Practical aspects of measurement-device-independent quantum key distribution

Quantum key distribution (QKD) [1–3] enables an unconditionally secure means of distributing secret keys between two spatially separated parties, Alice and Bob. The security of QKD has been rigorously proven based on the laws of quantum mechanics [4]. Nevertheless, owing to the imperfections in real-life implementations, a large gap between its theory and practice remains unfilled. In particular, an eavesdropper (Eve) may exploit these imperfections and launch specific attacks. This is commonly called quantum hacking. The first successful quantum hacking against a commercial QKD system was the time-shift attack [5] based on a proposal in [6]. More recently, the phase-remapping attack [7] and the detector-control attack [8] have been implemented against various practical QKD systems. Also, other attacks have appeared in the literature [9]. These results suggest that quantum hacking is a major problem for the real-life security of QKD.

To close the gap between theory and practice, a natural attempt was to characterize the specific loophole and find a countermeasure. For instance, Yuan, Dynes and Shields proposed an efficient countermeasure against the detector-control attack [10]. Once an attack is known, the prevention is usually uncomplicated. However, unanticipated attacks are most dangerous, as it is impossible to fully characterize real devices and account for all loopholes. Hence, researchers moved to the second approach—(full) device-independent QKD [11]. It requires no specification of the internal functionality of QKD devices and offers nearly perfect security. Its legitimate users (Alice and Bob) can be treated as a quasi black box by assuming no memory attacks [12]. Nevertheless, device-independent QKD is not really practical because it requires near-unity detection efficiency and generates an extremely low key rate [13]. Therefore, to our knowledge, there has been no experimental paper on device-independent QKD.

Fortunately, Lo et al [14] have recently proposed an innovative scheme—measurement-device-independent QKD (MDI-QKD)—that removes all detector side-channel attacks, the most important security loophole in conventional QKD implementations [5, 6, 8, 9]. As an example of a MDI-QKD scheme (see figure 1), each of Alice and Bob locally prepares phase-randomized signals (this phase randomization process can be realized using a quantum random number generator such as [15]) in the BB84 polarization states [1] and sends them to an untrusted quantum relay, Charles (or Eve). Charles is supposed to perform a Bell state measurement (BSM) and broadcast the measurement result. Since the measurement setting is only used to post-select entanglement (in an equivalent virtual protocol [14]) between Alice and Bob, it can be treated as a true black box. Hence, MDI-QKD is inherently immune to all attacks in the detection system. This is a major achievement as MDI-QKD allows legitimate users to not only perform secure quantum communications with untrusted relays⁵ but also out-source the manufacturing of detectors to untrusted manufacturers.

Zoom In Zoom Out Reset image size

Conceptually, the key insight of MDI-QKD is time reversal. This is in the same spirit as one-way quantum computation [16]. More precisely, MDI-QKD built on the idea of a time-reversed Einstein–Podolsky–Rosen (EPR) protocol for QKD [17]. By combining the decoy-state method [18] with the time-reversed EPR protocol, MDI-QKD gives both good performance and good security.

MDI-QKD is highly practical and can be implemented with standard optical components. The source can be a non-perfect single-photon source (together with the decoy-state method), such as an attenuated laser diode emitting weak coherent pulses (WCPs), and the measurement setting can be a simple BSM realized by linear optics. Hence, MDI-QKD has attracted intensive interest in the QKD community. A number of follow-up theoretical works have already been reported in [19–25]. Meanwhile, experimental attempts on MDI-QKD have also been made by several groups [26–29]. Nonetheless, before it can be applied in real life, it is important to address a number of practical issues. These include:

• (i)  
  Modeling the errors: an implementation of MDI-QKD may involve various error sources such as the mode mismatch resulting in a non-perfect Hong–Ou–Mandel (HOM) interference [30]. Thus, the first question is: how will these errors affect the performance of MDI-QKD?⁶ Or, what is the physical origin of the quantum bit error rate (QBER) in a practical implementation?
• (ii)  
  Finite decoy-state protocol and finite-key analysis: as mentioned before, owing to the lack of true single-photon sources [31], QKD implementations typically use laser diodes emitting WCPs [3] and single-photon contributions are estimated by the decoy-state protocol [18]. In addition, a real QKD experiment is completed in finite time, which means that the length of the output keys is finite. Thus, the estimation of relevant parameters suffers from statistical fluctuations. This is called the finite-key effect [32]. Hence, the second question is: how can one design a practical finite decoy-state protocol and perform a finite-key analysis in MDI-QKD?
• (iii)  
  Choice of intensities: an experimental implementation needs to know the optimal intensities for the signal and decoy states in order to optimize the system performance. Previously, [21, 22] have independently discussed the finite decoy-state protocol. However, the high computational cost of the numerical approach proposed in [21], together with the lack of a rigorous discussion of the finite-key effect in both [21, 22], makes the optimization of parameters difficult. Thus, the third question is: how can one obtain these optimal intensities?
• (iv)  
  Asymmetric MDI-QKD: as shown in figure 2, in real life, it is quite common that the two channels connecting Alice and Bob to Charles have different transmittances. We call this situation asymmetric MDI-QKD. Importantly, this asymmetric scenario appeared naturally in a recent proof-of-concept experiment [26], where a tailored length of fiber was intentionally added in the short arm to balance the two channel transmittances. Since an additional loss is introduced into the system, it is unclear whether this solution is optimal. Hence, the final question is: how can one optimize the performance of this asymmetric case?

Zoom In Zoom Out Reset image size

The second question has already been discussed in [21, 22, 24] and solved in [33]. In this paper, we offer additional discussions on this point and answer the other questions. Our contributions are summarized below.

• (i)  
  To better understand the physical origin of the QBER, we propose generic models for various error sources. In particular, we investigate two important error sources—polarization misalignment and mode mismatch. We find that in a polarization-encoding MDI-QKD system [14, 28, 29], polarization misalignment is the major source contributing to the QBER and mode mismatch (in the time or frequency domain), however, does not appear to be a major problem. These results are shown in section 3. Moreover, we provide a mathematical model to simulate a MDI-QKD system. This model is a useful tool for analyzing experimental results and performing the optimization of parameters. Although this model is proposed to study MDI-QKD, it is also useful for other non-QKD experiments involving quantum interference, such as entanglement swapping [34] and linear optics quantum computing [35]. This result is shown in appendix B.
• (ii)  
  A previous method to analyze MDI-QKD with a finite number of decoy states assumes that Alice and Bob can prepare a vacuum state [22]. Here, however, we present an analytical approach with two general decoy states, i.e. without the assumption of vacuum. This is particularly important for the practical implementations, as it is usually difficult to create a vacuum state in decoy-state QKD experiments [36, 37]. The different intensities are usually generated with an intensity modulator, which has a finite extinction ratio (e.g. around 30 dB). Additionally, we also simulate the expected key rates numerically and thus present an optimized method with two decoy states. Ignoring for the moment the finite-key effect, experimentalists can directly use this method to obtain a rough estimation of the system performance. Section 4 contains the main results for this point.
• (iii)  
  By combining the system model, the finite decoy-state protocol and the finite-key analysis of [33], we offer a general framework to determine the optimal intensities of the signal and decoy states. Notice that this framework has already been adopted and verified in the experimental demonstration reported in [29]. These results are shown in section 5.
• (iv)  
  Finally, we model and evaluate the performance of an asymmetric MDI-QKD system. This allows us to study its properties and determine the experimental configuration that maximizes its secret key rate. These results are shown in section 6.

