www.nature.

com/npjqi

REVIEW ARTICLE OPEN

Practical challenges in quantum key distribution

Eleni Diamanti1, Hoi-Kwong Lo2, Bing Qi3,4 and Zhiliang Yuan5,6

Quantum key distribution (QKD) promises unconditional security in data communication and is currently being deployed in
commercial applications. Nonetheless, before QKD can be widely adopted, it faces a number of important challenges such as secret
key rate, distance, size, cost and practical security. Here, we survey those key challenges and the approaches that are currently
being taken to address them.

npj Quantum Information (2016) 2, 16025; doi:10.1038/npjqi.2016.25; published online 8 November 2016

INTRODUCTION to quantum-resistant classical algorithms3 (These algorithms are

Why quantum key distribution? typically based on hard computational problems involving for
For thousands of years, human beings have been using codes to instance the structure of some specific lattices. Despite important
keep secrets. With the rise of the Internet and recent trends to the progress in the development of such algorithms, it is still an
Internet of Things, our sensitive personal financial and health data open question whether they are secure against a quantum
as well as commercial and national secrets are routinely being computer).
transmitted through the Internet. In this context, communication Quantum cryptography, or more specifically, quantum key
security is of utmost importance. In conventional symmetric distribution (QKD),4–7 promises in principle unconditional security
cryptographic algorithms, communication security relies solely on —the Holy Grail of communication security—based on the laws of
the secrecy of an encryption key. If two users, Alice and Bob, share physics only.8–10 QKD has the advantage of being future-proof:11
a long random string of secret bits—the key—then they can unlike classical key distribution, it is not possible for an
achieve unconditional security by encrypting their message using eavesdropper to keep a transcript of quantum signals sent in a
the standard one-time-pad encryption scheme. The central QKD process, owing to the quantum non-cloning theorem.12,13 For
question then is: how do Alice and Bob share a secure key in this reason, QKD is an essential element of the future quantum-
the first place? This is called the key distribution problem. safe infrastructure, which will include both quantum-resistant
Unfortunately, all classical methods to distribute a secure key classical algorithms and quantum cryptographic solutions. In the
are fundamentally insecure because in classical physics there is bigger context of quantum information, there has been tremen-
nothing preventing an eavesdropper, Eve, from copying the key dous scientific and engineering effort towards the long-term
during its transit from Alice to Bob. On the other hand, standard vision of a global quantum internet.14 Imagine a world where only
asymmetric or public-key cryptography solves the key distribution a few large-scale quantum computers are available (just like the
problem by relying on computational assumptions such as the early days of classical computing when only a few classical
hardness of factoring. Therefore, such schemes do not provide computers were available and in line with the current trend
information-theoretic security because they are vulnerable to
towards cloud computing); users will have to access those
future advances in hardware and algorithms, including the
powerful quantum computers at long distances via a quantum
construction of a large-scale quantum computer.1
internet. QKD will have a central role in securing data commu-
We remark that some secrets, for instance, census data, need to
be kept secret for decades (e.g. 92 years in Canada (Statistical nication links in such a quantum internet.
Canada webpage. Release of personal data after 92 years, URL: The potential applications of QKD include securing critical
http://www12.statcan.gc.ca/census-recensement/2011/ref/about- infrastructures (for instance, the Smart Grid), financial institutions
apropos/personal-personnels-eng.cfm)). Currently, however, data and national defense. Experimental QKD has been performed over
transmitted in 2016 is vulnerable to technological advances made distances on the order of 100 km in standard telecom fibres as
in the future as Eve might simply save the transcripts of well as in free space, while the secure key rate has now reached a
communication in her memory and wait for the construction, for few Mbits per second. QKD has leaped out of the lab.15 In China,
example, of a quantum computer some time before 2,108 the deployment of a 2,000 km QKD network between Shanghai
(92 years from 2016). This is highly probable. Recall that ENIAC, and Beijing is underway; in Europe, after the SECOQC network
the first general purpose electronics computer,2 which was largely demonstration in 2008,16 the UK is now creating a quantum
inferior to modern computers, was invented only 70 years ago. network facilitating device and system trials, and the integration
The US National Security Agency is taking the threat of quantum of quantum and conventional communications; in Japan, QKD
computing seriously and has recently announced transition plans technologies will be put into test to secure transmission of

1
Laboratoire Traitement et Communication de l’Information, CNRS, Télécom ParisTech, Université Paris-Saclay, Paris, France; 2Center for Quantum Information and Quantum
Control, Department of Physics and Department of Electrical & Computer Engineering, University of Toronto, Toronto, Canada; 3Quantum Information Science Group,
Computational Sciences and Engineering Division, Oak Ridge National Laboratory, Oak Ridge, TN, USA; 4Department of Physics and Astronomy, University of Tennessee,
Knoxville, TN, USA; 5Toshiba Research Europe Limited, Cambridge, UK and 6Corporate Research & Development Center, Toshiba Corporation, Kawasaki, Japan.
Correspondence: H-K Lo (hklo@ece.utoronto.ca)
Received 7 December 2015; revised 5 May 2016; accepted 29 May 2016

Published in partnership with The University of New South Wales

 Quantum key distribution
E Diamanti et al
2
sensitive genome data; and the US has also started installing its encoded in the properties of light (Figure 1a). In discrete-variable
own QKD network. (DV) protocols information is typically encoded in the polarisation
or phase of weak coherent pulses simulating true single-photon
Why practical challenges in QKD? states; hence the corresponding implementations employ single-
photon detection techniques. The previously mentioned BB84 and
In this review, we will focus on practical issues in QKD. We remark
decoy-state protocols are prominent examples in this category.
that, historically, practical considerations in QKD have led to
Single-photon detection techniques are also necessary for the
ground-breaking inventions. For example, the need to counter the
so-called distributed-phase-reference protocols, such as the
photon-number-splitting attack17 triggered the invention of the
coherent-one-way34 and differential-phase-shift (DPS)35 protocols,
decoy-state protocol,18–20 which allows efficient distillation of
where the key information is encoded in photon arrival times or in
secure keys using weak coherent pulse based QKD systems that
the phase between adjacent weak coherent pulses. On the other
once were vulnerable. As another example, the need to counter
hand, in continuous-variable (CV) QKD protocols information is
detector side-channel attacks has led to the discovery of
encoded in the quadratures of the quantised electromagnetic
measurement device independent (MDI) QKD.21 New theory that
field, such as those of coherent states,36,37 and homodyne or
is due to practical advances in QKD also includes, for instance, the
heterodyne detection techniques are used in this case. Such
quantum de Finetti theorem,22 while security loopholes in QKD
detectors are routinely deployed in classical optical communica-
are closely related to loopholes in Bell inequality tests23—a key
tions, hence the CV approach offers the possibility for implemen-
subject in the foundations of quantum mechanics. These issues
tations based only on mature telecom components. All these
are therefore of great interest to mathematicians and theoretical
protocols are prepare-and-measure in the sense that the
physicists.
transmitter, Alice, sends the encoded pulses to the receiver, Bob,
QKD is clearly of interest to engineers too. For instance, practical
who decodes as required by the specific protocol. On the contrary,
QKD is closely linked to the development of new single-photon
in entanglement-based protocols,5 both parties receive parts of an
detection technologies such as superconducting nanowire single-
entangled state and perform suitable measurements. More details
photon detectors (SNSPDs),24 superconducting transition-edge
on all protocols can be found in refs 6,7,38,39.
sensors (TES),25 frequency up-conversion single photon dete-
When it comes to practical demonstrations, performance of
ctors,26,27 and self-differencing InGaAs avalanche photodiodes,28 as
point-to-point links is assessed by the distance over which secret
well as of high-performance homodyne detection techniques.29 It is
keys can be distributed and the rate of their distribution for a
also the motivation for high-speed quantum random number
given security level. The security level is determined by the type of
generators30 and broadband entangled photon sources.31
attacks considered in the corresponding security proof; demon-
Practical QKD has steered innovation and is a precursor in the
strating security against the so-called collective attacks6 is an
field of Quantum Information Processing.
important challenge for an implementation; however, infor-
mation-theoretic security is achieved only when security against
Outline of the review the most general (or coherent) attacks is proven. Hence, the
Despite the important theoretical and experimental achievements, ultimate goal is to provide this level of security at a speed and a
a number of key challenges remain for QKD to be widely used for distance that are compatible with practical applications. Some
securing everyday interactions. For instance, much effort is being recent implementations have provided high levels of security:
put into increasing the communication rate and range of QKD and several QKD protocols have been demonstrated to provide
making QKD systems low cost, compact and robust. New composable security against collective attacks using reasonable
hardware such as chip-based QKD and new software such as data block sizes and practical setups, including decoy-state
novel protocols are being studied and developed. The security of BB84,40 coherent-one-way,41 and CV-QKD.42,43 Among those
practical QKD systems is another important challenge. In order to protocols, the security of decoy-state BB84 QKD has been
foil quantum hackers, protocols such as MDI-QKD and loss- extended to cover coherent attacks, for realistic block sizes and
tolerant QKD32 have been developed and are currently being with a minimal sacrifice in the secret key rate.44,45 Unfortunately,
experimentally implemented. Yet, a comprehensive theory of the for coherent-one-way, the best security proof against coherent
model of a QKD source remains to be constructed. To further attacks currently gives a secret key rate that only scales
extend the reach of QKD, two different approaches—quantum quadratically with the loss.46 For CV-QKD with coherent states
repeaters and ground-to-satellite QKD—are being pursued. In and heterodyne detection, a composable security proof against
view of the proliferation of mobile computing devices including the most general attacks has recently been provided,47 but the
smart phones, mobile QKD applications have also attracted recent current proof techniques do not allow a positive key rate for
attention. Furthermore, the standardisation of QKD components is realistic block sizes in this case. Extending the security proofs for
currently being pursued in European Telecommunications Stan- the latter protocols is therefore a pressing task in the theoretical
dards Institute.33 In what follows, we will highlight some of the study of QKD.
above challenges and the various approaches that are being taken Figure 1b,c shows examples of advanced fibre-optic QKD
to tackle them. systems allowing for real-time secret key generation over
distances of 50 km with Mbit/s rates. In Figure 1d we summarise
some important experimental achievements from both estab-
MAIN PROTOCOLS AND IMPLEMENTATIONS lished and emerging QKD protocols (discussed in the following
We begin our discussion with a brief overview of the main QKD sections). Although the security assumptions and technological
protocols currently studied and the state-of-the-art in their maturity vary in these implementations, these results illustrate the
practical implementations. As our main focus here is the current diversity of protocols and experimental solutions that the research
challenges in the field, we refer the reader to a recent review7 for community has invented to push the performance of QKD
the necessary background on the rigorous information-theoretic technology. Indeed, tremendous progress has been achieved in
(or, unconditional) security definition of QKD in the composable recent years, and avenues for further progress will be discussed in
framework, secure communication schemes including the one- the next section. We remark, however, that there are fundamental
time pad, the standard BB84 QKD protocol, and basic QKD limitations on what can be ultimately achieved. Over optical fibre
components. networks, the attenuation of light in standard fibres at the telecom
QKD protocols can be in essence divided with respect to the wavelength of 1,550 nm is 0.2 dB/km (or 0.16 dB/km in newly
detection technique required to recover the key information developed ultralow loss fibres). This unavoidable loss will not

