Quantum key distribution (QKD) is an application of quantum information sciences, enabling two partners (Alice and Bob) to share a secret key, which in turn allows them to communicate securely. The security is guaranteed by Heisenberg’s uncertainty principle and the no-clone theory. Since almost ten years ago, lots of interest has arisen in continuous-variable quantum key distribution (CVQKD), which provides various CVQKD protocols.^[1–6] One of the most favorable protocols is the Gaussian-modulated coherent state (GMCS) protocol.^[7–9] In this protocol, Alice performs Gaussian modulation to encode the key information, by modulating the quadratures X and P (using the amplitude and the phase modulators) of few-photon coherent states with a centered Gaussian distribution. These states are then sent along with a phase reference through the quantum channel to Bob, who randomly measures one of the two quadratures (X or P) using a homodyne detector, or both quadratures simultaneously with a heterodyne detector. So far, several experimental implementations have been carried out by several groups. Meanwhile, the unconditional security of the GMCS QKD against general collective and coherent eavesdropping attacks has been fully proved in some references.^[10–14]

Generally, the GMCS QKD protocol with homodyne detector requires a binary random basis choice, i.e., 0 or π/2, which makes Alice and Bob have to discard half of their data. Moreover, the devices and applications used in the practical system may be imperfect, which will incur loopholes to Eve in practical application. This points to the practical security which has been investigated widely, such as the laser source,^[15–17] the beam splitter (BS),^[18–21] the local oscillator,^[22,23] the detector,^[21,24] and the software or hardware for the phase compensation^[25,26] and the basis choice. For the binary random basis choice, Bob randomly modulates 0 or π/2 on the phase modulator (PM) to measure either quadrature of the received quantum state. Maybe we can propose another alternative figuration of CVQKD system, so that the performance and practical security of the system may be improved.

In this paper, we present a GMCS QKD scheme based on the continuous random basis choice, in which Bob randomly measures the received states depending on the continuous random phase, then Alice reshapes her data. The security of this scheme is guaranteed by the no-cloning theorem and the uncertainty principle. To testify the performance and security of the scheme, we calculate the secret key rate under collective attacks when using reverse reconciliation and investigate the practical security under realistic quantum channel and detector. The simulation results show that the continuous random basis choice does improve the performance, such as the secure communication distance, and the imperfect basis choice can be well removed by the perfect phase compensation algorithm. Moreover, this scheme avoids comparing the measurement basis and discarding the key bits, and it can be implemented with current technology easily.

The paper is organized as follows. In Section 2, we introduce the GMCS QKD scheme based on the continuous random basis choice. In Section 3, the secret key rate of the scheme under collective attacks is calculated. In Section 4, we analyze the practical security induced by the imperfect basis choice. Conclusions are drawn in Section 5.

In the prepare-and-measurement (P&M) model of a standard GMCS QKD scheme, Alice randomly prepares an encoded quantum state and sends it to Bob for detection. Alice and Bob broadcast their measurement bases via an authenticated channel. They discard all polarization data sent and received in different bases and use the remaining data to generate a sifted key. Here we substitute the continuous random basis choice in our scheme, which avoids comparing the measurement basis and discarding the key data. The P&M model of our scheme is shown in Fig. 1. In detail, the quantum transmission procedure is described as follows.

Fig. 1.

Figure Option ViewDownloadNew Window

Fig. 1. (color online) The P&M model of the GMCS QKD scheme based on the continuous random basis choice. (a) The schematic model. A represents the amplitude modulator (AM), Φ represents the phase modulator, and RNG represents the random numbers generator. (b) The modulation module at Bob’s side, which can be equivalent to the dotted box in (a). θ can be equal to the binary random basis choice 0 or π/2 with the phase shifts θ or θ − π/2. PS means the phase shifts.

(I) Alice generates two Gaussian random numbers X_A and P_A with mean values 0 and variances V_A. Meanwhile, Bob generates a random bit b.

(II) Alice prepares the quantum coherent state. The initial quantum coherent state with shot noise (δX_A, δP_A) is modulated by the amplitude and the phase modulator to obtain the coherent state centered at (X_A, P_A). Then Alice sends the prepared states to Bob through the quantum channel, which features a transmission efficiency T and an excess noise ε. The total channel added noise referred to the channel input, expressed in shot noise units, is defined as χ_line = 1/T − 1 + ε.

