Improving the performance of practical decoy-state quantum key distribution with advantage distillation technology

Abstract

Quantum key distribution (QKD) provides a promising solution for sharing information-theoretic secret keys between two remote legitimate parties. To improve the maximal transmission distance and the maximal error rate tolerance, we apply the advantage distillation technology to analyze the security of practical decoy-state QKD systems. Based on the practical experimental parameters, the device-dependent QKD protocols and the measurement-device-independent QKD protocols have been respectively analyzed, and our analysis results demonstrate that the advantage distillation technology can significantly improve the performance of various QKD protocols. In the four-state and six-state device-dependent QKD protocols, we prove that the maximal transmission distance can be improved from 142 km to 180 km and from 146 km to 187 km respectively. In the four-state and six-state measurement-device-independent QKD protocols, we prove that the maximal transmission distance can be improved from 195 km to 273 km and from 200 km to 282 km respectively.

Introduction

Quantum key distribution (QKD)^1,2 is the art of sharing the information-theoretic secure key between two different remote parties Alice and Bob, while the eavesdropper Eve cannot get the secret key information even if she has unlimited computation and storage power^3,4,5. The practical QKD system includes four steps to generate the final secret key. In the first step, Alice randomly chooses two classical bits to modulate a single-photon quantum state in two bases, which will be sent to Bob through a public quantum channel. In Bob’s side, he randomly chooses a basis to measure the received quantum states. In the second step, Alice and Bob publicly exchange the basis information with an authenticated classical channel, and they only retain those events with the same basis, which is called the raw key. In the third step, they apply the advantage distillation technology to increase the correlation between their raw key, thus they can get an advantage over Eve. In the fourth step, they perform the error correction and privacy amplification to generate the final secret key. Note that the third step may be omitted if the quantum bit error rate (QBER) is small in practical QKD systems, where the advantage distillation technology may have no advantage to increase the correlation. However, in the case of eavesdropping or long transmission distance, QBER will become higher, which will severely reduce the final secret key. Luckily, the advantage distillation technology can be adopted to improve the secret key rate in QKD.

The advantage distillation technology was firstly proposed in the classical cryptography theory⁶, which was then utilized in the device-dependent QKD (DD-QKD) protocol^7,8,9 and device-independent (DI) QKD protocol¹⁰ respectively. By considering the single-photon state modulation, the security of different QKD protocols has been proved with and without the advantage distillation technology respectively^7,8,11,12, and the analysis results demonstrate that the advantage distillation technology can improve the error tolerance of different QKD protocols. However, practical QKD systems are usually based on weak coherent sources, the multi-photon events of which may introduce the photon number splitting attack^13,14. Fortunately, the decoy-state method^15,16,17 can be applied to detect this attack, which has been a routine in practical QKD systems. More recently, some statistical fluctuation analysis methods have been proposed to account for the finite-size key effects on the achievable secret key generation rate^18,19,20,21.

In practical decoy-state QKD implementations, there are two important questions to be solved. One is how to increase the transmission distance without quantum repeaters, and the other is how to increase the tolerable background error rate. Since the practical quantum repeater technology is still immature until now, measurement-device-independent-QKD (MDI-QKD) protocols^22,23 have been proposed to increase the transmission distance, which require the optical interference device in the middle of the quantum channel. More recently, to beat the Pirandola-Laurenza-Ottaviani-Banchi (PLOB) bound²⁴, twin-field QKD²⁵ was proposed. However, new QKD protocols usually need to change the hardware devices in the first step, which cannot be directly applied in the established QKD systems.

In this paper, to solve these questions, we apply the repetition-code based advantage distillation technology in decoy-state DD-QKD and MDI-QKD protocols respectively. By applying the practical DD-QKD experimental parameters²⁶, we prove that, for the four-state and six-state DD-QKD protocols, the maximal transmission distance can be improved from 142 km to 180 km and from 146 km to 187 km respectively, and the maximal tolerable background error rate can be improved from 6.2% to 16.4% and from 7% to 21.8% respectively. By applying the practical MDI-QKD experimental parameters^18,27, we prove that, for the four-state and six-state MDI-QKD protocols, the maximal transmission distance can be improved from 195 km to 273 km and from 200 km to 282 km respectively, and the maximal tolerable background error rate can be improved from 4.5% to 14% and from 4.9% to 18% respectively. The analysis results demonstrate that the advantage distillation technology can significantly improve the maximal transmission distance and the maximal tolerable background error rate in different QKD systems. More importantly, the advantage distillation technology does not change the hardware devices about the quantum state preparation and measurement, which can be directly applied to current QKD systems^28,29,30.

Results

Decoy-state device-dependent QKD with advantage distillation

In practical DD-QKD systems, phase-randomized weak coherent sources, which can be seen as a mixture of photon-number states, are usually applied to modulate quantum states. However, the multi-photon states can be utilized by Eve to launch the photon number splitting attack. Fortunately, the decoy-state method can be applied to estimate the single-photon counting rate and error rate. By considering the weak coherent pulse with the mean photon number μ, the secret key rate can be estimated with the GLLP (Gottesman-Lo-Lütkenhaus-Preskill)³¹ formula

$${R}_{{{\mbox{decoy}}}}\ge {Q}_{\mu }\left[\frac{{Y}_{1}{P}_{1}}{{Q}_{\mu }}S{(A| E)}_{{{\mbox{single photon}}}}-H(A| B)\right],$$

(1)

where P₁ is the single-photon probability in Alice’s signal states, Y₁ is the single-photon counting rate and Q_μ is the total counting rate of signal states. E is Eve’s ancillary state, S(A∣E) = S(A, E) − S(E), H(A∣B) = H(A, B) − H(B), $H(x)=-x\log (x)-(1-x)\log (1-x)$ and $S(\rho )=-\,{{\mbox{tr}}}\,(\rho \log \rho )$ are the entropy functions. S(A∣E)_{single photon} is the conditional entropy by considering the single-photon state preparation in Alice’s side.