npj Quantum Information (2016) 16025 Published in partnership with The University of New South Wales
 Quantum key distribution
E Diamanti et al
3

Figure 1. (a) Quantum key distribution systems use discrete-variable (DV) single-photon state encoding and single-photon detection
techniques or continuous-variable (CV) quadrature field amplitude encoding and homodyne (or heterodyne) detection techniques. (b) State-
of-the-art experimental setup for the implementation of the decoy-state BB84 QKD protocol.40 (c) State-of-the-art experimental setup for the
implementation of the coherent state CV-QKD protocol.42 (d) Secret key generation rates demonstrated in some representative recent QKD
experiments. Note that this figure is not meant to provide an exhaustive list of QKD implementations. Furthermore, protocol performance
cannot be directly compared as different security assumptions are considered; for instance, decoy-state BB84 is secure against general
coherent attacks while coherent-one-way (COW) and CV-QKD are secure against collective attacks. QKD is a subject of active ongoing research
and so further developments are likely to occur in the near future. The loss coefficient of 0.2 dB/km in standard single-mode fibres at telecom
wavelengths is assumed in this figure. Figures adapted with permission from: (a), ref. 180 © 2013 NPG, courtesy of Ping Koy Lam; (b), ref. 40 ©
2013 OSA; (c) ref. 42 © 2013 NPG.

allow the range of point-to-point QKD links to exceed a few Presently, strong disparity exists between the classical and QKD
hundreds of kilometres as with overly excessive channel loss it communication rates. Classical optical communications delivering
would take several years to generate just one bit even using speeds of 100 Gbit/s per wavelength channel are currently being
perfect light sources and detectors. Furthermore, with a practical deployed,50 and a field trial featuring 54.2 Tbit/s aggregated data
lossy channel, the ultimate key rate is upper bounded by the rate has recently been performed.51 On the other hand, the Mbit/s
so-called TGW bound48 (see also ref. 49 for a more recent rates achieved by QKD systems today are sufficient, for instance,
result, quoted as the PLOB bound). These bounds provide a for video transmission; however, it is clear that if we want in the
useful benchmark for the performance of all QKD protocol longer term to encrypt high volumes of classical network traffic
implementations. using the one-time-pad, major developments on the secure key
rate generated by QKD will be required.
The obtained key rate depends crucially on the performance of
MAJOR CHALLENGES IN PERFORMANCE AND COST the detectors used. For QKD systems employing single-photon
In the quest for high performance and low-cost QKD systems, detection techniques, high efficiency and short dead time of the
both hardware and software solutions are currently being detectors are essential for reaching a high bit rate. The latest
pursued. developments on high efficiency detectors52–54 are extremely
promising; quantum efficiencies as high as 93% at telecom
wavelengths have been reported for SNSPDs,53 and devices based
Hardware development on this technology with short dead time, low dark count, low time
Key rate. Encryption keys generated by QKD can be used in a jitter and high detection efficiency are commercially available55
symmetric cipher scheme, such as Advanced Encryption Standard, (Figure 2a,b). These results may allow for as much as a fourfold
which is quantum resistant, for enhanced security, or they can be increase in the secret key rate, which currently stands at 1 Mbit/s
combined with the one-time-pad encryption scheme for uncondi- over a 50 km fibre (or 10 dB loss) achieved using self-differencing
tional security. In both cases, the secure key rate achieved by the InGaAs avalanche photodiodes with an ultrashort dead time40
underlying QKD layer in a typical application scenario is crucial. (Figure 2c). Further key rate increase is possible using wavelength
Higher secure rates allow for a more frequent update of or spatial mode multiplexing technologies that have been
encryption keys in symmetric ciphers, and for a proportional routinely used for increasing the bandwidth in data communi-
increase in the one-time-pad communication bandwidth as this cations.50,56,57 For CV-QKD systems, increasing the bandwidth of
scheme requires the key to be as long as the message. the homodyne or heterodyne detectors, while keeping at the

Published in partnership with The University of New South Wales npj Quantum Information (2016) 16025
 Quantum key distribution
E Diamanti et al
4

Figure 2. (a) Superconducting nanowire chips. (b) Commercial SNSPDs with high detection efficiency. (c) Characterisation circuit for self-
differencing InGaAs avalanche photodiodes.69 Figures adapted with permission from: (a) http://www.photonspot.com/, courtesy of Vikas
Anant; (b) http://www.singlequantum.com/products, courtesy of Jessie Qin-Dregely.

same time the electronic noise low, is a necessary step for Cost and robustness. For QKD systems to be used in real world
increasing the key rate beyond the 1 Mbit/s over 25 km that has applications, low cost and robustness are indispensable features
been achieved.43 Further progress continues to be pursued, alongside high performance. Several avenues are currently being
targeting also higher efficiency, which is currently around 60% for pursued. First, QKD systems have been shown to coexist with
fibre-coupled detectors at telecom wavelengths.42 Furthermore, as intense data traffic in the same fibre,64–67 thus eliminating the
shown in Figure 1c, a practical issue in these systems is that the need for dark fibres that are not only expensive but also often
strong phase reference pulse (or local oscillator) needs to be unavailable. Access network architecture allows simultaneous
transmitted together with the signal at high clock rates; recent access by a multitude of QKD users, and importantly they are
proposals that avoid this and use instead a local oscillator compatible with full power Gigabit Passive Optical Network traffic
generated at Bob’s site58–60 are promising and will lead to more in the same network.61,68 Room-temperature single-photon
practical, high performance implementations. detectors have been shown to be suitable for DV-QKD over up
to 100 km fibre, thus removing cooling requirements for the entire
Distance. Extending the communication range of QKD systems is QKD system;44,69 for CV-QKD cooling is unnecessary. All these
a major driving factor for technological developments in view of developments help reduce deployment cost as well as system
future network applications. QKD systems based on single-photon complexity, footprint and power consumption.
detection champion the point-to-point communication distance Another important avenue to address the issue of cost and
(or channel loss). Here the low noise of single-photon detectors is robustness is photonic integration.70 Chip-scale integration will
the key enabling factor; in particular, the attainable range depends bring high level of miniaturisation, leading to compact and light-
on the type and operation temperature of the detectors. InGaAs weight QKD modules that can be mass-manufactured at low cost.
avalanche photodiodes can tolerate losses of 30 and 52 dB when Two main integration platforms are currently being explored,
cooled to − 30 and − 120 °C,41,61 respectively, whereas SNSPDs namely silicon (Si)71 and indium phosphide (InP),72 whereas
cooled to cryogenic temperatures have been demonstrated to alternative techniques include lithium niobate (LiNbO3) integra-
withstand a record loss of 72 dB.62 This loss is equivalent to tion and glass waveguide technologies. For QKD protocols
360 km of standard single mode fibre or about 450 km of ultralow employing single-photon detection, the main difficulty comes
loss fibre. Although technologically possible, further extending the from the receiver side so initial experiments have focused on
point-to-point distance is increasingly unappealing because the transmitter integration. A LiNbO3 integrated polarisation controller
channel loss will inevitably reduce the key rate to a level of little was used for state preparation in a QKD implementation,73
practical relevance. This is also true for CV-QKD systems, which are whereas several techniques were combined to construct a hand-
in general more sensitive to losses. Here it is crucial to keep the held QKD sender module in ref. 74. More recently, a QKD
excess noise—the noise exceeding the fundamental shot noise of transmitter chip that is reconfigurable to accommodate the state
coherent states—low and especially to be able to estimate the preparation for several QKD protocols, including decoy-state BB84,
noise value precisely, which becomes increasingly difficult with coherent-one-way and DPS, has been developed on InP75
the distance.38,42 (Figure 3), and Si transmitters have also been
We remark that advances towards high-performance QKD demonstrated independently by the U. of Toronto76 and also by
systems in terms of key rate and distance are coupled with the Bristol group. (C. Erven and M. Thompson, private
security guarantees offered by these systems. For instance, communication.)
achieving composable security against general attacks requires Chip-scale QKD receivers are also progressing. Low-loss planar-
in practice being able to perform efficient post-processing, lightwave-circuits based on silica-on-silicon technology have been
including parameter estimation, over large data blocks with routinely used to replace fibre-based asymmetric Mach–Zehnder
stable setups. Particularly for CV-QKD, performing efficient interferometres,75,77,78 a key enabling component for phase-based
error correction and precise parameter estimation is of utmost QKD protocols. Research efforts are currently focused on the
importance.38,63 integration of single-photon detectors using the aforementioned

