Decoy-State QKD

Decoy-state quantum key distribution is a parameter-estimation method for QKD transmitters that emit phase-randomized weak coherent pulses rather than deterministic single photons. Alice randomly changes the pulse intensity. The different intensity classes contain different known mixtures of vacuum, one-photon, and multiphoton emissions, yet a pulse containing exactly $n$ photons is required to have the same relevant quantum state regardless of the intensity label. Comparing the observed detection and error rates then bounds the yield and error rate of the one-photon sector.

This page derives the vacuum-plus-weak-decoy bounds, first for exact probabilities and then with the qualifications needed for finite data. Decoy estimation supplies one ingredient of a security proof; source characterization, authentication and the remaining classical processing are still required.

Required background. QKD explains secrecy and classical processing; BB84 distinguishes bit and phase errors. Photon-number states explains the optical number basis.

Weak laser pulses and photon-number splitting

Weak laser pulses are not single photons

An attenuated laser pulse is naturally modeled as a coherent state. Here $|n\rangle$ means $n$ photons in the same encoded optical mode; the fixed BB84 state label is suppressed. If its mean photon number is $k$, write its complex amplitude as $\alpha=\sqrt{k}e^{i\phi}$. In the photon-number basis,

$$|\alpha\rangle = e^{-k/2} \sum_{n=0}^{\infty} \frac{k^{n/2}e^{in\phi}}{\sqrt{n!}}|n\rangle.$$

If Alice uniformly randomizes the global optical phase independently on every pulse and does not reveal it, averaging over $\phi$ removes the coherence between distinct photon-number sectors:

$$\begin{aligned} \rho_k &= \int_0^{2\pi}\frac{d\phi}{2\pi} |\sqrt{k}e^{i\phi}\rangle \langle\sqrt{k}e^{i\phi}| \\ &= \sum_{n=0}^{\infty} p_n(k)|n\rangle\langle n|, \qquad p_n(k)=e^{-k}\frac{k^n}{n!}. \end{aligned}$$

The pulse is therefore a classical Poisson mixture of photon-number states, not a coherent superposition between sectors for the security model being used. In particular,

$$p_0(k)=e^{-k}, \qquad p_1(k)=ke^{-k}, \qquad p_{\ge2}(k)=1-e^{-k}(1+k).$$

Vacuum pulses do not normally carry Alice’s bit. One-photon pulses support the qubit security argument. Multiphoton pulses require special care because two or more copies of the same encoded optical state may leave the transmitter.

The photon-number-splitting warning

Consider a highly lossy channel and suppose Alice and Bob inspect only the overall click probability and quantum bit error rate. An adversary can, as an illustrative attack, perform a quantum-nondemolition measurement of photon number, block selected vacuum and one-photon pulses, and remove one photon from a multiphoton pulse while forwarding the rest losslessly. Eve stores her photon until Alice announces the basis and then measures in that basis. On those forwarded multiphoton rounds she can learn the bit without introducing the intercept–resend error signature.

The point is not that every real attack literally uses a photon-number splitter. The point is non-identifiability. One overall detection rate can be explained by many different photon-number-dependent channel responses. A low observed error rate does not by itself show that enough detections came from the one-photon sector.

In the conservative tagged-signal treatment of Gottesman et al. (2004), every multiphoton emission is treated as known to Eve, the key-producing resource is the number of detected one-photon signals. Without additional observations, Alice and Bob cannot estimate that number tightly in a high-loss channel. Decoy intensities supply those observations.

The Decoy-State Principle

Alice chooses an intensity label $k$ at random for each pulse. A common three-intensity design uses

$$k\in\{0,\nu,\mu\}, \qquad 0<\nu<\mu,$$

where $\mu$ is the signal intensity, $\nu$ is a weak decoy intensity, and $0$ is a vacuum decoy. The intensity label is normally disclosed over the authenticated public channel only after Bob has fixed his detection record.

The key assumption is that, for a fixed photon number and encoded BB84 state, signal and decoy emissions have identical conditional states in all modes accessible to Eve. Changing the intensity changes the probabilities of the photon-number sectors, not their conditional polarization, timing, spectrum or spatial profile. This is the principle behind the proposals of Hwang (2003), Lo, Ma and Chen (2005), and Wang (2005).

