Quantum key distribution with triggering parametric down conversion sources
Abstract
Parametric downconversion (PDC) sources can be used for quantum key distribution (QKD). One can use a PDC source as a triggered single photon source. Recently, there are various practical proposals of the decoy state QKD with triggering PDC sources. In this paper, we generalize the passive decoy state idea, originally proposed by Mauerer and Silberhorn. The generalized passive decoy state idea can be applied to cases where either threshold detectors or photon number resolving detectors are used. The decoy state protocol proposed by Adachi, Yamamoto, Koashi and Imoto (AYKI) can be treated as a special case of the generalized passive decoy state method. By simulating a recent PDC experiment, we compare various practical decoy state protocols with the infinite decoy protocol and also compare the cases using threshold detectors and photonnumber resolving detectors. Our simulation result shows that with the AYKI protocol, one can achieve a key generation rate that is close to the theoretical limit of infinite decoy protocol. Furthermore, our simulation result shows that a photonnumber resolving detector appears to be not very useful for improving QKD performance in this case. Although our analysis is focused on the QKD with PDC sources, we emphasize that it can also be applied to other QKD setups with triggered single photon sources.
I Introduction
Quantum key distribution (QKD) Bennett and Brassard (1984); Ekert (1991) allows two legitimate parties, Alice and Bob, to create a random secret key even when the channel is accessible to an eavesdropper, Eve. The security of QKD is built on the fundamental laws of physics in contrast to existing classical public key encryption schemes that are based on unproven computational assumptions. Bennett and Brassard proposed a bestknown protocol — BB84 Bennett and Brassard (1984). Proving the security of QKD is a hard problem. Fortunately, this problem has been solved in the last decade, see for example, Mayers (2001); Lo and Chau (1999); Shor and Preskill (2000); Koashi (2006a). Many security proofs are based on the assumption of idealized QKD system components, such as a perfect single photon source and wellcharacterized detectors. In practice, inevitable device imperfections may compromise the security unless these imperfections are well investigated. Meanwhile, the security of QKD with realistic devices has been proven. See Mayers and Yao (1998); Lütkenhaus (2000); Brassard et al. (2000); Inamori et al. (2007); Koashi and Preskill (2003); Gottesman et al. (2004) for example.
In the original proposal of BB84 protocol, a single photon source is used. Unfortunately, single photon sources are still not commercially available with current technology. Alternatively, a weak coherent state is widely used as a photon source. We call this implementation coherent state QKD. Many coherent state QKD experiments have been done since the first QKD experiment Bennett et al. (1992).
The coherent state QKD suffers from photonnumber splitting (PNS) attacks Huttner et al. (1995); Brassard et al. (2000); Lütkenhaus and Jahma (2002). Nevertheless, it has been proven unconditionally secure by Inamori, Lütkenhaus and Mayers Inamori et al. (2007). This work is improved by Gottesman, Lo, Lütkenhaus, and Preskill (GLLP) Gottesman et al. (2004), though the performance in terms of the achievable secure distance and the key rate is limited.
Decoy state method Hwang (2003) has been proposed to improve the performance of the coherent state QKD. The security of QKD with decoy states has been proven Lo (2004); Ma (2004); Lo et al. (2005a). The simulation result shows us that the coherent state QKD with decoy states is able to operate as good as QKD with perfect single photon sources in the sense that the key generation rates given by both setups depend linearly on the channel transmittance Lo et al. (2005a). Afterwards, some practical decoystate protocols with only one or two decoy states are proposed Ma et al. (2005), see also Harrington et al. (2005); Wang (2005a, b). The experimental demonstrations for decoy state method have been done recently Zhao et al. (2006a, b); Rosenberg et al. (2007); SchmittManderbach et al. (2007); Peng et al. (2007); Yuan et al. (2007).
The motivation of decoy states is to estimate the channel properties (e.g., transmittance and error proability) better. To do that, Alice uses extra states with different light intensities during key transmission. Then Alice and Bob can consider detection statistics from signal and decoy states separately, from which they can estimate the channel transmittance and error probability better. We call the situation when Alice actively prepare decoy states active decoy state method to differentiate from the passive decoy state method where Alice choose decoy and signal states by passive measurements. Details can be found in Section IV. We note that in coherent state QKD, one can only use active decoy state method.
Other than the decoy state method, we remark that there are other approaches to enhance the performance of the coherent state QKD, such as QKD with strong reference pulses Koashi (2004); Tamaki et al. (2006) and differentialphaseshift QKD Inoue et al. (2002).
Besides a coherent state source, a parametric downconversion (PDC) source can be used for QKD as well. There are two ways to use a PDC source for QKD. The first is to use it as a triggered (heralded) single photon source. Alice detects one of the two modes from a PDC source as a trigger ^{1}^{1}1See Section II for the definition of a trigger. and actively encodes her qubit information into another mode. We call this implementation triggering PDC QKD. The second way is to use it as an entangled photon source for entanglementbased QKD protocols. See Ref. Ma et al. (2007) and references cited therein. We call this implementation entanglement PDC QKD.
The triggering PDC QKD, similar to the coherent state QKD, suffers from PNS attacks. By applying the GLLP security proof, one can find that the optimal average photon number is in the same order of overall transmittance . Then the key generation rate will be on the order of . For a rigorous derivation, one can refer to Appendix A. Thus, the performance of the triggering PDC QKD is very limited.