The secure key rate of MDI-QKD in the asymptotic case (i.e. assuming an infinite number of decoy states and signals) is given by [14]

$$\begin{equation} R\geqslant P^{1,1}_{Z}Y^{1,1}_{Z}[1-H_{2}(e_{X}^{1,1})]-Q_{Z}f_{\mathrm{e}}(E_{Z})H_{2}(E_{Z}), \end{equation} \tag{ 1 }$$

where Y^1,1_Z and e^1,1_X are, respectively, the yield (i.e. the probability that Charles declares a successful event) in the rectilinear (Z) basis and the error rate in the diagonal (X) basis given that both Alice and Bob send single-photon states (P^1,1_Z denotes this probability in the Z basis); H₂ is the binary entropy function given by H₂(x) = −x log₂(x) − (1 − x)log₂(1 − x); Q_Z and E_Z denote, respectively, the gain and QBER in the Z basis and f_e ⩾ 1 is the error correction inefficiency function. Here we use the Z basis for key generation and the X basis for testing only [38]. In practice, Q_Z and E_Z are directly measured in the experiment, while Y^1,1_Z and e^1,1_X can be estimated using the finite decoy-state method.

Next, we introduce some additional notations. We consider one signal state and two weak decoy states for the finite decoy-state protocol. The parameter μ is the intensity (i.e. the mean photon number per optical pulse) of the signal state⁷. ν and ω are the intensities of the two decoy states, which satisfy μ > ν > ω ⩾ 0. The sets {μ_a, ν_a, ω_a} and {μ_b, ν_b, ω_b} contain, respectively, Alice's and Bob's intensities. The sets {μ^opt_a, ν^opt_a, ω^opt_a} and {μ^opt_b, ν^opt_b, ω^opt_b} denote the optimal intensities that maximize the key rate. L_ac and t_a (L_bc and t_b) denote the channel distance and transmittance from Alice (Bob) to Charles. In the case of a fiber-based system, t_a = 10^−αL_ac/10 with α denoting the channel loss coefficient (α ≈ 0.2 dB km⁻¹ for a standard telecom fiber). η_d is the detector efficiency and Y₀ is the background rate that includes detector dark counts and other background contributions. The parameters e_d, e_t and e_m denote, respectively, the errors associated with the polarization misalignment, the time-jitter and the total mode mismatch (see definitions below).

In this section, we consider the original MDI-QKD setting [14], i.e. the symmetric case with t_a = t_b. The asymmetric case will be discussed in section 6. To model the practical error sources, we focus on the fiber-based polarization-encoding MDI-QKD system proposed in [14] and demonstrated in [28, 29]. Notice, however, that with some modifications, our analysis can also be applied to other implementations such as free-space transmission, the phase-encoding scheme and the time-bin-encoding scheme. See also [20, 25], respectively, for models of phase-encoding and time-bin-encoding schemes.

A comprehensive list of practical error sources is as follows⁸.

• (i)  
  Polarization misalignment (or rotation).
• (ii)  
  Mode mismatch including time-jitter, spectral mismatch and pulse-shape mismatch.
• (iii)  
  Fluctuations of the intensities (modulated by Alice and Bob) at the source.
• (iv)  
  Background rate.
• (v)  
  Asymmetry of the beam splitter (BS).

Here, we primarily analyze the first two error sources, i.e. polarization misalignment and mode mismatch. The other error sources present minor contributions to the QBER in practice, and are discussed in appendix A.

3.1. Polarization misalignment

Polarization misalignment (or rotation) is one of the most significant factors contributing to the QBER in not only the polarization-encoding BB84 system [1] but also the polarization-encoding MDI-QKD system. Since MDI-QKD requires two transmitting channels and one BSM (instead of one channel and a simple measurement as in the BB84 protocol), it is cumbersome to model its polarization misalignment. Here, we solve this problem by proposing a simple model in figure 1. One of the polarization BSs (PBSs) (PBS2 in figure 1) is defined as the fundamental measurement basis⁹. Three unitary operators, {U₁, U₂, U₃}, are considered to model the polarization misalignment of each channel [35]. The operator U₁ (U₂) represents the misalignment of Alice's (Bob's) channel transmission, while U₃ models the misalignment of the other measurement setting, PBS1.

For simplicity, we consider a simplified model with a two-dimensional unitary matrix¹⁰ (see section I.A. of [35])

$$\begin{equation} U_{k}=\left( \begin{array}{@{}cc@{}} \cos\theta_{k} & -\sin\theta_{k} \\ \sin\theta_{k} & \cos\theta_{k} \end{array} \right), \end{equation} \tag{ 2 }$$

where k = 1, 2, 3 and θ_k (polarization-rotation angle) is in the range of [ − π,π]. For each value of k, we define the polarization misalignment error e_k = sin² θ_k and the total error $e_{\mathrm { d}}=\sum _{k=1}^{3}e_k$. Note that e_d is equivalent to the systematic QBER in a polarization-encoding BB84 system.

From the model of figure 1, we can analyze the effect of polarization misalignment by evaluating the secure key rate given by equation (1). See appendix B for details. By using the practical parameters listed in table 1, we perform a numerical simulation of the asymptotic key rates for different values of polarization misalignment, e_d. The result is shown in figure 3. In this simulation, we temporarily ignore mode mismatch (i.e., set e_m = 0 in table 1) and make two practical assumptions for the polarization misalignment: (a) each polarization-rotation angle, θ_k, follows a Gaussian distribution with a standard deviation of $\theta _{k}^{\mathrm { std}}=\arcsin (\sqrt {e_{k}})$; and (b) the probability distribution of e_k is selected as e₁ = e₂ = 0.475e_d and e₃ = 0.05e_d.¹¹ Figure 3 shows that a polarization-encoding system can tolerate up to about 6.7% polarization misalignment at 0 km, while at 120 km it can only tolerate up to 5% misalignment. It also shows that MDI-QKD is moderately robust to errors due to polarization misalignment.

Zoom In Zoom Out Reset image size

Table 1. List of practical parameters for all numerical simulations. These experimental parameters, including the detection efficiency η_d, the total misalignment error e_d and the background rate Y₀, are from the 144 km QKD experiment reported in [39]. Since two SPDs are used in [39], the background rate of each SPD here is roughly half of the value there. We assume that the four SPDs in MDI-QKD (see figure 1) have identical η_d and Y₀. The parameter e_m is the total mode mismatch that is quantified from the experimental values of Tang et al [29].

ηd	ed	Y0	fe	em
14.5%	1.5%	6.02×10−6	1.16	2%

3.2. Mode mismatch

We primarily use the model of mode mismatch in time domain, called time-jitter¹² , to discuss our method. This model is shown in figure 4. We describe Alice's and Bob's quantum states in the time domain as

$$\begin{eqnarray} &{\rm Alice}&: |\phi_{\rm a}\rangle=|T_{\rm a}\rangle \nonumber \\\\ &{\rm Bob}&: |\phi_{\rm b}\rangle=\alpha|T_{\rm a}\rangle+\beta|\overline{T_{\rm a}}\rangle,\nonumber \end{eqnarray} \tag{ 3 }$$

where $|\overline {T_{\mathrm { a}}}\rangle$ is the orthogonal time mode of |T_a〉, $\beta =\sqrt {e_{\mathrm { t}}}$, $\alpha =\sqrt {1-e_{\mathrm { t}}}$, and e_t is defined as the time-jitter that represents the probability of Alice's state not overlapping with that of Bob¹³.

Zoom In Zoom Out Reset image size

This model is a very general method that can be used to study the mode mismatch problem in other domains for a variety of quantum optics experiments involving quantum interference. For instance, a similar discussion can be applied to the spectral (wavelength) mismatch if we write equation (3) in the frequency domain. One can also refer to [40] for a general discussion about the spectral mismatch. Considering equation (3) in the form of Alice's and Bob's pulse shapes, we can also analyze the pulse-shape mismatch. Here we define the total mode mismatch in all domains as e_m.

