A Estimation procedure

# Passive decoy state quantum key distribution with practical light sources

## Abstract

Decoy states have been proven to be a very useful method for significantly enhancing the performance of quantum key distribution systems with practical light sources. While active modulation of the intensity of the laser pulses is an effective way of preparing decoy states in principle, in practice passive preparation might be desirable in some scenarios. Typical passive schemes involve parametric down-conversion. More recently, it has been shown that phase randomized weak coherent pulses (WCP) can also be used for the same purpose [M. Curty et al., Opt. Lett. 34, 3238 (2009).] This proposal requires only linear optics together with a simple threshold photon detector, which shows the practical feasibility of the method. Most importantly, the resulting secret key rate is comparable to the one delivered by an active decoy state setup with an infinite number of decoy settings. In this paper we extend these results, now showing specifically the analysis for other practical scenarios with different light sources and photo-detectors. In particular, we consider sources emitting thermal states, phase randomized WCP, and strong coherent light in combination with several types of photo-detectors, like, for instance, threshold photon detectors, photon number resolving detectors, and classical photo-detectors. Our analysis includes as well the effect that detection inefficiencies and noise in the form of dark counts shown by current threshold detectors might have on the final secret ket rate. Moreover, we provide estimations on the effects that statistical fluctuations due to a finite data size can have in practical implementations.

## I Introduction

Quantum key distribution (QKD) is the first quantum information task that reaches the commercial market to offer efficient and user-friendly cryptographic systems providing an unprecedented level of security (1). It allows two distant parties (typically called Alice and Bob) to establish a secure secret key despite the computational and technological power of an eavesdropper (Eve), who interferes with the signals (2). This secret key is the essential ingredient of the one-time-pad or Vernam cipher (3), the only known encryption method that can deliver information-theoretic secure communications.

Practical implementations of QKD are usually based on the transmission of phase randomized weak coherent pulses (WCP) with typical average photon number of or higher (4). These states can be easily prepared using only standard semiconductor lasers and calibrated attenuators. The main drawback of these systems, however, arises from the fact that some signals may contain more than one photon prepared in the same quantum state. When this effect is combined with the considerable attenuation introduced by the quantum channel (about dB/km), it opens an important security loophole. Eve can perform, for instance, the so-called Photon Number Splitting attack on the multi-photon pulses (5). This attack provides her with full information about the part of the key generated with the multi-photon signals, without causing any disturbance in the signal polarization. As a result, it turns out that the standard BB84 protocol (6) with phase randomized WCP can deliver a key generation rate of order , where denotes the transmission efficiency of the quantum channel (7); (8). This poor performance contrasts with the one expected from a QKD scheme using a single photon source, where the key generation rate scales linearly with .

A significant improvement of the achievable secret key rate can be obtained if the original hardware is slightly modified. For instance, one can use the so-called decoy state method (9); (10); (11); (12), which can basically reach the performance of single photon sources. The essential idea behind decoy state QKD with phase randomized WCP is quite simple: Alice varies, independently and randomly, the mean photon number of each signal state she sends to Bob by employing different intensity settings. This is typically realized by means of a variable optical attenuator (VOA) together with a random number generator. Eve does not know a priori the mean photon number of each signal state sent by Alice. This means that her eavesdropping strategy can only depend on the actual photon number of these signals, but not on the particular intensity setting used to generate them. From the measurement results corresponding to different intensity settings, the legitimate users can obtain a better estimation of the behavior of the quantum channel. This fact translates into an enhancement of the resulting secret key rate. The decoy state technique has been successfully implemented in several recent experiments (13), which show the practical feasibility of this method.

While active modulation of the intensity of the pulses suffices to perform decoy state QKD in principle, in practice passive preparation might be desirable in some scenarios. For instance, in those experimental setups operating at high transmission rates. Passive schemes might also be more resistant to side channel attacks than active systems. For example, if the VOA which changes the intensity of Alice’s pulses is not properly designed, it may happen that some physical parameters of the pulses emitted by the sender depend on the particular setting selected. This fact could open a security loophole in the active schemes.