Since decoy states idea can substantially enhance the performance of the coherent state QKD, a natural question will be: “can decoy states idea be applied to the triggering PDC QKD?” The answer is yes. One can apply the infinite decoy state idea Lo et al. (2005a) to the triggering PDC QKD. Not surprisingly, with decoy states, the key generation rate can be , which is the same as the order achieved by a singlephoton source. Therefore, we expect the decoy state QKD to become a standard technique not only in the coherent state QKD, but also in QKD with triggering PDC sources. The infinite decoy state protocol requires an infinite number of decoy states to be used, which is not practical. A few practical decoy proposals for triggering PDC requiring a finite number of decoy states have been proposed Mauerer and Silberhorn (2007); Adachi et al. (2007); Wang et al. (2007a, b).
We are interested in comparing various protocols for the triggering PDC QKD. Among the practical decoy protocols for triggering PDC QKD, we find that the one proposed by Adachi, Yamamoto, Koashi and Imoto (AYKI) Adachi et al. (2007) is simple to implement. The AYKI protocol is conceptually similar to the onedecoystate scheme Ma et al. (2005). In the AYKI protocol, Alice and Bob only need to consider the statistics of triggered and nontriggered detection events ^{2}^{2}2In a nontriggered detection event, Bob gets a detection but Alice doesn’t get a trigger. separately, instead of preparing new signals for decoy states. We emphasize that the AYKI protocol is easy to implement since there is no need for a hardware change.
Other decoy state proposals for the triggering PDC QKD require hardware modifications. For example, the one proposed by Mauerer and Silberhorn Mauerer and Silberhorn (2007) requires photonnumber resolving detectors, and the one proposed by Wang, Wang and Guo Wang et al. (2007a) requires Alice’s pumping the laser source at various intensities.
We generalize the passive decoy state idea proposed by Mauerer and Silberhorn Mauerer and Silberhorn (2007). The main idea is that, Bob can group his detection events according to the public announcement of Alice’s detection events. For example, when Alice uses a threshold detector, Bob can group his detection results according to whether Alice gets a detection or not. The generalized passive decoy state idea can be applied to both cases of using threshold detectors and photonnumber resolving detectors. The AYKI protocol can be treated as a special case of the generalized passive decoy state protocol.
By simulating a recent PDC experiment Ursin et al. (2007), we compare one case with a perfect photonnumber resolving detector and four cases with threshold detectors: no decoy, infinite decoy, weak decoy and AYKI. Our simulation result shows that in a large parameter regime, the performance of AYKI protocol is close to that of the infinite decoy protocol and thus there is not much room left for improvement after the AYKI protocol has been implemented. Also, the QKD performance of the case with the infinite decoy protocol using threshold detectors is close to the case using a perfect photonnumber resolving detector. Thus, a photonnumber resolving detector appears to be not very useful for triggering PDC QKD.
We emphasize that one advantage of passive decoy state method is that by passively choosing decoy and signal states, the possibility that Eve can distinguish decoy and signal states is reduced. On the other hand, in active (regular) decoy state experiments, it is more difficult to verify the assumption that Eve cannot distinguish decoy and signal states.
We note that the passive decoy state idea can be combined to the active decoy state idea. In Ref. Wang et al. (2007b), the authors gave a special case of combining passive and active decoy state ideas. Note that for coherent state QKD, one can only use active decoy state methods.
Although our analysis is focussed on the QKD with PDC source, we emphasize that it can also be applied to QKD setups with other triggered single photon sources.
In Section II, we will review the experiment setup of the triggering PDC QKD. In Section III, we give a model for the triggering PDC QKD. In Section IV, we will study various postprocessing schemes for the triggering PDC QKD. In Section V, we will compare various schemes of the triggering PDC QKD: nondecoy+threshold detectors, infinite decoy+threshold detectors, AYKI and the case with a perfect photonnumber resolving detector, by simulating a real PDC experiment. In Appendix A, we consider the optimal PDC source intensities for the triggering PDC QKD.
Ii Experiment setup
In triggering PDC QKD, a PDC source is used as a triggered single photon source ^{3}^{3}3Sometimes it is called heralded single photon source.. The schematic diagram is shown in FIG. 1.
As shown in FIG. 1, a PDC source generates two modes of photons, which can be separated by a polarized beam splitter (PBS). One mode goes to Alice’s own detector (DA in FIG. 1) as the triggering signal and the other mode is used as a triggered single photon state for the QKD. When Alice’s detector (DA) clicks, we call it a trigger. We divide the detection events on Bob’s side into two groups depending on whether Alice gets a trigger or not: triggering detection events and nontriggering detection events.
Note that Alice can use either a threshold detector or a photonnumber resolving detector (DA in FIG. 1). She only needs to know the number of photons in the trigger mode. So only one detector is sufficient on Alice’s side. Due to the high channel losses, without Eve’s interference, Bob is highly likely to receive a vacuum or single photon state. Thus it is sufficient for Bob to use threshold detectors. Threshold single photon detectors can only tell whether there a click or not, but not the photon numbers. Bob needs to identify polarizations of incoming photons. Here we assume Alice encodes qubit information in photon polarizations.
In real experiments, there are two types of PDC sources. In triggering PDC QKD, both of these two types can be used. Here we assume Alice uses typeII PDC source. The Hamiltonian of the typeII PDC process in the triggering setup shown in FIG. 1 can be written as Walls and Milburn (1994)
(1) 
where means Hermitian conjugate and is a coupling constant which depends on the crystal nonlinearity and the amplitude of the pump beam. The operators , and , are the creation and annihilation operators of two modes with different polarizations.
The state coming from a triggering PDC source, with a Hamiltonian of Eq. (1), can be written as Walls and Milburn (1994)
(2) 
Here we assume the state is singlemode. The expected photon pair number is given by . The probability to get an photonpair is
(3) 
Here we assume that the PDC source always sends out photon pairs. That is, the photon number of mode and are always the same.
