Large-scale quantum networks based on graphs

Quantum entanglement is one of the pillars of quantum information processing. Distribution of entanglement among two or more spatially separated parties is a necessary ingredient for many tasks in quantum information theory, including distributed quantum computing [1], blind quantum computing [2], teleportation [3], telecloning [4], secret sharing [5] and quantum cryptography schemes [6–8]. Multipartite entanglement enables a violation of Bell inequalities that grows exponentially with the number of parties [9]. However, the controlled distribution of entanglement, in particular of multipartite entanglement, over long distances is a major challenge, due to unavoidable imperfections such as particle losses and decoherence.

The seminal idea of quantum repeaters [10, 11] is based on the distribution of short-range entanglement between intermediate repeater stations (thus avoiding losses that grow typically exponentially with the distance) and subsequent entanglement swapping, which connects the short links along a line to long-range bipartite entanglement. Several theoretical variations have been proposed: some of them are based on entanglement distillation [12–14] and others are based on forward error correction [15–18]. Much experimental progress towards the realisation of a quantum repeater has been made [19–25].

'Partially quantum' networks are considered in the so-called trusted node scenario [26], while fully quantum networks have been investigated in the context of network routing [27–30] and coding [31–33] strategies and heterogeneous network technologies [34].

Here we propose a general multipartite quantum network architecture, where the long-distance links are bridged by quantum repeater stations. This idea is illustrated in figure 1 for the long-term vision of a 'world-wide quantum web'. This network contains nodes (labelled by letters), which receive, measure and send particles. They could be located at, e.g., key institutions. Network nodes are connected by long-distance transmission channels, which are subdivided into shorter channels by an appropriate number of quantum repeater stations—an example is also shown in figure 1. The geometry of these links is general. In particular it is not restricted to regular lattices.

Zoom In Zoom Out Reset image size

Any network such as in figure 1 forms a mathematical graph by identifying the network nodes with vertices and the quantum channels with edges. To any graph a corresponding graph state can be associated [35, 36]. These states are highly entangled and constitute a valuable resource, e.g. for one-way quantum computation [35–39]. In our proposal the goal is to establish a multipartite entangled graph state between the network nodes, which constitutes a general resource that is required for many quantum information protocols, including the ones mentioned at the beginning.

This goal is reached in two steps. Step 1: a graph state is produced, where both the network nodes and the repeater stations constitute vertices. Step 2: the vertices corresponding to the repeater stations are 'removed' by appropriate measurements. It is important to note that no memories are needed at the repeater stations, as the measurements can be performed immediately, as will be explained in more detail below. We remark that not all quantum states are graph states. Thus not all multipartite quantum states can be obtained directly via our proposal.

In order to deal with unavoidable errors, for example photon losses in fibres or in the atmosphere, quantum error correction will be used, i.e. the nodes and repeater stations will process higher-dimensional encodings of physical qubits; we will use stabiliser codes throughout this paper.

As the same language of stabilisers is used for both the encoding and the target states, our scheme of a global quantum repeater network is concise and general.

A mathematical graph G consists of a set V of N vertices and a set E of edges, each of which connects two vertices, i.e. $E\subset V\times V$. In figure 1, the network nodes as well as the repeater stations are vertices, and all transmission channels between them are edges of a graph. To each mathematical graph G corresponds a graph state $| G\rangle$, which can be defined in two equivalent ways. First, a graph state can be physically produced by switching on a specific entangling gate for each edge of the graph. Concretely, $| G\rangle$ is the state that is created from the state $| +{\rangle }^{\otimes N}$, with $| +\rangle =\tfrac{1}{\sqrt{2}}(| 0\rangle +| 1\rangle )$, by applying a controlled-phase gate C_Z to each pair (i, j) of vertices in E, i.e.

$$\begin{eqnarray}&&| G\rangle =\displaystyle \prod _{(i,j)\in E}{C}_{Z}^{(i,j)}| +{\rangle }^{\otimes N},\end{eqnarray} \tag{ 1 }$$

where in the computational basis $\{| 00\rangle ,| 01\rangle ,| 10\rangle ,| 11\rangle \}$ the entangling gate reads C_Z = diag(1, 1 , 1, −1).