Based on the entanglement distillation and purification technology, S(A∣E)_{single photon} can be restricted by S(A∣E)_{single photon} ≥ 1 − H(e₁), where e₁ is the single-photon error rate. Note that S(A∣E)_{single photon} can also be analyzed with the information-theoretical security analysis method, where the detailed explanation is given in the Methods section. Since only the single-photon pulses can be used to generate the final secret key, we can apply the entanglement based QKD protocol to analyze the final secret key rate. In the entanglement based QKD protocol, Alice prepares quantum state $\frac{1}{\sqrt{2}}(\left|00\right\rangle +\left|11\right\rangle )$ and sends the second particle to Bob. After quantum channel transmission, Alice and Bob share quantum state ${\sigma }_{AB}={\sum }_{i=0}^{3}{\lambda }_{i}\left|{{{\Phi }}}_{i}\right\rangle \left\langle {{{\Phi }}}_{i}\right|$ (${\sum }{i=0}^{3}{\lambda }_{i}=1$), where $\left|{{{\Phi }}}_{0}\right\rangle \!=\!\frac{1}{\sqrt{2}}(\left|00\right\rangle +\left|11\right\rangle ),\left|{{{\Phi }}}_{1}\right\rangle \!=\!\frac{1}{\sqrt{2}}(\left|00\right\rangle -\left|11\right\rangle ),\left|{{{\Phi }}}_{2}\right\rangle =\frac{1}{\sqrt{2}}(\left|01\right\rangle +\left|10\right\rangle ),\left|{{{\Phi }}}_{3}\right\rangle \!=\!\frac{1}{\sqrt{2}}(\left|01\right\rangle -\left|10\right\rangle )$ (see the Methods section for details). Correspondingly, the relationship between λ_i(i = 0, 1, 2, 3) and the single-photon error rate in different bases can be analyzed, where the four-state DD-QKD protocol satisfies ${\lambda }_{1}+{\lambda }_{3}={e}_{1}^{x},{\lambda }_{2}+{\lambda }_{3}={e}_{1}^{z}$, and the six-state DD-QKD protocol satisfies ${\lambda }_{1}+{\lambda }_{3}={e}_{1}^{x},\,{\lambda }_{2}+{\lambda }_{3}={e}_{1}^{z},\,{\lambda }_{1}+{\lambda }_{2}={e}_{1}^{y}$. ${e}_{1}^{z}$, ${e}_{1}^{x}$ and ${e}_{1}^{y}$ are the single-photon error rates in the Z basis $\{\left|0\right\rangle \langle 0| ,| 1\rangle \left\langle 1\right|\}$, the X basis $\{\left|0\right\rangle {\left\langle 0\right|}_{x},\left|1\right\rangle {\left\langle 1\right|}_{x}\}$, and the Y basis $\{\left|0\right\rangle {\left\langle 0\right|}_{y},\left|1\right\rangle {\left\langle 1\right|}_{y}\}$, where ${\left|0\right\rangle }_{x}=\frac{1}{\sqrt{2}}(\left|0\right\rangle +\left|1\right\rangle ),{\left|1\right\rangle }_{x}=\frac{1}{\sqrt{2}}(\left|0\right\rangle -\left|1\right\rangle ),{\left|0\right\rangle }_{y}=\frac{1}{\sqrt{2}}(\left|0\right\rangle +i\left|1\right\rangle )$, and ${\left|1\right\rangle }_{y}=\frac{1}{\sqrt{2}}(\left|0\right\rangle -i\left|1\right\rangle )$. Based on decoy-state technology, ${e}_{1}^{z}$, ${e}_{1}^{x}$ and ${e}_{1}^{y}$ can be accurately estimated, so that the constraints of λ_i(i = 0, 1, 2, 3) can be obtained.

In the advantage distillation protocol⁵, Alice and Bob split their raw key into blocks of b bits {x₀, x₁, . . . x_b−1} and {y₀, y₁, . . . y_b−1} respectively. Alice privately generates a random bit c ∈ {0, 1}, and sends the message m = {m₀, m₁, . . . , m_b−1} = {x₀ ⊕ c, x₁ ⊕ c, . . . x_b−1 ⊕ c} to Bob through an authenticated classical channel. They accept the block if and only if {m₀ ⊕ y₀, m₁ ⊕ y₁, . . . , m_b−1 ⊕ y_b−1} equals {0, 0, . . . , 0} or {1, 1, . . . , 1}, and then keep the first bit x₀ and y₀ as the raw key. Note that if Eve knows any measurement outcome m_i(0 ≤ i ≤ b − 1), she can get all of the b measurement outcomes. Thus, only the events that all of the b pulses are single-photon states can be used to generate the final secret key, the probability of which is given by ${\left(\frac{{Y}_{1}{P}_{1}}{{Q}_{\mu }}\right)}^{b}$. Combining this advantage distillation technology with the information-theoretical security analysis method, the GLLP secret key rate formula can be modified with the following inequality

$${\tilde{R}}_{{{\mbox{decoy}}}}\ge {\max }_{b}\,{\min }_{{\lambda }_{0},{\lambda }_{1},{\lambda }_{2},{\lambda }_{3}}\frac{1}{b}{q}_{{{\mbox{succ}}}}{Q}_{\mu }\left[{\left(\frac{{Y}_{1}{P}_{1}}{{Q}_{\mu }}\right)}^{b}S{(A| E)}_{{{\mbox{single photon}}}}-H(A| B)\right],$$

