Secure quantum key distribution over 421 km of optical fiber
We present a quantum key distribution system with a 2.5 GHz repetition rate using a three-state time-bin protocol combined with a one-decoy approach. Taking advantage of superconducting single-photon detectors optimized for quantum key distribution and ultra low-loss fiber, we can distribute secret keys at a maximum distance of 421 km and obtain secret key rates of 6.5 bps over 405 km.
The first experimental demonstration of quantum key distribution (QKD) was over a short distance of 32 cm on an optical table Bennett et al. (1992). Since then, there has been a continuous progress on the theoretical and technological side such that nowadays commercial fiber-based systems are available IDQ () and the maximum distance has been pushed up to 400 km with academic systems Yin et al. (2016). Recently, the feasibility of satellite-based QKD has been demonstrated Liao et al. (2017), opening the door for world-wide key distribution for the lucky owners of satellites Liao et al. (2018).
The maximum distance of fiber-based systems is mainly limited by two factors. On one hand, the detector noise which, due to the exponential decrease of the signal, eventually becomes the dominant source of error and abruptly ends the possibility to extract a key. On the other hand, in the limit of arbitrarily low detector noise, it is the maximal acceptable key accumulation time. Indeed, taking into account finite key analysis, a secret key cannot be extracted with high confidence for short blocks of raw key. A system with high pulse rate and efficient detectors can therefore push this limit a bit further.
In this paper, we present an experiment that takes advantage of state-of-the-art performance on all fronts to push the limits to new heights. We rely on a new 2.5 GHz clocked setup Boaron et al. (2018), low-loss fibers, in-house-made highly efficient superconducting detectors Caloz et al. (2018) and last but not least a very efficient one-decoy state scheme Rusca et al. (2018a). Finally, we achieve an improvement of the secret key rate (SKR) by four orders of magnitudes with respect to a comparable experiment over 400 km.
We implement the protocol presented in Boaron et al. Boaron et al. (2018). For the sake of simplicity of the setup, we use a three-state time-bin scheme: two states in the basis (a weak coherent pulse in the first or the second time-bin, respectively) and one state in the basis (a superposition of two pluses in both time-bins). Moreover, we employ only two detectors. The finite-key security analysis of this scheme is briefly outlined below and detailed in Rusca et al. Rusca et al. (2018b). In order to be robust against photon number splitting attacks over long links (with high total loss) the decoy state method Wang (2005); Lo et al. (2005) is applied. In particular we use the one-decoy state approach, which was shown to be optimal for block sizes smaller than bits Rusca et al. (2018a). All pulses have random relative phase in order to render coherent attacks inefficient.
Figure 1 schematically shows our experimental realization. Alice’s and Bob’s setups are situated in two separated laboratories 20 m apart. Each of them is controlled by a field programmable gate array (FPGA).
Alice uses a phase-randomized diode laser pulsed at 2.5 GHz. Phase randomness is achieved by switching the current completely off between the pulses Kobayashi et al. (2014). The pulses then pass through an unbalanced Michelson interferometer (200 ps delay). One of its arms is equipped with a piezoelectric fiber stretcher to adjust the phase. The different qubit states are now encoded by a lithium niobate intensity modulator controlled by the FPGA. The qubit states and the pulse energies (signal or decoy state) are chosen at random. For this purpose, we rely on a quantum random number generator [ID Quantique, Quantis] which supplies 4 Mbps of random bits which are expanded to 40 Gbps using the NIST SP800-90 recommended AES-CTR cryptographically secure pseudo-random number generator.
Bob’s choice of measurement basis is made passively by a beamsplitter. In the basis, the photons are directly sent to a single-photon detector that measures their arrival time. This basis is used to generate the raw key. In the basis, used to estimate the eavesdropper information, an unbalanced interferometer identical to that of Alice allows to measure the coherence between two consecutive pulses. Only one detector is employed at the output of the interferometer.
The quantum channel (QC) is composed of spools of SMF-28 ultra low-loss (ULL) single-mode fiber (SMF) [Corning] which has an attenuation of about 0.16 dB/km (0.17 dB/km including the connections loss) and a positive chromatic dispersion of around 17 ps nm km. The ULL fiber consists of a pure silica core and a fluorine doped cladding. To reduce the impact of the chromatic dispersion, we pre-compensate it with dispersion compensation fiber (DCF) fabricated by Corning Inc. placed on Alice’s side. The DCF dispersion is around -140 ps nm km and its attenuation is about 0.5 dB/km.