Second, a graph state is the unique state which is eigenstate of a set of so-called stabiliser operators, with eigenvalues +1. Each vertex i of the graph has an associated stabiliser operator g_i which is a product of the Pauli-X operator for vertex i and the Pauli-Z operator for all its neighbours, i.e. g_i reads

$$\begin{eqnarray}&&{g}_{i}={X}_{i}\displaystyle \prod _{\begin{array}{c}j\in V\\ (i,j)\in E\end{array}}{Z}_{j}.\end{eqnarray} \tag{ 2 }$$

Here, X_i is a short‐hand notation for the Pauli operator X acting on vertex i and the identity ${\mathbb{1}}$ at all other vertices. The graph state $| G\rangle$ is defined via the eigenequations ${g}_{i}| G\rangle =| G\rangle$, for all $i\in V$. Note that a product of stabiliser operators is also a stabiliser.

In order to present our main idea, let us first describe the two mentioned steps. In step 1, a graph state according to the graph in figure 1 is created: for the simple line graphs, which constitute the long-distance links, each repeater station receives one qubit from the previous station, produces one qubit in state $| +\rangle$, entangles it with the qubit from the previous station via a C_Z gate and then sends the second qubit through the channel to the next repeater station, which acts in the same way. Thus, the edges between repeater stations are created. The network nodes act in a slightly different way: depending on their number of neighbours, they receive a certain number of inputs, create a certain number of qubits in state $| +\rangle$, perform entangling C_Z gates, and send on the appropriate number of qubits to the neighbouring repeater stations. Some examples are given in figure 1. Thus, the whole graph of figure 1 will be produced.

In step 2, the vertices corresponding to all repeater stations are removed by a simple Pauli X-measurement at each repeater station. The reasoning is as follows: remember that a product of stabilisers is also a stabiliser. Consider the vertex S (South Africa) in the quantum network shown in figure 1 and assume that the number of repeater stations is even on each edge (odd numbers can be treated in an analogous way). Take the product of the stabiliser generators starting from S and for every second repeater station, until reaching the neighbours T, M, P, I, and R. Due to the definition of g_i in equation (2) and the fact that ${Z}^{2}={\mathbb{1}}$, this product of stabilisers contains only X-operators at S and the mentioned repeater stations, and Z-operators on the neighbouring network nodes of S in the network (see also [40]). We call this stabiliser operator the main stabiliser centred on S. Measuring all repeater stations in the X-basis projects the state onto one stabilised by $\pm {X}_{S}{Z}_{T}{Z}_{M}{Z}_{P}{Z}_{I}{Z}_{R}$ in the Hilbert space of the network nodes only. Here the sign of the stabiliser operator depends on the parity of the measurement outcomes of the repeater stations included in the main stabiliser centred on S. The minus sign can be removed by applying the so-called by-product operator Z_S in this case. This reasoning holds for all network nodes. By comparison of the obtained stabilisers with equation (2) it is clear that the graph state corresponding to the global network (large vertices in figure 1) has been produced.

Even though we have explained the procedure in two consecutive steps, it is not necessary to store the full graph state: as the local measurements commute with the operations on other repeater stations, a qubit can be measured immediately after action of the C_Z gate, which is easier to realise experimentally. Thus, the whole graph state between network nodes is gradually built up in a one-way fashion, as explained in figure 1, without need for memories in the repeater stations.

In an implementation of the above scheme, losses in the transmission channels, noise in the gates as well as errors in preparation and measurement will occur and would lead to a low-quality output state. As a solution to this problem, quantum error correction can be employed: the main idea is to encode the state of a so-called logical qubit redundantly into many physical qubits, such that a local error leads to a unique error syndrome and can be corrected by applying a suitable operation [41]. This is in contrast to previous ideas [42] where graph states were used as resource states for measurement-based implementations of quantum error correction.

In the present article we make use of so-called stabiliser codes [43], which are defined via a set of stabiliser operators, the eigenstates of which (with eigenvalue 1) are the codewords. In particular, we focus here on a subclass of stabiliser codes, the Calderbank-Shor-Steane (CSS) codes [41] which have the useful property of 'transversal' logical entangling gates (see appendix B). Thus the only change in our scheme is that instead of initial physical qubit states $| +\rangle$ multi-qubit encoded logical states, denoted in the following as $| \bar{+}\rangle$, need to be generated. The specific structure of $| \bar{+}\rangle$ depends on the chosen error correction code. Low-error state preparation can be done more efficiently than general quantum operations on an unknown state, see e.g. [44] for a preparation scheme for the quantum Golay code [45–47]. The repeater operation in the encoded case and the short-hand notation $| \bar{+}\rangle$ and ${M}_{\bar{X}}$ for the measurement on the encoded state is illustrated in figure 2.

