Simple method for asymmetric twin-field quantum key distribution

Quantum key distribution (QKD) is proven to provide information-theoretic security to two communicating parties. Without efficient quantum repeaters, however, QKD is limited in the maximum distance over which it can generate secure keys. The linear bound [1, 2] is a theoretical upper bound for maximum key rate-distance relation for repeaterless QKD. Interestingly, the twin-field (TF) QKD protocol proposed in 2018 [3] uses a clever technique to surpass the linear bound: it uses a setup where two parties, Alice and Bob, communicate with an untrusted third party, Charles. Instead of using two-photon interference like in measurement-device-independent (MDI) QKD [4], TF-QKD makes use of single-photon interference to generate keys, and on average only one photon passes through either Alice's or Bob's channel—which allows to key rate to scale with transmittance over only half the distance between Alice and Bob. Not only does TF-QKD surpass the repeaterless bound, it also provides security against attacks on measurement devices [5] similar to MDI-QKD. Because of these advantages, TF-QKD has attracted much attention worldwide since its proposal. Since a rigorous security proof is not provided in the original proposal, several papers have improved the protocol and provided security proof [6–10]. Also, recently there have been multiple reports of TF-QKD demonstrated experimentally [11–14].

However, all the above security proofs and experimental demonstrations only consider the symmetric case where Alice's and Bob's channels have the same amount of loss. In reality, though, in a network setting, due to e.g. geographical locations, or Alice and Bob being situated on moving free-space platforms (such as ships or satellites), it is very likely that Alice's and Bob's channels are not symmetric. In the future, if a quantum network is build around the protocol—e.g. a star-shaped network where numerous users (senders) are connected to one central node with measurement devices, asymmetry will be an even more severe problem since it is difficult to maintain the same channel loss for all users (and users might join/leave a network at arbitrary locations). If channels are asymmetric, for prior art protocols, users would either have to suffer from much higher quantum-bit-error-rate (QBER) and hence lower key rate, or would have to deliberately add fibre to the shorter channel to compensate for channel asymmetry, which is inconvenient (since it requires physically modifying the channels) and also provides sub-optimal key rate.

Similar limitation to symmetric channels have been observed in MDI-QKD. In [15], we have proposed a method to overcome this limitation, by allowing Alice and Bob to adjust their intensities (and use different optimization strategies for two decoupled bases) to compensate for channel loss, without having to physically adjust the channels. The method has also been successfully experimentally verified for asymmetric MDI-QKD in [16].

In this work, we will apply our method to TF-QKD and show that it is possible to obtain good key rate through asymmetric channels by adjusting Alice's and Bob's intensities—in fact, we will show that, Alice and Bob only need to adjust their signal intensities to obtain optimal performance. We show that the security of the protocol is not affected, and that an order of magnitude higher (than symmetric protocol) or 2-3 times higher (than adding fibre) key rate can be achieved with the new method. Furthermore, we show with numerical simulation results that our method works well for both finite-decoy and finite-data case with practical parameters, making it a convenient and powerful method to improve the performance of TF-QKD through asymmetric channels in reality.

While we use the same main idea of allowing Alice and Bob to use asymmetric intensities to compensate for asymmetric channel losses as in [15], there are some key differences that need to be addressed for asymmetric TF-QKD. Firstly, the security proof need to be discussed, to show that the introduction of asymmetric channels and intensities do not affect security. Secondly, as we will later show in section 4, there is an interesting distinction between the MDI-QKD protocol in [15] and the TF-QKD protocol in [9] in how the two bases X and Z respectively react to asymmetric incoming intensities, which makes the optimal strategies for asymmetric-intensity MDI-QKD and TF-QKD different. We will discuss this in more detail in section 4.

The idea of TF-QKD protocol through asymmetric channels has also been discussed in a recent paper [17]. Our work is different from [17] in several aspects. First, [17] starts with a different protocol—'sending or not sending protocol'. Second, [17] is mostly numerical. In contrast, we start with the 'simple TF-QKD' protocol in [9] and consider its asymmetric-intensity version. We include both analytical and numerical reasoning. We also provide a detailed discussion about the physics behind the security of our asymmetric-intensity protocol.

The layout of the paper is as follows: in section 2, we define the setup and the protocol we use. In section 3 we will extend the security proof in [9] to the case with asymmetric intensities and channels. In section 4, we discuss the how the performance of TF-QKD is affected by channel asymmetry and asymmetric intensities (and for the latter, what are the best strategies for choosing the intensities). We show the effectiveness of our method with simulation results in section 5.

Here we consider a similar TF-QKD setup as in [9] 'Protocol 3'. Alice and Bob choose two bases X and Z randomly. When X basis is chosen, Alice (Bob) sends states $| \alpha {\rangle }_{a}$ ($| \alpha {\rangle }_{b}$) for bit b_A = 0 (b_B = 0) or states $| -\alpha {\rangle }_{a}$ ($| -\alpha {\rangle }_{b}$) for bit b_A = 1 (b_B = 1). When Z basis is chosen, Alice and Bob send phase-randomized coherent states ${\rho }_{a,{\beta }_{A}}$ (${\rho }_{b,{\beta }_{B}}$), where the decoy state intensities are $\{{\beta }_{A},{\beta }_{B}\}$. Note that here Alice and Bob have a common phase reference for X basis signals. After the signals are sent to Charles, the detector events are denoted as k_c, k_d (0 denotes no click, and 1 denotes a click).

The papers [3, 9] consider only the case where the channels between Alice (Bob) and Charles have equal transmittances. In reality, it is possible that the channels might have different levels of loss, due to e.g. geographical locations or moving platforms Here we are interested in three questions for TF-QKD with asymmetric channels:

• 1.  
  Does channel asymmetry affect security?
• 2.  
  How does channel asymmetry affect the QBER and hence key rate?²
• 3.  
  Can we improve the performance of the protocol under channel asymmetry?

We will use our method from [15] and apply it to Protocol 3 in [9], to make an 'asymmetric-intensity' TF-QKD protocol that works well even when channels are highly asymmetric. Similar to MDI-QKD, the protocol in [9] has decoupled X and Z bases. Here we allow Alice and Bob to have different intensities in the X and the Z bases respectively, such that in X basis Alice (Bob) now send states $| {\alpha }_{A}{\rangle }_{a}$ ($| {\alpha }_{B}{\rangle }_{b}$) for bit b_A = 0 (b_B = 0) or states $| -{\alpha }_{A}{\rangle }_{a}$ ($| -{\alpha }_{B}{\rangle }_{b}$) for bit b_A = 1 (b_B = 1). We can denote the signal intensities as ${s}_{A}={\alpha }_{A}^{2},{s}_{B}={\alpha }_{B}^{2}$. In the Z basis, the amplitudes for the phase-randomized coherent states, {β_A, β_B}, can be different for Alice and Bob too (we can denote the intensities as $\{{\beta }_{A}^{2},{\beta }_{B}^{2}\}$, and for the three-decoy case, the sets of intensities can be specifically written as $\{{\mu }_{A},{\nu }_{A},{\omega }_{A}\}$ and $\{{\mu }_{A},{\nu }_{A},{\omega }_{A}\}$). An example setup can be found in figure 1.

Zoom In Zoom Out Reset image size

We will answer the above three questions by showing in the following text three main pieces of results:

• (1)  
  neither asymmetric channels nor asymmetric intensities between Alice and Bob affect security;
• (2)  
  the X basis (signal state) QBER will increase with channel asymmetry, and greatly reduce the key rate of TF-QKD if no compensation is performed—on the other hand, the Z basis gain (as well as the upper bound to the yield and phase-error rate derived from the observable data in the Z basis) is little affected by channel asymmetry;
• (3)  
  we can use different intensities between Alice and Bob to compensate for channel asymmetry and get good key rate—in fact, using only different signal states between Alice and Bob (and keeping all decoy states and probabilities identical for Alice and Bob) can already effectively compensate for channel asymmetry and allow good key rate for asymmetric TF-QKD.

In this section we will show that neither asymmetric channels nor asymmetric intensities between Alice and Bob affect security. Following the discussion in [9], the key is generated from events in the X basis, and the secure key rate is bounded using the bit-error rate and the phase-error rate. The X basis bit-error rate is directly obtained as an observable, hence the key part of the security proof lies in the estimation of X basis phase-error rate (equivalent to the Z basis bit-error rate) based on the Z basis observables—which, since Z basis signals are phase-randomized, is not directly obtainable.

In the security proof in [9], the phase-error rate is obtained by upper-bounding the phase-error rate using the estimated yields of given photon numbers {m, n} (which can be upper-bounded by using decoy-state analysis, based on observed count rates, i.e. the gains, in the Z basis).

The key message we'd like to point out is that, this entire estimation process of the phase error rate does not rely on the fact that Alice and Bob use the same amplitude α for their signal states, or that the channels have the same transmittance. Therefore, here we will follow the proof in [9] step-by-step, but with asymmetric intensities and channel transmittances, to show that the security proof can be easily extended to the asymmetric case.

