r
X
i
v
:
1
3
1
1
.
0
8
2
5
v
2
[
q
u
a
n
t

p
h
]
2
3
J
a
n
2
0
1
4
Unconditional Security of Timeenergy Entanglement Quantum Key Distribution
using Dualbasis Interferometry
Zheshen Zhang,
SI
_
dt
S
_
dt
I
e
(t+tm)
2
/4
2
coh
t
2
/4
2
cor
iP t+
t
S
S
t
I
I
(1)
for some integer m. In this expression:
P
is the pump
frequency; t
S
S
(t
I
I
) represents a single photon of
the signal (idler) at time t
S
(t
I
); t
+
(t
S
+ t
I
)/2;
t
t
S
t
I
; the rootmeansquare coherence time
coh
= T
f
/
_
8 ln(2) ns is set by the pump pulses du
ration; and the rootmean square correlation time
cor
=
_
2 ln(2)/2B
PM
ps is set by the reciprocal of the full
width at halfmaximum (FWHM) phasematching band
width, B
PM
, in Hz. Now suppose that, despite propa
gation losses and detector ineciencies, Alice and Bob
detect the signal and idler, respectively, from the preced
ing photon pair and record the associated arrival times
[4, 5]. After many such frames, they use public com
munication to reconcile their arrivaltime data, resulting
in their sharing n
R
random bits per postselected frame,
i.e., frames used for key generation in which Alice and
Bob both made detections. How many of those bits are
secure against Eves collective attack? Before turning
to the security analysis, we pause for a brief note about
Eq. (1). This expression is an oftused approximation for
the postselected biphoton state produced by an SPDC
source, see, e.g., [14]. Moreover, entanglement engineer
ing can be employed to achieve a close match to a truly
Gaussian biphoton wave function [25].
Our security analysis begins with the positive
frequency eld operators,
E
S
(t) and
E
I
(t), for the
linearlypolarized single spatialmode signal and idler
elds emitted by Alices source, and their associated fre
quency decompositions:
E
S
(t) =
_
d
2
A
S
()e
i(P /2+)t
(2a)
E
I
(t) =
_
d
2
A
I
()e
i(P /2)t
. (2b)
The timedomain eld operators
E
S
(t) and
E
I
(t) an
nihilate signal and idler photons, respectively, at time
t, and they obey the canonical commutation relations,
[
E
J
(t),
E
K
(u)] =
JK
(t u), for J, K = S, I. Their
frequencydomain counterparts,
A
S
() and
A
I
(), anni
hilate signal and idler photons at detunings and ,
respectively. Our interest, however, is in the arrivaltime
and angularfrequency operators,
t
J
=
_
dt t
E
J
(t)
E
J
(t), (3a)
J
=
_
d
2
A
J
()
A
J
(), (3b)
for J = S, I, when only one photonpair is emitted by
the source. Restricting these time and frequency oper
ators to the singlepair Hilbert space implies that they
measure the arrival times and frequency detunings of the
signal and idler photons. It also leads to the commuta
tion relation [
J
,
t
K
] = i
J
JK
[26], where
S
=
I
= 1,
making these operators conjugate observables analogous
to the quadrature components employed in CVQKD, and
justifying our translating CVQKDs covariancebased se
curity analysis [16, 17] to our protocol.
To exploit the connection to CVQKD, we dene an ob
servable vector
O = [
t
S
S
t
I
I
]
T
. For a singlepair
state, the mean value of
O is m =
+h.c.)/2, where
O
Om and h.c.
denotes Hermitian conjugate. The characteristic function
associated with the singlepair state is () = e
i
T
O
.
Given the covariance matrix , the Gaussian state with
() = e
i
T
m
T
/2
yields an mindependent upper
bound on Eves Holevo information [16, 17, 27] when the
SPDC source emits a singlepair state.
FIG. 1: (color online) Top panel: diagram for the Franson
interferometer. Bottom panel: diagram for the conjugate
Franson interferometer. PM: phase modulator; OFS: optical
frequency shifter; Disp+: positive dispersion element; Disp:
negative dispersion element. D: detector.
A direct, complete measurement of the TFCM is quite
challenging, so we will resort to indirect measurements
using a Franson interferometer and a conjugateFranson
interferometerthat provide useful partial information.
A Franson interferometer [28], shown in the top panel of
Fig. 1, consists of two unequal pathlength MachZehnder
interferometers, with the signal going through one and
the idler going through the other. The time delay T be
tween each MachZehnders long and short paths is much
greater than the correlation time
cor
, ruling out local
interference in the individual interferometers. It is also
greater than the FWHM detector timing jitter, T, so
that coincidences are only registered when both photons
3
go through the long or the short path. Each long path is
equipped with a phase modulator, imparting phase shifts
e
iS
and e
iI
to the signal and the idler respectively.
The following Lemma shows that Franson measurements,
augmented by dispersionbased frequency measurements,
bound the signalidler frequency correlations [26]:
Lemma 1: For a singlepair state let V
FI
(T) =
[P
CFI
(0)P
CFI
()]/[P
CFI
(0)+P
CFI
()], where P
CFI
(
S
+
I
) is Alice and Bobs coincidence probability, be the 0
fringe visibility when the Franson interferometer has de
lay T. Then the variance of the signalidler frequency
dierence satises
(
S
I
)
2
_
2[1 V
FI
(T)]
T
2
+
(
S
I
)
4
12
T
2
,
(4)
where
S
(
I
) is the random variable associated with
the measured signal (idler) angular frequency from the
conjugateFranson interferometer with its frequency