Zoom In Zoom Out Reset image size

The unified description of the quantum network in terms of stabilisers for both the states and the encoding allows for a comprehensive analysis of errors and performance study. An error can be noticed, in the sense that it is known which qubit is affected (e.g. a no-detection event), or unnoticed (noise). For our performance study we will use the usual exponential loss model in optical fibres, i.e. the failure probability during transmission f_T is given by

$$\begin{eqnarray}&&{f}_{T}=1-(1-{f}_{C}){{\rm{e}}}^{-{L}_{0}/{L}_{{\rm{att}}}},\end{eqnarray} \tag{ 3 }$$

where f_C is a coupling failure probability, L₀ is the distance between repeater stations and ${L}_{\mathrm{att}}$ is the attenuation length of the fibre, for which we will use the value L_att = 20 km. All qubit errors (for sources, gates, channels, detectors) will be modelled by the depolarising channel, characterised as

$$\begin{eqnarray}&&\rho \to (1-f)\rho +f\displaystyle \frac{1}{2}{\mathbb{1}},\end{eqnarray} \tag{ 4 }$$

i.e. with a failure probability f the state of the qubit is proportional to the identity, and with probability (1− f) it is unaffected. Thus in case of failure the state is depolarised to the completely mixed state. The same effect is achieved by randomly applying bit-flips and phase-flips to the state. This mathematically equivalent viewpoint of a perfect operation followed by discrete X and Z errors is very convenient [48].

When a physical X or Z error has occurred, it propagates via the gates through the network, i.e. it may influence the consecutive qubits and measurement results. However, fortunately the spreading of errors along a repeater line is restricted to a finite length, concretely to up to two repeater stations. This is due to some simple rules for error propagation via a C_Z gate: a Z error that occurs on one of the two input qubits of a C_Z gate remains a Z error on the corresponding output qubit and does not affect the other output qubit. An X error that occurs on one of the two input qubits remains an X error on the corresponding output qubit, but also causes a Z error on the other output qubit. (If more than one error has occurred, the output qubits will suffer from corresponding products of errors.) An X or Z error may therefore be spread to the next repeater station, where the corresponding qubit will pass through the next C_Z gate and then will be measured. Regarding the measurement, an X-(Z-) error before an X-(Z-) measurement does not affect the measurement outcome, while an X-(Z-) error before a Z- (X-) measurement flips the measurement outcome.

The possible sources of errors are shown in figure 3. It is important to note, due to the arguments given above, that repeater station number i is only influenced by errors propagating from nearest and next-to-nearest neighbours, i.e. from stations (i − 1) and (i − 2).

Zoom In Zoom Out Reset image size

If an error is noticed, the corresponding measurement outcome is set to '?'. The physical error rate depends on the failure probabilities for transmission, gates and measurements and is explicitly calculated in appendix B.

In figure 3 we focus on the physical error rates along a repeater line. The generalisation of our analysis to more gates and more qubits in the case of the network nodes is straightforward and can be described in terms of the vertex (in- and out-) degree, see appendix D. Note, however, that in a large-scale quantum network there are many more repeater stations than network nodes. Thus the performance of the network mainly depends on the error rate at the repeater stations, which was described above.

Up to now we have described the physical errors. For a given encoding the logical error rate, i.e. the rate of uncorrectable errors, is a function of the physical error rate, see appendix C.

Remember that the (logical) measurement outcomes at the repeater stations of the main stabiliser centred on a node v determine whether the by-product operator Z_v needs to be applied. Thus even numbers of logical errors on the corresponding repeater stations cancel each other. The local error rate e_v at the vertex v is an important indicator of the quality of the produced state. The formula to calculate e_v follows the previous reasoning and is given in appendix A. The error rates e_v effectively combine all errors of the repeater stations and simplify the analysis considerably. The stabiliser error rates allow to bound the fidelity of the established state, see appendix A.