Next, let us discuss how e_m affects the key rate given by equation (1). As illustrated in figure 1, the overlapping modes between Alice's and Bob's pulses experience a HOM interference at the BS, while the non-overlapping modes transmit through the BS without interference. Assuming that η_d ≫ Y₀ and ignoring the polarization misalignment for the moment, we find that the mode mismatch only affects the gains and the error rates in the X basis rather than those in the Z basis¹⁴. Hence, in equation (1), e_m mainly affects e^1,1_X. In practice, e^1,1_X can be estimated from the finite decoy-state protocol, i.e. from the gains (Q_X) and QBERs (E_X) in the X basis. Similar to the analysis of the polarization misalignment in section 3.1, we can incorporate e_m into the derivations of Q_X and E_X following the method of appendix B.¹⁵

Using the parameters of table 1, we simulate the asymptotic key rates for different values of e_m. The results are shown in figure 5. In this simulation, we temporarily ignore polarization misalignment (i.e. we set e_d = 0) and only focus on mode mismatch. At 0 km, we find that the system can tolerate up to 80% mode mismatch and at 120 km, the tolerable value is about 50%. Hence, a polarization-encoding MDI-QKD system is less sensitive to mode mismatch than to polarization misalignment¹⁶. Notice also that we have quantified the value of e_m (see table 1) by using the experimental parameters from [29] and find that e_m is usually small in practice (e.g. below 5%). Therefore, mode mismatch does not appear to be a major problem in a MDI-QKD implementation.

Zoom In Zoom Out Reset image size

In a MDI-QKD implementation, by performing the measurements for the different intensities used by Alice and Bob, we can obtain [14]

$$\begin{equation} Q^{q_{\mathrm{a}}q_{\mathrm{b}}}_{Z}=\sum_{n,m=0}\mathrm{e}^{-(q_{\mathrm{a}}+q_{\mathrm{b}})}\frac{q^n_{\mathrm{a}}}{n!}\frac{q^m_{\mathrm{b}}}{m!}Y^{n,m}_{Z}, \end{equation} \tag{ 4 }$$

$$\begin{equation} Q^{q_{\mathrm{a}}q_{\mathrm{b}}}_{X}E^{q_{\mathrm{a}}q_{\mathrm{b}}}_{X}=\sum_{n,m=0}\mathrm{e}^{-(q_{\mathrm{a}}+q_{\mathrm{b}})}\frac{q^n_{\mathrm{a}}}{n!}\frac{q^m_{\mathrm{b}}}{m!}Y^{n,m}_{X}e^{n,m}_{X}, \end{equation} \tag{ 5 }$$

where qa (qb) denotes Alice's (Bob's) intensity setting, QqaqbZ (Eqa,qbX) denotes the gain (QBER) in the Z (X) basis with the intensity pair {qa, qb}, and Yn,mZ (en,mX) denotes the yield (error rate) given that Alice and Bob send respectively an n-photon and m-photon pulse. Here the goal of the finite decoy-state protocol is to estimate Y1,1Z and e1,1X (used to generate a secure key) from the set of linear equations given by equations (4) and (5) using different intensity settings17. More specifically, we estimate a lower bound for Y1,1Z and an upper bound for e1,1X. We denote these two bounds, respectively, as Y1,1Z,L and e1,1X,U.

The general approach for the finite decoy-state protocol has been discussed in [33]. In this section, however, we present a much simpler analytical method with only two decoy states. The final results are summarized in table 2. They can be directly used by experimentalists (without knowing the details of Curty et al [33]) to obtain a rough estimation of the expected system performance. Notice that our notations are different from [33] in that we primarily estimate the probabilities in the case of an infinite number of signals, while [33] focuses on the estimation of counts by incorporating the finite-key effect.

Table 2. Analytical equations for the two decoy-state protocol. See the main text for details. Here, for the estimation of Y^1,1_Z,L, we only consider one case and refer to equation (7) for the other case. Ignoring the finite-key effect, these results can be directly used by experimentalists to obtain an estimation of the expected system performance.

$Y_{Z,L}^{1,1}\geqslant \frac {1}{(\mu _{\mathrm {a}}-\omega _{\mathrm {a}})(\mu _{\mathrm {b}}-\omega _{\mathrm {b}})(\nu _{\mathrm {a}}-\omega _{\mathrm {a}})(\nu _{\mathrm {b}}-\omega _{\mathrm {b}})(\mu _{\mathrm {a}}-\nu _{\mathrm {a}})} \times$
[(μ2a−ω2a)(μb−ωb)(QνaνbZe(νa+νb)+QωaωbZe(ωa+ωb)−QνaωbZe(νa+ωb)−QωaνbZe(ωa+νb))−
(ν2a−ω2a)(νb−ωb)(QμaμbZeμa+μb+QωaωbZe(ωa+ωb)−QμaωbZe(μa+ωb)−QωaμbZe(ωa+μb)]
$e_{X,U}^{1,1}\geqslant \frac {1}{(\nu _{\mathrm {a}}-\omega _{\mathrm {a}})(\nu _{\mathrm {b}}-\omega _{\mathrm {b}})Y_{X,L}^{1,1}} \times$
[e(νa+νb)QνaνbXEνaνbX+e(ωa+ωb)QωaωbXEωaωbX−e(νa+ωb)QνaωbXEνaωbX−e(ωa+νb)QωaνbXEωaνb]

Now, let us start to discuss this two decoy-state protocol. As mentioned before, the intensities of the signal and decoy states satisfy μ > ν > ω and our protocol is applicable to either ω = 0 or ω ≠ 0. The key method to estimate Y^1,1_Z,L from equation (4) can be divided into two steps:

• (i)  
  Cancel out the terms Y^0m_Z and Yⁿ⁰_Z using Gaussian elimination.
• (ii)  
  Cancel out either the term Y¹²_Z or Y²¹_Z depending on the intensity values selected in the first step.

For the first step, we choose intensity pairs from {μ_a, ω_a, μ_b, ω_b} and {ν_a, ω_a, ν_b, ω_b},¹⁸ and generate two quantities Q^M1_Z and Q^M2_Z given by

$$\begin{eqnarray*} &&Q_{Z}^{M1}=Q^{\nu_{\mathrm{a}}\nu_{\mathrm{b}}}_{Z}e^{(\nu_{\mathrm{a}}+\nu_{\mathrm{b}})}+ Q^{\omega_{\mathrm{a}}\omega_{\mathrm{b}}}_{Z}e^{(\omega_{\mathrm{a}}+\omega_{\mathrm{b}})}-Q^{\nu_{\mathrm{a}}\omega_{\mathrm{b}}}_{Z}e^{(\nu_{\mathrm{a}}+\omega_{\mathrm{b}})}-Q^{\omega_{\mathrm{a}}\nu_{\mathrm{b}}}_{Z}e^{(\omega_{\mathrm{a}}+\nu_{\mathrm{b}})}, \\ &&Q_{Z}^{M2}=Q^{\mu_{\mathrm{a}}\mu_{\mathrm{b}}}_{Z}e^{(\mu_{\mathrm{a}}+\mu_{\mathrm{b}})}+Q^{\omega_{\mathrm{a}}\omega_{\mathrm{b}}}_{Z}e^{(\omega_{\mathrm{a}}+\omega_{\mathrm{b}})}-Q^{\mu_{\mathrm{a}}\omega_{\mathrm{b}}}_{Z}e^{(\mu_{\mathrm{a}}+\omega_{\mathrm{b}})}-Q^{\omega_{\mathrm{a}}\mu_{\mathrm{b}}}_{Z}e^{(\omega_{\mathrm{a}}+\mu_{\mathrm{b}})}. \end{eqnarray*}$$

To cancel out Y¹²_Z or Y²¹_Z, we consider two cases.

