Measurement-Device-Independent QKD

Measurement-device-independent quantum key distribution (MDI-QKD) is a QKD architecture in which Alice and Bob prepare quantum states and send them to an untrusted intermediate station that performs a joint measurement. The station, conventionally called Charles, publicly reports a Bell-state measurement outcome or failure. Alice and Bob use the successful reports, their private preparation choices, and authenticated classical postprocessing to distill a key.

The defining security move is to place the entire measurement station inside Eve’s domain. Its optics, detectors, timing logic, efficiency, dark counts, and classical outcome generator need not follow a trusted device model. A malicious station may suppress events, fabricate labels, or coordinate with the quantum channels. It may force an abort, but accepted data must still obey the security proof’s statistical tests before yielding a key.

The protocol of Lo, Curty and Qi (2012) removes the need to trust the relay’s measurement apparatus. It still relies on characterized sources, private random choices and isolated laboratories. This page treats discrete-variable BB84 encoding with phase-randomized weak coherent pulses and explains the two-source decoy estimate that supplies its private key fraction.

Required background. QKD defines correctness, secrecy and classical processing; BB84 explains bit and phase errors. Decoy-state QKD develops photon-number yields, and entanglement swapping derives the virtual Bell projection.

An untrusted joint measurement

In standard prepare-and-measure BB84, the quantum channel terminates at Bob’s receiver. A security proof therefore needs a model of his basis selector, detection efficiencies, time gates, double-click rules, dead time, and all optical modes that influence acceptance. Real single-photon detectors have supported attacks based on efficiency mismatch, timing, wavelength response, bright-light control, afterpulsing, and other behavior absent from simplified POVM models.

MDI-QKD changes the interface rather than attempting to enumerate every detector imperfection. Both legitimate users become transmitters. Everything that receives their quantum signals is placed outside their trusted laboratories and may be operated by Eve. The security proof is conditioned on the relay’s public classical report, whatever physical process produced it.

This removes detector behavior from the trusted secrecy boundary, but not from performance. Poor detectors lower the successful-event rate and raise the observed error rate. Eve can always deny service by reporting failure. The proof bounds the secrecy and correctness error of the complete accept-or-abort protocol, including malicious detector behavior. Passing a finite statistical test is not a claim of zero failure probability.

The MDI-QKD trust boundary. State preparation and private random choices stay inside Alice’s and Bob’s laboratories. Both quantum channels, the Bell analyzer, detectors, and outcome electronics are adversarial. The relay’s outcome must be fixed before basis and intensity disclosure; authenticated postprocessing then either produces a shared key or aborts.

Preparation, announcement and key processing

Consider a polarization or time-bin BB84 implementation with phase-randomized weak coherent pulses. A precise finite protocol fixes all probabilities, acceptance windows, and abort rules in advance. One round has the following structure.

1. Alice chooses a bit $x_A$, basis $w_A\in\{Z,X\}$, and intensity $a$.
2. Bob independently chooses $x_B$, $w_B$, and intensity $b$.
3. Each prepares the corresponding optical BB84 state, randomizes its global phase according to the source model, and sends it toward Charles.
4. Charles announces an outcome $z\in\{\Psi^-,\Psi^+,\varnothing\}$, where $\varnothing$ denotes failure. The supported Bell labels depend on the analyzer.
5. Only after the outcome record is fixed do Alice and Bob disclose the basis and intensity labels over authenticated classical communication.
6. They retain declared successful classes, apply a Bell-label-dependent bit correction, and separate key-generating data from parameter-estimation data.
7. Two-source decoy analysis bounds single-photon-pair detections and their phase errors. Alice and Bob then reconcile, verify, and privacy-amplify.

The relay does not need an identity that Alice and Bob trust. In a network it may be a service provider, an intermediate user, or Eve herself. Alice and Bob do need a consistent authenticated transcript. If Charles sends different outcome lists to the two endpoints, transcript comparison or authentication must expose the inconsistency before key acceptance.