shifted arms disabled, i.e., when dispersion enables fre
quency correlations to be measured from arrivaltime co
incidences.
A conjugateFranson interferometer, shown in the bot
tom panel of Fig. 1, consists of two equal pathlength
MachZehnders with one arm of each containing an
electrooptic opticalfrequency shifter. To rule out local
interference, these devices shift the signal and idler fre
quencies by and , respectively, while phase mod
ulators (not shown) apply phase shifts e
iS
and e
iI
,
as was done in the Franson interferometer. The pos
itive and negative dispersion elements have coecients
2
satisfying
2
=
2 T
g
> T, where T
g
is the
duration of detectors coincidence gate [6]. They time
disperse the signal and idlers frequency components so
that two detectors suce to measure their frequency co
incidences [18, 26]. The following Lemma shows that
conjugateFranson measurements, augmented by arrival
time measurements, bound the signalidler arrivaltime
correlations [26]:
Lemma 2: For a singlepair state let V
CFI
() =
[P
CCFI
(0) P
CCFI
()]/[P
CCFI
(0) + P
CCFI
()], where
P
CCFI
(
S
+
I
) is Alice and Bobs coincidence probability,
be the 0 fringe visibility when the conjugateFranson
interferometer has frequency shift . Then the vari
ance of the signalidler arrivaltime dierence satises
t
S
t
I
)
2
_
2[1 V
CFI
()]
2
+
(
t
S
t
I
)
4
12
2
,
(5)
where
t
S
(
t
I
) is the random variable associated with the
measured signal (idler) arrival time from the Franson in
terferometer with its long arms disabled.
Lemmas 1 and 2 will be used below to bound Eves
Holevo information for a frame in which Alices source
emits a single photonpair. Because there is no security
assurance for multiplepair emissions, we follow the lead
of DVQKD by employing decoy states [8, 9] to deal with
this problem. In particular, Alice operates her SPDC
source at several dierent pump powers enabling Bob and
her to estimate the fraction, F, of their coincidences that
originated from singlepair emissions [7].
To put an upper bound on Eves Holevo information,
we start from the following points: (1) Symmetry dic
tates that only 10 TFCM elements need to be found.
Of these,
2
S
and
t
2
S
are immune to Eves attack
because Eve does not have access to Alices apparatus,
which contains the SPDC source. (2) Given the Fran
son and conjugateFransons fringe visibilities, making
t
J
K
= 0, for J, K = S, I, does not increase Eves
Holevo information [26]. (3) From Lemmas 1 and 2 we
can determine upper bounds on the excess noise factors
1+
(
S
I
)
2
/(
S0
I0
)
2
and 1+
t
(
t
S
t
I
)
2
/(
t
S0
t
I0
)
2
, where (
t
S0
t
I0
)
2
and (
S0
I0
)
2
are the sources variances as mea
sured by Alice during her sourcecharacterization phase.
Points (1)(3) specify a set, M, of physically allowed
TFCMs that preserve the Heisenberg uncertainty re
lations for the elements of
O which are implied by
[
J
,
t
K
] = i
J
JK
. For each TFCM M, the
Gaussian state () = e
T
/2
aords Eve the maxi
mum Holevo information [16, 17, 27]. Using
(A; E)
to denote that Holevo information, our partial informa
tion about gives us the upper bound
UB
t,
(A; E) =
sup
M
[
2 = Tg = 3.6 T; /2 = 5 GHz; 2 =
8 ln(2)
coh
> T > Tg > T cor.
[30] Alice and Bob use all frames in which they have coin
cidences. The Supplemental Material explains how they
deal with frames that contain multiple coincidences.
[31] D. Gottesman, H.K. Lo, N. L utkenhaus, and J. Preskill,
Quantum Inf. Comput. 4, 325360 (2004).
[32] T. Zhong and F. N. C. Wong, Phys. Rev. A 88,
020103(R) (2013).
Supplemental Material
QUASIMONOCHROMATIC SIGNAL AND IDLER FIELD OPERATORS
We have taken the positivefrequency eld operators
E
S
(t) and
E
I
(t) for the signal and idler outputs of Alices
spontaneous parametric downconverter to be quasimonochromatic, photonunits operators [13]. As such this gives
them the deltafunction commutator, [
E
J
(t),
E
K
(u)] =
JK
(t u), for J, K = S, I. Our security proof relies on
time and frequency operators whose own deltafunction commutator, proved in the next section, depends on the
quasimonochromatic conditions validity. The 200 GHz phasematching bandwidth assumed in the main texts system
example corresponds to 0.1% fractional bandwidth at the 1.55 m ber telecom wavelength. Thus we are justied in
assuming that our eld operators obey the quasimonochromatic condition.
PROOF OF [ J,
t
J
=
_
dt t
E
J
(t)
E
J
(t) (7a)
J
=
_
d
2
A
J
()
A
J
(), (7b)
where the eld operators are restricted to the Hilbert space spanned by the vacuum state and the singlephoton
timedomain states { t
J
: < t < }, or, equivalently, the vacuum state and the singlephoton frequencydomain
6
states { 
J
: < < } [4]. In this Hilbert space the eld operators reduce to
E
J
(t) = 0
JJ
t, (8)
and
A
J
() = 0
JJ
. (9)
With the preceding restricted expressions for the eld operators in time and frequency, we can easily derive the
commutation relation [
J
,
t
K
] = i
J
JK
for J, K = S, I. For J = K, the frequencytime commutator vanishes because
E
J
(t) commutes with
E
K
(t) and
E
K
(t) and hence so too does
E
J
(t) with
A
K
() and
A
K
(). For J = K = S we
have that
S
t
S
t
S
S
=
_
dt
_
d
2
t[(
S
t
S
)
SS
t (
S
t
S
)t
SS
] (10)
=
_
dt
_
d
2
t[e
it

