Security of continuous-variable measurement-device-independent quantum key distribution with imperfect state preparation

Physics Letters A 383 (2019) 126005

Contents lists available at ScienceDirect

Physics Letters A www.elsevier.com/locate/pla

Security of continuous-variable measurement-device-independent quantum key distribution with imperfect state preparation Hong-Xin Ma a,b,c , Peng Huang c,∗ , Tao Wang c , Shi-Yu Wang c , Wan-Su Bao a,b , Gui-Hua Zeng c a

Henan Key Laboratory of Quantum Information and Cryptography, Zhengzhou Information Science and Technology Institute, Zhengzhou, Henan 450001, China Synergetic Innovation Center of Quantum Information and Quantum Physics, University of Science and Technology of China, Hefei, Anhui 230026, China c State Key Laboratory of Advanced Optical Communication Systems and Networks and Center of Quantum Information Sensing and Processing, Shanghai Jiao Tong University, Shanghai 200240, China b

a r t i c l e

i n f o

Article history: Received 22 July 2019 Received in revised form 22 September 2019 Accepted 23 September 2019 Available online 26 September 2019 Communicated by M.G.A. Paris Keywords: Quantum key distribution Measurement-device-independent Continuous-variable Imperfect state preparation Practical security

a b s t r a c t The state preparation operation of continuous-variable measurement-device-independent quantum key distribution (CV-MDI-QKD) protocol may become imperfect in practical applications. We address the security of the CV-MDI-QKD protocol based on imperfect preparation of the coherent state under realistic conditions of lossy and noisy quantum channel. Specifically, we assume that the imperfection of Alice’s and Bob’s practical state preparations equal to the amplification of ideal modulators and lasers at both Alice’s and Bob’s sides by untrusted third-parties Fred and Gray employing phase-insensitive amplifiers (PIAs), respectively. The equivalent excess noise introduced by the imperfect state preparation is comprehensively and quantitatively calculated by adopting the gains of PIAs. Security analysis shows that CV-MDI-QKD is quite sensitive to the imperfection of practical state preparation, which inevitably deteriorates the performance and security of CV-MDI-QKD system. Moreover, a lower bound of the secret key rate is derived under arbitrary collective attacks, and the upper threshold of this imperfection tolerated by the system is obtained in the form of the specific gains of PIAs. In addition, the methods presented will improve and perfect the practical security of CV-MDI-QKD protocol. © 2019 Elsevier B.V. All rights reserved.

1. Introduction Quantum key distribution (QKD) [1] allows two distant authenticated users to establish secure key through untrusted quantum and classical channels, which is based on the laws of quantum information. Discrete-variable (DV)QKD protocols [2–4] and continuous-variable (CV) QKD protocols [5–8] are two main categories of QKD. CVQKD protocols encode the secret keys into continuous-spectrum quantum observables, which lead to the unique potentials of being effectively compatible with existing optical communication systems and using lower cost homodyne detectors instead of single photon detectors compared with DVQKD protocols (such as BB84 protocol). Since the first CVQKD protocol was proposed, research on CVQKD has developed rapidly. The CVQKD protocol employing Gaussian-modulated coherent state [6] has been theoretically proven to be unconditionally secure both in asymptotic case [9,10] and finite-size regime [11,12], and its composable security has been fully proven [13]. In addition, this

*

Corresponding author. E-mail address: [email protected] (P. Huang).

https://doi.org/10.1016/j.physleta.2019.126005 0375-9601/© 2019 Elsevier B.V. All rights reserved.

CVQKD protocol has been verificated both in laboratory [7,14,15] and field tests [16], which demonstrate its potential in metropolitan quantum networks. In practice, CVQKD system can not satisfy the ideal assumptions of theoretical security analysis, especially the specific experimental devices may have some imperfections [17–22]. These imperfections may open practical security loopholes for CVQKD system, which will be used by eavesdroppers to carry out corresponding attack strategies. Inspired by the idea of entanglement swapping, measurement-device-independent (MDI) QKD has been proposed by two groups [23,24] independently, which can effectively eliminate all the security hazard of the detectors. In Ref. [25], Continuous-variable MDI-QKD (CV-MDI-QKD) has been first proposed and verified both theoretically and experimentally. A number of theoretical schemes of CV-MDI-QKD have also been put forward over the same period [26–29]. In CV-MDI-QKD protocols, Alice and Bob both send their quantum states to an untrustworthy third party, Charlie, which performs CV Bell-State Measurement (BSM) based on the received quantum states and announce measurement results through public channels. Since the measurement operation in CV-MDI-QKD is performed by an untrustworthy third