The time ordering matters. If basis, bit, or intensity information reaches the relay before its successful-event record is committed, the relay can postselect with knowledge that the proof treats as unavailable. Physical and software implementations therefore need a defined event boundary, not merely a diagram with arrows in the desired order.

Bell Projection and Time Reversal

Virtual entanglement-based description

The security intuition comes from a source-replacement construction. Imagine that Alice prepares $|\Phi^+\rangle_{AA'}$ and Bob prepares $|\Phi^+\rangle_{B'B}$. They retain $A$ and $B$ while sending $A'$ and $B'$ to Charles. Using the Bell states defined below, the swapping identity is

$$|\Phi^+\rangle_{AA'}|\Phi^+\rangle_{B'B} =\frac12\sum_{\beta\in\{\Phi^+,\Phi^-,\Psi^+,\Psi^-\}} |\beta\rangle_{AB}|\beta\rangle_{A'B'}.$$

An ideal Bell projection on $A'B'$ therefore projects the retained systems $AB$ into the corresponding Bell state. Alice and Bob could then measure $A$ and $B$ to obtain correlated bits. Because their local measurements commute with Charles’s remote operation, they may instead measure first. That early measurement remotely prepares the BB84 states sent in the actual prepare-and-measure implementation.

For this reason MDI-QKD is often called time-reversed entanglement-based QKD. No macroscopic reversal of time occurs. The phrase refers to exchanging the operational order of local state preparation and the middle Bell projection in an equivalent virtual protocol. The local measurement outcomes must reproduce the actual preparation probabilities and conditional states. For the ideal real $Z$ and $X$ BB84 states, uniform local outcomes do so directly.

Why an untrusted projection can still help

If Charles performs the advertised Bell measurement honestly, the virtual picture is literal. Security does not assume that honesty. A general attack replaces the Bell analyzer by an arbitrary quantum instrument controlled by Eve, with an arbitrary public output $z$. Alice and Bob condition on $z$ and test the resulting correlations.

This is analogous to treating the quantum channel as adversarial in ordinary QKD, but the adversarial map now includes measurement and detection. The proof does not infer that Charles created entanglement merely because he said “$\Psi^-$.” It bounds Eve’s information from the complete observed data and the trusted source states. Dishonest outcome labels either reproduce statistics compatible with a secure conditional state or reduce the certified key length.

Bell Labels and Bit Correction

Use

$$|\Psi^\pm\rangle = \frac{|01\rangle\pm|10\rangle}{\sqrt2}, \qquad |\Phi^\pm\rangle = \frac{|00\rangle\pm|11\rangle}{\sqrt2}.$$

Many linear-optical analyzers report one or both $\Psi$ outcomes. The following product-state decompositions make the classical correction rule transparent:

$$|0\rangle|1\rangle = \frac{|\Psi^+\rangle+|\Psi^-\rangle}{\sqrt2}, \qquad |1\rangle|0\rangle = \frac{|\Psi^+\rangle-|\Psi^-\rangle}{\sqrt2},$$ $$|+\rangle|+\rangle = \frac{|\Phi^+\rangle+|\Psi^+\rangle}{\sqrt2}, \qquad |+\rangle|-\rangle = \frac{|\Phi^-\rangle-|\Psi^-\rangle}{\sqrt2}.$$

With bit $0$ encoded as $|0\rangle$ or $|+\rangle$ and bit $1$ as $|1\rangle$ or $|-\rangle$, Bob can use this correction table:

Basis	Outcome	Ideal bits	Bob
$Z$	$\Psi^-$	opposite bits	flip
$Z$	$\Psi^+$	opposite bits	flip
$X$	$\Psi^-$	opposite bits	flip
$X$	$\Psi^+$	equal bits	no flip

The table depends on Bell-state phases, bit encoding, detector labeling, and which party corrects. A real protocol must publish one convention and test it against known state pairs. Some implementations accept only $\Psi^-$, which simplifies the rule at the cost of fewer successful outcomes.