SS
t e
it
t
SS
], (11)
where the second equality follows from

S
=
_
dt e
it
t
S
(12)
and
S
t
1
t
2
S
= (t
1
t
2
). (13)
Using Eqs. (11) and (13), we then obtain the timedomain matrix elements
S
t
1
[
S
,
t
S
]t
2
S
= (t
2
t
1
)
_
d
2
e
i(t1t2)
. (14)
Now, let f() be any squareintegrable function on < < that is continuous at = 0, and has Fourier
transform
F() =
_
d f()e
i
. (15)
We then have that
_
d
_
d
2
f()e
i
= i
_
d
2
dF()
d
= i
2
F()
+ i
_
d
2
F() = i
_
d
2
F() = if(0), (16)
where the rst equality is a Fouriertransform property, the second uses integration by parts, the third results from
f()s being squareintegrable, and the fourth by inverse Fourier transformation. Applying this result to Eq. (14)
yields
S
t
1
[
S
,
t
S
]t
2
S
= i(t
1
t
2
), (17)
which is equivalent to [
S
,
t
S
] = i, thus completing our proof for J = K = S. For J = K = I the proof follows the
same steps using

I
=
_
dt e
it
t
I
(18)
instead of Eq. (12).
7
PROOF OF LEMMA 1
The coincidence probability for our Franson interferometer when only a single photonpair has been emitted by
Alices source is [5]
P
CFI
(
S
,
I
) =
16
_
dt
_
t+Tg/2
tTg/2
du
__
S
(t) + e
iS
E
S
(t T)
_ _
I
(u) + e
iI
E
I
(u T)
_
_
E
S
(t) + e
iS
E
S
(t T)
_ _
E
I
(u) + e
iI
E
I
(u T)
__
, (19)
where accounts for propagation losses [6] and detection eciencies, and T
g
> T, with T being the detectors
fullwidth at halfmaximum (FWHM) timing jitter, is the duration of the coincidence gate. Because only a single
photonpair has been emitted, we can employ Eq. (8) and rewrite the coincidence probability as
P
CFI
(
S
,
I
) =
16
_
dt
_
t+Tg/2
tTg/2
du
_
t
SS
0 + e
iS
t T
SS
0
_
u
II
0 + e
iI
u T
II
0
_
0
SS
t + e
iS
0
SS
t T
_
0
II
u + e
iI
0
II
u T
_
. (20)
Multiplying out the bracketed expressions inside the averaging leads to a sum of sixteen terms, but only four of them
make nonzero contributions when T > T
g
> T
cor
. To see that this is so, let us rst take the undisturbed (no
eavesdropping) biphoton wave function [7]
SI
(t
S
, t
I
) =
e
(tS+tI)
2
/16
2
coh
(tStI)
2
/4
2
cor
iP(tS+tI )/2
2
coh
cor
. (21)
Averaging a term from Eq. (20) that contains t
A
SS
t
B
 u
A
II
u
B
 yields a result that contains
SI
(t
A
, u
A
)
SI
(t
B
, u
B
). Thus, unless t
A
u
A
 T
g
/2 and t
B
u
B
 T
g
/2, this term will make a negligible
contribution to P
CFI
. Indeed, the magnitude of each of these noncontributor terms is at least exp(T
2
/8
2
cor
)
times smaller than the terms we will retain. For our papers system example, which assumes T = 152.7 ps and
cor
= 0.937 ps, this attenuation factor is exp(3320). These numbers apply to detectors without timing jitter. With
timing jitter, the preceding attenuation factor becomes exp(T
2
ln(2)/2T
2
), which, because T = 30 ps in our
system example, equals exp(8.98). Now suppose there is eavesdropping. Then, unless Eves intrusion makes the
rootmeansquare arrivaltime dierence exceed the coincidence gate, such terms will still fail to contribute to the
coincidence probability. An Eve who makes that strong a disturbance will easily be detected and accounted for during
reconciliation, so we will neglect that possibility in what follows, as we evaluate the coincidence probability.
After eliminating the twelve noncontributors to P
CFI
, we get
P
CFI
(
S
,
I
) =
16
_
dt
_
t+Tg/2
tTg/2
du
__
t
S
u
II
u
S
t + e
i(S+I )
t
S
u
II
u T
S
t T
+ e
i(S+I)
t T
S
u T
II
u
S
t +t T
S
u T
II
u T
S
t T
__
. (22)
At this point the integration limits for u can be extended to < u < , because the integrand vanishes for
t u > T
g
/2 by an argument similar to what we just gave to go from Eq. (20) to Eq. (22). Thus, we can write
P
CFI
(
S
,
I
) =
16
_
dt
_
du
__
t
S
u
II
u
S
t + e
i(S+I)
t
S
u
II
u T
S
t T
+ e
i(S+I )
t T
S
u T
II
u
S
t +t T
S
u T
II
u T
S
t T
__
. (23)
=
16
_
dt
_
du
_
d
S
2
_
d
I
2
_
d
S
2
_
d
I
2
e
i[(S
S
)t(I
I
)u]
_
1 + e
i[(S+I)(
I
)T]
+ e
i[(S+I)(SI)T]
+ e
i(SI +
S
)T
_

