Realistic parameter regimes for a single sequential quantum repeater
Abstract
Quantum key distribution allows for the generation of a secret key between distant parties connected by a quantum channel such as optical fibre or free space. Unfortunately, the rate of generation of a secret key by direct transmission is fundamentally limited by the distance. This limit can be overcome by the implementation of socalled quantum repeaters. Here, we assess the performance of a specific but very natural setup called a single sequential repeater for quantum key distribution. We offer a finegrained assessment of the repeater by introducing a series of benchmarks. The benchmarks, which should be surpassed to claim a working repeater, are based on finiteenergy considerations, thermal noise and the losses in the setup. In order to boost the performance of the studied repeaters we introduce two methods. The first one corresponds to the concept of a cutoff, which reduces the effect of decoherence during storage of a quantum state by introducing a maximum storage time. Secondly, we supplement the standard classical postprocessing with an advantage distillation procedure. Using these methods, we find realistic parameters for which it is possible to achieve rates greater than each of the benchmarks, guiding the way towards implementing quantum repeaters.
pacs:
03.67.aI Introduction
Quantum communication enables the implementation of tasks with qualitative advantages with respect to classical communication, including secret key distribution Bennett and Brassard (1984); Ekert (1991), clock synchronization Giovannetti et al. (2001) and anonymous state transfer Christandl and Wehner (2005). Unfortunately, the transmission of both classical and quantum information over optical fibres decreases exponentially with the distance. While the problem of losses applies both to classical and quantum communication, classical information can be amplified at intermediate nodes, preventing the signal from dying out and thus increasing the rate of transmitted information. At the same time, the existence of a quantum analogue of a classical amplifier is prohibited by the nocloning theorem Wootters and Zurek (1982). Fortunately, in principle it is possible to construct a quantum repeater to increase the rate of transmission without having to amplify the signal Briegel et al. (1998); Munro et al. (2015). Hence, the construction of a quantum repeater would represent a fundamental milestone towards long distance quantum communications.
Many quantum repeater proposals require significant resources and are thus not within experimental reach. However, the recent experimental progress in the development of quantum memories Reiserer et al. (2016); Lvovsky et al. (2009); Specht et al. (2011) has brought the realisation of a quantum repeater closer to reality. In this paper, we evaluate a realistic setup of a socalled single sequential quantum repeater for the specific task of quantum key distribution. The setup considers two parties which we call Alice and Bob who are spatially separated, and want to generate a shared secret key. They use a single sequential quantum repeater Luong et al. (2016) located between Alice and Bob, where both of them are connected to the quantum repeater by optical fibre. The repeater is composed of two quantum memories, both of which have the ability to become entangled with a photon, see FIG. 1. However, the repeater has a single photonic interface which means that it can only address Alice and Bob in a sequential fashion. Examples where only one of the qubit memories has an interface to the photonic channel include modular ion traps Hucul et al. (2015) and nitrogenvacancy centres in diamond Blok et al. (2015); Reiserer et al. (2016); Gao et al. (2015). The situation is similar for atoms or ions trapped in a single cavity Reiserer and Rempe (2015). In this case, both memories can have a photonic interface. However, typically only one of the interfaces can be active at a given moment.
The figure of merit that we have chosen to evaluate the repeater is the secretkey rate. That is, the ratio between the number of generated secret bits and the number of uses of the quantum channel connecting the two parties. We compare the secretkey rate achievable with the repeater with a set of benchmarks that we introduce here. The most strict of these benchmarks is the capacity of the channel Wilde (2013). That is, the optimal secretkey rate achievable over optical fibre unassisted by a quantum repeater. The other benchmarks correspond to the optimal rates achievable with additional restrictions. In consequence, these benchmarks form a set of stepping stones towards the first quantum repeater able to produce a secure key over large distances.
The idea of assessing quantum repeaters by comparing with the optimal unassisted rates Takeoka et al. (2014a); Goodenough et al. (2016); Pirandola et al. (2017); Wilde and Qi (2016); Wilde et al. (2017); Pirandola and Laurenza (2015); Christandl and MüllerHermes (2016); Bardhan and Wilde (2014) has spurred a significant amount of research devoted to developing sophisticated repeater proposals. Analysis of practical systems that utilise only parametric downconversion sources and optical measurement setups Khalique and Sanders (2015) has shown that such systems do not allow for overcoming the channel capacity, which hints at the importance of quantum memories in repeater architectures. Specific architectures that utilise entangledphoton pair sources together with multimode quantum memories have also been considered in this context Guha et al. (2015); Krovi et al. (2016). Their analysis suggests that the required efficiency of those entangledphoton pair sources and number of storage modes might be experimentally very challenging for implementation in the very near future. Finally, the so called alloptical repeaters that do not require quantum memories but allow to overcome the channel capacity have been proposed Pant et al. (2017). However, they necessitate the ability to create large photonic cluster states which are beyond current experimental capabilities.
A detailed analysis of a realistic, singlenode proof of principle repeater that includes all the specific system imperfections has been recently performed Luong et al. (2016). In particular, the analysis identified parameter regimes where it would be possible to surpass the optimal direct transmission rates with a repeater scheme that is close to experimental implementation. We build upon the analysis of Luong et al. (2016) by introducing two methods that allow us to achieve higher rates. The first of these methods is the introduction of a maximum storage time for the memories in the quantum repeater. This restriction effectively reduces the effect of decoherence. We derive tight analytical bounds for the secretkey rate as a function of the maximum storage time. In this way we can perform efficient optimisation of the secretkey rate over the maximum storage time. The second of these methods is advantage distillation Gottesman and Lo (2003), a twoway classical postprocessing technique that allows for distilling secret key at a higher rate than achievable with only oneway postprocessing.
The structure of the paper is as follows. In Section II we detail our key distribution protocol. The sources of errors, such as losses in the apparatus and noisy operations and storage, are discussed in Section III. In Section IV, we calculate the secretkey rate that the single sequential quantum repeater would achieve. We define the benchmarks in Section V, and in Section VI we numerically explore the parameter regimes for which the quantum repeater implementation overcomes each benchmark and how the proposed protocol scales as a function of the distance. We end in Section VII with some concluding remarks.