There is a nonzero probability for the PDC source to emit more than one photon pairs in one pulse. Thus, Alice may send out multi photon states after she encodes basis and key information by her polarization controller (PC). This is the reason why the triggering PDC QKD suffers from PNS attacks.
Let us compare triggering PDC QKD and entanglement PDC QKD implementations. For the setup of entanglement PDC QKD, one can refer to Ref. Ma et al. (2007). In the triggering PDC QKD Alice actively encodes the key information, while in the entanglement PDC QKD Alice measures the polarization of one mode of PDC source directly. The advantage of the triggering PDC QKD here is that it does not rely on the polarization correlations between two modes of the PDC source. It only requires photonpair generation of the source, which means entanglement between photon pairs are not important for triggering PDC QKD. However, in entanglement PDC QKD implementation, the entanglement between two modes has to be well maintained for QKD transmission. We notice that maintaining entanglement in real experiments is a highly nontrivial task ^{4}^{4}4We thank A. M. Steinberg for enlightening discussions..
Iii Model
Lütkenhaus has already studied the model of triggering PDC QKD Lütkenhaus (2000) with threshold detectors. His model is similar to the one of the coherent state QKD, except for a different photon number distribution. For the model of the coherent state QKD, one can refer to Ref. Lütkenhaus (2000); Ma et al. (2005). For the model of entanglement PDC QKD, one can refer to Ref. Ma et al. (2007).
iii.1 Photon number channel model
Here we will use the photon number channel model Lo et al. (2005a): Alice and Bob have infinite number of channels. For channel , Alice uses photon states (Fock states) to carry the qubit information, with . The th channel corresponds to the case when Alice’s photon source emits an photon state. Thus, the probability for Alice to use the th channel is determined by the photon source. For example, in coherent state QKD, the probability for Alice using the different channels follows a Poisson distribution. For the details of the photon number channel model, one can refer to Ref. Ma et al. (2005).
We define the yield to be the probability for Bob to get a detection event conditioned on Alice using the th channel. As discussed in Section II, we assume that Bob uses a threshold detector. The yield is given by
(4) 
where is the background count rate of Bob’s detection system, and is the overall detection probability for Bob, which takes into account the channel transmission efficiency, the coupling efficiency, the detector efficiency and the other losses in Bob’s box.
The error rate when Alice uses th channel is given by
(5) 
where is the error rate of background counts, is the intrinsic detector error rate on Bob’s side (e.g., due to misalignment) and is given by Eq. (4). Here, we neglect the case where both background counts and true signal click since and are small. We remark that Eqs. (4) and (5) are true for both triggered and nontriggered cases.
iii.2 On Alice’s side
In the triggering PDC QKD, Alice may use either a threshold detector or a photonnumber resolving detector. Define an Nphotonresolving detector to be a detector that can tell 0, 1, , photons of incoming signal. For a threshold detector, we have , which can only tell there are photons presenting or not. Given an incoming photon state, the probability for Alice’s detector to indicate a photon state is , with for all . In general, ’s are real numbers in [0,1]. We define a photon trigger for the case that Alice’s detector indicates a photon state.
For a triggered PDC photon source, as given in Eq. (2), the probability for Alice’s detector to indicate a photon detection is
(6) 
With the assumption that the PDC source always emits photon pairs, the probability (gain) for Alice getting a photon detection and Bob getting a detection is
(7)  
where the yield is given in Eq. (4). The quantum bit error rate (QBER) conditioned on Alice’s photon detection, similar to Eq. (7), is given by
(8)  
where the error rate is given in Eq. (5).
iii.3 Threshold detector
Here we will discuss a special case that Alice uses a threshold detector. That is,
(9)  
where and are the background count rate and the detector efficiency on Alice’s side. The approximation is due to the fact that normally we have . That is, we neglect the background contributions on Alice’s side.
iii.4 Perfect photonnumber resolving detector
Here we will discuss the case that Alice uses a perfect photonnumber resolving detector, which can faithfully tell the number of photons in the incoming signal. That is, . Thus the gains and QBER’s are given by, from Eqs. (7) and (8),
(12)  
from where one can directly infer the gains and error rates of photon state, .
Iv Postprocessing
In the following discussion, we will focus on BB84 protocol Bennett and Brassard (1984). Due to PNS attacks Huttner et al. (1995); Brassard et al. (2000); Lütkenhaus and Jahma (2002), only vacuum states and single photon states are secure for BB84 protocol, which may not be true for other protocols, such as SARG04 Scarani et al. (2004).
Similar to the coherent state QKD, we can apply GLLP Gottesman et al. (2004) security analysis to the triggering PDC QKD. First, Alice and Bob perform error correction, after which they will share an identical key. Then, they perform privacy amplification to different types of qubits separately. Since here we assume only vacuum states and single photon states are secure for BB84 protocol, the key generation rate is given by Lo et al. (2005a); Lo (2005); Koashi (2006b)
(13) 
where is the basis reconciliation factor (1/2 for the BB84 protocol due to the fact that half of the time Alice and Bob disagree with the bases, and if one uses the efficient BB84 protocol Lo et al. (2005b), ), the subscript denotes for the expected photon pair number, and are the overall gain and QBER, and are the gain and error rate of single photon states, is the gain of vacuum states, is the bidirection error correction efficiency (see, for example, Brassard and Salvail (1993)) as a function of the error rate (normally with the Shannon limit ) and is the binary entropy function.
All the classical data measured can be grouped according to Alice’s detection events, . Then we can apply the GLLP idea Gottesman et al. (2004); Ma et al. (2006) to each group. The final key generation rate will be given by summing over contributions from all groups,
(14) 
In each case , one can apply Eq.(23),
(15) 