S
S

I
I I
I

S
S
 (24)
=
8
_
d
S
2
_
d
I
2
_
1 + Re
_
e
i[(S+I )(SI)T]
__

S
S

I
II
I

S
S
 (25)
=
8
_
1 + Re
_
e
i(S+I )
_
e
i( S I)T
___
, (26)
8
where the second equality follows from Eqs. (12) and (18), and the last equality follows from the sources emitting
a single photonpair. Because the coincidence probability only depends on
S
+
I
, we shall use the notation
P
CFI
() in what follows.
The 0 fringe visibility of a Franson interferometer with delay T is dened as
V
FI
(T) =
P
CFI
(0) P
CFI
()
P
CFI
(0) + P
CFI
()
= Re
__
e
i( S I)T
__
= cos[(
S
I
)T]. (27)
The frequencydomain biphoton wave function associated with Eq. (21),
(
S
,
I
) =
e
2
+
2
cor
2
coh
_
/2
cor
coh
(28)
where
+
(
S
+
I
)/2 and
=
S
I
, makes
cos[(
S
I
)T] = e
( S I)
2
T
2
/2
(29)
1 (
S
I
)
2
T
2
/2 +(
S
I
)
2
2
T
4
/8 (30)
= 1 (
S
I
)
2
T
2
/2 +(
S
I
)
4
T
4
/24, (31)
with (
S
I
)
2
= 1/4
2
coh
and the last equality following from Gaussian moment factoring [8]. In the presence of
eavesdropping we use a threeterm Taylorseries expansion to show that
cos[(
S
I
)T] 1
(
S
I
)
2
T
2
2
+
(
S
I
)
4
T
4
24
. (32)
Note that (32) does not assume the biphoton has a Gaussian wave function, so it applies for any biphoton statepure
or mixedof the signal and idler detected by Alice and Bob. The third term in this inequality satises
(
S
I
)
4
T
4
/24 (
S
I
)
4
T
4
/24, (33)
where
S
and
I
are classical random variables obtained from frequency measurements at Alice and Bobs terminals
respectively, i.e., by disabling the frequencyshifted arms in their conjugate Franson interferometers and relying on
those interferometers dispersive elements to make frequency information manifest in the observed arrival times [9].
Using (33) in (32) we get
(
S
I
)
2
_
2[1 V
FI
(T)]
T
2
+
(
S
I
)
4
T
2
12
. (34)
Together with (
S
I
)
2
(
S
I
)
2
, (34) completes the proof of Lemma 1.
PROOF OF LEMMA 2
The coincidence probability for our conjugate Franson interferometer when only a single photonpair has been
emitted by Alices source is [10]
P
CCFI
(
S
,
I
) =
16
_
dt
_
t+Tg/2
tTg/2
du
_
d
S
2
_
d
I
2
_
d
S
2
_
d
I
2
__
A
S
(
S
) + e
iS
A
S
(
S
)
_
_
A
I
(
I
) + e
iI
A
I
(
I
)
_ _
A
S
(
S
) + e
iS
A
S
(
S
)
_
_
A
I
(
I
) + e
iI
A
I
(
I
)
__
e
i[2(
2
S
2
I
2
S
+
2
I
)/2(S
S
)t+(I
I
)u]
. (35)
Using Eq. (9), this expression becomes
P
CCFI
(
S
,
I
) =
16
_
dt
_
t+Tg/2
tTg/2
du
_
d
S
2
_
d
I
2
_
d
S
2
_
d
I
2
_

S
SS
0 + e
iS

S
SS
0
_

I
II
0 + e
iI

I
II
0
_
0
SS
S
 + e
iS
0
SS
S

_
0
II
I
 + e
iI
0
II
I

_
e
i[2(
2
S
2
I
2
S
+
2
I
)/2(S
S
)t+(I
I
)u]
. (36)
9
Multiplying out the bracketed expressions inside the averaging leads to a sum of sixteen terms, but only four of
them make nonzero contributions when > T
g
/2
2
3/
coh
. To show that this is so, we begin by rewriting
Eq. (36) in terms of the sum and dierence variables t
+
(t + u)/2, t
t u,
+
(
S
+
I
)/2,
S
I
,
+
(
S
+
I
)/2, and
I
, obtaining
P
CCFI
(
S
,
I
) =
16
_
dt
+
_
Tg/2
Tg/2
dt
_
d
+
2
_
d
2
_
d
+
2
_
d
2
[
+
+
/2
SS
0
+ e
iS

+
+
/2
SS
0
_

+
/2
II
0 + e
iI

+
/2
II
0
_
0
SS
+
+
/2 + e
iS
0
SS
+
+
/2 
_
0
II
/2 + e
iI
0
II
/2 
_
e
i[2(+
)(+
+
)t(
)t+]
. (37)
Next, we perform the t
, t
+
, and
2
_
d
+
2
_

+
+
/2
SS
0 + e
iS

+
+
/2
SS
0
_

+
/2
II
0 + e
iI

+
/2
I I
0
_
0
SS
+
+
/2 + e
iS
0
SS
+
+
/2 
_
0
II
/2 + e
iI
0
II
/2 
_
T
g
sin[(
+
+
)T
g
/2]
(
+
+
)T
g
/2
e
i2(+
+
)
. (38)
Because the phasematching bandwidth B
PM
greatly exceeds 1/T
g
, the stateaverage term in Eq. (38) is essentially
unchanged for (
+
+
+
)/2 excursions on the order of 10/T
g
. Thus Eq. (38) simplies to
P
CCFI
(
S
,
I
) =
16
_
d
2
_
d
2
_
d
2
_
 +
/2
SS
0 + e
iS
 +
/2
SS
0
_

/2
II
0 + e
iI

/2
II
0
_
0
SS
+
/2 + e
iS
0
SS
+
/2 
_
0
II
/2 + e
iI
0
II
/2 
_
T
g
sin(
T
g
/2)
T
g
/2
e
i2
, (39)
where
+
. Performing the
2
_
 +
/2
SS
0 + e
iS
 +
/2
SS
0
_

/2
II
0 + e
iI

/2
I I
0
_
0
SS
+
/2 + e
iS
0
SS
+
/2 
_
0
II
/2 + e
iI
0
II
/2 
_
. (40)
At this point we can quickly eliminate twelve terms from Eq. (40). In Eves absence, any term containing