Ii Protocol for a single sequential quantum repeater
A quantum key distribution protocol consists of two main parts. First, Alice and Bob exchange quantum signals over a quantum channel and measure them to obtain a raw key that is postprocessed in a second, purely classical part into a secure key Scarani et al. (2009). Here, we focus our interest on the entanglementbased version of the BB84 Bennett and Brassard (1984) and the sixstate Bruß (1998) protocols. In this section, we describe the first part of both key distribution protocols.
The physical setup consists of two spatially separated parties Alice and Bob connected to an intermediate repeater via fibre optical channels. We note that such a repeater does not need to be positioned exactly halfway between Alice and Bob. The repeater is composed of two qubit quantum memories which we denote by and . The repeater is then able to generate memoryphoton entanglement, where the photonic degree of freedom in which the qubits are encoded could depend on the physical system, e.g. timebin or polarisation encoding. Alice and Bob each have an optical detector setup that performs a BB84 or a sixstate measurement. For technical reasons (see Section III), we consider slightly different setups for BB84 and sixstate. More concretely, for BB84 we consider an active setup that switches randomly between the two measurement bases, while in the sixstate protocol we consider a passive setup that chooses between the three measurement bases by a passive optical construction Gittsovich et al. (2014).
Let us now describe a first version of the protocol without a maximum storage time. First, the quantum repeater attempts to generate an entangled qubitqubit state between a photon and the first quantum memory , after which the photon is sent through a fibre to Alice. Such a trial is attempted repeatedly until a photon arrives at Alice’s side, after which Alice performs either a BB84 or a sixstate measurement. Second, the quantum repeater attempts to do the same on Bob’s side with the second quantum memory while the state in is kept stored. We denote the number of trials performed until a photon arrives at Alice’s and Bob’s sides and respectively. After Bob has received and measured a photon, a Bell state measurement is performed on the two states in and . We denote by the probability that the measurement succeeds. The classical outcome of the Bell state measurement is communicated to Bob. This concludes a single round of the protocol. We note that in this protocol every round ends with a successful generation of one bit of raw key.
One of the main problems in a quantum repeater implementation is that a quantum state will decohere when it is stored in a quantum memory. This means that if it takes Bob a large amount of trials to receive a photon, the state in the quantum memory will have significantly decohered, preventing the generation of secret key. This motivates the introduction of a cutoff. A cutoff is a limit on the amount of trials that Bob can attempt to receive a photon. We denote this maximum number by .
The protocol that we consider here, modifies the protocol described above as follows: if in a given round Bob reaches the cutoff without success, the round is interrupted and a new round starts from the beginning with the quantum repeater again attempting to send a photon to Alice. In this scheme a large number of rounds might be required until a single bit of raw key is successfully generated. See Algorithm 1 for a description of the modified protocol with the cutoff.
Iii Sources of errors
In this section, we model the different elements in the setup to identify the sources of losses and noise. The losses in the system are not only due to the transmissivity of the fibre; depending on the implementation a significant amount of photons is lost before they enter the fibre or due to the nonunit detector efficiency. The causes of noise are the experimental imperfections of the operations, measurements and quantum memories.
Losses
We model the process of generating and sending an entangled photon through a fibre as follows (see FIG. 2). First, the photon has to be generated at some photon source and be captured in the fibre. This process happens with probability . Depending on the experimental implementation, only a fraction of the photons entering the fibre can be used for secret key generation. This can occur for any number of reasons, for instance photons might be filtered according to frequency or a certain timewindow Reiserer and Rempe (2015); Gao et al. (2015). The filtering can happen either before or after the transmission through the fibre. The fibre losses are modelled as an exponential decay of the transmissivity with the distance , i.e. for some fibre attenuation length . We denote by the fibre losses on Alice’s side and by the fibre losses on Bob’s side. Finally, the arriving photons will be captured by the detectors with an efficiency . This probability of detecting a photon will be increased by the presence of dark counts (which will also inevitably add noise to the system), see the discussion of the dark counts at the bottom of this section and in Appendix A. We define the quantity describing the total efficiency of our apparatus.
Noise
We model all noise processes either by the action of a dephasing channel
(1) 
or that of a depolarising channel
(2) 
where the parameters and quantify the noise, is the qubit gate and is the maximally mixed state. The noise processes occur due to imperfect operations, decoherence of the state while stored in and dark counts in the detectors.
The noise from imperfect quantum operations is captured by two parameters: and . is a dephasing parameter which corresponds to the preparation fidelity of the memoryphoton entangled state Togan et al. (2010). is a depolarising parameter that describes the noise introduced by the imperfect gates and measurements performed on the two quantum memories during the protocol Cramer et al. (2016). Hence, the noise can be modelled by a dephasing and a depolarising channel with and .
The decoherence is modelled by a decay of the fidelity in the number of trials . This decoherence is caused by two distinct effects. Firstly, there is the decoherence due to the time that the quantum repeater has to wait between sending photons. This time is the time it takes to confirm whether the photon got lost plus the time it takes to generate a photon entangled with the memory. We model this effect through an exponential decay of fidelity with time, which is expected whenever excess dephasing is suppressed (e.g. by dynamical decoupling De Lange et al. (2010)). However, we note that this is not the only possible model of decay, in several experiments a Gaussian decay has been observed Specht et al. (2011); Hucul et al. (2015); Sangouard et al. (2011); Thiel et al. (2011). Secondly, attempting to generate an entangled photonmemory pair at might also decohere the state stored in the . The latter effect is the most prominent decoherence mechanism in nitrogenvacancy implementations Reiserer et al. (2016), for example, where an exponential decay of fidelity with number of trials was observed. This is also how we model that effect here.
The quantum state that is subjected to those effects undergoes an evolution given by the dephasing and depolarising channels with and . The two parameters and are given by
(3)  
(4) 
where is the refractive index of the fibre, is the speed of light in vacuum, the distance from the quantum repeater to Bob and is the time it takes to prepare for the emission of an entangled photon. Here and quantify the noise due to a single attempt at generating an entangled state and and quantify the noise during storage per second. Finally, the dark counts in the detectors introduce depolarising noise, this model is justified for the two quantum key distribution protocols that we consider, see Gittsovich et al. (2014); Beaudry et al. (2008). We let denote the corresponding depolarising parameter on Alice’s/Bob’s side. The details of this model are presented in Appendix A.