The synchronization and communication between Alice’s and Bob’s devices is performed through a communication link, denoted as service channel (SC), based on small form-factor pluggable (SFP) transceivers connected through a short 50 m duplex fiber. For practicality, we use this fiber for all QC lengths. However, a SC of the same length as the QC (implemented with optical amplifiers) would offer better stability. Anyway, we compensate actively the fluctuations of the path length difference between the QC and the SC. For this purpose, the detectors signals are sampled at 10 GHz (i.e. only half of the bins are used for the sifting). The temporal tracking is performed by minimizing the ratio between the detections in the inactive and active bins. At the distances under study, we observed drifts having a sinusoidal behavior over one day, with amplitudes up to about 10 ns (which correspond to a 0.5 K difference in the average fiber temperature at 400 km). The intrinsic phase stability of our interferometers exceeds 10 minutes. Still, an automatic feedback loop also stabilizes the relative phase between Alice’s and Bob’s interferometers using the quantum bit error rate (QBER) in the basis as an error signal. The temporal tracking and the phase stabilization work in real time for distances up to 400 km. However, at the maximal distance (421 km), given the low detection rate, the statistical fluctuations of the error signal become too important to stabilize in real time. Therefore, we interrupt data acquisition after each block of error correction (EC) (about half an hour of acquisition) in order to perform an adjustment with a higher power of Alice’s signal.
The detection is done with two custom-made molybdenum silicide superconducting nanowire single-photon detectors (SNSPDs) cooled at 0.8 K Caloz et al. (2018). For SNSPDs, reducing the noise of the detectors implies filtering out black-body radiation present in the optical fiber leading to the detector. The black-body radiation around the laser wavelength (1550.92 nm) is eliminated using a standard 200 GHz fibered dense wavelength division multiplexer bandpass filter cooled to 40 K. Infrared light above 1550 nm is filtered by coiling the optical fiber just before the detector Smirnov et al. (2015). In this way, we achieve a dark count rate (DCR) of 0.1 Hz, which is close to the intrinsic DCR of the detectors. The maximum efficiencies of our detectors are between 40 to 60%, depending on the detector and on the filtering configuration. Because of the meander structure of the SNSPDs, the detection efficiency depends on the input polarization (the ratio between the minimum and maximum efficiencies is about ). This leads to slow variations of the detection rate, since we adjust the polarization of the light at the beginning of the runs, but do not perform any further adjustment during the acquisition. The system timing jitter of the detectors is lower than 40 ps.
The model of our protocol consists in a modification from the already proven to be secure three-state protocol Fung and Lo (2006); Tamaki et al. (2014); Mizutani et al. (2015). The difference stands in the fact that we have only one detector in the basis. Therefore, we do not have access to all measurements outcomes of the standard protocol. However, this does not affect the security of the protocol as demonstrated in Rusca et al. Rusca et al. (2018b). Note that the proof covers the security against collective attacks. However, given the phase-randomization of the states sent by Alice, the results can be extended to coherent attacks using techniques such as Azuma’s inequality Azuma (1967); Boileau et al. (2005); Tamaki et al. (2009) or De Finetti’s theorem Caves et al. (2002); KÃ¶nig and Renner (2005).
The secure key bits per privacy amplification block is given by Rusca et al. (2018a):
where and are the lower bound on the number of vacuum and single-photon detections in the basis, is the upper bound on the phase error rate, is the total number of bits revealed during the EC, and and are the secrecy and correctness parameters, respectively.
|length||attn||block size||block time||QBER||RKR||SKR|
We performed key exchanges with fiber lengths between 252 and 421 km. For every distance we optimized the following experimental parameters to maximize the SKR. On Alice’s side, we varied the probability of choosing the and basis, the mean photon number of the two decoy states and and their respective probabilities. On Bob’s side, we used different detectors following a trade-off between high efficiency and low DCR. The latter criterion becomes increasingly important with increasing distances. For simplicity, Bob’s probability of choosing the and basis was kept constant to , which is a good value at long distances to minimize the penalty due to the finite-key analysis in both bases.
Table 1 summarizes the experimental settings and the results obtained for each distance. Figure 2 shows the SKR as a function of the distance. At shorter distances, the QBER is mainly due to the imperfect preparation of the states by Alice (in particular due to limited extinction ratio of the intensity modulator). Indeed, the errors caused by the timing jitter of the detectors should not exceed 0.1% thanks to the small and Gaussian-shaped timing jitter of SNSPDs. Given our detection method with a 10 GHz sampling (the bins are 100 ps wide), a detection has to occur 150 ps away from the central timing to generate an error. For a 40 ps jitter, this corresponds to more than 3, leading to an error probability smaller than 0.1%. (We would expect this value to be at least one order of magnitude bigger for avalanche photodiode single-photon detectors Boaron et al. (2018).)