Knowing $n$ can change Eve’s posterior probability of the intensity label: large photon numbers are more likely for the brighter setting. The assumption does not forbid that ordinary statistical information. It says that at fixed $n$ there is no additional distinguishable label carried by the state. Before the intensity announcement, Eve therefore applies the same conditional response to identical $n$-photon inputs. A source with intensity-dependent timing or spectrum needs a different analysis.

The brighter setting gives more weight to the one-photon and multiphoton sectors. Each individual $n$-photon yield $Y_n$ is shared between settings under the stated source assumptions. The grouped $n\ge2$ bar illustrates source composition only: its conditional mean yield need not be the same at the two intensities, because the mixture within that group changes.

Yields, Gains, and Error Gains

Suppress the basis label temporarily. For an emitted $n$-photon pulse, define the yield

$$Y_n := \Pr(\text{Bob records an accepted detection}\mid n).$$

Define the conditional error rate

$$e_n := \Pr(\text{wrong bit}\mid n,\text{ accepted detection}).$$

For intensity $k$, the experimentally accessible gain and error gain are

$$Q_k := \Pr(\text{accepted detection}\mid k), \qquad T_k := E_kQ_k,$$

where $E_k$ is the observed QBER among detected rounds of that intensity. In the stationary asymptotic model, the Poisson mixture and conditional-indistinguishability assumption give

$$Q_k = \sum_{n=0}^{\infty}p_n(k)Y_n, \qquad T_k = \sum_{n=0}^{\infty}p_n(k)Y_ne_n.$$

It is useful to remove the common Poisson factor:

$$S_k:=e^kQ_k = \sum_{n=0}^{\infty}\frac{k^n}{n!}Y_n,$$ $$R_k:=e^kT_k = \sum_{n=0}^{\infty}\frac{k^n}{n!}Y_ne_n.$$

These are exponential generating functions for the yields and error yields. With an ideal continuum of exactly known intensities near zero,

$$Y_n = \left.\frac{d^nS_k}{dk^n}\right|_{k=0}, \qquad Y_ne_n = \left.\frac{d^nR_k}{dk^n}\right|_{k=0}.$$

This infinite-decoy limit gives the clean intuition. A practical experiment uses only a few intensities and finite counts, so it obtains bounds rather than an exact inversion.

The same definitions are applied separately by basis in a modern proof. For example, $Y_{n,Z}$ and the number of detected single-photon $Z$-basis signals enter the key length, while $X$-basis data help bound the corresponding phase error. Writing one basis-independent $Y_n$ is an expository simplification, not permission to average incompatible data sets.

Vacuum-Plus-Weak Bounds

The three settings $0<\nu<\mu$ already give a useful analytic estimate. For a true vacuum decoy,

$$Y_0=Q_0.$$

If Alice’s vacuum-round bit is uniform, private and independent of the detector output and acceptance, then $e_0=1/2$. Bob’s background output need not itself be unbiased: comparing any independent bit with Alice’s uniform bit gives disagreement one-half. Bit leakage or bit-dependent acceptance can invalidate this argument. Vacuum data estimate the background yield and error gain under the actual assignment rules.

Lower bound on the one-photon yield

Expand the weak and signal gains:

$$S_\nu = Y_0+\nu Y_1 +\sum_{n=2}^{\infty}\frac{\nu^n}{n!}Y_n,$$ $$S_\mu = Y_0+\mu Y_1 +\sum_{n=2}^{\infty}\frac{\mu^n}{n!}Y_n.$$

Form the combination

$$\begin{aligned} D &:=S_\nu-\frac{\nu^2}{\mu^2}S_\mu\\ &= \left(1-\frac{\nu^2}{\mu^2}\right)Y_0 +\nu\left(1-\frac{\nu}{\mu}\right)Y_1 + \sum_{n=2}^{\infty} \frac{\nu^2}{n!} \left(\nu^{n-2}-\mu^{n-2}\right)Y_n. \end{aligned}$$

Because $0<\nu<\mu$ and $Y_n\ge0$, every term in the last line is nonpositive. The $n=2$ coefficient vanishes, and the coefficients for $n>2$ are negative. Therefore

$$D \le \left(1-\frac{\nu^2}{\mu^2}\right)Y_0 +\nu\left(1-\frac{\nu}{\mu}\right)Y_1.$$

Solving for $Y_1$ gives the vacuum-plus-weak lower bound of Ma et al. (2005)

$$Y_1^{\mathrm L} = \frac{\mu}{\mu\nu-\nu^2} \left[ Q_\nu e^\nu -\frac{\nu^2}{\mu^2}Q_\mu e^\mu -\frac{\mu^2-\nu^2}{\mu^2}Y_0 \right].$$

A negative right-hand side may be replaced by zero, using $Y_1\ge0$. In contrast, a lower bound above one signals inconsistent data or assumptions; replacing it by one does not repair the inference. Exercise 3 gives a simple example. Below, $Y_1^{\mathrm L}$ denotes the nonnegative bound from a consistent model.