where and are the first and second terms in the right hand side of Eq. (7). Here the error rate of single photon state is independent of , see the observation in the end of Section III.2. We note that the key generation rate from all photon trigger detections should be nonnegative. If any of them contributes a negative key generation rate, we should assign to it. In this case, Alice and Bob can just discard that type of detections. Based on this observation, we can further simplify Eq. (14). Given Alice detects more than one photons, the probability of emitting single photon state in Bob’s arm is small ^{5}^{5}5In Section II, we assume that Alice’s PDC source always sends out photon pairs. Given that Alice detects more than one photons on the triggering arm, a single photon state presents on the other arm only when there is a dark count in Alice’s detector. Normally, we can assume that the detector efficiency is much higher than the dark count probability on Alice’s side. Thus, we neglect probability of a single photon state with a multi photon trigger.. As we mentioned in the beginning of this section, only single photon state can contribute positively to the final key rate. Thus we can focus on the case .
(16) 
where and are given in Eq. (15). Again, both and should be nonnegative, otherwise should be assigned 0.
In Eq. (15), the gain and the QBER , given in Eqs. (7) and (8), can be measured or tested from QKD experiments directly. In this section, we will discuss various ways to estimate , , and . We assume that the PDC photon source and detector characteristics are fixed and known to Alice. That is, , the photon number distribution in Eq. (3) and are fixed and known.
iv.1 Nondecoy states with threshold detectors
Here we assume that Alice uses a threshold detector. Thus, Alice only has two measurement outcomes, . One simple way to estimate , , and is by assuming that all losses and errors come from the single photon states. This is because Eve can in principle perform PNS attacks on the multiphoton states. The gain and error rate of the single photon states in triggered () and nontriggered () detections can be bounded by
(17)  
where is the efficiency of Alice’s detector. The gain and the QBER , given in Eqs. (7) and (8), can be measured or tested from QKD experiments directly. In the following simulations, we will use Eqs. (10). Since we assume all errors come from the single photon states, one should take the lower bound of the vacuum contribution to be .
iv.2 Infinite active decoy state with threshold detectors
To do privacy amplification, Alice and Bob need to bound , , and for Eq. (15). From Eq. (7), we know that to bound and , Alice and Bob need to estimate .
Decoy state method provide a good way to estimate and Hwang (2003); Lo et al. (2005a). The essential idea is that instead of considering each linear equation of and in the form of Eqs. (7) and (8) separately, Alice and Bob consider all the linear equations simultaneously.
Let us imagine that Alice and Bob obtain an infinite number of linear equations in the form of Eqs. (7) and (8), e.g., they use an infinite number of intensities . In principle, Alice and Bob can solve the equations to get and accurately. Mathematically, the problem is solvable. The intuition is that the contributions from higher order terms of and decrease exponentially in Eqs. (7) and (8). For the case coherent state QKD, one or two decoy states are proven to be sufficient Ma et al. (2005). Shortly, we will see that one decoy state is sufficient for triggering PDC QKD.
We remark that the key underlying assumption of the decoy state method is Lo et al. (2005a)
(18)  
In another word, Eve sets the same values of and for decoy and signal states. This can be guaranteed by the assumption that Eve cannot distinguish decoy and signal states.
In Appendix A, we will show that the optimal for the infinite decoy state case is in the order of 1, , which yields final key rate . On the other hand, the optimal for nondecoy case is , which yields final key rate . Therefore, we expect the decoy state QKD to become a standard technique not only in the coherent state QKD, but also in QKD with triggering PDC sources.
There are various ways to apply the decoy state idea to the triggering PDC QKD Mauerer and Silberhorn (2007); Adachi et al. (2007); Wang et al. (2007a). Here we consider the upper bound (infinite decoy state case) of all possible decoy protocols of triggering PDC QKD with threshold detectors: triggering PDC+infinite decoy method Lo et al. (2005a). In the infinite decoy state method, Alice and Bob perform infinite number of decoy states by choosing different intensities of the PDC source, . Then they can solve the linear equations in the form of Eqs. (7) and (8) to estimate and accurately. So they can calculate each , , and accurately. In the simulation, we will use Eqs. (10) and (11) directly.
iv.3 Weak active decoy state with threshold detectors
Here we assume that Alice and Bob use threshold detectors and focus on triggered detection events. Alice uses another intensity , say by attenuating pumping laser, for the weak decoy state. Wang, Wang and Guo have proposed a practical decoy method for triggering PDC QKD Wang et al. (2007a), which is essentially applying vacuum+weak decoy state method Ma et al. (2005). Note that for triggered detection events, the vacuum contribution can be negligible since . Thus there is no need to estimate the vacuum contribution here. So Alice and Bob only need to perform weak decoy state instead of vacuum+weak decoy states. In this case, only one weak decoy state is sufficient.
iv.4 Passive decoy state
Recently, Mauerer and Silberhorn proposed a passive decoy state scheme, in which photonnumber resolving detectors are required Mauerer and Silberhorn (2007). Let us recap the heuristic idea of the original passive decoy state scheme briefly here. As discussed in the Section III, Alice and Bob eventually get different detection events grouped by triggers on Alice’s side. The key idea proposed by Mauerer and Silberhorn is that Alice and Bob manually combine the trigger detection events to get the decoy states with different photon number statistics and then follows regular decoy state scheme.
Here we want to point out that the “combination” step is unnecessary. In general, each detection event group with trigger has a different photon number statistics on photon source arm. Thus, what Alice and Bob need to do is treating all trigger detection events statistics separately. Furthermore, photonnumber resolving detectors are not necessary in passive decoys state scheme. Our new generalized passive decoy state scheme is as follows.