A
SS
B
 
B
 will only contribute if 
A
A
 3/
coh
and 
B
B
 3/
coh
. Indeed, the mag
nitude of each of these noncontributor terms is at least exp(
2
2
coh
/2) times smaller than the terms we will
retain. For our papers system example, which assumes /2 = 5 GHz, this attenuation factor is exp(20) for
coh
= 0.20 ns (corresponding to T
f
= 16T) and exp(82) for
coh
= 0.41 ns (corresponding to T
f
= 32T). These
numbers apply to detectors without timing jitter. With timing jitter, the preceding attenuation factor becomes
exp(
2
2
2
ln(2)/2T
2
), which equals exp(8.98) for our
2
=
2 T
g
, T
g
= 108 ps , T = 30 ps system example.
10
It follows that the only terms which survive in P
CCFI
are as given below, where we have reverted to
S
,
I
notation,
P
CCFI
(
S
,
I
) =
16
_
d
S
2
_
S+Tg/22
STg/22
d
I
2
__

S
S

I
II
I

S
S
 + e
i(S+I)

S
S

I
I I
I

S
S

+ e
i(S+I)

S
S

I
I I
I

S
S
 +
S
S

I
II
I

S
S

__
. (41)
The limits in the
I
integral can be extended to <
S

I
II
I

S
S

__
(42)
=
8
_
d
S
2
_
d
I
2
_
dt
S
_
dt
I
_
1 + Re
_
e
i(S+I)

S
S

I
I I
t
I

S
t
S
e
i(StSItI)
__
(43)
=
8
_
dt
S
_
dt
I
_
1 + Re
_
e
i(S+I)
e
i(tStI )
t
S
S
t
I
II
t
I

