IEEE - Aerospace and Electronic Systems - March 2021 - 40

An Introduction to Practical Quantum Key Distribution
various methods described above, over a fiber channel.
While past experimental implementations used dark-fiber,
today it is possible to perform quantum communication
over fiber also carrying classical information [79]-[83].
One prime limiting factor to the use of fiber is the high
probability of photon loss as distance increases (indeed,
the probability of photon loss is modeled as 1 À 10ÀaÁ'=10
where ' is the distance between users and a is typically .1
to :25 dB/km[29]. Note that one cannot repeat quantum
signals (as this would involve a measurement-thus decohering the state); while quantum repeaters are a theoretical
possibility, they require advanced technology including
perfect, or near-perfect, quantum memories which are far
from practical today [84], [85]. This, therefore, limits the
distance allowed between two QKD nodes connected by
fiber. Note that quantum repeaters operate through entanglement swapping via Bell state measurements and do not
violate the no-cloning theorem [10], [86].
Not only does loss limit raw key distillation due to B
not receiving any information, one must also assume that
any loss is due to an adversary's attack, thus greatly
shrinking the size of the final secret key after privacy
amplification. The reason for this can be understood from
an examination of some common attacks, such as a PNS
attack [87] and the unambiguous state discrimination
attack [88]. In the former, Eve blocks laser pulses that
contain only one photon, and siphons off one of the photons from each other the remaining photons allowing her
to have more information on each of the successful key
rounds than she would have otherwise. Even worse, the
B92 protocol, without mediation, is susceptible to the
unambiguous state discrimination attack, in which Eve is
able to only allow photons through during rounds in which
she has full information on the qubit.
Besides photon loss, the use of practical sources,
which as discussed produce multiple photons with nonzero probability, is also a bottleneck to efficient QKD
over long distances. To mitigate this concern, new protocols were developed which do not leak full information
when multiple photons are emitted [46] (as, with these,
key information is encoded in the basis choice, not the
actual state). An alternative approach is the decoy state
protocol which, using BB84-style encoding, allows users
A and B to actually estimate the probability of single-photon events and, in particular, channel statistics within
those events and to detect PNS attacks [29], [55], [89],
[90]. Due to its relatively simple hardware requirements,
this decoy state protocol is commonly used in experimental and commercial implementations.
The idea behind the decoy-state protocol is, in hindsight, relatively simple, yet extremely powerful. In
essence, instead of A using a fixed intensity setting for her
laser source [the m in (3)], she alters it choosing, randomly, from three possible settings: signal (the highest),
decoy (generally on the order of 10À1 ), and decoy-vacuum
40

(some implementations cannot truly be set to vacuum, and
so instead their intensity is set to something on the order
of 10À4 -essentially, with this setting A always sends a
vacuum state). Since the intensity setting is unknown to E
(who cannot distinguish what intensity A actually used on
any particular iteration), this allows A and B to get a better idea as to what E's attack strategy is when multiple, or
no, photons are emitted. That is, A and B will later sample
and collect statistics, separately for all three intensities. If
E is performing a PNS attack, there will be a detectable
change in behavior between the signal and decoy events
(as, normally, E will block single-photon events). Beyond
detecting this attack, the decoy state protocol allows one
to determine accurate bounds on single-photon errors,
needed to derive a more optimistic upper-bound on E's
information gain. By determining a more accurate bound
on E's information, one need not necessarily shrink the
raw key by as much during the privacy amplification
process.
For a recent analysis of the decoy-state protocol for
practical experimental sources, the reader is referred
to [29]. Here, we provide a high-level overview of the protocol. In addition to choosing random bases each iteration,
as is standard in BB84 (see the " Introduction " section), A
also chooses one of the three intensity settings m. The process repeats until a sufficiently large set of raw-key material has been produced (typically 10s for s ¼ 4; 5; . . . ; 9
depending on a user specified parameter s). Once this
block of data has been produced, A and B will sample on
a randomly chosen subset of their data, estimating noise
and loss levels for each of the three intensity settings.
Since E cannot determine what intensity was used, her
attack cannot depend on the intensity setting and this
allows users to determine good bounds on the noise in single-photon events (even though they cannot measure this
exactly as they can never be certain of when a single photon leaves A's lab) [29], [91]. From this, one can calculate
exactly the key-rate (1)
r ¼ qðQ1 ð1 À hðe1 ÞÞ À Qm hðEm ÞÞ

(5)

where q is the probability that A and B choose the same
basis; e1 is the estimated single-photon error; Q1 is the
estimated probability that a single-photon event leads to a
detection at B's end; Qm is the observed probability that
an iteration leads to a detection at B's end during rounds
in which the mean photon number was m (so it is the average over all photon numbers sent by A during rounds
where the intensity was m); and Em is the observed error
(again, it is the average of the error over all photon numbers sent by A). Recall that A sends multiple photons with
certain probabilities and it is never known by users when a
single-photon event occurred. Thus, while Em and Qm can
be measured, E1 and Q1 cannot be directly measured.
Instead, the seminal result of the decoy state protocol is

IEEE A&E SYSTEMS MAGAZINE

MARCH 2021

IEEE - Aerospace and Electronic Systems - March 2021

Table of Contents for the Digital Edition of IEEE - Aerospace and Electronic Systems - March 2021