The performance of a quantum network may depend on the task it was built for: possible figures of merit are e.g. the rate for the production of a long-distance entangled state, the success probability for a task such as quantum teleportation, or the secret key rate in a cryptographic setting. In the following we will use as figure of merit the cost-performance ratio C which compares the needed resources [18]: it is defined as the total number of needed qubits divided by the total distance L and a specific quality factor Q, i.e.

$$\begin{eqnarray}&&C=\displaystyle \frac{{nw}}{{LQ}},\end{eqnarray} \tag{ 5 }$$

where n is the number of qubits per station (neglecting preparation overhead) and w is the number of repeater stations. Our description in the graph state language provides a tool to optimise the architecture of a quantum network: two graphs G and G' with the same set of vertices V but different sets of edges $E\ne E^{\prime}$ may correspond to local-unitary equivalent graph states [36], i.e. states that are related by local basis changes. This fact leads to general optimisation arguments for quantum networks; we now consider only network nodes as vertices and their connecting repeater lines as edges, which have a weight according to the number of repeater stations on this line.

• (1)  
  The graph G' can have fewer edges than G. This corresponds to a reduced number of repeater lines in a network, see e.g. figure 4(a).
• (2)  
  The graph G' can have less cycles than G, see e.g. figures 4(a) and (c). Note that in general cycles increase the required coherence time of the used quantum memories at the network nodes, because the qubits need to be stored until all gates have been applied to them.
• (3)  
  The total length of the edges in E and E' may differ, even if the number of edges of G' and G are equal, see e.g. figure 4(b). One can thus minimise the total number of repeater stations in the network.
• (4)  
  The maximal vertex degree of G and G' may be different. Given that the number of repeater stations is optimised w.r.t. C for each individual edge, the rate of errors increases with the vertex degree (see appendix A). Thus it can be advantageous to reduce the maximal vertex degree, see e.g. figure 4(c).

In order to illustrate the general performance of a graph state quantum repeater and to compare different codes we consider in the following a bipartite setting, i.e. one repeater line. This is a typical quantum cryptographic scenario, and therefore we use as the quality factor Q in the cost-performance ratio C the effective secret fraction R, given by

$$\begin{eqnarray}&&R={P}_{{\rm{succ}}}{r}_{\infty },\end{eqnarray} \tag{ 6 }$$

where P_succ denotes the probability for not aborting of the protocol (one might choose to abort in case of a 'fatal' pattern of noticed errors in order to increase the quality of the produced state), employing a given code. The factor r_∞ is the secret fraction for the BB84 protocol, given by [49]

$$\begin{eqnarray}&&{r}_{\infty }=\mathrm{max}\{1-h({e}_{A})-h({e}_{B}),0\}.\end{eqnarray} \tag{ 7 }$$

Here, e_A and e_B are the error rates of the two end nodes, and the binary entropy is defined as $h(p)=-p{\mathrm{log}}_{2}(p)-(1-p)\;{\mathrm{log}}_{2}(1-p)$. Note that e_A and e_B depend on the logical error rate of the error correction code: a logical measurement error remains, if the outcomes are decoded to a codeword with wrong parity.

We optimised the cost-performance ratio C with respect to the number of repeater stations w for different L for several codes. The optimal separation distance of the repeater stations decreases with increasing total distance. Note that the number of repeater stations in figure 4, i.e. the optimal weight of the long-distance edges, was also calculated using this bipartite figure of merit for each edge. For a comparison of various encoding schemes with the original repeater see figure 5. For distances on the global scale the cost-performance ratio C of the Golay code remains in the same order of magnitude, e.g. for L = 100 000 km it is C ≈ 63.5 for optimised repeater spacing (approx. 480 m) and gate error probability f_G = 10⁻⁴. Starting from distances larger than about 800 km, the Golay code outperforms all previous approaches. With our methods, this type of comparison can now be performed for any quantum network architecture and any quantum information processing task, using a corresponding figure of merit for the quality factor Q.

Zoom In Zoom Out Reset image size

Zoom In Zoom Out Reset image size

Establishing a large-scale entangled quantum state is a formidable future task. In our proposal of a graph state quantum repeater network this task finds a unified description in the elegant language of stabilisers. Though being of abstract mathematical origin, this approach allows to quantitatively evaluate the implementation of a quantum network corresponding to an arbitrary graph and compare it to other networks and different approaches from the literature. For given quantum hardware such as sources, transmission channels, gates and detectors, a suitable error correction code can be found, and the performance for quantum information processing protocols such as e.g. secret key generation between two or more parties can be determined.