(2)

where ${q}_{{{\mbox{succ}}}}={E}_{\mu }^{b}+{(1-{E}_{\mu })}^{b}$ is the successful probability of the advantage distillation protocol, E_μ is the error rate of signal states, S(A∣E)_{single photon} can be estimated with the following inequality

$$S{(A| E)}_{{{\mbox{single photon}}}}\ge 1-(\tilde{{\lambda }_{0}}+\tilde{{\lambda }_{1}})H\left(\frac{\tilde{{\lambda }_{0}}}{\tilde{{\lambda }_{0}}+\tilde{{\lambda }_{1}}}\right)-(\tilde{{\lambda }_{2}}+\tilde{{\lambda }_{3}})H\left(\frac{\tilde{{\lambda }_{2}}}{\tilde{{\lambda }_{2}}+\tilde{{\lambda }_{3}}}\right),$$

(3)

where $\tilde{{\lambda }_{0}}=\frac{{({\lambda }_{0}+{\lambda }_{1})}^{b}+{({\lambda }_{0}-{\lambda }_{1})}^{b}}{2{p}_{{{\mbox{succ}}}}},\tilde{{\lambda }_{1}}=\frac{{({\lambda }_{0}+{\lambda }_{1})}^{b}-{({\lambda }_{0}-{\lambda }_{1})}^{b}}{2{p}_{{{\mbox{succ}}}}},\tilde{{\lambda }_{2}}=\frac{{({\lambda }_{2}+{\lambda }_{3})}^{b}+{({\lambda }_{2}-{\lambda }_{3})}^{b}}{2{p}_{{{\mbox{succ}}}}},\tilde{{\lambda }_{3}}=\frac{{({\lambda }_{2}+{\lambda }_{3})}^{b}-{({\lambda }_{2}-{\lambda }_{3})}^{b}}{2{p}_{{{\mbox{succ}}}}},{p}_{{{\mbox{succ}}}}={({\lambda }_{0}+{\lambda }_{1})}^{b}+{({\lambda }_{2}+{\lambda }_{3})}^{b}$ (see the Methods section for details). The modified key rate formula can be explained from two aspects. First, since the quantum channel can be controlled by Eve, she can choose the optimal parameters λ_i(i = 0, 1, 2, 3) to reduce the key rate. Secondly, the advantage distillation protocol can be controlled by Alice and Bob, so they can choose the optimal advantage distillation parameter b to increase the key rate.

In the error correction step, all of errors should be corrected by Alice and Bob, thus H(A∣B) can be estimated by the following inequality

$$H(A| B)\le fH(\tilde{{E}_{\mu }}),$$

(4)

where $\tilde{{E}_{\mu }}=\frac{{E}_{\mu }^{b}}{{E}_{\mu }^{b}+{(1-{E}_{\mu })}^{b}}$ is the error rate value after the advantage distillation step, f > 1 is the error correction efficiency. Since Eve can get all of the classical information transmitted in the classical channel, $fH(\tilde{{E}_{\mu }})$ demonstrates the maximal key information leaked to Eve in the error correction step. Finally, the final secret key rate can be estimated with the following optimization method

$$ {\max }_{b}\,{\min }_{{\lambda }_{0},{\lambda }_{1},{\lambda }_{2},{\lambda }_{3}}\,\frac{1}{b}{q}_{{{\mbox{succ}}}}{Q}_{\mu }\left[{\left(\frac{{Y}_{1}{P}_{1}}{{Q}_{\mu }}\right)}^{b}\left(1-(\tilde{{\lambda }_{0}}+\tilde{{\lambda }_{1}})H\left(\frac{\tilde{{\lambda }_{0}}}{\tilde{{\lambda }_{0}}+\tilde{{\lambda }_{1}}}\right)\right.\right. \\ \left.\left.-(\tilde{{\lambda }_{2}}+\tilde{{\lambda }_{3}})H\left(\frac{\tilde{{\lambda }_{2}}}{\tilde{{\lambda }_{2}}+\tilde{{\lambda }_{3}}}\right)\right)-fH(\tilde{{E}_{\mu }})\right]\\ \,{{\mbox{subject to}}}\,\\ {q}_{{{\mbox{succ}}}}={E}_{\mu }^{b}+{(1-{E}_{\mu })}^{b},\\ \tilde{{E}_{\mu }}=\frac{{E}_{\mu }^{b}}{{E}_{\mu }^{b}+{(1-{E}_{\mu })}^{b}},\\ {\lambda }_{1}+{\lambda }_{3}={e}_{1}^{x}\,\,(\,{{\mbox{four-state or six-state protocol}}}\,),\\ {\lambda }_{2}+{\lambda }_{3}={e}_{1}^{z}\,\,(\,{{\mbox{four-state or six-state protocol}}}\,),\\ {\lambda }_{1}+{\lambda }_{2}={e}_{1}^{y}\,\,(\,{{\mbox{six-state protocol}}}\,),\\ {p}_{{{\mbox{succ}}}}={(1-{e}_{1}^{z})}^{b}+{({e}_{1}^{z})}^{b},\\ \tilde{{\lambda }_{0}}=\frac{{({\lambda }_{0}+{\lambda }_{1})}^{b}+{({\lambda }_{0}-{\lambda }_{1})}^{b}}{2\,{p}_{{{\mbox{succ}}}}},\\ \tilde{{\lambda }_{1}}=\frac{{({\lambda }_{0}+{\lambda }_{1})}^{b}-{({\lambda }_{0}-{\lambda }_{1})}^{b}}{2\,{p}_{{{\mbox{succ}}}}},\\ \tilde{{\lambda }_{2}}=\frac{{({\lambda }_{2}+{\lambda }_{3})}^{b}+{({\lambda }_{2}-{\lambda }_{3})}^{b}}{2\,{p}_{{{\mbox{succ}}}}},\\ \tilde{{\lambda }_{3}}=\frac{{({\lambda }_{2}+{\lambda }_{3})}^{b}-{({\lambda }_{2}-{\lambda }_{3})}^{b}}{2\,{p}_{{{\mbox{succ}}}}},$$

