⇦Chinese Physics Letters, 2016, Vol. 33, No. 4, Article code 040301 Security of the Decoy State Two-Way Quantum Key Distribution with Finite Resources * Ya-Bin Gu(古亚彬)1,2, Wan-Su Bao(鲍皖苏)1,2**, Yang Wang(汪洋)1,2, Chun Zhou(周淳)1,2 Affiliations 1Zhengzhou Information Science and Technology Institute, Zhengzhou 450004 2Synergetic Innovation Center of Quantum Information and Quantum Physics, University of Science and Technology of China, Hefei 230026 Received 12 November 2015 *Supported by the National Basic Research Program of China under Grant No 2013CB338002, and the National Natural Science Foundation of China under Grant Nos 11304397 and 61505261.
**Corresponding author. Email: 2010thzz@sina.com Citation Text: Gu Y B, Bao W S, Wang Y and Zhou C 2016 Chin. Phys. Lett. 33 040301 Abstract The quantum key distribution (QKD) allows two parties to share a secret key by typically making use of a one-way quantum channel. However, the two-way QKD has its own unique advantages, which means the two-way QKD has become a focus recently. To improve the practical performance of the two-way QKD, we present a security analysis of a two-way QKD protocol based on the decoy method with heralded single-photon sources (HSPSs). We make use of two approaches to calculate the yield and the quantum bit error rate of single-photon and two-photon pulses. Then we present the secret key generation rate based on the GLLP formula. The numerical simulation shows that the protocol with HSPSs has an advantage in the secure distance compared with weak coherent state sources. In addition, we present the final secret key generation rate of the LM05 protocol with finite resources by considering the statistical fluctuation of the yield and the error rate. DOI:10.1088/0256-307X/33/4/040301 PACS:03.67.Dd, 03.67.Hk © 2016 Chinese Physics Society Article Text The quantum key distribution (QKD)[1] protocol is used to create secret keys between two legitimate parties, Alice and Bob. Since the first QKD protocol-BB84 was presented more than 30 y ago it has been developed into a functional and commercial technology. The QKD research has been focused on one-way protocols: Alice prepares states and sends them through an insecure quantum channel. On the other side, Bob carries out a measurement. However, the two-way QKD protocol has attracted much attention.[2-12] In a two-way QKD, Bob prepares and measures the states. Alice only carries out an encoding on the states. As we all know, in a two-way QKD, Bob can always make the right measurement, thus no bits are discarded in the process of basis sifting. Therefore, the low requirements for devices in Alice is a kind of advantage, which would play an important role in some special application scenarios, for example, the hand-held portable QKD device and the satellite device. Typical two-way QKD protocols have the plug-and-play protocol, the ping-pong protocol and the LM05 protocol. Two-way channels are already used in QKD in those setups based on a plug-and-play configuration,[2] where only the backward channel should be considered to be quantum channel. Bostrom et al. proposed a ping-pong protocol,[3] which put forward the use of a two-way quantum channel. To avoid the waste of qubits, the entanglement is used to attain a deterministic transmission of information.