For fixed locations of participating parties, our method helps to design an optimal quantum network in terms of resources and performance with respect to a specific task (e.g. cryptography or synchronisation of distributed clocks [51, 52]). Exploiting local unitary equivalence of different quantum networks has no classical counterpart and deserves further detailed investigations. Future research on quantum networks will benefit from the presented description in the stabiliser formalism. This includes in particular the analysis of the efficient use of the whole network infrastructure to produce entangled states shared by a subset of parties. While we showed that the performance of the 23-qubit quantum Golay code is outstanding for large distances, further research may focus on smaller codes for smaller networks.

M E acknowledges helpful discussions with S Muralidharan and financial support by the German Federal Ministry of Education and Research (BMBF).

An [[n, k, d]] error correction code encodes k logical qubits into n > k physical qubits. This redundancy guarantees the correction of up to $\tfrac{d-1}{2}$ single qubit errors or d − 1 erasures. Note that erasures, marked in the classical data as '?', are not only caused by losses of qubits at that particular position. In the scheme described in the main text, any noticed error on the qubit i or i − 1 will lead to an erasure of the measurement outcome at position i.

Let S denote the stabiliser group of the codespace of a stabiliser code. Furthermore let ${\bar{X}}^{(1)},\ldots ,{\bar{X}}^{(k)},{\bar{Z}}^{(1)},\ldots ,{\bar{Z}}^{(k)}$ denote logical X- and Z-operators. These operators are elements of the normaliser of S but not elements of S and fulfill ${X}^{(i)}{Z}^{(i)}=-{Z}^{(i)}{X}^{(i)}$, while operators on different logical qubits commute. For simplicity we focus on the k = 1 case and drop the label of the logical operator. In analogy to a graph state, we define a logical graph state associated with a graph G = (V, E) as the unique state $| \bar{G}\rangle$ that is stabilised by operators

$$\begin{eqnarray}&&{\bar{g}}_{i}={\bar{X}}_{i}\displaystyle \prod _{\begin{array}{c}j\in V\\ (i,j)\in E\end{array}}{\bar{Z}}_{j}.\end{eqnarray} \tag{ A1 }$$

This definition can be generalised to k > 1 which leads to k copies of the graph state.

A logical error e occurs when the recovery operation leads to a wrong codeword $e| \bar{G}\rangle \ne \bar{G}$. This can happen if more errors occurred on one block than the code is able to correct. A logical measurement error occurs if e anticommutes with the observable. One assumes that the probability of (un-noticed) errors f_u and erasures f_n are the same for all physical qubits. Then for any quantum error correction code, the probability of a logical error ${\bar{f}}_{u}$ is a function of f_u and f_n. It is possible to retry the production on a particular pattern of noticed errors. Thus the function ${\bar{f}}_{u}({f}_{u},{f}_{n})$ depends on the error correction code and the strategy of when to abort. Several examples are given in appendix C.

Given the probability of logical measurement errors at each vertex it is straightforward to calculate the logical error rate at the position of the network nodes. For each main stabiliser S_i centred on party i, the applied by-product operator ${Z}_{i}^{\sum {\bar{x}}_{j}}$ depends on all $\bar{X}$-measurement outcomes ${\bar{x}}_{j}$ of the qubits included in the main stabiliser (i.e. the qubits on which it acts non-trivially). These are half of the qubits on the links from and to party i, i.e. $\tfrac{1}{2}{\sum }_{j\in V}{w}_{{ij}}$, where w_ij is the number of repeater stations on the link (i, j). Even numbers of logical errors cancel each other and the stabiliser error rate is

$$\begin{eqnarray}&&{e}_{i}=\mathrm{tr}\left(\rho \displaystyle \frac{\bar{{\mathbb{1}}}-{\bar{g}}_{i}}{2}\right),\end{eqnarray} \tag{ A2 }$$

$$\begin{eqnarray}&&=\displaystyle \sum _{n}\mathrm{tr}\left(\rho {\bar{{\rm{Z}}}}_{i}\displaystyle \prod _{\begin{array}{c}k\in V\\ k\ne i\end{array}}{{\bar{{\rm{Z}}}}_{k}}^{{n}^{(k)}}| \bar{{\rm{G}}}\rangle \langle \bar{{\rm{G}}}| {\bar{{\rm{Z}}}}_{i}\displaystyle \prod _{\begin{array}{c}k^{\prime} \in V\\ k^{\prime} \ne i\end{array}}{{\bar{{\rm{Z}}}}_{k^{\prime} }}^{{n}^{(k^{\prime} )}}\right),\end{eqnarray} \tag{ A3 }$$