(III) When Bob receives the modulated coherent state, he randomly measures the quadratures by a detector depending on the continuous random phase θ (from 0 to 2π). The continuous random basis choice is implemented by PM at Bob’s side, which is based in the random bit b. The detection-added noise referred to Bob’s input is defined and expressed in shot-noise units as χ_hom = (1 − η + V_el)/η, where η denotes the efficiency of the detector and V_el is the detector’s electronic noise. The total noise referred to the channel input can then be expressed as χ_tot = χ_line + χ_hom/T.

(IV) Bob informs Alice the phases θ that he selects in each time and keeps his measurement outcomes m_B = X_A cos θ + P_A sin θ. Then Alice reshapes her data depending on θ.

(V) Finally, Alice and Bob apply reconciliation and privacy amplification algorithms to extract a private binary key string from the shared information. The reconciliation is direct when Alice’s data are used as a reference for establishing the key and reverse when the reference is Bob’s data.

Actually, this scheme can be seen just as one specific case of the well-known GMCS model with special known phase shifts θ or θ − π/2, as shown in Fig. 1(b). That is, the security against collective and coherent eavesdropping attacks will be the same as that of the general GMCS QKD protocol. The proposed scheme has several distinct features. We can implement this scheme with current technology easily and the scheme avoids comparing the measurement basis and discarding the key bits. The reconstruction of Alice’s data may be implemented in the data post-processing procedure, which will reduce the complexity of the system. Specially, the proposed scheme does increase the performance of the CVQKD system and it is secure even when we apply the same angle θ to hundreds of frames. In the intercept-resend attack, Eve makes a heterodyne measurement (X_A and P_A) of each incoming quantum state sent by Alice through the quantum channel, then prepares a coherent state according to her measurement results and sends it to Bob.^[27] However, the uncertainty principle prevents her from doing so. The eavesdropper cannot accurately measure the X_A and P_A at the same time, so will not exactly know the sent quantum states and successfully attacks the system though the θ is published. In the proposed scheme, when Eve wants to intercept and measure the pulses sent by Alice, because the angle for the basis choice is from 0 to 2π, she cannot guess the angle correctly. Eve must simultaneously measure the quadratures, then she will inevitably induce at least two shot-noise units of excess noise^[27] and obtain little information. It should be mentioned that it is insecure when we apply the same angle to hundreds of frames in the GMCS QKD protocol based on the binary random basis choice. Because there are only two possibilities of angle for the basis choice, Eve can intercept the pulses sent by Alice and accurately measure the quadrature X_A (or P_A) by the homodyne detector. She can control the interception proportions to further decrease the excess noise to a normal level without being detected and then obtains the information sent by Alice.

In the following, we derive the expression of the secret key rate of the proposed scheme for the case of collective attacks. It is well known that the P&M scheme is formally equivalent to the corresponding entanglement-based (E-B) scheme.^[8] In the E-B scheme, the coherent state preparation is modeled by a heterodyne measurement of one half of a two-mode squeezed vacuum (EPR) state of variance V = V_A + 1. The other half of the EPR state is sent to Bob through the quantum channel. Bob’s detector inefficiency is modeled by a BS with transmission η, while its electronic noise V_el is modeled by an EPR state of variance V_d, one half of which is entering the second input port of the BS, as shown in Fig. 2. The variance for the homodyne detector is V_d = 1 + V_el/(1 − η).^[28] Finally, Alice and Bob proceed with classical data processing procedures, which include a reconciliation algorithm. Reverse reconciliation has been shown to offer a great advantage in the QKD system, therefore calculations in this paper have been performed for this case.

Fig. 2.

	Figure Option ViewDownloadNew Window
	Fig. 2. (color online) The E–B model of the GMCS QKD based on the continuous random basis choice.