With valid simultaneous confidence intervals for this model, the adverse substitutions use a lower bound for $Q_\nu$ and upper bounds for $Q_\mu$ and $Y_0$. Point estimates are not exact probabilities, and a finite-key proof must justify both those intervals and their conversion to photon-number counts.

The single-photon contribution to signal-intensity detections is then bounded by

$$Q_1^{\mathrm L} = p_1(\mu)Y_1^{\mathrm L} = \mu e^{-\mu}Y_1^{\mathrm L}.$$

Upper bound on the one-photon error rate

All error-yield terms are nonnegative, so the weak-decoy error gain satisfies

$$R_\nu = e_0Y_0+\nu e_1Y_1 +\sum_{n=2}^{\infty} \frac{\nu^n}{n!}Y_ne_n \ge e_0Y_0+\nu e_1Y_1.$$

Consequently,

$$e_1^{\mathrm U} = \frac{E_\nu Q_\nu e^\nu-e_0Y_0} {\nu Y_1^{\mathrm L}}.$$

This requires $Y_1^{\mathrm L}>0$. If it is zero, the data have not certified a positive one-photon contribution, and division by zero supplies no error estimate. In a consistent exact-probability model the numerator is nonnegative. A negative value is another consistency failure; with finite data, one must use a jointly valid confidence region rather than independently repair unfavorable estimates.

The numerator is made large and the denominator small for a conservative bound: use an upper bound on the weak-decoy error gain and a lower bound on the background error yield. An error probability can be capped at one. Capping its upper bound at one-half is different and generally invalid. If all that is known is $0\le e_1\le u$, then the worst binary entropy is

$$\max_{0\le e\le\min(u,1)}h_2(e)=h_2\!\left(\min\{u,1/2\}\right).$$

For $u\ge1/2$, the allowed interval includes the maximally uncertain value $e=1/2$, so this entropy bound leaves no positive one-photon privacy term. It does not imply that the actual error is at most one-half.

With more intensities, numerical optimization can improve the bounds. Writing $t_n=Y_ne_n$ makes the gain constraints linear in $Y_n,t_n$. Minimizing $Y_1$ and maximizing $t_1$ separately gives a conservative ratio $t_1^{\mathrm U}/Y_1^{\mathrm L}$ when the denominator is positive. Optimizing the ratio itself is a linear-fractional problem, not simply a linear objective.

Worked Channel Example

Take an illustrative threshold-detector model with overall one-photon transmission-and-detection efficiency $\eta$, background yield $Y_0$, background error probability $e_0=1/2$, and optical misalignment error $e_d$. A simple low-background model is

$$Q_k = 1-(1-Y_0)e^{-\eta k},$$ $$T_k \simeq e_0Y_0+e_d\left(1-e^{-\eta k}\right).$$

The second expression neglects the small overlap between a background event and a signal-origin event; it is a calculation model, not a detector security proof. Choose

$$\mu=0.5, \qquad \nu=0.1, \qquad \eta=0.02, \qquad Y_0=10^{-6}, \qquad e_d=0.015.$$

The predicted signal and decoy observations are

$$\begin{aligned} Q_\mu&=9.95116\times10^{-3}, &E_\mu&=1.50488\times10^{-2},\\ Q_\nu&=1.99900\times10^{-3}, &E_\nu&=1.52426\times10^{-2}. \end{aligned}$$

Substitution in the analytic bounds gives

$$Y_1^{\mathrm L}=1.94001\times10^{-2}, \qquad e_1^{\mathrm U}=1.71002\times10^{-2},$$

and hence

$$Q_1^{\mathrm L} = \mu e^{-\mu}Y_1^{\mathrm L} = 5.88338\times10^{-3}.$$

For comparison, the channel model’s actual one-photon yield is

$$Y_1 = 1-(1-Y_0)(1-\eta) = 2.00010\times10^{-2}.$$

The bound is lower, as it must be, but remains close enough to certify a substantial single-photon contribution. Without intensity variation, the same overall signal gain would not determine that contribution.