[3] Unfortunately, the ping-pong protocol has been proved to be not secure.[4,5] Since then, several protocols have been introduced to solve this problem,[6-8] while none of them quantifies the amount of tolerable noise under which the communication remains secure. Lucamarini et al. proposed an LM05[9] protocol, which achieves secure deterministic communication without resorting to entanglement. Meanwhile, the protocol does not require sifting of the raw keys due to a mismatch of basis choices. The major difficulty in the LM05 protocol is that both the forward and the backward channels would be attacked twice by Eve, which leads to the decrease of the secure transmission distance. The security proof for the LM05 protocol has been given in Ref. [10], which has proved the security for the LM05 protocol against the most general attack by Eve. Therefore, the practicability of the LM05 protocol is worth further research. Due to the imperfection in the device and the lack of a perfect single-photon source, the implementation of the QKD protocol is still less than the one ultimately desirable. Fortunately, the decoy state method was proposed,[11] which not only resists the photon number splitting (PNS) attack, but also extends the maximum secure distance. In Ref. [12], Shaari et al. firstly considered the LM05 with the decoy method. They presented the security analysis of the decoy LM05 protocol with weak coherent state (WCS) sources in the context of individual attacks. The combination of the decoy state scheme and the WCS sources in the BB84 protocol extends the secure transmission distance.[13,14] Then the application of heralded single-photon sources (HSPSs) further extends the distance to 170 km.[15] The different photon sources can improve the performance of the protocol. Therefore, in our work, we consider the security of the decoy state LM05 protocol with HSPS. By using two approaches, we calculate the yield and the quantum bit error rate (QBER) of single-photon and two-photon pulses. In the first approach, the single- and double-photon contributions were separately calculated. In the second approach, the single- and double-photon contributions were jointly calculated. In a real QKD system, the length of key is finite, which will have an effect on the security of protocol. There are two main methods of analysis of QKD with infinite resources. One of them is in Ref. [16], Scarani et al. presented the secret key rate for finite resources against collective attacks based on the composable security definition of QKD. Moreover, Li et al.