After correction, an error is a disagreement between Alice’s bit and Bob’s corrected bit. Mismatched-basis events are normally discarded rather than forced into this table.

Two-Source Decoy Estimation

Practical MDI-QKD usually combines the untrusted measurement with decoy-state sources. If $\rho_{x_A,w_A}^{(n)}$ is Alice’s encoded $n$-photon state, then her phase-randomized pulse of intensity $a$ is

$$\rho_{a,x_A,w_A} = \sum_{n=0}^{\infty} p_n(a)\rho_{x_A,w_A}^{(n)}.$$

Alice’s pulse and Bob’s independently randomized pulse of intensity $b$ have the joint decomposition

$$\rho_{a,x_A,w_A}\otimes\rho_{b,x_B,w_B} = \sum_{n,m=0}^{\infty} p_n(a)p_m(b) \rho_{x_A,w_A}^{(n)}\otimes\rho_{x_B,w_B}^{(m)},$$

where

$$p_n(a)=e^{-a}\frac{a^n}{n!}, \qquad p_m(b)=e^{-b}\frac{b^m}{m!}.$$

For basis $w$, define the pair yield

$$Y_{nm}^{w} := \Pr(\text{accepted Bell report}\mid n,m,w),$$

and the corrected error rate

$$e_{nm}^{w} := \Pr(\text{bit error}\mid n,m,w,\text{accepted}).$$

In the asymptotic shared-yield model, the gain and error gain for intensity pair $(a,b)$ are

$$Q_{ab}^{w} = \sum_{n,m=0}^{\infty} p_n(a)p_m(b)Y_{nm}^{w},$$ $$T_{ab}^{w} := E_{ab}^{w}Q_{ab}^{w} = \sum_{n,m=0}^{\infty} p_n(a)p_m(b)Y_{nm}^{w}e_{nm}^{w}.$$

The security-relevant sector has one photon from Alice and one from Bob:

$$(n,m)=(1,1).$$

For signal intensities $s_A$ and $s_B$, its gain is

$$Q_{11}^{w} = s_Ae^{-s_A}s_Be^{-s_B}Y_{11}^{w}.$$

The shared-yield assumption now applies independently to both transmitters. Given $n$ and Alice’s encoded state, her signal and decoy pulses must be indistinguishable in every unmodeled degree of freedom; the analogous statement holds for Bob. Otherwise the correct unknown is $Y_{nm,ab}^{w}$, and cross-intensity constraints can fail.

A two-dimensional inverse problem

Removing the Poisson factors gives

$$S_{ab}^{w} := e^{a+b}Q_{ab}^{w} = \sum_{n,m=0}^{\infty} \frac{a^n}{n!}\frac{b^m}{m!}Y_{nm}^{w}.$$

In an ideal continuum-intensity limit,

$$Y_{nm}^{w} = \left. \frac{\partial^{n+m}S_{ab}^{w}} {\partial a^n\partial b^m} \right|_{a=b=0}.$$

Finite protocols use a few intensity pairs and statistical intervals. They minimize $Y_{11}^{w}$ and maximize the relevant $e_{11}^{w}$ subject to all gain and error-gain constraints, physical bounds, intensity calibration, and Poisson tails. This is the two-source extension of the estimator derived in Decoy-State QKD, not two unrelated one-dimensional fits.

Vacuum settings are especially useful because $(0,b)$ and $(a,0)$ data separate background and one-sided emissions from true two-sided interference. Efficient designs may use different signal and decoy intensities in the two bases, but the resulting basis-intensity table must be kept intact in the proof.

From one-photon pairs to a key rate

For ideal BB84 states with uniform private bits, the averaged one-photon state from either sender is $I/2$ in either basis. The two-source average is therefore $I_4/4$. An arbitrary relay effect $M_z$ has

$$Y_{11}^{Z,z}=Y_{11}^{X,z}=\frac14\operatorname{Tr}M_z.$$

This equality concerns single-photon yields, even for a dishonest relay; it does not make the bit errors in the two bases equal. Source flaws or setting leakage can break the common-state argument. Exercise 1 derives the identity.

