CC BY
12
NANOSYSTEMS: Goncharov R.K., et al. Nanosystems:
PHYSICS, CHEMISTRY, MATHEMATICS Phys. Chem. Math., 2022,13 (4), 372-391.
http://nanojournal.ifmo.ru
Original article DOI 10.17586/2220-8054-2022-13-4-372-391
Continuous-variable quantum key distribution: security analysis with trusted hardware noise against general attacks
Roman K. Goncharov", AlexeiD. Kiselev6, EduardO. Samsonovc, Vladimir I. Egorovd ITMO University, Kronverkskiy, 49, St. Petersburg, 197101, Russia
[email protected], [email protected], [email protected], [email protected] Corresponding author: R. K. Goncharov, [email protected]
PACS 03.67.-a, 42.50.-p
Abstract In this paper, using the full security framework for continuous-variable quantum key distribution (CV-QKD), we provide a composable security proof for the CV-QKD system in a realistic implementation. We take into account equipment losses and contributions from various components of excess noise and evaluate performance against collective and coherent attacks assuming trusted hardware noise. The calculation showed that the system remains operable at channel losses up to 10.2 dB in the presence of collective attacks and up to 7.5 dB in the presence of coherent ones.
Keywords quantum key distribution, continuous variables, security proof, composability, trusted noise.
Acknowledgements The work was done by Leading Research Center "National Center for Quantum Internet" of ITMO University by order of JSCo Russian Railways.
For citation Goncharov R. K., Kiselev A. D., Samsonov E. O., Egorov V. I. Continuous-variable quantum key distribution: security analysis with trusted hardware noise against general attacks. Nanosystems: Phys. Chem. Math., 2022, 13 (4), 372-391.
1. Introduction
Quantum key distribution (QKD) [1] is a special method of generating a secure key between two parties, Alice and Bob, which will ensure the privacy of transmitted information in the era of the quantum computer. Historically, the first protocols to be presented were discrete variable (DV) ones [2,3], where information was encoded in the state of a single photon: polarization, phase or time bin. However, over time, continuous-variable (CV) protocols [4-6] have been introduced, which are considered more efficient, high-rate and cost-effective due to the use of homodyne/heterodyne detection systems instead of single photon detectors.
Considering the security of QKD systems, one must take into account that each of them has a finite physical implementation that is not ideal, which opens up opportunities for the eavesdropper, Eve, to carry out a multiple attacks and extract part of the secret key. To prevent this threat, for each protocol, a complex system for assessing the information available to Eve and the acceptable level of errors is being developed.
Currently, a fairly significant amount of work has been presented, covering the topic of security of CV-QKD protocols [7-14]. Of the protocols most suitable for practical implementation, the GG02 protocol [6,15] stands out, for which the security is proven against coherent (general) attacks, taking into account the finite-key effects. Moreover, models of untrusted and trusted hardware noise are considered [12]. The latter is preferable, since many security levels imply that Eve does not have access to Alice's and Bob's blocks, moreover, accounting for untrusted noise makes the protocol essentially unusable.
Thus, this paper will present a full security proof of CV-QKD on a realistic implementation with trusted hardware noise against general attacks. In Section 2 we describe an optical configuration of the CV-QKD scheme, in Sections 35 we give a description of the protocol in the trusted noise scenario and consider a possibility of specific attacks that go beyond general security proof framework. In Section 6 we provide a technique of evaluation and monitoring of experimental parameters and in Section 7 we clarify security analysis and estimate the finite-length secure key generation rate. In Section 8 we discuss the results and draw the appropriate conclusions.
2. Optical CV-QKD scheme configuration
The optical scheme of the described protocol is shown in Fig. 1 and consists of the following blocks:
© Goncharov R. K., Kiselev A. D., Samsonov E. O., Egorov V. I., 2022
Alice block, in which the generation of signal states (Gaussian modulation) and a local oscillator (LO) is carried out, after which, by means of polarization-time multiplexing, they sent to Bob. Gaussian modulation itself can be done in two stages: amplitude modulation with a Rayleigh distribution and phase modulation with a uniform phase distribution; as a result, the complex signal amplitude value will correspond to the Gaussian distribution [16]. It should also be noted that the need for reference signal, which is used in the phase protocols of the DV-QKD [3,17], is no longer necessary in this case.
Quantum channel block, which in this work is represented by an optical fiber. Bob block, in which demultiplexing and heterodyne detection are carried out.
Fig. 1. Scheme of typical setup for CV-QKD with Gaussian modulation and heterodyne detection.
In the considered configuration, Alice uses the same laser to generate LO and signal states modulated according to the Gaussian distribution, which then experience the procedure of polarization-time multiplexing before sending through the quantum channel. Bob then performs a demultiplexing procedure and heterodyne detection. Fig. 1 also shows additional elements for monitoring.
In Alice block, a continuous wave (CW) laser with a central wavelength of 1550 nm and a spectral line width of 100 kHz is used. The width of the spectral line makes it possible to estimate the coherence time, and also affects the amount of phase noise. Coherent detection systems require the use of sources with a narrow spectral line. The Bob block uses a polarization-maintaining optical fiber of the Panda type due to the sensitivity of the optoelectronic components to polarization and implementation polarization multiplexing. The optical isolator OI1 is used in order to avoid backlight due to reflection on the optical scheme elements in the laser module. An amplitude modulator AM1 is used to form identical optical pulses with a repetition rate of 50 MHz and a duration of 3 ns. Laser pulses are then divided by amplitude into two arms using a 10/90 beam splitter BS1: the signal arm (10%) and LO arm (90%).
The second 90/10 beam splitter BS2 in the LO arm is used to separate 10% of the optical pulse power and direct it to the photodiode PD1, which allows one to organize feedback with an amplitude modulator to control the power of LO.
In the signal arm, Gaussian modulation of optical pulses occurs using an amplitude modulator AM2 and a phase modulator PM. Amplitude modulation is realized according to the Rayleigh distribution with a given variance. Phase modulation is implemented according to a uniform distribution in the range from 0 to 2n. The amplitude modulator AM3 is used as a fast attenuator with a wide range of extinction coefficient to set the average number of photons in an optical pulse. Every second pulse in the signal arm is a reference pulse and is not subjected to amplitude and phase modulation on amplitude modulators AM1 and AM2 and phase modulator PM. The modulators are controlled by a digital-to-analog converter (DAC), which is not indicated on Fig. 1.
In the signal and LO arms, 90:10 beam splitters BS3 and BS4 are used to separate part of the signal and LO pulses to control the power and variance (feedback for amplitude modulators AM1 and AM2) using a homodyne detector, which is carried out using 50/50 beam splitter BS5 and balanced detector BD1. For successful balanced detection, it is necessary that the optical paths of the signal and LO are identical.
In order to avoid the interaction of signal pulses and LO before their detection in Bob's side, time-division and polarization multiplexing is used. Time-division multiplexing is implemented by increasing length of the signal arm in Alice's side by an amount corresponding to half the pulse repetition period compared to LO arm. Polarization multiplexing is implemented using a polarization combiner PBS1 with a single-mode (SM) output, to which polarization maintaining fibers of two arms are connected with mutually orthogonal slow optical axes.
A SM optical isolator OI2 is used to prevent backlighting of Alice from the channel output. Alice and Bob are connected through a SM optical fiber of the G.652.D standard with a length of 25 km.
On Bob side, the signal and LO enter the CWDM filter with a central wavelength of 1550 nm. The use of a CWDM filter is due to protection against backlight at a different wavelength from the channel input. The output of the CWDM filter which corresponds to the reflected light is connected with the monitor photodiode PD2, by the signal from which one can analyse the presence or absence of backlights. The output of the CWDM filter which corresponds to the transmitted light, is connected with the input of the polarization controller PC, which is used to compensate for polarization distortions in the SM optical fiber between Alice and Bob. The input of a polarization beam splitter PBS2 is connected to the output of the polarization controller, which is used for polarization demultiplexing of the signal and LO. In the LO arm, there is a delay line for demultiplexing signals in time domain and also a 90:10 beam splitter BS6, which is used to organize the feedback of the polarization controller: a part of LO pulse power (10%) is sent to the photodiode PD3 to determine the optical power. The other output of the 90/10 beam splitter, which corresponds to 90% optical power, is connected to LO input of the 90-degree optical hybrid. In the signal arm, after the output of the polarizing beam splitter PBS2, it is connected to the signal input of the 90-degree optical hybrid. The 90-degree optical hybrid has four outputs: two outputs correspond to the sum and the difference amplitude of the signal field and LO with zero additional relative phase and two outputs correspond to an additional phase equal to 90 degrees. The outputs of the 90-degree optical hybrid are connected to the inputs of two balanced detectors. The signal from the balanced detectors is entered to analog-to-digital converter (ADC), which is not shown in Fig. 1).