[17] have analyzed the security of decoy-state QKD protocol with finite resources by considering the statistical fluctuations for the yield and error rate of the quantum states in different lengths of pulses. The other one is based on the uncertainty relation for smooth entropies by Tomamichel et al.,[18] which proposed tight finite-key bounds of the secret key rate by using the entropic formulation of the uncertainty relation for evaluating directly the smooth min-entropy and optimized statistical fluctuation analysis in a parameter estimation step. In this Letter, we analyze the security of the LM05 protocol with finite resources based on the first method. Now most of the QKD protocols are based on the WCS.[17,19] However, the dark-count has become the main factor affecting the key rate when the transmission distance is over 100 km. With the development of HSPSs, it can be used in the QKD protocol. The HSPS uses one mode of a spontaneous parametric down-conversion (SPDC). Two patterns have the same characteristics,[20] $$ {|{\it \Psi}\rangle _{TS}}=\sum\limits_{i=0}^\infty {\sqrt {{P_i}}}{|i\rangle _T}{|i\rangle _S},~~ \tag {1} $$ where $|i\rangle$ is the $i$-photon, the probability of generating $i$-photon is ${P_i}={x^i}/{(1+ x)^{1+i}}$ with $x$ being the intensity of one pattern. The pattern $S$ is sent to Bob as the signal state, and the pattern $T$ is used to estimate the number of photons. As is well known, the photon number distribution is thermal[20] (${\mu}$ is the intensity of the pulse) $$ p(\mu,i)=\frac{\mu ^i}{(1+\mu)^{i+1}}.~~ \tag {2} $$ In the QKD protocol, Alice uses a threshold (on-off) detector, which cannot distinguish one from two or more photons. When the detector generates a response, the pulse is sent to Bob certainly. Here ${\eta_{\rm A}}$ is the detection efficiency, and ${d _{\rm A}}$ is the dark-count.[20] Thus the probability that the $i$-photon is detected can be expressed as $$ P(\mu,i)=p(\mu,i)[1-(1-\eta_{\rm A})^i+d_{\rm A}].~~ \tag {3} $$ In the two-way QKD, as the two channels, the transmittance between Alice and Bob is $t={10^{-2\alpha L/10}}$. The efficiency of the detector is ${\eta_{\rm Bob}}$. Thus the overall transmission and detection efficiency is $\eta=t \cdot \eta_{\rm Bob}$. The transmittance of $i$-photon is ${\eta_i}=1-{(1-\eta)^i}$. We consider the case of an infinite number of decoy states, the yield of the $i$-photon and the quantum bit error rate can be estimated by[14] $$\begin{align} Y_i=\,&Y_0+{\eta_i}-Y_0{\eta_i} \approx Y_0+{\eta_i},~~ \tag {4} \end{align} $$ $$\begin{align} e_i=\,&\frac{e_0Y_0+e_{\rm detector}{\eta_i}}{Y_i},~~ \tag {5} \end{align} $$ where $Y_0$ is the background rate, $e_0$ is the noise error rate, assumed to be 1/2 due to randomness, and ${e _{\rm detector}}$ is the probability that a photon reaches the detector in error, which stands for the stability of the QKD. In the experiment, $e_{\rm detector}$ is often considered as a constant. We consider the case of two decoy states and a signal state, with the intensities $v_1$, $v_2$ and $\mu$. The gains for the two decoy states and the signal state, $Q_{v_1}$, $Q_{v_2}$ and $Q_{\mu}$ can be measured in experiment. In the LM05 protocol, not only the single-photon but also the double-photon have the contribution to the key generation.