• Case 1.  
  $\left(\frac {\mu _{\mathrm {a}}+\omega _{\mathrm {a}}}{\nu _{\mathrm {a}}+\omega _{\mathrm {a}}}\right)\leqslant \frac {\mu _{\mathrm {b}}+\omega _{\mathrm {b}}}{\nu _{\mathrm {b}}+\omega _{\mathrm {b}}}$ we use (μ²_b − ω²_b)(μ_a − ω_a) × Q^M1_Z − (ν²_b − ω²_b)(ν_a − ω_a) × Q^M2_Z to cancel out Y¹²_Z. Thus, Y^1,1_Z,L is given by

  $$\begin{equation} \frac{(\mu_{\mathrm{a}}^2-\omega_{\mathrm{a}}^2)(\mu_{\mathrm{b}}-\omega_{\mathrm{b}})Q_{Z}^{M1}-(\nu_{\mathrm{a}}^2-\omega_{\mathrm{a}}^2)(\nu_{\mathrm{b}}-\omega_{\mathrm{b}})Q_{Z}^{M2}}{(\mu_{\mathrm{a}}-\omega_{\mathrm{a}})(\mu_{\mathrm{b}}-\omega_{\mathrm{b}})(\nu_{\mathrm{a}}-\omega_{\mathrm{a}})(\nu_{\mathrm{b}}-\omega_{\mathrm{b}})(\mu_{\mathrm{a}}-\nu_{\mathrm{a}})}. \end{equation} \tag{ 6 }$$
• Case 2.  
  $(\frac {\mu _{\mathrm {a}}+\omega _{\mathrm {a}}}{\nu _{\mathrm {a}}+\omega _{\mathrm {a}}}>\frac {\mu _{\mathrm {b}}+\omega _{\mathrm {b}}}{\nu _{\mathrm {b}}+\omega _{\mathrm {b}}}$) we cancel out Y²¹_Z using the same method as in case 1 and derive Y^1,1_Z,L as

  $$\begin{equation} \frac{(\mu_{\mathrm{b}}^2-\omega_{\mathrm{b}}^2)(\mu_{\mathrm{a}}-\omega_{\mathrm{a}})Q_{Z}^{M1}-(\nu_{\mathrm{b}}^2-\omega_{\mathrm{b}}^2)(\nu_{\mathrm{a}}-\omega_{\mathrm{a}})Q_{Z}^{M2}}{(\mu_{\mathrm{a}}-\omega_{\mathrm{a}})(\mu_{\mathrm{b}}-\omega_{\mathrm{b}})(\nu_{\mathrm{a}}-\omega_{\mathrm{a}})(\nu_{\mathrm{b}}-\omega_{\mathrm{b}})(\mu_{\mathrm{b}}-\nu_{\mathrm{b}})}. \end{equation} \tag{ 7 }$$

Similarly, the strategy to estimate e^1,1_X,U from equation (5) requires to cancel out Y^0,m_Xe^0,m_X and Y^n,0_Xe^n,0_X. Thus, we choose intensity pairs from {ν_a, ω_a, ν_b, ω_b} ¹⁹ and derive e^1,1_X,U as

$$\begin{eqnarray*}&&\frac{1}{(\nu_{\mathrm{a}}-\omega_{\mathrm{a}})(\nu_{\mathrm{b}}- \omega_{\mathrm{b}})Y_{X,L}^{1,1}}[e^{(\nu_{\mathrm{a}}+\nu_{\mathrm{b}})}Q^{\nu_{\mathrm{a}}\nu_{\mathrm{b}}}_{X}E^{\nu_{\mathrm{a}}\nu_{\mathrm{b}}}_{X}+e^{(\omega_{\mathrm{a}}+\omega_{\mathrm{b}})}Q^{\omega_{\mathrm{a}}\omega_{\mathrm{b}}}_{X}E^{\omega_{\mathrm{a}}\omega_{\mathrm{b}}}_{X}\nonumber\\ &&- e^{(\nu_{\mathrm{a}}+\omega_{\mathrm{b}})}Q^{\nu_{\mathrm{a}}\omega_{\mathrm{b}}}_{X}E^{\nu_{\mathrm{a}}\omega_{\mathrm{b}}}_{X}e^{(\omega_{\mathrm{a}}+\nu_{\mathrm{b}})}Q^{\omega_{\mathrm{a}}\nu_{\mathrm{b}}}_{X}E^{\omega_{\mathrm{a}}\nu_{\mathrm{b}}}], \end{eqnarray*}$$

where Y^1,1_X,L can be estimated using a similar method to that for Y^1,1_Z,L.²⁰ The final equations are summarized in table 2.

In this section, we develop a general framework to choose the optimal intensity values for the signal and decoy states. This framework is shown in figure 6, and is composed of four steps.

• (i)  
  Quantify the parameters and errors of the system. For simulation purposes, we will consider the parameters shown in table 1.
• (ii)  
  Model the system using the techniques presented in section 3. A complete model for a polarization-encoding MDI-QKD can be found in appendix B.
• (iii)  
  Implement the finite decoy-state protocol. For this, we will consider the analytical method with two decoy states introduced in section 4. In the simulation, for the weakest decoy state ω, we set its minimum value at 5 × 10⁻⁴ (per pulse)²¹.
• (iv)  
  Apply the finite-key analysis. Here, we employ the rigorous finite-key analysis of [33] and consider a total number of signals N = 10^14 22 together with a security bound of  = 10⁻¹⁰.
• (v)  
  Perform the numerical optimization. In our simulation, we use a MATLAB program to maximize the secure key rate and thus obtain the optimal parameters under different channel transmittances.

Zoom In Zoom Out Reset image size

Based on this framework, the optimal intensities that maximize the key rate at different transmission distances are shown in figure 7. Notice also that our approach has already been applied to the experimental demonstration reported in [29], where the polarization misalignment is around 0.7% and the total mode mismatch is below 2%. Owing to the low operation rate there, the value of ω is set to 0.01. The optimal intensities in this scenario are μ^opt_a = μ^opt_b ≈ 0.3 and ν^opt_a = ν^opt_b ≈ 0.1.

Zoom In Zoom Out Reset image size

A schematic diagram of the asymmetric MDI-QKD is shown in figure 2. Note that this asymmetric scenario appeared naturally in a recent field-test experiment performed in Calgary [26]. Another concrete illustration can be found at the Tokyo QKD network [41], in which the asymmetric case occurs if Koganei-1 (Alice) and Koganei-3 (Bob) use Koganei-2 (Charles) as the quantum relay to perform MDI-QKD, where the two fiber links are, respectively, 90 and 1 km. Here we define a parameter x to quantify the ratio of the two channel transmittances, i.e. x = t_a/t_b. In the Calgary's system, x = 0.752, while in the Tokyo QKD network x = 0.017.

6.1. Problem identification

The main question here is how to choose the optimal intensities in this asymmetric situation. In the asymptotic case, these optimal intensities refer to the two signal states μ^opt_a and μ^opt_b. Let us discuss two possible options.

The first option is to choose μ^opt_a = μ^opt_b with both in O(1). If we ignore the system imperfections such as background counts and other practical errors, the error rates (e^1,1_X and E_Z in equation (1)) will be zero, while P^1,1_ZY^1,1_Z can be maximized with μ^opt_a = μ^opt_b = 1 (see appendix B.1 for the details). However, in practice, it is inevitable to have some practical errors such as the polarization misalignment discussed above. A relatively large intensity in the short channel will significantly increase the QBER due to the misalignment. Moreover, owing to the intensity mismatch on Charles's side (μ^opt_at_a ≠ μ^opt_bt_b), the quantum interference known as the HOM dip, will be imperfect. As a consequence, this option leads to a relatively large QBER, which decreases the key rate due to the cost of error correction.