A small note is that, the formulation of the original security proof in [9] appears to assume a single Kraus operator for the channel (i.e. a pure state after the measurement, which could involve measurements from Charles and/or Eve), but the proof can, in fact, be extended to cover the general case where the state could be a mixed state after passing through the channel and potentially being disturbed by Eve³ . We have discussed with the original authors of [9], and we thank Koji Azuma for pointing out this fact [18] and the details of incorporating multiple Kraus operators to represent a mixed state after the measurement (and applying Cauchy–Schwarz inequality to the mixed state to obtain the bounds on the phase error rate). In the following text we will use the formulation of multiple Kraus operators and density matrices as in Koji Azuma's clarification of the original proof.

We can start by imagining a virtual scenario where Alice (Bob) prepares entangled states between a local qubit A (B) and a signal a (b) to be sent to Charles. After Charles performs a measurement on the signals, the X basis phase-error rate (or Z basis bit-error rate) can be obtained by Alice (Bob) measuring their local qubits in the Z basis. The initial states can be written as:

$$\begin{eqnarray}\begin{array}{rcl}| {\psi }_{X}^{A}{\rangle }_{{Aa}} & = & \displaystyle \frac{1}{\sqrt{2}}(| +{\rangle }_{A}| {\alpha }_{A}{\rangle }_{a}+| -{\rangle }_{A}| -{\alpha }_{A}{\rangle }_{a})\\ | {\psi }_{X}^{B}{\rangle }_{{Bb}} & = & \displaystyle \frac{1}{\sqrt{2}}(| +{\rangle }_{B}| {\alpha }_{B}{\rangle }_{b}+| -{\rangle }_{B}| -{\alpha }_{B}{\rangle }_{b})\end{array}\end{eqnarray} \tag{ 1 }$$

here $| \pm \rangle =\tfrac{1}{\sqrt{2}}(| 0\rangle \pm | 1\rangle )$ are the X basis states. Here in the asymmetric-intensity case, we allow ${s}_{A}={\alpha }_{A}^{2}$ to be different from ${s}_{B}={\alpha }_{B}^{2}$. For convenience, here let us write $| {\psi }_{X}{\rangle }_{{AaBb}}=| {\psi }_{X}^{A}{\rangle }_{{Aa}}| {\psi }_{X}^{B}{\rangle }_{{Bb}}$. We can then write the density matrix of the initial state as

$$\begin{eqnarray}&&{\rho }_{{AaBb}}=| {\psi }_{X}{\rangle }_{{AaBb}}{}_{{AaBb}}\langle {\psi }_{X}| .\end{eqnarray} \tag{ 2 }$$

Now, the process of signals a and b going through their respective channels and Charles making a measurement can be represented by a set of Kraus operators $\{{\hat{M}}_{{k}_{c}{k}_{d},e}^{{ab}}\}$, where k_c, k_d are Charles' detector events, and e is the (implicit) measurement results of a potential eavesdropper Eve. The superscript ab represents that this operator only acts on the systems a, b (pulses sent to Charles) and not on A, B (local qubits in Alice's and Bob's labs). From the perspective of Alice and Bob, as e is not announced, the state they obtain is equivalent to Eve having discarded all measurement results e. After signals pass through the channels and Charles announces the measurement result k_c, k_d, the conditional state becomes:

$$\begin{eqnarray}&&{\rho }_{{AaBb}}^{{\prime} }=\displaystyle \frac{{\displaystyle \sum }_{e}{\hat{M}}_{{k}_{c}{k}_{d},e}^{{ab}}{\rho }_{{AaBb}}{\hat{M}}_{{k}_{c}{k}_{d},e}^{{ab}\dagger }}{{p}_{{XX}}({k}_{c},{k}_{d})}\end{eqnarray} \tag{ 3 }$$

here ${p}_{{XX}}({k}_{c},{k}_{d})$ is the X basis Gain for detection events k_c, k_d (which can be 0,1 or 1,0 for a detection event to be considered successful). Note that, this set of operator $\{{\hat{M}}_{{k}_{c}{k}_{d},i}^{{ab}}\}$ includes all information of the channels, detectors (and the eavesdropper) and is a general representation of their joint effects, and, importantly, it does not require that the channels are symmetric at all.

By measuring their local qubits in the Z basis, Alice and Bob can obtain the Z basis bit-error rate ${e}_{{ZZ},{k}_{c}{k}_{d}}$ (i.e. the X basis phase-error rate):

$$\begin{eqnarray}&&{e}_{{ZZ},{k}_{c}{k}_{d}}=\displaystyle \sum _{j=0,1}{}_{{AB}}\langle {jj}| {\rho }_{{AB}}^{{\prime} }| {jj}{\rangle }_{{AB}},\end{eqnarray} \tag{ 4 }$$

where ${\rho }_{{AB}}^{{\prime} }$, the state of the local qubits A, B, can be obtained by performing a partial trace over the systems a, b

$$\begin{eqnarray}&&{\rho }_{{AB}}^{{\prime} }={{tr}}_{{ab}}({\rho }_{{AaBb}}^{{\prime} }).\end{eqnarray} \tag{ 5 }$$

Now, the key observation in the proof of [9] is that, Alice and Bob making a measurement on the local qubits A and B after sending signals a and b and Charles making a measurement should be equivalent to the time-reversed scenario where Alice and Bob first make local Z basis measurements on the initial pure states $| {\psi }_{X}^{A}{\rangle }_{{Aa}},| {\psi }_{X}^{B}{\rangle }_{{Bb}}$, and then send the signal systems a and b to Charles. After Alice and Bob make the local measurements, the states become

$$\begin{eqnarray}\begin{array}{rcl}{}_{A}\langle 0| | {\psi }_{X}{\rangle }_{{Aa}} & = & | {C}_{0}^{A}{\rangle }_{a}\\ {}_{A}\langle 1| | {\psi }_{X}{\rangle }_{{Aa}} & = & | {C}_{1}^{A}{\rangle }_{a}\\ {}_{B}\langle 0| | {\psi }_{X}{\rangle }_{{Bb}} & = & | {C}_{0}^{B}{\rangle }_{b}\\ {}_{B}\langle 1| | {\psi }_{X}{\rangle }_{{Bb}} & = & | {C}_{1}^{B}{\rangle }_{b}\end{array}\end{eqnarray} \tag{ 6 }$$

which are cat states:

$$\begin{eqnarray}\begin{array}{rcl}| {C}_{0}^{A}{\rangle }_{a} & = & {{\rm{e}}}^{-\displaystyle \frac{{\alpha }_{A}^{2}}{2}}\displaystyle \sum _{n=0}^{\infty }\displaystyle \frac{{\alpha }_{A}^{2n}}{\sqrt{2n}}| 2n{\rangle }_{a}=\displaystyle \sum _{n=0}^{\infty }{c}_{n}^{A,(0)}| n{\rangle }_{a}\\ | {C}_{1}^{A}{\rangle }_{a} & = & {{\rm{e}}}^{-\displaystyle \frac{{\alpha }_{A}^{2}}{2}}\displaystyle \sum _{n=0}^{\infty }\displaystyle \frac{{\alpha }_{A}^{2n+1}}{\sqrt{2n+1}}| 2n+1{\rangle }_{a}=\displaystyle \sum _{n=0}^{\infty }{c}_{n}^{A,(1)}| n{\rangle }_{a}\\ | {C}_{0}^{B}{\rangle }_{b} & = & {{\rm{e}}}^{-\displaystyle \frac{{\alpha }_{B}^{2}}{2}}\displaystyle \sum _{n=0}^{\infty }\displaystyle \frac{{\alpha }_{B}^{2n}}{\sqrt{2n}}| 2n{\rangle }_{b}=\displaystyle \sum _{n=0}^{\infty }{c}_{n}^{B,(0)}| n{\rangle }_{b}\\ | {C}_{1}^{B}{\rangle }_{b} & = & {{\rm{e}}}^{-\displaystyle \frac{{\alpha }_{B}^{2}}{2}}\displaystyle \sum _{n=0}^{\infty }\displaystyle \frac{{\alpha }_{B}^{2n+1}}{\sqrt{2n+1}}| 2n+1{\rangle }_{b}=\displaystyle \sum _{n=0}^{\infty }{c}_{n}^{B,(1)}| n{\rangle }_{b}\end{array}\end{eqnarray} \tag{ 7 }$$

here the even (odd) cat states only contain nonzero amplitudes for even (odd) photon numbers. Nonetheless we can still write the amplitudes as ${c}_{n}^{A,(0)},{c}_{n}^{B,(0)}$ (${c}_{n}^{A,(1)},{c}_{n}^{B,(1)}$) for all photon number states, where the coefficients are zero for odd (even) photon number states in an even (odd) cat state.

Note that here in the asymmetric-intensity case, Alice and Bob's cat states are not the same, because they use different signal intensities (hence different amplitudes α_A, α_B), but as we will show below, the derivation of the upper bound for the phase error rate does not depend on the fact that Alice and Bob have the same cat states. Therefore, the security is not compromised by using asymmetric signal intensities⁴ .