$$\begin{eqnarray}&&={P}_{\mathrm{odd}}\left({\bar{f}}_{u}({f}_{u},{f}_{n}),\displaystyle \frac{1}{2}\displaystyle \sum _{j\in V}{w}_{{ij}}\right),\end{eqnarray} \tag{ A4 }$$

where n^k is the kth binary digit of n and

$$\begin{eqnarray}&&{P}_{\mathrm{odd}}(f,N)=\displaystyle \frac{1}{2}(1-{(1-2f)}^{N}).\end{eqnarray} \tag{ A5 }$$

Suppose that the state produced by the quantum network is given by a density matrix ρ. An error on any stabiliser implies the production of a state orthogonal to the target state $| G\rangle$. Note that it suffices to consider only $\bar{Z}$ errors, as the effect of $\bar{X}$-errors can be described with $\bar{Z}$ errors due the stabilisers of the graph state. One can thus immediately gain bounds on the fidelity of ρ with respect to the state $| G\rangle$ from the local error rates e_v,

$$\begin{eqnarray}&&1-\displaystyle \sum _{v\in V}{e}_{v}\leqslant \langle G| \rho | G\rangle \leqslant 1-\mathrm{max}\{{e}_{v}| v\in V\}.\end{eqnarray} \tag{ A6 }$$

For the network given in figure 4(b), these bounds evaluate to $94\%\leqslant \langle G| \rho | G\rangle \leqslant 99\%$, for example.

CSS codes allow the transversal implementation of controlled-NOT gates [41]. A transversal application of a quantum gate on two blocks of an [[n, k, d]] quantum error correction code is the qubit-wise application of the gate, i.e. n gates act in parallel on the ith qubit of block one and the ith qubit of block two, $i=1,2,\ldots ,n$, see figure 2. By using two alternating codes in the $\bar{X}$- and $\bar{Z}$-basis on alternating qubits, the transversal application of the controlled-NOT gates acts like a logical controlled-phase gate and we can stick to the language of graph states. Because only transversal gates are applied in the quantum circuit, it suffices to calculate the physical error rate by considering the first qubit of each block only. We start by calculating the unnoticed error rate f_u for a repeater station, i.e. the probability to get a flipped measurement outcome. Notice that two errors of this kind cancel each other. We collect all independent sources of errors that lead to the error pattern under consideration (e.g. 'flipped outcome at position i') into a vector $\vec{p}$. Then the probability for this error is

$$\begin{eqnarray}&&{f}_{u}={\tilde{P}}_{\mathrm{odd}}(\vec{p})=\displaystyle \sum _{\begin{array}{c}n=0\\ | n{| }_{H}\ \mathrm{odd}\end{array}}^{{2}^{N}-1}\displaystyle \prod _{k=1}^{N}{p}_{k}^{{n}^{(k)}}{(1-{p}_{k})}^{1-{n}^{(k)}},\end{eqnarray} \tag{ B1 }$$

where n^k is the kth binary digit of n. In case of the repeater stations the error sources correspond to

$$\begin{eqnarray}&&\vec{p}=\left({P}_{\mathrm{odd}}\left(\displaystyle \frac{{f}_{P,u}}{2},2\right),\displaystyle \frac{{f}_{P,n}+{f}_{P,u}}{2},\right.\\ &&\quad \left.{P}_{\mathrm{odd}}\left(\displaystyle \frac{{f}_{G,u}}{2},3\right),{P}_{\mathrm{odd}}\left(\displaystyle \frac{{f}_{T,u}}{2},2\right),\displaystyle \frac{{f}_{M,u}}{2}\right).\end{eqnarray} \tag{ B2 }$$

Here we included noticed/unnoticed errors for preparation (f_{P, n/u}), transmission (f_{T, n/u}), gates (f_{G, n/u}) and measurement (f_{M, n/u}). Remember that ${P}_{\mathrm{odd}}(f,N)$ was defined in equation (A5). In order to identify the processes that contribute to f_u one checks all possible propagations of errors to a Z-error on the qubit i under consideration. It is useful to note that only X-errors spread to Z-errors on adjacent qubits in a C_Z gate.