npj Quantum Information (2016) 16025 Published in partnership with The University of New South Wales
 Quantum key distribution
E Diamanti et al
5

Figure 3. Chip architecture combining several integrated photonic devices for the implementation of DV-QKD. (a) A monolithically integrated
In-dium phosphide (InP) transmitter for GHz clock rate, reconfigurable, multi-protocol QKD. (b) A silicon oxynitride (Triplex) photonic receiver
circuit for reconfigurable, multi-protocol QKD that passively decodes the quantum information with on-chip single-photon detectors. (c) The
InP technology platform waveguide cross-section. (d) Wavelength tunable continuous-wave laser, formed from two tuneable distributed
Bragg reflectors (T-DBR) and a semiconductor optical amplifier (SOA). (e) Microscopic image of electro-optic phase modulators in Mach-
Zehnder interferometer. (f) The SiOxNy Triplex waveguide cross-section, with metalisation for heating elements. (g) Microscopic image of the
receiver delay lines. Caption and Figure adapted with permission from ref. 75, courtesy of Philip Sibson, Chris Erven and Mark Thompson.

techniques, which will be essential for developing complete exploiting the spatial degree of freedom, but its potential is
integrated systems. CV-QKD systems are particularly well suited restricted by the availability of high speed modulators.86,87
for this objective because they only require the use of standard
components. Indeed, Si photonic chips integrating many func- RR-DPS-QKD. The Round-Robin (RR) DPS protocol, which
tionalities of a CV-QKD setup, including active elements such as was proposed in 2014,88 removes the need for monitoring the
amplitude and phase modulators and homodyne/heterodyne channel disturbance to establish security, in stark contrast with
detectors based on germanium (Ge) photodiodes, have been conventional QKD protocols (see Figure 4a for the principle).
developed.79 Instead, Eve’s information can be tightly set, even to an arbitrarily
Development of chip-scale QKD is still at its early stages. Further low level, by just choosing experimental parameters. In theory, a
research in this direction will help bring the QKD technology positive key rate is possible for any quantum bit error rate (QBER)
closer to its wide adoption.
o50%. This extraordinary QBER tolerance makes it attractive for
deployment when large systematic errors cannot be avoided.
New QKD protocols Shortly after its introduction the protocol has stimulated a number
In parallel to hardware development, much effort has also been of experimental demonstrations.89–92 The RR-DPS-QKD protocol
devoted to novel QKD protocols aiming to outperform the uses a transmitter identical to that found in a conventional DPS
established ones. Encouragingly, this line of research has led to system,35 but requires a receiver that is capable of measuring the
protocols that may exhibit advantages when certain technical differential phase between any two pulses within a pulse group
constraints are in place. Below, we discuss two protocols featuring sent by Alice. Two different approaches are adopted. In the first,
high photon information capacity or noise tolerance. direct approach, a combination of optical switches and delay lines
is used to bring the intended pulses into temporal overlap and
High dimension-QKD. High dimension-QKD allows retrieval of
then let them interfere90–92 (see for example Figure 4b). A more
more than 1 bit from each detected photon, thus offering an
ingenious approach is to let a common phase reference interfere
advantage in the photon information capacity when the photon
rate is restrained.80–82 The choice for encoding is to use the arrival with all pulses sent by Alice, and then determine the differential
times of time-energy entangled photon pairs,83 whose continuous phase between those pulses whose interference with the
nature permits encoding of extremely large alphabets. A security common reference produces a photon click.89 This latter approach
proof against collective attacks has been developed,84 which was avoids many problems associated with the direct one, such as loss
followed by a laboratory experiment demonstrating a photon and phase instability caused by optical delay lines and switches,
information capacity of up to 6.9 bits per coincidence and a key but it will require remote optical phase locking for optimal
rate of 2.7 Mbit/s over a 20 km fibre.85 Although this development performance. As it currently stands, the best key rate for RR-DPS-
has narrowed the key rate gap between entanglement based and QKD is around 10 kbit/s for a 50 km distance in fibre91 and cannot
prepare-and-measure QKD systems, its viability in a field environ- compete with the more mature decoy-state BB84 protocol.
ment will face a challenge to maintain the near unity interference RR-DPS-QKD has the advantage of being robust against encoding
visibility which was key to the obtained information capacity. High errors,93 but it is vulnerable to attacks on detectors, which will be
dimension-QKD without entanglement is also possible by discussed in the next section.

Published in partnership with The University of New South Wales npj Quantum Information (2016) 16025
 Quantum key distribution
E Diamanti et al
6

Figure 4. (a) Basic principle of RR-DPS QKD protocol.88 (b) Example of experimental implementation of the RR-DPS QKD protocol.90 Figures
adapted with permission from: (a), ref. 88 © 2014 NPG; (b), ref. 90 © 2015 NPG. Courtesy of Masato Koashi.

MAJOR CHALLENGES IN PRACTICAL SECURITY efficient single-photon detectors, the tolerable channel loss can be
Although the security of a QKD protocol can be proven rigorously, as high as 60 dB, which corresponds to 300 km of standard
its real-life implementation often contains imperfections that may telecom fibre.109 A real-life fibre based multi-user MDI-QKD
be overlooked in the corresponding security proof. By exploiting network was also implemented recently110 (Figure 5c). Moreover,
such imperfections, various attacks, targeting either the source or a 1 Mbit/s proof-of-principle MDI-QKD experiment was
the detectors, have been proposed; some of them have even been performed,111 thus illustrating the high key rate potential of DV
demonstrated to be effective against commercial systems.94–96 We MDI-QKD. This was also studied in ref. 112 for MDI-QKD employing
refer the reader to a recent review7 for more details on quantum state-of-the-art SNSPDs; in Figure 5b, simulation results of the
hacking and also countermeasures. To regain security in practical secret key rate in this case show an achievable key rate of 0.01 bit
QKD, several solutions, including QKD based on testable per pulse over 25 km. With a transmission rate of 1 GHz, this
assumptions,7 device independent (DI) QKD97,98 (see also ref. 99) corresponds to a secret key rate of 10 Mbit/s, which is sufficient for
and MDI-QKD,21 have been proposed. In the following, we discuss many cryptographic applications. As a comparison, we also
some important recent developments in this direction. present in Figure 5b the previously mentioned fundamental
upper bounds per optical mode.48,49 We see that the key rate of
DV MDI-QKD is only about 2 orders of magnitude away from the
MDI-QKD TGW bound at a practical distance, hence this protocol is suitable
One promising long-term solution to side-channel attacks is for high speed communications in metropolitan area networks.
DI-QKD, where the security relies on the violation of a Bell It is important to emphasise that one fundamental assumption
inequality and can be proven without knowing the implementa- in MDI-QKD is that Eve cannot interfere with Alice and Bob’s state
tion details. While recent loophole-free Bell experiments23,100,101 preparation processes. To prevent Eve from having access to
imply that DI-QKD could be implemented, the expected secure quantum signals entering Alice’s or Bob’s labs and interfering with
key rate is nevertheless impractically low even at short distances. the state preparation process, MDI-QKD is commonly implemen-
A more practical solution is MDI-QKD, which is inherently immune ted using independent laser sources for Alice and Bob. Recently,
to all side-channel attacks targeting the measurement device, gigahertz-clocked, phase-randomised pulses from independent
usually the most vulnerable part in a QKD system. In fact, the gain-switched lasers have been demonstrated to interfere with
measurement device in MDI-QKD can be treated as a ‘black box’ high visibility, by control of the frequency chirp and/or emission
which could even be manufactured and operated by Eve. Building jitter.111,113
upon refs 102,103; ref. 21 proposed a practical scheme with weak
coherent pulses and decoy states (Figure 5a), whose security DDI-QKD. One drawback of MDI-QKD is that its key rate scales
against the most general coherent attacks, taking into account the quadratically with the detector efficiency. This is because in most
finite data size effect, has been proved in ref. 104 (see also ref. 99, of existing MDI-QKD protocols (except for ref. 114), secure keys are
which studied an entanglement-based representation with distilled from two-fold coincidence detection events (In MDI-QKD,
general finite-dimensional systems, and ref. 105, which proposed the secure key rate R scales as TA × η × TB × η, where TA is the
a DI-QKD protocol with local Bell test). channel transmission from Alice to the measurement device, TB is
MDI-QKD21 is a natural building block for multi-user QKD the channel transmission from Bob to the measurement device,
networks, since the most expensive and complicated measure- and η is the single-photon detection efficiency (assuming that all
ment device can be placed in an untrusted relay and shared detectors have the same efficiency). The overall transmission of
among many QKD users.68 Several groups have demonstrated its the whole channel (from Alice to Bob) is T = TA × TB, hence the key
feasibility. In particular, DV MDI-QKD was demonstrated over rate R of MDI-QKD scales as T × η2. This means that the key rate of
200 km telecom fibre106 and 404 km of ultralow loss fibre107 in lab MDI-QKD scales linearly with the whole channel transmittance
conditions, and over 30 km of deployed fibre.108 With highly (same as the case of conventional QKD and DDI-QKD), but