(5)

where Y₁, ${e}_{1}^{x}$, ${e}_{1}^{y}$ and ${e}_{1}^{z}$ can be estimated with the decoy-state method (see the Methods section for details). By applying the DD-QKD experimental parameters²⁶ listed in Table 1,

Table 1 Experimental parameters of numerical simulations for device-independent quantum key distribution (DD-QKD) and measurement-device-independent quantum key distribution (MDI-QKD) protocols, including the loss coefficient of the standard fiber link α, the detection efficiency of single-photon detectors η_D, the probability that a photon hit the erroneous detector e_Det, the dark count rate of single-photon detectors Y₀, and the error correction efficiency f, which are from Ref. ²⁶ and Refs. ^18,27 respectively.

we analyze the secret key rate of the four-state DD-QKD protocol with and without advantage distillation technology, and the corresponding results are shown in Fig. 1.

Fig. 1: Results of the four-state device-dependent quantum key distribution (DD-QKD) protocol with and without advantage distillation.

a The relationship between the transmission distance and the secret key rate, the blue line is the secret key rate without advantage distillation (b = 1), while the red line is the secret key rate with the advantage distillation technology (b > 1). b The relationship between the transmission distance and the optimal b values, the advantage distillation technology (b > 1) can improve the secret key rate when the transmission distance is larger than 132 km.

As shown in Fig. 1, when the optimal b value satisfies b > 1, the advantage distillation technology can significantly improve the performance of practical QKD systems, which extends the maximal transmission distance from 142 km to 180 km. On the other side, the calculation results demonstrate that the maximal tolerable background error rate e_Det can be improved from 6.2% to 16.4% by adopting the advantage distillation technology. In particular, the maximal transmission distance can be improved from 0 km to 175 km when e_Det = 6.3%.

At the same time, we adopt the DD-QKD parameters²⁶ listed in Table 1 to analyze the six-state DD-QKD protocol with and without advantage distillation technology, and the corresponding results are shown in Fig. 2.

Fig. 2: Results of six-state device-dependent quantum key distribution (DD-QKD) protocol with and without advantage distillation.

a The relationship between the transmission distance and the secret key rate, the blue line is the secret key rate without advantage distillation (b = 1), while the red line is the secret key rate with the advantage distillation technology (b > 1). b The relationship between the transmission distance and the optimal b values, the advantage distillation technology (b > 1) can improve the secret key rate when the transmission distance is larger than 134 km.

From the calculation results, we find that the maximal transmission distance can be improved from 146 km to 187 km, the maximal tolerable background error rate e_Det can be improved from 7% to 21.8%, and the maximal transmission distance can be improved from 0 km to 182 km if the background error rate is e_Det = 7.1%. The analysis results demonstrate that the advantage distillation technology can efficiently improve the transmission distance and error tolerance compared with the no advantage distillation case. Moreover, compared with the four-state DD-QKD protocol, the six-state DD-QKD protocol has more superiority both in the transmission distance and the background error rate tolerance.

Decoy-state measurement-device-dependent QKD with advantage distillation

More interestingly, the advantage distillation technology can also be applied to the MDI-QKD protocol. Different from the DD-QKD protocol, the MDI-QKD protocol requires both Alice and Bob to prepare the single-photon state to generate the secret key, and the secret key rate can be estimated with the following optimization method

$$ {\max }_{b}\,{\min }_{{\lambda }_{0},{\lambda }_{1},{\lambda }_{2},{\lambda }_{3}}\,\frac{1}{b}{q}_{{{\mbox{succ}}}}{Q}_{\mu \mu }\left[{\left(\frac{{Y}_{11}{P}_{11}}{{Q}_{\mu \mu }}\right)}^{b}\left(1-(\tilde{{\lambda }_{0}}+\tilde{{\lambda }_{1}})\right.\right.\\ \left.\left.H\left(\frac{\tilde{{\lambda }_{0}}}{\tilde{{\lambda }_{0}}+\tilde{{\lambda }_{1}}}\right)-(\tilde{{\lambda }_{2}}+\tilde{{\lambda }_{3}})H\left(\frac{\tilde{{\lambda }_{2}}}{\tilde{{\lambda }_{2}}+\tilde{{\lambda }_{3}}}\right)\right)-fH(\tilde{{E}_{\mu \mu }})\right]\\ {{\mbox{subject to}}}\,\\ {q}_{{{\mbox{succ}}}}={E}_{\mu \mu }^{b}+{(1-{E}_{\mu \mu })}^{b},\\ \tilde{{E}_{\mu \mu }}=\frac{{E}_{\mu \mu }^{b}}{{E}_{\mu \mu }^{b}+{(1-{E}_{\mu \mu })}^{b}},\\ {\lambda }_{1}+{\lambda }_{3}={e}_{11}^{x}\,\,(\,{{\mbox{four-state or six-state protocol}}}\,),\\ {\lambda }_{2}+{\lambda }_{3}={e}_{11}^{z}\,\,(\,{{\mbox{four-state or six-state protocol}}}\,),\\ {\lambda }_{1}+{\lambda }_{2}={e}_{11}^{y}\,\,(\,{{\mbox{six-state protocol}}}\,),\\ {p}_{{{\mbox{succ}}}}={(1-{e}_{11}^{z})}^{b}+{({e}_{11}^{z})}^{b},\\ \tilde{{\lambda }_{0}}=\frac{{({\lambda }_{0}+{\lambda }_{1})}^{b}+{({\lambda }_{0}-{\lambda }_{1})}^{b}}{2{p}_{{{\mbox{succ}}}}},\\ \tilde{{\lambda }_{1}}=\frac{{({\lambda }_{0}+{\lambda }_{1})}^{b}-{({\lambda }_{0}-{\lambda }_{1})}^{b}}{2{p}_{{{\mbox{succ}}}}},\\ \tilde{{\lambda }_{2}}=\frac{{({\lambda }_{2}+{\lambda }_{3})}^{b}+{({\lambda }_{2}-{\lambda }_{3})}^{b}}{2{p}_{{{\mbox{succ}}}}},\\ \tilde{{\lambda }_{3}}=\frac{{({\lambda }_{2}+{\lambda }_{3})}^{b}-{({\lambda }_{2}-{\lambda }_{3})}^{b}}{2{p}_{{{\mbox{succ}}}}},$$