For Alice and Bob's local Z basis measurement results i, j ∈ {0,1} and for detection events k_c, k_d:

$$\begin{eqnarray}\begin{array}{rcl}{}_{{AB}}\langle {ij}| {\rho }_{{AB}}^{{\prime} }| {ij}{\rangle }_{{AB}} & = & {}_{{AB}}\langle {ij}| {{\rm{tr}}}_{{ab}}({\rho }_{{AaBb}}^{{\prime} })| {ij}{\rangle }_{{AB}}\\ & = & {{\rm{tr}}}_{{ab}}({}_{{AB}}\langle {ij}| {\rho }_{{AaBb}}^{{\prime} }| {ij}{\rangle }_{{AB}})\\ & = & \displaystyle \frac{1}{{p}_{{XX}}({k}_{c},{k}_{d})}{{\rm{tr}}}_{{ab}}({}_{{AB}}\langle {ij}| \displaystyle \sum _{e}{\hat{M}}_{{k}_{c}{k}_{d},e}^{{ab}}{\rho }_{{AaBb}}{\hat{M}}_{{k}_{c}{k}_{d},e}^{{ab}\dagger }| {ij}{\rangle }_{{AB}})\\ & = & \displaystyle \frac{1}{{p}_{{XX}}({k}_{c},{k}_{d})}\displaystyle \sum _{e}{{\rm{tr}}}_{{ab}}({\hat{M}}_{{k}_{c}{k}_{d},e}^{{ab}}{}_{{AB}}\langle {ij}| {\rho }_{{AaBb}}| {ij}{\rangle }_{{AB}}{\hat{M}}_{{k}_{c}{k}_{d},e}^{{ab}\dagger })\\ & = & \displaystyle \frac{1}{{p}_{{XX}}({k}_{c},{k}_{d})}\displaystyle \sum _{e}{{\rm{tr}}}_{{ab}}({\hat{M}}_{{k}_{c}{k}_{d},e}^{{ab}}| {C}_{i}^{A}{\rangle }_{a}| {C}_{j}^{B}{\rangle }_{b}{}_{a}\langle {C}_{i}^{A}| {}_{b}\langle {C}_{j}^{B}| {\hat{M}}_{{k}_{c}{k}_{d},e}^{{ab}\dagger })\\ & = & \displaystyle \frac{1}{{p}_{{XX}}({k}_{c},{k}_{d})}\displaystyle \sum _{e}{}_{a}\langle {C}_{i}^{A}| {}_{b}\langle {C}_{j}^{B}| {\hat{M}}_{{k}_{c}{k}_{d},e}^{{ab}\dagger }{\hat{M}}_{{k}_{c}{k}_{d},e}^{{ab}}| {C}_{i}^{A}{\rangle }_{a}| {C}_{j}^{B}{\rangle }_{b}\\ & = & \displaystyle \frac{1}{{p}_{{XX}}({k}_{c},{k}_{d})}{}_{a}\langle {C}_{i}^{A}| {}_{b}\langle {C}_{j}^{B}| \displaystyle \sum _{e}{\hat{M}}_{{k}_{c}{k}_{d},e}^{{ab}\dagger }{\hat{M}}_{{k}_{c}{k}_{d},e}^{{ab}}| {C}_{i}^{A}{\rangle }_{a}| {C}_{j}^{B}{\rangle }_{b}\end{array}\end{eqnarray} \tag{ 8 }$$

which means that, the probabilities for local Z basis measurement results $i,j\in \{0,1\}$ (which determine the phase-error rate) can be acquired by observing the gain if Alice and Bob sent cat states. However, Alice and Bob are not really sending cat states—when Z basis is chosen, they are sending phase-randomized coherent states. Using decoy-state analysis, what Alice and Bob acquire are the yields for phase-randomized photon number states, ${p}_{{ZZ}}({k}_{c},{k}_{d}| {n}_{A},{n}_{B})={}_{a}\langle {n}_{A}| {}_{b}\langle {n}_{B}| {\sum }_{e}{\hat{M}}_{{k}_{c}{k}_{d},e}^{{ab}\dagger }{\hat{M}}_{{k}_{c}{k}_{d},e}^{{ab}}| {n}_{A}{\rangle }_{a}| {n}_{B}{\rangle }_{b}$. The yields for photon number states are linked to equation (8) using the Cauchy–Schwarz inequality that upper-bounds the gains for cat states (and subsequently the phase-error rate):

$$\begin{eqnarray}&&\begin{array}{l}{}_{a}\langle {C}_{i}^{A}| {}_{b}\langle {C}_{j}^{B}| \displaystyle \sum _{e}{\hat{M}}_{{k}_{c}{k}_{d},e}^{{ab}\dagger }{\hat{M}}_{{k}_{c}{k}_{d},e}^{{ab}}| {C}_{i}^{A}{\rangle }_{a}| {C}_{j}^{B}{\rangle }_{b}\\ =\,\displaystyle \sum _{{m}_{A},{m}_{B},{n}_{A},{n}_{B}=0}^{\infty }{c}_{{m}_{A}}^{A,(i)}{c}_{{m}_{B}}^{B,(j)}{c}_{{n}_{A}}^{A,(i)}{c}_{{n}_{B}}^{B,(j)}\times \displaystyle \sum _{e}{}_{a}\langle {m}_{A}| {}_{b}\langle {m}_{B}| {\hat{M}}_{{k}_{c}{k}_{d},e}^{{ab}\dagger }{\hat{M}}_{{k}_{c}{k}_{d},e}^{{ab}}| {n}_{A}{\rangle }_{a}| {n}_{B}{\rangle }_{b}\\ \leqslant \,\displaystyle \sum _{{m}_{A},{m}_{B},{n}_{A},{n}_{B}=0}^{\infty }{c}_{{m}_{A}}^{A,(i)}{c}_{{m}_{B}}^{B,(j)}{c}_{{n}_{A}}^{A,(i)}{c}_{{n}_{B}}^{B,(j)}\\ \quad \times \,\displaystyle \sum _{e}\sqrt{{}_{a}\langle {n}_{A}| {}_{b}\langle {n}_{B}| {\hat{M}}_{{k}_{c}{k}_{d},e}^{{ab}\dagger }{\hat{M}}_{{k}_{c}{k}_{d},e}^{{ab}}| {n}_{A}{\rangle }_{a}| {n}_{B}{\rangle }_{b}}\sqrt{{}_{a}\langle {m}_{A}| {}_{b}\langle {m}_{B}| {\hat{M}}_{{k}_{c}{k}_{d},e}^{{ab}\dagger }{\hat{M}}_{{k}_{c}{k}_{d},e}^{{ab}}| {m}_{A}{\rangle }_{a}| {m}_{B}{\rangle }_{b}},\end{array}\end{eqnarray} \tag{ 9 }$$

where we have applied Cauchy–Schwarz inequality to the two vectors ${\hat{M}}_{{k}_{c}{k}_{d},e}^{{ab}}| {n}_{A}{\rangle }_{a}| {n}_{B}{\rangle }_{b}$ and ${\hat{M}}_{{k}_{c}{k}_{d},e}^{{ab}}| {m}_{A}{\rangle }_{a}| {m}_{B}{\rangle }_{b}$. We can then write:

$$\begin{eqnarray}&&\begin{array}{l}\displaystyle \sum _{{m}_{A},{m}_{B},{n}_{A},{n}_{B}=0}^{\infty }{c}_{{m}_{A}}^{A,(i)}{c}_{{m}_{B}}^{B,(j)}{c}_{{n}_{A}}^{A,(i)}{c}_{{n}_{B}}^{B,(j)}\\ \quad \times \,\displaystyle \sum _{e}\sqrt{{}_{a}\langle {n}_{A}| {}_{b}\langle {n}_{B}| {\hat{M}}_{{k}_{c}{k}_{d},e}^{{ab}\dagger }{\hat{M}}_{{k}_{c}{k}_{d},e}^{{ab}}| {n}_{A}{\rangle }_{a}| {n}_{B}{\rangle }_{b}}\sqrt{{}_{a}\langle {m}_{A}| {}_{b}\langle {m}_{B}| {\hat{M}}_{{k}_{c}{k}_{d},e}^{{ab}\dagger }{\hat{M}}_{{k}_{c}{k}_{d},e}^{{ab}}| {m}_{A}{\rangle }_{a}| {m}_{B}{\rangle }_{b}}\\ \leqslant \,\displaystyle \sum _{{m}_{A},{m}_{B},{n}_{A},{n}_{B}=0}^{\infty }{c}_{{m}_{A}}^{A,(i)}{c}_{{m}_{B}}^{B,(j)}{c}_{{n}_{A}}^{A,(i)}{c}_{{n}_{B}}^{B,(j)}\\ \quad \times \,\sqrt{{}_{a}\langle {n}_{A}| {}_{b}\langle {n}_{B}| \displaystyle \sum _{e}{\hat{M}}_{{k}_{c}{k}_{d},e}^{{ab}\dagger }{\hat{M}}_{{k}_{c}{k}_{d},e}^{{ab}}| {n}_{A}{\rangle }_{a}| {n}_{B}{\rangle }_{b}}\sqrt{{}_{a}\langle {m}_{A}| {}_{b}\langle {m}_{B}| \displaystyle \sum _{e}{\hat{M}}_{{k}_{c}{k}_{d},e}^{{ab}\dagger }{\hat{M}}_{{k}_{c}{k}_{d},e}^{{ab}}| {m}_{A}{\rangle }_{a}| {m}_{B}{\rangle }_{b}}\\ =\,{\left[\displaystyle \sum _{{n}_{A},{n}_{B}=0}^{\infty }{c}_{{n}_{A}}^{A,(i)}{c}_{{n}_{B}}^{B,(j)}\sqrt{{p}_{{ZZ}}({k}_{c},{k}_{d}| {n}_{A},{n}_{B})}\right]}^{2},\end{array}\end{eqnarray} \tag{ 10 }$$