Iv Secretkey rate of a single sequential quantum repeater
The secretkey rate is defined as the amount of secretkey bits generated by a protocol divided by the number of channel uses and the number of optical modes. In the particular case of our sequential quantum repeater, the secretkey rate is given by
(5) 
The yield of the protocol is defined as the rate of raw bits per channel use. The secretkey fraction is defined as the average amount of secret key that can be extracted from a single raw bit. The factor of a half is due to the fact that the encoding uses two optical modes. Since we consider two possible quantum key distribution protocols we take
(6) 
where and are the secretkey fractions of BB84 and the sixstate protocols respectively (see Eq. (12) and Appendix C).
Yield
The yield can be calculated as (i.e. the success probability of the Bell state measurement) divided by the (average) number of channel uses needed for the successful detection of a photon by both Alice and Bob in the same round. With a single sequential quantum repeater it is not obvious how to count the number of channel uses. As in Luong et al. (2016), we count the maximum of the two channel uses on Alice’s and Bob’s sides respectively,
(7) 
where , and are the random variables that model the number of channel uses, the number of channel uses at Alice’s side and the number of channel uses at Bob’s side, respectively.
Without the cutoff, it is possible to obtain an analytical formula for the average number of channel uses Panayi et al. (2014); Luong et al. (2016),
(8) 
where and depend on the quantum key distribution protocol and are given by the following equations (see Appendix A),
(9)  
(10) 
Every time that Bob reaches trials, Alice and Bob restart the round and start over again. The cutoff thus increases the average number of channel uses. We have developed an analytic approximation of which is essentially tight (see Appendix D for the derivation and error bounds)
(11) 
Secretkey fraction
Here we consider the secretkey fraction of the BB84 and sixstate protocols. As we discussed previously, we consider the BB84 protocol with an active measuring scheme and the sixstate protocol with a passive one. Moreover, we consider a fully asymmetric version of BB84 and a fully symmetric version of sixstate. Fully symmetric means that all bases are used with equal probability while fully asymmetric means that the ratio at which one of the bases is used is arbitrarily close to one. Finally, we consider a oneway key distillation scheme for BB84 Scarani et al. (2009) while for the sixstate protocol we consider the advantage distillation scheme in Watanabe et al. (2007). Advantage distillation Gottesman and Lo (2003) is a classical postprocessing technique that allows to increase the secretkey fraction at all levels of noise.
The reasons for not analysing the BB84 protocol with advantage distillation and the fully asymmetric sixstate with advantage distillation are technical. In the case of BB84, computing the rate with advantage distillation requires the optimisation over a free parameter. The combination of the optimisation over the cutoff together with the extra free parameter was computationally too intensive.
For the sixstate protocol there is, to our knowledge, no security proof that can deal with the fully asymmetric sixstate protocol with photonic qubits without introducing extra noise Gittsovich et al. (2014); Ballester et al. (2008). However, these protocol choices do not have a strong impact on our analysis. Advantage distillation does not significantly increase the amount of distillable key for low error rates. Hence, asymmetric BB84 without advantage distillation is only slightly suboptimal. For higher error rates, where advantage distillation plays a role, the symmetric sixstate protocol with advantage distillation is a factor of three away from the asymmetric version.
The expression for the secretkey fraction of both protocols depends on the error rates in the , and bases, which we denote by , and . In the case of the BB84 protocol, Scarani et al. (2009); Lo et al. (2005) it is given by
(12) 
where is the binary entropy function. The expression for is more complex. We leave its discussion to Appendix C.
We can directly evaluate the error rates in each basis as a function of the general parameters of Section III. For our single sequential quantum repeater these average errors are
(13) 
where is the average of the exponential over a geometric distribution over the first trials. The detailed derivation of the error expressions is presented in Appendix B.
V Benchmarks for the assessment of quantum repeaters
We introduce a set of benchmarks to assess the performance of a quantum repeater implementation.
The first benchmark that we consider is the rate that would be achieved with the same parameters for the system losses and dark counts and for the same protocol but without a quantum repeater. Overcoming this benchmark gives the first indication that the repeater setup is useful; it means that the repeater setup outperforms the setup without repeater. We call this benchmark the direct transmission benchmark.
The remaining benchmarks represent the optimal secretkey rate that Alice and Bob could achieve if they were to communicate over the same quantum channel without a repeater under some constraints.
The optimal secretkey rate without a repeater highly depends on the channel model. The first modelling decision is the placement of the boundary between Alice’s and Bob’s laboratories and the quantum channel.
This is because it is not a priori clear where the channel begins and ends. However, this decision has a strong impact on the optimal achievable rate; if the channel includes most of Alice’s and Bob’s laboratories, then the channel is more lossy and noisy and the benchmark is easier to overcome. If, on the other hand, the channel is just the fibre optical cable the benchmark becomes more difficult to overcome.
We consider three cases in terms of the individual lossy components of our setup (see FIG. 1, FIG. 2 and their captions):

Fibre only, in this case the transmissivity is: .

Fibre and different filters, then the channel transmissivity becomes: .

Fibre, filters and Alice’s and Bob’s apparatus, then the transmissivity becomes: .
Note that although in the experimental implementation of the repeater the terms and appear twice in the expression of the transmissivity, they appear only once in the benchmarks which include them. The reason is that in a scenario without a repeater the emission inefficiency and the filters only affect the transmissivity once.
The second design parameter for these benchmarks is the type of channel. Transmission of photons through fibres is modelled as a pureloss channel Weedbrook et al. (2012), where only a fraction of the input photons reach the end of the channel. The first type of channel that we consider is the pureloss channel without any additional restriction. The optimal achievable rate over one mode of the pureloss channel is given by the secretkey capacity Pirandola et al. (2017)
(14) 
Note that for high losses the scaling of this capacity with distance is proportional to . At the same time with an ideal (noiseless) single quantum repeater placed halfway between Alice and Bob, the expected secretkey rate would scale proportionally to Luong et al. (2016).