Please note that we have neglected the difference of the physical error rates for qubits at the boundary of a repeater line and 'typical' qubits. This is motivated by the fact, that in a large-scale quantum network there are many more repeater stations than parties. Incorporating these boundary effects is however straightforward.

We assume that noticed errors do not cancel each other. Again we collect all independent sources of the error under consideration. In contrast to the case of f_u, f_n denotes the probability that any of these events occurred. Thus the probability for an error of this type is

$$\begin{eqnarray}&&{f}_{n}=1-{(1-{f}_{P,n})}^{2}{(1-{f}_{G,n})}^{3}{(1-{f}_{T,n})}^{2}{(1-{f}_{M,n})}^{2}.\end{eqnarray} \tag{ B3 }$$

In order to calculate the secret key rate for a specific encoding, we need the error rates on odd and even logical qubits. The decoder assigns a codeword to any word given by the measurement, i.e. to the true outcomes altered by the error pattern. This recovered codeword is used to calculate the value of the logical observable. If this recovered value is different from the 'true outcome' this word of measurement outcomes contributes to the logical error rate. The decoder may trigger an abort on any error from the set ${ \mathcal F }$. The naive approach to calculating this rate thus is

$$\begin{eqnarray}&&{\bar{f}}_{u,{ \mathcal C }}({f}_{u},{f}_{n})=\displaystyle \frac{1}{k}\displaystyle \sum _{e\not\hspace{-2pt}{\in }{ \mathcal F }}f(e){P}_{e}(e),\end{eqnarray} \tag{ C1 }$$

where P_e(e) is the probability of the error e and f (e) is the number of logical errors after decoding. The success probability depends on ${ \mathcal F }$ and reads

$$\begin{eqnarray}&&{P}_{\mathrm{succ}}=\displaystyle \sum _{e\not\hspace{-2pt}{\in }{ \mathcal F }}{P}_{e}(e)=1-\displaystyle \sum _{e\in { \mathcal F }}{P}_{e}(e).\end{eqnarray} \tag{ C2 }$$

Let us consider a decoder that returns the most likely codeword c in the sense that an error pattern e that changes c to the observed data has maximal probability P_e(e). If this is not unique the decoder chooses any such c with equal probability. We use it for the 7-qubit Steane code and use a fatal error set ${ \mathcal F }$ of the form

$$\begin{eqnarray}&&{ \mathcal F }=\{e| e\ \mathrm{contains}\ \mathrm{more}\ \mathrm{than}\;{\text{}}{n}_{\mathrm{max}}\mathrm{losses}\},\end{eqnarray} \tag{ C3 }$$

where ${n}_{\mathrm{max}}\in {\mathbb{N}}$, i.e. the protocol is aborted if more than ${n}_{\mathrm{max}}$ losses occurred. The error rates of the 7-qubit Steane code listed in table C1 were obtained by implementing equation (C1). The logical error rate of the Golay code is given in table C2.

Table C1.  Logical error rates of the Steane code.