Alice uses a PDC source as her triggered photon source. She detects one of the modes from her PDC source as trigger and encode key information into another mode. Due to the detector Alice uses, she will get different trigger events: . When she uses a threshold detector, she will only get .

As usual BB84 protocol, Bob measures signals in two different bases. Alice and Bob perform basis reconciliation.

Alice announces her trigger detection results for each pulse: . Bob group his detection events by the information . For each , they calculate the gain and test the QBER .

Apply postprocessing according to Eq. (16).
We remark that the scheme is called passive because Alice does not actively select decoy states. Instead, she determines the decoy states by measuring the trigger mode. Later, we will show that this is one advantage of using triggering PDC source for QKD. Actually, in this case, there is no strict definitions of decoy states and signal states. In the original decoy state method Ma et al. (2005), decoy states are only used to estimate and and the key is always generated from signal states ^{6}^{6}6In the coherent state QKD, there is an optimal for a setup. To maximize the final key rate, Alice and Bob should publicly compare all detection results from decoy states.. In triggering PDC QKD case, both the triggered and nontriggered detection events may have positive contribution to the final key generation.
iv.5 Passive decoy state with threshold detectors
Here we will review the decoy protocol proposed by Adachi, Yamamoto, Koashi and Imoto Adachi et al. (2007) as a special case of the passive decoy state protocol. The AYKI protocol is interesting in practice since it doesn’t involve any hardware change to implement decoy state.
Both Alice and Bob use threshold detectors, thus they have two types of detection events, triggered () and nontriggered (). Secure keys can be generated from both types of detection events. Following the passive decoy state method procedure described in the previous subsection, Alice and Bob can estimate and by considering the statistics of triggered and nontriggered detection events together. This is conceptually similar to one decoy state idea Ma et al. (2005).
By solving two linear equations of Eq. (7) with , , one can get
(20) 
where is the vacuum state contribution in nontriggered detection events. One need to minimize the key rate of Eq. (16) for with the constraint of Eq. (8). We note that this result is essentially the Eq. (14) given in Ref. Adachi et al. (2007). We can see that when is close to 1 or is small, after neglecting (background counts), the lower bound is tight (approaches the real value of , see Eq. (4)),
(21) 
By neglecting the vacuum state contribution for triggered detection events, , can be simply estimated by
(22) 
iv.6 With a perfect photonnumber resolving detector
Here we discuss a special case that Alice uses a perfect photonnumber resolving detector, discussed in Section III.4. Now that Alice knows the exact photon number of the source, Alice and Bob only need to focus the postprocessing on the single photon state detection events. In this case, the BB84 protocol is implemented by single photon states only. Thus, they can directly apply Shor and Preskill’s formula Shor and Preskill (2000); Ma et al. (2007)
(23) 
Later from the simulation, shown in Fig. 2, we can see that a perfect photonnumber resolving detector does not improve the QKD performance dramatically comparing to the threshold detector case.
iv.7 A few remarks
From the analysis of optimal in Appendix A, one can see that the key rate for the case without decoy states quadratically depends on the channel loss, , while for the case with decoy states, . This result is consistent with prior work in comparing the cases of coherent state QKD with and without decoy states Lo et al. (2005a).
In the decoy state security proof Lo et al. (2005a), the key assumption is that the decoy state and signal state should satisfy Eq. (18). This is guaranteed by the assumption that Eve cannot distinguish decoy and signal states. However, in the active decoy state method, Alice may introduce side information that can distinguish decoy and signal states when she actively prepares decoy and signal states. For example, an attenuator on Alice’s side, used to prepare different intensities for signal and decoy states, may introduce different frequency shifts for signal and decoy states Zhao et al. (2006a). In general, it is hard to verify the assumption that Eve cannot distinguish decoy and signal states in real active decoy state experiments.
In the passive decoy state scheme, decoy and signal states are passively determined by Alice’s measurement outcome. Alice does not use an extra component (like in active decoy state method) to prepare decoy states. This reduces the possibility of side information leakage. By passively choosing decoy states, Alice prepares same states on Bob’s arm ^{7}^{7}7Strictly speaking, there is one underlying assumption: the PDC source is singlemode.. In fact, Alice can measure trigger signals after Bob finishes his measurements. Thus, to Eve’s point of view, the states transmitted through the channel is independent of Alice’s measurement results (). Therefore, in principle, Eve cannot distinguish the decoy and signal states in the passive decoy state QKD.
This is the main advantage to use passive decoy state methods. Note that for coherent state QKD, one can only use active decoy state idea.
V Simulation
In this section, we will compare the passive decoy state with a perfect number resolving detector and four QKD implementations with threshold detectors: nondecoy, infinite decoy, weak active decoy and AYKI (passive decoy state).
We deduce experimental parameters from a recent PDC experiment Ursin et al. (2007), which are listed in TABLE 1. In the following simulations, we will use and in Eq. (15). We notice that with the slightly modified experiment setup, a coherent state QKD with decoy states has been implemented Ursin et al. (2007). Thus, it is reasonable to use this experiment setup to simulate the five QKD implementations.
Frequency  Wavelength  