2

H.-X. Ma et al. / Physics Letters A 383 (2019) 126005

party, all the side-channel attacks against detector vulnerabilities can be eliminated. In recent years, theoretical research on CV-MDIQKD has made some significant achievements [30–37]. Nevertheless, CV-MDI-QKD only eliminates the security vulnerabilities of the detectors, while other operations, such as the state preparation operation, still have some imperfections in practice. In the implementation of state preparation of Gaussianmodulated CV-MDI-QKD protocols, the waveguide electro-optic amplitude and phase modulators, which are widely used in highspeed optical communication systems, are usually employed to accomplish the Gaussian modulation operation. Waveguide electrooptic modulators have the characteristics of high bandwidth and low driving voltage, which just meet the integration requirement of QKD system. Mach-Zehnder(MZ) intensity modulators and Lithium niobate-based phase modulators are two specific types of waveguide electro-optic modulators which are applied in a high frequency. However, in practice, it is inevitable that the drift of direct-current bias voltage and the imperfect arrival of input optic signal from practical laser, which is caused by the electrical characteristics and environmental perturbations [38], will make the state preparation operation not as perfect as the theoretical hypothesis. Obviously, the imperfect state preparation will bring extra excess noise, which belongs to Gaussian noise [18,19,21,22]. This imperfection in general will lead to the error estimate of the final secret key rate, which brings security vulnerabilities to the protocol. In addition, both Alice and Bob need to perform state preparation, and the excess noises introduced by imperfect state preparation of both sides are also independent of each other. For the sake of consummating the practical security analysis of CV-MDI-QKD protocol, we need to systematically characterize and analyze the imperfect modulation operations in both senders. In this paper, we mainly explore the security of CV-MDI-QKD protocol with imperfect state preparation under realistic conditions of lossy and noisy quantum channel. Both the extreme asymmetric case and the symmetric case have been analyzed. More specifically, we characterize the imperfections that occur in the implementations of state preparation in both Alice’s and Bob’s sides in CVMDI-QKD protocol through reasonable modeling, and the formula for calculating the equivalent excess noise caused by the imperfect state preparation is obtained. Then, a comprehensive security framework of CV-MDI-QKD protocol with imperfect state preparation is developed and a tighter security key rate is derived under arbitrary collective attacks. We find that this imperfection will significantly deteriorate the security of CV-MDI-QKD protocol, and our security analysis framework can quantitatively describe the impact of this imperfection on system security. The paper is structured as follows. In Sec. 2, we first introduce the original CV-MDI-QKD protocol, then give the model of the imperfect state preparation in CV-MDI-QKD protocol and calculate the equivalent excess noise introduced by this imperfection. In Sec. 3, we derive the secret key of the CV-MDI-QKD protocol with imperfect state preparation. In Sec. 4, we give the numerical simulation and analysis both in the extreme asymmetric case and the symmetric case. Conclusion and discussion are drawn in Sec. 5. 2. CV-MDI-QKD protocol with imperfect state preparation In the following, we first review the CV-MDI-QKD protocol, mainly focus on the prepare-and-measurement (PM) version. Then, we introduce the physical model of the imperfect state preparation in CV-MDI-QKD protocol. Finally, we obtain a reasonable formula for calculating the equivalent excess noise introduced by this imperfection.

Fig. 1. (Color online). Schematic diagram of the CV-MDI-QKD protocol with imperfect state preparation in PM version. Hom is homodyne detection. AM is amplitude modulator. PM is phase modulator. GA is a phase-insensitive amplifier with gain g A , which is controlled by the third party Fred. GB is a phase-insensitive amplifier with gain g B , which is controlled by the third party Gray.

2.1. CV-MDI-QKD protocol The PM version of Gaussian-modulated coherent-state CV-MDIQKD protocol illustrated in Fig. 1 is described as follows. Step 1: Alice randomly generates a coherent state |x A + i p A , where x A and p A are Gaussian distributed with modulation variance V AM in shot-noise units. At the same time, Bob randomly generates a coherent state |x B + i p B , where x B and p B are Gaussian distributed with modulation variance V B M in shot-noise units. Alice and Bob both send their prepared coherent state to third party Charlie through two different lossy and noisy quantum channels. Step 2: After receiving the coherent states sent by Alice and Bob, Charlie interferes two states on a 50:50 beam splitter to performs BSM, obtaining two output states C and D. Then, the x quadrature of mode C and p quadrature of mode D are measured by homodyne detections respectively and announced by Charlie through public channel. Step 3: Bob revises his data according to the published measurement results of Charlie, which Alice keep her data unchanged. Then, Alice and Bob perform parameter estimation, information reconciliation and privacy amplification steps through an authenticated public channel, extracting a string of secret key. In the equivalent entanglement-based (EB) version, Alice and Bob both prepare two-mode squeezed vacuum states independently and each send one mode to Charlie for BSM. Then, Bob takes displacement operation on his retained mode according to the measurement results announced by Charlie, while Alice keeps her mode unchanged. Finally, Alice and Bob extract a string of secret key after the date post-processing. 2.2. Practical imperfect state preparation in CV-MDI-QKD In Gaussian-modulated coherent-state CV-MDI-QKD protocol, Alice and Bob perform state preparation simultaneously. In PM version, Alice employs intensity and phase modulators to encode secret key information  A  on quadratures X and P of the coherent α . Meanwhile, Bob prepares his coherent state state, obtaining  B α . In phase space, the coherent states prepared by Alice and Bob can be expressed as

  A  α = |x A + i p A  = α A e i θ A ,  B   α = |x B + i p B  = α B e i θ B ,

(1)

where x A and p A are two independent Gaussian random numbers with the same modulation variance V AM , and x B and p B are also two independent Gaussian random numbers with the same modulation variance V B M . In addition, here are the following relations

x A = |α A | cos θ A , p A = |α A | sin θ A , x B = |α B | cos θ B , p B = |α B | sin θ B ,

(2)

