Quantum communication has been developed in the past thirty years. One highlighted communication protocol is quantum key distribution (QKD). ^[1] QKD is to allow two authorized parties, Alice and Bob, to share a secret key in the presence of an eavesdropper. QKD offers unconditional security guaranteed by the laws of quantum mechanics. ^[2–4] However, real-life imperfections of the QKD devices lead to the difference between theoretical and practical security of QKD, which compromises the security of QKD systems. In order to close the gap, device-independent QKD (DIQKD) ^[5–7] and semi-device-independent QKD (SDI-QKD) ^{[8, 9]} have been proposed. Unfortunately, the demonstration of these two protocols is still an extremely difficult challenge.

As we know, among the real-life imperfections, the defect in the detectors is a serious threat to the security. By exploiting the vulnerabilities of single-photon detectors, several specific attacks ^[10–17] have been successfully launched against practical QKD systems. Fortunately, measurement-device-independent QKD (MDI-QKD) ^{[18, 19]} has been proposed, which can remove all the possible loopholes in detection. Thereafter, MDI-QKD has drawn great interest in both theory ^[20–31] and experiment. ^[32–40]

All the protocols mentioned above are two-party protocols distributing secret keys between two authorized parties. Multi-party quantum communication protocols ^{[41, 42]} have been proposed. But all of them face the same constraints, i.e., lacking the high intensity source and reliable remote distribution of the entangled states. Until recently, two multi-party quantum communication protocols ^{[43, 44]} combining the MDI-QKD ^{[18, 19]} technologies manifest the possibility for the practical applications of MDI multi-party quantum communication. These two protocols are not only immune to all detection-side attacks, but also require neither the preparation of high-fidelity entangled states (GHZ states or W states) in advance nor their remote distribution. Afterwards, a finite-key analysis on MDI quantum cryptographic conferencing (MDI-QCC) ^[43] has been reported in Ref. ^[45].

However, just like in MDI-QKD system, there are still some major challenges making the practical applications of MDI-QCC ^{[43, 44]} an experimental challenge. Firstly, we assume there is no security loophole in the users’ frequency-locked lasers. Secondly, a complex time-synchronization system and feedback controls are truly essential in fiber communication. Thirdly, in MDI-QCC protocol, it also needs to ensure the indistinguishability of the particles from Alice, Bob, and Charlie. However, since the photons are prepared independently, it is difficult to meet this condition.

Recently, Xu ^[29] has proposed an MDI-QKD protocol with a single untrusted source and provided a complete security analysis. This protocol can overcome the analogous challenges mentioned above in MDI-QKD. It should be noted that in the decoy-analysis of MDI-QKD with an untrusted source, Xu uses the numerical method to study the precise parameters’ estimation and just presents a relatively simple analytical method.

In this paper, we extend the framework of MDI-QKD with an untrusted source to MDI-QCC and give a complete security analysis. Due to the bi-directional structure, the birefringence effects and polarization-dependent losses can be automatically compensated. With a single source, we can easily ensure the indistinguishability of the particles from different users. What is more, inspired by the security analysis for plug & play QKD, ^{[46, 47]} we give a rigorous analytical method for parameters’ estimation based on the actual photon number distribution of users’ output pulses.

To extend the protocol of MDI-QKD with an untrusted source ^[29] to MDI-QCC, we clearly define the protocol of MDI-QCC with an untrusted source illustrated in Fig. 1. Here, we clarify the required assumptions for our protocol. First, we require that Alice’s, Bob’s, and Charlie’s laboratories are perfectly isolated, and their devices are independent. Second, Alice’s, Bob’s, and Charlie’s monitoring devices are trusted. The monitoring unit used in our protocol is realized by a standard optical filter and a classical intensity detector. So most of the attacks against single-photon detectors are ineffective. The security of the intensity detector has been studied in Ref. ^[48]. Then, the detailed description of our protocol is presented below.