3. GG02 protocol features
3.1. Gaussian modulation of coherent states
In the CV-QKD with Gaussian modulation [6,15], Alice prepares coherent states (with a given value of amplitude and phase) with quadrature components q and p which are realizations of two independent and identically distributed random variables Q and V, which have the same Gaussian distribution with zero mean and given variance
Q - V - N (0, Va) , (1)
where VA is a modulation variance.
Alice prepares a sequence of coherent states |a1},... | aj),..., |aN} of the form:
la) = |qj + ipj), for qj € Q, Pj € V. (2)
In this case, the equations for the eigenvalues are satisfied in shot noise units (SNU)
a|aj} = aj laj ), (3)
2(q + ip)|«j} = (qj + ipj )|aj } (4)
where a is a creation operator andp, q are a quadrature operators.
The mean photon number in each individual state is estimated as follows
(■nj} = (aj |n|aj} = |aj|2 = qj + p2. (5)
Given that qj and pj taken from the distribution in Eq. (1), the mean photon number over the ensemble of states prepared by Alice is
(n} = (Q2} + (V2} = 2Va. (6)
To calculate the variance of the quadrature operator V(q) = (q2) - (q)2, it is necessary to find the averaged values:
(q) = (a|q|a) = 0, (7)
(q2) = (a|q2|a) = (a|(a + af )2|a) =
= (a|a2|a) + (a|(a^)2|a) + (a|aa^|a) + (a|a^a|a) = = a2 + (a*)2 + a*a + 1 + a*a = = q2 - p2 + 2iqp + q2 - p2 - 2iqp + 2(q2 + p2) + 1 =
= 4q2 + 1. (8)
Considering that the values q and p are realizations of the random variables Q and P, respectively, we can write:
(q2) = 4(Q2) + 1 = 4Va + 1, (9)
(p2) = 4(P2) + 1 = 4"VA + 1. (10)
According to Eqs. (9), one has:
V = V (q) = V (p) = V = 4VA + 1 = Va + 1. (11)
In Eq. (11), the transition from the variance of random variable corresponding to the quadrature distribution to the variance of quadrature operator is carried out. It should be noted that there is also a shot noise component in SNU (equal to one).
Combining (6) and (11), we can express the average number of photons over the ensemble in terms of the variance of quadrature operator
(n) = 2(V - 1) = 2Va. (12)
After the preparation stage, Alice sends the |aj) state to the Gaussian quantum channel, after which Bob performs coherent detection and decodes information about the sent state in the case of heterodyne detection or the projection of its quadrature components in the case of homodyne detection. It should be emphasized that in this paper only heterodyne detection is considered.
3.2. Gaussian sequence processing
This subsection briefly describes the stages of classical data post-processing, which means Alice's modulation and Bob's detection results data.
The first step is sifting. Despite sifting is not implied in the case of heterodyne detection (in which the sequence after the distribution session and before error correction can be considered as a sifted key), it is worth mentioning that in CV-QKD with homodyne detection, Alice and Bob choose the bases they use to prepare and measure the states respectively, using independently and identically distributed generated random bits. In these cases, the sifting step eliminates all uncorrelated signals when different bases were used for preparation and measurement. The presence of signal bases is more typical for CV-QKD protocols with discrete modulation, however, in protocols with Gaussian modulation and homodyne detection, sifting means discarding the quadrature not measured by Bob.
The second step is parameter estimation. After transmitting and detecting a sequence of states, legitimate parties compare a random subset of their data. This comparison allows one to estimate the quantum channel parameters: transmittance and excess noise of the channel, from which they can calculate a mutual information /AB and evaluate an information x available to Eve. If x is greater than fi/AB, where fi G [0, 1] is the reconciliation efficiency, the protocol is aborted at this point.
If fi/AB > x, users go to the third, information reconciliation step, which is a form of error correction procedure.
The fourth step is confirmation. After the reconciliation procedure, legitimate parties perform a confirmation step using a family of universal hash functions [18] to limit the chance that error correction fails: Alice or Bob chooses one particular hash function with uniform probability and announces its choice over the classical channel. Users apply this hash function to their key to get a hash code. Subsequently, Alice and Bob exchange and compare their hash codes. If the values are different, the keys are considered compromised and the protocol is aborted; if the values are equal, then it is considered that an upper bound on the probability that the keys are not identical has been obtained. This error rate depends on the length of the hash codes and the type of hash functions used.
The fifth and final step is privacy amplification. After successfully passing the confirmation stage, Alice and Bob will have the same bit string with a very high probability. However, Eve has some information about the key, so to reduce the chance that she successfully guesses part of the key to an acceptable value, users perform a privacy amplification protocol by applying a seeded randomness extraction algorithm to their bit strings, which uses a family of 2-universal hash functions.
3.3. Quantum channel description
The Gaussian quantum channel is characterized by the transmittance coefficient (taking into account losses directly in the channel, losses in the equipment and detection efficiency) and noise (on Alice side, in the channel, and on Bob side). The potential advantage of Eve depends on both characteristics. The noise in the channel can be expressed as [1,13,19]
Sch = 2-^ + £a, (13)
T ch
where —ch is a quantum channel transmittance, £A is a excess noise (in SNU). The excess noise itself includes variances of all noise sources
-A = -modul, A + -Raman, A + -phase, A + • • • , (14)
where -modul, A is the modulation noise, -Raman, A is the Raman noise, and -phase, A is the phase noise. Similarly, the detector noise can be estimated as [1,13,14,19]
„ _1 - Trecndet . Vel
Sdet = - + — , ( )
- rec ^det — rec ^det
where ndet is the balanced detector efficiency, vel is the electronic noise of the balanced detector and Trec is the transmittance coefficient responsible for losses in the receiver module. For a more convenient notation, it can be written as
Tdet = Trec ndet. (16)
The total noise related to the channel input is then determined by the sum of the channel noise and the detector noise normalized to Tch
1
S = Sch + Sdet. (17)
Tch
After the signal state passing through a channel with noise and losses, Bob measures the total variance of the quadrature operator as [1,13,14,19]
Vb = V (qB) = V (Pb) = Tch Tdet (V + S) =
= TchTdet (V + -A + Tr- (^^ + )) =
V Tch Tch V Tdet Tdet J J
= Tch Tdet V - TchTdet + Tch —rec^det-A + 1 + Vel =
= TV - T + --A + 1 + Vel =
= T (V - 1)+ --A + 1+ Vel. (18)
Since the parameter vel is the noise variance in SNU and can be considered stochastically independent of other noise sources, it can be considered as another component of the excess noise, i.e. vel = -det, thus
T-A + £det = T + —£det^ = T£tot, A = £tot, B = — (19)
Vb = T(V - 1) + 1 + £ = TVa + 1 + £. (20)
3.4. Signal-to-noise ratio and mutual information
The signal-to-noise ratio is expressed as
—S
SNR = , (21)
— N
where —S is the total signal power and —N is the total noise power.
The purposed model makes it possible to separate the signal and noise components in the variance of the quadrature operator observed by Bob
T £
Vb = -Va + 1 + -, (22)
where ^ G {1; 2} is the homodyne/heterodyne detection system parameter, respectively. Thus, the signal-to-noise ratio for the purposed protocol is as follows
a-Va
SNR =f+T7. (23)
+ a.£
M
Mutual information between Alice and Bob in this case is evaluated as [13]
MTVa
Iab = | log2(1 + SNR) = | log J 1 + ) . (24)
As it has been already mentioned, the purposed protocol assumes a heterodyne detection method, i.e. ^ = 2. According to Eq. (24), despite the increase in mutual information by a factor of two (two quadratures per message are detected at once, instead of one), the signal-to-noise ratio decreases. Obviously (estimating the rate of increase of logarithmic functions), the advantage of heterodyne detection in terms of estimating mutual information will be observed only at large TVa.