From a Yield Bound to a Key Rate

In BB84 the privacy term uses a one-photon phase-error bound. Conjugate-basis decoy data can supply it under the source and sampling assumptions of the security proof. An aggregate signal QBER cannot be substituted for it. In the symmetric example here, the bound $e_1^{\mathrm U}$ also bounds the phase error; write $\bar e_1=\min\{e_1^{\mathrm U},1/2\}$ for the entropy maximizer just discussed.

The asymptotic tagged-signal treatment counts multiphoton detections as fully compromised. Omitting any possible positive vacuum contribution gives the achievable rate bound (Lo, Ma and Chen, 2005; Ma et al., 2005)

$$R\ge q\max\!\left\{0,-Q_\mu f_{\mathrm{EC}}h_2(E_\mu) +Q_1^{\mathrm L}[1-h_2(\bar e_1)]\right\},$$

where

$$h_2(x) = -x\log_2x-(1-x)\log_2(1-x)$$

is the binary entropy, $f_{\mathrm{EC}}\ge1$ describes reconciliation inefficiency, and $q$ is a declared signal-and-basis selection prefactor. In the traditional symmetric BB84 convention with an asymptotically negligible decoy fraction, $q=1/2$. If signal intensity is chosen with probability $p_\mu$ and only $Z$-$Z$ rounds make key, then a rate per emitted pulse instead contains the corresponding factor $q=p_\mu p_Z^{A}p_Z^{B}$.

For the numerical example, taking $f_{\mathrm{EC}}=1.16$ gives the bracketed quantity

$$-Q_\mu f_{\mathrm{EC}}h_2(E_\mu) +Q_1^{\mathrm L} \left(1-h_2(e_1^{\mathrm U})\right) = 3.84852\times10^{-3}.$$

Thus the conventional $q=1/2$ example yields approximately $1.92\times10^{-3}$ secret bits per emitted pulse before finite-key, authentication, and other implementation overheads. A positive asymptotic number is not a claim about a finite device run.

Finite-Key Estimation

A real block supplies counts, not exact probabilities. For each intensity and basis class $(k,b)$, let $N_{k,b}$ count the pulses sent, $n_{k,b}$ count accepted detections, and $m_{k,b}$ count wrong detected bits.

The observed ratios are

$$\widehat Q_{k,b} = \frac{n_{k,b}}{N_{k,b}}, \qquad \widehat T_{k,b} = \frac{m_{k,b}}{N_{k,b}}.$$

Finite-key analysis needs simultaneous bounds with a stated joint failure probability. For a stationary shared-yield model, confidence intervals on the expected gains lead to constraints such as

$$\underline Q_{k,b}\le\sum_{n=0}^\infty p_n(k)Y_{n,b}\le\overline Q_{k,b}, \qquad \underline T_{k,b}\le\sum_{n=0}^\infty p_n(k)t_{n,b}\le\overline T_{k,b}.$$

These constraints illustrate the optimization. Under general correlated attacks, empirical yields from distinct samples need not coincide exactly. A security proof must justify the appropriate statistical comparison and convert it into bounds on actual one-photon counts and phase errors. Applying binomial intervals to observed gains and solving this stationary model is not by itself such a proof.

Subject to $0\le Y_{n,b}\le1$ and $0\le Y_{n,b}e_{n,b}\le Y_{n,b}$, one can bound the single-photon yield and error yield as above. A numerical linear program truncates the photon number at $n_{\max}$ and accounts for the known Poisson tail

$$\tau_k(n_{\max}) = 1- \sum_{n=0}^{n_{\max}}e^{-k}\frac{k^n}{n!}.$$

Since $0\le Y_n\le1$, the omitted gain is between zero and $\tau_k$. Thus a conservative truncated constraint is

$$\underline Q_{k,b}-\tau_k\le\sum_{n=0}^{n_{\max}}p_n(k)Y_{n,b}\le\overline Q_{k,b}.$$

Error tails also lie between zero and the corresponding gain tails. Retaining their joint constraints can tighten the result. Setting the tail to zero without a bound can exclude physically allowed explanations of the data.

