Quantum key distribution with correlated sources

Assumptions on Alice’s and Bob’s devices

For simplicity, we consider a three-state protocol in which modulation devices are used to encode the bit and the basis choices. We do not explicitly consider the use of the decoy-state method (2–4); however, we remark that our framework could be combined with that method and also incorporate the effect of correlated intensity modulators and other imperfections of the intensity modulators (15). Furthermore, we assume an asymptotic scenario where Alice sends Bob an infinite number of pulses. We note, however, that the work presented here also applies to other protocols that use more than three states, as discussed in the next section.

Additional assumptions might be required depending on the particular security proof technique that is combined with our method. For instance, if the RT based on the GLT protocol (18) or the RT based on the original LT protocol (17), which we will present below, are used, then one also needs to assume that certain information about the states prepared by Alice is known. To be precise, for a setting choice j ∈ {0_Z,1_Z,0_X}, the state of the k^th pulse is in general purified into systems C_kB_kE and expressed as∣ψj〉CkBkE=aj∣ϕj〉CkBk∣λ〉E+1−aj2∣ϕj⊥〉CkBkE(1)

Here, we take a_j as a non-negative number satisfying 0 ≤ a_j ≤ 1, which is possible by appropriately choosing the global phase of the states. The subscript C_kB_kE stands for all the systems, which include not only the k^th qubit (system B_k) that Alice sends to Bob over the quantum channel but also the system C_k, which is needed for purifying the state of system B_k, and E is a system that includes Eve’s system. System E includes the systems sent by Alice over the quantum channel, such as the back-reflected light from a possible THA and the ancilla systems kept in Eve’s laboratory. As we will discuss further later, in general, this system also includes Alice’s ancilla systems used in the virtual entanglement-based protocol, which is equivalent to the actual protocol. Some of the latter systems store the setting information for all the pulses sent before the k^th pulse. This means, in particular, that ∣λ〉_E could depend on the setting choices for all the previous pulses. If it is not possible to find such a state, then a_j becomes simply zero. From construction, Eq. 1 is the most general state that can be prepared in a QKD protocol. In other words, Eq. 1 simply decomposes a state ∣ψ_j〉_CkBkE in a given Hilbert space into two states, each of which belongs to an orthogonal space. Precisely, one of them is the qubit state ∣ϕ_j〉_CkBk∣λ〉_E (as the set of states {∣ϕ_j〉_CkBk∣λ〉_E}_j constitutes a qubit space), with ∣λ〉_E being a state independent of the k^th setting choice, and the other is the setting-dependent side-channel state ∣ϕj⊥〉CkBkE that corresponds to unwanted and possibly unknown modes. This decomposition can always be done for an appropriate choice of a_j with 0 ≤ a_j ≤ 1. The characterization of ∣ϕj⊥〉CkBkE is not required for the RT, and, in particular, no relationships between the states ∣ϕj⊥〉CkBkE and ∣ϕj˜⊥〉CkBkE and between ∣ϕ_j〉_CkBkE and ∣ϕj˜⊥〉CkBkE for j≠j˜ are required, where j∼ represents a different setting choice to j. To use the RT, we only need to know a lower bound on the coefficient a_j in Eq. 1 and a full characterization of the density operator of the qubit B_k. The main contribution of our work is to show that one can accommodate the effect of pulse correlations through the parameter a_j in Eq. 1.

The assumptions on Bob’s devices also depend on the security proof. For example, in the case of the RT based on the GLT protocol or based on the original LT protocol, one assumes that Bob measures the incoming pulses in the Z or the X basis. More precisely, Bob’s measurements are represented by the positive operator–valued measures (POVMs) {m̂0Z,m̂1Z,m̂f} and {m̂0X,m̂1X,m̂f}, respectively. Here, m̂αβ corresponds to Bob obtaining the bit value α ∈ {0,1} when selecting the basis β ∈ {Z, X}, and m̂f is associated with an inconclusive outcome. That is, we assume that these measurements satisfy the basis-independent efficiency condition, i.e., we impose that the operator m̂f is the same for both basis. Note that this condition is usually used in security proofs to remove detector side-channel attacks exploiting channel loss (34, 35); however, it is not necessary in MDI-QKD, to which our framework also applies. Furthermore, we emphasize that our method to deal with pulse correlations could be used as well with security proofs where the basis-independent efficiency condition is not guaranteed, such as in (36).