H.-X. Ma et al. / Physics Letters A 383 (2019) 126005

where θ A and θ B are decided by the phased modulators, |α A | and |α B | are decided by the intensity modulators. All of them are effected by lasers. However, in practical CV-MDI-QKD system, the intensity modulators, phase modulators and lasers maybe imperfect, θ A , θ B , |α A | and |α B | may deviate from the ideal values. As a result, the practical x A , p A , x B and p B are no longer set values, which inevitably induce extra excess noise to the coherent states which carry the information of secret key. In order to depict this excess noise rationally, we mode these imperfect state preparations as a combination of ideal modulators and PIAs, which is shown in Fig. 1. G A is the PIA on Alice’s side with the gain g A , which is dominated by an untrusted third party Fred. G B is the PIA on Bob’s side with the gain g B , which is dominated by an untrusted third party Gray. Firstly, we analyze the Alice’s side. The quadratures of the coherent state just passing through the ideal modulators is obtained as

x IA = x A + δ x,

(3) p IA = p A + δ p ,     where δ x2 = δ p 2 = 1 in shot noise units, which are originated from shot noise. After the amplification operation of G A , the coherent state that Alice sent to Charlie can be denoted by quadratures (x IAM , p IAM ) as

x IAM = p IAM

=

√

g A x IA +

√

g A p IA

√

+

g − 1xG A ,

√

(4)

g − 1p G A ,

where (xG A , p G A ) are the quadratures of the input idler mode in G A with the variance V G A . Then, it can be obtained that



x IAM

2 

=



p IAM

2 

= g A V AM + g A + ( g A − 1) V G A .

(5)

3

Fig. 2. (Color online). Schematic diagram of the CV-MDI-QKD protocol with imperfect state preparation in EB version. Het is heterodyne detection, Dis is displacement operation, TMSA and TMSB are the devices that prepare two-mode squeezed vacuum states.

and ρ B  B C respectively, and take them purification. Alice keeps mode A  with quadratures (xA , p A ), and Bob keeps mode B  with quadratures (xB , p B ). The mode A C with quadratures (x IAM , p IAM ) and the mode B C with quadratures (x IPM , p IPM ) are sent to Charlie through quantum channels. These quadratures satisfy



 2 = p A = V A , 

2  I M 2 x IAM = pA = V A + ε AI M ,   2 2 x B = p B = V B,  

2

2 x IBM = p IBM = V B + ε BI M . x A

2

Based on the uncertainty relationship, we can obtain the following inequalities

 

 I M  2   x A x A  ≤ V A V A + ε AI M − V V+Aε I M , A A  

 I M  2  VB IM  x B x B  ≤ V B V B + ε B − V +ε I M . B

We denote V A = V AM + 1 and the extra excess noise introduced by imperfect state preparation in Alice is





ε AI M = ( g A − 1) V AM + V G A + 1 ,

(6)

then Eq. (5) can be obtained as



x IAM

2 

=



p IAM

2 

= V A + ε AI M .

(7)

The conditional variances V x I M |x A = V p I M | p A are calculated as A

(11)

(12)

B

We first analyze the Alice’s side. Obviously, in EB version, the system ρ A  A C F will not achieve maximum entanglement, then we can assume that





x IAM x A =





V 2A − 1, p IAM p  A = − V 2A − 1.

(13)

Alice takes heterodyne detection on her retained mode A  with quadratures (xA , p A ), obtaining

x AM = x A − δ x AM ,

A

(8)

(14) p  AM = p  A − δ p  AM , 

2   2 where δ x AM = δ p AM = 1 are introduced by vacuum

Similarly, in Bob’s side, the quadratures (x IBM , p IBM ) denote the coherent state that Bob sent to Charlie, which satisfy

state. We denote Alice’s estimate of (x IAM , p IAM ) as (x A , p A ), which can be expressed as

V x I M |x A = V p I M | p A = A

A



IM 2

xA

−



x IAM x A



x2A



2

= 1 + ε AI M .



x IBM

2 

=



p IBM

2 

= VB +ε

IM B ,

(9)

where V B = V B M + 1, V B M is the modulation variance of ideal modulators in Bob, ε BI M is the extra excess noise introduced by imperfect state preparation in Bob, which is given as





ε BI M = ( g B − 1) V B M + V G B + 1 ,

(10)

where V G B is the variance of the input idler mode in G B . The equivalent EB version is illustrated in Fig. 2, which is convenient for security analysis. In the following analysis, we will show that the EB version is equivalent to the PM version. In EB version, Fred and Gray prepare two-mode squeezed vacuum states ρ A  A C

 xA =

V −1  x AM , p A = V +1



V −1  p AM . V +1

(15)

Then we can easily calculate that









x2A = p 2A = V A − 1 = V AM ,

V x I M |x A = V p I M | p A = 1 + ε AI M . A

(16)

A

Similarly, in Bob’s side of EB version, we analyze the quadratures of mode B C and B  , and calculate that









x2B = p 2B = V B − 1 = V B M ,

V x I M |x B = V p I M | p B = 1 + ε BI M . B

B

(17)

4

H.-X. Ma et al. / Physics Letters A 383 (2019) 126005

sion distance between Bob and Charlie. ε refers to the equivalent excess noise of equivalent one-way protocol, which is calculated as

ε = 1 + χ A + η1A [η B (χ B − 1)] 1

Fig. 3. (Color online). Equivalent one-way protocol of the CV-MDI-QKD protocol with imperfect state preparation in EB version, where Eve is aware of Charlie, Bob’s twomode squeezed vacuum state and channel. η is a normalized parameter stands for the equivalent channel transmittance between Alice and Bob, ε is the equivalent excess noise of equivalent one-way protocol.