Known passive schemes rely typically on the use of a parametric down-conversion (PDC) source together with a photon detector (14); (15); (16). The main idea behind these proposals comes from the photon number correlations that exist between the two output modes of a PDC source. By measuring the photon number distribution of one output mode it is possible to infer the photon number statistics of the other mode. In particular, Ref. (14) considers the case where Alice measures one of the output modes by means of a time multiplexed detector (TMD) which provides photon number resolution capabilities (17); Ref. (15) analyzes the scenario where the detector used by Alice is just a simple threshold detector, while the authors of Ref. (16) generalize the ideas introduced by Mauerer et al. in Ref. (14) to QKD setups using triggered PDC sources. All these schemes nearly reach the performance of a single photon source.

More recently, it has been shown that phase randomized WCP can also be used for the same purpose (18). That is, one does not need a non-linear optics network preparing entangled states. The crucial requirement of a passive decoy state setup is to obtain correlations between the photon number statistics of different signals; hence it is sufficient that these correlations are classical. The main contribution of Ref. (18) is rather simple: When two phase randomized coherent states interfere at a beam splitter (BS), the photon number statistics of the outcome signals are classically correlated. This effect contrasts with the one expected from the interference of two pure coherent states with fixed phase relation at a BS. In this last case, it is well known that the photon number statistics of the outcome signals is just the product of two Poissonian distributions. Now the idea is similar to that of Refs. (14); (15); (16): By measuring one of the two outcome signals of the BS, the conditional photon number distribution of the other signal varies depending on the result obtained (18). In the asymptotic limit of an infinite long experiment, it turns out that the secret key rate provided by such a passive scheme is similar to the one delivered by an active decoy state setup with infinite decoy settings (18). A similar result can also be obtained when Alice uses heralded single-photon sources showing non-Poissonian photon number statistics (19).

In this paper we extend the results presented in Ref. (18), now showing specifically the analysis for other practical scenarios with different light sources and photo-detectors. In particular, we consider sources emitting thermal states and phase randomized WCP in combination with threshold detectors and photon number resolving (PNR) detectors. In the case of threshold detectors, we include as well the effect that detection inefficiencies and dark counts present in current measurement devices might have on the final secret ket rate. For simplicity, these measurement imperfections were not considered in Ref. (18). On the other hand, PNR detectors allows us to obtain ultimate lower bounds on the maximal performance that can be expected at all from this kind of passive setups. We also present a passive scheme that employs strong coherent light and does not require the use of single photon detectors, but it can operate with a simpler classical photo-detector. This fact makes this setup specially interesting from an experimental point of view. Finally, we provide an estimation on the effects that statistical fluctuations due to a finite data size can have in practical implementations.

The paper is organized as follows. In Sec. II we review very briefly the concept of decoy state QKD. Next, in Sec. III we present a simple model to characterize the behavior of a typical quantum channel. This model will be relevant later on, when we evaluate the performance of the different passive schemes that we present in the following sections. Our starting point is the basic passive decoy state setup introduced in Ref. (18). This scheme is explained very briefly in Sec. IV. Then, in Sec. V we analyze its security when Alice uses a source of thermal light. Sec. VI and Sec. VII consider the case where Alice employs a source of coherent light. First, Sec. VI investigates the scenario where the states prepared by Alice are phase randomized WCP. Then, Sec. VII presents a passive decoy state scheme that uses strong coherent light. In Sec. VIII we discuss the effects of statistical fluctuations. Finally, Sec. IX concludes the paper with a summary.

## Ii Decoy state QKD

In decoy state QKD Alice prepares mixtures of Fock states with different photon number statistics and sends these states to Bob (9); (10); (11); (12). The photon number distribution of each signal state is chosen, independently and at random, from a set of possible predetermined settings. Let denote the conditional probability that a signal state prepared by Alice contains photons given that she selected setting , with . For instance, if Alice employs a source of phase randomized WCP then , and she varies the mean photon number (intensity) of each signal. Assuming that Alice has choosen setting , such states can be described as

 ρl=∞∑n=0pln|n⟩⟨n|, (1)

where denote Fock states with photons.

The gain corresponding to setting , i.e., the probability that Bob obtains a click in his measurement apparatus when Alice sends him a signal state prepared with setting , can be written as

 Ql=∞∑n=0plnYn, (2)

where denotes the yield of an -photon signal, i.e., the conditional probability of a detection event on Bob’s side given that Alice transmitted an -photon state. Similarly, the quantum bit error rate (QBER) associated to setting , that we shall denote as , is given by

 QlEl=∞∑n=0plnYnen, (3)

with representing the error rate of an -photon signal.