[12,21] We write $$\begin{align} &Q_{v_1}(1+v_1)-Q_{v_2}(1+v_2)\\ =\,&\sum\limits_{i=0}^2 Y_i \Big[\frac{{v_1^i}}{(1+v_1)^i}-\frac{v_2^i}{(1+v_2)^i}\Big][1-(1-\eta_{\rm A})^i+d_{\rm A}]\\ &+\sum\limits_{n=3}^\infty Y_i \Big[\frac{{v_1^i}}{(1+v_1)^i}-\frac{v_2^i}{(1+v_2)^i}\Big][1\\ &-(1-\eta_{\rm A})^i+d_{\rm A}].~~ \tag {6} \end{align} $$ Our interest is about the single- and double-photon contributions, thus we shall consider the following equation $$ \sum\limits_{i=3}^\infty Y_i \frac{\mu ^i}{(1+\mu)^i}=Q_\mu(1+\mu)-\sum\limits_{i=0}^2 Y_i \frac{\mu ^i}{(1+\mu)^i}.~~ \tag {7} $$ Moreover, we consider the case of ${\frac{1}{1+\mu}>\frac{1}{1+v_1}+\frac{1}{1+v_2}}$, the second section on the right side of Eq. (6) can be transformed into another form $$\begin{align} &Q_{v_1}(1+v_1)-Q_{v_2}(1+v_2)\\ &\le \sum\limits_{i=0}^2 Y_i \Big[\frac{{v_1^i}}{(1+v_1)^i}-\frac{v_2^i}{(1+v_2)^i}\Big][1-{{( {1-{\eta_{\rm A}}})}^i}\\ &+d_{\rm A}]+\frac{{\frac{v_1^3}{(1+v_1)^3}-\frac{v_2^3}{(1+v_2)^3}}}{\frac{\mu ^3}{(1+\mu)^3}}(1+d_{\rm A})\Big[Q_\mu(1+\mu)\\ &-\sum\limits_{i=0}^2 Y_i \frac{\mu ^i}{(1+\mu)^i}\Big],~~ \tag {8} \end{align} $$ where ${Y_1^{\rm U}}$ (the upper bound of single-photon yield) and ${Y_0^{\rm L}}$ (the lower bound of dark count) are given by[12,14] $$\begin{alignat}{1} Y_0^{\rm L}=\,&\max \Big\{\Big[Q_{v_1}(1+v_1) \cdot \frac{v_2}{1+v_2}\\ &-Q_{v_2}(1+v_2) \cdot \frac{v_1}{1+v_1}\Big]\\ &\cdot\Big[\frac{v_2}{1+v_2} -\frac{v_1}{1+v_1}\Big]^{-1},0\Big\},~~ \tag {9} \end{alignat} $$ $$\begin{alignat}{1} Y_1^{\rm U}=\,&\frac{{Q_\mu{(1+\mu)^3}-Y_0{(1+\mu)^2}-Y_2^\infty \cdot {\mu ^2}}}{{\mu (1+\mu)}}.~~ \tag {10} \end{alignat} $$ The lower bound of single-photon yield and double-photon yield can be given by $$\begin{align} &Y_1 \ge Y_1^{\rm L}=\Big\{Q_{v_1}(1+v_1)-Q_{v_2}(1+v_2)\\ &-\frac{{\frac{{v_1^2}}{(1+v_1)^2}-\frac{v_2^2}{(1+v_2)^2}}}{{\frac{\mu ^2}{(1+\mu)^2}}}( {1+d_{\rm A}})[Q_\mu(1+\mu)\\ &-Y_0^{\rm L}]\Big\}\cdot\Big\{\Big({{\eta_{\rm A}}+d_{\rm A}}\Big)\Big({\frac{v_1}{1+v_1}-\frac{v_2}{1+v_2}}\Big)\\ &-\frac{{\frac{{v_1^2}}{(1+v_1)^2} -\frac{v_2^2}{(1+v_2)^2}}}{{\frac{\mu}{1+\mu}}}({1+d_{\rm A}})\Big\}^{-1},~~ \tag {11} \end{align} $$ $$\begin{align} &Y_2 \ge Y_2^{\rm L}=\Big\{Q_{v_1}(1+v_1)-Q_{v_2}(1+v_2)\\ &-M[Q_\mu(1+\mu)-Y_0^{\rm L}]\\ &-Y_1^{\rm U}[({{\eta_{\rm A}}+d_{\rm A}})\Big({\frac{v_1}{1+v_1}-\frac{v_2}{1+v_2}}\Big)\\ &-M\frac{\mu}{1+\mu}]\Big\}\cdot\Big\{\Big[{\frac{{v_1^2}}{(1+v_1)^2}-\frac{v_2^2}{(1+v_2)^2}}\Big]\\ &\cdot[1-{(1-{\eta_{\rm A}})^2}+d_{\rm A}]-M\frac{\mu ^2}{(1+\mu)^2}\Big\}^{-1},~~ \tag {12} \end{align} $$ where $$ M=\frac{{\frac{v_1^3}{(1+v_1)^3}-\frac{v_2^3}{(1+v_2)^3}}}{{\frac{\mu ^3}{(1+\mu)^3}}}. $$ To obtain the upper bounds of the errors $e_1$ and $e_2$ related to $Y_1$ and $Y_2$, we now assume that the errors only come from single- and double-photons as well as dark counts $$\begin{align} E_{v_1}Q_{v_1}(1+v_1) \approx\,&e_0Y_0+e_1Y_1\frac{v_1}{1+v_1}\\ &+e_2Y_2\frac{{v_1^2}}{(1+v_1)^2},\\ E_{v_2}Q_{v_2}(1+v_2) \approx\,&e_0Y_0+e_1Y_1\frac{v_2}{1+v_2}\\ &+e_2Y_2\frac{v_2^2}{(1+v_2)^2},\\ {E_\mu}Q_\mu(1+\mu) \approx\,& e_0Y_0+e_1Y_1\frac{\mu}{1+\mu}\\ &+e_2Y_2\frac{\mu ^2}{(1+\mu)^2},~~ \tag {13} \end{align} $$ then we can obtain $$\begin{align} &E_{v_1}Q_{v_1}(1+v_1)-E_{v_2}Q_{v_2}(1+v_2)\\ =\,&e_1Y_1(\frac{v_1}{1+v_1}-\frac{v_2}{1+v_2})\\ &+e_2Y_2[\frac{{v_1^2}}{(1+v_1)^2} -\frac{v_2^2}{(1+v_2)^2}]\\ &{E_\mu}Q_\mu(1+\mu)-E_{v_2}Q_{v_2}(1+v_2)\\ =\,&e_1Y_1(\frac{\mu}{1+\mu}-\frac{v_2}{1+v_2})\\ &+e_2Y_2[\frac{\mu ^2}{(1+\mu)^2}-\frac{v_2^2}{(1+v_2)^2}].