Composable security of unidimensional continuous-variable quantum key distribution

Abstract

We investigate the composable security of unidimensional continuous-variable quantum key distribution (UCVQKD) protocol in generally phase-sensitive channel; the UCVQKD protocol is based on the Gaussian modulation of a single quadrature of the coherent state of light, aiming to provide a simple implementation of key distribution compared to the symmetrically modulated Gaussian coherent-state protocols. This protocol neglects the necessity in one of the quadrature modulations in coherent states and hence reduces the system complexity. To clarify the influence of finite-size effect and the cost of performance degeneration, we establish the relationship of the balanced parameters of the unmodulated quadrature and estimate the precise secure region. Subsequently, we illustrate the composable security of the UCVQKD protocol against collective attacks and achieve the tightest bound of the UCVQKD protocol. Numerical simulations show the asymptotic secret key rate of the UCVQKD protocol, together with the symmetrically modulated Gaussian coherent-state protocols.

Appendices

Appendix A: Derivation of the covariance matrix

In what follows, we illustrate the derivation of Eq. (6) from Eq. (5). As the states travel through quantum channel with transmittance $\eta _{x,p}$ and excess noise $\varepsilon _{x,p}$, we have

$$\begin{aligned} \gamma _{A}= & {} \left( \begin{array}{cc} V &{} \quad 0 \\ 0 &{} \quad V \\ \end{array} \right) , \end{aligned}$$

(24)

$$\begin{aligned} \gamma _{B_2}= & {} \left( \begin{array}{cc} \eta _x(V^2+\chi _x) &{}\quad 0 \\ 0 &{}\quad \eta _p(1+\chi _p) \\ \end{array} \right) , \end{aligned}$$

(25)

$$\begin{aligned} \sigma _{AB_2}= & {} \left( \begin{array}{cc} \sqrt{\eta _xV(V^2-1)} &{}\quad 0 \\ 0 &{}\quad -\sqrt{\frac{\eta _p(V^2-1)}{V}} \\ \end{array} \right) . \end{aligned}$$

(26)

Substituting $V_M=V^2-1$ into Eqs. (24)–(26), we finally obtain the covariance matrix in the presentation modulation variance $V_M$, namely

$$\begin{aligned}&\varGamma _{AB_2}= \left( \begin{array}{cccc} \sqrt{V_M+1} &{}\quad 0 &{} \quad \left( \eta _x V_{M}\sqrt{V_{M}+1}\right) ^{\frac{1}{2}} &{} \quad 0 \\ 0 &{} \quad \sqrt{V_M+1} &{} \quad 0 &{} \quad -\left( \frac{\eta _p V_{M}}{\sqrt{V_{M}+1}}\right) ^{\frac{1}{2}} \\ \left( \eta _x V_{M}\sqrt{V_{M}+1}\right) ^{\frac{1}{2}} &{} \quad 0 &{}\quad 1+\eta _x(V_{M}+\varepsilon _x) &{} \quad 0 \\ 0 &{} \quad -\left( \frac{\eta _p V_{M}}{\sqrt{V_{M}+1}}\right) ^{\frac{1}{2}} &{} \quad 0 &{} \quad 1+\eta _p\varepsilon _p \\ \end{array} \right) . \end{aligned}$$

Appendix B: Calculation of the asymptotic secret key rate

We illustrate the calculation of asymptotic secret key rate of UCVQKD with RR. After obtaining the expression of $K_{RR}$ in Eq. (3) and the transformed covariance matrix $\varGamma _{AB_{2}}$ in Eq. (6), the covariance matrix of the state which is conditioned by Bob’s homodyne detection in quadrature $\hat{x}$ is given by

$$\begin{aligned} \begin{aligned} \gamma _{A|x_{B}}=\gamma _{A}-\sigma _{AB_{2}}^{\mathrm {T}}(X\gamma _{B_{2}}X)^{\mathrm {MP}}\sigma _{AB_{2}}, \end{aligned} \end{aligned}$$

(27)

with $X={\mathrm {diag}}(1,0,1,0,\ldots ,1,0)$ and ${\mathrm {MP}}$ being the inverse operation on the range; $\gamma _{A}$ and $\gamma _{B_{2}}$ are the submatrices of transformed covariance matrix $\varGamma _{AB_{2}}$ representing each mode A and B individually; $\sigma _{AB_{2}}$ is the correlation between mode A and B in $\varGamma _{AB_{2}}$.