S
t
S

__
(44)
=
8
_
1 + Re
_
e
i(S+I)
_
e
i(
tS
tI)
___
. (45)
Now suppose that there is eavesdropping. Any intrusion by Eve that degrades the frequency correlations to the point
that the suppressed terms do contribute to P
CCFI
will be detected by the Franson interferometer and accounted for via
Lemma 1, so we will complete our Lemma 2 proof using Eq. (45). Because the coincidence probability only depends
on
S
+
I
, we shall use the notation P
CCFI
() in what follows.
The conjugateFranson interferometers 0 fringe visibility is dened to be
V
CFI
() =
P
CCFI
(0) P
CCFI
()
P
CCFI
(0) + P
CCFI
()
= Re
__
e
i(
tS
tI )
__
= cos[(
t
S
t
I
)]. (46)
The timedomain biphoton wave function, Eq. (21), makes
cos[(
t
S
t
I
)] = e
(
tS
tI )
2
2
/2
(47)
1 (
t
S
t
I
)
2
2
/2 +(
t
S
t
I
)
2
4
/8 (48)
= 1 (
t
S
t
I
)
2
2
/2 +(
t
S
t
I
)
4
4
/24, (49)
with (
t
S
t
I
)
2
=
2
cor
and the last equality again following from Gaussian moment factoring. In the presence of
eavesdropping we use a threeterm Taylorseries expansion to show that
cos[(
t
S
t
I
)] 1 (
t
S
t
I
)
2
2
/2 +(
t
S
t
I
)
4
4
/24. (50)
As noted in Lemma 1, (50) does not assume the biphoton has a Gaussian wave function, so it applies for any biphoton
statepure or mixedof the signal and idler detected by Alice and Bob. The third term in this inequality satises
(
t
S
t
I
)
4
4
/24 (
t
S
t
I
)
4
4
/24, (51)
where
t
S
and
t
I
are classical random variables obtained from arrivaltime measurements at Alice and Bobs terminals
respectively, i.e., by disabling the long arms in their Franson interferometers [11]. Using (51) in (50) we get
t
S
t
I
)
2
_
2[1 V
CFI
()]
2
+
(
t
S
t
I
)
4
2
12
. (52)
Together with (
t
S
t
I
)
2
(
t
S
t
I
)
2
, (52) completes the proof of Lemma 2.
SECURITY CALCULATIONS
The timefrequency covariance matrix
The TFCM for the biphoton state from Eq. (21) is
0
=
_
0
SS
0
SI
0
IS
0
II
_
, (53)
11
where
0
SS
=
0
II
=
_
2
cor
/4 +
2
coh
0
0 1/4
2
cor
+ 1/16
2
coh
_
(54a)
0
SI
=
0
IS
=
_
2
cor
/4 +
2
coh
0
0 1/4
2
cor
1/16
2
coh
_
. (54b)
The rootmeansquare twophoton correlation time is given by
cor
=
_
2 ln(2)/(2B
PM
) in terms of the FWHM
phasematching bandwidth (in Hz). The rootmeansquare twophoton pulse duration is given by
coh
= T
f
/
_
8 ln(2)
in terms of our protocols frame durationwhich is taken to be the FWHM coherence timeand is set by choice of
the pump pulses duration. To achieve multiple secure bits per coincidence, we require
coh
T/
_
8 ln(2)
cor
.
Under this condition, we have
t
2
S0
=
t
2
I0
=
2
coh
, (
t
S0
t
I0
)
2
=
2
cor
,
2
S0
=
2
I0
= 1/4
2
cor
, and
(
S0
I0
)
2
= 1/4
2
coh
, where the subscript 0 denotes the initial state produced by the source. The Franson and
conjugateFranson interferometers allow us to upper bound the variances of Alice and Bobs arrivaltime and frequency
dierences, which we denote (
t
S
t
I
)
2
= (1+
t
)(
t
S0
t
I0
)
2
and (
S
I
)
2
= (1+
)(
S0
I0
)
2
,
where
t
and
and
t
will be bounded from the measured Franson and conjugateFransons 0
visibilities, plus the fourth moments of the arrivaltime and frequency dierences obtained, respectively, from
Franson and conjugateFranson count records with one arm disabled at Alice and Bobs terminals. For the theoretical
assessment of the securekey rate presented in the paper, we used assumed values for the 0 visibilities and the
following jitterlimited values for the fourth moments appearing in Lemmas 1 and 2:
(
S
I
)
4
= 3(T/2
_
ln(2)
2
)
4
, (55)
and
(
t
S
t
I
)
4
= 3(T/2
_
ln(2))
4
. (56)
Here, we have assumed that our detectors have statistically independent, identically distributed Gaussian timing
jitters whose FWHM T satises T
2
2
2
(
S
I
)
2
and T
2
(
t
S
t
I
)
2
.
Odiagonal elements in covariance submatrices
The odiagonal elements in Eq. (54) are all zero, because Alices source does not produce any timefrequency cross
correlations. However, Eves intrusion could result in a TFCM
=
_
SS
SI
IS
II
_
, (57)
whose submatrices have nonzero odiagonal elements. Inasmuch as the Franson and conjugateFranson interferome
ters do not probe those odiagonal elements, we now prove that the information they do providethrough Lemmas 1
and 2suces to upper bound Eves Holevo information.
We begin by introducing dimensionless time and frequency operators dened as follows
t
J
=
t
J
T
(58a)
J
=
J
T, (58b)
for J = S, I, where T
2
coh
cor
is a normalization time that symmetrizes these conjugate observables, i.e., for
Alices SPDC source we have that
t
2
J0
=
2
J0
. The biphoton wave function from Eq. (21) now becomes a
twomode squeezedvacuum state of the modes associated with the eective annihilation and creation operators
a
J
= (
t
J
i
J
J
)/
2 (59a)
J
= (
t
J
+ i
J
J
)/
2, (59b)
12
because [
J
,
t
K
] = i
J
JK
implies that [
a
J
,
K
] =
JK
. As a result, we can now apply security results of entanglement
based CVQKD to our TEEbased HDQKD protocol.
Eves arbitrary Gaussian attack can be decomposed into the following two steps: Step 1, she interacts her ancillary
state with the idler beamwhile it is en route from Alice to Bobin a manner that does not introduce any time
frequency odiagonal elements in Alice and Bobs TFCM. Step 2, she applies individual symplectic transformations
to the idler state and her ancillary state, a process which creates such timefrequency odiagonal elements [12].
Step 2 consists of a rotation followed by quadrature squeezing. Because it only involves local unitary operations, it
does not aect Eves Holevo information. Eves goal here is to minimize
2
(
I
)
2
, and thus maximize Alice
and Bobs 0 Fransoninterferometer visibility so that they will underestimate the information her interaction has
yielded [13]. More specically, Eves goal in Step 2 is to make
2
smaller than
2
diag
, the (
I
)
2
value when
she only employs Step 1, i.e., when Alice and Bobs TFCM has no odiagonal terms representing timefrequency
cross correlations.
To see that Eves eort in this regard is futile we proceed as follows, where, for notational simplicity, we have
assumed that mean values have been subtracted out. Let the eective idler annihilation operator after Step 1 be
b.
The eective idler annihilation operator after Step 2 is then
a
I
= e
i
cosh(r)
b e
i()
sinh(r)
, (60)
where is the phase used in the rotation, r is the squeezing parameter, and is the phase used in the squeezing
operation. We now nd that
I