~~ \tag {14} \end{align} $$ We can obtain the upper bounds for errors by solving the above two equations $$\begin{align} e_1^{\rm U}=\,&\{[E_{v_1}Q_{v_1}(1+v_1)-E_{v_2}Q_{v_2}(1+v_2)]P\\ &-[{E_\mu}Q_\mu(1+\mu) -E_{v_2}Q_{v_2}(1+v_2)]S\}\\ &\cdot\Big\{Y_1^{\rm L}\Big[\frac{(v_1-v_2)P}{(1+v_2)(1+v_2)}\!-\!\frac{(\mu-v_2)S}{(1+\mu)(1+v_2)}\Big]\Big\}^{-1},\\ e_2^{\rm U}=\,&\Big\{[E_{v_1}Q_{v_1}(1+v_1)-E_{v_2}Q_{v_2}(1+v_2)]\frac{{\mu- v_2}}{1+\mu}\\ &-[{E_\mu}Q_\mu(1+\mu)-E_{v_2}Q_{v_2}(1+v_2)]\frac{{v_1- v_2}}{1+v_1}\Big\}\\ &\cdot\Big\{Y_2^{\rm L}\Big(\frac{{\mu-v_2}}{1+\mu}S-\frac{{v_1-v_2}}{1+v_1}P\Big)\Big\}^{-1},~~ \tag {15} \end{align} $$ where $$\begin{align} P=\,&\frac{\mu ^2}{(1+\mu)^2}-\frac{v_2^2}{(1+v_2)^2},\\ S=\,&\frac{{v_1^2}}{(1+v_1)^2} -\frac{v_2^2}{(1+v_2)^2}. \end{align} $$ In the above section, we find that $Y_2$ is a function of $Y_1$, that is, $Y_2$ is dependent on $Y_1$. Next, we consider a method to calculate the lower bound of $Y_1$ and $Y_2$ jointly. We consider $$\begin{align} Y_1\frac{\mu}{1+\mu}+Y_2\frac{\mu ^2}{(1+\mu)^2}=\,&({Y_1+Y_2})\frac{\mu ^2}{(1+\mu)^2}\\ &+Y_1\frac{\mu}{(1+\mu)^2},~~ \tag {16} \end{align} $$ thus from Eq. (8), we can obtain $$\begin{alignat}{1} &Q_{v_1}(1+v_1)-Q_{v_2}(1+v_2)\\ &\le \sum\limits_{i=1}^2 Y_i [{\frac{{v_1^i}}{(1+v_1)^i}-\frac{v_2^i}{(1+v_2)^i}}]({1+d_{\rm A}})\\ &+M(1+d_{\rm A})(Q_\mu(1+\mu)-Y_0\\ &-({Y_1+Y_2})\frac{\mu ^2}{(1+\mu)^2}+Y_1\frac{\mu}{(1+\mu)^2}).~~ \tag {17} \end{alignat} $$ Thus the lower bound of $Y_1+Y_2$ is given as $$\begin{alignat}{1} &({Y_1+Y_2})^{\rm L}=\Big\{\frac{{[{Q_{v_1}(1+v_1)-Q_{v_2}(1+v_2)}]}}{1+d_{\rm A}}\\ &-M[Q_\mu(1+\mu)-Y_0^{\rm L}-Y_1^{\rm L}\frac{\mu}{(1+\mu)^2}]\Big\}\\ &\cdot\Big\{\frac{v_1}{1+v_1}-\frac{v_2}{1+v_2}-\frac{{\frac{v_1^3}{(1+v_1)^3}- \frac{v_2^3}{(1+v_2)^3}}}{\frac{\mu}{1+\mu}}\Big\}^{-1}.~~ \tag {18} \end{alignat} $$ We only consider the contribution from the single- and double-photon contribution, $$\begin{alignat}{1} {Q_{12}}(\mu) \ge\,& Y_1\frac{\mu}{(1+\mu)^2}+Y_2\frac{\mu ^2}{(1+\mu)^3}\\ =\,&(Y_1+Y_2)\frac{\mu ^2}{(1+\mu)^3}+Y_1\frac{\mu}{(1+\mu)^3}.~~ \tag {19} \end{alignat} $$ Thus the lower bound is $$ Q_{12}^{\rm L}(\mu)={(Y_1+Y_2)^{\rm L}}\frac{\mu ^2}{(1+\mu)^3}+Y_1^{\rm L}\frac{\mu}{(1+\mu)^3}.~~ \tag {20} $$ We now assume that the errors only come from single- and double-photons as well as dark counts, $$ {E_\mu}Q_\mu \ge \frac{{e_0Y_0}}{1+\mu}+e_{12}{Q_{12}}(\mu).~~ \tag {21} $$ Thus the upper bound of error is $$ e_{12}^{\rm U}=\frac{{{E_\mu}Q_\mu-\frac{{e_0Y_0^{\rm L}}}{1+\mu}}}{Q_{12}^{\rm L}}.~~ \tag {22} $$ Tomamichel et al.