Now the main idea of decoy state QKD is very simple. From the observed data and , together with the knowledge of the photon number distributions , Alice and Bob can estimate the value of the unknown parameters and just by solving the set of linear equations given by Eqs. (2)-(3). For instance, in the general scenario where Alice employs an infinite number of possible decoy settings then she can estimate any finite number of parameters and with arbitrary precision. On the other hand, if Alice and Bob are only interested in the value of a few probabilities (typically , , and ), then they can estimate them by means of only a few different decoy settings (10); (11); (12).

In this paper we shall consider that Alice and Bob treat each decoy setting separately, and they distill secret key from all of them. We use the security analysis presented in Ref. (10), which combines the results provided by Gottesman-Lo-Lütkenhaus-Preskill (GLLP) in Ref. (8) (see also Ref. (20)) with the decoy state method. Specifically, the secret key rate formula can be written as

 R≥m∑l=0max{Rl,0}, (4)

where satisfies

 Rl≥q{−Qlf(El)H(El)+pl1Y1[1−H(e1)]+pl0Y0}. (5)

The parameter is the efficiency of the protocol ( for the standard BB84 protocol (6), and for its efficient version (21)); is the efficiency of the error correction protocol as a function of the error rate (22), typically with Shannon limit ; denotes the single photon error rate; is the binary Shannon entropy function.

To apply the secret key rate formula given by Eq. (5) one needs to solve Eqs. (2)-(3) in order to estimate the quantities , , and . For that, we shall use the procedure proposed in Ref. (12). This method requires that the probabilities satisfy certain conditions. It is important to emphasize, however, that the estimation technique presented in Ref. (12) only constitutes a possible example of a finite setting estimation procedure and no optimality statement is given. In principle, many other estimation methods are also available for this purpose, like, for instance, linear programming tools (23), which might result in a sharper, or for the purpose of QKD better, bounds on the considered probabilities.

## Iii Channel model

In this section we present a simple model to describe the behavior of a typical quantum channel. This model will be relevant later on, when we evaluate the performance of the passive decoy state setups that we present in the following sections. In particular, we shall consider the channel model used in Refs. (10); (12). This model reproduces a normal behavior of a quantum channel, i.e., in the absence of eavesdropping. Note, however, that the results presented in this paper can also be applied to any other quantum channel, as they only depend on the observed gains and error rates .

### iii.1 Yield

There are two main factors that contribute to the yield of an -photon signal: The background rate , and the signal states sent by Alice. Usually is, to a good approximation, independent of the signal detection. This parameter depends mainly on the dark count rate of Bob’s detection apparatus, together with other background contributions like, for instance, stray light coming from timing pulses which are not completely filtered out in reception. In the scenario considered, the yields can be expressed as (10); (12)

 Yn=1−(1−Y0)(1−ηsys)n, (6)

where represents the overall transmittance of the system. This quantity can be written as

 ηsys=ηchannelηBob, (7)

where is the transmittance of the quantum channel, and denotes the overall transmittance of Bob’s detection apparatus. That is, includes the transmittance of any optical component within Bob’s measurement device and the detector efficiency. The parameter can be related with a transmission distance measured in km for the given QKD scheme as

 ηchannel=10−αd10, (8)

where represents the loss coefficient of the channel (e.g., an optical fiber) measured in dB/km.

### iii.2 Quantum bit error rate

The -photon error rate is given by (10); (12)

 en=Y0e0+(Yn−Y0)edYn, (9)

where is the probability that a signal hits the wrong detector on Bob’s side due to the misalignment in the quantum channel and in his detection setup. For simplicity, here we assume that is a constant independent of the distance. Moreover, from now on we shall consider that the background is random, i.e., .

## Iv Passive decoy state QKD setup

The basic setup is rather simple (18). It is illustrated in Fig. 1. Suppose two Fock diagonal states

 ρ = ∞∑n=0pn|n⟩⟨n|, σ = ∞∑n=0rn|n⟩⟨n|, (10)

interfere at a BS of transmittance t.

If the probabilities and are properly selected, then it turns out that the photon number distributions of the two outcome signals can be classically correlated. By measuring the signal state in mode , therefore, the conditional photon number statistics of the signal state in mode vary depending on the result obtained.

In the following sections we analyze the setup represented in Fig. 1 for different light sources and photo-detectors. We start by considering a simple source of thermal states. Afterwards, we investigate more practical sources of coherent light.

