Unconditional Security of Time-Energy Entanglement Quantum Key Distribution Using Dual-Basis Interferometry
Total Page：16
File Type：pdf, Size：1020Kb
Unconditional Security of Time-Energy Entanglement Quantum Key Distribution Using Dual-Basis Interferometry The MIT Faculty has made this article openly available. Please share how this access benefits you. Your story matters. Citation Zhang, Zheshen, Jacob Mower, Dirk Englund, Franco N. C. Wong, and Jeffrey H. Shapiro. “Unconditional Security of Time-Energy Entanglement Quantum Key Distribution Using Dual-Basis Interferometry.” Physical Review Letters 112, no. 12 (March 2014). © 2014 American Physical Society As Published http://dx.doi.org/10.1103/PhysRevLett.112.120506 Publisher American Physical Society Version Final published version Citable link http://hdl.handle.net/1721.1/89019 Terms of Use Article is made available in accordance with the publisher's policy and may be subject to US copyright law. Please refer to the publisher's site for terms of use. week ending PRL 112, 120506 (2014) PHYSICAL REVIEW LETTERS 28 MARCH 2014 Unconditional Security of Time-Energy Entanglement Quantum Key Distribution Using Dual-Basis Interferometry Zheshen Zhang,* Jacob Mower, Dirk Englund, Franco N. C. Wong, and Jeffrey H. Shapiro Research Laboratory of Electronics, Massachusetts Institute of Technology, 77 Massachusetts Avenue, Cambridge, Massachusetts 02139, USA (Received 4 November 2013; published 26 March 2014) High-dimensional quantum key distribution (HDQKD) offers the possibility of high secure-key rate with high photon-information efficiency. We consider HDQKD based on the time-energy entanglement produced by spontaneous parametric down-conversion and show that it is secure against collective attacks. Its security rests upon visibility data—obtained from Franson and conjugate-Franson interferometers—that probe photon-pair frequency correlations and arrival-time correlations. From these measurements, an upper bound can be established on the eavesdropper’s Holevo information by translating the Gaussian-state security analysis for continuous-variable quantum key distribution so that it applies to our protocol. We show that visibility data from just the Franson interferometer provides a weaker, but nonetheless useful, secure-key rate lower bound. To handle multiple-pair emissions, we incorporate the decoy-state approach into our protocol. Our results show that over a 200-km transmission distance in optical fiber, time-energy entanglement HDQKD could permit a 700-bit=sec secure-key rate and a photon information efficiency of 2 secure-key bits per photon coincidence in the key-generation phase using receivers with a 15% system efficiency. DOI: 10.1103/PhysRevLett.112.120506 PACS numbers: 03.67.Dd, 03.67.Hk, 42.50.Dv Quantum key distribution (QKD) [1] promises uncondi- [16,17] uses the quadrature-component covariance matrix tionally secure communication by enabling one-time to derive a lower bound on the SKR in the presence of a pad transmission between remote parties, Alice and Bob. collective attack. We take an analogous approach—using Continuous-variable QKD (CVQKD) [2,3] and discrete- the time-frequency covariance matrix (TFCM)—for our variable QKD (DVQKD) [4,5] utilize infinite-dimensional time-energy entanglement HDQKD protocol. and finite-dimensional Hilbert spaces, respectively. The TFCM for our protocol can be obtained using the CVQKD exploits the wave nature of light to encode dispersive-optics scheme from [18], although dense wave- multiple bits into each transmission, but it has been limited length-division multiplexing (DWDM) may be required to to 80 km in optical fiber [3,6,7] because the eavesdropper do so [19]. An experimentally simpler technique—utilizing (Eve) can obtain partial information from a beam-splitting a Franson interferometer—has been conjectured [13,14] to attack. The predominant DVQKD protocol is Bennett- be sufficient for security verification. Its robustness against Brassard 1984 (BB84), which uses a two-dimensional some specific attacks has been discussed [14,20],but Hilbert space. The decoy-state BB84 protocol [8,9] has security against collective attacks has not been proven demonstrated nonzero secure-key rates (SKRs) over and [20] suggests that such a proof may be impossible. 