4. Trusted hardware noise. Holevo bound
After variable pAB has been removed from the shared state equation, it can be viewed as a pure two-particle state with a common Alice and Bob on one side and Eve on the other. As such, it can be written in terms of the Schmidt decomposition
|^abe} = A |^}ab |4}e , (25)
i
where Aj is a real non-negative number.
Taking a partial trace over subsystems gives one
TTe PAB = PAB = ^2 Ai|^i}AB(^i|, (26)
i
TTab PAB = PE = ^2 Ai|^i}E(^i|. (27)
i
The von Neumann entropy depends only on the Ai components, which, due to the Schmidt decomposition, are the same for pAB and pE. Therefore, the von Neumann entropy of Eve is the same as the entropy shared by Alice and Bob
Se = Sab = - ^ A log2 A". (28)
i
Then, the following transformation is obvious
XE = SE - SE|B = SAB - SA|B. (29)
In the trusted noise model [12], the noise coming from the Alice's and Bob's equipment is assumed to be trusted, that is, Eve cannot manipulate it. The same applies to equipment losses. In this context, it is necessary to clarify Eq. (19)
£ = T£pr + Tdet £ch + £rec, (30)
where £pr is the Alice excess noise, £ch is the channel excess noise, and £rec is the Bob excess noise.
Assuming that the detection devices are well calibrated and reliable, Trec and £rec are beyond Eve's influence. Then the covariance matrix describing its von Neumann entropy prior to measurement by Bob is as follows
^trustedrec. = ( V12 TTch(V2 - 1)az .
AB \ TTch (V2 - 1)<7z (Tch(V - 1) + 1+ ech) 12 .
The matrix itself can be represented in the form
al2 or
'z
(32)
ca z 6I2
The symplectic eigenvalues of this matrix are expressed as
vi, 2 = 1(z ± (b - a)), (33)
where z = \J(a + b)2 - 4c2.
Although in the trusted noise model the quantities Trec and erec do not contribute to SE, though they do affect Alice measurements and, consequently, Eve entropy SE|B.
In the trusted noise scenario, the eavesdropper can only manipulate the state in the channel and carry out purifying in the same place. This means that the state of the system must be viewed through three distinct subsystems in the entanglement base scenario. Let the state "Alice-Bob-Eve" consist of two entangled states and a thermal state, each of which is uniquely determined by its variance: one entangled state EPRAB with variance V used for key exchange between Alice and Bob, one entangled state EPRch with variance Wch for modeling noise and loss in the quantum channel and thermal state Threc with variance Wrec to simulate the noise and losses of the receiver. The beam splitters, one with Tch transmittance and one with Trec transmittance, mix the initial Bob's entangled state modes with the channel state and
the thermal state modes, respectively. The general state before the action of the beam splitters can be represented by the covariance matrix
Stot, 0 = EPRab e EPRch e Thr
/
V12
Vv2 - 1 az
VV2 - 1 az V12 0 0 0
0 0
Wch12
Wh - 1 az 0
Wc2h - 1az Wch12
y 0 0 0 0 W rec 12 )
It can be noted here that the eavesdropper attack on the quantum channel involves only two entangled states, EPRAB and EPRch, which guarantees purifying as part of an attack. Unitary equivalence with complete purifying thus makes it easier to express the state on Bob's side: in the general case, it must be represented by another entangled state [14].
The beam splitter in the channel affects Alice's mode and one of the EPRch state modes; the second beam splitter affects Bob's mode and the thermal state simulating the detection module
(34)
/
BS
ch =
12
0
V/Tch12
0
00
\
V1 - Tch12 0 0
0 -V1 - Tch12 v/rch12 0 0
BSr
0 0
00
12
0
(35)
^12 0 0 y/1 - Tdet12
' det 12 0 0
12 0 0 12
0 -V1 - Tdet 12 0 0 ^12
(36)
/
Denoting the sequence of both beam splitters as BStot = BSrecBSch, the total quantum state is transformed as follows
Stot = BStotStot,0BStot.
(37)
To simplify expressions for the covariance matrix, it should be considered block by block. Thus, the block describing the Alice-Bob subsystem is transformed as follows
/
Sab =
V12
1 az
V
VThVTWV2 - 1az ^ ^ Tch Tdet V ^
+ (1 - Tch) TdetWch ^ +(1 - Tdet) Wrec )
(38)
Let the variances for entangled states be defined as
Wh = + 1,
Wrec =
1 - Tr
£r,
ch
+ 1.
1 - Tdet
Then the variance of Bob's quadrature operator is as follows
Vb = Tch Tdet (V - 1) + 1 + TdetCch + £re, = Tch Tdet (V - 1) + 1 + £ch,B + £rec. The final expression for the Alice-Bob block is
SAB
V12 v^VV2 - 1az
VTVV2 - 1az (T(V - 1) + 1 + e) 12
(39)
(40)
(41)
(42)
0
0
0
0
12
1
0
0
2
0
2
The Eve block is described by the matrix
((1 - Tch) V + Tchwch) 12 - i<7z
VTChVwC[-Iaz Wchl2
Se
(43)
This matrix can be described in the form given by Eq. (32), so its symplectic eigenvalues can be calculated by Eq. (33). It can be verified that the entropy of Eve SE is the same as the entropy shared by Alice and Bob and obtained from their mutual covariance matrix in the trusted receiver noise scenario from Eq. (31), which is expected when Eve purifies the state of Alice and Bob, i.e.
Se = S (Ee) = S (SAABtedrec) = Sab. (44)
Now, in order to get SE|B, we have to calculate Etot|B, i.e. the covariance matrix of the common state of the remaining modes after the projective measurement of the receiver mode. It is convenient to represent Etot so that the Alice's mode is located in the last row and column. This can be done by using a permutation matrix, which allows to rearrange the third and fourth rows (columns) down (to the right) when multiplied by Etot from the left (right) [14]:
/
P
3,4^9,10 —
0 0 0 0
\
0 0 0 12
12
0 0 0
0 12
0 0
0 0 12
0
S' — P
iStotP?1
3,4^9,10StotP 3,4^9,10.
(45)
(46)
Since P3,4^9,10—3,4^, 10 = 1, the above permutation is a similarity transformation and therefore leaves the eigenvalues of the matrix Etot invariant. The covariance matrix itself now looks like this:
Sa , ch, rec SC SC SB
(47)
where EA, ch, rec g R8x8 is a matrix describing the Alice's mode and the state of the channel and the detection module, EB g r2 x 2 is a matrix describing the Bob's mode, and EC g r8 x 2 is a matrix describing quadrature correlations between
Ea, ch, rec and Eb.
The Etot|B matrix after a projective measurement of the Bob's mode depends on whether it performs homodyne or heterodyne detection.
In the case of heterodyne detection, the remaining modes are projected into the state described by the 8 x 8 matrix
S
'tot|B — SA, ch, rec —
1
Vb + 1
-ScS
csc .
(48)
Again, there is no need to evaluate the entire covariance matrix. Instead, one can evaluate a block describing the eavesdropper information that is two modes representing the entangled state that was used to model the noise and the channel loss. The block itself is expressed as follows
SE|B —
1
ei I2 e2az
Vb + M e2e3l2
ei — V ((1 - Trec) Wrec + TrecWch + 1) + + Tch (Wch - V) (1 + (1 - Trec) Wrec) ,
e2 — ^Tch (Wc2h - 1) (TrecV + (1 - Trec) Wrec + 1) ,
e3 — (1 - Trec) Wch Wrec + TrecTch (VWch - 1) + Trec + Wch.
(49)
(50)
(51)
(52)
Considering that the matrix SE|B can also be represented in the form of Eq. (32), then the symplectic eigenvalues can also be represented similarly to Eq. (33) as
«3, 4
z ± (e3 - ei) 2 (Vb + 1) '
— V(ei + e3)2 - 4e2.
