† Corresponding author. E-mail:
Project supported by the National Basic Research Program of China (Grant No. 2013CB338002) and the National Natural Science Foundation of China (Grant Nos. 61505261, 61675235, 61605248, and 11304397).
Reference frame independent quantum key distribution (RFI-QKD) allows two legitimate parties to share the common secret keys with the drift of reference frames. In order to reduce the actual requirements of RFI-QKD protocol on light source and make it more suitable for practical applications, this paper gives a specific description of RFI-QKD protocol with an untrusted source and analyzes the practical security of this protocol based on the two-way “plug and play” structure commonly used in practical systems. In addition, we also investigate the performance of RFI-QKD with an untrusted source considering statistical fluctuations based on Chernoff bound. Using simulations, we compare the secret key rate of RFI-QKD with an untrusted source to RFI-QKD with trusted source. The results show that the performance of RFI-QKD with an untrusted source is similar to that of RFI-QKD with trusted source, and the finite data size clearly effects the performance of our protocol.
With the development of science and technology, cryptography as the core of communication security has been widely concerned, and the key is the crucial point of cryptography to protect communication security. Quantum key distribution (QKD) based on the principle of quantum physics theoretically enables both legitimate parties to share the common secret keys securely. Since the BB84 protocol was proposed in 1984,[1] scholars worldwide have carried out a lot of research and experiments on QKD.[2–14] At present, with the deepening of QKD theory research, researchers gradually focus on the satellite-earth QKD,[15,16] the establishment of quantum secure communication network,[17,18] and the chip-based QKD equipment.[19,20] However, it is difficult to calibrate the reference frame in these three QKD application scenarios. To solve this problem, Laing et al. put forward the reference frame independent quantum key distribution (RFI-QKD) protocol in 2010.[21] Through this protocol, both legal communication parties can transmit the key securely without reference frame calibration or in the presence of deviations in the reference frame. This provides new theoretical support for the practical development of the earth-to-satellite, network and chip-based QKD. Due to the advantages of RFI-QKD protocol in practical applications, it has attracted extensive attention of researchers worldwide.[22–31]
Although RFI-QKD protocol can theoretically enable the sender Alice and receiver Bob to realize the transmission of secret key in the case of reference frame deviation, an important prerequisite for the successful implementation of this protocol is that the light source is reliable. However, the light source used in the practical QKD system inevitably has some security risks. The plug and play structure, which has been widely used in current commercial systems,[32] can automatically compensate for the phase and polarization drift in the transmission process, thus making the system more stable. However, the safety of the light source has been a concern. In the plug and play structure, the light source is set at the Bob end and the bright pulses are generated by Bob and sent to Alice. After encoded by Alice, the pulses will be sent back to Bob. Before the pulses arriving Alice’s equipment, they are completely exposed to Eve. At this time, Eve can perform arbitrary operations on the pulses. In the worst case, Eve completely replaced Bob’s pulses sent to Alice. Obviously, the security of the QKD protocol is threatened if the light source is not trusted.[33]
For the untrustworthy situation of the light source, there are two solutions: active solution[34] and passive solution.[35] The main difference is that the active method uses the optical switch to randomly select the pulse to enter the light intensity monitor or the encoder, while the passive method uses the beam splitter. Instead of the optical switch, the beam splitter splits the light pulse into two parts, one into the light intensity monitor and the other into the encoder and sent to Bob. The schematic diagram is shown in Figs.
In the QKD system, there are many difficulties in using the active device in Fig.
In this paper, pulses are divided into tagged pulses and untagged pulses depending on the number of photons contained in the input pulse. The pulse with photon number n ∈ [(1 − δ)N, (1 + δ)N] is defined as untagged pulse and the pulse with photon number n < (1 − δ)N or n > (1 + δ)N is defined as tagged pulse. Here N is the average number of photons of the input light pulse and δ is a positive real number with a smaller value chosen by Alice and Bob. In this paper, we focus on the untagged pulse and only the untagged pulse is used to generate security key.