## V Thermal light

Suppose that the signal state which appears in Fig. 1 is a thermal state of mean photon number . Such state can be written as

 ρ=11+μ∞∑n=0(μ1+μ)n|n⟩⟨n|, (11)

and let be a vacuum state. In this scenario, the joint probability of having photons in output mode and photons in output mode (see Fig. 1) has the form

 pn,m=11+μ(n+mm)(μ1+μ)n+mtn(1−t)m. (12)

That is, depending on the result of Alice’s measurement in mode , the conditional photon number distribution of the signals in mode varies.

In particular, we have that whenever Alice ignores the result of her measurement, the total probability of finding photons in mode can be expressed as

 ptn=∞∑m=0pn,m=11+μt(μt1+μt)n. (13)

Next, we consider the case where Alice uses a threshold detector to measure mode .

### v.1 Threshold detector

Such a detector can be characterized by a positive operator value measure (POVM) which contains two elements, and , given by (24)

 Fvac = (1−ϵ)∞∑n=0(1−ηd)n|n⟩⟨n|, Fclick = \openone−Fvac. (14)

The parameter denotes the detection efficiency of the detector, and represents its probability of having a dark count. Eq. (V.1) assumes that is, to a good approximation, independent of the incoming signals. The outcome of corresponds to “no click” in the detector, while the operator gives precisely one detection “click”, which means at least one photon is detected.

The joint probability for seeing photons in mode and no click in the threshold detector, which we shall denote as , has the form

 p¯cn=(1−ϵ)∞∑m=0(1−ηd)mpn,m=(1−ϵ)r(μtr)n, (15)

with the parameter given by

 r=1+μ[t+(1−t)ηd]. (16)

If the detector produces a click, the joint probability of finding photons in mode is given by

 pcn=ptn−p¯cn. (17)

Figure 2 shows the conditional photon number statistics of the outcome signal in mode depending on the result of the threshold detector (click and not click): and , with

 Nth=∞∑n=0p¯cn=1−ϵ1+μηd(1−t). (18)

### v.2 Lower bound on the secret key rate

We consider that Alice and Bob distill secret key both from click and no click events. The calculations to estimate the yields and , together with the single photon error rate , are included in Appendix A.

For simulation purposes we use the channel model described in Sec. III. After substituting Eqs. (6)-(9) into the gain and QBER formulas we obtain that the parameters , , , and can be written as

 Q¯c = Nth−(1−ϵ)(1−Y0)r−(1−ηsys)μt, Q¯cE¯c = (e0−ed)Y0Nth+edQ¯c, Qt = Y0+μtηsys1+μtηsys, QtEt = (e0−ed)Y0+edQt, (19)

where and .

The resulting lower bound on the secret key rate is illustrated in Fig. 3 (dashed line).

We employ the experimental parameters reported by Gobby et al. in Ref. (25): , , dB/km, and Bob’s detection efficiency . We further assume that , and . These data are used as well for simulation purposes in the following sections. We study two different scenarios: (A) A perfect threshold detector, i.e., and , and (B) and (25). In both cases we find that the values of the mean photon number and the transmittance which maximize the secret key rate formula are quite similar and almost constant with the distance. In particular, is quite strong (around in the simulation), while is quite weak (around ). This result is not surprising. When and , Alice’s threshold detector produces a click most of the times. Then, in the few occasions where Alice actually does not see a click in her measurement device, she can be quite confident that the signal state that goes to Bob is quite weak. Note that in this scenario the conditional photon number statistics satisfy and . Similarly to the one weak decoy state protocol proposed in Ref. (12), this fact allows Alice and Bob to obtain an accurate estimation of and , which results into an enhancement of the achievable secret key rate and distance. The cutoff point where the secret key rate drops down to zero is km.

One can improve the resulting secret key rate further by using a passive scheme with more intensity settings. For instance, Alice may employ a PNR detector instead of a threshold detector, or she could use several threshold detectors in combination with beam splitters. In this context, see also Ref. (16). Figure 3 illustrates also this last scenario, for the case where Alice uses a PNR detector (solid line). As expected, it turns out that now the legitimate users can estimate the actual value of the relevant parameters , , and with arbitrary precision (see Appendix B.1). The cutoff point where the secret key rate drops down to zero is km. This result shows that the performance of the passive setup represented in Fig. 1 with a threshold detector is already close to the best performance that can be achieved at all with such an scheme and the security analysis provided in Refs. (8); (20).