(53)
(54)
2
z
Thus, the necessary values for estimating the Holevo bound in the presence of collective attacks in the trusted receiver noise scenario have been obtained. Further, the model will need to be supplemented taking into account the lack of access of Eve to the noise of Alice in order to consider the full scenario of trusted noise from trusted nodes.
The noise on the Alice side can be composed of the noise from laser power fluctuation and imperfect modulation [13,20]. Models of such trusted Alice noise for collective attacks are presented in [14,21-23]. This noise is modeled analogously to the noise of the channel and the detection module using an additional thermal state Thpr with variance
Wpr = + 1, (55)
1 - Tpr
where Tpr is the transmittance coefficient of Alice module.
Then the Alice noise measured by Bob will be epr, B = TchTrecepr. The thermal state Thpr interacts with Bob's mode through a beam splitter with a transmittance Tpr — 1, since the initial signal power is assumed already at the output of the Alice module. While the limit Tpr — 1 would result in Wpr —y to, the noise (1 — Tpr) Wpr — epr + 1 — Tpr —y epr of the mode reflected into the channel will be finite and good certain.
The problem can again be reduced to considering only two modes available to Eve, reducing the eigenvalue problem to a second degree polynomial. This allows one to describe the trusted noise of Alice and Bob using simple analytical expressions.
The overall initial state now includes the thermal state responsible for the Alice's noise
Stot,0 = EPRab e Thpr e EPRch e Threc. (56)
Then one should redesignate the sequence of all beam splitters BStot = BSrecBSchBSpr. Then the symplectic transformation, analogous to Eq. (37), will change the block of the covariance matrix related to the eavesdropper as
( ((1 - Tch) (V + epr) + TchWch) 12 VWwi - 1az \
SE = -- /--v . (57)
V V^^Wch - 1az Wch12 )
Obviously, the matrices from Eqs. (43) and (57) coincide up to the replacement V — V + epr. The symplectic eigenvalues v1 and v2 (required for calculating SE) are again obtained by Eq. (33). To calculate v3 and v4 for SE|B, Stot|B must be rearranged according to the modified shared state structure.
Thus, after substitution Tpr = 1 and with the accuracy of replacement V — V + epr, Eve's covariance matrix after heterodyne detection by Bob has the form in accordance with Eq. (49). The symplectic eigenvalues v3 and v4 are again obtained by Eqs. (50)-(52).
The advantage of this model is that as equipment losses increase, the Holevo bound decreases faster than mutual information [14].
5. Gaussian quantum channel modeling
The Gaussian quantum channel, as has already been mentioned in this paper, is characterized by two parameters: the transmittance and excess noise. Often CV-QKD papers do not provide clarifications on the components of these characteristics [16,24,25]: an analytical assessment has been carried out only for some components.
Modeling the parameters of the Gaussian channel is necessary to obtain the value of the signal-to-noise ratio, which will be maintained at a given distance.
As has already been demonstrated in the previous section, the transmittance is composite, which is why it cannot be estimated in the aggregate, which, for example, was done in [24,26]. This assumption significantly improves the performance and the amount of allowable losses in the stability analysis but remains incorrect.
So, given that the quantum channel is an optical fiber channel, the transmittance can be estimated in accordance with the well-known expression [27]:
Tch = 10-ZL/i0, (58)
where Z is the fiber attenuation in dB/km.
The coefficient Tdet can be obtained from the equipment loss and the detector efficiency as:
Tdet = ndet10-loSSeS/i0, (59)
where losses is the cumulative losses on Alice's equipment.
Here, it should be clarified that Tdet is the transmittance in the signal arm, Tdet is a transmittance in the LO arm. The latter will be necessary for estimating the excess noise. Both coefficients are calculated using Eq. (59) taking into account the fact that losses in both arms are different. For example, the power of LO is expressed as
PLO = TdetPLO, A, (60)
where PLO, A is the power of LO at the output of Alice.
The cumulative losses on the equipment in the Bob module are presented in Table 1.
Table 1. Cumulative losses in the signal arm and in the arm of LO obtained from [28—35]
Arm Name of the optical component Insertion loss, dB
FC/APC Connectors 3
CWDM-filter 0.6
Polarization controller 0.05
Signal Polarizing beam splitter 0.6
90-degree hybrid 3
All components 7,25
FC/APC Connectors 3,6
CWDM-filter 0.6
Polarization controller 0.05
LO Polarizing beam splitter 0.6
Beam splitter 10/90 6 0.85
90-degree hybrid 3
All components 8.7
In many theoretical works, the excess noise values are approximated and fixed [14,25,36-38]. This is motivated by the fact that in real CV-QKD systems, the excess noise, as well as the transmittance, is estimated from experimental data on the variances of quadrature operators. As far as strictly theoretical works are concerned, the substitution is necessary only for illustrative purposes. However, for a theoretical performance evaluation of the considered CV-QKD system, it is necessary to take into account various noise sources, which will be further carried out in accordance with work [13]. Like the transmittance, excess noise is compound. In this case, the excess noise components are:
• Alice module noises:
- laser power fluctuations noise;
- DAC noise;
• channel noises:
- phase noise;
• Bob module noises:
- common-mode rejection ratio (CMRR) noise;
- internal noise of the balanced detector;
- ADC noise.
Laser power fluctuations noise contains two components, signal and LO ones
-RIN, sig = W RINsigBsig, (61)
-rin, LO = 1RINloBloV, (62)
-RIN = -RIN, LO + -RIN, sig, (63)
where RINsig is the relative intensity noise (RIN) of signal, RINLO is the relative intensity noise of LO, Bsig is a signal spectrum width, and BLO is the LO spectrum width.
It is important to note that due to the fact that both the signal and LO emit from the same laser, the spectral width and the relative intensity noise for them will be the same [13], i.e. Bsig = BLO = B, RINsig = RINLO = RIN. The excess noise caused by noise from the modulating voltage side is estimated by the inequality [13]
-dac < + 1 n2a2, (64)
Vq = LSB2/12 = Vj2g/(12 • 22Nres(/rep)). (65)
where is the voltage required to reverse the phase by n, a is the DAC gain coefficient, Vq is the converter output voltage variance, LSB is the least significant bit, VFS is the full-scale voltage range of the converter, and Nres is the DAC resolution.
Coherent quantum signal detection requires a well calibrated phase and frequency relationship between the signal and LO. In addition, the signal initially carries a certain level of phase noise. This phase noise, as well as relative phase shifts,
can be compensated with a strong reference sent by Alice [39-42]. The reference (or pilot) signal carries well-known phase with a fixed phase relation to the original signal pulse. Bob performs heterodyne detection of the reference signal by measuring its quadratures q and p. It can determine the deviation from a fixed and time-constant reference phase. Any of such measured phase shift is used to appropriately correct the measured phase of the quantum signal. The remaining phase noise is then expressed as [13]
epR=2 Va to • (66)
where Vpt is the variance of the quadrature operator of the reference signal, Npt is the number of the reference signals, (Npt) is the average number of photons in the reference pulse.
It should be noted that in the presented paper, it is assumed that for each signal message there is a reference signal, i.e. the number of reference signals is half of the total number of messages.
It is convenient to express the internal noise of the balanced detector in terms of a characteristic called clearance C, which is defined as the ratio of the total experimental variance of the zero power signal (dispersion shot noise V0(q) and electronic noise of dispersion Vdet(q)) and variance Vdet(q) caused only by detector electronic noise:
C V0(q) + Vdet(q)
C = Vdet^) • (67)
The shot noise variance depends linearly on the power of LO, which, however, is limited by the saturation limit of the detector's PIN diodes. Experimentally, the numerator of Eq. (67) can be determined by measuring the quadrature variance of LO when it is mixed with the vacuum inlet. The denominator is the remaining quadrature variance after LO is disconnected from the detector. In SNU by definition V0(q) = 1, and the equation becomes as follows
C = 1 + Vdet(<?) = 1 + edet (68)
Vdet(q) edet '
Thus, the noise of the balanced detector relative to the clearance, taking into account one/two detectors in homo/heterodyne detection, respectively, is the following one
edet = ^C 1 1 • (69)
An experimental evaluation of edet was carried out for the General Photonics OEM Balanced Detector (BPD-003) with the operating frequency band of 200 MHz (see Fig. 2). The choice of the detector was based on the following parameters for the optimal signal-to-noise ratio:
• low noise equivalent power — indicates the possibility of detecting signals with a power comparable to that of shot noise;
• high gain coefficient — allows one to detect low power signals with high attenuation of LO;
• high CMRR — shows the gain quality;
• a wide operating frequency band — allows one to increase the frequency of sending states, which, in accordance with the current technical level, should be about MHz [16,24,26]. The established relationship between the excess noise of the detector and its operating frequency band is linear [13], so a too large range can lead to a high level of the internal detector noise.