where we again use Cauchy–Schwarz inequality by considering two vectors $\vec{u},\vec{v}$ whose eth components are

$$\begin{eqnarray}\begin{array}{rcl}{u}_{e} & = & \sqrt{{}_{a}\langle {n}_{A}{| }_{b}\langle {n}_{B}| {\hat{M}}_{{k}_{c}{k}_{d},e}^{{ab}\dagger }{\hat{M}}_{{k}_{c}{k}_{d},e}^{{ab}}| {n}_{A}{\rangle }_{a}| {n}_{B}{\rangle }_{b}}\\ {v}_{e} & = & \sqrt{{}_{a}\langle {m}_{A}{| }_{b}\langle {m}_{B}| {\hat{M}}_{{k}_{c}{k}_{d},e}^{{ab}\dagger }{\hat{M}}_{{k}_{c}{k}_{d},e}^{{ab}}| {m}_{A}{\rangle }_{a}| {m}_{B}{\rangle }_{b}}\end{array}\end{eqnarray} \tag{ 11 }$$

respectively, and apply $\vec{u}\cdot \vec{v}\leqslant \sqrt{\vec{u}\cdot \vec{u}}\sqrt{\vec{v}\cdot \vec{v}}$.

This means that, the phase-error rate can be upper-bounded by the yields for photon number states ${p}_{{ZZ}}({k}_{c},{k}_{d}| {n}_{A},{n}_{B})$:

$$\begin{eqnarray}\begin{array}{rcl}{p}_{{XX}}({k}_{c},{k}_{d}){e}_{{ZZ}}({k}_{c},{k}_{d}) & = & {p}_{{XX}}({k}_{c},{k}_{d})\displaystyle \sum _{j=0,1}{}_{{AB}}\langle {jj}| {\rho }_{{AB}}^{{\prime} }| {jj}{\rangle }_{{AB}}\\ & \leqslant & \displaystyle \sum _{j=0,1}{\left[\displaystyle \sum _{{n}_{A},{n}_{B}=0}^{\infty }{c}_{{n}_{A}}^{A,(j)}{c}_{{n}_{B}}^{B,(j)}\sqrt{{p}_{{ZZ}}({k}_{c},{k}_{d}| {n}_{A},{n}_{B})}\right]}^{2}\end{array}\end{eqnarray} \tag{ 12 }$$

this phase error rate, combined with the bit error rate in the X basis, can be used to perform privacy amplification on the error-corrected raw keys and obtain the secure key.

The key point is that, the above proof that upper bounds the phase error rate does not require the fact that α_A = α_B at all. The different signal intensities will cause Alice and Bob to have different cat states, but these states are independently used to obtain inner product with ${}_{A}\langle i|$ and ${}_{B}\langle j|$ respectively. With the Cauchy–Schwarz inequality, the joint cat states are reduced to a mixture of photon number states, and there are no cross-terms between the two cat states.

This means that, using asymmetric intensities between Alice and Bob will not affect the estimation of phase error rate. Moreover, as we described in equation (3), $\{{\hat{M}}_{{k}_{c}{k}_{d},e}^{{ab}}\}$ is a general representation of the channels and detection, and does not require that η_A = η_B either, i.e. asymmetric channels do not affect the security proof either.

Additionally, the decoy intensities $\{{\beta }_{A}^{2},{\beta }_{B}^{2}\}$ might be different for Alice and Bob too, but these states are only used to estimate the yields of photon number states ${p}_{{ZZ}}({k}_{c},{k}_{d}| {n}_{A},{n}_{B})$ using decoy-state analysis, which is exactly the same process as in MDI-QKD. As long as Eve cannot distinguish pulses from different intensity settings, this decoy-state analysis is secure, even in the asymmetric setting—since the sending of a given photon number n given the Poisson distribution $P(n| \mu )={{\rm{e}}}^{-\mu }\tfrac{{\mu }^{n}}{n!}$ is a Markov process, i.e. memoryless process, Eve has no way of telling which intensity setting the photon number state came from, therefore using asymmetric intensities does not affect the estimation of yields for photon number states ${p}_{{ZZ}}({k}_{c},{k}_{d}| {n}_{A},{n}_{B})$.

Therefore, overall, we conclude that neither asymmetric channel losses, nor asymmetric intensities Alice and Bob use (for signal states or decoy states), will affect the security of the protocol. Asymmetry will only affect the performance of the protocol (which will be the subject of discussion in the next section)—asymmetric channels will result in higher QBER and subsequently lower key rate, and asymmetric intensities can compensate for channel asymmetry and enable high key rate for the protocol even when channels are highly asymmetric.

In this section we will discuss how channel asymmetry, and asymmetric intensities, can affect the performance of TF-QKD.

4.1. Channel model

We will first discuss the channel model in the asymmetric case. Again, we extend the expressions in the appendix of [9], and consider asymmetric intensities and channel transmittances.

To obtain the secure key rate, three sets of observables are needed: the X basis gain p_XX(k_c, k_d), the X basis bit-error rate e_XX(k_c, k_d), and the Z basis gain ${p}_{{ZZ}}({k}_{c},{k}_{d}| {\beta }_{A},{\beta }_{B})$ (for all combinations of {β_A, β_B}).

Now, let us suppose Alice and Bob send signals with intensities s_A, s_B, and channels between Alice/Bob and Charles have transmittances η_A, η_B. For simplicity we can write:

$$\begin{eqnarray}\begin{array}{rcl}{\gamma }_{A} & = & {s}_{A}{\eta }_{A}\\ {\gamma }_{B} & = & {s}_{B}{\eta }_{B}\end{array}\end{eqnarray} \tag{ 13 }$$

for signal states, and

$$\begin{eqnarray}\begin{array}{rcl}{\gamma }_{A}^{{\prime} } & = & {\mu }_{A}^{i}{\eta }_{A}\\ {\gamma }_{B}^{{\prime} } & = & {\mu }_{B}^{j}{\eta }_{B}\end{array}\end{eqnarray} \tag{ 14 }$$

for decoy states, where ${\mu }_{A}^{i}$ and ${\mu }_{B}^{j}$ are selected from the set of decoy intensities.

The other imperfections in the channel include the dark count rate p_d, the polarization misalignment between Alice and Bob θ, and the phase mismatch ϕ between Alice and Bob. If we first do not consider dark counts and phase mismatch, the intensities arriving at the detectors C and D at Charles can be written as (similar to the discussions in [19]):

$$\begin{eqnarray}\begin{array}{rcl}{D}_{c} & = & \displaystyle \frac{1}{2}\left({\gamma }_{A}+{\gamma }_{B}-2\sqrt{{\gamma }_{A}{\gamma }_{B}}\cos \theta \right)\\ {D}_{d} & = & \displaystyle \frac{1}{2}\left({\gamma }_{A}+{\gamma }_{B}+2\sqrt{{\gamma }_{A}{\gamma }_{B}}\cos \theta \right)\end{array}\end{eqnarray} \tag{ 15 }$$

the probability that one detector clicks and the other does not (e.g. C clicks and D does not) can be written as

$$\begin{eqnarray}&&(1-{{\rm{e}}}^{-{D}_{c}}){{\rm{e}}}^{-{D}_{d}}={{\rm{e}}}^{-{D}_{d}}-{{\rm{e}}}^{-({D}_{c}+{D}_{d})}={{\rm{e}}}^{-\displaystyle \frac{1}{2}\left[{\gamma }_{A}+{\gamma }_{B}+2\sqrt{{\gamma }_{A}{\gamma }_{B}}\cos \theta \right]}-{{\rm{e}}}^{-({\gamma }_{A}+{\gamma }_{B})}.\end{eqnarray} \tag{ 16 }$$