The virtual protocol connects the measured one-photon $X$-basis bit error to the $Z$-key phase error under these characterized-state assumptions. Write $u=e_{11}^{X,\mathrm U}$ for a valid upper bound and $\bar e=\min\{u,1/2\}$ for its worst-entropy argument, as explained on the decoy-state page. An asymptotic achievable rate per emitted pulse pair is

$$R\ge q\max\!\left\{0, Q_{11}^{Z,\mathrm L}[1-h_2(\bar e)] -Q_{s_As_B}^{Z}f_{\mathrm{EC}}h_2(E_{s_As_B}^{Z})\right\}.$$

Here $Q_{11}^{Z,\mathrm L}$ bounds accepted signal pairs with one photon on each side; reconciliation acts on all accepted signal-pair bits. The binary entropy is $h_2(x)=-x\log_2x-(1-x)\log_2(1-x)$. With independent choices at the two endpoints,

$$q=\Pr_A(s_A,Z)\Pr_B(s_B,Z).$$

Only when each sender also chooses intensity independently of basis does this become $p_{s_A}p_{s_B}p_Z^Ap_Z^B$. Basis-dependent intensity designs must use their actual joint probabilities.

All gains and error rates must use the same accepted Bell-label classes and correction conventions. A protocol may instead prove and sum separate contributions for each label. Neither form permits substituting the aggregate optical QBER for a one-photon phase-error bound.

A numerical rate check

Suppose an analysis reports

$$Q_{11}^{Z,\mathrm L}=2.30\times10^{-4}, \qquad e_{11}^{X,\mathrm U}=0.015,$$ $$Q_{s_As_B}^{Z}=3.00\times10^{-4}, \qquad E_{s_As_B}^{Z}=0.020, \qquad f_{\mathrm{EC}}=1.16.$$

The quantity inside braces is

$$Q_{11}^{Z,\mathrm L} \left[1-h_2(e_{11}^{X,\mathrm U})\right] -Q_{s_As_B}^{Z}f_{\mathrm{EC}}h_2(E_{s_As_B}^{Z}) = 1.54936\times10^{-4}.$$

If $q=1/4$, then $R\ge3.87339\times10^{-5}$ secret bits per emitted pulse pair in this asymptotic calculation. The quoted gains already include which Bell outcomes were retained. Finite-key deductions, authentication and actual trial timing must still be included when assessing an experimental run.

Finite-Key Form

For each chosen basis and intensity pair, let $N_{ab}^{w}$ be the total number of emitted trials, including all relay outcomes and failures. For each accepted label $z$, record $n_{ab}^{w,z}$ detections and $m_{ab}^{w,z}$ corrected disagreements. Then

$$\widehat Q_{ab}^{w,z}=\frac{n_{ab}^{w,z}}{N_{ab}^{w}}, \qquad \widehat T_{ab}^{w,z}=\frac{m_{ab}^{w,z}}{N_{ab}^{w}}.$$

The denominator does not depend on the future outcome $z$. For example, if $10^6$ input-class trials produce $120$ reports of $\Psi^-$ and $80$ reports of $\Psi^+$, their gains are $1.2\times10^{-4}$ and $8\times10^{-5}$; the total accepted gain is $2\times10^{-4}$. Dividing by the $200$ successful trials would instead give conditional label fractions $0.6$ and $0.4$, losing the rate information.

For a stationary shared-yield model, simultaneous confidence regions give constraints such as

$$\underline Q_{ab}^{w,z} \le \sum_{n,m}p_n(a)p_m(b)Y_{nm}^{w,z} \le \overline Q_{ab}^{w,z},$$ $$\underline T_{ab}^{w,z} \le \sum_{n,m}p_n(a)p_m(b)Y_{nm}^{w,z}e_{nm}^{w,z} \le \overline T_{ab}^{w,z}.$$

Writing $t_{nm}^{w,z}=Y_{nm}^{w,z}e_{nm}^{w,z}$ makes these constraints linear in yields and error yields. Their bounds must hold simultaneously; separate extrema can provide valid but loose bounds without being jointly attainable. Maximizing an error ratio itself requires a fractional optimization.