A conservative finite-key expression, omitting a possible positive vacuum term, has the structure

$$\ell \le s_{Z,1}^{\mathrm L} \left[1-h_2(\min\{\phi_Z^{\mathrm U},1/2\})\right] -\lambda_{\mathrm{EC}} -\Delta_{\mathrm{sec}},$$

where $s_{Z,1}^{\mathrm L}$ bounds detected one-photon key-basis events, $\phi_Z^{\mathrm U}$ bounds their phase-error rate, $\lambda_{\mathrm{EC}}$ is the actual reconciliation leakage, and $\Delta_{\mathrm{sec}}$ represents the proof’s verification and hashing length deductions. Statistical failures and smoothing parameters also enter the total correctness and secrecy error; they are not universally interchangeable fixed bit penalties. Lim et al. (2014) give a composable construction against general attacks with explicit constants, statistical bounds and a vacuum contribution, under specified source and receiver assumptions including basis-independent detection probability. The QKD overview explains the underlying entropy-to-key step.

Why more decoys can still mean less key

Additional intensity settings add constraints, but finite samples must be divided among more classes. A very weak decoy is informative about $Y_1$ only if it produces enough detections to control fluctuations. A vacuum setting measures background directly but produces few useful events by design. The signal intensity, decoy intensities, basis biases, and selection probabilities therefore need joint optimization for the expected channel, block duration, detector behavior, and security target.

Rules of thumb such as $\mu\approx0.5$ and $\nu\approx0.1$ are useful starting points for some fiber links, not protocol constants. At long distance, the best allocation may devote a substantial fraction of pulses to parameter estimation. In a changing channel, an optimization based on a favorable past block can also bias the analysis unless adaptation is specified in advance or covered by the proof.

Source assumptions and finite data

Phase randomization

The Poisson mixture follows from averaging a uniformly random global phase. Attenuation alone does not perform that average. Gain-switching a laser may produce substantial phase randomization under characterized operating conditions, but it is not a mathematical guarantee for every pulse. Residual phase coherence can let Eve distinguish or coherently combine states in ways excluded by the photon-number-channel model. A transmitter should actively randomize or otherwise validate the phase model used by its proof.

Lo and Preskill (2007) analyze security with nonrandom phases under their specified source assumptions. The state decomposition and proof differ from the phase-randomized case. The standard decoy equations must not be imported unchanged.

Intensity calibration and fluctuations

The symbols $\mu$ and $\nu$ represent physical photon-number distributions, not merely digital control values. Modulator calibration, laser power drift, finite extinction, pulse-shape changes, and monitor uncertainty produce intervals or correlations in the actual intensities. A sound analysis either bounds the emitted distribution pulse by pulse or uses a security proof that explicitly tolerates the characterized fluctuation model.

Replacing an uncertain $k$ by its nominal value can move Poisson weights in the favorable direction and overestimate $Y_1$. The conservative endpoint is not always the same for every coefficient, so blindly inserting one worst intensity into every term is not generally valid.

No intensity side channel at fixed photon number

Signal and decoy pulses can differ in spectrum, timing, chirp, spatial mode, polarization, pulse duration, or back-reflected light. If Eve can infer the intensity class before acting on the pulse, the correct variables are $Y_{n,k}$ rather than shared $Y_n$. The standard system then loses its cross-intensity constraint.

This issue is especially important when separate lasers generate signal and decoy pulses. A single laser followed by a characterized intensity modulator can reduce some differences, but the modulator itself can introduce chirp or pattern dependence. Optical isolation, filtering, watchdog monitoring, and Trojan-horse bounds address parts of the engineering problem; their residual assumptions still belong in the security statement.

Correlations and detector behavior

Dead time, afterpulsing, modulator memory, feedback control, and thermal drift can correlate neighboring rounds. A proof based on independent and identically distributed trials is not automatically valid for such a source or receiver. Modern analyses may use martingale, entropy-accumulation, or explicit source-memory methods, but the observed data must match the chosen model.

Decoy states do not remove detector side channels. Detector blinding, efficiency mismatch, time-shift attacks, and mode-dependent acceptance remain receiver-model questions. Measurement-Device-Independent QKD combines two-source decoy estimation with an untrusted measurement station to move that particular trust boundary; it still relies on source characterization and decoy-state assumptions.