(6)

where P₁₁ is the probability of both Alice and Bob’s signal states emitting single-photon events, Y₁₁ is the counting rate of both Alice and Bob transmitting single-photon states, Q_μμ (E_μμ) is the counting rate (error rate) of Alice and Bob’s signal states, ${e}_{11}^{z}$, ${e}_{11}^{x}$ and ${e}_{11}^{y}$ are the single-photon error rate in the Z, X and Y bases respectively. Note that, Y₁₁, ${e}_{11}^{x}$, ${e}_{11}^{y}$ and ${e}_{11}^{z}$ can be estimated with the decoy-state method (see the Methods section for details). By applying the MDI-QKD experimental parameters^18,27 listed in Table 1, we analyze the secret key rate of the four-state MDI-QKD protocol with and without advantage distillation technology, and the corresponding results are shown in Fig. 3.

Fig. 3: Results of four-state measurement-device-independent quantum key distribution (MDI-QKD) protocol with and without advantage distillation.

a The relationship between the transmission distance and the secret key rate, the blue line is the secret key rate without advantage distillation (b = 1), while the red line is the secret key rate with the advantage distillation technology (b > 1). b The relationship between the transmission distance and the optimal b values, the advantage distillation technology (b > 1) can improve the secret key rate when the transmission distance is larger than 185 km.

As illustrated in Fig. 3, we find that the maximal transmission distance can be improved from 195 km to 273 km, the maximal tolerable background error rate e_Det can be improved from 4.5% to 14%, and the maximal transmission distance can be improved from 0 km to 260 km when e_Det = 4.6%. The analysis results demonstrate that the advantage distillation technology can significantly improve the transmission distance and error tolerance compared with the no advantage distillation case.

Similarly, we adopt the MDI-QKD experimental parameters^18,27 listed in Table 1 to analyze the six-state MDI-QKD protocol with and without advantage distillation technology, and the corresponding results are shown in Fig. 4.

Fig. 4: Results of six-state measurement-device-independent quantum key distribution (MDI-QKD) protocol with and without advantage distillation.

a The relationship between the transmission distance and the secret key rate, the blue line is the secret key rate without advantage distillation (b = 1), the red line is the secret key rate with the advantage distillation technology (b > 1), and the green line is the Pirandola- Laurenza-Ottaviani-Banchi (PLOB) bound. b The relationship between the transmission distance and the optimal b values, the advantage distillation technology (b > 1) can improve the secret key rate when the transmission distance is larger than 189 km.

From the calculation results, we find that the maximal transmission distance can be improved from 200 km to 282 km, and the maximal tolerable background error rate e_Det can be improved from 4.9% to 18%, and the maximal transmission distance can be improved from 0 km to 270 km when e_Det = 5%. Compared with the four-state MDI-QKD protocol, the six-state MDI-QKD protocol has more advantage both in the transmission distance and the background error rate tolerance. Moreover, we also plot the PLOB bound²⁴ in Fig. 4, and the performance of six-state MDI-QKD with advantage distillation is obviously lower than the PLOB bound. Fortunately, the twin-field QKD protocol²⁵ proposed recently can surpass the PLOB bound. The advantage distillation method developed in this paper can also be extended to twin-field QKD²⁵ to further improve its performance, and we will leave this as future research.

Finite key security analysis

In practical QKD systems, the generated secret key is finite, thus how to prove security of QKD with the advantage distillation technology in finite-key scenarios is an important question. Since the advantage distillation technology only modifies the classical post-processing step, we can simply analyze the finite key length with the existed methods. More precisely, based on the quantum asymptotic equipartition property^32,33 and the leftover hash lemma^5,34, the secret key rate with the DD-QKD protocol can be given by

$${\widetilde{R}}_{{{\mbox{decoy}}}} \ge {\max }_{b}\,{\min }_{{\lambda }_{0},{\lambda }_{1},{\lambda }_{2},{\lambda }_{3}}\,\frac{1}{b}{q}_{{{\mbox{succ}}}}{Q}_{\mu }[{S}_{\min }^{{\varepsilon }_{min}}{(A| E)}_{{{\mbox{single photon}}}}-H(A| B)]\\ \ge {\max }_{b}\,{\min }_{{\lambda }_{0},{\lambda }_{1},{\lambda }_{2},{\lambda }_{3}}\,\frac{1}{b}{q}_{{{\mbox{succ}}}}{Q}_{\mu }\left[{\left(\frac{{Y}_{1}{P}_{1}}{{Q}_{\mu }}\right)}^{b}\left(1-\left(\tilde{{\lambda }_{0}}+\tilde{{\lambda }_{1}}\right)H\right.\right.\\ \left.\left.\;\left(\frac{\tilde{{\lambda }_{0}}}{\tilde{{\lambda }_{0}}+\tilde{{\lambda }_{1}}}\right)-(\tilde{{\lambda }_{2}}+\tilde{{\lambda }_{3}})H\left(\frac{\tilde{{\lambda }_{2}}}{\tilde{{\lambda }_{2}}+\tilde{{\lambda }_{3}}}\right)\right)-fH(\tilde{{E}_{\mu }})-{{\Delta }}\right],$$