Security analysis in the presence of pulse correlations

In this section, we present the security analysis of QKD with pulse correlations. For this, we consider a security proof with the following properties. It uses an entanglement-based virtual protocol where Alice prepares pulses in an entangled state, and she (Bob) measures the local (incoming) systems to distill a secret key. In addition, it considers a particular detected pulse to estimate the phase error rate (or the phase error rate as a bound of the min-entropy). For simplicity, in what follows, we shall explicitly mention only the phase error rate, but it applies to both cases. Security against coherent attacks can then be guaranteed with the help of Azuma’s inequality (37), Kato’s inequality (38), or by applying the techniques in (39, 40). Moreover, we assume that the security proof can be generalized such that it applies to a particular pulse with a side channel. That is, it can be used to prove the security of QKD in the presence of active and/or passive information leakage. Thanks to the reduction technique presented below, a particular pulse affected by correlations can be regarded as a pulse with a side channel, and therefore, the security of QKD with pulse correlations is guaranteed. As an example, we now demonstrate that running a three-state protocol in the presence of nearest-neighbor pulse correlations can be regarded as a three-state protocol in which each of the pulses entails side channels. We emphasize, however, that it is straightforward to generalize this reduction technique to an m-state protocol, as discussed below, and to arbitrarily long-range correlations (see Materials and Methods for more details).

Particular device model

Having stated the framework for the security proof in the presence of pulse correlations, we now consider a particular device model with only nearest-neighbor pulse correlations. The purpose of this section is to show how to obtain the parameters needed in Eq. 1 for a particular example of device model. Once this is achieved, one can directly apply the RT to guarantee the security of practical QKD implementations. We remark that for simplicity, below, we do not consider THAs or mode dependencies. However, they could readily be included by using the method in (18). In addition, we assume that a single-photon source is available, and as a concrete example for modeling pulse correlations, we select the following instance of nearest-neighbor pulse correlation∣ψjk∣jk−1′〉Bk=1−ϵ∣ϕjk〉Bk+eiθjk∣jk−1′ϵ∣ϕjk⊥〉Bk(10)for the three states. Here, ∣ψjk∣jk−1′〉Bk is a single-photon state living in a qubit space with j_k ∈ {0_Z,1_Z,0_X}, ∣ϕ_jk〉_Bk is a qubit state, the parameter ϵ intuitively quantifies the strength of the correlation, θ_{jk ∣ j′k − 1} represents how the k^th state depends on the previous information j′_{k − 1}, and ∣ϕjk⊥〉Bk is a state, in the same qubit space, that is orthogonal to ∣ϕ_jk〉_Bk. Note that, when there are no pulse correlations, i.e., ϵ = 0, the state ∣ψjk∣jk−1′〉Bk becomes the perfect state ∣ϕ_jk〉_Bk, which does not depend on the previous setting jk−1′. However, in the presence of pulse correlations, i.e., when ϵ > 0, the overall state ∣ψjk∣jk−1′〉Bk diverges from the ideal state ∣ϕ_jk〉, since it becomes dependent on the previous setting choice. The physical intuition of this model derives from the functioning of a phase modulator. To be precise, the state of an emitted pulse is typically affected by the modulation of the previous pulses such that there is a deviation depending on its preselected phase, which is quantified in the example given in Eq. 10 by θjk∣jk−1′.