A signal plus one nonzero decoy removes the dedicated vacuum setting, but then the background contribution must be bounded indirectly. Rusca et al. (2018) analyze such a one-decoy protocol in finite blocks. The vacuum-plus-weak formulas cannot simply be reused with an unknown $Y_0$. More elaborate basis-dependent or passive choices likewise require the corresponding conditional source model and statistical analysis.

Exercises

1. Phase averaging

Starting from the coherent-state expansion, prove that uniform phase randomization produces a diagonal Poisson mixture.

Solution

Expand the projector:

$$|\alpha\rangle\langle\alpha| = e^{-k} \sum_{n,m=0}^{\infty} \frac{k^{(n+m)/2}e^{i(n-m)\phi}} {\sqrt{n!m!}}|n\rangle\langle m|.$$

Uniform averaging uses

$$\int_0^{2\pi}\frac{d\phi}{2\pi} e^{i(n-m)\phi} = \delta_{nm}.$$

Only $n=m$ remains, giving

$$\rho_k = \sum_{n=0}^{\infty} e^{-k}\frac{k^n}{n!}|n\rangle\langle n|.$$

2. Multiphoton probability

Show that $p_{\ge2}(k)=1-e^{-k}(1+k)$. Find its leading behavior for $k\ll1$ and evaluate it at $k=0.5$.

Solution

Subtract the vacuum and one-photon probabilities from unity:

$$p_{\ge2}(k) = 1-p_0(k)-p_1(k) = 1-e^{-k}(1+k).$$

Using $e^{-k}=1-k+k^2/2+O(k^3)$ gives

$$p_{\ge2}(k) = \frac{k^2}{2}+O(k^3).$$

At $k=0.5$,

$$p_{\ge2}(0.5) = 1-1.5e^{-0.5} \approx 0.0902.$$

Thus roughly nine percent of emitted signal pulses are multiphoton in this source model, even though loss makes the detected fraction quite different.

3. An impossible yield estimate

Suppose exact gains are reported as $Q_\mu=0$, $Q_\nu=0.1$, and $Y_0=0$ for $\mu=0.5$, $\nu=0.1$. Evaluate the analytic lower bound. Can clipping it to one give a valid estimate?

Solution

The formula gives

$$Y_1^{\mathrm L}=\frac{0.5}{0.04}(0.1e^{0.1})\approx1.3815.$$

This contradicts $Y_1\le1$. More directly, every Poisson weight at $\mu>0$ is positive. Since all yields are nonnegative, $Q_\mu=0$ forces every $Y_n=0$, which also forces $Q_\nu=0$. There is no shared-yield model for the stated exact data. Clipping the answer would conceal that inconsistency. Finite counts instead require a justified confidence region, which may contain consistent probabilities even when their point estimates do not.

4. Derive the error bound

Starting from $R_\nu$, derive an upper bound on $e_1$ when $Y_1^{\mathrm L}>0$. Explain why replacing $Y_1$ by a lower bound is conservative. If the resulting upper bound is $0.7$, what entropy bound may be used?

Solution

Nonnegative multiphoton error yields imply

$$R_\nu \ge e_0Y_0+\nu e_1Y_1.$$

Therefore

$$e_1 \le \frac{R_\nu-e_0Y_0}{\nu Y_1} = \frac{E_\nu Q_\nu e^\nu-e_0Y_0}{\nu Y_1}.$$

For a nonnegative numerator and positive denominator, decreasing the denominator increases the ratio. Thus $Y_1^{\mathrm L}\le Y_1$ preserves the upper bound. A finite analysis uses simultaneous adverse bounds on all quantities.

If the result is $e_1\le0.7$, the allowed interval contains $e_1=1/2$, where $h_2=1$. Hence the safe entropy bound is one, not $h_2(0.7)\approx0.8813$. The latter would overstate the private fraction. Nor may one conclude that the actual error is at most one-half.

5. Reproduce the channel estimate

Use the worked-example parameters to calculate $Y_1^{\mathrm L}$, $e_1^{\mathrm U}$, and $Q_1^{\mathrm L}$. Compare the yield bound with the model value $1-(1-Y_0)(1-\eta)$.