## Vi Weak coherent light

Suppose now that the signal states and which appear in Fig. 1 are two phase randomized WCP emitted by a pulsed laser source. That is,

 ρ = e−μ1∞∑n=0μn1n!|n⟩⟨n|, σ = e−μ2∞∑n=0μn2n!|n⟩⟨n|, (20)

with and denoting, respectively, the mean photon number of the two signals. In this scenario, the joint probability of having photons in output mode and photons in output mode can be written as (18)

 pn,m=υn+me−υn!m!12π∫2π0γn(1−γ)mdθ, (21)

where the parameters , , and , are given by

 υ = μ1+μ2, γ = μ1t+μ2(1−t)+ξcosθυ, ξ = 2√μ1μ2(1−t)t. (22)

This result differs from the one expected from the interference of two pure coherent states with fixed phase relation, and , at a BS of transmittance . In this last case, is just the product of two Poissonian distributions. Whenever Alice ignores the result of her measurement in mode , then the probability of finding photons in mode can be expressed as

 ptn=∞∑m=0pn,m=υnn!12π∫2π0γne−υγdθ, (23)

which turns out to be a non-Poissonian probability distribution (18). Let us now consider the case where Alice uses a threshold detector to measure output mode .

### vi.1 Threshold detector

The analysis is completely analogous to the one presented in Sec. V.1. In particular, the joint probability for seeing photons in mode and no click in the threshold detector has now the form

 p¯cn = (1−ϵ)∞∑m=0(1−ηd)mpn,m (24) = (1−ϵ)υne−ηdυn!12π∫2π0γne−(1−ηd)υγdθ.

On the other hand, if the detector produces a click, the joint probability of finding photons in mode is given by Eq. (17). Figure 4 (Cases A and B) shows the conditional photon number statistics of the outcome signal in mode depending on the result of the detector (click and no click): and , with

 Nw=∞∑n=0p¯cn=(1−ϵ)e−ηd[μ1(1−t)+μ2t]I0,ηdξ, (25)

and where represents the modified Bessel function of the first kind (26). This function is defined as (26)

 Iq,z=12πi∮e(z/2)(t+1/t)t−q−1dt. (26)

Figure 4 includes as well a comparison between and a Poissonian distribution of the same mean photon number (Cases C and D). Both distributions, and , are also non-Poissonian.

### vi.2 Lower bound on the secret key rate

To apply the secret key rate formula given by Eq. (5), with , we need to estimate the quantities , , and . For that, we follow the same procedure explained in Appendix A. This method requires that and satisfy certain conditions that we confirmed numerically. As a result, it turns out that the bounds given by Eqs. (61)-(67) are also valid in this scenario.

The only relevant statistics to evaluate Eqs. (61)-(67) are and , with . These probabilities can be obtained by solving Eqs. (23)-(24). They are given in Appendix C. Note that can be directly calculated from these two statistics by means of Eq. (17). After substituting Eqs. (6)-(9) into the gain and QBER formulas we obtain

 Q¯c = Nw−(1−ϵ)(1−Y0)e(ηd−ηsys)ω−ηdυ × I0,(ηd−ηsys)ξ, Q¯cE¯c = (e0−ed)Y0Nw+edQ¯c, Qt = 1−(1−Y0)e−ηsysωI0,ηsysξ, QtEt = (e0−ed)Y0+edQt, (27)

with the parameter given by

 ω=μ1t+μ2(1−t). (28)

The resulting lower bound on the secret key rate is illustrated in Fig. 5.

We assume that , i.e., we consider a simple BS. Again, we study two different situations: (A) and (18), and (B) and (25). In both cases the optimal values of the intensities and are almost constant with the distance. One of them is quite weak (around ), while the other one is around . The reason for this result can be understood as follows. When the intensity of one of the signals is really weak, the output photon number distributions in mode are always close to a Poissonian distribution (for click and no click events). This distribution is narrower than the one arising when both and are of the same order of magnitude. In this case, a better estimation of and can be derived, and this fact translates into a higher secret key rate. It must be emphasized, however, that from an experimental point of view this solution might not be optimal. Specially, since in this scenario the two output distributions and might be too close to each other for being distinguished in practice. This effect could be specially relevant when one considers statistical fluctuations due to finite data size (see Sec. VIII). For instance, small fluctuations in a practical system could overwhelm the tiny difference between the decoy state and the signal state in this case. Figure 5 includes as well the secret key rate of an active asymptotic decoy state QKD system with infinite decoy settings (10). The cutoff points where the secret key rate drops down to zero are km (passive setup with two intensity settings) and km (active asymptotic setup). From these results we see that the performance of the passive scheme with a threshold detector is comparable to the active one, thus showing the practical interest of the passive setup.