= [cos() cosh(r) + cos( ) sinh(r)]
b
+ [sin() cosh(r) sin( ) sinh(r)]
t
b
, (61)
from which the meansquared frequency error is seen to obey
2
=
2
S
2 [cos() cosh(r) + cos( ) sinh(r)]
2
b
+ [sin() cosh(r) sin( ) sinh(r)]
2
t
2
b
, (62)
where we have used the fact that Eves Step 1 does not create any timefrequency cross correlations. Setting = 0,
r = 0, and = 0 in this expression eliminates Eves Step 2 and leads us to the benchmark value
2
diag
= (
b
)
2
, (63)
that she is trying to beat with her symplectic transformation. Without loss of generality, we can assume that
2
diag
2
S
, because violating this condition makes Eves presence extremely obvious to Alice and Bob.
To minimize
2
, we set its partial derivatives with respect to , r, and to zero. For the partial derivative with
respect to we have
(
2
)
2
b
t
2
b
), (64)
which vanishes if
[sin() cosh(r) sin( ) sinh(r)] = 0 (C.1)
or
b
= [cos() cosh(r) + cos( ) sinh(r)] (
2
b
t
2
b
). (C.2)
Condition (C.1), combined with the fact that Eves Step 1 does not create any timefrequency cross correlations,
implies that the TFCM will not have any timefrequency odiagonal terms. Hence we will only carry forward
Condition (C.2) in trying to see if Eves Step 2 helps her.
For the partial derivative with respect to we have
(
2
)
= 2 sin( ) sinh(r)
b
2 [cos() cosh(r) + cos( ) sinh(r)] [sin( ) sinh(r)]
2
b
t
2
b
. (65)
13
If the partial derivative vanishes because (C.2) is satised, we need
sin() = 0 (C.2.1)
or
r = 0 (C.2.2)
to make the partial derivative vanish.
For the partial derivative with respect to r we have
(
2
)
r
= 2 [cos() sinh(r) + cos( ) cosh(r)]
2
b
t
2
b
. (66)
If the and partial derivatives vanish because Conditions (C.2) and (C.2.1) are satised, then the r partial derivative
equals zero when sinh(r) = cosh(r), where the plus sign applies for cos() = 1 and the minus sign for cos() = 1.
We then nd that
2
=
2
S
2
diag
, making Eves presence very detectable if she elects to perform Step 2 with
these parameter values.
At this point, the only remaining case that might provide Eve some utility from her Step 2 is when Conditions (C.2)
and (C.2.2) are satised and the r partial derivative vanishes. Here, Step 2 corresponds to rotation without squeezing,
in which case we need cos() = 0 to make the r partial derivative vanish, yielding
2
=
2
S
cos
2
()(
2
b
t
2
b
) +
t
2
b
. (67)
If
2
b
=
t
2
b
, we get
2
2
diag
, so Eve shouldnt use a symplectic transformation after her Step 1. If
2
b
>
t
2
b
,
then her
2
is minimized by choosing cos
2
() = 1, and Eq. (61) shows that no odiagonal TFCM elements arise
from timefrequency cross correlations. If
2
b
<
t
2
b
, then Eves
2
is minimized by choosing cos() = 0, and we get
2
=
2
S
+
t
2
b
2
diag
, making her presence very detectable if she elects to perform Step 2 with these parameter
values.
To summarize, we have shown that for any value of Eves Holevo information, the minimum value of
2
can be
achieved without introducing any odiagonal elements into the TFCM submatrices [13]. Hence Lemmas 1 and 2
suce to bound the information that Eve obtains from an optimized collective attack.
Alice and Bobs Shannon Information
Alice and Bob postselect frames in which each of them had at least one detection, which may be either a photon
detection or a dark count. A fraction q of these postselected frames are reconciled to generate key, while the rest
are used for the Franson and conjugateFranson measurements needed to estimate
t
and
n=0
p
s
(n) [1 (1
A
)
n
(1 p
d
)] [1 (1
B
P
)
n
(1 p
d
)] , (68)
where: p
s
(n) =
n
e
/n! gives the probability that Alices source emits an npair state in terms of the average number,
, of pairs emitted per frame [14];
A
and
B
are Alice and Bobs detection eciencies;
P
is the transmissivity of the
berpropagation link from Alices source to Bob terminal; and p
d
is the probability of one darkcount occurring in a
frame. Note that we are neglecting the possibility of multiple dark counts occurring in a frame, because the product
of the frame duration and the darkcount rate (for typical SNSPDs) is much smaller than one.
When either Alice or Bob register more than one detection in a frame, they discard those data and randomly
choose an arrival time from a Gaussian distribution whose variance equals their terminals TFCM entry for arrival
time plus the timingjitter variance [15]. It follows that there are ve possibilities for Alice and Bobs joint arrivaltime
distribution, from which their Shannon information can be found.
14
1. Their arrival times are jointly Gaussian random variables with a covariance matrix that is a submatrix of the
TFCM augmented to account for their detectors timing jitters. This case is a postselected frame in which
Alices source emitted one photonpair and neither Alice nor Bob had a dark count.
2. Their arrival times are independent Gaussian random variables with variances equal to the values from the
TFCM plus the variance of their detectors timing jitters. This case is a postselected frame in which one of two
situations occurred: (1) Alices source emitted multiple photonpairs and both Alice and Bob registered at least
one photon detection; or (2) Alices source emitted one photonpair and both Alice and Bob registered photon
detections with at least one of them also having a dark count. (Strictly speaking, there could be some correlation
between Alice and Bobs arrival times in this case. By neglecting such a possibility, we are underestimating its
contribution to their Shannon information.)
3. Alices arrival time is a Gaussian random variable with variance equal to the value from the TFCM plus the
variance of her detectors timing jitter, and Bobs is uniformly distributed over the frame. This case is a
postselected frame in which Alice registered at least one photon detection and Bob had a dark count without a
photon detection.
4. Alices arrival time is uniformly distributed over the frame, and Bobs is a Gaussian random variable with
variance equal to the value from the TFCM plus the variance of his detectors timing jitter. This case is a
postselected frame in which Alice had a dark count without a photon detection and Bob registered at least one
photon detection.
5. Both Alices and Bobs arrival times are uniformly distributed over the frame. This case is a postselected frame