The second type of channel that we consider is the pureloss channel when the transmitter has a limitation in the energy that can be introduced into the channel. There has been some recent work studying the optimal rate per mode of the finiteenergy pureloss channel Takeoka et al. (2014b); Goodenough et al. (2016); Wilde and Qi (2016). However, the optimal rate remains unknown. The bound that we consider here Takeoka et al. (2014b) is given by
(15) 
where and is the mean photon number. In our repeater setup, the finite energy restriction arises from the fact that, on average, only a fraction of a photon enters the fibre in each trial. More precisely, the average photon number satisfies in cases 1 and 2 above and in case 3. Unfortunately, since Eq. (15) is an upper bound, it is only strictly smaller than the capacity of the pureloss channel for small mean photon number. Expanding the bounds from equations (14) and (15) around shows that the crossover between the two bounds occurs when . In other words, for high losses the finiteenergy bound is tighter when . This implies that the finiteenergy bound does not yield an interesting benchmark in case 3.
The third type of channel that we consider is the thermalloss channel. An upper bound on the capacity of the thermalloss channel is
(16) 
if and zero otherwise Pirandola et al. (2017). Here, is the average number of thermal photons per channel use Weedbrook et al. (2012). This is an interesting channel because the effect of dark counts can be seen as caused by the thermal photons. Hence this type of channel becomes relevant for case 3, where detectors, and therefore also the dark counts, are regarded as part of the channel. The details of the dark count model are presented in Appendix A. There we also show how to easily convert the experimentally relevant dark count rate of the detector and the duration of the detection window into and , the probability of getting a dark count within the given time window.
The combinations of a channel boundary together with a channel type give us a set of benchmarks. Not all combinations yield interesting benchmarks. In Table 1, we summarise the benchmarks that we consider.
Infinite  Finite  Thermal  Direct transmission  
Case 1:  1a  1b  
Case 2:  2a  2b  
Case 3:  3c  3d 
Vi Numerical results
In this section, we perform a numerical analysis of our model applied to a specific physical system. In particular, we have chosen a setup based on nitrogenvacancy centres in cavities kept at cryogenic temperatures. All numerical results have been obtained using a Mathematica notebook Not (). Unless specified otherwise, we use the following parameters that we call “expected parameters”:
Before we present the results, we note that the emission frequency of the nitrogenvacancy centres results in a relatively low which in turn does not allow to achieve large distances. In practical quantum key distribution networks, this problem might be overcome using the frequency conversion of the emitted photons into the telecom frequency for which km Radnaev et al. (2010). However, this conversion process is usually probabilistic which results in lower rates. Since the main objective of this paper is the study of the regimes where the various benchmarks could be overcome, the frequency conversion is not included in our numerical results.
Tightness of the error bounds for the secretkey rate. We have derived upper and lower bounds on the yield, and thus also on the secretkey rate, for the two studied protocols.
In FIG. 3, we plot both the upper and the lower bound on the achieved rate with the current and improved parameters ( and ) and optimised cutoff as a function of the distance in units of . There are two regimes visible on the plot. This is a consequence of the fact that our bounds have a different analytical form in the two regimes (see Appendix D).
Since for practical purposes our bounds are essentially tight, from now on we will refer to the upper bound as the expected secretkey rate, and will omit the lower bound for the legibility of the plots.
The impact of the cutoff on the secretkey rate. In FIG. 4 we plot the secretkey rate versus the cutoff for different sets of parameters. The repeater is assumed to be positioned halfway between Alice and Bob. We observe a strong dependency of the secretkey rate on the cutoff. In particular, for large cutoff the secretkey rate drops to zero. This is due to the inclusion of rounds where the state has significantly decohered. This implies that the cutoff is essential for generating a key at large distances. Moreover, we observe that the optimal cutoff highly depends on the explored parameter regime.
Optimal positioning of the repeater. The asymmetry of the studied sequential protocol raises the question of whether it is best to position the repeater halfway between Alice and Bob. In fact, in the absence of a cutoff this is not the case Luong et al. (2016). For sufficiently large distances, shifting the repeater towards Bob can increase both the secretkey rate and the distance over which the secretkey rate is nonzero in the presence of dark counts. Specifically, the optimal positioning remains a fixed distance away from Bob independently of the actual total distance. Here, we find that with the cutoff and for the parameters considered this phenomenon disappears. We see in FIG. 5 that the optimal position with the cutoff optimisation appears to be exactly in the middle of Alice and Bob. Nevertheless, we note that the bounds for the yield derived in Appendix D are valid under the condition . This means that we can only study the effect of moving the repeater towards Bob. However, we do not expect any benefit in shifting the repeater towards Alice as this could only increase the noise due to decoherence. From now on for the scenarios with the cutoff optimisation, we always consider the repeater to be placed halfway between Alice and Bob. Interestingly, in FIG. 5 we also see that the rates for the two scenarios with and without the cutoff start to coincide after the quantum repeater is shifted within a certain distance of Bob. Intuitively this happens when the probability of Bob getting a photon is large enough so that the significance of the cutoff becomes marginal.
Cutoff versus no cutoff. Having established the optimal positioning of the repeater, we can now compare the two scenarios: optimised cutoff with middle positioning of the repeater and no cutoff with optimised positioning. We find that in the absence of dark counts the scaling with distance of both schemes is the same, with a small advantage of the cutoff scheme. However, the cutoff is more robust against dark counts. Hence, for imperfect detectors the cutoff allows distributing keys at larger distances. These results can be seen in FIG. 6 and FIG. 7, which show the secretkey rate as a function of distance for detectors without and with dark counts, together with the channel capacity of the optical fibre (i.e. benchmark 1a). We plot the data for the expected and improved parameters ( and ).
In FIG. 6 where we assume no dark counts, we see that for small distances the rate scales approximately with the square root of the transmissivity for both scenarios. That is, they are proportional to the theoretical optimum Luong et al. (2016) of . For sufficiently large distances timedependent decoherence of the memory becomes a problem. Both schemes overcome it at the expense of reducing the yield. As a result, the scaling becomes proportional to for both schemes. In FIG. 7 however we see that the presence of dark counts affects the two schemes quite differently. While for both schemes the effect of dark counts becomes the dominant source of noise after a certain distance, this distance is shorter for the no cutoff scheme than for the scheme with the cutoff. In other words, we see that the cutoff is more robust towards dark counts than the repositioning method. This fact can be explained by noting that shifting the repeater towards Bob increases the losses on Alice’s side and as a result makes the link Alicerepeater vulnerable to dark counts. With the cutoff however, the repeater remains in the middle making both of the individual links Alicerepeater and repeaterBob shorter than the Alicerepeater link in the no cutoff scheme. As a result the setup with the cutoff and with the improved parameters allows us to clearly overcome the channel capacity (1a), which is barely surpassed without it.