One can derive the conditional matrix after Bob’s measurement with

$$\begin{aligned} \begin{aligned} \gamma _{A|x_{B}}= \left( \begin{array}{cc} \frac{\sqrt{V_{M}+1}(1+\eta _{x}\varepsilon _{x})}{1+\eta _{x}(V_{M}+\varepsilon _{x})} &{}\quad 0 \\ 0 &{}\quad \sqrt{V_{M}+1} \\ \end{array} \right) . \end{aligned} \end{aligned}$$

(28)

Thus, Alice and Bob’s mutual information can be estimated by calculating the following equation

$$\begin{aligned} \begin{aligned} I(A:B_{2})=\frac{1}{2}\log {\frac{V_{A}}{V_{A|x_{B}}}}, \end{aligned} \end{aligned}$$

(29)

where $V_{A}$, which is the variance of mode A, and $V_{A|x_{B}}$ are easily calculated from the first diagonal elements of the matrices $\gamma _{A}$ and $\gamma _{A|x_{B}}$, respectively. Finally, we obtain

$$\begin{aligned} \begin{aligned} I(A:B_{2})=\frac{1}{2}\log {\left( 1+\frac{\eta _{x}V_{M}}{1+\eta _{x}\epsilon _{x}}\right) }. \end{aligned} \end{aligned}$$

(30)

Due to the fact that Eve can provide a purification of Alice and Bobs density matrix, we first achieve $S(E) = S(AB_{2})$, which is a function of the symplectic eigenvalues $\nu _{1,2}$ of $\varGamma _{AB_{2}}$, given by

$$\begin{aligned} \begin{aligned} S(AB_{2})=G\left( \frac{\nu _{1}-1}{2}\right) +G\left( \frac{\nu _{2}-1}{2}\right) , \end{aligned} \end{aligned}$$

(31)

where

$$\begin{aligned} \begin{aligned} G(x)=(x+1)\log (x+1)-x\log {x} \end{aligned} \end{aligned}$$

(32)

is the von Neumann entropy and the symplectic eigenvalues $\nu _{1,2}$ are calculated by the square roots of the solutions of equation

$$\begin{aligned} \begin{aligned} \zeta ^{2}-\varDelta \zeta +\det {\varGamma _{AB_{2}}}=0, \end{aligned} \end{aligned}$$

(33)

where $\varDelta =\det {\gamma _{A}}+\det {\gamma _{B}}+2\det {\sigma _{AB_{2}}}$. After Bob performs the projective measurement $x_{B}$, system $AB_{2}$ is pure, and hence, we have $S(E|x_{B}) = S(A|x_{B})$, then the conditional von Neumann entropy $S(A|x_{B})=G[(\nu _{3}-1)/2]$ is a function of the symplectic eigenvalue $\nu _{3}$ of the covariance matrix $\gamma _{A|x_{B}}$, which can be calculated from $\nu _{3}=\sqrt{\det {\gamma _{A|x_{B}}}}$.

Finally, we are able to calculate the asymptotic secret key rate $K_{RR}$ of the UCVQKD protocol.

Appendix C: Secret key rate of the composable security

We, here, detail the generation of secret key rate of UCVQKD provided by the composable security analysis. Before illustrating the calculation, we give a theorem of composable security for UCVQKD [24].

The UCVQKD protocol is $\epsilon$-secure against collective attacks if $\epsilon =2\epsilon _{\mathrm{sm}}+\overline{\epsilon }+\epsilon _{\mathrm{PE}}/\epsilon +\epsilon _\mathrm{cor}/\epsilon +\epsilon _\mathrm{ent}/\epsilon$ and if the final key length l is chosen such that

$$\begin{aligned} \begin{aligned} l&\le 4\lambda n\hat{H}_{\mathrm{MLE}}(U)-2\lambda nF\left( \varOmega _{a}^{\max },\varOmega _{b}^{\max },\varOmega _{c}^{\min }\right) \\&\quad -\hbox {leak}_{\mathrm{EC}}-\varDelta _{\mathrm{AEP}}-\varDelta _\mathrm{ent}-2\log \frac{1}{2\overline{\epsilon }}, \end{aligned} \end{aligned}$$