249MHz  710 nm  14.5%  14.5%  1.5% 
In the simulation, for fair comparison, we always assume Bob uses the same detection setup (with threshold detectors).
v.1 Without statistical fluctuations
In the first simulation, we consider the case that Alice and Bob performs an infinitely long QKD (no statistical fluctuations). In this case the weak active decoy state protocol will approach the infinite decoy case Ma et al. (2005). We assume that Alice is able to adjust (the brightness of the PDC source) in the regime of arbitrarily. In the simulation, we numerically optimize for each of the four implementation protocols: nondecoy, infinite decoy, AYKI and the case with a perfect number resolving detector. The simulation result is shown in FIG. 2.
From FIG. 2, we have the following remarks.

In Appendix A, instead of numerically optimizing as done for Fig. (2), we qualitatively investigate the optimal for triggering PDC QKD with and without decoy states. The simulation result is consistent with the qualitative conclusion for the case with decoy state and for the case without decoy state.

The space between the solid line and dashed line in FIG. 2 indicates the room left for improvement by other decoy protocols with threshold detectors after AYKI protocol is implemented. We can see that, in a large optical link loss regime, the performances of AYKI and the infinite decoy are close. For instance, the AYKI protocol yields around 50% of the key rate of the infinite decoy state protocol when the channel loss is within 20dB.

By comparing AYKI and the case with a perfect photonnumber resolving detector, we can see that even with a perfect photonnumber resolving detector on Alice’s side, the key rate is not improved dramatically in a large optical loss regime.

There is a bump in each curve. This is due to the fact that in the key generation rate formula Eq. (16), the nontriggered detection events have no contribution to the final secure key after the bump.

At the point of loss=0 dB, the key rates of four cases (from top to bottom) are , , and .

At the point of loss=0 dB, the numerical results for optimal for four cases (from top to bottom) are: 1, 0.52, 0.194, 0.0589. The optimal for the case with a perfect threshold detector is always 1, which is reasonable since maximizes the single photon state probability. In Appendix A, we show that the optimal ’s for the infinite decoy and AYKI case are relatively stable in a large optical loss regime. The optimal for the no decoy state case decreases with channel loss.

We remark that the real used in the experiment Ursin et al. (2007) is . In general, it is experimentally hard to increase the brightness () of a PDC source.

All of the four cases can tolerate similar optical losses.
v.2 With statistical fluctuations
In a real experiment, the key length is always finite. Alice and Bob should consider statistical fluctuations. As pointed in Ref. Ma et al. (2005), statistical fluctuation analysis is a complicated problem in decoy state QKD.
Similar to the analysis in Ref. Ma et al. (2005), we assume a few conditions:

Alice knows the exact value of average photon pair number , which is a fixed number during key transmission.

The distribution of photon number, Eq. (3), does not fluctuate.

Assume the QKD transmission is part of an infinite length experiment.
Here we focus on the three cases with threshold detectors: infinite decoy, weak decoy and AYKI. We assume that the data size is pulses of Alice’s pumping laser. The simulation result is shown in FIG. 3. From the simulation result, we have the following observations.

Similar to the case without fluctuation analysis, in a large optical link loss regime, the performances of AYKI and the infinite decoy are close.

At the point of loss=0 dB, the key rates of the three cases from top to bottom are (infinite), (weak) and (AYKI).

The maximal tolerable secure optical losses for three cases are rather similar: 37dB (infinite), 32.5dB (AYKI), 32dB (weak).