Below, we show how to derive the state in the form of Eq. 1 for this particular example starting from Eq. 10. For this, we follow the idea introduced in the previous section and obtain the states ∣ψjk∣jk−1′〉Bk∣λjk〉Ak+1,⋯,An,Bk+1,⋯,Bn given by Eq. 6. By using Eq. 10, we have that∣ψjk∣jk−1′〉Bk∑jk+1∣jk+1〉Ak+1,⋯,An,Bk+2,⋯,Bn∣ψjk+1∣jk〉Bk+1=(1−ϵ∣ϕjk〉Bk+eiθjk∣jk−1′ϵ∣ϕjk⊥〉Bk)⊗∑jk+1∣jk+1〉Ak+1,⋯,An,Bk+2,⋯,Bn(1−ϵ∣ϕjk+1〉Bk+1+eiθjk+1∣jkϵ∣ϕjk+1⊥〉Bk+1)≕(1−ϵ)∣ϕjk〉Ak+1,⋯,An,Bk,Bk+1,⋯,Bn+1−(1−ϵ)2∣ϕjk∣jk−1′⊥〉Ak+1,⋯,An,Bk,Bk+1,⋯,Bn(11)where∣ϕjk〉Ak+1,⋯,An,Bk,Bk+1,⋯,Bn=∣ϕjk〉Bk∑jk+1∣jk+1〉Ak+1,⋯,An,Bk+2,⋯,Bn∣ϕjk+1〉Bk+1(12)is a qubit state (note that the set {∣ϕjk〉Ak+1,⋯,An,Bk,Bk+1,⋯,Bn}jk∈{0Z,1Z,0X} spans a two-dimensional space) since ∑_{jk + 1}∣j_{k + 1}〉_{Ak + 1, ⋯, An, Bk + 2, ⋯, Bn}∣ϕ_{jk + 1}〉_Bk+1 is a normalized state independent of the information j_k, and ∣ϕjk∣jk−1′⊥〉Ak+1,⋯,An,Bk,Bk+1,⋯,Bn is a state orthogonal to this qubit state. The explicit form of ∣ϕjk∣jk−1′⊥〉Ak+1,⋯,An,Bk,Bk+1,⋯,Bn is omitted here for simplicity, but it could be straightforwardly obtained from Eq. 11. We can regard our protocol as a protocol that uses the states in Eq. 11 rather than the ideal states ∣ϕ_jk〉_Bk for any k. We emphasize once again that the parameter ϵ and the state ∣ϕjk∣jk−1′⊥〉Ak+1,⋯,An,Bk,Bk+1,⋯,Bn in Eq. 11 represent most of the source imperfections (i.e., SPFs, mode dependencies, and THAs could be incorporated in a state of the form given by Eq. 11) (18), not only pulse correlations. This comes from the generality of Eq. 1.

Now, our formalism to deal with pulse correlations can be used directly with the RT since the states in Eq. 11 are in the form of Eq. 1. For the RT (described in the next section), we only require to know a lower bound on the coefficient 1 − ϵ and a full characterization of the state ∣ϕ_jk〉_Bk. We remark, however, that this framework can also be applied to the numerical techniques in (22–24) if, in addition, the form of the state ∣ϕjk∣jk−1′⊥〉Ak+1,⋯,An,Bk,Bk+1,⋯,Bn is known or if bounds involving the inner products Ak+1,⋯,An,Bk,Bk+1,⋯,Bn〈ϕjk∣jk−1′⊥∣ϕj˜k∣jk−1′⊥〉Ak+1,⋯,An,Bk,Bk+1,⋯,Bn and Ak+1,⋯,An,Bk,Bk+1,⋯,Bn〈ϕjk∣jk−1′∣ϕj˜k∣jk−1′⊥〉Ak+1,⋯,An,Bk,Bk+1,⋯,Bn for jk≠j˜k can be estimated, where j˜k represents a different setting choice to j_k.