The dependence of the excess noise of the detector and, as a result, the signal-to-noise ratio on the operating frequency band does not have a minimum due to linearity, however, as can be seen in Fig. 2, the obtained noise level in the considered detector is quite low and corresponds to the level established by [13,24]. So, for example, with the total loss of 13.7 dB (5 dB in the channel and 8.7 dB in the LO arm), edet = 0.093 is observed in [13] at operating frequency band of the detector is 250 MHz. In [24], one obtains edet ~ 10-1, based on the given data.
According to the obtained dependence of the excess noise of the balanced detector on the input power of LO, one can observe an increase in the contribution of the noise with a decrease in its values. In practice, a decrease in power is associated with an increase in losses. The resulting dependence will be used later in the overall assessment of the total excess noise. The experimental background of the obtained formula is related to the fact that the proposed models do not take into account the full composition of the balanced detector.
A realistic differential amplifier will amplify not only the difference current with a coefficient g, but also to a small extent with a coefficient gCM their average value of the input photocurrents in the subtractive circuit. As a characteristic for estimating such amplification, CMRR [43] is used:
CMRR:
g
gCM
(70)
Noise dependent on CMRR is calculated as [13]:
eCMRR = 4CMRR2 (iSLtRINsig Bsig + fPLORINL°BLO) , (71)
where PLO is a LO power, t is the pulse duration, f is the optical frequency and h is Planck's constant.
Fig. 2. Dependence of the excess noise of the balanced detector on the input power of LO for General Photonics OEM Balanced Detector (BPD-003).
The incoming signal pulse will be received and amplified by Bob's balanced detector, where the output voltage will be proportional to the measured quadrature. However, if the output voltage is quantized by DAC, it will introduce additional error into the measured signal, thereby contributing to excess noise as [13]:
^ADC = ^
TVq
(72)
hf g2P2 Plo'
where g is the gain coefficient of the electrical circuit of the balanced detector and p is the photodiode responsivity.
It should be noted that in Eqs. (64) and (72) the output voltage variance of DAC and ADC are equal, because they are selected with the same scope and resolution.
The calculation of the components of the total excess noise was carried out in accordance with the parameters specified in Table 2. The substantiation of the variance of the quadrature operator is given below in Sec. 6.1. It is important that in the considered case of transmitted LO (see Fig. 1), the power of the LO, as well as the signal power, depends significantly on the losses on equipment and in the channel, which must be taken into account in assessing the excess noise related to the receiver.
6. Evaluation and monitoring of experimental parameters
This subsection describes the procedure for assessing, optimizing and monitoring the key parameters of the CV-QKD. Since the selection of parameters directly affects the secure key generation rate, it is necessary to introduce a boundary with respect to which the calculation will be carried out.
In the general case, the secure key generation rate K is determined by
k = f
sym
(73)
where fsym is the repetition rate and r is the secure key fraction.
The asymptotic secure key generation rate in terms of a message with ideal post-processing for the CV-QKD system in the case of collective attacks is given by the Devetak-Winter bound [45] as
cnmpt > iab - x. Given the non-ideal reverse reconciliation, the bound can be refined as
r
asympt coll
> (1 - FER) (£1ab - XEB) ,
(74)
(75)
where FER e [0, 1] is the frame error rate (FER).
The quantities 1AB and xeb are respectively obtained by Eqs. (24) and (29). The dependence of these quantities on losses in the quantum channel is shown in Fig. 3.
It can be seen that the Holevo bound does not exceed the mutual information at large distances, thereby keeping the secure key generation rate positive (see Fig. 4). Such an assessment poorly reflects reality, because with an infinite number of messages, and, hence, with an infinite sample for estimating the parameters and an infinite number of reference signals, the excess noise in the channel is very small. At the same time, the excess noise and losses on the Bob side are still large.
r
R. K. Goncharov, A. D. Kiselev, E. O. Samsonov, V. I. Egorov Table 2. Parameters used in modeling excess noise obtained from Refs. [13,44]
Parameter Description Value Units
Va Alice's modulation variance 6.77 SNU
RIN RIN 10-14.5 Hz-1
B laser spectrum width 104 Hz
Vn voltage required to reverse the phase by n 5 V
a DAC gain 8 a.u.
Vq variance of output voltage of converter 1.94-10-11 V
Vfs full-scale voltage range of DAC 1 V
Nres DAC resolution 16 bit
Vpt variance of pilot signal 1.2 SNU
npt number of pilot signals 3 • 108 -
(Npt > mean photon number in pilot puls 600 -
M homo-/heterodyning parameter 2 -
Plo, a Alice's output LO power 2-10-3 W
Tdet transmittance of signal arm 10-0,745 a.u.
T i Tdet transmittance of LO arm 10-0,89 a.u.
T pulse duration 3-10-9 s
f optical frequency 1.934 -1014 Hz
h Planck's constant 6.63-10-34 Js
g balanced detector's gain 105 V/A
p photodiode responsivity 0.85 A/W
CMRR CMRR 30 dB
0.7
(L, dB
Fig. 3. Mutual information 1AB and the Holevo bound xbe versus losses in the quantum channel.
Limitations on the quantum channel length, as, for example, in [14], are due to the fact that the excess noise model uses not analytical expressions, but approximate fixed values. It can also be noted that when using error correction codes over an alphabet of size q, each symbol of the code corresponds to log2 q bits, and for a given code rate R, which is selected based on the channel parameters, one can write [13]:
R log2 q = ^/ab . (76)
Fig. 4. Dependence of the secure key generation rate in the asymptotic limit on losses in the quantum channel considering the presence of collective attacks.
6.1. Mean photon number optimization
Obviously, an increase in the variance of Alice's quadrature operator VA, which specifies the average number of photons over an ensemble of states (see Eq. (12)), will lead to a proportional increase in the signal-to-noise ratio (see Eq. (21)). That is, an increase in the average number of photons in the signal will give better discrimination of the Gaussian states up to the limits provided by the detector. However, it must be taken into account that in this case, Eve will also receive more information. In this regard, it is necessary to estimate the value of VA by maximizing the value of the secure key fraction r at the target distance.
Thus, with a target loss in the quantum channel of 5 dB and the efficiency of the reconciliation procedure ^ = 0.95, the optimal value VA is 6.77 SNU, which is obtained by maximizing the adjusted value of r from Eq. (99). It is important to note that this parameter is significantly affected by the total number of states nstates, which, in turn, determines the limit for the number of reference signals.
6.2. Parameter estimation
The Bob measurement data does not initially correspond to the Gaussian quantum information terminology. For this reason, it is necessary to introduce a conversion coefficient 0, expressed in V2/SNU, which converts the original data to SNU. To keep track of possible changes to the calibration parameters, this procedure should be repeated during the key exchange step. Instead of the variance of the quadrature operator, Bob measures the voltage variance (see Eq. (22))
V(U) = 0V (qB). (77)
Alice and Bob randomly jointly select npe from nstates distributed signals and publicly disclose the corresponding -npe value pairs. Under the collective Gaussian attack assumption, these pairs are independent and equally distributed Gaussian variables. In accordance with the maximum likelihood method, the following estimate can be obtained from the sample
V(U) = <U2)-(U)2 = -Le £ U2 - £ Ui , (78)
Mnpe i=1 i=1 )
where Ui is a measured voltage value.
Approximately the parameter 0 can be estimated as
0 « Plop2g2Bbd hf, (79)
where BBD is an operating frequency of the balanced detector.