+ ηA

η A = 10

10

, η B = 10

−lL BC 10

,

(18)

where l = 0.2 dB/km is the quantum channel loss, L AC is the transmission distance between Alice and Charlie, L BC is the transmis-

√

2 gdis

√

VB − 1−

2

√

ηB V B + 1

(19)

,

A

1 IM η B − 1 + ε B + ε B . In order to minimize the equivalent 2( V −1)

2 excess noise, we adopt gdis = η B ( VBB +1) [27], thus we obtain

ε = 1 + χ A + ηη BA (χ B − 1)



= ε A + ε AI M + ηη BA ε B + ε BI M − 2 + η2A .

(20)

We assume that Charlie’s detectors are perfect, then the equivalent total channel-added noise expressed in shot noise units is 2 χt = η1 − 1 + ε , where η = 12 gdis η A is a normalized parameter stands for the equivalent channel transmittance between Alice and Bob [27]. In EB version, the covariance matrix γ A  B dis of ρ A  B dis is given as

γ A  B dis =

In this section, we mainly focus on calculating the secret key rate of CV-MDI-QKD with imperfect state preparation under collective attacks. In the previous section, we have proved that the EB version of CV-MDI-QKD protocol with imperfect state preparation is equivalent to its PM version. In the EB version, when Bob’s two-mode squeeze state and his displacement operation are assumed to be untrusted, the CV-MDI-QKD protocol is converted in to the equivalent one-way CVQKD protocol employing heterodyne detection, which is shown in Fig. 3. In other words, EB version of CV-MDI-QKD is just a specific case of the equivalent one-way CVQKD protocol, where Eve is more restricted. Therefore, we can use the secret key rate of equivalent one-way protocol to obtain the lower bound of the secret key rate of CV-MDI-QKD protocol. In the security analysis of one-way CVQKD protocol, collective Gaussian attack [39] combined with the symmetry operation has been proved to be as optimal as coherent Gaussian attack. In the security analysis of CV-MDI-QKD protocol, there are two mainstream attack strategies: one-mode attack, where Eve takes two independent collective Gaussian attacks on each quantum channel [9,27], or two-mode attack, where Eve takes correlated two-mode coherent Gaussian attack by employing quantum interactions in both quantum channels. Two-mode attack has been explored for CV-MDI-QKD protocol in Ref. [25], and it is demonstrated to be the optimal and general attack strategy against the CV-MDI-QKD protocol. Besides, the non-Markovian effects on CVQKD protocol has been well analyzed in [40]. For the convenience of calculation, we restrict our analysis to two Markovian memoryless Gaussian quantum channels, which do not interact with each other. Under this assumption, the quantum channels of CV-MDI-QKD protocol turn into a one-mode channel [41], and two-mode attack degenerates into one-mode attack. The following calculation and simulation are all based on one-mode collective Gaussian attack. In addition, we should point out that Eve’s attack described here is not as optimal and general as two-mode attack. The transmittance η A and η B is given as −lL AC

χB =



3. Calculation of the secret key rate

2

where gdis is the gain of the displacement operation in Bob. In the previous section, we calculate that χ A = η1 − 1 + ε A + ε AI M and

These results are the same as PM version, which shows that the EB version is equivalent to the PM version. In general, the imperfect state preparation in CV-MDI-QKD protocol introduces extra excess noise ε AI M and ε BI M on Alice’s and Bob’s sides respectively. The total channel-added noise referred to the channel input between Alice and Charlie expressed in shot noise units is χ A = η1 − 1 + ε A + ε AI M , A and the total channel-added noise referred to the channel input between Alice and Charlie expressed in shot noise units is χ B = 1 IM η B − 1 + ε B + ε B , where ε A and η A are the excess noise and the transmittance of the quantum channels between Alice and Charlie respectively, ε B and η B are the excess noise and the transmittance of the quantum channels between Bob and Charlie respectively.



aI2

c σz

⎛ c σz

bI2

=⎝



V A I2

η( V 2A − 1)σz

η( V 2A − 1)σz

η ( V A + χt ) I2

⎞ ⎠,

(21)

where I2 is 2 × 2 identity matrix, σz = diag (1, −1). The secret key rate of the CV-MDI-QKD protocol with imperfect state preparation under collective attack can be calculated as

K = β I A B − χB E F G ,

(22)

where β is the reconciliation efficiency, I A B is the classical mutual information between Alice and Bob. χ B E F G is the Holevo bound [42] of the mutual information between Bob and Eve, where Eve is aware of Fred and Gray. The mutual information I A B has the following form [42]

I A B = 2 × 12 log2



a +1 a+1−c 2 /(b+1)



  χt )+1 = log ηη((VχAt+ +1)+1

(23)

where a, b and c are given in Eq. (21). The Holevo boundχ B E takes the form



χ B E F G = S (ρ E F G ) −

dm B p (m B ) S





B ρm EFG ,

(24)

where S is the Von Neumann entropy, m B is the measurement of Bob, p (m B ) represents the probability density of the measurement, B ρm E F G denotes Eve’s state conditional on Bob’s measurement result. m Obviously, Eve purifies the system A  B dis , and ρ A B is independent of m B in Gaussian protocols. χ B E F G can be calculated as