Including the phase mismatch and dark counts, we can write the X basis gain and QBER in a similar form as [9]:

$$\begin{eqnarray}\begin{array}{rcl}{p}_{{XX}}({k}_{c},{k}_{d}) & = & \displaystyle \frac{1}{2}(1-{p}_{d})\left({{\rm{e}}}^{-\sqrt{{\gamma }_{A}{\gamma }_{B}}{\rm{\cos }}\phi {\rm{\cos }}\theta }+{{\rm{e}}}^{\sqrt{{\gamma }_{A}{\gamma }_{B}}{\rm{\cos }}\phi {\rm{\cos }}\theta }\right)\\ & & \times {{\rm{e}}}^{-\displaystyle \frac{1}{2}({\gamma }_{A}+{\gamma }_{B})}-{\left(1-{p}_{d}\right)}^{2}{{\rm{e}}}^{-({\gamma }_{A}+{\gamma }_{B})}\end{array}\end{eqnarray} \tag{ 17 }$$

$$\begin{eqnarray}&&{{e}}_{{XX}}({k}_{c},{k}_{d})=\displaystyle \frac{{{\rm{e}}}^{-\sqrt{{\gamma }_{A}{\gamma }_{B}}{\rm{\cos }}\phi {\rm{\cos }}\theta }-(1-{p}_{d}){{\rm{e}}}^{-\tfrac{1}{2}({\gamma }_{A}+{\gamma }_{B})}}{{{\rm{e}}}^{-\sqrt{{\gamma }_{A}{\gamma }_{B}}{\rm{\cos }}\phi {\rm{\cos }}\theta }+{{\rm{e}}}^{\sqrt{{\gamma }_{A}{\gamma }_{B}}{\rm{\cos }}\phi {\rm{\cos }}\theta }-2(1-{p}_{d}){{\rm{e}}}^{-\tfrac{1}{2}({\gamma }_{A}+{\gamma }_{B})}}\end{eqnarray} \tag{ 18 }$$

and the Z basis gain is the integral over all possible (random) relative phases:

$$\begin{eqnarray}&&{p}_{{ZZ}}({k}_{c},{k}_{d}| {\beta }_{A},{\beta }_{B})=(1-{p}_{d})\left[{{\rm{e}}}^{-\displaystyle \frac{1}{2}({\gamma }_{A}^{{\prime} }+{\gamma }_{B}^{{\prime} })}{I}_{0}(\sqrt{{\gamma }_{A}^{{\prime} }{\gamma }_{B}^{{\prime} }}\cos \theta )-{{\rm{e}}}^{-({\gamma }_{A}^{{\prime} }+{\gamma }_{B}^{{\prime} })}\right]+{p}_{d}(1-{p}_{d}){{\rm{e}}}^{-({\gamma }_{A}^{{\prime} }+{\gamma }_{B}^{{\prime} })},\end{eqnarray} \tag{ 19 }$$

where I₀(x) is a modified Bessel function of the first kind.

The Z basis gain can be used in decoy-state analysis to obtain m, n photon yields ${p}_{{ZZ}}({k}_{c},{k}_{d}| {n}_{A},{n}_{B})$. Here for simplicity we first consider the infinite-decoy case, where ${p}_{{ZZ}}({k}_{c},{k}_{d}| {n}_{A},{n}_{B})$ can be assumed to be perfectly known (similar to supplementary information equations (18), (19) in [9] but with asymmetric channel transmittances):

$$\begin{eqnarray}&&{p}_{{ZZ}}({k}_{c},{k}_{d}| {n}_{A},{n}_{B})=(1-{p}_{d}){q}_{{ZZ}}({k}_{c},{k}_{d}| {n}_{A},{n}_{B})+(1-{p}_{d}){p}_{d}{\left(1-{\eta }_{A}\right)}^{{n}_{A}}{\left(1-{\eta }_{B}\right)}^{{n}_{B}},\end{eqnarray} \tag{ 20 }$$

where

$$\begin{eqnarray}\begin{array}{rcl}{q}_{{ZZ}}({k}_{c},{k}_{d}| {n}_{A},{n}_{B}) & = & \displaystyle \sum _{k=0}^{{n}_{A}}\displaystyle \left(\genfrac{}{}{0em}{}{{n}_{A}}{k}\right)\displaystyle \sum _{l=0}^{{n}_{B}}\displaystyle \left(\genfrac{}{}{0em}{}{{n}_{B}}{l}\right)\displaystyle \frac{{\eta }_{A}^{k}{\eta }_{B}^{l}{\left(1-{\eta }_{A}\right)}^{{n}_{A}-k}{\left(1-{\eta }_{B}\right)}^{{n}_{B}-l}}{{2}^{k+l}k!l!}\\ & & \displaystyle \sum _{m=0}^{k}\displaystyle \left(\genfrac{}{}{0em}{}{k}{m}\right)\displaystyle \sum _{p=0}^{l}\displaystyle \left(\genfrac{}{}{0em}{}{l}{p}\right)\displaystyle \sum _{q=\max (0,m+p-l)}^{\min (k,m+p)}\displaystyle \left(\genfrac{}{}{0em}{}{k}{q}\right)\displaystyle \left(\genfrac{}{}{0em}{}{l}{m+p-q}\right)\\ & & (m+p)!(k+l-m-p)!{\cos }^{m+q}({\theta }_{A}){\cos }^{m+p-q}({\theta }_{B})\\ & & {\sin }^{2k-m-q}({\theta }_{A}){\sin }^{2l-m-2p+q}({\theta }_{B})-{\left(1-{\eta }_{A}\right)}^{{n}_{A}}{\left(1-{\eta }_{B}\right)}^{{n}_{B}}.\end{array}\end{eqnarray} \tag{ 21 }$$

In the case with finite decoys (e.g. 3 decoy states for each of Alice and Bob), we can use linear programming to upper-bound the yields, which is described in more detail in appendix.

Afterwards, the phase-error rate can be upper-bounded using these yields:

$$\begin{eqnarray}&&{p}_{{XX}}({k}_{c},{k}_{d}){e}_{{ZZ}}({k}_{c},{k}_{d})\leqslant \displaystyle \sum _{i=0,1}{\left[\displaystyle \sum _{{n}_{A},{n}_{B}=0}^{\infty }{c}_{{n}_{A}}^{A,(i)}{c}_{{n}_{B}}^{B,(i)}\sqrt{{p}_{{ZZ}}({k}_{c},{k}_{d}| {n}_{A},{n}_{B})}\right]}^{2}.\end{eqnarray} \tag{ 22 }$$

With the the X basis gain p_XX(k_c, k_d), the X basis bit-error rate e_XX(k_c, k_d), and the phase-error rate e_ZZ(k_c, k_d), we can obtain the final secure key rate:

$$\begin{eqnarray}&&{R}_{{k}_{c}{k}_{d}}={p}_{{XX}}({k}_{c},{k}_{d})\times [1-{h}_{2}({e}_{{XX}}({k}_{c},{k}_{d}))-{h}_{2}({e}_{{ZZ}}({k}_{c},{k}_{d}))],\end{eqnarray} \tag{ 23 }$$

where ${h}_{2}(x)=-x{{\rm{log}}}_{2}(x)-(1-x){{\rm{log}}}_{2}(1-x)$ is the binary entropy function.

4.2. Effect of channel and intensity asymmetry on gain and QBER

In the estimation of key rate, only three sets of observables are used: the X basis gain p_XX(k_c, k_d), the X basis bit-error rate e_XX(k_c, k_d), and the set of Z basis gain for each combination of decoy intensities ${p}_{{ZZ}}({k}_{c},{k}_{d}| {\beta }_{A},{\beta }_{B})$. Here we note that, the X basis gain and Z basis gain do not explicitly depend on the symmetry of incoming signal strengths γ_A/γ_B, and only the X basis QBER is affected by γ_A/γ_B.

For simplicity, here let us consider the second-order approximation for the Bessel function and exponential function, and for now ignore the phase mismatch and dark count rate:

$$\begin{eqnarray}\begin{array}{rcl}{I}_{0}(x) & = & 1+\displaystyle \frac{1}{4}{x}^{2}+O({x}^{4})\\ {e}^{x} & = & 1+x+\displaystyle \frac{1}{2}{x}^{2}+O({x}^{3}).\end{array}\end{eqnarray} \tag{ 24 }$$