[22] proved the security of the BB84 protocol against general attacks utilizing an entropic uncertainty relation, where they use the Devetak–Winter formula[23] to calculate the key rate. In a similar manner, Beaudry et al. used the entropic uncertainty relation and the Devetak–Winter security bound to prove the security of the LM05 protocol against the most general type of attacks. From this we can know that the security analysis for the LM05 protocol is similar to the BB84 protocol. In addition, the key rate formula for the BB84 protocol with the decoy method is GLLP.[24] Therefore, we can apply the GLLP idea in the LM05 protocol to calculate the key rate. Thus the lower bounds of the secure key rate for the two cases are given by $$\begin{alignat}{1} \!\!\!\!\!\!\!\!\!\!\!\!R_{1+2}\ge\,&-{Q_{\mu}}f(E_{\mu}){H_2}( E_{\mu})\\ &+\sum\limits_{i=1}^2Q_i^{\rm L}[1-{H_2}({{\rm{e}}_i^{\rm U}})],~~ \tag {23} \end{alignat} $$ $$\begin{alignat}{1} \!\!\!\!\!\!\!\!\!\!\!\!R_{12}\ge\,&-{Q_{\mu}}f(E_{\mu}){H_2}(E_{\mu})+Q_{12}^{\rm L}[1-{H_2}({\rm{e}}_{12}^{\rm U})].~~ \tag {24} \end{alignat} $$ In a practical QKD system, due to the fact that the number of keys is finite, there are statistical fluctuations that exist in the yield and the error rate of the $i$-photon signal states. Based on the law of large numbers, the statistical fluctuation in the yield of the $i$-photon signal states can be expressed as[17] $$ |{Y_i^M\!\!-\!\!Y_i^\infty}|\le \frac{1}{2}\xi ({M,\varepsilon})=\frac{1}{2}\sqrt {\frac{{2\ln (1/\varepsilon)\!+\!4\ln (M\!+\!1)}}{M}},~~ \tag {25} $$ where $Y_i^M$ is the yield of the $i$-photon state with $M$ pulses, $Y_i^\infty$ is the yield of the $i$-photon state with infinite pulses. For the LM05 protocol with two decoy states with HSPSs, the statistical fluctuation of the yield of the $i$-photon state can be expressed as $$\begin{alignat}{1} \!\!\!\!\!\!\!\!\!\!\!\!|{Y_{i,\mu}^{{n_{i,\mu}}}-Y_{i,\mu}^\infty}|\le \frac{1}{2}\xi ( {{n_{i,\mu}},\varepsilon})=\,&\frac{1}{2}\xi ({{N_\mu}p(\mu,i),\varepsilon})\\ \!\!\!\!\!\!\!\!\!\!\!\!|{Y_{i,v_1}^{{n_{i,v_1}}}-Y_{i,v_1}^\infty}|\le \frac{1}{2}\xi ( {{n_{i,v_1}},\varepsilon})=\,&\frac{1}{2}\xi ({N_{v_1}p(v_1,i),\varepsilon})\\ \!\!\!\!\!\!\!\!\!\!\!\!|{Y_{i,v_2}^{{n_{i,v_2}}}-Y_{i,v_2}^\infty}|\le \frac{1}{2}\xi ( {{n_{i,v_2}},\varepsilon})=\,&\frac{1}{2}\xi ({N_{v_2}p(v_2,i),\varepsilon}),~~ \tag {26} \end{alignat} $$ where ${N_\mu}$ is the number of signal states, and $N_{v_1}$ and $N_{v_2}$ are the numbers of decoy states. As in Eq. (26), considering the case of ${|{a-b}|\le|a|+|b|}$, the relative statistical fluctuation of the yield of the $i$-photon state between signal state and decoy state is given by $$\begin{alignat}{1} A_i=\,&|{Y_{i,v_1}^{{n_{i,v_1}}}-Y_{i,\mu}^{{n_{i,\mu}}}}|\\ &\le \frac{1}{2}\xi ({N_{v_1}p(v_1,i),\varepsilon})+\frac{1}{2}\xi ({{N_\mu}p(\mu,i),\varepsilon})\\ B_i=\,&|{Y_{i,v_2}^{{n_{i,v_2}}}-Y_{i,\mu}^{{n_{i,\mu}}}}|\\ &\le \frac{1}{2}\xi ({N_{v_2}p(v_2,i),\varepsilon})+\frac{1}{2}\xi ({{N_\mu}p(\mu,i),\varepsilon}).