B χ B E F G = S ρ A  B dis − S ρ m A



= G ( λ12−1 ) + G ( λ22−1 ) − G ( λ32−1 ),

(25)

where λ1,2 are the symplectic eigenvalues of covariance matrix γ A  B dis characterizing the state ρ A  B dis , λ3 is the symplectic eigenm m value of covariance matrix γ A  B characterizing the state ρ A B , and G (x) = (x + 1) log2 (x + 1) − xlog2 x. The symplectic eigenvalues λ1,2 is obtained as

H.-X. Ma et al. / Physics Letters A 383 (2019) 126005

λ21,2 =

1 2

A±



5



A 2 − 4B 2 ,

(26)

with

A = a2 + b2 − 2c 2 = V 2A + η2 ( V A + χt )2 − 2η( V 2A − 1), B = ab − c 2 = η( V A χt + 1). The covariance matrix

(27)

B γ Am B of the state ρ m has the form A

γ Am B = aI2 − c σz (bI2 + I2 )−1 c σz = [a − c 2 /(b + 1)]I2 ,

(28)

thus, the symplectic eigenvalues λ3 is calculated as

λ3 = a − c 2 /(b + 1) =

η V A χt + V A + η . η( V A + χt ) + 1

(29)

4. Performance analysis In this section, we will give the simulation and analysis of the CV-MDI-QKD protocol with imperfect state preparation compared with the protocol without considering this imperfection. It has been proven that the performance of the asymmetric case, where L AC = L BC [27], is superior to that of the symmetric case, where L AC = L BC [25]. In other words, the shorter the distance between Bob and Charlie, the longer the total transmission distance of the protocol. When Charlie is extremely close to Bob, which is called the extreme asymmetric case, the protocol can obtain the maximal transmission distance under the same parameters. Hence, the extreme asymmetric case is more suitable for point-to-point communications. Although the transmission distance of the symmetric case is far inferior to the extreme asymmetric case, it has unique potentials in short-range communications where the relay should be just in the middle of the legitimate parties. In the following analysis, we mainly focus on two cases: the extreme asymmetric case, where Charlie is extremely close to Bob [27], and the symmetric case, where Charlie is just in the middle of Alice and Bob [25]. The PLOB bound [43], which depicts the ultimate limit of repeater-less communication, is plotted as a reference for performance comparison. 4.1. Performance analysis in the extreme asymmetric case In the extreme asymmetric case, where CV-MDI-QKD protocol has the best performance, the quantum channel turns into oneway channel, then the optimal two-mode coherent Gaussian attack degenerates into one-mode collective Gaussian attack. We first assume the gains of G A and G B have the same value, where g A =g B . The plot of Fig. 4 shows the secret key rates as a function of the transmission distance in the extreme asymmetric case, where g A is equal to g B . Different values of gains are taking into account for the CV-MDI-QKD protocol with imperfect state preparation. When g A = g B = 1, it shows that the state preparation operation is perfect, which is represented as green solid line in the figure. Here we denote the modulation variance V AM = V B M = 5. As shown in the figure, the performance curves of CV-MDI-QKD protocol are always lower than PLOB bound, which means that Charlie cannot be an active repeater in MDI protocols. The performance curves of the CV-MDI-QKD protocol with considering imperfect state preparation are always lower than the one without considering this imperfection. As the gain increases, which means the extra excess noise introduced by imperfect state preparation become larger, the performance of the protocol decreases rapidly. When g A = g B = 1.002, the maximal transmission distance of the protocol is almost halved. On the one hand, the figure shows that imperfect state preparation will seriously affect the performance

Fig. 4. (Color online). Secret key rates as a function of the transmission distance in the extreme asymmetric case, where g A is equal to g B . Parameters are fixed as follows: excess noise ε A = ε B = 0.002, variance V G A = V G B = 1, modulation variance V A M = V B M = 5, reconciliation efficiency β = 96%.

Fig. 5. (Color online). Secret key rates as a function of g A ( g B ) in the extreme asymmetric case, where g A is equal to g B . D is total transmission distance. Parameters are fixed as follows: excess noise ε A = ε B = 0.002, variance V G A = V G B = 1, modulation variance V A M = V B M = 5, reconciliation efficiency β = 96%.

and security of CV-MDI-QKD protocol. On the other hand, a more compact secret key rate is given with considering this imperfection. Fig. 5 depicts the secret key rates as a function of g A ( g B ) in the extreme asymmetric case, where g A is equal to g B . The figure shows that the tolerance of g A ( g B ) decreases rapidly with the increase of the maximum transmission distance for CV-MDI-QKD protocol. D is total transmission distance, which equal to L AC under this case. The top red solid line, which is denoted as “D = 0 km”, gives the upper bound of tolerance threshold for CV-MDIQKD protocol to the imperfection of practical state preparation in the extreme asymmetric case. The upper bound is obtained in the form of the specific gains g A ( g B ) of PIAs, which is calculated as g˜ asy = 1.0151. It means that there is just no secret key extracted when the gains of PIAs greater than 1.0151 in the extreme asymmetric case. From the point of view of the extra excess noise introduced by the imperfect state preparation, the upper bound of tolerance threshold for ε AI M and ε BI M is 0.1057 in shot noise units. In the previous analysis, we assume g A = g B , which is the ideal state for the convenience of analysis. In practice, G A and G B are two independent PIAs, whose gain g A and g B are independent

6

H.-X. Ma et al. / Physics Letters A 383 (2019) 126005

Fig. 6. (Color online). Secret key rates as a function of the transmission distance in the extreme asymmetric case, where g A and g B are independent of each other. Parameters are fixed as follows: excess noise ε A = ε B = 0.002, variance V G A = V G B = 1, modulation variance V A M = V B M = 5, reconciliation efficiency β = 96%.