Comparison with the proposed benchmarks. Let us now investigate the secret key rate achievable with the expected parameters and how it compares with the proposed benchmarks. The comparison is depicted in FIG. 8. The benchmarks corresponding to direct transmission (3d) and the thermalloss channel (3c) are outperformed. The other benchmarks are not overcome but are within experimental reach.
Parameter tradeoff. Let us now give a general overview of how good the improved parameters need to be in order to overcome individual benchmarks. This information is presented on two contour plots. In FIG. 9, we study the parameter regions for which it is possible to beat the benchmarks in Table 1 as a function of and .
A similar plot as a function of and can be seen in FIG. 10. We omit here the direct transmission benchmark which, as we have already seen, can be easily surpassed with the expected parameters. Moreover, we note that the capacity of the thermal channel in the benchmark (3c) goes to zero for very low and for which it is still possible to generate key with the quantum repeater. Hence it is trivially easy to beat this benchmark for low and . In that sense this benchmark is not so interesting in that regime. It is for this reason that this regime is not depicted on the contour plots. In both FIG. 9 and FIG. 10 we observe a crossing between the finite energy benchmarks (1b) and (2b) and their infinite energy counterparts (1a) and (2a) at as discussed in Section V.
Vii Conclusions
In this work, we have analysed numerically a realistic quantum repeater implementation for quantum key distribution. We have introduced two methods for improving the rates of the repeater with respect to previous proposals: advantage distillation and the cutoff. Advantage distillation is a classical postprocessing method that increases the secretkey rate at all levels of noise. The cutoff on the other hand allows for a tradeoff between the channel uses required and the secretkey fraction. Utilising the cutoff results in three benefits with respect to the previous scheme for the single sequential quantum repeater Luong et al. (2016). Firstly, the cutoff method achieves a higher rate for all distances. Secondly, the protocol is more robust against dark counts, in the sense that nonzero secret key can be generated over larger distances. Finally, the cutoff can be adjusted on the fly, unlike the repositioning of the repeater Luong et al. (2016). This is especially convenient in the scenario where the experimental setup might be modified. With the previous scheme for example, improving the coherence times of the memories would lead to a new optimal position. The repositioning of the repeater node would be both costly and timeinefficient, while modifying the cutoff corresponds to a simple change in the programming of the devices.
By optimising over the cutoff, we have found realistic parameter regions where it is possible to surpass several different benchmarks including the secretkey capacity. These benchmarks are relevant milestones towards claiming a quantum repeater, and thus form an important step in the creation of the first largescale quantum networks. To make our arguments concrete, we have chosen a specific parameter set induced by some recent experimental results. However, other platforms or technological advances might allow to improve upon our results and predict particularly simple setups for performing the first quantum repeater experiment. We leave the investigation of other parameter regimes open. In this respect our model has a very broad functionality, as it allows us to perform efficient optimisation of the secretkey rate over the cutoff for any set of parameters. We achieve this functionality by finding tight analytical bounds for the number of channel uses needed to generate one bit of raw key as a function of the cutoff. Our numerical package is freely available for further exploration Not ().
Viii Acknowledgements
The authors would like to thank Suzanne van Dam, Peter Humphreys, Thinh Le Phuc and Mark Steudtner for helpful discussions and feedback, and Dmytro Vasylyev for the illustrations of Alice and Bob. This work was supported by the Dutch Organization for Fundamental Research on Matter (FOM), Dutch Technology Foundation (STW), the Netherlands Organization for Scientific Research (NWO) through a VICI grant (RH), a VIDI grant (SW) and the European Research Council through a Starting Grant (RH and SW).
References
 (1) Available on demand.
 Ballester et al. (2008) Ballester, M. A., Wehner, S., and Winter, A. State discrimination with postmeasurement information. IEEE Transactions on Information Theory, 54(9):4183–4198, 2008.
 Bardhan and Wilde (2014) Bardhan, B. R. and Wilde, M. M. Strong converse rates for classical communication over thermal and additive noise bosonic channels. Physical Review A, 89(2):022302, 2014.
 Beaudry et al. (2008) Beaudry, N. J., Moroder, T., and Lütkenhaus, N. Squashing models for optical measurements in quantum communication. Physical review letters, 101(9):093601, 2008.
 Bennett and Brassard (1984) Bennett, C. H. and Brassard, G. Quantum cryptography: Public key distribution and coin tossing. In International Conference on Computer System and Signal Processing, IEEE, 1984, pages 175–179, 1984.
 Blok et al. (2015) Blok, M., Kalb, N., Reiserer, A., Taminiau, T., and Hanson, R. Towards quantum networks of single spins: analysis of a quantum memory with an optical interface in diamond. Faraday discussions, 184:173–182, 2015.
 Bogdanovic et al. (2017) Bogdanovic, S., van Dam, S. B., Bonato, C., Coenen, L. C., Zwerver, A., Hensen, B., Liddy, M. S., Fink, T., Reiserer, A., Loncar, M., and Hanson, R. Design and lowtemperature characterization of a tunable microcavity for diamondbased quantum networks. Applied Physics Letters, 110(17):171103, 2017.
 Briegel et al. (1998) Briegel, H.J., Dür, W., Cirac, J. I., and Zoller, P. Quantum repeaters: The role of imperfect local operations in quantum communication. Physical Review Letters, 81(26):5932, 1998.
 Bruß (1998) Bruß, D. Optimal eavesdropping in quantum cryptography with six states. Physical Review Letters, 81(14):3018, 1998.
 Christandl and MüllerHermes (2016) Christandl, M. and MüllerHermes, A. Relative entropy bounds on quantum, private and repeater capacities. arXiv preprint arXiv:1604.03448, 2016.