Like in Sec. V, one can improve the performance of the passive scheme further by using more intensity settings. The case where Alice uses a PNR detector is analyzed in Appendix B.2. The result is also shown in Fig. 5. It reproduces approximately the behavior of the asymptotic active setup and the secret key rate is both scenarios cannot be distinguished with the resolution of this figure (solid line). This result is not surprising, since in both situations (passive and active) we apply Eq. (5) with the actual values of the parameters , , and . The only difference between these two setups arises from the photon number distribution of the signal states that go to Bob. In particular, while in the passive scheme the relevant statistics are given by Eq. (B.2), in the active setup these statistics have the form given by Eq. (B.2).

### vi.3 Alternative implementation scheme

The passive setup illustrated in Fig. 1 requires that Alice employs two independent sources of signal states. This fact might become specially relevant when she uses phase randomized WCP, since in this situation none of the signal states entering the BS can be the vacuum state. Otherwise, the photon number distributions of the output signals in mode and mode would be statistically independent.

Alternatively to the passive scheme shown in Fig. 1, Alice could as well employ, for instance, the scheme illustrated in Fig. 6.

This setup has only one laser diode, but follows a similar spirit like the original scheme in Fig. 1, where a photo-detector is used to measure the output signals in mode . It includes, however, an intensity modulator (IM) to block either all the even or all the odd pulses in mode . This requires, therefore, an active control of the functioning of the IM, but note that no random number generator is needed here. The main reason for blocking half of the pulses in mode is to suppress possible correlations between them. That is, the action of the IM guarantees that the signal states that go to Bob are tensor product of mixtures of Fock states. Then, one can directly apply the security analysis provided in Refs. (10); (8); (20). Thanks to the one-pulse delay introduced by one arm of the interferometer, together with a proper selection of the transmittance , it can be shown that both setups in Fig. 1 and Fig. 6 are completely equivalent, except from the resulting secret key rate. More precisely, the secret key rate in the active scheme is half the one of the passive setup, since half of the pulses are now discarded.

## Vii Strong coherent light

Let us now consider the passive decoy state setup illustrated in Fig. 7.

This scheme presents two main differences with respect to the passive system analyzed in Sec. VI. In particular, the mean photon number (intensity) of the signal states and is now very high; for instance, photons. This fact allows Alice to use a simple classical photo-detector to measure the pulses in mode , which makes this scheme specially suited for experimental implementations. Moreover, it has an additional BS of transmittance to attenuate the signal states in mode and bring them to the QKD regimen.

Due to the high intensity of the input signal states and , we can describe the action of the first BS in Fig. 7 by means of a classical model. Specifically, let () represent the intensity of the input states (), and let [] be the intensity of the output pulses in mode (). Here the angle is just a function of the relative phase between the two input states. It is given by

 θ=ϕ1−ϕ2+π/2, (29)

where () denotes the phase of the signal (). Like in Sec. VI, we assume that these phases are uniformly distributed between and for each pair of input states. This can be achieved, for instance, if Alice uses two pulsed laser sources to prepare the signals and . With this notation, we have that and can be expressed as

 Ia(θ) = t1I1+r1I2+2√t1r1I1I2cosθ, Ib(θ) = r1I1+t1I2−2√t1r1I1I2cosθ, (30)

where denotes the transmittance of the BS, and .

### vii.1 Classical threshold detector

For simplicity, we shall consider that Alice uses a perfect classical threshold detector to measure the pulses in mode . For each incoming signal, this device tells her whether its intensity is below or above a certain threshold value that satisfies . That is, the value of is between the minimal and maximal possible values of the intensity of the pulses in mode . Note, however, that the analysis presented in this section can be straightforwardly adapted to cover also the case of an imperfect classical threshold detector, or a classical photo-detector with several threshold settings. Figure 8 shows a graphical representation of versus the angle , together with the threshold value .