We can then rewrite the X basis gain as:

$$\begin{eqnarray}\begin{array}{rcl}{p}_{{XX}}({k}_{c},{k}_{d}) & = & \displaystyle \frac{1}{2}({{\rm{e}}}^{-\sqrt{{\gamma }_{A}{\gamma }_{B}}{\rm{\cos }}\theta }+{{\rm{e}}}^{\sqrt{{\gamma }_{A}{\gamma }_{B}}{\rm{\cos }}\phi {\rm{\cos }}\theta })\times {{\rm{e}}}^{-\displaystyle \frac{1}{2}({\gamma }_{A}+{\gamma }_{B})}-{{\rm{e}}}^{-({\gamma }_{A}+{\gamma }_{B})}\\ & \approx & \displaystyle \frac{1}{2}({\gamma }_{A}+{\gamma }_{B})-\displaystyle \frac{1}{8}[3{\gamma }_{A}^{2}+3{\gamma }_{B}^{2}+(2+4{{e}}_{d}){\gamma }_{A}{\gamma }_{B}]\end{array}\end{eqnarray} \tag{ 25 }$$

and the Z basis gain as:

$$\begin{eqnarray}\begin{array}{rcl}{p}_{{ZZ}}({k}_{c},{k}_{d}| {\beta }_{A},{\beta }_{B}) & = & {{\rm{e}}}^{-\displaystyle \frac{1}{2}({\gamma }_{A}^{{\prime} }+{\gamma }_{B}^{{\prime} })}{I}_{0}(\sqrt{{\gamma }_{A}^{{\prime} }{\gamma }_{B}^{{\prime} }}\cos \theta )-{{\rm{e}}}^{-({\gamma }_{A}^{{\prime} }+{\gamma }_{B}^{{\prime} })}\\ & \approx & \displaystyle \frac{1}{2}({\gamma }_{A}^{{\prime} }+{\gamma }_{B}^{{\prime} })-\displaystyle \frac{1}{8}[3{\gamma }_{A}^{{\prime} 2}+3{\gamma }_{B}^{{\prime} 2}+(4+2{e}_{d}){\gamma }_{A}^{{\prime} }{\gamma }_{B}^{{\prime} }],\end{array}\end{eqnarray} \tag{ 26 }$$

where the terms higher than second order are omitted, and θ is the total polarization misalignment angle between Alice and Bob satisfying $\theta =2{\sin }^{-1}(\sqrt{{e}_{d}}))$ (suppose Alice–Charles and Bob–Charles each has misalignment error e_d, but with misalignment angles in different directions). We can see that, the gain in both X and Z basis is dominated by the term $\tfrac{1}{2}({\gamma }_{A}+{\gamma }_{B})=\tfrac{1}{2}({s}_{A}{\eta }_{A}+{s}_{B}{\eta }_{B})$ or $\tfrac{1}{2}({\gamma }_{A}^{{\prime} }+{\gamma }_{B}^{{\prime} })=\tfrac{1}{2}({\mu }_{A}^{i}{\eta }_{A}+{\mu }_{B}^{j}{\eta }_{B})$, i.e. taking first-order approximation:

$$\begin{eqnarray}\begin{array}{rcl} & & {p}_{{XX}}({k}_{c},{k}_{d})\approx \displaystyle \frac{1}{2}({\gamma }_{A}+{\gamma }_{B})\\ & & {p}_{{ZZ}}({k}_{c},{k}_{d}| {\beta }_{A},{\beta }_{B})\approx \displaystyle \frac{1}{2}({\gamma }_{A}^{{\prime} }+{\gamma }_{B}^{{\prime} })\end{array}\end{eqnarray} \tag{ 27 }$$

which means that the gain scales with the average of arriving intensities through Alice's and Bob's channels—this is different from MDI-QKD, where the gain only contains the second-order terms ${\gamma }_{A}^{2},{\gamma }_{B}^{2},{\gamma }_{A}{\gamma }_{B}$. We can also see that the gain does not depend on the asymmetry of arriving intensities, e.g. γ_A/γ_B.

On the other hand, the QBER in X basis depends on the balance of arriving intensities:

$$\begin{eqnarray}\begin{array}{rcl}{{e}}_{{XX}}({k}_{c},{k}_{d}) & = & \displaystyle \frac{{{\rm{e}}}^{-\sqrt{{\gamma }_{A}{\gamma }_{B}}{\rm{\cos }}\phi {\rm{\cos }}\theta }-(1-{p}_{d}){{\rm{e}}}^{-\tfrac{1}{2}({\gamma }_{A}+{\gamma }_{B})}}{{{\rm{e}}}^{-\sqrt{{\gamma }_{A}{\gamma }_{B}}{\rm{\cos }}\phi {\rm{\cos }}\theta }+{{\rm{e}}}^{\sqrt{{\gamma }_{A}{\gamma }_{B}}{\rm{\cos }}\phi {\rm{\cos }}\theta }-2(1-{p}_{d}){{\rm{e}}}^{-\tfrac{1}{2}({\gamma }_{A}+{\gamma }_{B})}}\\ & \approx & \displaystyle \frac{\tfrac{1}{2}({\gamma }_{A}+{\gamma }_{B})-\sqrt{{\gamma }_{A}{\gamma }_{B}}{\rm{\cos }}\theta +\tfrac{1}{2}{\gamma }_{A}{\gamma }_{B}{{\rm{\cos }}}^{2}\theta -\tfrac{1}{8}{({\gamma }_{A}+{\gamma }_{B})}^{2}}{({\gamma }_{A}+{\gamma }_{B})+{\gamma }_{A}{\gamma }_{B}{{\rm{\cos }}}^{2}\theta -\tfrac{1}{4}{({\gamma }_{A}+{\gamma }_{B})}^{2}}\end{array}\end{eqnarray} \tag{ 28 }$$

which, in the first-order approximation⁵ , can be simplified as:

$$\begin{eqnarray}&&{e}_{{XX}}({k}_{c},{k}_{d})\approx \displaystyle \frac{\tfrac{1}{2}({\gamma }_{A}+{\gamma }_{B})-\sqrt{{\gamma }_{A}{\gamma }_{B}}\cos \theta }{{\gamma }_{A}+{\gamma }_{B}}=\displaystyle \frac{\tfrac{1}{2}(\tfrac{{\gamma }_{A}}{{\gamma }_{B}}+1)-\sqrt{\tfrac{{\gamma }_{A}}{{\gamma }_{B}}}\cos \theta }{\tfrac{{\gamma }_{A}}{{\gamma }_{B}}+1}.\end{eqnarray} \tag{ 29 }$$

We can see that here the X basis QBER does depend on asymmetry—more precisely, it depends on how much the arriving intensities at Charles, ${\gamma }_{A}={\eta }_{A}{s}_{A}$ and ${\gamma }_{B}={\eta }_{B}{s}_{B}$ are balanced. This is understandable physically, since the X basis key generation depends on single-photon interference and relies on the indistinguishability of incoming signals. This means that, in the case that channels are not symmetric, compensating for the channel asymmetry with different signal intensities for Alice and Bob and aiming for ${\eta }_{A}{s}_{A}={\eta }_{B}{s}_{B}$ can help minimize the X basis QBER.

On the other hand, in the Z basis, the bit-error rate (i.e. the X basis phase-error rate) cannot be directly measured, but is instead upper-bounded using the observable gain data from the decoy states. As we mentioned above, the Z basis gain (in the first-order approximation) scales with $\tfrac{1}{2}({\gamma }_{A}^{{\prime} }+{\gamma }_{B}^{{\prime} })=\tfrac{1}{2}({\mu }_{A}^{i}{\eta }_{A}+{\mu }_{B}^{j}{\eta }_{B})$ and does not depend on the symmetry between incoming intensities. Moreover, the yields ${p}_{{ZZ}}({k}_{c},{k}_{d}| {n}_{A},{n}_{B})$ are estimated using linear programming. For instance, for three decoys where Alice and Bob respectively use $\{{\mu }_{A},{\nu }_{A},{\omega }_{A}\},\{{\mu }_{B},{\nu }_{B},{\omega }_{B}\}$ as their decoy states, there are nine sets of observable gains, $\{{Q}_{\mu \mu },{Q}_{\mu \nu },{Q}_{\mu \omega },{Q}_{\nu \mu },{Q}_{\nu \nu },{Q}_{\nu \omega },{Q}_{\omega \mu },{Q}_{\omega \nu },{Q}_{\omega \omega }\}$, each of which constitutes a constraint for the linear program that helps bound the yields ${p}_{{ZZ}}({k}_{c},{k}_{d}| {n}_{A},{n}_{B})$. Such a structure makes the linear program relatively robust against asymmetry in the decoy states, and the linear program can fairly accurately upper-bound the yields as long as the intensities are of reasonable values (i.e. ${\mu }_{A}\ne {\nu }_{A},{\mu }_{B}\ne {\nu }_{B}$, and none of the intensities are too large e.g. > 1).

The phase error rate, as shown in equation (17), is based on a linear combination of the square root of the yields. It is therefore also very little affected by asymmetry, and almost always reaches a good value (at least in the infinite-data case) so long as the intensities are within reasonable range, regardless of the asymmetries in channel transmittances or decoy intensities.

We plot the QBER in the X and the Z bases versus asymmetry in arriving intensities (e.g. ${s}_{A}{\eta }_{A}/{s}_{B}{\eta }_{B}$ or μ_Aη_A/μ_Bη_B) in figure 2. As can be seen, the X basis QBER depends heavily on asymmetry and is minimal when ${s}_{A}{\eta }_{A}/{s}_{B}{\eta }_{B}=1$, while the upper-bounded Z basis QBER (i.e. phase-error rate) is hardly affected by asymmetry.

Zoom In Zoom Out Reset image size

Therefore, a viable strategy for TF-QKD in asymmetric channels is to compensate for the channel asymmetry with signal intensities {s_A, s_B} only, while the decoy intensities {μ_A, ν_A, ω_A}, {μ_B, ν_B, ω_B} can be still kept symmetric. However, note that the signal intensities not only determines (1) X basis QBER, it also affects (2) X basis gain (which determines the raw key generation rate, and favors large s_A, s_B), as well as (3) upper-bound of phase error rate (since the cat states are determined by signal intensities, and the estimation favors small s_A, s_B—typically < 0.1—for a tighter upper bound on phase error rate). Criteria (1)–(3) cannot be simultaneously satisfied, therefore an optimization for {s_A, s_B} is required for highest key rate.