npj Quantum Information (2016) 16025 Published in partnership with The University of New South Wales
 Quantum key distribution
E Diamanti et al
7

Figure 5. (a) The schematic diagram of DV MDI-QKD proposed in ref. 21. (b) Simulation results of MDI-QKD and the TGW and PLOB bounds. DV
MDI-QKD has a high key rate and is suitable for metropolitan networks. The achievable key rate is about 0.01 bit per pulse at a channel loss of
5 dB (which corresponds to 25 km telecom fibre). The key rate of DV MDI-QKD is only about 2 orders of magnitude away from the TGW bound
at a practical distance. The simulation corresponds to the symmetric MDI-QKD case where the channels between Alice and Charlie and Charlie
and Bob have the same amount of losses. It assumes high-efficiency SNSPDs with detection efficiency of 93% and dark count probability of
10 − 6 (per pulse),53 and an intrinsic error rate of 0.1%.106 The efficiency of error correction is assumed to be 1.16. Note that if the detection
efficiency is reduced, for instance, to 50%, this induces a drop of the key rate of about a factor of 4. This means that for the metropolitan
applications of DV MDI-QKD, the requirement on detector efficiency is not stringent. (c) MDI-QKD metropolitan area network experimental
field test with untrusted relays.110 Figures adapted with permission from: (a) ref. 21, © 2012 APS; (b) ref. 112 courtesy of Feihu Xu; (c) ref. 110
courtesy of Qiang Zhang.

quadratically with the detector efficiency.). Recently, the detector- single-photon BSM scheme.118 However, its ability to completely
device-independent (DDI) QKD protocol, designed to bridge the remove detector side-channel attacks has yet to be proven. Either
strong security of MDI-QKD with the high efficiency of conven- countermeasures to Trojan horse attacks119 or some trustworthi-
tional QKD, was proposed.115–117 In this protocol, the legitimate ness to the BSM device is still required to establish the security of
receiver employs a trusted linear optics network to decode DDI-QKD.120 In fact, mathematically the standard BB84 QKD
information on photons received from an insecure quantum protocol based on a four-state modulation scheme can be
channel, and then performs a Bell state measurement (BSM) using formulated into a DDI-QKD protocol.121 This highlights the
uncharacterised detectors. One important advantage of this underlying connection between DDI-QKD and the BB84 protocol.
approach is that its key rate scales linearly with the detector Finally, we remark that the advantage of DDI-QKD compared with
efficiency. This is achieved by replacing the two-photon BSM MDI-QKD becomes insignificant if high detection efficiency
scheme in the original MDI-QKD protocol (Figure 5a) by a detectors are used in both schemes.

Published in partnership with The University of New South Wales npj Quantum Information (2016) 16025
 Quantum key distribution
E Diamanti et al
8
CV MDI-QKD. The MDI-QKD scheme has been extended recently source, capable of naturally providing phase-randomised coherent
to the CV framework122 (see also refs 123,124 for a more restricted pulses at a clock rate of up to 2.5 GHz.134,135
security analysis). In the CV framework, both Alice and Bob Progress has also been made on enhancing the security of QKD
prepare Gaussian-modulated coherent states and send them to an by carefully examining source imperfections in implementations.
untrusted third party, Charlie, who measures the correlation Refs 136,137 studied the risk of Trojan horse attacks due to back
between the incoming quantum states. The CV MDI-QKD system reflections from commonly used optical components in QKD.
requires high efficiency (485%) homodyne detectors for a Similar research was also conducted for CV-QKD.138 In ref. 139, by
positive key rate.112 This efficiency requirement has been met in using laser-induced damage threshold of single-mode optical fibre
recent proof-of-principle laboratory free-space experiments.122,125 to bound the photon numbers in Eve’s Trojan horse pulses, the
However, achieving the required efficiencies in a fibre-based authors provided quantitative security bounds and a purely
optical network setting is more challenging, owing to the detector passive solution against a general Trojan horse attack.
coupling loss and losses by fibre network interconnects and All the above advances strongly suggest the feasibility of long-
components110 (see also ref. 126 for a different perspective). When distance secure quantum communication with imperfect sources.
high efficiency detectors are in place, CV MDI-QKD would require A promising research direction is to apply the above techniques
an asymmetric configuration, where Charlie needs to be located for QKD with imperfect sources to MDI-QKD leading to practical
close to one of the users. Even in this case, the expected key rate side-channel-free QKD. To achieve this goal, it is necessary to
of the state-of-the-art CV MDI-QKD system drops to zero when the establish a comprehensive list of assumptions on the sources, and
channel loss is above 6 dB (corresponding to 30 km standard verify them one by one. In a recent experimental demon-
telecom fibre).112,122 Therefore, for long distance (430 km) stration,140 the loss-tolerant protocol is applied to a MDI-QKD
applications, DV MDI-QKD is currently the only option available setting. Such an experiment thus addresses source and detector
for MDI-QKD. A reliable phase reference between Alice and Bob flaws at the same time.
also needs to be established in CV MDI-QKD, and may be possible We end our discussion on practical security by noting that in
to realise using recently proposed techniques for standard both classical and quantum cryptography, it is also important to
CV-QKD.58–60 Despite these challenges, CV MDI-QKD has the carefully address the risks of side-channel attacks on the
potential for very high key rates, within one order of magnitude electronics and post-processing layers. Various side-channel
from the TGW and PLOB bounds, at relatively short communica- attacks discovered in classical cryptography, such as the timing
tion distances. attack,141 the power-monitoring attack,142 and acoustic crypt-
analysis,143 can also pose threats to quantum cryptography.
QKD with imperfect sources Closing these side channels requires substantial future efforts.
Given that the security loopholes associated with the measure-
ment device can be closed by MDI-QKD, an important remaining NETWORK QKD
question is how to justify the assumption of trustable quantum
So far, our discussion has been largely limited to point-to-point
state preparation, including single-mode operation, perfect global
QKD links. Although these links are useful for some applications,
phase randomisation, no side channels, etc. On one hand, the
QKD network structures must be considered in order to enable
imperfections in quantum state preparation need to be carefully
access by a greater many users and also to extend the reach and
quantified and taken into account in the security proof; on the
geographical coverage. In addition, the incorporation of mobile
other hand, practical countermeasures are required to prevent
QKD nodes for key transports will add to network connection
Trojan horse attacks119 on the source.
flexibility and allow even greater geographical coverage. In the
To address imperfections in quantum state preparation in QKD,
following, we discuss approaches for building a QKD network and
a loss-tolerant protocol was proposed in ref. 32, which makes QKD
possibilities for future mobile QKD deployment.
tolerable to channel loss in the presence of source flaws (see also
studies in refs 127,128). On the basis of the assumption that the
single-photon components of the states prepared by Alice remain Building QKD networks
inside a two-dimensional Hilbert space, it was shown that Eve An important issue in a network setting is the topology that allows
cannot enhance state preparation flaws by exploiting the channel for multiple users to access the network. A star topology is suitable
loss and Eve’s information can be bounded by the rejected data for this purpose for relatively short distance (up to 400 km).
analysis.129 The intuition for the security of loss-tolerant QKD Imagine a star network where there is at most one intermediate
protocol can be understood in the following manner. By assuming node between any two users, allowing for secure quantum
that the state prepared by Alice is a qubit, it becomes impossible communication among all users without the need for the relay to
for Eve to perform an unambiguous state discrimination (USD) be trusted. In fact, this approach has already been demonstrated
attack.130 Indeed, in order for Eve to perform a USD attack, the based on the MDI-QKD protocol.110 The long-term vision is for
states prepared by Alice must be linearly independent; but by each user to use a simple and cheap transmitter and outsource all
having three or more states in a two-dimensional space, in general the complicated devices for network control and measurement to
the set of states prepared by Alice is linearly dependent, thus an untrusted network operator. As only one set of measurement
making USD impossible. devices will be needed for such a network that is shared by many
The above loss-tolerant protocol has been further developed users, the cost per user could be kept relatively low. The network
and demonstrated experimentally in ref. 131, where the authors provider would then be in a favourable position to deploy state-
implemented decoy-state QKD with imperfect state preparation of-the-art technologies including high detection efficiency SNSPDs
and employed tight finite-key security bounds with composable to enhance the performance of the network and to perform all
security against coherent attacks. The work in ref. 32 has also been network management tasks. The important advantage is that the
extended to the finite-key regime in ref. 132, where a wide range network operator can be completely untrusted without compro-
of imperfections in the laser source, such as the intensity mising security. Experimental demonstrations of network
fluctuations, have been taken into account. In ref. 133, a rigorous MDI-QKD, either in optical fibres110 or in free space, are a major
security proof of QKD systems using discrete-phase-randomised step towards such QKD networks with untrusted relays.
coherent states was given, thus removing the requirement for Nonetheless, MDI-QKD is limited in distance, hence in order to
perfect phase randomisation. With respect to this, we note that address the great challenge of extending the distance of secure
gain-switched laser diodes are presently the de facto QKD light QKD, three further approaches are possible. The first and the