The angle which satisfies is given by

 θth=arccos(r1I1+t1I2−IM2√t1r1I1I2). (31)

Whenever the classical threshold detector provides Alice with an intensity value below , it turns out that the unnormalized signal states in mode can be expressed as

 ρ

This means, in particular, that the joint probability of finding photons in mode and an intensity value below in mode is given by

 p

Similarly, we find that can be written as

 p>IMn=tn2n!π∫πθthIa(θ)ne−Ia(θ)t2dθ. (34)

Figure 9 (Case A) shows the conditional photon number statistics of the outcome signal in mode depending on the result of the classical threshold detector (below or above ): and , with

 Ns=∞∑n=0p

This figure includes as well a comparison between (Case B) and (Case C) and a Poissonian distribution of the same mean photon number. It turns out that both distributions, and , approach a Poissonian distribution when is sufficiently small.

### vii.2 Lower bound on the secret key rate

Again, to apply the secret key rate formula given by Eq. (5), with , we need to estimate the quantities , , and . Once more, we follow the procedure explained in Appendix A. We confirmed numerically that the probabilities and satisfy the conditions required to use this technique. As a result, it turns out that the bounds given by Eqs. (61)-(67) are also valid in this scenario.

For simplicity, we impose . This means that . The relevant statistics and , with , are calculated in Appendix D. After substituting Eqs. (6)-(9) into the gain and QBER formulas we obtain

 QIM = (1−Ns)−(1−Y0)e−ηsysκ2 × (I0,ηsysζ+L0,ηsysζ), Q>IME>IM = (e0−ed)Y0(1−Ns)+edQ>IM, (36)

where the parameter is given by

 κ=It2, (37)

and represents the modified Struve function (27) defined by Eq. (85).

The resulting lower bound on the secret key rate is illustrated in Fig. 10.

We study two different situations: (A) We impose , i.e., we consider a simple BS, and we optimize the parameter , and (B) we optimize both quantities, and . In both scenarios the optimal values of the parameters are almost constant with the distance. In the first case is around , while in the second case we obtain that and are, respectively, around and . The cutoff point where the secret key rate drops down to zero is km both in case A and B. These results seem to indicate that this passive scheme can offer a better performance than the passive setups analyzed in Sec. V and in Sec. VI with a threshold photon detector. This fact arises mainly from the probability distributions and , which, in this scenario, approach a Poissonian distribution when is sufficiently small. Again, one can improve the performance of this system even further just by using more threshold settings in the classical threshold detector. Moreover, from an experimental point of view, this configutation might be more feasible than using PNR detectors.

To conclude this section, let us mention that, like in Sec. VI.3, Alice could as well employ, for instance, the alternative active scheme illustrated in Fig. 11.

This setup has only one pulsed laser source, but includes an intensity modulator (IM) to block either all the even or all the odd pulses in mode . The argumentation here goes exactly the same like in Sec. VI.3 and we omit it for simplicity. The resulting secret key rate in the active scheme is half the one of the passive setup.

## Viii Statistical Fluctuations

In this section, we discuss briefly the effect that finite data size in real life experiments might have on the final secret key rate. For that, we follow the statistical fluctuation analysis presented in Ref. (12). This procedure is based on standard error analysis. That is, we shall assume that all the variables which are measured in the experiment each fluctuates around its asymptotic value.

Our main objective here is to obtain a lower bound on the secret key rate formula given by Eq. (5) under statistical fluctuations. For that, we realize the following four assumptions:

1. Alice and Bob know the photon number statistics of the source well and we do not consider their fluctuations directly. Intuitively speaking, these fluctuations are included in the parameters measuring the gains and QBERs.

2. Alice and Bob use a real upper bound on the single photon error rate , thus no fluctuations have to be considered for this parameter. In particular, we use the fact that the number of errors within the single photon states cannot be greater than the total number of errors.

3. Alice and Bob use a standard error analysis procedure to deal with the fluctuations of the variables which are measured.

4. The error rate of background does not fluctuate, i.e., .

To illustrate our results, we focus on the passive decoy state setup introduced in Sec. VI. Note, however, that a similar analysis can also be applied to the other passive schemes presented in this paper.

### viii.1 Active decoy state QKD

In order to make a fair comparison between the active and the passive decoy state QKD setups with two intensity settings, from now on we shall consider an active scheme with only one decoy state (12). In this last case, the quantities and can be bounded as

 Y1 ≥ YL1=μ2Qνeν−ν2Qμeμ−(μ2−ν2)Y0μν(μ−ν), e1 ≤ eU1=EμQμeμ−e0Y0Yl1μ, (38)

where () denotes the mean photon number of a signal (decoy) state, () and () represent, respectively, its associated gain and QBER, and is a free parameter. Using the channel model described in Sec. III, we find that these parameters can be written as

 Qμ =Y0+1−e−μηsys, (39) EμQμ =e0Y0+ed(1−e−μηsys), Qν =Y0+1−e−νηsys, EνQν =e0Y0+ed(1−e−νηsys).