144 km in free space [10] and 107 km in optical fiber This Letter proves that time-energy entanglement [11], but its photon information efficiency (PIE) cannot HDQKD can be made secure against Eve’s collective exceed 1 key bit per sifted photon. attack when a Franson interferometer is used for security High-dimensional QKD (HDQKD) using single photons verification in conjunction with a dispersion-based [12] can utilize the best features of the continuous and frequency-difference measurement. Our proof relates the discrete worlds, with the Hilbert space of single-photon Franson interferometer’s fringe visibility to the TFCM’s arrival times providing an appealing candidate for frequency elements that, together with the frequency- its implementation. The time-energy entanglement of difference measurement, establishes an upper bound on photon pairs produced by spontaneous parametric down- Eve’s Holevo information. We introduce another nonlocal conversion (SPDC) has been employed in HDQKD experi- interferometer—the conjugate-Franson interferometer— ments [13,14], although these works lacked rigorous and link its fringe visibility to the TFCM’s arrival-time security proofs. Security proofs for time-energy entangled elements [21]. Employing both interferometers increases HDQKD have been attempted by discretizing the continu- the SKR. ous Hilbert space to permit use of DVQKD security Our fringe visibility results presume that the entangle- analyses [12,15], but the validity of the discretization ment source emits at most one photon pair in a measurement approach has not been proven. CVQKD security analysis frame, which need not be the case for SPDC. Thus, we 0031-9007=14=112(12)=120506(5) 120506-1 © 2014 American Physical Society week ending PRL 112, 120506 (2014) PHYSICAL REVIEW LETTERS 28 MARCH 2014 incorporate decoy-state operation [8,9] to handle multiple- they obey the canonical commutation relations, † pair emissions. We show that time-energy entanglement ½Eˆ ðtÞ; Eˆ ðuÞ ¼ δ δðt − uÞ, for J;K ¼ S; I. Their fre- J K JK ˆ ˆ HDQKD could permit a 700 bit=sec SKR over a 200-km quency-domain counterparts, ASðωÞ and AIðωÞ, annihilate transmission distance in optical fiber. We also show that a signal and idler photons at detunings ω and −ω, respec- PIE of 2 secure-key bits per photon coincidence can be tively. Our interest, however, is in the arrival-time and achieved in the key-generation phase using receivers with angular-frequency operators, a 15% system efficiency. Before beginning our security Z analysis, we provide a brief explanation of our protocol. † tˆ ¼ dttEˆ ðtÞEˆ ðtÞ; (3a) Suppose Alice has a repetitively pumped, frequency- J J J degenerate SPDC source that, within a time frame of duration Z ¼ 3 ω of Tf sec, which is centered at time tm mTf, emits a ωˆ ¼ d ω ˆ †ðωÞ ˆ ðωÞ (3b) single photon pair in the state [22] J 2π AJ AJ ; Z Z 2 2 2 2 ¼ −ðtþ−t Þ =4σ −t−=4σ −iω tþ for J S; I when only one photon pair is emitted by the jψ i ∝ dt dt e m coh cor P jt i jt i m SI S I S S I I source. Restricting these time and frequency operators to (1) the single-pair Hilbert space implies that they measure the arrival times and frequency detunings of the signal and for some integer m. In this expression, ωP is the pump idler photons. It also leads to the commutation relation j i j i ½ωˆ ˆ ¼ ϵ δ ϵ ¼ −ϵ ¼ 1 frequency; tS S ( tI I) represents a single photon of the J; tK i J JK [26], where S I , making these signal (idler) at time tS (tI); tþ ≡ ðtS þ tIÞ=2; t− ≡ tS − tI; operators conjugate observables analogous to the quad- σ ¼ ptheffiffiffiffiffiffiffiffiffiffiffiffiffiffi root-mean-square coherence time coh Tf= rature components employed in CVQKD and justifying our 8 lnð2Þ ∼ nsec is set by the pump pulse’s duration; translating CVQKD’s covariance-based security analysis σ ¼ pandffiffiffiffiffiffiffiffiffiffiffiffiffiffi the root-mean square correlation time cor [16,17] to our protocol. 2 ð2Þ 2π ∼ ln = BPM psec is set by the reciprocal of the To exploit the connection to CVQKD, we define an Oˆ ¼½ˆ ˆ T full-width at half-maximum (FWHM) phase-matching observable vector tS ωˆ S tI ωˆ I . For a single- ˆ ˆ bandwidth, BPM, in Hz. Now suppose that, despite propa- pair state, the mean value of O is m ¼hOi, and the TFCM † gation losses and detector inefficiencies, Alice and Bob is Γ ¼hðΔOˆ ΔOˆ þ H:c:Þi=2, where ΔOˆ ≡ Oˆ − m and detect the signal and idler, respectively, from the preceding H.c. denotes Hermitian conjugate. The characteristic func- ˆ photon pair and record the associated arrival times [23,24]. tion associated with the single-pair state is χðζÞ¼heiζT Oi. After many such frames, they use public communication to Given the covariance matrix Γ, the Gaussian state with reconcile their arrival-time data, resulting in their sharing χðζÞ¼eiζT m−ζT Γζ=2 yields an m-independent upper bound nR random bits per postselected frame, i.e., frames used on Eve’s Holevo information [16,17,27] when the SPDC for key generation in which Alice and Bob both made source emits a single-pair state. ’ detections. How many of those bits are secure against Eve s A direct, complete measurement of the TFCM is quite collective attack? Before turning to the security analysis, challenging, so we resort to indirect measurements— we pause for a brief note about Eq. (1). This expression using a Franson interferometer and a conjugate-Franson is an oft-used approximation for the postselected biphoton interferometer—that provide useful partial information. state produced by an SPDC source (see, e.g., [14]). A Franson interferometer [28], shown in the top panel of Moreover, entanglement engineering can be employed to Fig.