The contribution of the DCR to the QBER becomes significant only above 350 km. At this distance the imperfect temporal tracking due to faster variation and lower error signal starts to contribute as well. Similarly, the phase error rate is additionally affected by the imperfect stabilization of the interferometers.
For 405 km and 421 km, in order to keep the acquisition time shorter than one day, we reduced the privacy amplification block size by more than a factor of ten compared to shorter distances. The finite-key analysis leads therefore to lower SKRs that are about half of the SKRs one would obtain in the case of infinite keys.
To obtain the 421 km point, we run the system over three periods corresponding to a total of 24.2 h of acquisition time, including the necessary interruptions for alignment. 39 EC blocks were generated of which we kept the 25 blocks with the best performance. This allowed us to extract 22124 secret bits, which corresponds to a SKR of 0.25 bps. Considering only the time necessary to exchange the 25 EC blocks (12.7 h), we obtain a SKR of 0.49 bps.
To demonstrate the long-term operation capability of our system, we run it over a continuous period of more than 24 h at a transmission distance of 302 km. The phase stabilization and temporal alignment were performed automatically by the control software. The relevant experimental results are shown in figure 3 as a function of time. Fluctuations of the raw key rate (RKR) are mainly due to polarization fluctuations of the signal arriving at Bob’s side.
Figure 2 also shows a comparison of our experimental results with other QKD realizations. 421 km is the maximal transmission distance reported for a QKD system in fiber. Compared to the previous record Yin et al. (2016), at 405 km, the rate is improved by four orders of magnitude. Moreover, our acquisition times, shorter than a day, are still of practical utility.
In order to appreciate the performance of our system with respect to a perfect one, we simulated (for the same distances and block sizes as our experimental points) the SKRs of an idealized BB84 system with no DCR, 0% of QBER and 100% detection efficiency (represented as triangles on figure 2). Most of the difference is due to the lower detection efficiency in our experiment. Indeed, if we took it into account, the simulated and experimental points would almost overlap. Therefore, we can conclude that our simplifications of the protocol (three-state) and the implementation (with only one detector in the basis) do not significantly affect the performance. Except for the detection efficiency, our system is close to an ideal system.
How far could one still increase the transmission distance of QKD? With an ideal, noiseless implementation, the limiting factor is in the end the minimum block size needed to still extract a secret key with good confidence. Given that the number of detected photons decreases exponentially with distance, the resulting, necessary exponential increase of the accumulation time cannot be satisfactorily mitigated by an increased pulse repetition rate. We simulate a system with the following properties: BB84 protocol, 10 GHz repetition rate, 100% detector efficiency, 0 Hz DCR and . For this system, a constraint of 1 day of acquisition leads to a maximal distance of around 600 km, with a SKR of bps (i.e. 2.2 kb per day (block)) at 600 km. Going significantly beyond this limit would require switching to protocols featuring a more favorable dependency of the RKR as a function of the fiber length , such as the recently proposed twin-field QKD () Lucamarini et al. (2018), or a quantum repeater Sangouard et al. (2011). However, these alternatives are of much greater technological complexity.
We would like to acknowledge Jesús Martínez-Mateo for providing the error correction code and Charles Ci Wen Lim for useful discussions. We thank the Swiss NCCR QSIT. D.R. and G.G. thank the EUs H2020 programme under the Marie Skłodowska-Curie project QCALL (GA 675662) for financial support. This work was partly supported by the COST (European Cooperation in Science and Technology) Action MP1403 â Nanoscale Quantum Optics and by the Eurostars-2 joint programme (grant agreement: E11493 - QuPIC) with co-funding from the European Union Horizon 2020 research and innovation programme.
- C. H. Bennett, F. Bessette, G. Brassard, L. Salvail, and J. Smolin, Journal of cryptology 5, 3 (1992).
- H.-L. Yin, T.-Y. Chen, Z.-W. Yu, H. Liu, L.-X. You, Y.-H. Zhou, S.-J. Chen, Y. Mao, M.-Q. Huang, W.-J. Zhang, H. Chen, M. J. Li, D. Nolan, F. Zhou, X. Jiang, Z. Wang, Q. Zhang, X.-B. Wang, and J.-W. Pan, Phys. Rev. Lett. 117, 190501 (2016).