Here, we restricted the discussion to the case of nearest-neighbor pulse correlations, but our analysis also applies to arbitrarily long-range correlations. For instance, these correlations could be characterized by∣Bk〈ψjk∣jk−1,⋯,jw+1,j˜w,jw−1,⋯,j1∣ψjk∣jk−1,⋯,jw+1,jw,jw−1,⋯,j1〉Bk∣2≥1−ϵk−w(13)for any w and k with w < k. That is, the correlation could be characterized through the response according to the change of the w^th index. In other words, we can quantify the correlation represented by ϵ_{k − w}, where k–w is the range of the correlation, by looking at the distinguishability of the states. Here, k–w can be any non-negative number, meaning that our method can incorporate arbitrary long-range correlations. One can show that from this model, it is straightforward to obtain the three states in the form given by Eq. 1 (see Materials and Methods) and consequently apply the RT.

RT based on the original LT protocol

In this section, we introduce a new framework for security proofs, the RT, which results in a high secret key rate in the presence of source imperfections. In what follows, we outline the intuition behind the key idea of the RT by applying it to the original LT protocol (17). A full description of the RT, including the detailed security proof, is presented in Materials and Methods. To simplify the discussion, here, we shall assume collective attacks; however, our analysis can be generalized to coherent attacks (see Materials and Methods for more details). Only as an example, we consider a protocol with a single-photon source in the presence of side-channel information, such as pulse correlations, in which Alice prepares the following three states for each pulse emission∣ψjk∣jk−1′〉B=(1−ϵ)∣ϕjk〉B+1−(1−ϵ)2∣ϕjk∣jk−1′⊥〉B(14)where B denotes the system to be sent to Bob. We remark that this subscript B could be replaced with A_{k + 1}, ⋯, A_n, B_k, B_{k + 1}, ⋯, B_n and then we would recover Eq. 11. However, in this section, we prefer to use Eq. 14 rather than Eq. 11 for simplicity of notation. Note that, here, we analyze the case of nearest-neighbor pulse correlations, but the RT is also applicable to arbitrary long-range pulse correlations. In Eq. 14, ∣ϕ_jk〉_B is a qubit state while ∣ϕjk∣jk−1′⊥〉B corresponds to the side-channel state for j_k ∈ {0_Z,1_Z,0_X} that lives in any dimensional Hilbert space and is orthogonal to ∣ϕ_jk〉_B for each setting choice j_k. However, we do not assume any relationship between ∣ϕjk∣jk−1′⊥〉B and ∣ϕj˜k∣jk−1′⊥〉B for jk≠j˜k. For instance, ∣ϕ_jk〉_B can be defined as in (18) such that∣ϕ0Z〉B=∣0Z〉B,∣ϕ1Z〉B=−sin (δ2)∣0Z〉B+cos (δ2)∣1Z〉B,∣ϕ0X〉B=cos (π4+δ4)∣0Z〉B+sin (π4+δ4)∣1Z〉B(15)where {∣0_Z〉, ∣1_Z〉} is a qubit basis and δ( ≥ 0) is the deviation of the phase modulation from the intended value due to SPFs (18). That is, when there is no side-channel information, the states of the single photons sent by Alice have the form given by Eq. 15, but in the presence of side-channel information, however, these states are defined by Eqs. 14 and 15.

To prove the security of this protocol, we need to evaluate its phase error rate. The key idea of the RT is to consider the phase error rate estimation that we would obtain if we replace the actual set of states of the protocol, {∣ψ0Z∣jk−1′〉B,∣ψ1Z∣jk−1′〉B,∣ψ0X∣jk−1′〉B}, with another set of states, which we call the reference states. Being the intuition that since the actual and the reference states are close to each other, one should be able to obtain a relationship between the events associated with the actual states by slightly modifying the relationship for the reference states. Note that the choice of reference states is, in principle, infinite; however, for higher secret key rates, they should be linearly dependent states such that unambiguous state discrimination (41, 42) is not possible. This allows us to use directly the original LT protocol (17) to estimate precisely some quantities associated with the reference states and their relationship as an intermediate step toward obtaining the phase error rate associated with the actual states.