To minimize the QBER, a second option is to choose μ^opt_at_a = μ^opt_bt_b regardless of x. We denote this situation as the symmetric choice (indicated by symmetry in figure 8 and table 3). An equivalent implementation scheme for this option is to add a tailored length of fiber in the local station of the sender with the short channel transmission (i.e. Bob in figure 2) in order to balance the two channel transmittances. In fact, such a scheme was recently implemented in a proof-of-principle MDI-QKD experiment [26]. However, when x is far from 1, to satisfy μ_at_a = μ_bt_b, either μ_a or μ_b needs to be relatively small. Hence, we cannot derive good bounds for P^1,1_ZY^1,1_Z and e^1,1_X. In particular, the increase of e^1,1_X results in the decrease of the key rate due to the cost of privacy amplification.

Zoom In Zoom Out Reset image size

Table 3. Optimal intensities of an asymmetric MDI-QKD system. The channel mismatch is fixed at x = 0.1 and thus L_ac = {50,60,70 km}. In the asymptotic case, the ratio μ^opt_a/μ^opt_b for the optimal choice is around 4. In the symmetric choice, this ratio is 10. The parameters μ^opt_a and μ^opt_b are fixed regardless of t_a and t_b (see theorem 1 in appendix C.1). In the two decoy-state case (with different L_bc), the optimal intensities for the decoy state ν are about {ν_a = 0.10, ν_b = 0.01} for the symmetric choice and {ν^opt_a = 0.07, ν^opt_b = 0.01} for the optimal choice. The optimal value for the weakest decoy state is ω^opt_a = ω^opt_b = 5 × 10⁻⁴ for both choices. From the intensity values in this table, we find that the optimal choice for μ_a and μ_b does not always satisfy μ^opt_at_a = μ^opt_bt_b, but the ratio μ^opt_at_a/μ^opt_bt_b is near 1. Also, in the asymptotic case, μ^opt_a and μ^opt_b are only determined by x instead of t_a or t_b.

Parameters	Asymptotic case				Two decoy-state case
	Symmetry		Optimum		Symmetry		Optimum
x=0.1	μa	μb	μopta	μoptb	μa	μb	μopta	μoptb
Lbc=0 km	0.75	0.08	0.60	0.15	0.49	0.05	0.46	0.08
Lbc=10 km	0.75	0.08	0.60	0.15	0.46	0.05	0.41	0.07
Lbc=20 km	0.75	0.08	0.60	0.15	0.41	0.03	0.38	0.06

In summary, we find that both of the above two options are sub-optimal. We present the optimal choice below.

6.2. Summary of results

A key assumption in MDI-QKD [14] is that Alice and Bob trust their devices for the state preparation, i.e. they can generate ideal quantum states in the BB84 protocol. One approach to remove this assumption is to quantify the imperfections in the state preparation part and thus include them into the security proofs [19]. We believe that this assumption is practical because Alice's and Bob's quantum states are prepared by themselves and thus can be experimentally verified in a fully protected laboratory environment outside of Eve's interference. For instance, based on an earlier proposal [42], Lim et al [43] have introduced another interesting scheme in which each of Alice and Bob uses an entangled photon source (instead of WCPs) and quantifies the state-preparation imperfections via random sampling. That is, Alice and Bob randomly sample parts of their prepared states and perform a local Bell test on these samples. Such a scheme is very promising, as it is in principle a fully device-independent approach. It can be applied in short-distance communications.

In conclusion, we have presented an analysis for practical aspects of MDI-QKD. To understand the physical origin of the QBER, we have investigated various practical error sources by developing a general system model. In a polarization-encoding MDI-QKD system, polarization misalignment is the major source contributing to the QBER. Hence, in practice, an efficient polarization management scheme such as polarization feedback control [28, 44] can significantly improve the polarization stabilization and thus generate a higher key rate. We have also discussed a simple analytical method for the finite decoy-state analysis, which can be directly used by experimentalists to demonstrate MDI-QKD. In addition, by combining the system model with the finite decoy-state method, we have presented a general framework for the optimal intensities of the signal and decoy states. Furthermore, we have studied the properties of the asymmetric MDI-QKD protocol and discussed how to optimize its performance. Our work is relevant to both QKD and general experiments on quantum interference.

We thank W Cui, S Gao, L Qian for enlightening discussions and V Burenkov, Z Liao, P Roztocki for comments on the presentation of the paper. Support from funding agencies NSERC, the CRC program, European Regional Development Fund (ERDF), and the Galician Regional Government (projects CN2012/279 and CN 2012/260, 'Consolidation of Research Units: AtlantTIC') is gratefully acknowledged. FX would like to thank the Paul Biringer Graduate Scholarship for financial support.

Here, we discuss other practical error sources and show that their contribution to the QBER is not very significant in a practical MDI-QKD system. For this reason, they are ignored in our simulations.

A.1. Intensity fluctuations at the source

A.2. Threshold detector with background counts

The threshold single photon detector (SPD) can be modeled by a BS with η_d transmission and (1-η_d) reflection. The transmission part is followed by a unity efficiency detector, while the reflection part is discarded. η_d is defined as the detector efficiency. Background counts can be treated to be independent of the incoming signals. For simplicity, the system model discussed in appendix B assumes that the four SPDs (see figure 1) are identical and have a detection efficiency η_d and a background rate Y₀. Note, however, that if this condition is not satisfied (i.e. there is some detection efficiency mismatch) our system model can be adapted to take care also of this case.

All the simulations reported in the main text already consider a background rate of Y₀ = 6.02 × 10⁻⁶ (see table 1). Figure A.1 simulates more general cases of the asymptotic key rates at different background count rates. At 0 km, the MDI-QKD system can tolerate up to 10⁻³ (per pulse) background counts.

Zoom In Zoom Out Reset image size

A.3. Beam splitter ratio

In practice, for telecom wavelengths, the asymmetry of the BS (i.e. not 50:50) is usually small. For instance, the wavelength dependence of the fiber-based BS in our laboratory (Newport-13101550-5050 fiber coupler) is experimentally quantified in figure A.2. If the laser wavelength is 1542 nm [29], the BS ratio is 0.5007, which introduces negligible QBER (below 0.01%) in a MDI-QKD system. Hence, this error source can also be ignored in the theoretical model of MDI-QKD.

Zoom In Zoom Out Reset image size

In this section, we discuss an analytical method to model a polarization-encoding MDI-QKD system. That is, we calculate Y^1,1_Z, e^1,1_X, Q_Z and E_Z and thus estimate the expected key rate from equation (1).

To simplify our calculation, we make two assumptions about the practical error sources: (i) since most practical error sources do not contribute significantly to the system performance, we only consider the polarization misalignment e_d, the background count rate Y₀ and the detector efficiency η_d; (ii) for the model of the polarization misalignment, we consider only two unitary operators, U₁ and U₂, to represent, respectively, the polarization misalignment of Alice's and Bob's channel transmission, i.e. set U₃ = I in the generic model of section 3.1. For simplicity, a more rigorous derivation with U₃ ≠I is not shown here, but it can be easily completed following our procedures discussed below.

B.1. Y^1,1_Z and e^1,1_X

In the asymptotic case, we assume that Y^1,1_Z and e^1,1_X in equation (1) can be perfectly estimated with an infinite number of signals and decoy states. Thus, they are given by

$$\begin{eqnarray} &&\fl e_{X}^{1,1}=\frac{1}{2}- \frac{t_{\rm a}t_{\rm b}\eta_{\rm d}^{2}(1-e_{\rm d})^{2}(1-Y_{0})^{2}}{4Y_{X}^{1,1}}, \nonumber\\ &&Y_{Z}^{1,1}\!=\!(1-Y_{0})^{2}\left[4Y_{0}^{2}(1\!-\!t_{\rm a}\eta_{\rm d})(1{-}t_{\rm b}\eta_{\rm d})+2Y_{0}\left(\!t_{\rm a}\eta_{\rm d}+t_{\rm b}\eta_{\rm d}-\frac{3t_{\rm a}t_{\rm b}\eta_{\rm d}^{2}}{2}\right)+\frac{t_{\rm a}t_{\rm b}\eta_{\rm d}^{2}}{2}\!\right]\!,\nonumber\\ \end{eqnarray} \tag{ B.1 }$$

where Y^1,1_X = Y^1,1_Z. Importantly, we can see that ignoring the imperfections of polarization misalignment and background counts (i.e. e_d = 0, Y₀ = 0), e^1,1_X is zero, while P^1,1_ZY^1,1_Z (P^1,1_Z = μ_aμ_b e^{−(μ_a+μ_b)}) can be maximized with μ_a = μ_b. Thus, the optimal choice of intensities is μ_a = μ_b = 1. However, in practice, it is inevitable to have certain practical errors, which result in this optimal choice being a function of the values of practical errors.