(7)

where

$${{\Delta }}=4\sqrt{\frac{b}{n}}\log (2\sqrt{{2}^{{H}_{\max }(A| E)}}+1)\sqrt{\log \frac{2}{{\varepsilon }_{\min }^{2}}}+\frac{2b}{n}\log \frac{1}{{\varepsilon }_{{{\mbox{pa}}}}},$$

(8)

n is the raw key length before the advantage distillation step, ${H}_{\max }(A| E)$ is the conditional max-entropy function⁵, ${H}_{\min }^{{\varepsilon }_{\min }}(A| E)={\max }_{{\sigma }_{AE}\in {{{{{{\mathcal{B}}}}}}}^{{\varepsilon }_{\min }}({\rho }_{AE})}{H}_{\min }(A| E)$, ${{{{{{\mathcal{B}}}}}}}^{{\varepsilon }_{\min }}({\rho }_{AE})$ is the set of sub-normalized states σ_AE with $D({\sigma }_{AE},{\rho }_{AE})\le {\varepsilon }_{\min }$, and the final secret parameter can be given by $\varepsilon \equiv {\varepsilon }_{{{\mbox{pa}}}}+2{\varepsilon }_{\min }$. Note that the the secret key rate with the MDI-QKD protocol can be analyzed similarly. In the practical experimental realization, the QBER value and the count rate value also have statistical fluctuations, which can be analyzed by applying the Chernoff bound and the Hoeffding inequality^20,21. However, we should emphasize that the advantage distillation technology reduces the length of the raw key when b > 1, thus it has larger statistical error to analyze the security of QKD protocols with finite resources.

Conclusions

Improvements on the maximal transmission distance and the maximal error rate tolerance are two important topics of analyzing the security of practical QKD systems. By combining the advantage distillation technology with the decoy-state method, we prove that both the maximal transmission distance and the maximal tolerable error rate can be sharply improved in different DD-QKD and MDI-QKD protocols. More importantly, the advantage distillation technology does not change the quantum step of a practical QKD system. It only modifies the classical post-processing step, so it can be conveniently applied to various practical QKD systems. In the future research, it will be interesting to experimentally realize the advantage distillation technology in different QKD systems.

Methods

Single-photon QKD with advantage distillation

In the four-state or six-state DD-QKD protocol, Alice and Bob randomly prepare and measure the quantum state in the two-dimensional Hilbert spaces. By applying the entanglement based protocol, we assume that Alice prepares the quantum state $\frac{1}{\sqrt{2}}(\left|00\right\rangle +\left|11\right\rangle )$ and sends the second particle to Bob, then Alice and Bob take inputs from four-dimensional Hilbert spaces H_A ⊗ H_B to apply binary measurements. By considering the four-state and six-state QKD protocols, it has been proved that Eve’s general attack can be reduced to the Pauli attack^5,11, which can be described by the classical probability theory. After quantum channel transmission, Alice and Bob share the following quantum state

$${\sigma }_{AB}=\mathop{\sum }\limits_{i=0}^{3}{\lambda }_{i}\left|{{{\Phi }}}_{i}\right\rangle \left\langle {{{\Phi }}}_{i}\right|,\,\,\,{{\mbox{with}}}\,\,\,\mathop{\sum }\limits_{i=0}^{3}{\lambda }_{i}=1,$$

(9)

where

$$\left|{{{\Phi }}}_{0}\right\rangle =\frac{1}{\sqrt{2}}(\left|00\right\rangle +\left|11\right\rangle ),\\ \left|{{{\Phi }}}_{1}\right\rangle =\frac{1}{\sqrt{2}}(\left|00\right\rangle -\left|11\right\rangle ),\\ \left|{{{\Phi }}}_{2}\right\rangle =\frac{1}{\sqrt{2}}(\left|01\right\rangle +\left|10\right\rangle ),\\ \left|{{{\Phi }}}_{3}\right\rangle =\frac{1}{\sqrt{2}}(\left|01\right\rangle -\left|10\right\rangle ).$$

(10)

Obviously, the single-photon error rates in the Z basis $\{\left|0\right\rangle \langle 0| ,| 1\rangle \left\langle 1\right|\}$, the X basis $\{\left|0\right\rangle \langle 0{| }_{x},| 1\rangle {\left\langle 1\right|}_{x}\}$, and the Y basis $\{\left|0\right\rangle \langle 0{| }_{y},| 1\rangle {\left\langle 1\right|}_{y}\}$ are constrained by ${\lambda }_{2}+{\lambda }_{3}={e}_{1}^{z}$, ${\lambda }_{1}+{\lambda }_{3}={e}_{1}^{x}$, and ${\lambda }_{1}+{\lambda }_{2}={e}_{1}^{y}$ respectively. Since Eve holds the purified system of σ_AB, we have the following pure state σ_ABE on H_A ⊗ H_B ⊗ H_E

$${\sigma }_{ABE}=\left|{{\Psi }}\right\rangle {\langle {{\Psi }}{| }_{ABE},{{\mbox{with}}}| {{\Psi }}\rangle }_{ABE}=\mathop{\sum }\limits_{i=0}^{3}\sqrt{{\lambda }_{i}}{\left|{{{\Phi }}}_{i}\right\rangle }_{AB}\bigotimes {\left|{e}_{i}\right\rangle }_{E},$$