As an example, we select the reference states to be {∣ϕ0Z〉B,∣ϕ1Z〉B,∣ϕ0X〉B}, which are defined in Eq. 15 and that correspond to the qubit part of the actual states in Eq. 14. In addition, we fictitiously consider that Alice chooses the reference states with the same probabilities as the actual states. Now, we can apply the RT in the following way. The first step is to find an expression for the probability of a phase error in terms of the reference states, which is a key parameter to be estimated in the security proof. For this, we consider an entanglement-based virtual protocol (see Materials and Methods for further details) using the reference states, where Alice prepares the virtual states∣ϕαXvir〉B=∣ϕ0Z〉B+(−1)α∣ϕ1Z〉B2(1+(−1)αB〈ϕ0Z∣ϕ1Z〉B)(16)with α ∈ {0,1} and where, for simplicity, we assumed that the selection probabilities in the Z basis satisfy p0Z=p1Z. We can then define the probability of a phase error conditional on the reference states asP(ph∣Ref)≔p1XvirpZBTr[∣ϕ1Xvir〉〈ϕ1Xvir∣BM̂0X]+p0XvirpZBTr[∣ϕ0Xvir〉〈ϕ0Xvir∣BM̂1X](17)where pαXvir=12pZA(1+(−1)αB〈ϕ0Z∣ϕ1Z〉B) is the probability that Alice sends the virtual states defined in Eq. 16, pZA≔p0Z+p1Z(pZB) is the probability that Alice (Bob) selects the Z basis, and M̂αX is Bob’s POVM element after any attack by Eve in the actual protocol. That is, M̂αX≔∑e∼K̂e∼m̂αXK̂e∼†, where K̂e∼ is the Kraus operator representing Eve’s action in the actual protocol, e∼ corresponds to her measurement outcome, and m̂αX is Bob’s POVM element for detecting α_X in the actual protocol. The probabilities Tr[∣ϕ1Xvir〉〈ϕ1Xvir∣BM̂0X] and Tr[∣ϕ0Xvir〉〈ϕ0Xvir∣BM̂1X] in Eq. 17 cannot be directly obtained since they involve reference and virtual states, which are never sent in reality. However, by exploiting the fact that the reference states are all qubit states, one can follow the idea of the original LT protocol (17) and get a simple relationship between these probabilities and the probabilities associated with the reference states. To see this, first, note that in a qubit space, the following expressions hold∣ϕ1Xvir〉〈ϕ1Xvir∣B=a∣ϕ0Z〉〈ϕ0Z∣B+b∣ϕ1Z〉〈ϕ1Z∣B−c∣ϕ0X〉〈ϕ0X∣B,∣ϕ0Xvir〉〈ϕ0Xvir∣B=∣ϕ0X〉〈ϕ0X∣B(18)where the coefficients a, b, and c are defined in Materials and Methods. We remark that if there are no SPFs, then the coefficients become a = b = c = 1. Then, by substituting Eq. 18 into Eq. 17, we obtain an expression for the probability of a phase error in terms of the reference states0=p1XvirpZBaTr[∣ϕ0Z〉〈ϕ0Z∣BM̂0X]+p1XvirpZBbTr[∣ϕ1Z〉〈ϕ1Z∣BM̂0X]+p0XvirpZBTr[∣ϕ0X〉〈ϕ0X∣BM̂1X]−[p1XvirpZBcTr[∣ϕ0X〉〈ϕ0X∣BM̂0X]+P(ph∣Ref)] (19)

In the RT, we call Eq. 19 the reference formula since it is used as a reference to obtain a similar expression in terms of the actual states. Note that we cannot use the reference formula directly in the security proof because it entails probabilities associated with the reference states, rather than the actual states.