B.2. Q_Z and E_Z

Now, let us calculate Q_Z and E_Z, which are eventually given by equation (B.12). To further simplify our discussion, we use {horizonal, vertical, 45°, 135°} to represent the BB84 polarization states. Also, {HH,HV,+ + ,+ − } will denote Alice's and Bob's encoding modes. We define the following notations:

$$\begin{eqnarray*} \gamma_{\rm a}&=&\sqrt{\mu_{\rm a}t_{\rm a}\eta_{\rm d}}, \quad \gamma_{\rm b}=\sqrt{\mu_{\rm b}t_{\rm b}\eta_{\rm d}}, \\ \nonumber \beta&=&\gamma_{\rm a}\gamma_{\rm b},\quad \gamma=\gamma_{\rm a}^{2}+\gamma_{\rm b}^{2}, \\ \nonumber \lambda&=&\gamma_{\rm a}\gamma_{\rm b}\sqrt{e_{\rm d1}(1-e_{\rm d1})},\quad \omega=\gamma_{\rm a}^{2}+e_{\rm d1}(\gamma_{\rm b}^{2}-\gamma_{\rm a}^{2}). \end{eqnarray*}$$

B.2.1. Derivation of Q^HH_Z

First, both Alice and Bob encode their states in the H mode (symmetric to V mode). We assume that U₁ and U₂ (see equation (2)) rotate the polarization in the same direction, i.e. θ₁θ₂ > 0. The discussion regarding rotation in the opposite direction (i.e. θ₁θ₂ < 0) is in B.2.4.

In Charles's laboratory, after the BS and PBS (see figure 1), the optical intensities received by each SPD are given by

$$\begin{eqnarray}&&\begin{array}{@{}l@{}} D_{\rm ch}: |A|^{2}=\displaystyle\frac{(1-e_{\rm d1})(\gamma_{\rm a}^{2}+\gamma_{\rm b}^{2})-2\gamma_{\rm a}\gamma_{\rm b}\cos(\phi)(1-e_{\rm d1})}{2}, \\ D_{\rm dh}: |C|^{2}=\displaystyle\frac{(1-e_{\rm d1})(\gamma_{\rm a}^{2}+\gamma_{\rm b}^{2})+2\gamma_{\rm a}\gamma_{\rm b}\cos(\phi)(1-e_{\rm d1})}{2},\\ D_{\rm cv}: |B|^{2}=\displaystyle\frac{e_{\rm d1}(\gamma_{\rm a}^{2}+\gamma_{\rm b}^{2})-2\gamma_{\rm a}\gamma_{\rm b}\cos(\phi)e_{\rm d1}}{2}, \\ D_{\rm dv}: |D|^{2}=\displaystyle\frac{e_{\rm d1}(\gamma_{\rm a}^{2}+\gamma_{\rm b}^{2})+2\gamma_{\rm a}\gamma_{\rm b}\cos(\phi)e_{\rm d1}}{2},\end{array} \end{eqnarray} \tag{ B.2 }$$

where ϕ denotes the relative phase between Alice's and Bob's weak coherent states. Thus, the detection probability of each threshold SPD is

$$\begin{equation} P_{V}=1-(1-Y_{0})\,\mathrm{e}^{-|V|^{2}}, \end{equation} \tag{ B.3 }$$

where V =A,B,C,D. Then, the coincident counts are

$$\begin{eqnarray*} &&Q_{Z}^{HH,\psi^{+}}=2P_{{A}}P_{{B}}(1-P_{{C}})(1-P_{{D}}), \nonumber \\ &&Q_{Z}^{HH,\psi^{-}}=2P_{{A}}P_{{D}}(1-P_{{B}})(1-P{_{C}}), \end{eqnarray*}$$

where Q^HH,ψ+ _Z and Q^HH,ψ− _Z denote, respectively, the probability of the projection on the Triplet $|\psi ^{+}\rangle = \frac {1}{\sqrt {2}}(|H,V\rangle +|V,H\rangle$) and the Singlet $|\psi ^{-}\rangle = \frac {1}{\sqrt {2}}(|H,V\rangle -|V,H\rangle$). Here from figure 1, Triplet means the coincident detections of {ch & cv} or {dh & dv}; Singlet means the coincident detections of {ch & dv} or {cv & dh}. After averaging over the relative phase ϕ (integration over [0, 2π]), we have

$$\begin{eqnarray}&&\begin{array}{@{}l@{}} Q_{Z}^{HH,\psi^{+}}=2\,{\rm e}^{-\frac{\gamma}{2}}(1-Y_{0})^{2}[I_{0}(\beta)+(1-Y_{0})^{2}\,{\rm e}^{-\frac{\gamma}{2}} \\ \hspace{50pt}-(1-Y_{0})\,{\rm e}^{-\frac{\gamma(1-e_{\rm d1})}{2}}I_{0}(e_{\rm d1}\beta)-(1-Y_{0})\,{\rm e}^{-\frac{\gamma e_{\rm d1}}{2}}I_{0}(\beta-e_{\rm d1}\beta)], \\ Q_{Z}^{HH,\psi^{-}}=2\,{\rm e}^{-\frac{\gamma}{2}}(1-Y_{0})^{2}[I_{0}(\beta-2\beta e_{\rm d1})+(1-Y_{0})^{2}\,{\rm e}^{-\frac{\gamma}{2}} \\ \hspace{50pt}-(1-Y_{0})\,{\rm e}^{-\frac{\gamma(1-e_{\rm d1})}{2}}I_{0}(e_{\rm d1}\beta)-(1-Y_{0})\,{\rm e}^{-\frac{\gamma e_{\rm d1}}{2}}I_{0}(\beta-e_{\rm d1}\beta)], \end{array}\end{eqnarray} \tag{ B.4 }$$

where I₀(·) is the modified Bessel function. Therefore, Q^HH_Z is given by

$$\begin{equation} Q_{Z}^{HH}=Q_{Z}^{HH,\psi^{+}}+Q_{Z}^{HH,\psi^{-}}. \end{equation} \tag{ B.5 }$$

Here, to simplify equation (B.2.1), we ignore background counts, i.e. Y₀ = 0, and use a second order approximation (as both β and γ are typically on the order of 0.01) such that

$$\begin{eqnarray*} &&I_{0}(\beta)=1+\frac{\beta^{2}}{4}+O(\beta^{4}), \nonumber \\ &&e^{\gamma}=1+\gamma+\frac{\gamma^{2}}{2}+O(\gamma^{3}), \end{eqnarray*}$$

then, equation (B.2.1) can be estimated as

$$\begin{eqnarray}&&\begin{array}{@{}l@{}} Q_{Z}^{HH,\psi^{+}}=\displaystyle\frac{\gamma^{2}e_{\rm d1}(1-e_{\rm d1})}{2}+\beta^{2}e_{\rm d1}(1-e_{\rm d1}),\\ Q_{Z}^{HH,\psi^{-}}=\displaystyle\frac{\gamma^{2}e_{\rm d1}(1-e_{\rm d1})}{2}-\beta^{2}e_{\rm d1}(1-e_{\rm d1}), \end{array}\end{eqnarray} \tag{ B.6 }$$

and Q^HH_Z is given by

$$\begin{equation} Q_{Z}^{HH}=\gamma^{2}e_{\rm d1}(1-e_{\rm d1}). \end{equation} \tag{ B.7 }$$