If we now apply a standard error analysis to these quantities we obtain that their deviations from the theoretical values are given by

 ΔQμ =uα√Qμ/Nμ, (40) ΔQν =uα√Qν/Nν, ΔQμEμ =uα√2EμQμ/Nμ, ΔQνEν =uα√2EνQν/Nν,

where () denotes the number of signal (weak decoy) pulses sent by Alice, and represents the number standard deviations from the central values. That is, the total number of pulses emitted by the source is just given by . Roughly speaking, this means, for instance, that the gain of the signal states lies in the interval except with small probability, and similarly for the other quantities defined in Eq. (39). For example, if we select , then the corresponding confidence interval is , which we use later on for simulation purposes. For simplicity, here we have assumed that Alice and Bob use the standard BB84 protocol, i.e., they keep only half of their raw bits (due to the basis sift). This is the reason for the factor which appears in the last two expressions of Eq. (40). In this context, see also Ref. (28) for a discussion on the optimal value of the parameter .

### viii.2 The background Y0

The bounds given by Eq. (VIII.1) depend on the unknown parameter . When a vacuum decoy state is applied, the value of can be estimated. Alternatively, one can also derive a lower bound on and an upper bound on which do not depend on . Specifically, from Eqs. (2)-(3) we obtain that

 (1−2e1)Y1≥A = μν(μ−ν)Qν(1−2Eν)eν (41) − νμ(μ−ν)Qμ(1−2Eμ)eμ.

The gains and , together with the QBERs and , are directly measured in the experiment, and their statistical fluctuations are given by Eq. (40). On the other hand, we have that

 e1≤BYL1, (42)

with the parameter given by

 B=min{EνQνeνν,EμQμeμ−EνQνeνμ−ν}. (43)

Combining Eqs. (41)-(42) we find

 Y1[1−H(e1)]≥A1−2e1[1−H(B(1−2e1)A)]. (44)

The quantities and can be obtained directly from the variables measured in the experiment. Moreover, if one considers the secret key rate formula given by Eq. (5) as a function of the free parameter , then one should select an upper bound on , which gives a value (may not be a bound) for as

 Yt1 = A+2B, eU1 = BA+2B, (45)

where the equation for comes from solving the two inequalities given by Eqs. (41)-(42).

Again, using a standard error analysis procedure, we find that the deviations of the parameters and from their theoretical values can be written as

 ΔA = [(c1ΔQν)2+4(c1ΔEνQν)2+(c2ΔQμ)2 +4(c2ΔEμQμ)2]12, ΔB = min{eμΔEμQμμ,eνΔEνQνν, (46) √(eμΔEμQμ)2+(eνΔEνQν)2μ−ν},

where the coefficients and have the form

 c1 = μν(μ−ν)eν, c2 = νμ(μ−ν)eμ, (47)

and the deviations of the gains and the QBERs are given by Eq. (40).

For simplicity, we assume now that and are statistically independent. Thus, the statistical deviation of the crucial term in the secret key formula can be written as

 ΔY1[1−H2(e1)] = {[ΔAlog2(2A+2BA+2B)]2 (48) + Missing or unrecognized delimiter for \Bigg

From Eqs. (40), (VIII.2) and (48) one can directly calculate the final secret key rate with statistical fluctuations for an active decoy state setup with only one decoy state (12). The result is illustrated in Fig. 12 (dashed line). Here we use again the experimental data reported by Gobby et al. in Ref. (25). Moreover, we pick the data size (total number of pulses emitted by Alice) to be . We calculate the optimal values of and for each fiber length numerically. It turns out that both parameters are almost constant with the distance. One of them is weak (it varies between and ), while the other is around . This figure includes as well the resulting secret key rate for the same setup without considering statistical fluctuations (thick solid line). The cutoff points where the secret key rate drops down to zero are km (active setup with statistical fluctuations) and km (active setup without considering statistical fluctuations). From these results we see that the performance of this active scheme is quite robust against statistical fluctuations.

### viii.3 Passive decoy state QKD

The analysis is completely analogous to the previous section. Specifically, we find that the parameters and