~~ \tag {27} \end{alignat} $$ Similar to the above analysis under infinite sources, we can calculate the lower bound of the yields of single-photon and double-photon, $$\begin{align} Y_2 \ge Y_2^{L'}=\,&\Big\{Q_{v_1}(1+v_1)-Q_{v_2}(1+v_2)\\ &-M({1+d_{\rm A}})[Q_\mu(1+\mu)-Y_0^{\rm L}]\\ &-Y_1^{\rm U}[({{\eta_{\rm A}}+d_{\rm A}})\Big({\frac{v_1}{1+v_1}- \frac{v_2}{1+v_2}}\Big)\\ &-M\frac{\mu}{1+\mu}({1+d_{\rm A}})]-\sum\limits_{i=1}^{10}\Big[A_i\frac{{v_1^i}}{(1+v_1)^i}\\ &+B_i\frac{v_2^i}{(1+v_2)^i}\Big]\Big\}\cdot\Big\{\Big[\frac{{v_1^2}}{(1+v_1)^2}\\ &-\frac{v_2^2}{(1+v_2)^2}\Big][1-{{({1-{\eta_{\rm A}}})}^2}+ d_{\rm A}]\\ &-\frac{{\frac{v_1^3}{(1+v_1)^3}-\frac{v_2^3}{(1+v_2)^3}}}{{\frac{\mu}{(1+\mu)}}}({1+d_{\rm A}})\Big\}^{-1},~~ \tag {28} \end{align} $$ $$\begin{align} Y_1\ge Y_1^{L'}=\,&\Big\{Q_{v_1}(1+v_1)-Q_{v_2}(1+v_2)\\ &-M\frac{\mu}{1+\mu}({1+d_{\rm A}})[Q_\mu(1+\mu)-Y_0^{\rm L}]\\ &-\sum\limits_{i=1}^{10} \Big[A_i\frac{{v_1^i}}{{{{(1+ v_1)}^i}}}+B_i\frac{v_2^i}{(1+v_2)^i}\Big]\Big\}\\ &\cdot\Big\{({\eta_{\rm A}}+d_{\rm A})\Big({\frac{v_1}{1+v_1}-\frac{v_2}{1+v_2}}\Big)\\ &-\frac{\frac{{v_1^2}}{{{{(1+v_1)}^2}}}-\frac{v_2^2}{(1+v_2)^2}}{{\frac{\mu}{1+\mu}}}({1+d_{\rm A}})\Big\}^{-1}.~~ \tag {29} \end{align} $$ From Eq. (15), we can see that $e_1$ and $e_2$ are dependent on ${Y_1^{\rm L}}$ and ${Y_2^{\rm L}}$. Thus the QBER has the relative statistical fluctuation in the case of finite sources. In addition, we know ${Q_i^{L'}=Y_i^{L'}p(\mu,i)}$. Thus we obtain the key rate formula considering the case of the finite sources, $$\begin{alignat}{1} R_{1+2} \ge \frac{N_\mu}{{{N_\mu}+N_{v_1}+N_{v_2}}}\{-{Q_{\mu}}f( E_{\mu}){H_2}(E_{\mu})\\ +Q_1^{L'}[{1-{H_2}({{\rm{e}}_1^{\rm U}})}]+Q_2^{L'}[{1-{H_2}({{\rm{e}}_2^{\rm U}})}]\}.~~ \tag {30} \end{alignat} $$ In our simulations, we use the reliable QKD system parameters from the GYS experiment[25] as listed in Table 1. Firstly, we compare the HSPS with the WCS source in two approaches: the single-photon and double-photon are calculated separately and jointly. In Fig. 1, when the single-photon and double-photon are calculated separately, we can find that the HSPS has an advantage in distance which is extended by almost 60 km. However, before the distance of 70 km, the WCS has a higher key rate than the HSPS. Similarly, when the single-photon and double-photon are calculated jointly, the result is analogous. Thus the WCS source is the optimal choice before 70 m. If we extend the maximum secure distance, the HSPS will work efficiently.
Table 1. Key parameters of the GYS experiment for simulation.
${\alpha}$ (dB/km) $e_{\det}$ $Y_0$ ${\eta_{\rm Bob}}$
0.21 0.033 $1.7 \times 10^{-6}$ 0.045
cpl-33-4-040301-fig1.png
Fig. 1. (Color online) The key generation rate against the transmission distance with different sources. The above lines show the comparison for the WCS source and the HSPS in two approaches. We consider the case of two decoy states, and we set the intensities of decoy state and signal state: $\mu=0.008$, $v_1=0.00015$, $v_2=0.00014$ (HSPS), and $\mu=0.98$, $v_1=0.02$, $v_2=0.01$ (WCS).
cpl-33-4-040301-fig2.png
Fig. 2. (Color online) The key generation rate against the transmission distance with different lengths of pulses. From left to right, the numbers of pulses are $10^{10}$, $10^{11}$, $10^{12}$, $10^{13}$, $10^{14}$, $10^{15}$ and $10^{16}$. The rightmost line is the case of infinite resources.