Fig. 1

Figure Option ViewDownloadNew Window

Fig. 1 (color online) Schematic layout of the MDI-QCC with an untrusted source setup. An untrusted relay, David, generates bright laser pulses. They are split into three parts by two beam splitters (BS). Before entering Alice’s, Bob’s, and Charlie’s lab, the pulses will travel through the channel, which is fully controlled by Eve. In the lab, to ensure the single mode assumption for each signal, the pulses pass through an optical filter (F) first. After that, a monitoring unit, which consists of a BS and an intensity detector (ID), is needed to monitor the photon number distribution of the input pulse. Then, the input pulses pass through a phase modulator (PM) for phase randomization, a variable optical attenuator (VOA) and an encoder that consists of an intensity modulator (IM) and a PM. Finally, the pulses are reflected by a Faraday mirror (FM) and travel back to David who is supposed to perform a GHZ-state measurement. [43] The measurement can identify two of the eight GHZ states.

(i) State preparation and distribution David, located in the middle node, generates bright pulses whose photon numbers are centered at . The bright pulses go through two beam splitters one after another and are split into three parts. Then, David sends them to Alice, Bob, and Charlie via two quantum channels. In this paper, we assume a fiber-based channel model.

(ii) Monitoring and encoding The pulses sent by David suffer the whole channel loss and then enter Alice’s, Bob’s, and Charlie’s lab. In the lab, to remove side-channels and ensure that only pulses of the desired mode can pass through, we place an optical filter working in spectral, spatial, and temporal domains. Accordingly, the single mode assumption for each pulse sustains. Then, the pulses go through a monitoring unit which consists of a beam splitter and an intensity monitor. The monitoring unit is used to estimate the photon number of input pulses. ^[29] After the monitoring unit, the pulses go through a phase modulator used to apply the phase randomization on each pulse. The randomization is used to disentangle the input pulse into a classical mixture of Fock states, which is also the foundation of our security analysis. Then, the input pulses are encoded by an encoder which consists of a phase modulator (PM) and an intensity modulator (IM). After that, the pulses are reflected by a Faraday mirror (FM).

(iii) Measurement The reflected pulses are attenuated to the single-photon level by a variable optical attenuator. We denote the internal transmittance of Alice’s, Bob’s, and Charlie’s labs as , where the superscript are the intensity settings chosen by Alice, Bob, and Charlie, and the subscripts refer to Alice, Bob, and Charlie respectively. Then, the attenuated pulses retransmit through the same optical fiber to David. David is supposed to perform a GHZ-state measurement which can identify two of the eight GHZ states, that is, and .

(iv) Sifting David reveals which GHZ state he has obtained. Meanwhile, Alice, Bob, and Charlie broadcast the intensity settings and post-select the events where they use the same basis via an authenticated channel.

(v) Parameter estimation The data of Z basis are used to generate the cryptographic conferencing keys, while the data of X basis are totally used to estimate errors. Alice, Bob, and Charlie estimate the gain and quantum bit error rate of single-photon pulses of untagged pulses with the decoy state method.

(vi) Post processing Firstly, Alice, Bob, and Charlie apply the error correction to ensure that they share a string of identical keys. Secondly, to make the leakage of information on keys as little as possible, they apply the privacy amplification to extract the secret key.

Here, in order to post-select GHZ states among Alice, Bob, and Charlie, we need to ensure the mode matching of their pulses. Since we use plug-and-play architecture in our protocol, the polarization drift can be automatically compensated, and the spectral modes of these pulses are naturally identical. So the only measure we need to take is to actively control the arrival timing of the pulses.

As the framework presented in Section 2, the source is placed in the middle node. So we can consider the source is controlled by Eve. To enhance the security of our protocol, we place an optical filter and phase modulator in the users’ lab to ensure the single mode assumption and phase randomization on each input pulse, respectively. In addition, the monitoring unit in users’ lab is used to test the photon numbers of the input pulses. In order to estimate the bounds of output pulses, we focus on the input pulses whose photon numbers are concentrated in a relatively narrow range.

Following Ref. ^[29], we divide the input pulses into two categories according to the photon numbers: untagged input pulses with photon number , and tagged input pulses with photon number or , where the subscript denotes which users (Alice, Bob, or Charlie) the pulses belong to. is a small positive real number, chosen in advance by Alice, Bob, and Charlie. is a large positive integer denoted as the average of the photon numbers of the input pulses. For a specific user (Alice, Bob, or Charlie), these parameters can be denoted as , , or .