npj Quantum Information (2016) 16025 Published in partnership with The University of New South Wales
 Quantum key distribution
E Diamanti et al
9
simplest approach is to use trusted relays. This is already feasible position-based quantum cryptography, cannot be perfectly
with current technology and indeed has been used as the achieved with unconditional security. However, other security
standard in existing QKD networks.16,144 By setting up trusted models exist, such as, for instance, those based on relativistic
nodes, for instance, every 50 km, to relay secrets, it is possible to constraints or on noisy storage assumptions,179 where by
achieve secure communication over arbitrarily long distances. The assuming that it is impossible for an eavesdropper to store
QKD network currently under development between Shanghai quantum information for a long time, one can retrieve security for
and Beijing is based on this approach. such protocols.
The second approach is quantum repeaters, which remove the Determining the exact power and limitations of quantum
need for the users to trust the relay nodes. Quantum repeaters are communication is the subject of intense research efforts world-
beyond current technology, but have been a subject of intense wide. The formidable developments that can be expected in the
research efforts in recent years. The long-term vision here is to next few years will mark important milestones towards the
construct a global quantum internet as described, for example, in quantum internet of the future.
ref. 14. Research efforts on quantum repeaters have focused on
matter quantum memories and their interface with photonic
flying qubits.145,146 However, new recent approaches manage to Notes added in proof
reduce the need for a quantum memory147 or to completely After a completion of a preliminary version of this paper, a recent
remove it by using all-photonic quantum repeaters.148 preprint181 has been posted on the arXiv that demonstrates the
Finally, the third approach is ground-to-satellite QKD. By using insecurity of DDI-QKD protocol. In addition, it has come to our
one or a few trusted satellites as relay stations, it is possible to attention that DI-QKD remains vulnerable to covert channels such
extend the distance of secure QKD to the global scale. To this end, as memory attack.182
several free-space studies, including experiments with low earth
orbit (LEO) satellites, have been conducted.149–155 China, the EU
and Canada are all currently exploring experimental ground- ACKNOWLEDGEMENTS
to-satellite QKD in ambitious long-term projects involving LEO We acknowledge helpful comments from many colleagues including Romain
satellites. Alléaume, Hoi-Fung Chau, Marcos Curty, Philippe Grangier, Anthony Leverrier,
Charles Ci Wen Lim, Marco Lucamarini, Xiongfeng Ma, Joyce Poon, Li Qian, Kiyoshi
Tamaki and Feihu Xu. We thank our colleagues including Ping Koy Lam, Vikas Anant,
Mobile QKD
Jessie Qin-Dregely, Chris Erven, Masato Koashi, Philip Sibson, Mark Thompson and
The studies in free-space QKD may also open the door to mobile Qiang Zhang for allowing us to reproduce some of their figures. We thank Warren
QKD networks, which can be useful in many applications, such as Raye of Nature Partner Journals for securing the permission for reproductions of
ship-to-ship communication, airport traffic control, communica- figures from various publishers. We acknowledge financial support from NSERC, CFI,
tion between autonomous vehicles, etc. In such a network, the ORF, the US Office of Naval Research (ONR), the Laboratory Directed Research and
mobility of QKD platforms requires the network to be highly Development (LDRD) Program of Oak Ridge National Laboratory (managed by
reconfigurable—the QKD users should be able to automatically UT-Battelle LLC for the US Department of Energy), the City of Paris, the French
determine the optimal QKD route in real time based on their National Research Agency, the Ile-de-France Region, the France-USA Partner
locations. Fast-beam tracking systems are indispensable. Further- University Fund, and the Commissioned Research of National Institute of Information
more, due to the strong ambient light, an effective filtering and Communications Technology (NICT), Japan.
scheme is required to selectively detect quantum signals. Recent
studies analyze the effect of fading and of atmospheric turbulence
COMPETING INTERESTS
to CV-QKD156 and show that CV-QKD with coherent detection
Owing to the employments and consulting activities of some of the authors, they
could be robust against ambient noise photons due to the
have financial interests in the commercial applications of quantum key distribution.
intrinsic filtering function of the local oscillator.157 We also note
that preliminary studies suggest that QKD at microwave
wavelengths, which are widely used in wireless communications, REFERENCES
might be feasible over short distances.158–160 Driven by various 1. Shor, P. W. Proceedings of the 35th Annual Symposium on Foundations of
potential applications, we expect that mobile QKD will become an Computer Science (ed. Goldwasser, S.) 124–134 (IEEE Computer Society Press,
active research topic in the coming years. 1994).
2. Encyclopedia Britannica. ENIAC. https://www.britannica.com/technology/ENIAC.
3. Cesare, C. Encryption faces quantum foe. Nature 525, 167–168 (2015).
CONCLUSION 4. Bennett, C. H. & Brassard, G. Proceedings of the IEEE International Conference on
In this review, we have discussed important challenges in practical Computers, Systems, and Signal Processing (ed. Goldwasser, S.) 175–179
QKD. These range from extending security proofs to the most (IEEE Press, 1984).
general attacks allowed by quantum mechanics to developing 5. Ekert, A. K. Quantum cryptography based on Bell’s theorem. Phys. Rev. Lett. 67,
661–663 (1991).
photonic chips as well as side-channel-free systems and global-
6. Scarani, V. et al. The security of practical quantum key distribution. Rev. Mod.
scale QKD networks. Addressing these challenges using some of Phys. 81, 1301 (2009).
the approaches that we have presented will open the way to the 7. Lo, H.-K., Curty, M. & Tamaki, K. Secure quantum key distribution. Nat. Photon. 8,
use of QKD technology for securing everyday interactions. 595–604 (2014).
As the lead application of the field of Quantum Information 8. Mayers, D. Unconditional security in quantum cryptography. J. ACM 48,
Processing, advances in QKD will have important implications in 351–406 (2001).
many other applications too. For example, a great range of 9. Lo, H.-K. & Chau, H. F. Unconditional security of quantum key distribution over
quantum communication protocols beyond QKD have been arbitrarily long distances. Science 283, 2050–2056 (1999).
studied in recent years161 and their development has directly 10. Shor, P. W. & Preskill, J. Simple proof of security of the BB84 quantum key
distribution protocol. Phys. Rev. Lett. 85, 441–444 (2000).
benefited from research in QKD. These include, for instance,
11. Unruh, D. Advances in Cryptology—Crypto 2013. Vol. 8043, 380–397
quantum bit commitment,162–164 quantum secret sharing,165–167 (Springer, 2013).
quantum coin flipping,168,169 quantum fingerprinting,170,171 quan- 12. Wootters, W. K. & Zurek., W. H. A single quantum cannot be cloned. Nature 299,
tum digital signatures,172,173 blind quantum computing174,175 and 802–803 (1982).
position-based quantum cryptography.176–178 It is known that 13. Dieks, D. Communication by EPR devices. Phys. Lett. 92A, 271–272 (1982).
some of those protocols, such as quantum bit commitment and 14. Kimble., H. J. The quantum internet. Nature 453, 1023–1030 (2008).