Lastly, the numerical simulation of secret key rates with different lengths of pulses is present. We consider the percentage of signal state and two decoy states: ${N_\mu}/N=0.8$, $N_{v_1}/N=0.1$ and $N_{v_2}/N=0.1$. In Fig. 2, the finite lengths of pulses have a great effect on the key rate, we can find that there is an increase of the maximum transmission distance by increasing the number of exchanged signals. When the number of pulses is $10^{16}$, the maximum transmission distance is close to the case of infinite sources. In summary, we have studied the LM05 protocol with the decoy state method. By using the HSPS, the maximum transmission distance has increased about 60 km. Moreover, we have analyzed the security of the LM05 protocol with finite resources by considering the statistical fluctuations for the yield and error rate of the quantum states in different lengths of keys. The result of simulation shows the influence of finite-key on the lower bound of the secret key generation rate. As we all know, the two-way QKD protocol has its own unique advantages, which has major research significance. Meanwhile, the security analysis of the LM05 protocol is not particularly perfect. For example, the Trojan horse attacking strategy on the LM05 protocol is worthy of investigation. These works will be carried out in future. References Quantum cryptography over 23 km in installed under-lake telecom fibreDeterministic Secure Direct Communication Using EntanglementEavesdropping on the “Ping-Pong” Quantum Communication ProtocolThe “Ping-Pong” Protocol Can Be Attacked without EavesdroppingImproving the capacity of the Boström-Felbinger protocolQuantum dense key distributionReply to “Comment on ‘Quantum dense key distribution’ ”Secure Deterministic Communication without EntanglementSecurity of two-way quantum key distributionQuantum Key Distribution with High Loss: Toward Global Secure CommunicationDecoy states and two way quantum key distribution schemesDecoy State Quantum Key DistributionPractical decoy state for quantum key distributionPractical decoy-state method in quantum key distribution with a heralded single-photon sourceQuantum Cryptography with Finite Resources: Unconditional Security Bound for Discrete-Variable Protocols with One-Way PostprocessingSecurity of decoy states QKD with finite resources against collective attacksTight finite-key analysis for quantum cryptographyDecoy state quantum key distribution with a photon number resolved heralded single photon sourceTwo-Way Protocol with Imperfect DevicesUncertainty Relation for Smooth EntropiesDistillation of secret key and entanglement from quantum statesQuantum key distribution over 122 km of standard telecom fiber
[1]Bennett C H and Brassard G 1984 Proceedings of IEEE International Conference on Computers, Systems and Signal Processing (Bangalore, India) p 175
[2] Muller A, Zbinde H and Gisin N 1996 Europhys. Lett. 33 335
[3] Bostrom K and Felbinger T 2002 Phys. Rev. Lett. 89 187902
[4] Wojcik A 2003 Phys. Rev. Lett. 90 157901
[5] Cai Q Y 2003 Phys. Rev. Lett. 91 109801
[6] Cai Q Y and Li B W 2004 Phys. Rev. A 69 054301
[7] Degiovanni I P, Berchera I R, Castelletto S, Rastello L M, Bovino F A, Colla A M and Castagnoli G 2004 Phys. Rev. A 69 032310
[8] Degiovanni I P, Berchera I R, Castelletto S, Rastello L M, Bovino F A, Colla A M and Castagnoli G 2005 Phys. Rev. A 71 16302
[9] Lucamarini M and Mancini S 2005 Phys. Rev. Lett. 94 140501
[10] Beaudry N J, Lucamarini M, Mancini S and Renner R 2013 Phys. Rev. A 88 062302
[11] Hwang W Y 2003 Phys. Rev. Lett. 91 057901
[12] Shaari J S, Bahari I and Ali S 2011 Opt. Commun. 284 697
[13] Lo H K, Ma X F and Chen K 2005 Phys. Rev. Lett. 94 230504
[14] Ma X F, Qi B, Zhao Y and Lo H K 2005 Phys. Rev. A 72 012326
[15] Wang Q, Wang X B and Guo G C 2007 Phys. Rev. A 75 012312
[16] Scarani V and Renner R 2008 Phys. Rev. Lett. 100 200501
[17] Li H W, Zhao Y B, Yin Z Q, Wang S, Han Z F, Bao W S and Guo G C 2009 Opt. Commun. 282 4162
[18] Tomamichel M, Lim C C W and Renner R 2012 Nat. Commun. 3 634
[19]Du Y N, Xie W Z, Jin X et al 2015 Acta Phys. Sin. 64 110301 (in Chinese)
[20] Tomoyuki H and Takayoshi K 2006 Phys. Rev. A 73 032331
[21] Lucamarini M, Cere A, Giuseppe G D, Mancini S, Vitali D and Tombesi P 2007 Open Sys. Inf. Dyn. 14 169
[22] Tomamichel M and Renner R 2011 Phys. Rev. Lett. 106 110506
[23] Devetak I and Winter A 2005 Proc. R. Soc. A 461 207
[24]Gottesman D, Lo H K, Lutkenhaus N and Preskill J 2004 Quantum Inf. Comput. 4 325
[25] Gobby C, Yuan Z L and Shields A J 2004 Appl. Phys. Lett. 84 3762