In the case of collective attacks, Eve interacts individually with each pulse but is allowed to wait for the entire classical procedure to end before performing the best possible collective measurement on her ensemble of stored ancillae. The maximum information of Bob’s key available to Eve is limited by the Holevo bound

Therefore, the covariance matrix γ_AB1, which depends on the system including Alice and the quantum channel, can be written as

We now have all the elements required to proceed to the calculation of the symplectic eigenvalues. In addition, the mutual information of Alice and Bob, I_AB, is derived from Bob’s measured variance V_B and the conditional variance V_B|A,

Fig. 3.

Figure Option ViewDownloadNew Window

Fig. 3. (color online) The secret key rate of the scheme against the collective attacks. The curve at the left-most position represents the secret key rate of the GMCS QKD based on the binary random basis choice. Then from left to right, the curves represent the secret key rates of our proposed scheme with the parameters k = 0.8, 0.7, 0.6, and 0.5, respectively. Meanwhile, other parameters of the simulation are VA = 30, ε = 0.01, η = 0.6, Vel = 0.01, and β = 0.9.

For any practical CVQKD system, the security includes not only the theoretical security, but also the practical security induced by the devices and applications. In our proposed scheme, the continuous random phase θ is needed for the basis choice. However, because of the imperfections of the digital to analog convertor (DAC) and PM, the real phase values applied to the system θ′ may be not equal to the expected phase values θ, which will increase the excess noise of the system and induce a loophole.

Considering a practical basis choice with the imperfect DAC and PM, the output mode can be denoted as

The secret key rate R^κ is plotted in Fig. 4. The noise of the imperfect basis choice is weighted by the parameter κ, thus we plot the secret key rate with different parameters κ. The results show that the secret key rate is affected by the imperfection, since it affects the mutual information between Alice and Bob, and increases the information eavesdropped by Eve on the final key. Actually, this issue also exists in the GMCS QKD protocol involving the basis choice procedure, but can be well solved by the phase compensation algorithm.^[25,31]

Fig. 4.

Figure Option ViewDownloadNew Window

Fig. 4. (color online) The secret key rate as a function of the transmission distance of optical fiber with loss coeffiency 0.2 dB/km for different degrees of imperfection of continuous random basis choice (perfect basis choice corresponds to κ = 1). The curves without the marked points from right to left represent the secret key rates for κ = 1, 0.997, 0.993, and 0.98, respectively. The red marked curve represents the result of eliminating the imperfections by our phase compensation algorithm.

In the CVQKD system, the phase shift between the local and signal pulses is inevitable due to the variation of temperature and vibrations in the environment. The phase shift may affect the stability and the final key rate of the system. To overcome this issue, the phase compensation is a necessary procedure in practical applications of the CVQKD system. We introduce some brighter and randomly labeled stabilization pulses that are not used for generating a raw key, which can therefore be used for the calculation of the phase shifts. The stabilization pulses are sent in known phase states and placed at random positions within the weak quantum signals. When Bob receives the data, he firstly extracts the stabilization pulses and calculates the values of the phase shifts. Then Alice reconstructs the quantum data and Bob performs a linear operation on the received data.^[31] In order to effectively compensate the phase shifts, the phase variation of the phase shifts should be less than the inaccuracy of the phase compensation algorithm. We test our algorithm in practice, the precision can reach 0.1° for each frame. Considering the angles of each pulse are the same, then 0.1° represents .^[25] Meanwhile, according to the above analysis, κ = 0.99 represents δθ = 1.8°. Therefore, the precision of our phase compensation algorithm can meet the requirement of eliminating the imperfections of the basis choice. To demonstrate the effect of elimination, we simulate and plot the red marked curve in Fig. 4. The result shows that the red marked curve and the curve with the perfect basis choice are roughly coincident. In other words, the phase compensation algorithm can well solve the imperfections induced by the basis choice.

We have explored the possibility of enabling the GMCS QKD with the continuous random basis choice. The secret key rate of the proposed scheme under collective attacks has been calculated and the result shows that the use of the continuous random basis choice does improve the performance of the system, such as the secure communication distance. Moreover, the devices and applications may be imperfect in the practical system and we investigate the practical security of the scheme with the imperfect basis choice procedure. The results show that this imperfection will decrease the secret key rate and thus incur insecurity of the system. Fortunately, this issue can be well solved by the perfect phase compensation algorithm.