Published in partnership with The University of New South Wales npj Quantum Information (2016) 16025
 Quantum key distribution
E Diamanti et al
10
15. Qiu, J. Quantum communications leap out of the lab. Nature 508, 49. Pirandola, S., Laurenza, R., Ottaviani, C. & Banchi., L. The ultimate rate of
441–442 (2014). quantum cryptography. Preprint at arXiv:1510.08863 (2015).
16. Peev, M. et al. The SECOQC quantum key distribution in vienna. New J. Phys. 11, 50. Winzer, P. J. Scaling optical fiber networks: Challenges and solutions. Opt.
075001 (2009). Photon. News 26, 28–35 (2015).
17. Huttner, B., Imoto, N., Gisin, N. & Mor, T. Quantum cryptography with 51. Huang, M. F. et al. Terabit/s Nyquist superchannels in high capacity fiber field
coherent states. Phys. Rev. A 51, 1863–1869 (1995). trials using DP-16QAM and DP-8QAM modulation formats. J. Lightw. Technol. 32,
18. Hwang, W.-Y. Quantum key distribution with high loss: toward global secure 776–782 (2014).
communication. Phys. Rev. Lett. 91, 057901 (2003). 52. Pernice, W. H. P. et al. High-speed and high-efficiency travelling wave single-
19. Lo, H.-K., Ma, X. & Chen, K. Decoy state quantum key distribution. Phys. Rev. Lett. photon detectors embedded in nanophotonic circuits. Nat. Commun. 3,
94, 230504 (2005). 1325 (2012).
20. Wang, X.-B. Beating photon-number-splitting attack in practical quantum 53. Marsili, F. et al. Detecting single infrared photons with 93% system efficiency.
cryptography. Phys. Rev. Lett. 94, 230503 (2005). Nat. Photon. 7, 210–214 (2013).
21. Lo, H.-K., Curty, M. & Qi, B. Measurement-device-independent quantum key 54. Comandar, L. C. et al. Gigahertz-gated InGaAs/InP single-photon detector with
distribution. Phys. Rev. Lett. 108, 130503 (2012). detection efficiency exceeding 55% at 1550 nm. J. Appl. Phys. 117,
22. Christandl, M., Koenig, R., Mitchison, G. & Renner, R. One-and-a-half quantum de 083109 (2015).
Finetti theorems. Commun. Math. Phys 273, 473–498 (2007). 55. Scontel Superconducting nanotechnology. http://www.scontel.ru/; Single
23. Hensen, B. et al. Experimental loophole-free violation of a Bell inequality using Quantum. http://www.singlequantum.com/; ID Quantique. http://www.idquan
entangled electron spins separated by 1.3 km. Nature 526, 682 (2015). tique.com/; Photon Spt. http://www.photonspot.com/ Accessed 19 October,
24. Gol’Tsman, G. N. et al. Picosecond superconducting single-photon optical 2016.
detector. Appl. Phys. Lett. 79, 705–707 (2001). 56. Bahrani, S., Razavi, M. & Salehi, J. A. Orthogonal frequency-division multiplexed
25. Lita, A. E., Miller, A. J. & Nam., S. W. Counting near-infrared single-photons with quantum key distribution. J. Lightw. Technol. 33, 4687–4698 (2015).
95% efficiency. Opt. Express 16, 3032–3040 (2008). 57. Dynes, J. F. et al. Quantum key distribution over multicore fiber. Opt. Express 24,
26. Albota, M. A. & Wong, F. N. C. Efficient single-photon counting at 1.55 μm by 8081–8087 (2016).
means of frequency upconversion. Opt. Lett. 29, 1449–1451 (2004). 58. Qi, B., Lougovski, P., Pooser, R., Grice, W. & Bobrek, M. Generating the local
27. Langrock, C. et al. Highly efficient single-photon detection at communication oscillator ‘locally’ in continuous-variable quantum key distribution based on
wavelengths by use of upconversion in reverse-proton-exchanged periodically coherent detection. Phys. Rev. X 5, 041009 (2015).
poled LiNbO3 waveguides. Opt. Lett. 30, 1725–1727 (2005). 59. Soh, D. B. S. et al. Self-referenced continuous-variable quantum key distribution.
28. Yuan, Z. L., Kardynal, B. E., Sharpe, A. W. & Shields, A. J. High speed single photon Phys. Rev. X 5, 041010 (2015).
detection in the near infrared. Appl. Phys. Lett. 91, 041114 (2007). 60. Huang, D., Huang, P., Lin, D., Wang, C. & Zeng., G. High-speed continuous-
29. Hansen, H. et al. Ultrasensitive pulsed, balanced homodyne detector: application variable quantum key distribution without sending a local oscillator. Opt. Lett.
to time-domain quantum measurements. Opt. Lett. 26, 1714–1716 (2001). 40, 3695–3698 (2015).
30. Jennewein, T., Achleitner, U., Weihs, G., Weinfurter, H. & Zeilinger, A. A fast and 61. Fröhlich, B. et al. Quantum secured gigabit optical access networks. Sci. Rep. 5,
compact quantum random number generator. Rev. Sci. Instrum. 71, 18121 (2015).
1675–1680 (2000). 62. Shibaba, H., Honjo, T. & Shimizu, K. Quantum key distribution over a 72 dB
31. Zhu, E. Y. et al. Poled-fiber source of broadband polarization-entangled channel loss using ultralow dark count superconducting single-photon detec-
photon pairs. Opt. Lett. 38, 4397–4400 (2013). tors. Opt. Lett. 39, 5078–5081 (2014).
32. Tamaki, K., Curty, M., Kato, G., Lo, H.-K. & Azuma, K. Loss-tolerant quantum 63. Jouguet, P., Elkouss, D. & Kunz-Jacques, S. High bit rate continuous-variable
cryptography with imperfect sources. Phys. Rev. A 90, 052314 (2014). quantum key distribution. Phys. Rev. A 90, 042329 (2014).
33. Alléaume, R. et al. Worldwide standardization activity for quantum key dis- 64. Patel, K. A. et al. Quantum key distribution for 10 Gb/s dense wavelength
tribution. In Proceedings of the IEEE Globecom Workshops (GC Wkshps), 656–551 division multiplexing networks. Appl. Phys. Lett. 104, 051123 (2014).
(2014). 65. Choi, I. et al. Field trial of a quantum secured 10 Gb/s DWDM transmission
34. Stucki, D., Brunner, N., Gisin, N., Scarani, V. & Zbinden, H. Fast and simple one- system over a single installed fiber. Opt. Express 22, 23121–23128 (2014).
way quantum key distribution. Appl. Phys. Lett. 87, 194108 (2005). 66. Qi, B., Zhu, W., Qian, L. & Lo, H.-K. Feasibility of quantum key distribution
35. Inoue, K., Waks, E. & Yamamoto, Y. Differential phase shift quantum key through a dense wavelength division multiplexing network. New J. Phys. 12,
distribution. Phys. Rev. Lett. 89, 037902 (2002). 103042 (2010).
36. Grosshans, F. & Grangier, P. Continuous variable quantum cryptography using 67. Kumar, R., Qin, H. & Alléaume, R. Coexistence of continuous variable QKD with
coherent states. Phys. Rev. Lett. 88, 057902 (2002). intense DWDM classical channels. New J. Phys. 17, 043027 (2015).
37. Grosshans, F. et al. Quantum key distribution using gaussian-modulated 68. Fröhlich, B. et al. A quantum access network. Nature 501, 69–72 (2013).
coherent states. Nature 421, 238 (2003). 69. Comandar, L. C. et al. Room temperature single-photon detectors for high bit
38. Diamanti, E. & Leverrier, A. Distributing secret keys with quantum continuous rate quantum key distribution. Appl. Phys. Lett. 104, 021101 (2014).
variables: principle, security and implementations. Entropy 17, 6072–6092 70. Hughes, R. J. et al. Network-centric quantum communications with applications
(2015). to critical infrastructure protection. Preprint at arXiv:1305.0305 (2013).
39. Ma, X., Fung, C.-H. F. & Lo, H.-K. Quantum key distribution with entangled 71. Lim, A. E.-J. et al. Review of silicon photonics foundry efforts. IEEE J. Sel. Topics
photon sources. Phys. Rev. A 76, 012307 (2007). Quantum Electron 20, 405–416 (2014).
40. Lucamarini, M. et al. Efficient decoy-state quantum key distribution with 72. Smit, M. et al. An introduction to InP-based generic integration technology.
quantified security. Opt. Express 21, 24550–24565 (2013). Semicond. Sci. Technol. 29, 083001 (2014).
41. Korzh, B. et al. Provably secure and practical quantum key distribution over 307 73. Zhang, P. et al. Reference-frame-independent quantum-key-distribution server
km of optical fibre. Nat. Photon. 9, 163–168 (2015). with a telecom tether for an on-chip client. Phys. Rev. Lett. 112, 130501 (2014).
42. Jouguet, P., Kunz-Jacques, S., Leverrier, A., Grangier, P. & Diamanti, E. Experi- 74. Vest, G. et al. Design and evaluadtion of a handheld quantum key distribution
mental demonstration of long-distance continuous-variable quantum key sender module. IEEE J. Sel. Topics Quantum Electron 21, 6600607 (2014).
distribution. Nat. Photon. 7, 378 (2013). 75. Sibson, P. et al. Chip-based quantum key distribution. Preprint at
43. Huang, D. et al. Continuous-variable quantum key distribution with 1 Mbit/s arXiv:1509.00768 (2015).
secure key rate. Opt. Express 23, 17511–17519 (2015). 76. Ma, C. et al. Integrated silicon photonic transmitter for polarization-encoded
44. Lim, C. C. W., Curty, M., Walenta, N., Xu, F. & Zbinden, H. Concise security bounds quantum key distribution. Optica (in press). Preprint on-line available at https://
for practical decoy-state quantum key distribution. Phys. Rev. A 89, arxiv.org/abs/1606.04407.
022307 (2014). 77. Takesue, H. et al. Differential phase shift quantum key distribution experiment
45. Lucamarini, M., Dynes, J. F., Fröhlich, B., Yuan, Z. & Shields, A. J. Security bounds over 105 km fibre. New J. Phys. 7, 232 (2005).
for efficient decoy-state quantum key distribution. IEEE J. Sel. Topics Quantum 78. Nambu, Y., Yoshino, K. & Tomita, A. Quantum encoder and decoder for practical
Electron 21, 6601408 (2015). quantum key distribution using a planar lightwave circuit. J. Mod. Opt. 55,
46. Moroder, T. et al. Security of distributed-phase-reference quantum key dis- 1953–1970 (2008).
tribution. Phys. Rev. Lett. 109, 260501 (2012). 79. Ziebell, M. et al. CLEO/Europe (EQEC, Munich, Germany, 2015).
47. Leverrier, A. Composable security proof for continuous-variable quantum key 80. Bechmann-Pasquinucci, H. & Tittel, W. Quantum cryptography using larger
distribution with coherent states. Phys. Rev. Lett. 114, 070501 (2015). alphabets. Phys. Rev. A 61, 062308 (2000).
48. Takeoka, M., Guha, S. & Wilde, M. M. Fundamental rate-loss tradeoff for optical 81. Bourennane, M., Karlsson, A. & Björk, G. Quantum key distribution using multi-
quantum key distribution. Nat. Commun. 5, 5235 (2014). level encoding. Phys. Rev. A 64, 012306 (2001).