Solution

The gains and error rates are

$$\begin{aligned} Q_{0.5}&=0.0099512, &E_{0.5}&=0.015049,\\ Q_{0.1}&=0.0019990, &E_{0.1}&=0.015243. \end{aligned}$$

Substitution gives

$$Y_1^{\mathrm L}=0.019400, \qquad e_1^{\mathrm U}=0.017100,$$

and

$$Q_1^{\mathrm L} = 0.5e^{-0.5}Y_1^{\mathrm L} = 0.0058834.$$

The model value is $Y_1=0.02000098$, so the analytic lower bound is about $97.0\%$ of the actual value in this asymptotic calculation without sampling fluctuations.

6. Infinite-decoy reconstruction

Suppose $Q_k$ is known exactly for all $k$ in a neighborhood of zero. Show how to reconstruct $Y_0$, $Y_1$, and $Y_2$.

Solution

Define $S_k=e^kQ_k$. Its series is

$$S_k = Y_0+kY_1+\frac{k^2}{2}Y_2+\cdots.$$

Hence

$$Y_0=S_0, \qquad Y_1=S'_0, \qquad Y_2=S''_0.$$

In general $Y_n=S^{(n)}_0$. Exact differentiation is only an intuition for the infinite-data, continuous-intensity limit; numerical differentiation of noisy experimental gains would be unstable.

7. A distinguishable-decoy failure

Suppose weak-decoy pulses are delayed by $200\ \mathrm{ps}$ relative to signal pulses, and Eve can resolve that delay before deciding whether to forward a pulse. Identify the failed equation and explain what source information or analysis is needed.

Solution

At fixed photon number, Eve can infer the class from arrival time. The shared yield model fails: one must allow

$$Y_{n,\nu}\ne Y_{n,\mu}, \qquad e_{n,\nu}\ne e_{n,\mu}.$$

Then comparing $Q_\nu$ and $Q_\mu$ no longer constrains one common $Y_1$. Alice needs source characterization showing that the delay is absent or bounded strongly enough for a proof with distinguishable states, or she needs a protocol and security analysis that explicitly includes the leaked timing information. Relabeling the pulses does not repair the model.

8. Finite-key resource allocation

Alice can reduce the weak-decoy probability to send more signal pulses. Give one benefit and two costs of doing so in a fixed-duration experiment.

Solution

The benefit is a larger expected number of signal-and-key-basis detections, which can increase the raw material for the final key. The costs are fewer weak-decoy detections and therefore wider confidence intervals for $Y_1$ and $e_1$. A looser lower bound on $s_{Z,1}$ or a looser upper bound on the phase error can erase the gain or force abort. The best probability is therefore a finite-block optimization, not “as few decoys as possible.” Channel drift can add a third cost if the smaller sample no longer diagnoses nonstationarity.

References

• D. Gottesman, H.-K. Lo, N. Lütkenhaus, and J. Preskill, “Security of Quantum Key Distribution with Imperfect Devices,” Quantum Information and Computation 4, 325–360 (2004), doi:10.26421/QIC4.5-1.
• W.-Y. Hwang, “Quantum Key Distribution with High Loss: Toward Global Secure Communication,” Physical Review Letters 91, 057901 (2003), doi:10.1103/PhysRevLett.91.057901.
• C. C. W. Lim, M. Curty, N. Walenta, F. Xu, and H. Zbinden, “Concise Security Bounds for Practical Decoy-State Quantum Key Distribution,” Physical Review A 89, 022307 (2014), doi:10.1103/PhysRevA.89.022307.
• H.-K. Lo, X. Ma, and K. Chen, “Decoy State Quantum Key Distribution,” Physical Review Letters 94, 230504 (2005), doi:10.1103/PhysRevLett.94.230504.
• H.-K. Lo and J. Preskill, “Security of Quantum Key Distribution Using Weak Coherent States with Nonrandom Phases,” Quantum Information and Computation 7, 431–458 (2007), doi:10.26421/QIC7.5-6-2.
• X. Ma, B. Qi, Y. Zhao, and H.-K. Lo, “Practical Decoy State for Quantum Key Distribution,” Physical Review A 72, 012326 (2005), doi:10.1103/PhysRevA.72.012326.
• D. Rusca, A. Boaron, F. Grünenfelder, A. Martin, and H. Zbinden, “Finite-Key Analysis for the 1-Decoy State QKD Protocol,” Applied Physics Letters 112, 171104 (2018), doi:10.1063/1.5023340.
• X.-B. Wang, “Beating the Photon-Number-Splitting Attack in Practical Quantum Cryptography,” Physical Review Letters 94, 230503 (2005), doi:10.1103/PhysRevLett.94.230503.