in which Alice and Bob both had dark counts and neither had a photon detection.
Given that a particular frame has been postselected, the conditional occurrence probabilities for the preceding ve
events are
P
1
= p
s
(1)
A
P
(1 p
d
)
2
/p
r
(69a)
P
2
=
n=2
p
s
(n) [1 (1
A
)
n
] [1 (1
B
P
)
n
] /p
r
+ p
s
(1)
A
P
(2p
d
p
2
d
)/p
r
(69b)
P
3
=
n=1
p
s
(n) [1 (1
A
)
n
] [p
d
(1
B
P
)
n
] /p
r
(69c)
P
4
=
n=1
p
s
(n) [p
d
(1
A
)
n
] [1 (1
B
P
)
n
] /p
r
(69d)
P
5
=
n=0
p
s
(n)p
2
d
(1
A
)
n
(1
B
P
)
n
/p
r
. (69e)
Alice and Bobs Shannon information is given by
I(A; B) =
_
dt
A
dt
B
p
TA,TB
(t
A
, t
B
) log
2
_
p
TA,TB
(t
A
, t
B
)
p
TA
(t
A
)p
TB
(t
B
)
_
, (70)
for which we need the joint probability density function, p
TA,TB
(t
A
, t
B
), for their measured arrival times, T
A
and T
B
,
from which the marginal densities, p
TA
(t
A
) and p
TB
(t
B
), are easily obtained. The mean values of T
A
and T
B
are
invariant to which of the preceding ve postselection events has occurred. Thus they do not aect Alice and Bobs
Shannon information, and so we will set them to zero.
The joint density function we need can be found from
p
TA,TB
(t
A
, t
B
) =
5
i=1
P
i
p
TA,TBi
( t
A
, t
B
 i ), (71)
where p
TA,TBi
( t
A
, t
B
 i ) is the joint probability density for T
A
and T
B
given that event i has occurred. The condi
tional probability densities for events 2 through 5 are easily found, because T
A
and T
B
are statistically independent
15
given that one of these events has occurred. We have that
p
TA,TB2
( t
A
, t
B
 2 ) = p
G
(t
A
;
2
A
) p
G
(t
B
;
2
B
) (72a)
p
TA,TB3
( t
A
, t
B
 3 ) = p
G
(t
A
;
2
A
) p
U
(t
B
; T
f
) (72b)
p
TA,TB4
( t
A
, t
B
 4 ) = p
U
(t
A
; T
f
) p
G
(t
B
;
2
B
) (72c)
p
TA,TB2
( t
A
, t
B
 5 ) = p
U
(t
A
; T
f
) p
U
(t
B
; T
f
), (72d)
where p
G
(t;
2
) is a Gaussian probability density with zero mean and variance
2
, p
U
(t; T
f
) is a uniform probability
density over the interval of [T
f
/2, T
f
/2], and
2
A
=
t
2
S
+ (T/2.35)
2
(73a)
2
B
=
t
2
I
+ (T/2.35)
2
. (73b)
When event 1 has occurred, T
A
and T
B
are jointlyGaussian random variables with zero means and covariance matrix
=
_
2
A
t
S
t
I
t
S
t
I
2
B
_
. (74)
Eves Holevo information
Here we describe how Lemmas 1 and 2 permit us to place an upper bound on Eves Holevo information. Alice and
Bobs TFCM has the form given in Eq. (57), with
SS
=
0
SS
(75a)
SI
=
IS
=
_
1
t
0
0 1
0
SI
(75b)
II
=
_
1 +
t
0
0 1 +
0
II
, (75c)
where {
t
,
} and {
t
,
}. Nevertheless, knowing
t
and
(A; E) = S(
E
)
_
dt p
TA
(t
A
)S(
ETA=tA
), (76)
where S( ) = Tr[ log
2
( )] is the von Neumann entropy of the state . Because Alice, Bob, and Eves joint quantum
state is pure, we have S(
E
) = S(
AB
). Conditioned on Alices measurement, the quantum state shared by Bob and
Eve is also pure, so that S(
ETA=tA
) = S(
BTA=tA
). Furthermore, because all these states are Gaussian, the von
Neumann entropy of Bob and Eves conditional quantum state is independent of Alices measurement result. Thus,
we can drop the integral in Eq. (76) and get
(A; E) = S(
AB
) S(
BTA
). (77)
16
To evaluate
t
2
S
2
S
(78a)
I
2
=
t
2
I
2
I
(78b)
I
3
=
t
S
t
I
S
I
(78c)
I
4
= (
t
2
S
t
2
I
t
S
t
I
2
)(
2
S
2
I
S
I
2
) (78d)
d
=
1
2
_
I
1
+ I
2
+ 2I
3
_
(I
1
+ I
2
+ 2I
3
)
2
4I
4
. (78e)
We then have that S(
AB
) = f(d
+
) + f(d
), where
f(d) = (d + 1/2) log
2
(d + 1/2) (d 1/2) log
2
(d 1/2). (79)
and
S(
Bt
) = f
__
det[
ITA
]
_
, (80)
where Bobs conditional covariance matrix is
ITA
=
_
t
2
I
t
S
t
I
2
/
t
2
S
0
0
2
I
_
. (81)
Our upper bound on Eves Holevo information is now found from
UB
t,
(A; E) = sup
M
{
P
)(1 p
d
)] /p
r
. (83)
The errorcorrecting code used during reconciliation to establish n
R
shared random bits between Alice and Bob
employs, on average, n
ECC
syndrome bits, where
n
R
= I(A; B) + n
ECC
, (84)
with 0 < 1 being the codes reconciliation eciency [16]. In total, therefore, Eve will have captured at most
(1 F)n
R
+ n
ECC
+ F
UB
t,
(A; E) bits of information per postselected frame. The securekey rate, in bits per
postselected frame, is the dierence between n
R
and Eves total information, hence it satises
I(A; B) I(A; B) (1 F)n
R
F
UB
t,
(A; E). (85)
When all postselected frames originated from emissions of one photonpair, i.e., F = 1, we recover CVQKDs secure
key rate bound, I(A; B) I(A; B)
UB
t,
(A; E), showing that, as expected, the emission of multiple photonpairs
reduces the securekey rate of timeenergy entanglement based HDQKD. The securekey rate in bits per second for our
timeenergy entanglement based HDQKD protocol is the product of the frame postselection rate and the securekey
rate in bits per postselected frame, viz.,
SKR
qp
r
3T
f
_
I(A; B) (1 F)n
R
F
UB
t,
(A; E)
, (86)
where we have accounted for frames occurring once every 3T
f
seconds.
tS
tI)
2
.
[11] It would be more ecient to eliminate those interferometers beam splitters as well as their long arms.
[12] A. Serani, F. Illuminati and S. De Siena, J. Phys. B: At. Mol. Opt. Phys. 37, L21L28 (2004).
[13] Eve could also aim to use odiagonal elements to minimize (
tS
tI)
2
to maximize Alice and Bobs 0 conjugateFranson
visibility. We will prove Eve derives no benet from minimizing
2
with her symplectic transformation. A similar argument
will prove that the same is true if she tries, instead, to minimize
t
2
(
tS
tI)
2
with that transformation. Because we
will consider security when only a Franson interferometer is employedas well as when both interferometers are usedwe
focus our attention on the case of
2
minimization.
[14] We are using the Poisson distribution here because it is an excellent approximation to the exact statistics when the product
of the pump pulses ns duration and the SPDC crystals THz phasematching bandwidth is much greater than one.
[15] This procedure may not be optimal, but it enables us to more easily calculate Alice and Bobs Shannon information.
[16] Our reconciliation procedure allows Alice and Bob to share an arbitrarily chosen number of bits, nR, as is the case in
CVQKD. However, all such bits in excess of I(A; B) are obtained via public communication through the errorcorrection
code they employ. Consequently, Eve is able to capture nECC = nR I(A; B) bits from that publicchannel reconciliation
procedure.
Mult mai mult decât documente.
Descoperiți tot ce are Scribd de oferit, inclusiv cărți și cărți audio de la editori majori.
Anulați oricând.