The conditional probability that photons are emitted by Alice (Bob, Charlie) given that photons entering Alice’s (Bob’s, Charlie’s) device obeys a binomial distribution as

(1)

For untagged pulses, we can show that the upper bound and lower bound of are

(2)

In practice, quantum non-demolition (QND) measurements on photon number of the input pulses are not feasible with current technology. Thus Alice, Bob, and Charlie do not know the exact photon number of each input pulse. They can only measure the overall gain and the overall quantum bit error rate (QBER) , and cannot get the gain Q and the QBER EQ of the untagged pulses directly. However, as in the description of the protocol presented in Section 2, Alice, Bob, and Charlie can use a monitoring unit to sample the input pulses to acquire information about the photon number distribution. From Ref. ^[29], with this information, Alice, Bob, and Charlie know that at least , , and pulses are untagged with high confidence, where k denotes the number of pulses sent by David and denotes the probability that a certain sampling pulse of Alice (Bob, Charlie) belongs to untagged pulses in the asymptotic case. In the asymptotic case, . The calculating methods of are totally presented in Ref. ^[29], which have been elided here for brevity.

Then Alice, Bob, and Charlie can estimate the upper bounds and the lower bounds of the gain Q and the QBER EQ of the untagged pulses. The upper bound and lower bound of Q are given by

(3)

The upper bound and lower bound of EQ are given by

(4)

If the source is trusted, Eve only knows the output photon number of each pulse. This draws out the basic assumption of previous decoy state analysis of MDI-QCC, that is,

However, if the source is untrusted, the assumption above no longer holds. Because both the source and channel are controlled by Eve, Eve not only knows the output photon number , but also knows the input photon number . In this case, and . Considering and jointly, we can find that

In this case, the rigorous decoy-state analysis for MDI-QCC with untrusted source becomes much more difficult and complicated. Fortunately, since we focus on the gain and the QBER of the untagged pulses whose photon numbers are concentrated within a narrow range, the unconditional security of our protocol can still be achieved quantitatively and rigorously. By performing the measurements for different intensity settings, we can obtain

(5)

(6)

(7)

(8)

Because the events that photons are emitted by Alice (Bob, Charlie) given that photons have entered Alice’s (Bob’s, Charlie’s) device are independent, we have

(9)

(10)

4.1. The gain of single-photon pulses of untagged pulses

To estimate the gain of single-photon pulses of untagged pulses, we have to solve Eq. (9) under the constraints of the binomial probability distributions given by Eq. (2). From the proof in Appendix A, the lower bound of untagged pulses Q₁₁₁ ^Z is given by

where Q _uuu ^Z (Q _vvv ^Z , Q₀₀₀ ^Z ) are the gain of single-photon pulses of untagged pulses when Alice, Bob, and Charlie choose the signal state (the decoy state, the vacuum state) simultaneously, and their bounds can be estimated from Eq. (3). Then,

(11)

where and are defined by Eq. (2). We have , , , , , and , where , , , , , and are defined by Eq. (2).

4.2. The error rate of single-photon pulse of untagged pulses

To estimate the error rate of single-photon pulses of untagged pulses, we have to solve Eq. (10) under the constraints of the binomial probability distributions given by Eq. (2). From the proof in Appendix B, the upper bound of e₁₁₁ ^X in untagged pulses is given by

where are the error rate of single-photon pulse of untagged pulses when Alice’s, Bob’s, and Charlie’s intensity settings are respectively, and their bounds can be estimated from Eq. (4). and are defined by Eq. (2).

4.3. Secret key rate

We analyze the behavior of the secret key rate of MDI-QCC with an untrusted source such that

where Q _uuu ^Z (E _uuu ^Z ) is the gain (the total quantum bit error rate) of Z basis when Alice, Bob, and Charlie use signal states, which can be directly obtained from the experimental results; is the lower bound of the gain that Alice sends out vacuum state in Z basis, given that Alice, Bob, and Charlie all send states in untagged pulses; and are the lower bound of the gain in the Z basis and the upper bound of the error rate in the X basis, given that Alice, Bob, and Charlie all send single-photon states in untagged pulses.