B.2.2. Derivation of Q^HV _Z

Alice (Bob) encodes her (his) state in the H (V) mode (symmetric to V (H)). We also assume θ₁θ₂ > 0. At Charles's side, the optical intensities received by each SPD are given by

$$\begin{eqnarray*} &&|A'|^{2}=\frac{(1-e_{\rm d1})\gamma_{\rm a}^{2}+e_{\rm d1}\gamma_{\rm b}^{2}-2\lambda\cos(\phi)}{2}, \nonumber \\ &&|B'|^{2}=\frac{e_{\rm d1}\gamma_{\rm a}^{2}+(1-e_{\rm d1})\gamma_{\rm b}^{2}-2\lambda\cos(\phi)}{2}, \nonumber \\ &&|C'|^{2}=\frac{(1-e_{\rm d1})\gamma_{\rm a}^{2}+e_{\rm d1}\gamma_{\rm b}^{2}+2\lambda\cos(\phi)}{2}, \nonumber \\ &&|D'|^{2}=\frac{e_{\rm d1}\gamma_{\rm a}^{2}+(1-e_{\rm d1})\gamma_{\rm b}^{2}+2\lambda\cos(\phi)}{2}. \end{eqnarray*}$$

The detection probability of each SPD is described by equation (B.3). Q^HV,ψ+ _Z and Q^HV,ψ− _Z can be calculated similarly to equation (B.4). After averaging over ϕ, the results are

$$\begin{eqnarray}&&\begin{array}{@{}l@{}} Q_{Z}^{HV,\psi^{+}}=2\,{\rm e}^{-\displaystyle\frac{\gamma}{2}}(1-Y_{0})^{2}[I_{0}(2\lambda)+(1-Y_{0})^{2}\,{\rm e}^{-\displaystyle\frac{\gamma}{2}}\\ \hspace{45pt}-(1-Y_{0})\,{\rm e}^{-\displaystyle\frac{\omega}{2}}I_{0}(\lambda)-(1-Y_{0})\,{\rm e}^{-\displaystyle\frac{\gamma-\omega}{2}}I_{0}(\lambda)],\\ Q_{Z}^{HV,\psi^{-}}=2\,{\rm e}^{-\displaystyle\frac{\gamma}{2}}(1-Y_{0})^{2}[1+(1-Y_{0})^{2}\,{\rm e}^{-\displaystyle\frac{\gamma}{2}}\\\hspace{45pt}-(1-Y_{0})\,{\rm e}^{-\displaystyle\frac{\omega}{2}}I_{0}(\lambda)-(1-Y_{0})\,{\rm e}^{-\displaystyle\frac{\gamma-\omega}{2}}I_{0}(\lambda)]. \end{array}\end{eqnarray} \tag{ B.8 }$$

Therefore, Q^HV _Z is given by

$$\begin{equation} Q_{Z}^{HV}=Q_{Z}^{HV,\psi^{+}}+Q_{Z}^{HV,\psi^{-}}. \end{equation} \tag{ B.9 }$$

To simplify equation (B.8) we once again ignore the background counts and take a second order approximation. Equation (B.8) can be estimated as

$$\begin{eqnarray}&&\begin{array}{@{}l@{}} Q_{Z}^{HV,\psi^{+}}=\displaystyle\frac{\omega(\gamma-\omega)}{2}+\lambda^{2}, \\ Q_{Z}^{HV,\psi^{-}}=\displaystyle\frac{\omega(\gamma-\omega)}{2}-\lambda^{2},\end{array} \end{eqnarray} \tag{ B.10 }$$

and Q^HV _Z is given by

$$\begin{equation} Q_{Z}^{HV}=\omega(\gamma-\omega). \end{equation} \tag{ B.11 }$$

B.2.3. Derivation of Q_Z and E_Z

Finally, Q_Z and E_Z can be expressed as

$$\begin{eqnarray}&&\begin{array}{@{}l@{}} Q_{Z}=\displaystyle\frac{Q_{Z}^{HH}+Q_{Z}^{HV}}{2},\\ E_{Z}=\displaystyle\frac{Q_{Z}^{HH}}{Q_{Z}^{HH}+Q_{Z}^{HV}},\end{array} \end{eqnarray} \tag{ B.12 }$$

where the different terms on the rhs of this equation are given by equations (B.2.1), (B.5), (B.8) and (B.9). Therefore, together with equation (B.1), we could derive the analytical key rate of equation (1).

If we ignore background counts and take the second order approximation from equations (B.6), (B.10), Q_Z and E_Z can be written as

$$\begin{eqnarray}&&\begin{array}{@{}l@{}} Q_{Z}=\displaystyle\frac{\beta^{2}+e_{\rm d}(1-\frac{e_{\rm d}}{2})(\gamma^{2}-2\beta^{2})}{2}, \\ E_{Z}=\displaystyle\frac{\gamma^{2}e_{\rm d}(1-\displaystyle\frac{e_{\rm d}}{2})}{4Q_{Z}}.\end{array} \end{eqnarray} \tag{ B.13 }$$

B.2.4. Q_Z and E_Z with opposite rotation angle

When U₁ and U₂ rotate the polarization in the opposite direction, i.e. θ₁θ₂ < 0, equation (B.2) changes to

$$\begin{eqnarray*} &&|A|^{2}=\frac{(1-e_{\rm d1})(\gamma_{\rm a}^{2}+\gamma_{\rm b}^{2})-2\gamma_{\rm a}\gamma_{\rm b}\cos(\phi)(1-e_{\rm d1})}{2}, \nonumber \\ &&|C|^{2}=\frac{(1-e_{\rm d1})(\gamma_{\rm a}^{2}+\gamma_{\rm b}^{2})+2\gamma_{\rm a}\gamma_{\rm b}\cos(\phi)(1-e_{\rm d1})}{2},\\ &&\nonumber |B|^{2}=\frac{e_{\rm d1}(\gamma_{\rm a}^{2}+\gamma_{\rm b}^{2})+2\gamma_{\rm a}\gamma_{\rm b}\cos(\phi)e_{\rm d1}}{2}, \nonumber\\ &&|D|^{2}=\frac{e_{\rm d1}(\gamma_{\rm a}^{2}+\gamma_{\rm b}^{2})-2\gamma_{\rm a}\gamma_{\rm b}\cos(\phi)e_{\rm d1}}{2}. \end{eqnarray*}$$

After performing similar procedures to those of section B.2.1, equation (B.6) is altered to

$$\begin{eqnarray}&&\begin{array}{@{}l@{}} Q_{Z}^{HH,\psi^{+}}=\frac{\gamma^{2}e_{\rm d1}(1-e_{\rm d1})}{2}-\beta^{2}e_{\rm d1}(1-e_{\rm d1}), \\ Q_{Z}^{HH,\psi^{-}}=\frac{\gamma^{2}e_{\rm d1}(1-e_{\rm d1})}{2}+\beta^{2}e_{\rm d1}(1-e_{\rm d1}).\end{array} \end{eqnarray} \tag{ B.14 }$$

Since the QBER is mainly determined by Q^HH_Z, by comparing equation (B.6) to (B.13), we conclude that

• θ₁θ₂ > 0 Projection on |ψ⁺〉 results in a larger QBER than that on |ψ⁻〉
• θ₁θ₂ < 0 Projection on |ψ⁺〉 results in a smaller QBER than that on |ψ⁻〉

An equivalent analysis can also be applied to Q^HV _Z following section B.2.2, and thus equation (B.10) is altered to

$$\begin{eqnarray}&&\begin{array}{@{}l@{}} Q_{Z}^{HV,\psi^{+}}=\frac{\omega(\gamma-\omega)}{2}-\lambda^{2}, \\ Q_{Z}^{HV,\psi^{-}}=\frac{\omega(\gamma-\omega)}{2}+\lambda^{2}.\end{array} \end{eqnarray} \tag{ B.15 }$$

Therefore, the key rates of R^ψ− (projections on the triplet) and R^ψ+ (projections on the singlet) are correlated with the relative direction of the rotation angles, while the overall key rate R (R = R^ψ−  + R^ψ+) is independent of the relative direction of the rotation angles.