npj Quantum Information (2016) 16025 Published in partnership with The University of New South Wales
 Quantum key distribution
E Diamanti et al
11
82. Cerf, N. J., Bourennane, M., Karlsson, A. & Gisin, N. Security of quantum key 114. Tamaki, K., Lo, H.-K., Fung, C.-H. F. & Qi, B. Phase encoding schemes for
distribution using d-level systems. Phys. Rev. Lett. 88, 127902 (2002). measurement-device-independent quantum key distribution with basis-
83. Zhang, L., Silberhorn, C. & Walmsley, I. A. Secure quantum key distribution dependent flaw. Phys. Rev. A 85, 042307 (2012).
using continuous variables of single photons. Phys. Rev. Lett. 100, 110504 115. González, P. et al. Quantum key distribution with untrusted detectors. Phys. Rev.
(2008). A 92, 022337 (2015).
84. Zhang, Z., Mower, J., Englund, D., Wong, F. N. C. & Shapiro, J. H. Unconditional 116. Lim, C. C. W. et al. Detector-device-independent quantum key distribution. Appl.
security of time-energy entanglement quantum key distribution using dual- Phys. Lett. 105, 221112 (2014).
basis interferometry. Phys. Rev. Lett. 112, 120506 (2014). 117. Cao, W.-F. et al. Highly efficient quantum key distribution immune to all detector
85. Zhong, T. et al. Photon-efficient quantum key distribution using time-energy attacks. Preprint at arXiv:1410.2928v1 (2014).
entanglement with high-dimensional encoding. New J. Phys. 17, 022002 118. Kim, Y.-H. Single-photon two-qubit entangled states: Preparation and
(2015). measurement. Phys. Rev. A 67, 040301(R) (2003).
86. Mirhosseini, M. et al. High-dimensional quantum cryptography with 119. Gisin, N., Fasel, S., Kraus, B., Zbinden, H. & Ribordy, G. Trojan-horse attacks on
twisted light. New J. Phys. 17, 033033 (2015). quantum-key-distribution systems. Phys. Rev. A 73, 022320 (2006).
87. Etcheverry, S. et al. Quantum key distribution session with 16-dimensional 120. Qi, B. Trustworthiness of detectors in quantum key distribution with untrusted
photonic states. Sci. Rep. 3, 2316 (2013). detectors. Phys. Rev. A 91, 020303(R) (2015).
88. Sasaki, T., Yamamoto, Y. & Koashi, M. Practical quantum key distribution pro- 121. Liang, W.-Y. et al. Simple implementation of quantum key distribution based on
tocol without monitoring signal disturbance. Nature 509, 475–478 (2014). single-photon bell state measurement. Phys. Rev. A 92, 012319 (2015).
89. Guan, J. Y. et al. Experimental passive round-robin differential phase-shift 122. Pirandola, S. et al. High-rate measurement-device-independent quantum cryp-
quantum key distribution. Phys. Rev. Lett. 114, 180502 (2015). tography. Nat. Photon. 9, 397–402 (2015).
90. Takesue, H., Sasaki, H., Tamaki, K. & Koashi, M. Experimental quantum key dis- 123. Li, Z., Zhang, Y.-C., Xu, F., Peng, X. & Guo, H. Continuous-variable measurement-
tribution without monitoring signal disturbance. Nat. Photon. 9, device-independent quantum key distribution. Phys. Rev. A 89, 052301
827—831 (2015). (2014).
91. Wang, S. et al. Experimental demonstration of quantum key distribution without 124. Ma, X.-C., Sun, S.-H., Jiang, M.-S., Gui, M. & Liang, L.-M. Gaussian-modulated
signal disturbance monitoring. Nat. Photon. 9, 832–836 (2015). coherent-state measurement-device-independent quantum key distribution.
92. Li, Y. H. et al. Experimental round-robin differential phase-shift quantum key Phys. Rev. A 89, 042335 (2014).
distribution. Phys. Rev. A 93, 030302(R) (2016). 125. Gehring, T. et al. Implementation of continuous-variable quantum key
93. Mizutani, A., Imoto, N. & Tamaki, K. Robustness of round-robin differential phase- distribution with composable and one-sided-device-independent security
shift quantum key distribution protocol against source flaws. Phys. Rev. A 92, against coherent attacks. Nat. Commun. 6, 8795 (2015).
060303 (2015). 126. Pirandola, S. et al. Reply to 'Discrete and continuous variables for measurement-
94. Zhao, Y., Fung, C.-H. F., Qi, B., Chen, C. & Lo, H.-K. Quantum hacking: experi- device-independent quantum cryptography'. Nat. Photon. 9, 773 (2015).
mental demonstration of time-shift attack against practical quantum-key- 127. Yin, Z.-Q. et al. Measurement-device-independent quantum key distribution
distribution systems. Phys. Rev. A 78, 042333 (2008). with uncharacterized qubit sources. Phys. Rev. A 88, 062322 (2013).
95. Lydersen, L. et al. Hacking commercial quantum cryptography systems by tai- 128. Yin, Z.-Q. et al. Mismatched-basis statistics enable quantum key distribution with
lored bright illumination. Nat. Photon. 4, 686–689 (2010). uncharacterized qubit sources. Phys. Rev. A 90, 052319 (2014).
96. Xu, F., Qi, B. & Lo, H.-K. Experimental demonstration of phase-remapping attack 129. Barnett, S. M., Huttner, B. & Phoenix, S. Eavesdropping strategies and
in a practical quantum key distribution system. New J. Phys. 12, 113026 rejected-data protocols in quantum cryptography. J. Mod. Opt. 40, 2501
(2010). (1993).
97. Mayers, D. & Yao, A. Quantum cryptography with imperfect apparatus. in Pro- 130. Dušek, M., Jahma, M. & Lütkenhaus, N. Unambiguous state discrimination in
ceedingsof the 39th Annual Symposium on Foundations of Computer Science, quantum cryptography with weak coherent states. Phys. Rev. A 62,
1998. 503–509 (IEEE, 1998). 022306 (2000).
98. Can, A. et al. Device-independent security of quantum cryptography against 131. Xu, F. et al. Experimental quantum key distribution with source flaws. Phys. Rev.
collective attacks. Phys. Rev. Lett. 98, 230501 (2007). A 92, 032305 (2015).
99. Braunstein, S. L. & Pirandola, S. Side-channel-free quantum key distribution. 132. Mizutani, A., Curty, M., Lim, C. C. W., Imoto, N. & Tamaki, K. Finite-key security
Phys. Rev. Lett. 108, 130502 (2012). analysis of quantum key distribution with imperfect light sources. New J. Phys.
100. Shalm, L. K. et al. A strong loophole-free test of local realism. Phys. Rev. Lett. 115, 17, 093011 (2015).
250402 (2015). 133. Cao, Z., Zhang, Z., Lo, H.-K. & Ma, X. Discrete-phase-randomized coherent state
101. Giustina, M. et al. A significant-loophole-free test of Bell’s theorem with source and its application in quantum key distribution. New J. Phys. 17,
entangled photons. Phys. Rev. Lett. 115, 250401 (2015). 053014 (2015).
102. Biham, E., Huttner, B. & Mor, T. Quantum cryptographic network based on 134. Yuan, Z. L. et al. Robust random number generation using steady-state emission
quantum memories. Phys. Rev. A 54, 2651 (1996). of gain-switched laser diodes. Appl. Phys. Lett. 104, 261112 (2014).
103. Inamori, H. Security of practical time-reversed EPR quantum key distribution. 135. Yuan, Z. L. et al. A directly phase-modulated light source. Phys. Rev. X 6,
Algorithmica 34, 340 (2002). 031044 (2016).
104. Curty, M. et al. Finite-key analysis for measurement-device-independent quan- 136. Jain, N. et al. Trojan-horse attacks threaten the security of practical quantum
tum key distribution. Nat. Commun. 5, 3732 (2014). cryptography. New J. Phys. 16, 123030 (2014).
105. Lim, C. C. W., Portmann, C., Tomamichel, M., Renner, R. & Gisin, N. Device- 137. Jain, N. et al. Risk analysis of trojan-horse attacks on practical quantum
independent quantum key distribution with local Bell test. Phys. Rev. X 3, key distribution systems. IEEE J. Sel. Topics Quantum Electron 21, 6600710
031006 (2013). (2015).
106. Tang, Y.-L. et al. Measurement-device-independent quantum key distribution 138. Stiller, B. et al. in 2015 Conference on Lasersand Electro-Optics (CLEO)
over 200 km. Phys. Rev. Lett. 113, 190501 (2014). (ed. Goldwasser, S.) (Optical Society of America, 2015).
107. Yin, H.-L. et al. Measurement device independent quantum key distribution over 139. Lucamarini, M. et al. Practical security bounds against the Trojan-horse attack in
404 km optical fibre. Preprint at arXiv:1606.06821 (2016). quantum key distribution. Phys. Rev. X 5, 031030 (2015).
108. Tang, Y.-L. et al. Field test of measurement-device-independent quantum key 140. Tang, Z., Wei, K., Bedroya, O., Qian, L. & Lo, H.-K. Experimental measurement-
distribution. IEEE J. Sel. T. Quantum Electron. 21, 6600407 (2014). device-independent quantum key distribution with imperfect sources. Phys. Rev.
109. Valivarthi, R. et al. Measurement-device-independent quantum key distribution: A 93, 042308 (2016).
from idea towards application. J. Mod. Opt. 62, 1141–1150 (2015). 141. Paul, C. K. in Advances in Cryptology—CRYPTO 1996 104–113 (Springer, 1996).
110. Tang, Y.-L. et al. Measurement-device-independent quantum key distribution 142. Kocher, P., Jaffe, J. & Jun, B. in Advances in Cryptology—CRYPTO 1999
over untrustful metropolitan network. Phys. Rev. X 6, 011024 (2015). 388–397 (Springer, 1999).
111. Comandar, L. C. et al. Quantum cryptography without detector vulnerabilities 143. Genkin, D., Shamir, A. & Tromer, E. in Advances in Cryptology—CRYPTO 2014
using optically-seeded lasers. Nat. Photon. 10, 312–315 (2016). 444–461 (Springer, 2014).
112. Xu, F., Curty, M., Qi, B., Qian, L. & Lo, H.-K. Discrete and continuous variables for 144. Sasaki, M. et al. Field test of quantum key distribution in the Tokyo QKD net-
measurement-device-independent quantum cryptography. Nat. Photon. 9, work. Opt. Express 19, 10387 (2011).
772 (2015). 145. Northup, T. E. & Blatt, R. Quantum information transfer using photons. Nat.
113. Yuan, Z.-L. et al. Interference of short optical pulses from independent gain- Photon. 8, 356 (2014).
switched laser diodes for quantum secure communications. Phys. Rev. Applied 2, 146. Bussières, F. et al. Quantum teleportation from a telecom-wavelength photon to
064006 (2014). a solid-state quantum memory. Nat. Photon. 8, 775 (2014).