(34)

where $\hat{H}_{\mathrm{MLE}}(U)$ is the empiric entropy of U, the maximum likelihood estimator (MLE) for H(U) to be $\hat{H}_{\mathrm{MLE}}(U)=-\sum _{i=1}^{2^{d}}\hat{p}_{i}\log \hat{p}_{i}$ with $\hat{p}_{i}=\frac{\hat{n}_{i}}{2\lambda dn}$ denotes the relative frequency of obtaining the value i, and $\hat{n}_{i}$ is the number of times the variable U takes the value i for $i\in \{1,\ldots ,2^{d}\}$, and

$$\begin{aligned} \varDelta _{\mathrm{AEP}}= & {} \sqrt{2\lambda n}(d+1)^2+\sqrt{32\lambda n}(d+1)\log _{2}\frac{2}{\epsilon _{\mathrm{sm}}^{2}} \nonumber \\&+\,\sqrt{8\lambda n}\log _{2}\frac{2}{\epsilon ^{2}\epsilon _{\mathrm{sm}}}-4\frac{\epsilon _{\mathrm{sm}}d}{\epsilon }, \end{aligned}$$

(35)

$$\begin{aligned} \varDelta _\mathrm{ent}= & {} \log _{2}\frac{1}{\epsilon }-\sqrt{8\lambda n\log ^{2}(4\lambda n)\log (2/\epsilon )}, \end{aligned}$$

(36)

and F is the function computing the Holevo information between Eve and Bob. It is given by

$$\begin{aligned} \begin{aligned} F=G\left( \frac{\mu _{1}-1}{2}\right) +G\left( \frac{\mu _{2}-1}{2}\right) -G\left( \frac{\mu _{3}-1}{2}\right) , \end{aligned} \end{aligned}$$

(37)

where $\mu _{1}$ and $\mu _{2}$ are the symplectic eigenvalues of the covariance matrix $\varGamma _{AB_{2}}$, the variables follow Eqs. (20)–(22). $\mu _{3} =\varOmega _{a}^{\mathrm{max}2}-(\varOmega _{c}^{\mathrm{min}2})^{2}/(1+\varOmega _{b}^{\max })$; the entropy function G is identical with Eq. (32). Moreover, the symplectic eigenvalues $\mu _{1}$ and $\mu _{2}$ need to satisfy the following relations:

$$\begin{aligned}&\mu _{1}^{2}+\mu _{2}^{2}=\varOmega _{a}^{\mathrm{max}2}+\varOmega _{b}^{\mathrm{max}2}-2\varOmega _{c}^{\mathrm{min}2}, \end{aligned}$$

(38)

$$\begin{aligned}&\mu _{1}^{2}\mu _{1}^{2}=\left( \varOmega _{a}^{\max }\varOmega _{b}^{\max }-\varOmega _{c}^{\mathrm{min}2}\right) ^{2}. \end{aligned}$$

(39)

Now, let’s consider the calculation of secret key rate provided by UCVQKD composable security analysis. Assuming that the calculation is based on a Gaussian channel with transmissivity $\eta _{x,p}$ and excess noise $\varepsilon _{x,p}$, the following model is used for error correction

$$\begin{aligned} \begin{aligned} \beta S(A_{x};B_{x})=2\hat{H}_{\mathrm{MLE}(U)}-\frac{1}{2\lambda n}\hbox {leak}_{\mathrm{EC}}, \end{aligned} \end{aligned}$$

(40)

where $\beta$ denotes the reconciliation efficiency and $S(A_{x};B_{x})$ represents the mutual information between Alice and Bob. For the UCVQKD protocol in Gaussian channel and the modulation variance $V_{M}$ on quadrature $\hat{x}$, we obtain

$$\begin{aligned} \begin{aligned} S(A_{x};B_{x})&=\frac{1}{2}\log _{2}(1+\hbox {SNR})\\&=\frac{1}{2}\log _{2}\left( 1+\frac{\eta _{x}V_{M}}{2+\eta _{x}\varepsilon _{x}}\right) . \end{aligned} \end{aligned}$$