However, the coefficient ^ must be determined experimentally more precisely. To do this, Bob disables the signal input (TVA = £ch = 0) and, instead, measures the quadratures of the vacuum state. Then, the variance of the Bob quadrature operator is as follows
V ) = 1 + —, (80)
M
V (U ) = ^ + ^ = ^ + Nrec. (81)
M
It should be noted that ^ is linearly directly proportional to the LO power, while the detector noise is inversely proportional, as shown in Eq. (72) and as can be seen from Fig. 2 (the analytical formula for the detector noise is presented in [13]). Therefore, the product of two is constant with respect to PLO
4 <x PLo, (82)
£rec <X , (83)
PLO
dNec = dd?H = 0. (84)
<9Plo <9Plo
Thus, in the case of PLO = 0, the coefficient ^ will become zero, but Nrec will remain unchanged, since it does not depend on the LO power. Therefore, when not only the signal but also the LO input are disabled, Eq. (81) becomes
V (U )= Nrec. (85)
Now, for a given voltage dispersion V (U), obtained with a given non-zero LO power, we can write the final formula
for
$ = V(U) - Nrec. (86)
The quantity ^ is the quadratic measure of the voltage of exactly one SNU, still assuming that only the vacuum input is measured, i.e. TVA = 0. For subsequent parameter estimation, Bob divides his measured voltages representing q and p by and any calculated voltage variance by so that all his data will be represented in SNU system.
6.3. Confidence intervals
Depending on the chosen security model (trusted or untrusted noise), when estimating the parameters, it is necessary to set certain confidence intervals. Since the noise of the equipment is assumed to be trusted in the model under consideration, the total transmittance for Bob (in Eq. (60)) must be estimated in terms of the best case, while the transmittance and the excess noise of the channel — in terms of the worst.
As have already been mentioned, Alice and Bob have a sample of M«pe independent and equally distributed pairs jxj, yi}f=T, where xj and y» are Gaussian variables, which are related by the ratio of the channel with additive white Gaussian noise:
y = VTx + N (0,0. (87)
For pairs of values, estimates of the transmittance and the excess noise are determined:
T = ^ f, (88)
E
¿=i
1 M«pe
e=-£ (yi - TXi). (89)
It should be taken into account that corrections must be introduced, depending on the belonging of the noise for a correct assessment of the mutual information and the Holevo bound. At the same time, the channel model with additive noise is preserved. The corrections themselves are expressed as [38]:
Corrt j = wJVarj2) = w + M , (90)
V j V2^npe
/2T2 + Tj (£j + m)/Va
CorrT, j = wyj Var(j) = 2wW -—-—-, (91)
y Mnpe
where w is the confidence factor, m is the number of signals for parameter estimation and j is the parameter that defines belonging to Alice/channel/Bob.
Such approximations are correct up to ©(n-1). The expression Var(T1/2) can be further approximated for large npe, so a more optimistic estimate can be written
CorrT, j = 2w£j /Va ^Tj/(Mnpe). (92)
However, the estimate from Eq. (91) will be used for performance analysis. Thus, it is necessary to carry out the replacement as follows
Tdet Tdet + CorrT, full, (93)
Tch Tch " CorrT, ch, (94)
-ch —» -ch + Corr5i ch . (95) Each of these estimates limits the corresponding actual value to within the error probability epe, if denote
V2
V/21n(l/£pe). (96)
17
erf (l - 2£pe)
Approximation in Eq. (96) is allowed for small epe < 107. Estimating the finite-length secure key generation rate
After parameter estimation, each initial sequence of nstates dimensions goes into n symbols to be processed into the final key using error correction and privacy amplification procedures. For each information block, errors are successfully corrected with a probability of 1 - FER. The value of this probability depends on the signal-to-noise ratio, the target reconciliation efficiency and the e-criteria correctness ecor. The latter limits the probability that local bit strings of Alice and Bob are different after error correction and successful execution of the validation procedure.
On average, n(1 - FER) signals from the information block remain for the privacy amplification procedure. This final step is implemented with the e-security parameter esec, which limits the trace distance between the final key and the ideal key, which has no correlation with the eavesdropper. In the QKD paradigm, it is necessary to take into account the pessimistic assessment of information distributed among users. In this case, not Shannon entropies, but smoothed Renyi min-entropies are used, which are reduced to the former through the asymptotic equipartition property [46]. The smoothness determines the allowable error fluctuations. In turn, e-security is technically decomposed as:
eSec = es + eh, (97)
where es is the min-entropy smoothing parameter and eh is the parameter that determines the match of hash codes after privacy amplification procedure.
All declared e-security parameters are set small (for example, 2-33 « 10-10) and form a general security criteria
e = 2(1 - FER)epe + ecor + eSec. (98)
7.1. Satisfying the composability criteria of CV-QKD protocol in the presence of collective attacks
Taking into account the finiteness of the keys and the requirement that the protocol under consideration be composable in the presence of collective attacks, the boundary from Eq. (75) is refined, and the secure key generation rate in terms of the message is expressed as [7, 8, 37, 38]
fir > n(1- FER) (vab(w) - XEB(w) - ^ + ©) , (99)
nstates V Vn n J
Aaep = 41og2(2^ +1)^1°g2 ((t-fk)^), (100)
18
^(1 - FER)2e^
© = 1og2 [(1 - FER) (1 - es2/3)] + 21og2 V2eh, (101)
where n is the number of characters left to process the final key, nstates is the number of states, Aaep is the correction according to asymptotic equipartition property [46], © is the correction coefficient that combines hash mismatch accounting after privacy amplification procedure according to Lemma 2 of [47] and a leak on the error correction procedure [37,38], d is the size of the effective alphabet after the final digitization of the continuous variables of Alice and Bob and ej is the security parameter.
To improve performance, Aaep can be refined as [38,48]
Aaep = 41og2(Vd +2)/og2 (^FER^. (102)
The value of n, in turn, is obtained from nstates as follows
n = nstates - (npt + npe), (103)
where npt is the number of reference signals and npe is the number of signals given for parameter estimation.
7.2. Security of CV-QKD protocol against coherent attacks
So far, the security of the CV-QKD protocol with the Gaussian modulation in the presence of Gaussian collective attacks has been substantiated. The level of security for a protocol with heterodyne detection can be extended to security against coherent attacks using the mathematical apparatus from [49].
Let the protocol P, which uses coherent states as information carriers, be e-secure with a secure key generation rate of finite length rfi0nte in the presence of collective Gaussian attacks, and P can be symmetrized with respect to the representation of the group of unitary matrices in the Fock space. This symmetrization is equivalent to applying an identical random orthogonal matrix to the classical continuous variables [49], which is certainly possible for a protocol that implies heterodyne detection. The symmetrized protocol can be denoted as P.
Then it can be assumed that users jointly perform the so-called energy tests on the sample net = fetn from random inputs for some coefficient fet < 1. In each test, the parties measure the local average of the number of photons, which can be extrapolated from the data, and calculate the average over the net tests. If these averages exceed the specified thresholds (dA for Alice and dB for Bob), the protocol is aborted. Setting dA > VA/2 + O(net) guarantees almost successful passing of the test with probability pet « 1 in typical scenarios, where the signals are attenuated and the noise is not too high, at large values of net [37]. Also, for a channel with losses and sufficiently small excess noise, the average number of photons reaches Bob, which is clearly less than in the state prepared by Alice, which means that the successful value for dB can be chosen to be dA, i.e. relies dA = dB = det.
Thus, the parties are moving to the symmetrized P protocol, which will now use n = nstates - ncoh signals to generate secret quantum keys, where ncoh = npt + npe + net.
Moreover, additional privacy amplification is required, reducing the output key string by [37,38,49]
2
, . K„ +4 log2
4
(104)
i 1 + 2V$ + 2$ 1 Kn = max < 1,2ndet . } , (105)
$ = (2n)-1 ln(8/e). (106)
Assuming that the original protocol has e security criteria against collective Gaussian attacks, otherwise the security criteria for the symmetrized protocol against coherent attacks goes to [49]
e' = K e/50. (107)
It should be noted that a very strict limitation on e-parameters is implied. In particular, this means that epe must be sufficiently small (for example, 10-43, as suggested by [25,37]), and the corresponding coefficient confidence w must be calculated using Eq. (96).