If photon numbers are truncated to $n\le N_A$, $m\le N_B$, the omitted probability is $1-(1-\tau_a)(1-\tau_b)$, where $\tau_a,\tau_b$ are the individual Poisson tails. The omitted gain lies between zero and that quantity; it must not be silently set to zero.

As on the one-source decoy page, these stationary constraints illustrate the inference, not a complete finite-key proof against correlated attacks. Such a proof must justify the comparison between intensity samples and the conversion to actual one-photon-pair counts and phase errors. Curty et al. (2014) give an explicit composable construction against general attacks.

A composable final-length statement has the schematic form

$$\ell \le s_{11,Z}^{\mathrm L} \left[1-h_2\!\left(\min\{\phi_{11,Z}^{\mathrm U},1/2\}\right)\right] -\lambda_{\mathrm{EC}} -\Delta_{\mathrm{sec}},$$

where $s_{11,Z}^{\mathrm L}$ is a lower bound on accepted key-basis events with one photon from each user, $\phi_{11,Z}^{\mathrm U}$ is their phase-error bound, $\lambda_{\mathrm{EC}}$ is the actual reconciliation leakage, and $\Delta_{\mathrm{sec}}$ represents the specified verification and hashing length deductions. Statistical failure and smoothing parameters also enter the total security error. The exact deductions and admissible source model come from a single consistent proof; they cannot be chosen independently to maximize the rate.

Optical Bell-State Measurement

An honest relay overlaps Alice’s and Bob’s photons at a balanced beam splitter and resolves output modes with threshold or number-resolving detectors. For two pure single-photon wave packets $|u\rangle$ and $|v\rangle$, an ideal Hong–Ou–Mandel experiment (Hong, Ou and Mandel, 1987) has coincidence probability

$$P_{\mathrm{coin}} = \frac12\left(1-|\langle u|v\rangle|^2\right).$$

Perfect mode overlap suppresses the coincidence associated with distinguishable photons. In an MDI analyzer, beam-splitter interference plus polarization, phase, or time-bin resolution maps selected coincidence patterns to Bell labels. Standard passive linear optics with vacuum ancillas cannot deterministically distinguish all four dual-rail Bell states; a familiar analyzer identifies at most two and has an intrinsic average success probability no greater than $1/2$ for equally likely Bell inputs under that model (Calsamiglia and Lütkenhaus, 2001). Xu et al. (2013) analyze practical optical performance. More details appear in Photonic Qubits.

Independent global phase randomization is compatible with single-photon interference: an overall phase does not change $|u\rangle\langle u|$. It is the wave-packet overlap that matters. The arriving pulses must be matched in all degrees of freedom that drive two-photon interference:

• arrival time and pulse duration;
• optical frequency and spectral shape;
• polarization or interferometric reference frame;
• spatial mode and beam-splitter coupling;
• intensity statistics and phase-randomization behavior.

Feedback may track delay, frequency offset, polarization, and interferometer phase. Those controls improve the honest-system QBER but can also create side-channel or correlation assumptions at the sources. A high interference visibility is necessary for performance, not sufficient for security. Weak coherent pulses also include vacuum and multiphoton events, so their raw Hong–Ou–Mandel visibility has a different ideal limit from two deterministic single photons.