Interestingly, we can compare this with the case of MDI-QKD. As described in [15], the 4-intensity protocol (and 7-intensity protocol in the extended asymmetric case) has decoupled X and Z bases, where Z basis is used for key generation and X basis uses decoy states to estimation phase-error rate. In MDI-QKD, the X basis data depends on two-photon interference and requires balanced arriving intensities (or else the X basis QBER will increase dramatically), while the Z basis does not require indistinguishability of the signals, and is therefore insensitive to channel asymmetry. In MDI-QKD, all the X basis decoy states should satisfy e.g. ${\mu }_{A}{\eta }_{A}={\mu }_{B}{\eta }_{B}$, while the signal states s_A, s_B can be chosen to simply optimize key generation rate. (Due to misalignment, there is a slight dependence of Z basis QBER to asymmetry too, hence optimal s_A, s_B are still not equal, but this is a much weaker dependence on symmetry than in the X basis, and optimal s_A/s_B is much closer to 1 than η_B/η_A in MDI-QKD.)

While our approach works both for MDI-QKD and TF-QKD, a key difference is that states that compensate for channel asymmetry are the signal states in TF-QKD (while this responsibility lies on decoy states in MDI-QKD), which are also involved in key generation and phase error estimation. This means that in TF-QKD, it is more difficult to simultaneously keep a low X basis QBER and a good key generation rate and low phase error rate. Perhaps due to this reason, the advantage of asymmetric-intensity protocols is somewhat less pronounced in TF-QKD—nonetheless, it still provides about an order of magnitude higher key rate than completely symmetric protocols and still 2–3 times higher key rate than adding fibre—which means that it still is the strategy that provides highest key rate when channels are asymmetric.

In this section we use the technique described above—to compensate for channel asymmetry simply with different s_A, s_B for Alice and Bob. We first compare our method with prior art techniques and study the numerically optimized intensities for the asymptotic (infinite-decoy, infinite-data) case. Then, we also show that our method works with finite decoys and also finite data size.

We plot the simulation results for asymptotic TF-QKD in figure 3. As can be seen, for the two cases where channel mismatch x = η_A/η_B = 0.1 and η_A/η_B = 0.01, our method consistently have much higher key rate than TF-QKD with symmetric intensities. Interestingly, we show that adding fibre can help users obtain higher key rate, but it comes with the additional inconvenience of having to physically modify the channel, and also it still has lower key rate than our method of simply adjusting signal intensities.

Zoom In Zoom Out Reset image size

We also plot the ratio of optimal signal intensities in figure 4. As we have predicted, the optimal signal intensities are rather close to the relation of ${s}_{A}{\eta }_{A}={s}_{B}{\eta }_{B}$, in order to maintain a lower X basis QBER. However, as we discussed, since signal states are also involved in key generation and phase error rate estimation (based on the imaginary cat states), they prevent the signal states from taking the values that minimize QBER (but rather, makes it choose the value that maximizes the overall key rate).

Zoom In Zoom Out Reset image size

Additionally, we also plot our results for the practical case with finite number of decoys (here we use three decoys each for Alice and Bob: {μ_A, ν_A, ω_A}, {μ_B, ν_B, ω_B}) and finite data size. The upper-bounding of photon number yields using linear programming, as well as the finite-key analysis, are both described in more detail in appendix. We can see that similar result holds—our method has an advantage over either using symmetric intensities directly or adding fibre. More interestingly, we include both the case where we only allow s_A, s_B to be asymmetric, versus the case where all intensities and probabilities can be optimized, and as shown in the plot, we see that using asymmetric signal intensities alone is sufficient to compensate for channel asymmetry.

In this paper we present a simple method to obtain good performance for TF-QKD even if channels are asymmetric. We present a theoretical understanding of why signal states (and not decoy states) should be adjusted to compensate for asymmetry, and we also show that the method is still compatible with existing security proofs. With our method, there is no need to add additional fibre, and Alice and Bob can implement the method in software-only. This provides great convenience for TF-QKD in practice—where realistic channels might likely be asymmetric—and can also be used in quantum networks (where adding fibre for each pair of users is impractical) where a central service-provider can easily optimize the intensities for each pair of users.

This work was supported by the Natural Sciences and Engineering Research Council of Canada (NSERC), U.S. Office of Naval Research (ONR). Computations were performed on the Niagara supercomputer at the SciNet HPC Consortium. SciNet is funded by: the Canada Foundation for Innovation; the Government of Ontario; Ontario Research Fund—Research Excellence; and the University of Toronto.

We thank Koji Azuma for providing the corrected security proof [18] that incorporates mixed states after the measurement.

We note that, during the preparation of the current manuscript, it came into our knowledge that another work on asymmetric TF-QKD is under preparation [20], which is independently completed from this work. Our works are posted simultaneously on the preprint server [20, 21].

In this section we briefly describe the linear programming approach we used to estimate the upper bounds for the photon-number yields ${p}_{{ZZ}}({k}_{c},{k}_{d}| {n}_{A},{n}_{B})$—which for simplicity here we will denote as Y_nm—which is the probability to obtain a set of detection events k_c, k_d given that Alice and Bob respectively sent n_A, n_B (or, n, m) photons. Such an approach has been widely discussed in literature as in [22–24], and is also described in the simple TF-QKD proof paper [9]. We also used a similar linear programming approach for some of the results in [15] appendix E, but it was not described in detail in that paper.

For simplicity, in this section we denote the observable gain in Z basis ${p}_{{ZZ}}({k}_{c},{k}_{d}| {\beta }_{A},{\beta }_{B})$ as ${Q}_{{\mu }_{i},{\mu }_{j}}$ where ${\mu }_{i}={\beta }_{A}^{2}$ and ${\mu }_{j}={\beta }_{B}^{2}$, and k_c, k_d are omitted (since the same expressions hold true for k_c, k_d = (0, 1) or k_c, k_d = (1, 0), and we can substitute the observable data for each k_c, k_d respectively to obtain the corresponding ${p}_{{ZZ}}({k}_{c},{k}_{d}| {n}_{A},{n}_{B})$). Also, as mentioned above, we denote the yields ${p}_{{ZZ}}({k}_{c},{k}_{d}| {n}_{A},{n}_{B})$ as Y_nm.

A.1. Linear program model

Following [4], the yields Y_nm where Alice sends n photons and Bob sends m photons, satisfy the constraints:

$$\begin{eqnarray}&&\displaystyle \sum _{n}\displaystyle \sum _{m}{P}_{n}^{{\mu }_{i}}{P}_{m}^{{\mu }_{j}}{Y}_{{nm}}={Q}_{{\mu }_{i}{\mu }_{j}}^{Z},\end{eqnarray} \tag{ A.1 }$$

where the photon number distributions are Poissonian:

$$\begin{eqnarray}\begin{array}{rcl}{P}_{n}^{{\mu }_{i}} & = & {{\rm{e}}}^{{\mu }_{i}}\displaystyle \frac{{\mu }_{i}^{n}}{n!}\\ {P}_{m}^{{\mu }_{j}} & = & {{\rm{e}}}^{{\mu }_{j}}\displaystyle \frac{{\mu }_{j}^{m}}{m!}.\end{array}\end{eqnarray} \tag{ A.2 }$$

Here, the right-hand-side constants ${Q}_{{\mu }_{i}{\mu }_{j}}^{Z}$ are the 'observables', i.e. the gain and error-gain respectively for the intensity combination μ_i, μ_j (which can be any intensity among the set of decoy intensities). For the case of 3-decoys each for Alice and Bob, equation (A.1) corresponds to 9 sets of constraints. Using equation (A.1) as linear constraints, and {Y_nm} as variables, we can apply linear programming, to maximize or minimize any linear combination of any of the variables (called an objective function)—for instance, here we can run the linear program multiple times, each time acquiring the upper bound for a given Y_nm where (n, m) can be (0, 0), (2, 0), (0, 2), (1, 1), (2, 2).