The AYKI protocol yields a higher key rate than weak decoy state protocol when the loss is greater than 16 dB. AYKI is less affected by statistical fluctuations than the weak decoy state because in AYKI, Alice does not need to sacrifice extra pulses for decoy states.
In Section IV.7, we pointed out that from a practical security point of view, the passive decoy state method has an advantage over active decoy state methods. Also, AYKI method does not require any additional hardware change to implement decoy state, while in the weak decoy state case, Alice needs to add an attenuator to create decoy states. Now, from the simulation result, we can see that AYKI and weak active decoy state method yields similar QKD performance. Thus, our conclusion is that one should just use AYKI method instead of the weak decoy state method.
Vi Conclusion
By investigating the optimal photon source intensity, we find that the triggering PDC QKD setup with decoy states is able to achieve a key rate that linearly depends on the channel transmittance, comparing to the quadratic dependence for the case without decoy states. Therefore, we expect the decoy state QKD to become a standard technique not only in the coherent state QKD, but also in QKD with triggering PDC sources.
On the practical side, we generalize the passive decoy state idea. The generalized passive decoy state idea can be applied to cases where either threshold detectors or photon number resolving detectors are used. The decoy protocol proposed by Adachi, Yamamoto, Koashi and Imoto (AYKI) can be treated as a special case of the generalized passive decoy state method. Comparing to the active (regular) decoy state methods, the passive one opens less possibility for Eve to distinguish decoy and signal states, which is a key underlying assumption in the security proof of decoy state QKD. From this sense, the passive decoy state method is more secure than the active decoy state methods in practice.
By simulating a recent PDC experiment, we compare various practical decoy state protocols with the infinite decoy protocol. We also compare the cases using threshold detectors and photonnumber resolving detectors. Our simulation result shows that with the AYKI protocol, one can achieve a key generation rate that is close to the theoretical limit of infinite decoy protocol. Furthermore, our simulation result suggests that a photonnumber resolving detector has little room to improve the QKD performance, comparing to the case using threshold detectors.
We also consider the statistical fluctuations. We compare infinite decoy protocol, weak active decoy state method and AYKI protocol. The simulation result shows that the weak active decoy state method and AYKI protocol yield very close QKD performance. In a large optical loss regime, the AYKI protocol can achieve a performance that is close to the infinite decoy case. Since the AYKI protocol requires no hardware changes for triggering PDC QKD, we conclude that AYKI method is a good protocol for triggering PDC QKD experiments.
Although our analysis is focused on the QKD with PDC sources, we emphasize that it can also be applied to other QKD setups with triggered single photon sources.
Vii Acknowledgments
We thank C.H. F. Fung, W. Mauerer, A. M. Steinberg and G. Weihs for enlightening discussions. In the simulation part, we thank H. Hübel for confirming the parameters we deduced from their experiments. This work has been supported by CFI, CIFAR, CIPI, Connaught, CRC, MITACS, NSERC, OIT, PREA, QuantumWorks and the University of Toronto. X. Ma gratefully acknowledges Chinese Government Award for Outstanding Selffinanced Students Abroad and the Lachlan Gilchrist Fellowship.
Appendix A Optimal
The optimal for the coherent state QKD with and without decoy states has already been studied Ma et al. (2005). Here instead of numerically optimizing as done for Fig. (2), we qualitatively investigate the optimal for the triggering PDC QKD with and without decoy states. Here we are interested in the case that Alice uses a threshold detector.
a.1 Without decoy states
Let us begin with the optimal of the case without decoy states. Here we will apply GLLP Gottesman et al. (2004) security analysis. As shown in Ref. Ma (2006), GLLP and Lütkenhaus’s Lütkenhaus (2000) security analyses achieve similar performances for the coherent state QKD. Intuitively, we should get a similar optimal as given in Ref. Lütkenhaus (2000), .
From Eq. (10), we can see that the gain () is in the order of . To keep or in Eq. (17) positive, should be in the order of . By assuming , and are small, we can simplify Eq. (10)
(24)  
where is the lower bound of and is the upper bound of from Eq. (17). Since the error rates from triggered () and nontriggered () detection events are the same, the key generation rate given by Eq. (23) can be simplified to
(25)  
By taking derivative of , the optimal satisfies
(26) 
Here if set , then we get which is compatible with Lükenthaus’ result Lütkenhaus (2000). We note that essentially maximize the probability of single photon source in Eq. (24). More precisely, we can solve Eq. (26) numerically, see FIG. 4.
From FIG. 4, we can see that the optimal for triggering PDC+nondecoy is , which will lead the final key generation rate .
a.2 With decoy states
With decoy states, Alice and Bob can estimate and better. Here we consider the infinite decoy state case with threshold detectors. Under the assumption that and are small, we can simplify Eqs. (10) and (11),