Loss and Rate Scaling

Let $\eta_A$ and $\eta_B$ be channel transmittances from Alice and Bob to the relay, let $\eta_d$ be the efficiency of each required detector, and let $c_{\mathrm{BSM}}$ denote the analyzer’s intrinsic accepted-outcome factor. Ignoring background and mismatch, the one-photon-pair yield scales as

$$Y_{11} \sim c_{\mathrm{BSM}}\eta_A\eta_B\eta_d^2.$$

For a standard two-state linear-optical analyzer, $c_{\mathrm{BSM}}\le1/2$ in the idealized dual-rail model. Consider $50\ \mathrm{km}$ of $0.20\ \mathrm{dB/km}$ fiber on each side. Then

$$\eta_A=\eta_B=10^{-10/10}=0.1.$$

With $\eta_d=0.8$ and $c_{\mathrm{BSM}}=1/2$,

$$Y_{11} \approx \frac12(0.1)(0.1)(0.8)^2 = 3.2\times10^{-3}.$$

For symmetric signal intensities $s_A=s_B=0.4$,

$$p_1(0.4)^2 = \left(0.4e^{-0.4}\right)^2 \approx 7.19\times10^{-2},$$

so the idealized signal-pair single-photon gain is

$$Q_{11} \approx 2.30\times10^{-4}.$$

This is a physical scaling check, not a secret-key prediction. Background coincidences, multiphoton terms, mismatch, basis and intensity probabilities, finite statistics, and postprocessing all remain.

For fixed total endpoint separation in uniform fiber, $\eta_A\eta_B$ equals the end-to-end channel transmittance. Standard MDI-QKD therefore has $O(\eta)$ repeaterless scaling, with extra Bell-measurement and two-detector costs. It is chosen for a better detector trust boundary, not because it generically beats the pure-loss capacity. Twin-field and phase-matching families use a different single-photon-interference structure to target $O(\sqrt\eta)$ scaling; they should not be relabeled as ordinary two-photon MDI-QKD.

Asymmetric Links and Networks

A central relay naturally supports a star network: users need transmitters, while expensive detectors can be concentrated at one site that need not be trusted for secrecy. Any pair of users can send to the relay during assigned slots and run independent authenticated postprocessing.

Real networks are asymmetric. Unequal loss changes arrival probabilities. Conditional on exactly one photon surviving from each source, however, mode-independent pure loss does not reduce $|\langle u|v\rangle|^2$. There are not two unequal single-photon field amplitudes to balance in this conditional experiment.

For weak coherent pulses, different arriving mean intensities also change the mixture of events with two photons from one sender versus one from each. This can degrade the aggregate interference visibility and the $X$-basis error statistics. Choosing separate signal and decoy intensities can improve the inferred key rate; balancing every basis indiscriminately is not the objective. Wang, Xu and Lo (2019) analyze independent intensity choices for asymmetric channels. Adding loss to the shorter arm can balance mean powers, but discards events, as exercise 8 quantifies.

Moving the relay changes detector count rates and background balance, but in uniform loss it does not change the product $\eta_A\eta_B$ for fixed total distance. Relay placement is therefore a system optimization involving fiber routes, synchronization, detector saturation, background, user access, and operations, not a free change to the asymptotic exponent.

What remains trusted

The relay’s channels, analyzer and detectors may be adversarial. Endpoint preparations, private choices, laboratory isolation and classical processing must still satisfy the proof. A source-monitor detector inside Alice’s laboratory is part of that characterized apparatus; calling the protocol measurement-device-independent does not remove its role in intensity estimates. Optical probes sent back into the source also require a bounded endpoint response.

A Bell-state measurement is a joint quantum measurement. A Bell test is a statistical test of local hidden-variable models. MDI-QKD uses the former as its honest implementation, but does not require a Bell-inequality violation. Device-independent QKD uses the latter to reduce internal device characterization under its own laboratory assumptions.

The station also differs from a trusted key relay: it need not know either endpoint’s final key or maintain a quantum memory. Variants with memories or continuous-variable encoding use different state models and rate analyses.

Exercises

1. Basis-independent one-photon yields

Show that uniform independent BB84 bits give the same two-source average in the $Z$ and $X$ bases. Deduce the accepted-label yield for any relay effect $0\le M_z\le I$. Does equality of these yields imply equal error rates?