Since in the QKD system, Alice and Bob are not capable of quantum non-demolition measurement to obtain photon number information of input light pulses. Therefore, Alice and Bob cannot directly obtain the gain Q and quantum bit error rate E of the untagged pulse in the experiment. They can only measure the overall gain Qe and the overall quantum bit error rate Ee of all received pulses. In the RFI-QKD protocol with an untrusted source, we use beam splitters and intensity monitors to obtain information about the distribution of photons in pulses from untrusted sources. Assume that the number of pulses sent by the untrusted light source to Alice is k, each pulse is divided into two parts A and B after passing through the BS, wherein the A pulse is taken as a sample into the light intensity monitor to analyze the photon number distribution information of the input pulse, and the B pulse is encoded as a coded pulse and sent to Bob. Let VA be the number of pulses in the untagged part of the A pulse and VB is the number of untagged part in the B pulse. According to Ref. [35], the probability that the inequality VB ≤ VA − ε k holds satisfies
As can be seen from the above relationship, Alice can estimate the number of untagged pulses in the encoded pulse from the number of untagged pulses in the sample pulse. Let Δ be the proportion of the tagged pulse in the sample pulse, then there are (1 − Δ − ε)k untagged pulses with a great probability in the coded pulse. Therefore, Alice and Bob can use the measured Qe, Ee to estimate the upper and lower bounds of the untagged pulse gain and error rate
The number of photons in the untagged pulse is m, and the conditional probability Pn(m) that there are n photons transmitted to Bob after Alice encoded conforms to Bernoulli distribution,
The constraint (1 + δ)N λ < 1 guarantees that the average number of photons of any untagged pulse output from the Alice terminal is less than 1, which is easily achievable experimentally.
In the case of the trusted source, since the attacker Eve only knows the photon number distribution information in the pulse sent from Alice, it is considered that the bit error rate and the count rate of the n photons in the decoy state are the same as those in the signal state. This is the theoretical basis for the successful application of the decoy state method in the trusted source QKD. However, this condition does not hold under the condition that the light source is not reliable. In the case that the light source is untrusted, we believe that Eve not only controls the light source but also controls the transmission channel, so Eve not only grasps the photon number distribution information in the light pulse emitted from the Alice, but also grasps the photon number distribution information of the light pulse entering the Alice end. At this time,
When analyzing the security of RFI-QKD protocol with an untrusted source under the condition of infinite key length, we only pay attention to the calculation methods of single-photon counting rate and single-photon bit error rate in different base selection conditions of untagged pulses. Firstly, Bob can measure the total counting rate under the signal intensity and the decoy intensity
The bit error rate under different bases when m photons enter the Alice end and n photons are emitted from Alice end and trigger the Bob end detector is given as
Using the method in Ref. [22], when the inequality
In order to calculate the single-photon error rate in signal state of the untagged pulses when Alice and Bob both select the Z basis, from Eq. (
Then, when Alice and Bob both select the Z-basis, the upper bound of the single-photon error rate in signal state of the untagged pulses is
Using the same method, we can obtain
Combined with the GLLP formula, we can obtain the RFI-QKD protocol secret key rate formula under ideal conditions with the untrusted source as follows:
![](cpb_29_3_030303/cpb_29_3_030303_ieqn8.gif)
![](cpb_29_3_030303/cpb_29_3_030303_ieqn9.gif)
![](cpb_29_3_030303/cpb_29_3_030303_ieqn10.gif)
The above security analysis is based on the fact that the output key length is infinite, but an actual QKD system runtime is limited, which means that its output key length is limited. The impact of the finite length of the key on the untrusted source protocol mainly includes two aspects: Firstly, in the finite key case, the calculations of the untagged pulses are different. In the case of infinite key, when the confidence level defined by Eq. (