Fig. 7. (Color online). Secret key rates as a function of the transmission distance in the symmetric case, where g A is equal to g B . Parameters are fixed as follows: excess noise ε A = ε B = 0.002, variance V G A = V G B = 1, modulation variance V A M = V B M = 10, reconciliation efficiency β = 96%.

of each other. In other words, the values of g A and g B may differ in practice. In order to objectively and separately analyze the influence of imperfect state preparation of Alice and Bob on the security and performance of CV-MDI-QKD protocol, we obtain the secret key rates as a function of the transmission distance in the extreme asymmetric case, where g A and g B are independent of each other, which is depicted in Fig. 6. As can be seen from the figure, the line denoted as “g A = 1.005, g B = 1.001” is always higher than the one denoted as “g A = 1.001, g B = 1.005”, and the gap of secret key rate between them will raise with the increase of transmission distance. It shows that the effect of g A on the protocol is much less than that of g B . In theory, the impact of g A and g B on the protocol is embodied in ε AI M , ε BI M and the equivalent excess noise ε . In the extreme asymmetric case, L BC = 0 and η B = 1. Thus the equivalent excess noise can be obtained as

ε(asy) = ε A +

1

ηA

ε B + ε AI M +

1

ηA

ε BI M ,

(30)

where 0 < η A ≤ 1. Obviously, the coefficient of ε BI M will never be less than that of ε AI M . When V AM = V B M and V G A = V G B , ε AI M −1 = gg BA − . This proves theoretically that, in the extreme asym1 ε BI M

metric case, the imperfection of Bob’s practical state preparation has greater impact on the protocol than that of Alice. 4.2. Performance analysis in the symmetric case

In the symmetric case, Alice and Bob are at the same distance from the untrusted third-party Charlie, which is more suitable for the application scenario where a public service is right in the middle of two legitimate communicators. Same as the previous subsection, we first analyze the case of g A = g B . The plot of Fig. 7 shows the secret key rates as a function of the transmission distance in the symmetric case, where g A is equal to g B . Here we denote the modulation variance V AM = V B M = 10. Compared with the extreme asymmetric case, the symmetric case of CV-MDI-QKD protocol has almost the same initial key rate and less than one tenth of the maximal transmission distance. Same with the former case, the performance curves of the CV-MDI-QKD protocol with considering imperfect state preparation are always lower than the one without considering this imperfection, and the gap will raise with the increase of PIAs’ gain g A ( g B ). A more compact secret key

Fig. 8. (Color online). Secret key rates as a function of g A ( g B ) in the symmetric case, where g A is equal to g B . Parameters are fixed as follows: excess noise ε A = ε B = 0.002, variance V G A = V G B = 1, modulation variance V A M = V B M = 10, reconciliation efficiency β = 96%.

rate is given with considering this imperfection in the symmetric case. The secret key rates as a function of g A ( g B ) in the symmetric case, where g A is equal to g B , is plotted in Fig. 8. The total transmission distance D is equal to L AC + L BC under this case. As shown in the figure, the protocol has quite low tolerance for g A ( g B ). The solid line denoted as “D = 0 km” shows the upper bound of tolerance threshold for CV-MDI-QKD protocol to the imperfection of practical state preparation in the symmetric case, which is obtained as g˜ sy = 1.0112 in the form of the specific gains g A ( g B ) of PIAs. It is clear that the upper bound of tolerance threshold for CV-MDI-QKD protocol to the imperfection of practical state preparation in the symmetric case is lower than that in the extreme asymmetric case. It shows that the symmetric case of CV-MDI-QKD protocol is more sensitive to the gains of PIAs than the extreme asymmetric case. In addition, the upper bound of tolerance threshold for ε AI M and ε BI M in the symmetric case is 0.1344 in shot noise units, which is higher than that of the extreme asymmetric case. This is mainly caused by the quite higher modulation variance of the former case.

H.-X. Ma et al. / Physics Letters A 383 (2019) 126005

7

attacks. Moreover, based on the gains of PIAs, we give the upper bound of tolerance threshold for CV-MDI-QKD protocol to the imperfection of practical state preparation. This work can effectively eliminate the security hazards caused by the imperfect state preparation without changing the protocol structure, and make the security analysis closer to the practical situation. Acknowledgements This work was supported the National Key Research and Development Program (Grants No. 2016YFA0302600), the National Basic Research Program of China (Grant No. 2013CB338002) and the National Natural Science Foundation of China (Grants No. 11304397, 61332019, 61505261, 61675235, 61605248, 61671287, 61971276). References

Fig. 9. (Color online). Secret key rates as a function of the transmission distance in the symmetric case, where g A and g B are independent of each other. Parameters are fixed as follows: excess noise ε A = ε B = 0.002, variance V G A = V G B = 1, modulation variance V A M = V B M = 10, reconciliation efficiency β = 96%.