Published in partnership with The University of New South Wales npj Quantum Information (2016) 16025
 Quantum key distribution
E Diamanti et al
12
147. Munro, W. J., Stephens, A. M., Devitt, S. J., Harrison, K. A. & Nemoto, K. Quantum 168. Berlin, G. et al. Flipping quantum coins. Nat. Commun. 2, 561 (2011).
communication without the necessity of quantum memories. Nat. Photon. 6, 169. Pappa, A. et al. Experimental plug and play quantum coin flipping.
777–781 (2012). Nat. Commun. 5, 3717 (2014).
148. Azuma, K., Tamaki, K. & Lo, H.-K. All-photonic quantum repeaters. Nat. Commun. 170. Buhrman, H., Cleve, R., Watrous, J. & Wolf, R. D. Quantum fingerprinting. Phys.
6, 6787 (2015). Rev. Lett. 87, 167902 (2001).
149. Buttler, W. T. et al. Daylight quantum key distribution over 1.6 km. Phys. Rev. Lett. 171. Xu, F. et al. Experimental quantum fingerprinting. Nat. Commun. 6, 8735
84, 5652 (2000). (2015).
150. Nauerth, S. et al. Air-to-ground quantum communication. Nat. Photon. 7, 172. Gottesman, D. & Chuang, I. Quantum digital signatures. Preprint at quant-ph/
382–386 (2013). 0105032 (2001).
151. Wang, J.-Y. et al. Direct and full-scale experimental verifications towards ground- 173. Donaldson, R. J. et al. Experimental demonstration of kilometer-range quantum
satellite quantum key distribution. Nat. Photon. 7, 387–393 (2013). digital signatures. Phys. Rev. A 93, 012329 (2016).
152. Vallone, G. et al. Experimental satellite quantum communications. Phys. Rev. Lett. 174. Broadbent, A., Fitzsimons, J. & Kashefi, E. in Proceedings of the 50th Annual
115, 040502 (2015). Symposium on Foundations of Computer Science 517–526 (IEEE, 2009).
153. Meyers, R. E. in Advanced Free Space Optics (FSO) 343–387 (Springer, 2015). 175. Barz, S. et al. Experimental demonstration of blind quantum computing. Science
154. Elser, D. et al. in IEEE ICSOS 2015, (New Orleans, USA, 2015). 335, 303 (2012).
155. Bourgoin, J. P. et al. Free-space quantum key distribution to a moving receiver. 176. Lau, H.-K. & Lo, H.-K. Insecurity of position-based quantum-cryptography
Opt. Express 23, 33437–33447 (2015). protocols against entanglement attacks. Phys. Rev. A 83, 012322 (2011).
156. Usenko, V. C. et al. Entanglement of Gaussian states and the applicability 177. Buhrman, H. et al. Position-based quantum cryptography: Impossibility and
to quantum key distribution over fading channels. New J. Phys. 14, constructions. SIAM J. Comput. 43, 150–178 (2014).
093048 (2012). 178. Chakraborty, K. & Leverrier, A. Practical position-based quantum cryptography.
157. Heim, B. et al. Atmospheric continuous-variable quantum communication. New Phys. Rev. A 92, 052304 (2015).
J. Phys. 16, 113018 (2014). 179. Wehner, S., Curty, M., Schaffner, C. & Lo, H.-K. Implementation of two-party
158. Usenko, V. C. & Filip, R. Feasibility of continuous-variable quantum key protocols in the noisy-storage model. Phys. Rev. A 81, 052336 (2010).
distribution with noisy coherent states. Phys. Rev. A 81, 022318 (2010). 180. Lam, P.-K. & Ralph, T. Quantum cryptography: Continuous improvement. Nat.
159. Weedbrook, C., Pirandola, S., Lloyd, S. & Ralph, T. C. Quantum cryptography Photon. 7, 350 (2013).
approaching the classical limit. Phys. Rev. Lett. 105, 110501 (2010). 181. Sajeed, S, Huang, A, Sun, S, Xu, F, Makarov, V & Curty, M. Insecurity of detector-
160. Weedbrook, C., Pirandola, S. & Ralph, T. C. Continuous-variable quantum key device-independent quantum key distribution. https://arxiv.org/abs/1607.05814
distribution using thermal states. Phys. Rev. A 86, 022318 (2012). (2016).
161. Broadbent, A. & Schaffner, C. Quantum cryptography beyond quantum key 182. Barrett, J., Colbeck, R. & Kent, A. Memory attacks on device-independent
distribution. Des. Codes Cryptogr. 78, 351–382 (2016). quantum cryptography. Phys. Rev. Lett. 110, 010503 (2013).
162. Mayers, D. Unconditionally secure quantum bit commitment is impossible. Phys.
Rev. Lett. 78, 3414–3417 (1997).
163. Lo, H.-K. & Chau, H. F. Is quantum bit commitment really possible? Phys. Rev. Lett. This work is licensed under a Creative Commons Attribution 4.0
78, 3410–3413 (1997). International License. The images or other third party material in this
164. Lunghi, T. et al. Practical relativistic bit commitment. Phys. Rev. Lett. 115, article are included in the article’s Creative Commons license, unless indicated
030502 (2015). otherwise in the credit line; if the material is not included under the Creative Commons
165. Cleve, R., Gottesman, D. & Lo, H.-K. How to share a quantum secret. Phys. Rev. license, users will need to obtain permission from the license holder to reproduce the
Lett. 83, 648–651 (1999). material. To view a copy of this license, visit http://creativecommons.org/licenses/
166. Hillery, M., Bužek, V. & Berthiaume, A. Quantum secret sharing. Phys. Rev. A 59, by/4.0/
1829–1834 (1999).
167. Bell, B. A. et al. Experimental demonstration of graph-state quantum secret
sharing. Nat. Commun. 5, 5480 (2014). © The Author(s) 2016

npj Quantum Information (2016) 16025 Published in partnership with The University of New South Wales