Fortunately, by evaluating the deviation between the reference and the actual states, we can obtain bounds on the probabilities associated with the actual states and, consequently, the phase error rate of the actual protocol. This part of the RT corresponds to the deviation evaluation part (see Materials and Methods for further details). By following the analysis in the Supplementary Materials, we have that this deviation is quantified by usinggL(Tr[∣A〉〈A∣M̂],∣〈A∣R〉∣)≤Tr[∣R〉〈R∣M̂]≤gU(Tr[∣A〉〈A∣M̂],∣〈A∣R〉∣)(20)where M̂ is any non-negative bounded operator such that 0≤M̂≤1 and A and R are any normalized states associated with the actual and reference states, respectively. Here, the functions g^L(x, y) and g^U(x, y) are defined asgL(x,y)={0x<1−y2x+(1−y2)(1−2x)−2y(1−y2)x(1−x)x≥1−y2(21)andgU(x,y)={x+(1−y2)(1−2x)+2y(1−y2)x(1−x)x≤y21x>y2(22)

No measurement, including any measurement performed by Eve, can induce a larger deviation between the probabilities because Eq. 20 holds for any M̂. We remark that, here, one could also use the trace distance argument (15); however, for the problem at hand, that bound is loose, and therefore, we use a tighter bound. That is, we use the knowledge of the probability associated with the observable events in the actual protocol, i.e., Tr[∣A〉〈A∣M̂], while the trace distance does not.

Now, we apply Eq. 20 to the first three terms and the last line of Eq. 19 separately, thus converting Eq. 19 into an expression for the probability of a phase error in terms of the actual states. For instance, note that the last line can be expressed by −pZBS−Tr[∣A−〉〈A−∣CBM̂−] with ∣A−〉CB≔p1Xvirc/S−∣0x,A,XB〉C∣ψ0X∣jk−1′〉B+pZA/2S−∣0z,A,ZB〉C∣ψ0Z∣jk−1′〉B+pZA/2S−∣1z,A,ZB〉C∣ψ1Z∣jk−1′〉B and M̂−≔P̂(∣0x,A,XB〉C)⊗M̂0X+P̂([∣0z,A,ZB〉C−∣1z,A,ZB〉C]/2)⊗M̂0X+P̂([∣0z,A,ZB〉C+∣1z,A,ZB〉C]/2)⊗M̂1X where S−=p1Xvirc+pZA, system C is an ancilla that stores the classical information associated with Alice’s and Bob’s setting choices, and P̂(∣·〉)=∣·〉〈·∣ (see Materials and Methods). Here, we have mathematically represented the summed probabilities using the trace. By obtaining a similar expression for the first three terms of Eq. 19, we find that this equation becomes (see Materials and Methods)0≤S+gU(p1XvirpZBaS+Tr[∣ψ0Z∣jk−1′〉〈ψ0Z∣jk−1′∣BM̂0X]+p1XvirpZBbS+Tr[∣ψ1Z∣jk−1′〉〈ψ1Z∣jk−1′∣BM̂0X]+p0XvirpZBS+Tr[∣ψ0x∣jk−1′〉〈ψ0x∣jk−1′∣BM̂1X],1−ϵ)−S−gL(p1XvirpZBcS−Tr[∣ψ0x∣jk−1′〉〈ψ0x∣jk−1′∣BM̂0X]+P(ph∣Act)S−,1−ϵ)(23)where S+=p1Xvira+p1Xvirb+p0Xvir andP(ph∣Act)≔p˜1XvirpZBTr[∣ψ1X∣jk−1′vir〉〈ψ1X∣jk−1′vir∣BMˆ0X]+p˜0XvirpZBTr[∣ψ0X∣jk−1′vir〉〈ψ0X∣jk−1′vir∣BMˆ1X](24)is the probability of a phase error conditional on the actual states. In Eq. 24, ∣ψαX∣jk−1′vir〉B are the virtual states associated with the actual states, and p∼αXvir are their respective probabilities. The explicit form of ∣ψαX∣jk−1′vir〉B is omitted here for simplicity, but similar to Eq. 16, ∣ψαX∣jk−1′vir〉B∝∣ψ0Z∣jk−1′〉B+(−1)α∣ψ1Z∣jk−1′〉B. Equation 23 is valid for any eavesdropping strategy, i.e., any Kraus operator K̂e∼, that is included in the operators M̂αX (see discussion just after Eq. 17), and it can be directly used for the phase error estimation in the actual protocol. To clearly see how Eq. 23 is related with quantities observed in an actual experiment, we rewrite it as0≤S+gU(p1XvirpZBaS+p0ZpXBP(q0z,0x∣Act)+p1XvirpZBbS+p1ZpXBP(q1z,0x∣Act)+p0XvirpZBS+p0XpXBP(q0x,1x∣Act),1−ϵ)−S−gL(p1XvirpZBcS−p0XpXBP(q0x,0x∣Act)+P(ph∣Act)S−,1−ϵ)(25)where, e.g., P(q0z,0x∣Act)≔p0ZpXBTr[∣ψ0Z∣jk−1′〉〈ψ0Z∣jk−1′∣BM̂0X] is the joint probability (i.e., the yield) that Alice selects the setting 0_Z and prepares the state ∣ψ0Z∣jk−1′〉B and Bob’s measurement outcome is 0_X. Last, by solving Eq. 25 with respect to P(ph∣Act), we obtain the probability of a phase error of the actual protocol. The phase error rate is then defined as e_X = P(ph∣Act)/Y_Z, where Y_Z ≔ P(q_0z,0z ∣Act) + P(q_0z,1z∣Act) + P(q_1z,0z∣Act) + P(q_1z,1z∣Act) is the yield in the Z basis, i.e., the joint probability that Alice and Bob choose the Z basis and Bob obtains a detection event.