We also need to analyze the case that g A and g B are independent of each other in the symmetric case, which is closer to the practical situation. Fig. 9 depicts the secret key rates as a function of the transmission distance in the symmetric case, where g A and g B are independent of each other. Different with the extreme asymmetric case, the situations where “g A = 1.005, g B = 1.001” and “g A = 1.001, g B = 1.005” has the same simulated performance curve. In the symmetric case, L AC = L BC and η A = η B . In Fig. 9, we assume V AM = V B M and V G A = V G B . Then it can be obtained that ε AI M −1 = gg BA − , which is same as the extreme asymmetric case. The1 ε BI M

oretically, the equivalent excess noise be calculated as

ε(sy) = ε A + ε B + ε AI M + ε BI M +

2

ηA

ε in the symmetric case can

− 2.

(31)

ε AI M and ε BI M have the same coefficient in this equation. It means that g A and g B have the same impact on ε(sy ) . That is to say the imperfections of Alice’s and Bob’s practical state preparations have the same impact on the security and performance of CV-MDI-QKD protocol in the symmetric case. 5. Conclusion and discussions CV-MDI-QKD protocol is immune to the side-channel attacks against imperfect measurement devices, but we can not ignore the imperfection of other parts. Practical state preparation operations of Alice and Bob may be imperfect in CV-MDI-QKD protocol, which will undoubtedly bring security risks to the system. In this paper, we have investigated the imperfection of practical state preparation operation on the security of CV-MDI-QKD protocol, which is mainly due to the fact that the practical lasers, waveguide electrooptic amplitude and phase modulators do not work perfectly as expected. Both the extreme asymmetric case and the symmetric case are taken into account. In order to quantitatively characterize this imperfection, we mode these imperfect state preparations as a combination of ideal modulators, ideal lasers and PIAs (G A and G B ), where G A and G B are dominated by untrusted third-parties Fred and Gray respectively. Under this framework, we comprehensively calculate the equivalent excess noise introduced by the imperfect state preparation by employing the gains of PIAs, and obtain a low bound of secret key rate under arbitrary collective

[1] N. Gisin, G. Ribordy, W. Tittel, H. Zbinden, Quantum cryptography, Rev. Mod. Phys. 74 (2002) 145. [2] C.H. Bennett, G. Brassard, Quantum cryptography: public key distribution and coin tossing, in: Proceedings IEEE Int. Conf. on Computers, Systems and Signal Processing, Bangalore, India, IEEE, New York, 1984, pp. 175–179. [3] A.K. Ekert, Quantum cryptography based on Bell’s theorem, Phys. Rev. Lett. 67 (1991) 661. [4] C.H. Bennett, F. Bessette, G. Brassard, L. Salvail, J.A. Smolin, Experimental quantum cryptography, J. Cryptol. 5 (1992) 3. [5] T.C. Ralph, Continuous variable quantum cryptography, Phys. Rev. A 61 (1999) 010303. [6] F. Grosshans, P. Grangier, Continuous variable quantum cryptography using coherent states, Phys. Rev. Lett. 88 (2002) 057902. [7] F. Grosshans, G.V. Assche, J. Wenger, R. Brouri, N.J. Cerf, P. Grangier, Quantum key distribution using Gaussian-modulated coherent states, Nature 421 (2003) 238. [8] C. Weedbrook, S. Pirandola, R. García-Patrón, N.J. Cerf, T.C. Ralph, J.H. Shapiro, S. Lloyd, Gaussian quantum information, Rev. Mod. Phys. 84 (2012) 621. [9] M. Navascus, F. Grosshans, A. Acín, Optimality of Gaussian attacks in continuous-variable quantum cryptography, Phys. Rev. Lett. 97 (2006) 190502. [10] R. Renner, J.I. Cirac, de Finetti representation theorem for infinite-dimensional quantum systems and applications to quantum cryptography, Phys. Rev. Lett. 102 (2009) 110504. [11] A. Leverrier, R. García-Patrón, R. Renner, N.J. Cerf, Security of continuousvariable quantum key distribution against general attacks, Phys. Rev. Lett. 110 (2013) 030502. [12] A. Leverrier, Security of continuous-variable quantum key distribution via a Gaussian de Finetti reduction, Phys. Rev. Lett. 118 (2017) 200501. [13] A. Leverrier, Composable security proof for continuous-variable quantum key distribution with coherent states, Phys. Rev. Lett. 114 (2015) 070501. [14] P. Jouguet, S. Kunz-Jacques, A. Leverrier, P. Grangier, E. Diamanti, Experimental demonstration of long-distance continuous-variable quantum key distribution, Nat. Photonics 7 (2013) 378. [15] D. Huang, P. Huang, D. Lin, G. Zeng, Long-distance continuous-variable quantum key distribution by controlling excess noise, Sci. Rep. 6 (2016) 19201. [16] D. Huang, P. Huang, H. Li, T. Wang, Y. Zhou, G. Zeng, Field demonstration of a continuous-variable quantum key distribution network, Opt. Lett. 41 (2016) 3511. [17] G. Brassard, N. Lutkenhaus, T. Mor, B.C. Sanders, Limitations on practical quantum cryptography, Phys. Rev. Lett. 85 (2000) 1330. [18] R. Filip, Continuous-variable quantum key distribution with noisy coherent states, Phys. Rev. A 77 (2008) 022310. [19] Y. Shen, J. Yang, H. Guo, Security bound of continuous-variable quantum key distribution with noisy coherent states and channel, J. Phys. B 42 (2009) 235506. [20] Z.L. Yuan, J.F. Dynes, A.J. Shields, Avoiding the blinding attack in QKD, Nat. Photonics 4 (2010) 800–801. [21] V.C. Usenko, R. Filip, Feasibility of continuous-variable quantum key distribution with noisy coherent states, Phys. Rev. A 81 (2010) 022318. [22] P. Jouguet, S. Kunz-Jacques, E. Diamanti, A. Leverrier, Analysis of imperfections in practical continuous-variable quantum key distribution, Phys. Rev. A 86 (2012) 032309. [23] S.L. Braunstein, S. Pirandola, Side-channel-free quantum key distribution, Phys. Rev. Lett. 108 (2012) 130502. [24] H.-K. Lo, M. Curty, B. Qi, Measurement-device-independent quantum key distribution, Phys. Rev. Lett. 108 (2012) 130503. [25] S. Pirandola, C. Ottaviani, G. Spedalieri, et al., High-rate measurement-deviceindependent quantum cryptography, Nat. Photonics 9 (2015) 397–402. [26] X.-C. Ma, S.-H. Sun, M.-S. Jiang, M. Gui, L.-M. Liang, Gaussian-modulated coherent-state measurement-device-independent quantum key distribution, Phys. Rev. A 89 (2014) 042335.