(11)

where the reduced density operator σ_AE and σ_E can be respectively given by

$${\sigma }_{AE}={{{\mbox{tr}}}}_{B}{\sigma }_{ABE},\,\,{\sigma }_{E}={{{\mbox{tr}}}}_{A}{\sigma }_{AE}.$$

(12)

Note that the quantum channel can be controlled by Eve, she can choose the optimal parameters λ_i(i = 0, 1, 2, 3) to reduce the secret key rate as long as λ_i is constrained by the QBER in different bases. Based on the this state preparation, the secret key rate can be given by⁵

$$ R\ge {\min }_{{\lambda }_{0},{\lambda }_{1},{\lambda }_{2},{\lambda }_{3}}[S(A| E)-H(A| B)]\\ ={\min }_{{\lambda }_{0},{\lambda }_{1},{\lambda }_{2},{\lambda }_{3}}\left[1-({\lambda }_{0}+{\lambda }_{1})H\left(\frac{{\lambda }_{0}}{{\lambda }_{0}+{\lambda }_{1}}\right)-({\lambda }_{2}+{\lambda }_{3})H\left(\frac{{\lambda }_{2}}{{\lambda }_{2}+{\lambda }_{3}}\right)-H({\lambda }_{0}+{\lambda }_{1})\right],$$

(13)

where H(A∣B) = H(λ₀ + λ₁) demonstrates that Z basis is used for generating the final secret key.

To improve the maximal tolerable QBER, the advantage distillation technology based on the repetition code protocol has been proposed⁵. In the repetition code protocol, Alice and Bob split their raw key into blocks of b bits {x₀, x₁, . . . x_b−1} and {y₀, y₁, . . . y_b−1} respectively. Alice privately generates a random bit c ∈ {0, 1}, and sends the message m = {m₀, m₁, . . . , m_b−1} = {x₀ ⊕ c, x₁ ⊕ c, . . . x_b−1 ⊕ c} to Bob through an authenticated classical channel. They accept the block if and only if {m₀ ⊕ y₀, m₁ ⊕ y₁, . . . , m_b−1 ⊕ y_b−1} equals {0, 0, . . . , 0} or {1, 1, . . . , 1}, and then keep the first bit x₀ and y₀ as the raw key. That is, if all bits in {x₀, x₁, . . . x_b−1} and {y₀, y₁, . . . y_b−1} are completely the same or different, Alice and Bob will obtain a raw key bit, the corresponding successful probability of which is given by

$${p}_{{{\mbox{succ}}}}={\left({\lambda }_{0}+{\lambda }_{1}\right)}^{b}+{\left({\lambda }_{2}+{\lambda }_{3}\right)}^{b}.$$

(14)

We emphasize that the successful probability p_succ can be further improved if Alice and Bob iteratively repeat the advantage distillation protocol on very small blocks. Consequently, the practical QBER value in the Z basis can be reduced from λ₂ + λ₃ to $\frac{{({\lambda }_{2}+{\lambda }_{3})}^{b}}{{p}_{{{\mbox{succ}}}}}$, and the quantum state shared between Alice and Bob can be given by⁵

$${\tilde{\sigma }}_{AB}=\tilde{{\lambda }_{0}}\left|{{{\Phi }}}_{0}\right\rangle \langle {{{\Phi }}}_{0}| +\tilde{{\lambda }_{1}}| {{{\Phi }}}_{1}\rangle \langle {{{\Phi }}}_{1}| +\tilde{{\lambda }_{2}}| {{{\Phi }}}_{2}\rangle \langle {{{\Phi }}}_{2}| +\tilde{{\lambda }_{3}}| {{{\Phi }}}_{3}\rangle \left\langle {{{\Phi }}}_{3}\right|,$$

(15)

where

$$\tilde{{\lambda }_{0}}=\frac{{\left({\lambda }_{0}+{\lambda }_{1}\right)}^{b}+{\left({\lambda }_{0}-{\lambda }_{1}\right)}^{b}}{2{p}_{{{\mbox{succ}}}}},\\ \tilde{{\lambda }_{1}}=\frac{{\left({\lambda }_{0}+{\lambda }_{1}\right)}^{b}-{\left({\lambda }_{0}-{\lambda }_{1}\right)}^{b}}{2{p}_{{{\mbox{succ}}}}},\\ \tilde{{\lambda }_{2}}=\frac{{\left({\lambda }_{2}+{\lambda }_{3}\right)}^{b}+{\left({\lambda }_{2}-{\lambda }_{3}\right)}^{b}}{2{p}_{{{\mbox{succ}}}}},\\ \tilde{{\lambda }_{3}}=\frac{{\left({\lambda }_{2}+{\lambda }_{3}\right)}^{b}-{\left({\lambda }_{2}-{\lambda }_{3}\right)}^{b}}{2{p}_{{{\mbox{succ}}}}}.$$

(16)

Based on the state preparation ${\tilde{\sigma }}_{AB}$ and the advantage distillation parameter b, the secret key rate $\tilde{R}$ can be modified as the following inequality

$$\tilde{R}\ge {\max }_{b}\,{\min }_{{\lambda }_{0},{\lambda }_{1},{\lambda }_{2},{\lambda }_{3}}\frac{1}{b}{p}_{{{\mbox{succ}}}}\left[1-(\tilde{{\lambda }_{0}}+\tilde{{\lambda }_{1}})H\left(\frac{\tilde{{\lambda }_{0}}}{\tilde{{\lambda }_{0}}+\tilde{{\lambda }_{1}}}\right)\right.\\ \left.-(\tilde{{\lambda }_{2}}+\tilde{{\lambda }_{3}})H\left(\frac{\tilde{{\lambda }_{2}}}{\tilde{{\lambda }_{2}}+\tilde{{\lambda }_{3}}}\right)-H(\tilde{{\lambda }_{0}}+\tilde{{\lambda }_{1}})\right].$$

(17)

Note that the advantage distillation protocol can be controlled by Alice and Bob, so they can choose the optimal advantage distillation parameter b to improve the secret key rate.