(41)

Moreover, here, assuming that the probability of passing the parameter estimation step is at least 0.99, which means the robustness of the UCVQKD protocol to be $\epsilon _{\mathrm{rob}}\le 10^{-2}$. This assumption can be achieved by taking values for $\varOmega _{a}^{\max }$, $\varOmega _{b}^{\max }$, $\varOmega _{c}^{\min }$ differing by three standard deviations from the expected values of $\omega _{a}$, $\omega _{b}, \omega _{c}$ [24]. By doing this, the values of random variables $\left| \left| X\right| \right| ^{2}$, $\left| \left| Y\right| \right| ^{2}$ and $\langle X,Y\rangle$ satisfy the following restraints

$$\begin{aligned}&\left| \left| X\right| \right| ^{2}\le \delta (\delta +3)\sqrt{V_{M}+1}, \end{aligned}$$

(42)

$$\begin{aligned}&\left| \left| Y\right| \right| ^{2}\le \delta (\delta +3)\left[ 1+\eta _{x}(V_{M}+\varepsilon _{x})\right] , \end{aligned}$$

(43)

$$\begin{aligned}&\langle X,Y\rangle \ge \delta (\delta -3)\left( \eta _{x}V_{M}\sqrt{V_{M}+1}\right) ^{\frac{1}{2}}, \end{aligned}$$

(44)

where $\delta =\sqrt{2\lambda n}$. Note that these restraints are obtained from the covariance matrix $\varGamma _{AB_{2}}$ of the UCVQKD protocol with $\hat{x}$ quadrature modulation and the value of modulation variance $V_{M}$ must be optimized to obtain the optimal performance. Finally, we use these bounds on Eqs. (42)–(44) and define:

$$\begin{aligned} \varOmega _{a}^{\max }= & {} \frac{\left| \left| X\right| \right| ^{2}}{2\lambda n}\left[ 1+2\sqrt{\frac{\log (36/\epsilon _{\mathrm{PE}})}{n}}\right] -1, \end{aligned}$$

(45)

$$\begin{aligned} \varOmega _{b}^{\max }= & {} \frac{\left| \left| Y\right| \right| ^{2}}{2\lambda n}\left[ 1+2\sqrt{\frac{\log (36/\epsilon _{\mathrm{PE}})}{n}}\right] -1, \end{aligned}$$

(46)

$$\begin{aligned} \varOmega _{c}^{\min }= & {} \frac{\langle X,Y\rangle }{2\lambda n}-5\left( \left| \left| X\right| \right| ^{2}+\left| \left| Y\right| \right| ^{2}\right) \sqrt{\frac{\log (8/\epsilon _{\mathrm{PE}})}{n^{3}}}. \end{aligned}$$

(47)

With all the equations, we now can calculate the secret key rate of the UCVQKD protocol provided by composable security

$$\begin{aligned} \begin{aligned} K_{\mathrm{composable}}^{\hat{x}}&=(1-\epsilon _{\mathrm{rob}})\left\{ \beta S(A_{x};B_{x})\right. \\&\quad -F\left( \varOmega _{a}^{\max }, \varOmega _{b}^{\max }, \varOmega _{c}^{\min }\right) \\&\quad \left. -\frac{1}{2\lambda n}\left( \varDelta _{\mathrm{AEP}}+\varDelta _\mathrm{ent}+2\log _{2}\frac{1}{2\overline{\varepsilon }}\right) \right\} . \end{aligned} \end{aligned}$$

(48)

In addition, we should optimize over all parameters compatible with $\epsilon =10^{-20}$. However, in order to simplify the description and give a fair comparison, we make the following choices which slightly suboptimal the performance of the UCVQKD protocol and identical with corresponding symmetrically modulated Gaussian coherent-state protocol [24]

$$\begin{aligned} \begin{aligned} \epsilon _{\mathrm{sm}}=\overline{\epsilon }=10^{-21},\quad \epsilon _{\mathrm{PE}}=\epsilon _\mathrm{cor}=\epsilon _\mathrm{ent}=10^{-41}. \end{aligned} \end{aligned}$$

(49)