Solution

For either orthonormal qubit basis, the average of the two pure-state projectors is $I/2$. Thus

$$\rho_{11}^{Z}=\rho_{11}^{X}=\frac I2\otimes\frac I2=\frac{I_4}{4}, \qquad \Pr(z\mid11,w)=\operatorname{Tr}(M_z\rho_{11}^{w})=\frac{\operatorname{Tr}M_z}{4}.$$

Equality holds for an arbitrary effect, not just a Bell projector, provided the source average and the relay’s available information are the same. It does not equate the bit-conditioned probabilities. For example, $M_z=|01\rangle\langle01|$ has yield $1/4$ in both bases. If it is announced as $\Psi^-$, the $Z$ bits are always opposite, giving zero corrected error. In the $X$ basis all four bit pairs have equal conditional probability, giving corrected error one-half. A high acceptance rate alone does not bound the phase error.

2. Construct the correction table

Using the four BB84 product states in each matched basis, determine whether Alice’s and Bob’s bits are equal or opposite when the relay reports $\Psi^-$ or $\Psi^+$.

Solution

In the $Z$ basis, only opposite-bit products $|01\rangle$ and $|10\rangle$ overlap the $\Psi$ subspace, so either $\Psi$ label means opposite bits. In the $X$ basis,

$$|++\rangle,|--\rangle \quad\text{overlap }|\Psi^+\rangle,$$

whereas

$$|+-\rangle,|-+\rangle \quad\text{overlap }|\Psi^-\rangle.$$

Thus $\Psi^+$ means equal $X$ bits and $\Psi^-$ means opposite $X$ bits. With the convention in the article, Bob flips for both $Z$ outcomes and for $X,\Psi^-$, but not for $X,\Psi^+$.

3. Ideal one-photon-pair yield

Reproduce the $100\ \mathrm{km}$ symmetric-link estimate with $\eta_A=\eta_B=0.1$, $\eta_d=0.8$, and $c_{\mathrm{BSM}}=1/2$. Then find $Q_{11}$ for $s_A=s_B=0.4$.

Solution

The accepted yield conditioned on one photon from each side is

$$Y_{11} \approx \frac12(0.1)(0.1)(0.8)^2 = 0.0032.$$

Each source emits one photon with probability $p_1(0.4)=0.4e^{-0.4}\approx0.26813$. Therefore

$$Q_{11} = p_1(0.4)^2Y_{11} \approx (0.26813)^2(0.0032) = 2.30\times10^{-4}.$$

This excludes background, mismatch, and multiphoton events and is therefore only a scaling check.

4. Infinite-decoy derivative

Show that the mixed derivative of $S_{ab}=e^{a+b}Q_{ab}$ at $a=b=0$ gives $Y_{11}$.

Solution

The generating function is

$$S_{ab} = \sum_{n,m=0}^{\infty} \frac{a^n}{n!}\frac{b^m}{m!}Y_{nm}.$$

Differentiating once in each variable gives

$$\frac{\partial^2S_{ab}}{\partial a\partial b} = \sum_{n,m\ge1} \frac{a^{n-1}}{(n-1)!} \frac{b^{m-1}}{(m-1)!}Y_{nm}.$$

At $a=b=0$, only $n=m=1$ survives, so the result is $Y_{11}$.

5. Evaluate the asymptotic rate

Using the numerical values in the article and $q=1/4$, calculate the rate per emitted pulse pair. Which term would change if reconciliation became less efficient?

Solution

The binary entropies are

$$h_2(0.015)=0.112361, \qquad h_2(0.020)=0.141441.$$

The privacy contribution minus reconciliation leakage is

$$2.30\times10^{-4}(1-0.112361) -(3.00\times10^{-4})(1.16)(0.141441) = 1.54936\times10^{-4}.$$

Multiplying by $q=1/4$ gives

$$R = 3.87339\times10^{-5}$$

secret bits per emitted pulse pair. Worse reconciliation increases $f_{\mathrm{EC}}$ and therefore increases the magnitude of the negative second term.