Security analysis of decoy-state QKD

Firstly, we consider the security analysis of decoy-state QKD without advantage distillation. Combining Eq. (13) with the decoy-state method^15,16,17, the secret key rate with DD-QKD system can be given by

$${R}_{\,{{\mbox{decoy}}}\,}^{\prime}\ge \,{\min }_{{\lambda }_{0},{\lambda }_{1},{\lambda }_{2},{\lambda }_{3}}{Q}_{\mu }\left[\frac{{Y}_{1}{P}_{1}}{{Q}_{\mu }}S{(A| E)}_{{{\mbox{single photon}}}}-fH({E}_{\mu })\right],$$

(18)

where P₁ is the single-photon probability in Alice’s signal states, Y₁ is the single-photon counting rate, Q_μ and E_μ denote the counting rate and error rate of signal states, Inspired by the information-theoretical security analysis method given by⁵, S(A∣E)_{single photon} can be estimated with the following inequality

$$S{(A| E)}_{{{\mbox{single photon}}}}\ge 1-({\lambda }_{0}+{\lambda }_{1})H\left(\frac{{\lambda }_{0}}{{\lambda }_{0}+{\lambda }_{1}}\right)-({\lambda }_{2}+{\lambda }_{3})H\left(\frac{{\lambda }_{2}}{{\lambda }_{2}+{\lambda }_{3}}\right),$$

(19)

where λ_i(i = 0, 1, 2, 3) can be characterized with the following equations

$${\lambda }_{1}+{\lambda }_{3}={e}_{1}^{x},\\ {\lambda }_{2}+{\lambda }_{3}={e}_{1}^{z},\\ {\lambda }_{1}+{\lambda }_{2}={e}_{1}^{y},$$

(20)

where ${e}_{1}^{z}$, ${e}_{1}^{x}$ and ${e}_{1}^{y}$ are the single-photon error rates in the Z, X and Y bases, which can be estimated with the decoy-state method.

Similarly, by considering the Bell state measurement outcome $\frac{1}{\sqrt{2}}(\left|00\right\rangle +\left|11\right\rangle )$ in Charlie’s side, the secret key rate with decoy-state MDI-QKD system can be given by

$${R}_{\,{{\mbox{decoy}}}\,}^{\prime}\ge \,{\min }_{{\lambda }_{0},{\lambda }_{1},{\lambda }_{2},{\lambda }_{3}}{Q}_{\mu \mu }\left[\frac{{Y}_{11}{P}_{11}}{{Q}_{\mu \mu }}S{(A| E)}_{{{\mbox{single photon}}}}-fH({E}_{\mu \mu })\right],$$

(21)

where P₁₁ is the probability of both Alice and Bob’s signal states emitting single-photon events, Y₁₁ is the counting rate of both Alice and Bob transmitting single-photon states, and Q_μμ (E_μμ) is the counting rate (error rate) of Alice and Bob’s signal states. Similarly, λ_i(i = 0, 1, 2, 3) can be characterized with the following equations

$${\lambda }_{1}+{\lambda }_{3}={e}_{11}^{x},\\ {\lambda }_{2}+{\lambda }_{3}={e}_{11}^{z},\\ {\lambda }_{1}+{\lambda }_{2}={e}_{11}^{y},$$

(22)

where ${e}_{11}^{z}$, ${e}_{11}^{x}$ and ${e}_{11}^{y}$ are the single-photon error rates in the Z, X and Y bases, which can be estimated with decoy-state method. Note that the other three Bell states measurement outcomes can be analyzed similarly.

As for the security analysis of decoy-state with advantage distillation which has been given in Section II, we will not repeated it here.

Simulation method of decoy-state QKD with advantage distillation

To simulate the performance of decoy-state QKD with advantage distillation, we adopt infinite decoy states to precisely estimate channel parameters. Briefly, combining Eq. (18) with the advantage distillation method^7,8,9, the secret key rate with the DD-QKD system can be given in Eq. (5). Combining Eq. (21) with the advantage distillation method^7,8,9, the secret key rate with the MDI-QKD system can be given in Eq. (6). Compared with the secret key rate without advantage distillation, only the events that all of the b pulses are single-photon states can be used to generate the final secret key, thus the advantage distillation parameter b should be optimized to maximize the final secret key.

For the decoy-state DD-QKD with advantage distillation, the corresponding parameters Y₁, P₁, ${e}_{1}^{x}$, ${e}_{1}^{y}$, ${e}_{1}^{z}$, Q_μ and E_μ are given as P₁ = μe^−μ, $\eta =1{0}^{\frac{-\alpha l}{10}}{\eta }_{D}$, Y₁ =  Y₀ + η, ${e}_{1}^{x}={e}_{1}^{y}={e}_{1}^{z}=\frac{0.5{Y}_{0}+{e}_{{{\mbox{Det}}}}\eta }{{Y}_{1}}$, Q_μ = Y₀ + 1 − e^−ημ, ${E}_{\mu }=\frac{0.5{Y}_{0}+{e}_{{{\mbox{Det}}}}(1-{e}^{-\eta \mu })}{{Q}_{\mu }}$ ³⁵. By applying the practical DD-QKD experimental parameters²⁶ listed in Table 1, the secret key rate of decoy-state DD-QKD with advantage distillation can be easily estimated. Similarly, by adopting the simulation model in³⁶ (see Eqs. (2)–(7) in³⁶ for details), the secret key rate of decoy-state MDI-QKD with advantage distillation can be easily estimated.