- S.-K. Liao, W.-Q. Cai, W.-Y. Liu, L. Zhang, Y. Li, J.-G. Ren, J. Yin, Q. Shen, Y. Cao, Z.-P. Li, F.-Z. Li, X.-W. Chen, L.-H. Sun, J.-J. Jia, J.-C. Wu, X.-J. Jiang, J.-F. Wang, Y.-M. Huang, Q. Wang, Y.-L. Zhou, L. Deng, T. Xi, L. Ma, T. Hu, Q. Zhang, Y.-A. Chen, N.-L. Liu, X.-B. Wang, Z.-C. Zhu, C.-Y. Lu, R. Shu, C.-Z. Peng, J.-Y. Wang, and J.-W. Pan, Nature 549, 43 (2017).
- S.-K. Liao, W.-Q. Cai, J. Handsteiner, B. Liu, J. Yin, L. Zhang, D. Rauch, M. Fink, J.-G. Ren, W.-Y. Liu, Y. Li, Q. Shen, Y. Cao, F.-Z. Li, J.-F. Wang, Y.-M. Huang, L. Deng, T. Xi, L. Ma, T. Hu, L. Li, N.-L. Liu, F. Koidl, P. Wang, Y.-A. Chen, X.-B. Wang, M. Steindorfer, G. Kirchner, C.-Y. Lu, R. Shu, R. Ursin, T. Scheidl, C.-Z. Peng, J.-Y. Wang, A. Zeilinger, and J.-W. Pan, Phys. Rev. Lett. 120, 030501 (2018).
- A. Boaron, B. Korzh, R. Houlmann, G. Boso, D. Rusca, S. Gray, M.-J. Li, D. Nolan, A. Martin, and H. Zbinden, Applied Physics Letters 112, 171108 (2018).
- M. Caloz, M. Perrenoud, C. Autebert, B. Korzh, M. Weiss, C. SchÃ¶nenberger, R. J. Warburton, H. Zbinden, and F. Bussières, Applied Physics Letters 112, 061103 (2018).
- D. Rusca, A. Boaron, F. Grünenfelder, A. Martin, and H. Zbinden, Applied Physics Letters 112, 171104 (2018a).
- D. Rusca, A. Boaron, A. Martin, M. Curty, and H. Zbinden, In preparation (2018b).
- X.-B. Wang, Phys. Rev. Lett. 94, 230503 (2005).
- H.-K. Lo, X. Ma, and K. Chen, Phys. Rev. Lett. 94, 230504 (2005).
- T. Kobayashi, A. Tomita, and A. Okamoto, Physical Review A 90, 032320 (2014).
- K. Smirnov, Y. Vachtomin, A. Divochiy, A. Antipov, and G. Goltsman, Applied Physics Express 8, 022501 (2015).
- C.-H. F. Fung and H.-K. Lo, Phys. Rev. A 74, 042342 (2006).
- K. Tamaki, M. Curty, G. Kato, H.-K. Lo, and K. Azuma, Phys. Rev. A 90, 052314 (2014).
- A. Mizutani, M. Curty, C. C. W. Lim, N. Imoto, and K. Tamaki, New Journal of Physics 17, 093011 (2015).
- K. Azuma, Tohoku Math. J. (2) 19, 357 (1967).
- J.-C. Boileau, K. Tamaki, J. Batuwantudawe, R. Laflamme, and J. M. Renes, Phys. Rev. Lett. 94, 040503 (2005).
- K. Tamaki, N. Lütkenhaus, M. Koashi, and J. Batuwantudawe, Phys. Rev. A 80, 032302 (2009).
- C. M. Caves, C. A. Fuchs, and R. Schack, Journal of Mathematical Physics 43, 4537 (2002), https://doi.org/10.1063/1.1494475 .
- R. KÃ¶nig and R. Renner, Journal of Mathematical Physics 46, 122108 (2005), https://doi.org/10.1063/1.2146188 .
- B. Fröhlich, M. Lucamarini, J. F. Dynes, L. C. Comandar, W. W.-S. Tam, A. Plews, A. W. Sharpe, Z. Yuan, and A. J. Shields, Optica 4, 163 (2017).
- B. Korzh, C. C. W. Lim, R. Houlmann, N. Gisin, M. J. Li, D. Nolan, B. Sanguinetti, R. Thew, and H. Zbinden, Nature Photonics 9, 163 (2015).
- M. Lucamarini, Z. Yuan, J. Dynes, and A. Shields, Nature 557, 400 (2018).
- N. Sangouard, C. Simon, H. de Riedmatten, and N. Gisin, Rev. Mod. Phys. 83, 33 (2011).