We finally remark that in a practical polarization-encoding MDI-QKD system, the polarization rotation angle of each quantum channel (θ₁ or θ₂) can be modeled by a Gaussian distribution with a standard deviation of $\theta _{k}^{\mathrm { std}}=\arcsin (\sqrt {e_{k}})$ (k = 1,2), which means that both θ₁ and θ₂ (mostly) distribute in the range of [ − 3θ^std_k, 3θ^std_k] and the relative direction between them also randomly distributes between θ₁θ₂ > 0 and θ₁θ₂ < 0. Hence, the effect of the polarization misalignment is the same for R^ψ− and R^ψ+, i.e. both R^ψ− and R^ψ+ are independent of the total polarization misalignment. We can experimentally choose to measure either the singlet or the triplet by using only two detectors (but sacrificing half of the total key rate), such as in the experiments of [26, 29].

Here we discuss the properties of a practical asymmetric MDI-QKD system. For this, we derive an analytical expression for the estimated key rate and we optimize the system performance numerically.

C.1. Estimated key rate

The estimated key rate R_est is defined under the condition that background counts can be ignored. Note that this is a reasonable assumption for a short distance transmission.

Theorem 1. μ^opt_a and μ^opt_b only depend on x rather than on t_a or t_b; Under a fixed x, R_est is quadratically proportional to t_b.

Proof. when Y₀ is ignored, e^1,1_X and P^1,1Y^1,1_Z are given by (see equation (B.1))

$$\begin{eqnarray*} &&e_{X}^{1,1}=e_{\rm d}-\frac{e_{\rm d}^{2}}{2}, \nonumber \\ &&P^{1,1}_{Z}Y_{Z}^{1,1}=\frac{\mu_{\rm a}t_{\rm a}\mu_{\rm b}t_{\rm b}\,{\rm e}^{-(\mu_{\rm a}+\mu_{\rm b})}\eta_{\rm d}^{2}}{2}. \end{eqnarray*}$$

   □

If we take the second order approximation, Q_Z and E_Z are estimated as (see equation (B.13))

$$\begin{eqnarray}&&\begin{array}{@{}l@{}} Q_{Z}=\displaystyle\frac{t_{\rm b}^{2}\eta_{\rm d}^{2}[2x\mu_{\rm a}\mu_{\rm b}+(\mu_{\rm b}^{2}+x^{2}\mu_{\rm a}^{2})(2e_{\rm d}-e_{\rm d}^{2})]}{4}, \\ E_{Z}=\displaystyle\frac{(\mu_{\rm b}+x\mu_{\rm a})^{2}(2e_{\rm d}-e_{\rm d}^{2})}{2[2x\mu_{\rm a}\mu_{\rm b}+(\mu_{\rm b}^{2}+x^{2}\mu_{\rm a}^{2})(2e_{\rm d}-e_{\rm d}^{2})]}. \end{array}\end{eqnarray} \tag{ C.1 }$$

By combining the above two equations with equation (1), the overall key rate can be written as

$$\begin{equation} R_{\rm est}=\frac{t_{\rm b}^{2}\eta_{\rm d}^{2}}{2}G(x,\mu_{\rm a},\mu_{\rm b}), \end{equation} \tag{ C.2 }$$

where G(x,μ_a,μ_b) has the form

$$\begin{eqnarray}&&\fl G(x,\mu_{\rm a},\mu_{\rm b})= x\mu_{\rm a}\mu_{\rm b}\,{\rm e}^{-(\mu_{\rm a}+\mu_{\rm b})}\left[1-H_{2}\left(e_{\rm d}-\frac{e_{\rm d}^{2}}{2}\right)\right]\nonumber\\ &&-\frac{2x\mu_{\rm a}\mu_{\rm b}+(\mu_{\rm b}^{2}+x^{2}\mu_{\rm a}^{2})(2e_{\rm d}-e_{\rm d}^{2})}{2}\times f_{\mathrm{e}} H_2(E_Z), \end{eqnarray} \tag{ C.3 }$$

where E_Z is given by equation (C.1) and is also a function of (x,μ_a,μ_b). Therefore, optimizing R_est is equivalent to maximizing G(x,μ_a,μ_b) and the optimal values, μ^opt_a and μ^opt_b, are only determined by x. Under a fixed x, the optimal key rate is quadratically proportional to t_b. For a given x, the maximization of G(x,μ_a,μ_b) can be done by calculating the derivatives over μ_a and μ_b and verified using the Jacobian matrix.

C.2. Properties of asymmetric MDI-QKD

We numerically study the properties of an asymmetric MDI-QKD system. In our simulations below, the asymptotic key rate, denoted by R_rig, is rigorously calculated from the key rate formula given by equation (1) in which each term is shown in appendix B. R_est denotes the estimated key rate from equation (C.2). The practical parameters are listed in table 1. We used the method of Curty et al [33] for the finite-key analysis.

Firstly, figure C.1 simulates the key rates of R_rig and R_est at different channel lengths. For short distances (i.e. total length L_ac + L_bc < 100 km), the overlap between R_est and R_rig demonstrates the accuracy of our estimation model of equation (C.2). Therefore, in the short distance range, we could focus on R_est to understand the behaviors of the key rate. Moreover, from the curve of L_bc = 1 m, we have that this asymmetric system can tolerate up to x = 0.004 (120 km length difference for standard fiber links).

Zoom In Zoom Out Reset image size

Secondly, figure C.2 shows μ^opt_a and μ^opt_b, when both L_bc and L_ac are scanned from 1 m to 100 km. These parameters numerically verify theorem 1 at short distances (x ⩾ 0.5), μ^opt_a and μ^opt_b depend only on x, while at long distances (x < 0.5), background counts contribute significantly and result in non-smooth behaviors. μ^opt_a and μ^opt_b are both in O(1).

Zoom In Zoom Out Reset image size

Finally, we simulate the optimal key rates under two fixed x in figure C.3.

• (i)  
  Solid curves are the asymptotic keys: at short distances (L_bc + L_ac < 120 km), the maximal G(x,μ_a,μ_b) is fixed with a fixed x (see equation (C.3)). Taking the logarithm with base 10 of R_est and writing t_b = 10^−αL_bc, equation (C.2) can be expressed as

  $$\begin{equation} \log_{10}R_{\rm est}=-2\alpha L_{\mathrm{bc}}+\log_{10}\frac{\eta_{\rm d}^{2}G(x,\mu_{\rm a},\mu_{\rm b})}{2}.\end{equation} \tag{ C.4 }$$

  Hence, the scaling behavior between the logarithm (base 10) of the key rate and the channel distance is linear, which can be seen in the figure. Here, α = 0.2 dB km⁻¹ (standard fiber link) results in a slope of −0.4.
• (ii)  
  Dotted curves are the two decoy-state key rates with the finite-key analysis: we consider a total number of signals N = 10¹⁴ and a security bound of  = 10⁻¹⁰; for the dotted curve with x = 0.1, the optimal intensities satisfy μ_a/μ_b ≈ ν_a/ν_b ≈ 7, which means that the ratios for the optimal μ and ν are roughly the same and this ratio is mainly determined by x. Even taking the finite-key effect into account, the system can still tolerate a total fiber link of 110 km.

Zoom In Zoom Out Reset image size