 Christandl and Wehner (2005) Christandl, M. and Wehner, S. Quantum anonymous transmissions. In International Conference on the Theory and Application of Cryptology and Information Security, pages 217–235. Springer, 2005.
 Cramer et al. (2016) Cramer, J., Kalb, N., Rol, M. A., Hensen, B., Blok, M. S., Markham, M., Twitchen, D. J., Hanson, R., and Taminiau, T. H. Repeated quantum error correction on a continuously encoded qubit by realtime feedback. Nature communications, 7, 2016.
 De Lange et al. (2010) De Lange, G., Wang, Z., Riste, D., Dobrovitski, V., and Hanson, R. Universal dynamical decoupling of a single solidstate spin from a spin bath. Science, 330(6000):60–63, 2010.
 Ekert (1991) Ekert, A. K. Quantum cryptography based on Bell’s theorem. Physical review letters, 67(6):661, 1991.
 Gao et al. (2015) Gao, W., Imamoglu, A., Bernien, H., and Hanson, R. Coherent manipulation, measurement and entanglement of individual solidstate spins using optical fields. Nature Photonics, 9(6):363–373, 2015.
 Giovannetti et al. (2001) Giovannetti, V., Lloyd, S., and Maccone, L. Quantumenhanced positioning and clock synchronization. Nature, 412(6845):417–419, 2001.
 Gittsovich et al. (2014) Gittsovich, O., Beaudry, N. J., Narasimhachar, V., Alvarez, R. R., Moroder, T., and Lütkenhaus, N. Squashing model for detectors and applications to quantumkeydistribution protocols. Physical Review A, 89(1):012325, 2014.
 Goodenough et al. (2016) Goodenough, K., Elkouss, D., and Wehner, S. Assessing the performance of quantum repeaters for all phaseinsensitive gaussian bosonic channels. New Journal of Physics, 18(6):063005, 2016.
 Gottesman and Lo (2003) Gottesman, D. and Lo, H.K. Proof of security of quantum key distribution with twoway classical communications. IEEE Transactions on Information Theory, 49(2):457–475, 2003.
 Guha et al. (2015) Guha, S., Krovi, H., Fuchs, C. A., Dutton, Z., Slater, J. A., Simon, C., and Tittel, W. Rateloss analysis of an efficient quantum repeater architecture. Physical Review A, 92(2):022357, 2015.
 Hensen et al. (2015) Hensen, B., Bernien, H., Dréau, A., Reiserer, A., Kalb, N., Blok, M., Ruitenberg, J., Vermeulen, R., Schouten, R., Abellán, C., et al. Loopholefree Bell inequality violation using electron spins separated by 1.3 kilometres. Nature, 526(7575):682–686, 2015.
 Hucul et al. (2015) Hucul, D., Inlek, I., Vittorini, G., Crocker, C., Debnath, S., Clark, S., and Monroe, C. Modular entanglement of atomic qubits using photons and phonons. Nature Physics, 11(1):37–42, 2015.
 Khalique and Sanders (2015) Khalique, A. and Sanders, B. C. Practical longdistance quantum key distribution through concatenated entanglement swapping with parametric downconversion sources. JOSA B, 32(11):2382–2390, 2015.
 Krovi et al. (2016) Krovi, H., Guha, S., Dutton, Z., Slater, J. A., Simon, C., and Tittel, W. Practical quantum repeaters with parametric downconversion sources. Applied Physics B, 122(3):1–8, 2016.
 Lo et al. (2005) Lo, H.K., Chau, H. F., and Ardehali, M. Efficient quantum key distribution scheme and a proof of its unconditional security. Journal of Cryptology, 18(2):133–165, 2005.
 Luong et al. (2016) Luong, D., Jiang, L., Kim, J., and Lütkenhaus, N. Overcoming lossy channel bounds using a single quantum repeater node. Applied Physics B, 122(4):1–10, 2016.
 Lvovsky et al. (2009) Lvovsky, A. I., Sanders, B. C., and Tittel, W. Optical quantum memory. Nature photonics, 3(12):706–714, 2009.
 Maurer et al. (2012) Maurer, P. C., Kucsko, G., Latta, C., Jiang, L., Yao, N. Y., Bennett, S. D., Pastawski, F., Hunger, D., Chisholm, N., Markham, M., et al. Roomtemperature quantum bit memory exceeding one second. Science, 336(6086):1283–1286, 2012.
 Munro et al. (2015) Munro, W. J., Azuma, K., Tamaki, K., and Nemoto, K. Inside quantum repeaters. Selected Topics in Quantum Electronics, IEEE Journal of, 21(3):1–13, 2015.
 Panayi et al. (2014) Panayi, C., Razavi, M., Ma, X., and Lütkenhaus, N. Memoryassisted measurementdeviceindependent quantum key distribution. New Journal of Physics, 16(4):043005, 2014.
 Pant et al. (2017) Pant, M., Krovi, H., Englund, D., and Guha, S. Ratedistance tradeoff and resource costs for alloptical quantum repeaters. Physical Review A, 95(1):012304, 2017.
 Pirandola and Laurenza (2015) Pirandola, S. and Laurenza, R. General benchmarks for quantum repeaters. arXiv preprint arXiv:1512.04945, 2015.
 Pirandola et al. (2017) Pirandola, S., Laurenza, R., Ottaviani, C., and Banchi, L. Fundamental limits of repeaterless quantum communications. Nature Communications, 8:15043 EP –, 04 2017. URL http://dx.doi.org/10.1038/ncomms15043.
 Radnaev et al. (2010) Radnaev, A., Dudin, Y., Zhao, R., Jen, H., Jenkins, S., Kuzmich, A., and Kennedy, T. A quantum memory with telecomwavelength conversion. Nature Physics, 6(11):894–899, 2010.
 Reiserer and Rempe (2015) Reiserer, A. and Rempe, G. Cavitybased quantum networks with single atoms and optical photons. Reviews of Modern Physics, 87(4):1379, 2015.
 Reiserer et al. (2016) Reiserer, A., Kalb, N., Blok, M. S., van Bemmelen, K. J., Taminiau, T. H., Hanson, R., Twitchen, D. J., and Markham, M. Robust quantumnetwork memory using decoherenceprotected subspaces of nuclear spins. Physical Review X, 6(2):021040, 2016.