Note that, since there are infinitely many photon number states, to solve the linear program on an actual computer, we have to perform a cut-off and discard higher-order terms with large photon number. In practice we choose S_cut = 10, such that a term is only discarded when both n ≥ 10 and m ≥ 10. For the discarded terms, we can either set them to zero (for lower bounds) or 1 (for upper bounds).

$$\begin{eqnarray}\begin{array}{rcl}\displaystyle \sum _{n}\displaystyle \sum _{m}{P}_{n}^{{\mu }_{i}}{P}_{m}^{{\mu }_{j}}{Y}_{{nm}} & \geqslant & \displaystyle \sum _{n\lt 10}\displaystyle \sum _{m\lt 10}{P}_{n}^{{\mu }_{i}}{P}_{m}^{{\mu }_{j}}{Y}_{{nm}}\\ \displaystyle \sum _{n}\displaystyle \sum _{m}{P}_{n}^{{\mu }_{i}}{P}_{m}^{{\mu }_{j}}{Y}_{{nm}} & \leqslant & \displaystyle \sum _{n\lt 10}\displaystyle \sum _{m\lt 10}{P}_{n}^{{\mu }_{i}}{P}_{m}^{{\mu }_{j}}{Y}_{{nm}}+\left(1-\displaystyle \sum _{n\lt 10}\displaystyle \sum _{m\lt 10}{P}_{n}^{{\mu }_{i}}{P}_{m}^{{\mu }_{j}}\right).\end{array}\end{eqnarray} \tag{ A.3 }$$

Therefore, in practice, the linear constraints can be written as:

$$\begin{eqnarray}&&{Q}_{{\mu }_{i}{\mu }_{j}}^{Z}-\left(1-\displaystyle \sum _{n\lt 10}\displaystyle \sum _{m\lt 10}{P}_{n}^{{\mu }_{i}}{P}_{m}^{{\mu }_{j}}\right)\leqslant \displaystyle \sum _{n\lt 10}\displaystyle \sum _{m\lt 10}{P}_{n}^{{\mu }_{i}}{P}_{m}^{{\mu }_{j}}{Y}_{{nm}}\leqslant {Q}_{{\mu }_{i}{\mu }_{j}}^{Z}\end{eqnarray} \tag{ A.4 }$$

with the additional constraint on variables:

$$\begin{eqnarray}&&0\leqslant {Y}_{{nm}}\leqslant 1.\end{eqnarray} \tag{ A.5 }$$

The linear program is run multiple times, each time maximizing a given Y_mn, where (n, m) can be (0, 0), (2, 0), (0, 2), (1, 1), (2, 2).

A.2. Finite-size effects

In this section we consider finite-size effects for the privacy amplification process. Because of the statistical fluctuations, the observables (gains) we obtain in the Z basis might deviate from their respective expected values, which will lie within a certain 'confidence interval' around the observed values. Here we will perform a standard error analysis, similar to that in [15, 22, 25], which is meant to be a straightforward estimation of the performance of TF-QKD under asymmetry and with practical data size, but not as a rigorous proof for composable security.

Consider a random variable, whose observed value is n, we can bound its expected value $\langle n\rangle$ with the upper and lower bounds

$$\begin{eqnarray}&&\underline{n}=n-\gamma \sqrt{n}\leqslant \langle n\rangle \leqslant n+\gamma \sqrt{n}=\overline{n}\end{eqnarray} \tag{ A.6 }$$

with a confidence (success probability) of ${\rm{erf}}(\gamma /\sqrt{2})$, where γ is the number of standard deviations the confidence interval lies above and below the observed value, and erf is the error function. In the simulations we consider a security failure probability of  = 10⁻⁷, which means we should set γ ≈ 5.3.

In the Z basis, let us denote the observed counts for a given intensity setting {μ_i, μ_j} as ${n}_{{\mu }_{i},{\mu }_{j}}^{Z}$, which satisfies

$$\begin{eqnarray}&&{n}_{{\mu }_{i},{\mu }_{j}}^{Z}={Q}_{{\mu }_{i},{\mu }_{j}}^{Z}\times ({{NP}}_{{\mu }_{i}}{P}_{{\mu }_{j}}),\end{eqnarray} \tag{ A.7 }$$

where N is the total number of signals sent and ${P}_{{\mu }_{i}},{P}_{{\mu }_{j}}$ are the probabilities for Alice and Bob to respectively choose intensities μ_i and μ_j. By applying equation (A.6), we can acquire the upper and lower bounds to ${Q}_{{\mu }_{i},{\mu }_{j}}^{Z}$:

$$\begin{eqnarray}\begin{array}{rcl}\overline{{Q}_{{\mu }_{i}{\mu }_{j}}^{Z}} & = & {Q}_{{\mu }_{i}{\mu }_{j}}^{Z}+\gamma \sqrt{\displaystyle \frac{{Q}_{{\mu }_{i}{\mu }_{j}}^{Z}}{{{NP}}_{{\mu }_{i}}{P}_{{\mu }_{j}}}}\\ \underline{{Q}_{{\mu }_{i}{\mu }_{j}}^{Z}} & = & {Q}_{{\mu }_{i}{\mu }_{j}}^{Z}-\gamma \sqrt{\displaystyle \frac{{Q}_{{\mu }_{i}{\mu }_{j}}^{Z}}{{{NP}}_{{\mu }_{i}}{P}_{{\mu }_{j}}}}.\end{array}\end{eqnarray} \tag{ A.8 }$$

Then, we can substitute them into the upper and lower bounds in the linear program when estimating Y_nm:

$$\begin{eqnarray}&&\underline{{Q}_{{\mu }_{i}{\mu }_{j}}^{Z}}-\left(1-\displaystyle \sum _{n\lt 10}\displaystyle \sum _{m\lt 10}{P}_{n}^{{\mu }_{i}}{P}_{m}^{{\mu }_{j}}\right)\leqslant \displaystyle \sum _{n\lt 10}\displaystyle \sum _{m\lt 10}{P}_{n}^{{\mu }_{i}}{P}_{m}^{{\mu }_{j}}{Y}_{{nm}}\leqslant \overline{{Q}_{{\mu }_{i}{\mu }_{j}}^{Z}}\end{eqnarray} \tag{ A.9 }$$

which loosens the bounds and will result in a slightly higher upper bound for Y_nm (which is understandable, since we expect lower key rate with finite-size effect considered). Similar linear programs for finite-size decoy-state have also been considered in [23].

Note that, although here we only consider a standard error analysis, in principle our results in this paper is applicable to e.g. composable security using Chernoff's bound [24]. The key point is, the dependence on channel asymmetry, and the compensation for asymmetry using intensities, are only relevant in the X basis (signal states). The asymptotic case (with infinite decoys, where only signal states are relevant) therefore defines the fundamental scaling of key rate versus asymmetric channels, and all types of finite size analysis on the decoy states (e.g. using standard error analysis, using Chernoff's bound [24], or adding a 'joint bounds' analysis to tighten the bounds on statistical fluctuation and obtain a higher key rate [25], versus not considering finite-size effects at all and assuming the asymptotic key rate [3, 7–10], i.e. assuming expected values of the gain and QBER to be identical to observed values in experiment) can be viewed of as correction terms (imperfections) on the yields and the key rate in the asymptotic limit. Our method is only related to the signal states and their intensities in the X basis, and is in principle always applicable regardless of the type of decoy state analysis (e.g. number of decoys) and the finite-size analysis used, as long as the Z basis is decoupled from the X basis.

With finite-size effect considered, the optimizable parameters for TF-QKD now include

$$\begin{eqnarray}&&[{s}_{A},{\mu }_{A},{\nu }_{A},{P}_{{s}_{A}},{P}_{{\mu }_{A}},{P}_{{\nu }_{A}},{s}_{B},{\mu }_{B},{\nu }_{B},{P}_{{s}_{B}},{P}_{{\mu }_{B}},{P}_{{\nu }_{B}}],\end{eqnarray} \tag{ A.10 }$$

where the implicit parameters are ω_A, ω_B (which for simplicity we assume to be zero), and ${P}_{{\omega }_{A}}=1-{P}_{{s}_{A}}-{P}_{{\mu }_{A}}-{P}_{{\nu }_{A}}$ and similarly ${P}_{{\omega }_{B}}=1-{P}_{{s}_{B}}-{P}_{{\mu }_{B}}-{P}_{{\nu }_{B}}$, and the choice of signal states s_A, s_B versus the decoy states automatically implies basis choice, too. The above parameters are optimized using the same coordinate descent algorithm as described in [15]. In figure A1, the dot-dash line (fully asymmetric) optimizes all 12 parameters, while the dashed line (signal-only asymmetric) optimizes only 7 parameters (where all parameters except s_A, s_B are identical for Alice and Bob):

$$\begin{eqnarray}&&[{s}_{A},\mu ,\nu ,{P}_{s},{P}_{\mu },{P}_{\nu },{s}_{B},\mu ,\nu ,{P}_{s},{P}_{\mu },{P}_{\nu }].\end{eqnarray} \tag{ A.11 }$$

Zoom In Zoom Out Reset image size

Performing coordinate descent on key rate versus parameters while estimating the yields with linear programming is rather CPU-intensive. We have used a 40-core (80-thread) machine (a single compute node in the Niagara supercomputer [26], each node with dual 20-core Intel Skylake CPUs) to generate figure A1, where the OpenMP multithreading library is used to parallelize the coordinate descent algorithm (to accelerate the search along each coordinate). The details of the algorithm can be found in [15, 22]. Also, we used Gurobi [27], a commercial linear program solver, to solve the linear programming models. Linear programs sometimes introduce multiple maxima, which means a local search on parameters sometimes might get trapped in a local maximum. To alleviate this, we can start a local search from multiple random starting points, and pick the largest search result, which can be viewed of as a form of global search. (In principle, we can permutate the search results and perform multiple iterations of random search using e.g. an evolution algorithm [28], but here using one iteration with multiple random starting points is usually sufficient in finding a good key rate.)