Secondly, in the decoy state QKD protocol, the influence of the statistical fluctuation caused by the finite key in the parameter estimation cannot be ignored. In this section, we use the Chernoff bound to characterize the statistical fluctuations in the parameter estimation of the decoy state RFI-QKD protocol with an untrusted source under finite key conditions. In the decoy state RFI-QKD protocol with an untrusted source, the gains under different light intensities and the bit error rates in different signal bases are measured by a limited number of samples, and the measured values and mathematical expectations meet the relevant conditions of the Chernoff bound. According to Chernoff bound, the measured values of gain under the light intensity of signal state
Therefore, the upper and lower bounds of the gain of the signal state in the untagged pulses under finite key conditions are, respectively,
Similarly, under finite key conditions, the upper and lower bounds of the decoy state gain in the untagged pulses are, respectively,
Combining Eq. (
In the signal state, when Alice selects Z-basis to prepare and Bob selects Z-basis to measure, the bit error rate measurement value
In the same way, we can obtain the upper and lower bounds of the bit error rate when Alice selects i ∈ {X,Y} basis and Bob selects j ∈ {X,Y} basis in the signal state
![](cpb_29_3_030303/cpb_29_3_030303_ieqn15.gif)
![](cpb_29_3_030303/cpb_29_3_030303_ieqn16.gif)
![](cpb_29_3_030303/cpb_29_3_030303_ieqn17.gif)
Finally, the relationship between the secret key rate and the secret key transmission distance of the decoy state RFI-QKD protocol in the case of infinite key length and finite key length is demonstrated by numerical simulation. The numerical simulation of this section employs the QKD system channel model with standard fiber transmission. The experimental parameters used are listed in Table
![]() | Table 1. Experimental parameters used in the numerical simulation of the RFI-QKD protocol with an untrusted source. . |
Among them, α and Y0 are the transmission loss coefficient of optical fiber and the dark count of Bob detector, ηI and σI are the detection efficiency of light intensity monitor and the noise of light intensity monitor, q and f are the beam splitting ratio and the protocol error correction efficiency, and ηB is the detection efficiency of Bob’s detector. In the optical fiber transmission process, the total transmission efficiency is η = ηB10− α L/10, L is the distance between Alice and Bob in kilometers. In order to improve the performance of the protocol, the decoy state light intensity is selected to be v = 0.05 and the value of signal state light intensity is optimized. The probability of Alice choosing to prepare signal state is set to be PS = 0.7, and the probability of decoy state is set to be PD = 0.2. Referring to Ref. [35], we choose δ = 0.01, the confidence level τ > 1 − 10− 10 and ε3 = ε4 = εsec = εcor = 10− 10 in simulation. The proportion of tagged pulses in sample pulses Δ can be obtained by the following formula:
![](cpb_29_3_030303/cpb_29_3_030303_ieqn18.gif)
In Fig.
![]() | Fig. 3. Comparison of the secret key rate between RFI-QKD with a trusted source and an untrusted source. |
Considering the influence of finite key length on the secret key rate of the decoy-state RFI-QKD protocol with an untrusted source, we simulate the relationship between the secret key rate and the security transmission distance when the number of pulses Alice sends to Bob is 1011 and 1013. In Fig.
In summary, we have proposed and analyzed the decoy-state RFI-QKD protocol with an untrusted source based on plug-play structure. In order to compare the secret key rates with the real QKD system, our analysis and simulation consider the finite key effect using Chernoff bound. The results of the numerical simulation show that the transmission distance of the decoy-state RFI-QKD with an untrusted source is similar to the decoy-state RFI-QKD with a trusted source, and the finite data size clearly affects the performance of our protocol. The research in this paper provides an implementation scheme for the practical application of the RFI-QKD protocol, and reduces the requirement of the source for the specific implementation of the RFI-QKD protocol.
[1] | |
[2] | |
[3] | |
[4] | |
[5] | |
[6] | |
[7] | |
[8] | |
[9] | |
[10] | |
[11] | |
[12] | |
[13] | |
[14] | |
[15] | |
[16] | |
[17] | |
[18] | |
[19] | |
[20] | |
[21] | |
[22] | |
[23] | |
[24] | |
[25] | |
[26] | |
[27] | |
[28] | |
[29] | |
[30] | |
[31] | |
[32] | |
[33] | |
[34] | |
[35] | |
[36] |