6. A dishonest relay

Charles reports success only when an internal rule predicts low error. Why is this not automatically a break, and what ordering constraint prevents him from selecting after learning the users’ settings?

Solution

The security model already lets Charles choose which rounds succeed as part of Eve’s arbitrary quantum instrument. Alice and Bob estimate security on the conditioned accepted sample, including its rate and basis-intensity statistics. Selective reporting can lower the key rate or cause abort without revealing an accepted key beyond the proof’s bound.

Charles must commit the event and Bell-label record before Alice and Bob disclose basis and intensity choices. Authenticated transcript comparison must also prevent inconsistent lists. If the settings leak first, the sampling model changes and the stated proof no longer applies.

7. Source leakage at one endpoint

Alice’s signal pulses are $30\ \mathrm{ps}$ longer than her decoy pulses at fixed photon number. Explain why untrusted detectors do not make this harmless.

Solution

The duration difference can give Eve partial information about Alice’s intensity class before she announces an outcome. Nonidentical wave packets need not be perfectly distinguishable for the exact common-state assumption to fail. The shared-yield assumption can fail:

$$Y_{nm,a b}^{w} \ne Y_{nm,a' b}^{w}.$$

MDI-QKD removes the need to model the relay’s detector response; it does not remove Alice’s source model. Alice must eliminate or characterize the timing leak and use a proof that includes the resulting distinguishability.

8. Asymmetric channels

Alice’s channel has $6\ \mathrm{dB}$ more loss than Bob’s. Compare adding $6\ \mathrm{dB}$ attenuation to Bob’s arm with optimizing the two launched intensities independently.

Solution

With mode-independent attenuation, $\eta_A=10^{-0.6}\eta_B\approx0.2512\eta_B$. Adding $6\ \mathrm{dB}$ loss to Bob’s arm multiplies the one-photon-pair yield by $10^{-0.6}\approx0.2512$: about three-quarters of those events are discarded.

Balancing the arriving mean intensities without adding channel loss would require $a\eta_A=b\eta_B$, or $a/b\approx3.981$. This can improve weak-coherent-pulse test statistics, but is not a universal optimum for signal intensities. Increasing $a$ changes multiphoton emission; for example, $p_1(a)=ae^{-a}$ decreases when $a>1$. Separate choices and finite-sample optimization must weigh those effects. Neither approach changes the wave-packet overlap of two surviving ideal single photons, and the channel contribution to $Y_{11}$ remains $\eta_A\eta_B$.

References

• J. Calsamiglia and N. Lütkenhaus, “Maximum Efficiency of a Linear-Optical Bell-State Analyzer,” Applied Physics B 72, 67–71 (2001), doi:10.1007/s003400000484.
• M. Curty, F. Xu, W. Cui, C. C. W. Lim, K. Tamaki, and H.-K. Lo, “Finite-Key Analysis for Measurement-Device-Independent Quantum Key Distribution,” Nature Communications 5, 3732 (2014), doi:10.1038/ncomms4732.
• C. K. Hong, Z. Y. Ou, and L. Mandel, “Measurement of Subpicosecond Time Intervals between Two Photons by Interference,” Physical Review Letters 59, 2044–2046 (1987), doi:10.1103/PhysRevLett.59.2044.
• H.-K. Lo, M. Curty, and B. Qi, “Measurement-Device-Independent Quantum Key Distribution,” Physical Review Letters 108, 130503 (2012), doi:10.1103/PhysRevLett.108.130503.
• W. Wang, F. Xu, and H.-K. Lo, “Asymmetric Protocols for Scalable High-Rate Measurement-Device-Independent Quantum Key Distribution Networks,” Physical Review X 9, 041012 (2019), doi:10.1103/PhysRevX.9.041012.
• F. Xu, M. Curty, B. Qi, and H.-K. Lo, “Practical Aspects of Measurement-Device-Independent Quantum Key Distribution,” New Journal of Physics 15, 113007 (2013), doi:10.1088/1367-2630/15/11/113007.