD schemes is that they are fun- damentally distance limited – current fibre-based QKD systems are restricted to distributing key over distances up to approximately 250km, but for efficiency typ- ically operate at distances of less than 100km. Theoretical results show that this limitation is inherent to any optical QKD scheme [141] and cannot be overcome without quantum memory. By placing the detectors halfway between Alice and Bob, MDI-QKD effectively doubles the achievable transmission distance.
Second, MDI-QKD is very efficient compared to other attempts to remove side- channel attacks. Fully DI-QKD suffers hugely from problems associated with the detection efficiency loophole, which requires an overall detection efficiency of around 80%. For practical QKD setups in which there is high channel loss and only im- perfect detectors available, DI-QKD becomes essentially impossible, with expected secret key rates falling below 1 bit per second (bps) if possible at all. On the other hand, recent advances in experimental techniques have allowed MDI-QKD systems to achieve secret key rates of 9.7 × 104 bps over a distance of 52km, and Mbps se-
cret key rates over shorter distances [142]. These rates are even comparable to the state-of-the-art measurement-device-dependent QKD systems.
Third, MDI-QKD removes the need for either Alice or Bob to have detectors. Detectors are often the most expensive and complex element of a QKD system, and could significantly increase the cost of purchasing/maintaining a QKD link between two parties. MDI-QKD allows for the possibility of an untrusted central node holding all measurement equipment and connecting many parties. From a commercial perspective, this could be very beneficial in larger networks since it reduces the cost for each individual Alice and Bob. Instead, they could use third party measurement providers, such as Eve, whom they do not even need to trust.