8

H.-X. Ma et al. / Physics Letters A 383 (2019) 126005

[27] Z. Li, Y.-C. Zhang, F. Xu, X. Peng, H. Guo, Continuous-variable measurementdevice-independent quantum key distribution, Phys. Rev. A 89 (2014) 052301. [28] Y.C. Zhang, Z. Li, S. Yu, W. Gu, X. Peng, H. Guo, Continuous-variable measurement-device-independent quantum key distribution using squeezed states, Phys. Rev. A 90 (2014) 052325. [29] C. Ottaviani, G. Spedalieri, S.L. Braunstein, S. Pirandola, Continuous-variable quantum cryptography with an untrusted relay: detailed security analysis of the symmetric configuration, Phys. Rev. A 91 (2015) 022320. [30] X. Zhang, Y. Zhang, Y. Zhao, X. Wang, S. Yu, H. Guo, Finite-size analysis of continuous-variable measurement-device-independent quantum key distribution, Phys. Rev. A 96 (2017) 042334. [31] P. Papanastasiou, C. Ottaviani, S. Pirandola, Finite-size analysis of measurementdevice-independent quantum cryptography with continuous variables, Phys. Rev. A 96 (2017) 042332. [32] C. Lupo, C. Ottaviani, P. Papanastasiou, S. Pirandola, Continuous-variable measurement-device-independent quantum key distribution: composable security against coherent attacks, Phys. Rev. A 97 (2018) 052327. [33] C. Lupo, C. Ottaviani, P. Papanastasiou, S. Pirandola, Parameter estimation with almost no public communication for continuous-variable quantum key distribution, Phys. Rev. Lett. 120 (2018) 220505. [34] Z. Chen, Y. Zhang, G. Wang, Z. Li, H. Guo, Composable security analysis of continuous-variable measurement-device-independent quantum key distribution with squeezed states for coherent attacks, Phys. Rev. A 98 (2018) 012314.

[35] Y. Zhao, Y. Zhang, B. Xu, S. Yu, H. Guo, Continuous-variable measurementdevice-independent quantum key distribution with virtual photon subtraction, Phys. Rev. A 97 (2018) 042328. [36] H.-X. Ma, P. Huang, D.-Y. Bai, S.-Y. Wang, W.-S. Bao, G.-H. Zeng, Continuousvariable measurement-device-independent quantum key distribution with photon subtraction, Phys. Rev. A 97 (2018) 042329. [37] P. Wang, X. Wang, Y. Li, Continuous-variable measurement-device-independent quantum key distribution using modulated squeezed states and optical amplifiers, Phys. Rev. A 99 (2019) 042309. [38] W. Liu, X. Wang, N. Wang, S. Du, Y. Li, Imperfect state preparation in continuous-variable quantum key distribution, Phys. Rev. A 96 (2017) 042312. [39] R. García-Patrón, N.J. Cerf, Unconditional optimality of Gaussian attacks against continuous-variable quantum key distribution, Phys. Rev. Lett. 97 (2006) 190503. [40] R. Vasile, S. Olivares, M.G.A. Paris, S. Maniscalco, Continuous variable quantum key distribution in non-Markovian channels, Phys. Rev. A 83 (2011) 042321. [41] S. Pirandola, Entanglement reactivation in separable environments, New J. Phys. 15 (2013) 113046. [42] A.S. Holevo, Bounds for the quantity of information transmitted by a quantum communication channel, Probl. Inf. Transm. 9 (1973) 177. [43] S. Pirandola, R. Laurenza, C. Ottaviani, L. Banchi, Fundamental limits of repeaterless quantum communications, Nat. Commun. 8 (2017) 15043.