 Riedel et al. (2017) Riedel, D., Söllner, I., Shields, B. J., Starosielec, S., Appel, P., Neu, E., Maletinsky, P., and Warburton, R. J. Deterministic enhancement of coherent photon generation from a nitrogenvacancy center in ultrapure diamond. arXiv preprint arXiv:1703.00815, 2017.
 Sangouard et al. (2011) Sangouard, N., Simon, C., De Riedmatten, H., and Gisin, N. Quantum repeaters based on atomic ensembles and linear optics. Reviews of Modern Physics, 83(1):33, 2011.
 Scarani et al. (2009) Scarani, V., BechmannPasquinucci, H., Cerf, N. J., Dušek, M., Lütkenhaus, N., and Peev, M. The security of practical quantum key distribution. Reviews of modern physics, 81(3):1301, 2009.
 Specht et al. (2011) Specht, H. P., Nölleke, C., Reiserer, A., Uphoff, M., Figueroa, E., Ritter, S., and Rempe, G. A singleatom quantum memory. Nature, 473(7346):190–193, 2011.
 Takeoka et al. (2014a) Takeoka, M., Guha, S., and Wilde, M. M. Fundamental rateloss tradeoff for optical quantum key distribution. Nature communications, 5, 2014a.
 Takeoka et al. (2014b) Takeoka, M., Guha, S., and Wilde, M. M. The squashed entanglement of a quantum channel. Information Theory, IEEE Transactions on, 60(8):4987–4998, 2014b.
 Thiel et al. (2011) Thiel, C., Böttger, T., and Cone, R. Rareearthdoped materials for applications in quantum information storage and signal processing. Journal of luminescence, 131(3):353–361, 2011.
 Togan et al. (2010) Togan, E., Chu, Y., Trifonov, A., Jiang, L., Maze, J., Childress, L., Dutt, M. G., Sørensen, A. S., Hemmer, P., Zibrov, A., et al. Quantum entanglement between an optical photon and a solidstate spin qubit. Nature, 466(7307):730–734, 2010.
 Watanabe et al. (2007) Watanabe, S., Matsumoto, R., Uyematsu, T., and Kawano, Y. Key rate of quantum key distribution with hashed twoway classical communication. Physical Review A, 76(3):032312, 2007.
 Weedbrook et al. (2012) Weedbrook, C., Pirandola, S., GarciaPatron, R., Cerf, N. J., Ralph, T. C., Shapiro, J. H., and Lloyd, S. Gaussian quantum information. Reviews of Modern Physics, 84(2):621, 2012.
 Wilde (2013) Wilde, M. M. Quantum information theory. Cambridge University Press, 2013.
 Wilde and Qi (2016) Wilde, M. M. and Qi, H. Energyconstrained private and quantum capacities of quantum channels. arXiv preprint arXiv:1609.01997, 2016.
 Wilde et al. (2017) Wilde, M. M., Tomamichel, M., and Berta, M. Converse bounds for private communication over quantum channels. IEEE Transactions on Information Theory, 63(3):1792–1817, 2017.
 Wootters and Zurek (1982) Wootters, W. K. and Zurek, W. H. A single quantum cannot be cloned. Nature, 299(5886):802–803, 1982.
Appendix A Dark counts
In this section we detail the effect of dark counts in the detectors of Alice and Bob on our protocol. In particular, we briefly go over the concept of socalled squashing models Gittsovich et al. (2014); Beaudry et al. (2008), after which we will be able to calculate the induced depolarising noise. We conclude with detailing how dark counts increase the yield.
Quantum states of light are naturally described by operators on an infinitedimensional Hilbert space. However, a significant number of optical experiments have been performed where the infinitedimensional states and operations are approximated by a lower dimensional description. An example of this is where the state of light is assumed to lie within a twodimensional subspace spanned by the vacuum state and a singlephoton excitation. Such an approximation is valid in the sense that the theoretical predictions of measurement statistics correspond accurately to those that are observed experimentally.
However, in cryptographic contexts one usually has to make unconditional statements about the information held by a third party. This third party might be malicious and allpowerful, and her measurement statistics are, by definition, unknown. This implies that there is not necessarily a bound on the information held by a malicious third party, despite the fact that the truncation of the Hilbert space is a good approximation for experimental statistics.
Since the theoretical analysis in a infinitedimensional Hilbert space is difficult, one would prefer to be able to bound the held information by a third party, while at the same time applying a truncation to the finitedimensional Hilbert space. This can be done if a socalled squashing model exists, which is a way of relating measurements performed on a highdimensional state to a truncated space. Squashing models exist for both the fully asymmetric BB84 protocol and the symmetric sixstate protocol (with only passive measurements), implying that one can, without loss of generality, perform the fully asymmetric BB84 and symmetric (passive) sixstate protocol with photons Gittsovich et al. (2014); Beaudry et al. (2008). The squashing model also dictates how multiple clicks in different detectors give rise to noise in the truncated space. In the next section, we discuss how to map the dark counts in the detectors to depolarising noise according to the corresponding squashing model.
The parameters typically used to quantify detectors are the dark counts per second and the detection window , which is the duration of the integration period of the detectors. The number of thermal photons relevant for the thermal benchmark is given by times the dark counts per second. Assuming a Poisson distribution of the dark counts, it follows that the probability of getting at least a single dark count click within the time window of awaiting the signal photon is given by for small .
The noise caused by the dark counts at Alice’s or Bob’s detector can then be modelled by a depolarising channel, where the depolarising parameter depends on the protocol implemented,
(17)  
(18) 
That is, conditioned on a click in at least one of the detectors, Alice or Bob receive the desired state if they receive the signal photon and no other detector was triggered. Due to the squashing map all other events can be mapped onto a maximally mixed state Gittsovich et al. (2014); Beaudry et al. (2008). To explain the exponents, we note that the active BB84 protocol requires an optical measurement setup with two detectors, while for the sixstate protocol such a measurement setup will consist of six detectors.