Given the changed length of the input sequence and the change in the security criteria, Eq. (99) is rewritten as
rfi0hte > Ub(w) - XEB(w) - + ^) . (108)
nstates V A/n n /
7.3. Analysis of the potential performance of CV-QKD system
The dependence of the finite-length secure key generation rate in the presence of collective and coherent attacks on losses in the quantum channel is shown in Fig. 5. The corresponding parameters are presented in the Tables 2 and 3. A significant contribution to the performance of any system CV-QKD is made by the number of states, while increasing this parameter imposes a limit on the computing resource. In the case under consideration, this value was estimated from the calculation of memory characteristics and information processing speed, i.e. the number of states was chosen as large as possible to fully record information about them in high-speed memory of the type DDR. It is supposed to use the Kria K26 computing module from Xilinx with a memory of 4 GB, of which 2 GB is allocated for data. With further increase in the number of states, information will need to be recorded in a larger, but low-speed memory, using which, the final rate of generation of the secret quantum key will be lower. For this reason, there is a limitation on the amount of recorded information about states in memory caused by the use of high-speed memory.
The marginal losses in the quantum channel in CV-QKD in the presence of collective attacks are 10.2 dB, in the presence of coherent — 7.5 dB.
Ensuring the security of the CV-QKD protocol with Gaussian modulation against coherent attacks, in turn, requires not only a significant limitation on security criteria, but also an increase in the number of messages to maintain the proper performance level.
According to the collective attack security criteria set in p. 7.1 (see also Table 3), the number of states is 6 • 108. Each quantum signal pulse is followed by a reference pulse in such a way that the total number of quantum signal pulses and reference pulses is 6 • 108 for each block. For each quantum message, the random number generator generates 32 bits: 16 bits each to determine the value of each of the quadratures.
^ 1000
10
0 2 4 6 8 10
dB
Fig. 5. Dependence of the secure key generation rate of finite length in the presence of collective and coherent attacks on losses in the quantum channel.
Table 3. Parameters used to evaluate the performance of the CV-QKD system. Security parameters are selected in accordance with the works [25,36-38]
Parameter Description Value (collective attacks) Value (coherent attacks) Units
nstates number of states 6 • 108 6 • 108 -
P reconciliation efficiency 0.95 0.95 a.u.
FER frame error rate 0.03 0.03 a.u.
d size of the effective alphabet 104 104 bit
npe number of signals for parameter estimation 6 • 107 6 • 107 -
fet fraction os states for energy tests 0.2 0 a.u.
w confidence 6.34 14.07 a.u.
£s smoothness parameter 10-10 10-43 a.u.
parameter that determines hash code match 10-10 10-43 a.u.
£ general security parameter 5.6 • 10-9 1.3 • 10-9 a.u.
Alice in the process of generating the message writes the package number without taking into account the reference pulses, using 27 bits for this (5 bits are laid down for redundancy to align the word to 4 bytes), as well as a 4-byte number obtained using a software random number generator implemented on the basis of the FPGA Alice module. Bob detects both quadratures of each message received from the channel. Given that half of the states are reference pulses and two quadrature values are recorded for each state, legitimate users within each block write down information about 6 • 108 quantum state quadrature values. During detection, Bob writes the number of the message (which accounts for 4 bytes) and 4 bytes of information about the two registered values of quadratures of quantum messages to high-speed DDR memory, as well as 4 bytes of information about the two registered values of the quadratures of the reference pulses.
information about the registered reference pulse quadratures is used to compensate for the phase shift of quantum messages as a result of transmission over a quantum channel, after which this information is deleted from memory. Every ten states, Bob randomly selects one to be used for channel characterization (for the parameter estimation procedure). For the remaining messages, insignificant bits are discarded in the part containing information about quadratures, as a result
of which eight bits remain out of 32 bits of information. On average, each package has 5.3 bytes of information. The time taken for detection and storage is 12 seconds.
To evaluate the channel, states are disclosed for which insignificant bits have not been discarded. After that, errors are corrected using multi-level encoding and multi-stage decoding [50-52]. During error correction, three of the four bits are revealed, thereby reducing the bit sequence to a length of 5.4 • 108 bits.
After the error correction is completed, universal hashing is used to exhaustively verify that all Alice and Bob sequences are the same (confirmation procedure). Hashing of the key with corrected errors is performed both in Alice's and Bob's blocks. As a result of hashing, users still have hash codes on their hands. Bob sends the received hash code to Alice. She then compares the values of two hash codes: the one calculated in her block and the one received from Bob. The result of the comparison is then transmitted to him. If the values do not match, then the processing of this sifted key stops without generating a secret key. The key that has not passed the confirmation procedure is erased from memory on both sides.
A 2-universal hash function is used at the privacy amplification step. The input is a key with corrected errors. The corrected key is loaded in blocks. The ratio of the length of the output sequence after privacy amplification procedure to the length of the input sequence is 1:66.
Since the post-processing of the sequence is faster than writing information to memory during detection, these processes can be performed in parallel.
8. Conclusion
In this paper, we have carried out a theoretical analysis of the performance of the realistic CV-QKD system. Our estimates show that performance can be maintained with losses as low as 10 dB in the most common assumption of collective attacks. In the presence of coherent attacks, there is a noticeable drop in allowable losses (down to 7 dB), and at the same time, tougher security criteria must be taken into account, which are still quite difficult to satisfy in practice. Further work will be focused on creating an experimental setup in accordance with what is described in the article and evaluating the performance of a real system.
References
[1] Pirandola S., Andersen U.L., Banchi L., Berta M., Bunandar D., Colbeck R., Englund D., Gehring T., Lupo C., Ottaviani C., Pereira J.L., Razavi M., Shamsul Shaari J., Tomamichel M., Usenko V.C., Vallone G., Villoresi P., and Wallden P., Advances in quantum cryptography. Advances in Optics and Photonics, 2020, 12, P. 1012.
[2] Bennett C.H., Brassard G., Quantum cryptography: Public key distribution and coin tossing. Theoretical Computer Science, 2014, 560(12), P. 7-11.
[3] Bennett C.H., Brassard G., Mermin N.D., Quantum cryptography without Bell's theorem. Physical Review Letters, 1992, 68(2), P. 557-559..
[4] Ralph T.C., Continuous variable quantum cryptography. Phys. Rev. A, 1999, 61(1), P. 010303.
[5] Cerf N.J., Levy M., Assche G.V., Quantum distribution of Gaussian keys using squeezed states. Physical Review A, 2001, 63(4), P. 052311.
[6] Grosshans F., Van Assche G., Wenger J., Brouri R., Cerf N.J., Grangier P., Quantum key distribution using gaussian-modulated coherent states. Nature, 2003, 421(1), P. 238-241.
[7] Leverrier A., Grosshans F., Grangier P., Finite-size analysis of a continuous-variable quantum key distribution. Physical Review A, 2010, 81(6), P. 062343.
[8] Leverrier A., Composable Security Proof for Continuous-Variable Quantum Key Distribution with Coherent States. Physical Review Letters, 2015, 114(2), P. 070501.
[9] Ghorai S.,Grangier P.,Diamanti E., and Leverrier A., Asymptotic Security of Continuous-Variable Quantum Key Distribution with a Discrete Modulation. Physical Review X, 2019, 9(6), P. 021059.
[10] Lin J., Upadhyaya T., Liitkenhaus N., Asymptotic Security Analysis of Discrete-Modulated Continuous-Variable Quantum Key Distribution. Phys. Rev. X, 2019, 9(12).
[11] Denys A., Brown P., Leverrier A., Explicit asymptotic secret key rate of continuous-variable quantum key distribution with an arbitrary modulation. Quantum, 2021, 5(9), P. 540.
[12] Usenko V., Filip R., Trusted Noise in Continuous-Variable Quantum Key Distribution: A Threat and a Defense. Entropy, 2016, 18(1), P. 20..