Simulation of the secret key rate

To show the performance of QKD in the presence of pulse correlations, we now present the simulation results. For simplicity of discussion, here, we apply our framework to two different cases of the RT: the RT based on the GLT protocol (18) and the RT described in the previous section. We remark that the GLLP type security proofs (19–21) are also regarded as a special case of the RT where we select the actual states as the reference states and skip the reference formula part (see the Supplementary Materials for the proof of this claim). However, they involve four states, rather than three states, and analytical or numerical optimization is required. The comparison between the RT based on the GLLP type security proofs and the RT based on the original LT protocol is presented in the Supplementary Materials.

The main difference between the RT based on the GLT protocol and the RT based on the original LT protocol is that, in the former, a different bound is used to estimate the probabilities associated with the actual states. More precisely, the RT based on the GLT protocol essentially uses an inequality involving eigenvalues, instead of Eq. 20, which has the formTr[∣ϕjk〉〈ϕjk∣BM̂αX]+λjkmin≤Tr[∣ψ0Z∣jk−1′〉〈ψ0Z∣jk−1′∣BM̂αX]≤Tr[∣ϕjk〉〈ϕjk∣BM̂αX]+λjkmax(26)

Here, λjkmin and λjkmax are the eigenvalues of a matrix in the form [CjkBjk*Bjk0], where Bjk=(1−ϵ)1−(1−ϵ)2 and C_jk = 1 − (1 − ϵ)². The inequality in Eq. 26 is valid for any M̂αX with α ∈ {0,1}, and therefore, we can use it to consider the deviation between the probabilities associated with the reference states and the ones associated with the actual states [see (18) for more details]. We emphasize that pulse correlations are not taken into account in (18); however, we can apply our method to deal with pulse correlations to this security analysis. In doing so, we simply consider a QKD protocol with the states in Eqs. 14 and 15 and apply the RT based on the GLT protocol. That is, besides pulse correlations, we also include the effect of SPFs by assuming δ > 0 in Eq. 15. Furthermore, recall that system B in Eqs. 14, 15, and 26 can include more systems, not only those sent to Bob. In these equations, the subscript B could be replaced by A_{k + 1}, ⋯, A_n, B_k, B_{k + 1}, ⋯, B_n, allowing us to consider pulse correlations as the side channel. Note that to simplify the mathematical analysis, we do not trace out Alice’s subsequent systems A_{k + 1}, ⋯, A_n. Since these systems are independent of the setting j_k, they do not provide any relevant information to Eve, and therefore, they do not affect our estimation of the phase error rate.