Furthermore, independent of the existence of a squashing map, the dark counts increase the total probability that Alice or Bob gets a click. This probability depends on whether the BB84 or sixstate protocol is implemented, and is given by
(19)  
(20) 
Appendix B Quantum bit error rate
In this Appendix we derive the expressions for the average quantum bit error rate as a function of the experimental parameters, such as the losses. These are given by
(21)  
(22) 
where the average is performed over the geometric distribution with only the first trials. That is, the average of the exponential is given by
(23)  
To derive these quantum bit error rates, let us firstly define the twoqubit bell states as
(24) 
for . The noise in the preparation can be modelled as dephasing noise Togan et al. (2010). The initially generated entangled state between the quantum memory and the state of the photon flying to Alice is then
(25) 
where is the preparation fidelity of this state. The state in the first quantum memory is now kept stored there. During this time, a second entangled photonmemory is attempted to be generated at the second quantum memory. During these attempts, the state stored in the first quantum memory decoheres through timedependent dephasing and depolarising noise acting on it. This means that at the time when the second copy is generated, the first copy will have decohered. This second copy will be of the same form as the first one. The decohered first copy is of the form
(26)  
where are respectively the depolarising and dephasing parameters due to the decoherence processes on the stored state in the first memory. The fidelity decays exponentially with the number of attempts Reiserer et al. (2016) and hence these parameters be written as
(27)  
(28) 
Here is the number of attempts that have been performed on the second memory to successfully generate the repeaterBob entanglement and the decay rates and are defined in the main text. Hence we can rewrite the state of as
(29) 
where
(30) 
The entanglement swapping is performed at the two memories at the repeater node. Since the situation is symmetric for all the four measurement outcomes, without loss of generality we can consider the resulting state on as if the repeater measured . If a different Bell state was measured, a Pauli rotation could be used to bring the state to this form. The state that we obtain is
(31)  
Finally we note that the operations such as Bell state measurements or any other required gates performed on the memories are also noisy. We will model them by the depolarising channel here Cramer et al. (2016). The depolarising channel commutes with the dephasing channel. For the two copies of the Belldiagonal state, it also commutes with the entanglement swapping, in the sense that applying it to one of our memory qubits is mathematically equivalent to applying the same channel to one of the photons flying to Alice or Bob. Hence independently of when exactly in the protocol those gates or measurements on the memories are applied, we can add the resulting depolarisation to the final state shared between Alice and Bob, so that we obtain
(32)  
Here by we denote the product of all the depolarising parameters corresponding to all noisy gates and measurements and corresponds to the noise caused by the dark counts on Alice’s/Bob’s side. From the final state it follows that
(33)  
(34) 
where the average is over the geometric distribution with only the first trials. This is due to the fact that, by construction, the state is never allowed to decohere more than trials.
Appendix C Secretkey fraction and advantage distillation
In this section the secretkey fraction formula for the sixstate protocol with advantage distillation of Watanabe et al. (2007) is briefly reviewed. We note here that while the analysis in Appendix B has the state as the target state, here we follow the analysis of Watanabe et al. (2007) for which is the target state. This doesn’t affect the overall analysis as the final state from Appendix B can be rotated locally such that could be made the target state. The secret key fraction can be expressed in terms of the Bell coefficients of the Bell diagonal state
(35) 
Here is a probability distribution and we will abbreviate as . For the description of the advantage distillation protocol we refer the reader to Watanabe et al. (2007). It is shown there that the secretkey fraction can be written as
(36) 
where
(37)  
(38) 
and
(39)  
(40)  
(41)  
(42) 
and is the Shannon entropy of the distribution . The factor of a third arises from the fact that for a symmetric sixstate protocol only a third of the measurements will be performed in the same basis by Alice and Bob.
In our model we only consider depolarising noise and dephasing noise in standard basis. Hence for the sixstate protocol the error rates in and basis will be the same. Therefore
(43)  
(44)  
(45)  
(46) 
Hence
(47)  
(48)  
(49) 
And so
(50)  
(51) 
Appendix D Yield
In this Appendix we derive the analytical approximation for the yield with the cutoff . The yield is given by
(52) 
The approximation used for is
(53) 
where and are defined in Eq. (19) for BB84 and in Eq. (20) for the sixstate protocol.
In the rest of this Appendix, we will motivate this approximation by finding tight analytical lower and upper bounds on the expression above.
We note that we consider separately two parameter regimes. One of them is the regime where on average the dominant number of channel uses per round is on Alice’s side . This corresponds to the highloss regime since the number of channel uses per round on Bob’s side is upper bounded by the cutoff. The other regime is the lowloss regime . In this regime we will show that the cutoff does not play any significant role, so that in this regime the formula for the yield with no cutoff Panayi et al. (2014); Luong et al. (2016) can be used. Moreover, for our derivation to be valid we require an additional constraint to be satisfied, namely . This means that we cannot consider scenarios when the repeater is positioned closer to Alice than to Bob. Such a constraint is welljustified since the timedependent decoherence in quantum memory would only increase by shifting the repeater towards Alice.
Highloss regime
The highloss regime is the regime where the losses on Alice’s side together with the cutoff on Bob’s side ensure that the predominant number of channel uses is almost always on Alice’s side, i.e. . This regime is described by the condition . More specifically, as we will show in this section, if
(54) 
then
(55) 
where (see Eq. (63)) and is a function defined in Eq. (82). This implies that for large enough, can be accurately approximated by .
We start the proof of equation (55) by first noticing that . It is, thus, only necessary to find an upper bound for . Now, let be the probability that Bob succeeds in round . Here is the probability that Bob succeeds in a given round. Then
(56) 
One can split the sum over in two, depending on whether is greater than or vice versa. We get
(57) 
where , and . The first term of Eq. (57) can be upper bounded noticing that , i.e.
(58) 
The second term of Eq. (57) can be upper bounded in the following way
(59)  
(60)  
(61) 
Inputting Eq. (58) and Eq. (61) back into Eq. (57), we obtain
(62) 
Let be the random variable describing the number of trials on Alice’s side in round . Since , we clearly have that . Then we note that
(63) 
Here, we first express by calculating the average number of trials in each of the rounds. Then, we sum the averages together, and finally, we average over the total number of rounds . Since all the rounds are independent, we replace each by as stated above. By inputting Eq. (63) into Eq. (62), we get
(64) 
We now upper bound the term. Note that
(65) 
We note that conditioned on , we have that . It then follows that