Loss-tolerant quantum cryptography with imperfect sources

Abstract

In principle, quantum key distribution (QKD) offers unconditional security based on the laws of physics. In practice, flaws in the state preparation undermine the security of QKD systems, as standard theoretical approaches to deal with state preparation flaws are not loss-tolerant. An eavesdropper can enhance and exploit such imperfections through quantum channel loss, thus dramatically lowering the key generation rate. Crucially, the security analyses of most existing QKD experiments are rather unrealistic as they typically neglect this effect. Here, we propose a novel and general approach that makes QKD loss-tolerant to state preparation flaws. Importantly, it suggests that the state preparation process in QKD can be significantly less precise than initially thought. Our method can widely apply to other quantum cryptographic protocols.PACS numbers: 03.67.Dd, 03.67.-a Introduction.-Quantum key distribution (QKD) [1] allows two distant parties, Alice and Bob, to distribute a secret key, which is essential to achieve provable secure communications [2]. The field of QKD has progressed very rapidly over the last years, and it now offers practical systems that can operate in realistic environments [3,4].Crucially, QKD provides unconditional security based on the laws of physics, i.e., despite the computational power of the eavesdropper, Eve. Indeed, the security of QKD has been promptly demonstrated for different scenarios [5][6][7][8][9][10][11][12]. Importantly, Gottesman, Lo, Lütkenhaus and Preskill [13] (henceforth referred to as GLLP) proved the security of QKD when Alice's and Bob's devices are flawed, as is the case in practical implementations. Unfortunately, however, GLLP has a severe limitation, namely, it is not loss-tolerant; it assumes the worst case scenario where Eve can enhance flaws in the state preparation by exploiting channel loss. As a result, the key generation rate and achievable distance of QKD are dramatically reduced [14]. Notice that most existing QKD experiments simply ignore state preparation imperfections in their key rate formula, which renders their results unrealistic and not really secure.In this Letter, we show that GLLP's worst case assumption is far too conservative, i.e., in sharp contrast to GLLP, we present a security proof for QKD that is loss-tolerant. Indeed, for the case of modulation errors, an important flaw in real-life QKD systems, we show that Eve cannot exploit channel loss to enhance such imperfections. The intuition here is rather simple: in this type of state preparation flaws the signals sent out by Alice are still qubits, i.e., there is no side-channel for Eve to exploit

Quantum key distribution with untrusted detectors

“…Furthermore, note that Bob could even remove the phase modulator within his LON. If Alice sends him only three different states, it can be shown that this scenario (i.e., without phase modulator on Bob's side) would be completely equivalent to that of the three-state protocol [51,52]. According to the results in [52] the expected performance in this case would be basically the same as that of the original situation where Alice and Bob use four different states.…”

Effect of source tampering in the security of quantum cryptography

“…The security of MDI-QKD as well as BB84 based on S-LD has been proven with decoy state method [23]. Hence, it has been convinced that if the source can be well characterized (for example the source flaws could be taken care of with the loss-tolerant QKD protocol [24]), perfect security can still be obtained.…”

“…It is important for not only weak coherent pulse-based protocols, but also, for instance, parametric down-conversion-based protocols [35]. And continuous or discrete phase randomization is also crucial for the loss-tolerant protocol [24]. In fact, without the phase randomization, the performance of a quantum communication protocol will be dramatically reduced in distance and key rate [31].…”

Security of quantum key distribution with iterative sifting

“…, then the operator M fail is the same for both bases [11]. Here, M bα represents the POVM element associated to the detection of the bit value b in the basis α, and the operator M fail represents the failure of outputting a bit value.…”