For the simulations, we assume the asymptotic regime where the secret key rate formula for a single-photon source can be expressed asR≥YZ(1−h(eX)−fh(eZ))(27)where, as defined before, Y_Z is the yield in the Z basis and e_X is the phase error rate. The term e_Z is the bit error rate, h(x)=−xlog2(x)−(1−x)log2(1−x) is the binary entropy function, and f is the error correction efficiency. Note that Y_Z and e_Z are directly observed in a practical implementation of the protocol, but in the simulations, a channel model [see (18) for more details] is used instead. The experimental parameters used are as follows: dark count rate of Bob’s detectors p_d = 10⁻⁷, f = 1.16, and the probabilities for Alice and Bob to select the Z basis are, for simplicity, pZA=23 and pZB=12. Unfortunately, there are no quantitative works characterizing pulse correlations (i.e., the value of the parameter ϵ); therefore, for illustration purposes, we select the values 10⁻³ and 10⁻⁶ to evaluate this imperfection. In addition, to investigate how the length of the pulse correlations affects the secret key rate, we consider the nearest-neighbor correlation ϵ₁, as well as correlations among two subsequent pulses, ϵ₂, and among 10 subsequent pulses, ϵ₁₀ (see Eq. 13 for the definitions of these ϵ parameters). Regarding SPFs, we choose δ = 0 and δ = 0.063 according to the experimental results reported in (43–45). The results for the RT based on the GLT protocol and for the RT based on the original LT protocol are illustrated in Fig. 1.

• Download high-res image
• Open in new tab
• Download Powerpoint

As expected, this figure shows that when the magnitude of pulse correlations characterized by ϵ_i increases, the secret key rate decreases. In addition, as the length of the correlations, taken into account, increases, the secret key rate drops. We note, however, that even when long-range correlations are considered, a secret key can still be obtained. Namely, Fig. 1 shows that for ϵ = 10⁻⁶, one can generate a secret key even when there are correlations between 10 subsequent pulses. For a smaller value of the parameter ϵ_i, longer correlations can be included. If ϵ_i is small enough, then one can consider a very long range of pulse correlations while guaranteeing the security of QKD.

We emphasize that the security proof selected highly affects the results obtained, and this is also illustrated in Fig. 1, where we apply our technique to two different cases of the RT. To compare the RT based on the GLT protocol and the RT based on the original LT protocol as a function of pulse correlations, one can examine panels (A) and (B) or (C) and (D) of Fig. 1. Noticeably, as the magnitude of the pulse correlation ϵ_i increases, the secret key rate deteriorates for both of them. However, the RT based on the LT protocol outperforms the RT based on the GLT protocol in all the parameter regimes investigated. In addition, by comparing panels (A) and (C) or (B) and (D) of Fig. 1, one can see the effect of SPFs. As expected, the RT based on the GLT protocol and the RT based on the LT protocol are barely affected by this imperfection since they inherit, from the GLT protocol and the original LT protocol, respectively, high tolerance against SPFs with channel loss. The big difference observed in Fig. 1 between these two cases of the RT arises because of the following reason. Recall that we need to evaluate the deviation between the probabilities associated with the reference states and those associated with the actual states. For this, the bound used in the RT based on the GLT protocol is obtained by calculating certain eigenvalues, and thus, they entail square root terms, which deteriorate the secret key rate. Note that in the trace distance argument (15), square root terms are also present, resulting in loose bounds. On the other hand, the RT based on the original LT provides a tighter estimation of the phase error rate thanks to the bound in Eq. 20. More precisely, the square root terms in Eq. 20 include detection probabilities, which decrease as the channel loss increases, while for the other two bounds, the square root terms are constant, and thus, the high performance is maintained by using the bound in Eq. 20. Last, we remark again that the RT framework is general and can be applied to other QKD protocols as well, as shown in the Supplementary Materials.