(27)  
a.3 Numerical checking
Now we would like to numerically compare the optimal with and without decoy states by simulating a recent PDC experiment Ursin et al. (2007), with parameters listed in Table 1. In the simulation, we numerically optimize for the key rate given by Eq. (16) for the nondecoy and infinite decoy methods. For this particular setup, the optimal is shown in Figure 6.
From the figure we can see that the optimal for the nondecoy case is in the order of , while the optimal for the infinitedecoy case is in the order of 1. This is consistent with the results of the analysis in the two previous subsections.
References
 Bennett and Brassard (1984) C. H. Bennett and G. Brassard, in Proceedings of IEEE International Conference on Computers, Systems, and Signal Processing (IEEE, New York, Bangalore, India, 1984), pp. 175–179.
 Ekert (1991) A. K. Ekert, Phys. Rev. Lett. 67, 661 (1991).
 Mayers (2001) D. Mayers, Journal of the ACM 48, 351406 (2001).
 Lo and Chau (1999) H.K. Lo and H.F. Chau, Science 283, 2050 (1999).
 Shor and Preskill (2000) P. W. Shor and J. Preskill, Phys. Rev. Lett. 85, 441 (2000).
 Koashi (2006a) M. Koashi, J. Phys. Conf. Ser. 36, 98 (2006a).
 Mayers and Yao (1998) D. Mayers and A. Yao, in FOCS, 39th Annual Symposium on Foundations of Computer Science (IEEE, Computer Society Press, Los Alamitos, 1998), p. 503.
 Lütkenhaus (2000) N. Lütkenhaus, Phys. Rev. A 61, 052304 (2000).
 Brassard et al. (2000) G. Brassard, N. Lütkenhaus, T. Mor, and B. C. Sanders, Phys. Rev. Lett. 85, 1330 (2000).
 Inamori et al. (2007) H. Inamori, N. Lütkenhaus, and D. Mayers, Eur. Phys. J. D 41, 599 (2007).
 Koashi and Preskill (2003) M. Koashi and J. Preskill, Phys. Rev. Lett. 90, 057902 (2003).
 Gottesman et al. (2004) D. Gottesman, H.K. Lo, N. Lütkenhaus, and J. Preskill, Quantum Information and Computation 4, 325 (2004).
 Bennett et al. (1992) C. H. Bennett, F. Bessette, G. Brassard, L. Salvail, and J. A. Smolin, Journal of Cryptology 5, 3 (1992).
 Huttner et al. (1995) B. Huttner, N. Imoto, N. Gisin, and T. Mor, Phys. Rev. A 51, 1863 (1995).
 Lütkenhaus and Jahma (2002) N. Lütkenhaus and M. Jahma, New Journal of Physics 4, 44.1 (2002).
 Hwang (2003) W.Y. Hwang, Phys. Rev. Lett. 91, 057901 (2003).
 Lo (2004) H.K. Lo, in Proc. of IEEE ISIT (IEEE, 2004), p. 137.
 Ma (2004) X. Ma, arXiv: quantph/0503057 (2004).
 Lo et al. (2005a) H.K. Lo, X. Ma, and K. Chen, Phys. Rev. Lett. 94, 230504 (2005a).
 Ma et al. (2005) X. Ma, B. Qi, Y. Zhao, and H.K. Lo, Phys. Rev. A 72, 012326 (2005).
 Harrington et al. (2005) J. W. Harrington, J. M. Ettinger, R. J. Hughes, and J. E. Nordholt, ArXiv.org:quantph/0503002 (2005).
 Wang (2005a) X.B. Wang, Phys. Rev. Lett. 94, 230503 (2005a).
 Wang (2005b) X.B. Wang, Phys. Rev. A 72, 012322 (2005b).
 Zhao et al. (2006a) Y. Zhao, B. Qi, X. Ma, H.K. Lo, and L. Qian, Phys. Rev. Lett. 96, 070502 (2006a).
 Zhao et al. (2006b) Y. Zhao, B. Qi, X. Ma, H.K. Lo, and L. Qian, in Proc. of IEEE ISIT (IEEE, 2006b), p. 2094.
 Rosenberg et al. (2007) D. Rosenberg, J. W. Harrington, P. R. Rice, P. A. Hiskett, C. G. Peterson, R. J. Hughes, A. E. Lita, S. W. Nam, and J. E. Nordholt, Phys. Rev. Lett. 98, 010503 (2007).
 SchmittManderbach et al. (2007) T. SchmittManderbach, H. Weier, M. Fürst, R. Ursin, F. Tiefenbacher, T. Scheidl, J. Perdigues, Z. Sodnik, C. Kurtsiefer, J. G. Rarity, et al., Phys. Rev. Lett. 98, 010504 (2007).
 Peng et al. (2007) C.Z. Peng, J. Zhang, D. Yang, W.B. Gao, H.X. Ma, H. Yin, H.P. Zeng, T. Yang, X.B. Wang, and J.W. Pan, Phys. Rev. Lett. 98, 010505 (2007).
 Yuan et al. (2007) Z. L. Yuan, A. W. Sharpe, and A. J. Shields, Appl. Phys. Lett. 90, 011118 (2007).
 Koashi (2004) M. Koashi, Phys. Rev. Lett. 93, 120501 (2004).
 Tamaki et al. (2006) K. Tamaki, N. Lütkenhaus, M. Koashi, and J. Batuwantudawe, arXiv:quantph/0607082 (2006).
 Inoue et al. (2002) K. Inoue, E. Waks, and Y. Yamamoto, Phys. Rev. Lett. 89, 037902 (2002).
 Ma et al. (2007) X. Ma, C.H. F. Fung, and H.K. Lo, Phys. Rev. A 76, 012307 (2007).
 Mauerer and Silberhorn (2007) W. Mauerer and C. Silberhorn, Phys. Rev. A 75, 050305(R) (2007).
 Adachi et al. (2007) Y. Adachi, T. Yamamoto, M. Koashi, and N. Imoto, Phys. Rev. Lett. 99, 180503 (2007).
 Wang et al. (2007a) Q. Wang, X.B. Wang, and G.C. Guo, Phys. Rev. A 75, 012312 (2007a).
 Wang et al. (2007b) Q. Wang, X.B. Wang, G. Björk, and A. Karlsson, Europhysics Letters 79, 40001 (2007b).
 Ursin et al. (2007) R. Ursin, F. Tiefenbacher, T. SchmittManderbach, H. Weier, T. Scheidl, M. Lindenthal, B. Blauensteiner, T. Jennewein, J. Perdigues, P. Trojek, et al., Nature Physics 3, 481 (2007).
 Walls and Milburn (1994) D. F. Walls and G. J. Milburn, Quantum Optics (Springer, Berlin, 1994).
 Scarani et al. (2004) V. Scarani, G. R. A. Acin, and N. Gisin, Phys. Rev. Lett. 92, 057901 (2004).
 Lo (2005) H.K. Lo, Quantum Information and Computation 5, 413 (2005).
 Koashi (2006b) M. Koashi, arXiv:quantph/0609180 (2006b).
 Lo et al. (2005b) H.K. Lo, H.F. Chau, and M. Ardehali, Journal of Cryptology 18, 133 (2005b).
 Brassard and Salvail (1993) G. Brassard and L. Salvail, in Advances in Cryptology EUROCRYPT ’93, edited by G. Goos and J. Hartmanis (SpringerVerlag, Berlin, 1993).
 Ma et al. (2006) X. Ma, C.H. F. Fung, F. Dupuis, K. Chen, K. Tamaki, and H.K. Lo, Phys. Rev. A 74, 032330 (2006).
 Ma (2006) X. Ma, Phys. Rev. A 74, 052325 (2006).