By assuming a fiber-based channel model, we numerically show the performance of our protocol in the asymptotic case in comparison with Ref. ^[43] (the case with trusted sources). The experimental parameters for simulation are listed in Table 1.

Table 1

Table 1

Table 1 List of experimental parameters for simulations: and are the detection efficiency and the dark-count rate of David’s single photon detectors, represents the overall misalignment-error probability of the system, [43] and are the the efficiency and the noise of intensity detector, q is the beam-splitter ratio, [29] α is the loss coefficient of the fiber, and f is the error-correction efficiency. . f q α 40% 0.7 1.5% 1.16 0.01 0.20db/km

Table 1 List of experimental parameters for simulations: and are the detection efficiency and the dark-count rate of David’s single photon detectors, represents the overall misalignment-error probability of the system, [43] and are the the efficiency and the noise of intensity detector, q is the beam-splitter ratio, [29] α is the loss coefficient of the fiber, and f is the error-correction efficiency. .

In Fig. 2, we consider the imperfections of the intensity monitor in implementation ^[29] and present the numerical simulation of secret-key rates with different values of , which is the average photon number per pulse at the source in the middle node. In the simulation, we consider two decoy state (weak+vacuum) protocols. Specifically, the intensity of one decoy state is 0.01 and the other decoy state is a vacuum state, while the signal state is optimized for different distances. Since can significantly affect the performance of the protocol, ^{[46, 47]} we optimize for different distances.

Fig. 2

Figure Option ViewDownloadNew Window

Fig. 2 (color online) Secret key rate versus fiber length with different values of . The red dashed curve denotes the asymptotic secret key rate with trusted source in Ref. [43]. At short distance, the asymptotic key rates for the two cases (with trusted and untrusted sources) almost overlap. With and considering the imperfections of intensity detector, MDI-QCC with an untrusted source can achieve the nonzero asymptotic secret key rate in long distance approximating to 105 km.

From the simulation results, we can find that as for the secret key rates, our protocol (the MDI-QCC with an untrusted source) and the case with trusted sources ^[43] are neck and neck at short distances. However, at long distances the secret key rates of our protocol reduce significantly. The reason is that due to the bi-directional structure, bright pulses sent by David will suffer the whole channel loss. This means that as the distances increase, lower photons per pulse can arrive at Alice’s, Bob’s, and Charlie’s labs, which leads to the increase of .

Moreover, from Eqs. (3) and (4), we know the estimation of the gain of the untagged pulses is sensitive to the value of which affects the performance directly. This influence is much greater than that of Refs. ^{[29, 46]}, and ^[47]. Because MDI-QCC is a multi-party protocol, the influence on will affect the parameter estimating of the untagged pulses together. In other words, the influence on each party accumulates.

We extend the framework of MDI-QKD with an untrusted source ^[29] to MDI-QCC and give the rigorous security analysis of MDI-QCC with an untrusted source. The protocol of MDI-QCC with an untrusted source utilizes the bi-directional structure and can certainly mitigate the experimental complexity of MDI-QCC. What is more, inspired by the security analysis for plug & play QKD, ^{[46, 47]} we clearly provide rigorous analytical method for parameters’ estimation based on the actual photon number distribution of user’s output pulses. With simple modifications, our analytical method can be applied to not only MDI-QKD with an untrusted source, but also arbitrary multi-party communication protocol with an untrusted source. To some extent, our work can be an important step towards practical application for quantum networks.

The numerical simulation results show that we can achieve the nonzero asymptotic secret key rate over reasonable distances, and the secret key rates for our protocol and the case with trusted source almost overlap at short distances. Importantly, our framework and security analysis can be extended to arbitrary multi-party communication not merely confined to three parties and can also be applied to MDI-QSS ^[43] protocol and MDI-QCC protocol using W-state. ^[44] To make the protocol of MDI-QCC with an untrusted source more practical, it is necessary to settle the remaining practical issues, such as the source flaws and the imperfections in the electronics of the classical intensity detector.