[13] Laudenbach F., Pacher C., Fung C.-H. F., Poppe A., Peev M., Schrenk B., Hentschel M., Walther P., and Hubel H., Continuous-Variable Quantum Key Distribution with Gaussian Modulation-The Theory of Practical Implementations. Advanced Quantum Technologies, 2018,1(8), P. 1800011.
[14] Laudenbach F., Pacher C., Analysis of the Trusted-Device Scenario in Continuous-Variable Quantum Key Distribution. Advanced Quantum Technologies, 2019, 2(11), P. 1900055.
[15] Weedbrook C., Lance A.M., Bowen W.P., Symul T., Ralph T.C., Lam P.K., Quantum Cryptography Without Switching. Physical Review Letters, 2004, 93(10), P. 170504.
[16] Huang D., Huang P., Lin D., and Zeng G., Long-distance continuous-variable quantum key distribution by controlling excess noise. Scientific Reports, 2016, 6(5), P. 19201.
[17] Bennett C.H., Quantum cryptography using any two nonorthogonal states. Physical Review Letters, 1992, 68(5), P. 3121-3124.
[18] Carter J., Wegman M.N., Universal classes of hash functions. Journal of Computer and System Sciences, 1979, 18(4), P. 143-154.
[19] Scarani V., Bechmann-Pasquinucci H., Cerf N.J., Du M.\ifmmode \checks\else s\fiek, N. Liitkenhaus, and M. Peev, The security of practical quantum key distribution. Reviews of Modern Physics, 2009, 81(9), P. 1301-1350.
[20] Jouguet P., Kunz-Jacques S., Diamanti E., and Leverrier A., Analysis of imperfections in practical continuous-variable quantum key distribution, Physical Review A, 2012, 86(9), P. 032309.
[21] Filip R., Continuous-variable quantum key distribution with noisy coherent states. Physical Review A, 2008, 77(2), P. 22310.
[22] Usenko V.C., Filip R., Feasibility of continuous-variable quantum key distribution with noisy coherent states. Physical Review A, 2010, 81(2), P. 022318.
[23] Jacobsen C., Gehring T., and Andersen U., Continuous Variable Quantum Key Distribution with a Noisy Laser. Entropy, 2015,17(7), P. 4654-4663.
[24] Zhang Y., Chen Z., Pirandola S., Wang X., Zhou C., Chu B., Zhao Y., Xu B., Yu S., and Guo H., Long-Distance Continuous-Variable Quantum Key Distribution over 202.81 km of Fiber, Physical Review Letters, 2020, 125(6), P. 010502.
[25] Hosseinidehaj N., Lance A.M., Symul T., Walk N., and Ralph T.C., Finite-size effects in continuous-variable quantum key distribution with Gaussian postselection. Physical Review A, 2020, 101(5), P. 052335.
[26] Jouguet P., Kunz-Jacques S., Leverrier A., Grangier P., and Diamanti E., Experimental demonstration of long-distance continuous-variable quantum key distribution. Nature Photonics, 2013, 7(5), P. 378-381.
[27] Agrawal G.P., Fiber-optic communication systems, vol. 222. John Wiley & Sons, 2012.
[28] Polarization Insensitive Isolator (ISO) http://www.lightcomm.com/product/view/typeid/235/id/268.html.
[29] Polarization Maintaining Fused Standard Coupler (PMC) http://www.lightcomm.com/home/product/view/typeid/189/id/206.html.
[30] Intensity Modulators https://photonics.ixblue.com/store/lithium-niobate-electro-optic-modulator/intensity-modulators.
[31] Phase Modulators https://photonics.ixblue.com/store/lithium-niobate-electro-optic-modulator/phase-modulators.
[32] Polarization Beam Combiner/Splitter (PBC/PBS) http://www.lightcomm.com/product/view/typeid/190/id/212.html.
[33] 90-Degree Optical Hybrid http://www.optoplex.com/Optical_Hybrid.htm.
[34] Polarization Maintaining Isolator (PMISO) http://www.lightcomm.com/product/view/typeid/190/id/211.html.
[35] HIGH SPEED POLARIZATION CONTROLLER-SCRAMBLER (OEM VERSION) https://www.ozoptics.com/ALLNEW_PDF/DTS0143.pdf.
[36] Hosseinidehaj N., Walk N., and Ralph T.C., Optimal realistic attacks in continuous-variable quantum key distribution. Physical Review A, 2019, 99(5), P. 1-11.
[37] Pirandola S., Limits and security of free-space quantum communications. Physical Review Research, 2021, 3(3), P. 013279.
[38] Pirandola S., Composable security for continuous variable quantum key distribution: Trust levels and practical key rates in wired and wireless networks. Physical Review Research, 2021, 3(10), P. 043014.
[39] Qi B., Lougovski P., Pooser R., Grice W., and Bobrek M., Generating the Local Oscillator "Locally" in Continuous-Variable Quantum Key Distribution Based on Coherent Detection. Physical Review X, 2015, 5(10), P. 041009.
[40] Soh D.B., Brif C., Coles P.J., Lutkenhaus N., Camacho R.M., Urayama J., and Sarovar M., Self-referenced continuous-variable quantum key distribution protocol. Physical Review X, 2015, 5(4), P. 1-15.
[41] Kleis S., Rueckmann M., and Schaeffer C.G., Continuous variable quantum key distribution with a real local oscillator using simultaneous pilot signals. Optics Letters, 2017, 42(4), P. 1588.
[42] LaudenbachF., SchrenkB., Pacher C., Hentschel M., Fung C.-H.F., KarinouF., Poppe A., Peev M., and Hubel H., Pilot-assisted intradyne reception for high-speed continuous-variable quantum key distribution with true local oscillator. Quantum, 2019, 3(10), P. 193.
[43] Szynowski J., CMRR analysis of instrumentation amplifiers. Electronics Letters, 1983, 19(14), P. 547.
[44] Tang X., Kumar R., Ren S., Wonfor A., Penty R., and White I., Performance of continuous variable quantum key distribution system at different detector bandwidth. Optics Communications, 2020, 471(9), P. 126034.
[45] Devetak I. and Winter A., Distillation of secret key and entanglement from quantum states, Proceedings of the Royal Society A: Mathematical, Physical and Engineering Sciences, 2005, 461(1), P. 207-235.
[46] Tomamichel M., Colbeck R., and Renner R., A fully quantum asymptotic equipartition property. IEEE Transactions on information theory, 2009, 55(12), P. 5840-5847.
[47] Tomamichel M., Schaffner C., Smith A., and Renner R., Leftover Hashing Against Quantum Side Information. IEEE Transactions on Information Theory, 2011, 57(8), P. 5524-5535.
[48] Tomamichel M., Quantum Information Processing with Finite Resources. Cham: Springer International Publishing, 2016.
[49] Leverrier A., Security of Continuous-Variable Quantum Key Distribution via a Gaussian de Finetti Reduction. Physical Review Letters, 2017, 118(5), P. 200501.
[50] Van Assche G., Cardinal J., and Cerf N., Reconciliation of a Quantum-Distributed Gaussian Key. IEEE Transactions on Information Theory, 2004, 50(2), P. 394-400.
[51] Mani H., Error Reconciliation Protocols for Continuous-Variable Quantum Key Distribution. PhD thesis, Technical University of Denmark, 2021.
[52] Wen X., Li Q., Mao H., Wen X., and Chen N., Rotation Based Slice Error Correction Protocol for Continuous-variable Quantum Key Distribution and its Implementation with Polar Codes. arXivpreprint arXiv:2106.06206, 2021, 6, P. 1-17.
Submitted 30 May 2022; revised 16 June 2022; accepted 17 June 2022
Information about the authors:
RomanK. Goncharov - ITMO University, Kronverkskiy, 49, St. Petersburg, 197101, Russia; [email protected] AlexeiD. Kiselev - ITMO University, Kronverkskiy, 49, St. Petersburg, 197101, Russia; [email protected] Eduard O. Samsonov - ITMO University, Kronverkskiy, 49, St. Petersburg, 197101, Russia; [email protected] Vladimir I. Egorov - ITMO University, Kronverkskiy, 49, St. Petersburg, 197101, Russia; [email protected] Conflict of interest: the authors declare no conflict of interest.