		7-qubit Steane code (${n}_{\mathrm{max}}=0$)
${\bar{f}}_{u}({f}_{u},{f}_{n})$	=	${({f}_{n}-1)}^{7}{f}_{u}^{2}(48{f}_{u}^{5}-168{f}_{u}^{4}+252{f}_{u}^{3}-210{f}_{u}^{2}+98{f}_{u}-21)$
Psucc(fn)	=	${(1-{f}_{n})}^{7}$
		7-qubit Steane code (${n}_{\mathrm{max}}=1$)
${\bar{f}}_{u}({f}_{u},{f}_{n})$	=	${({f}_{n}-1)}^{6}{f}_{u}(48({f}_{n}-1){f}_{u}^{6}-168({f}_{n}-1){f}_{u}^{5}\quad +\quad 252({f}_{n}-1){f}_{u}^{4}-210({f}_{n}-1){f}_{u}^{3}$
		$+14(9{f}_{n}-7){f}_{u}^{2}\quad +\quad 21(1-3{f}_{n}){f}_{u}+21{f}_{n})$
${P}_{\mathrm{succ}}({f}_{n})$	=	${({f}_{n}-1)}^{6}(6{f}_{n}+1)$
		7-qubit Steane code (nmax = 2)
${\bar{f}}_{u}({f}_{u},{f}_{n})$	=	$({f}_{n}-1){}^{5}{f}_{u}(48({f}_{n}-1){}^{2}{f}_{u}^{6}-168({f}_{n}-1){}^{2}{f}_{u}^{5}\quad +\quad 252({f}_{n}-1){}^{2}{f}_{u}^{4}-210({f}_{n}-1){}^{2}{f}_{u}^{3}$
		$+14({f}_{n}(3{f}_{n}-16)+7){f}_{u}^{2}\quad +\quad 21({f}_{n}(3{f}_{n}+4)-1){f}_{u}-21{f}_{n}(2{f}_{n}+1))$
Psucc(fn)	=	$-({f}_{n}-1){}^{5}(15{f}_{n}^{2}+5{f}_{n}+1)$
		7- qubit Steane code (nmax = 3)
${\bar{f}}_{u}({f}_{u},{f}_{n})$	=	$\tfrac{1}{2}({f}_{n}-1){}^{4}({f}_{n}^{3}(96{f}_{u}^{7}-336{f}_{u}^{6}+504{f}_{u}^{5}-420{f}_{u}^{4}+308{f}_{u}^{3}-210{f}_{u}^{2}+84{f}_{u}+7)$
		$-2{f}_{n}^{2}{f}_{u}(144{f}_{u}^{6}-504{f}_{u}^{5}+756{f}_{u}^{4}-630{f}_{u}^{3}+266{f}_{u}^{2}-21{f}_{u}-21)$
		$+2{f}_{n}{f}_{u}(144{f}_{u}^{6}-504{f}_{u}^{5}+756{f}_{u}^{4}-630{f}_{u}^{3}+322{f}_{u}^{2}-105{f}_{u}+21)$
		$+2{f}_{u}^{2}(-48{f}_{u}^{5}+168{f}_{u}^{4}-252{f}_{u}^{3}+210{f}_{u}^{2}-98{f}_{u}+21))$
Psucc(fn)	=	$({f}_{n}-1){}^{4}(20{f}_{n}^{3}+10{f}_{n}^{2}+4{f}_{n}+1)$
		7-qubit Steane code (nmax = 4)
${\bar{f}}_{u}({f}_{u},{f}_{n})$	=	$\tfrac{1}{2}({f}_{n}-1){}^{3}(3{f}_{n}^{4}(32{f}_{u}^{7}-112{f}_{u}^{6}+168{f}_{u}^{5}-140{f}_{u}^{4}+84{f}_{u}^{3}-42{f}_{u}^{2}+14{f}_{u}-7)$
		$-{f}_{n}^{3}(384{f}_{u}^{7}-1344{f}_{u}^{6}+2016{f}_{u}^{5}-1680{f}_{u}^{4}+840{f}_{u}^{3}-252{f}_{u}^{2}+42{f}_{u}+7)$
		$+12{f}_{n}^{2}{f}_{u}^{2}(48{f}_{u}^{5}-168{f}_{u}^{4}+252{f}_{u}^{3}-210{f}_{u}^{2}+98{f}_{u}-21)$
		$-6{f}_{n}{f}_{u}(64{f}_{u}^{6}-224{f}_{u}^{5}+336{f}_{u}^{4}-280{f}_{u}^{3}+140{f}_{u}^{2}-42{f}_{u}+7)$
		$+2{f}_{u}^{2}(48{f}_{u}^{5}-168{f}_{u}^{4}+252{f}_{u}^{3}-210{f}_{u}^{2}+98{f}_{u}-21))$
Psucc(fn)	=	$-15{f}_{n}^{7}+35{f}_{n}^{6}-21{f}_{n}^{5}+1$
		7-qubit Steane code (nmax = 5)
${\bar{f}}_{u}({f}_{u},{f}_{n})$	=	$\tfrac{1}{2}({f}_{n}-1){}^{2}(6{f}_{n}^{5}{f}_{u}(16{f}_{u}^{6}-56{f}_{u}^{5}+84{f}_{u}^{4}-70{f}_{u}^{3}+42{f}_{u}^{2}-21{f}_{u}+7)$
		$-2{f}_{n}^{4}(240{f}_{u}^{7}-840{f}_{u}^{6}+1260{f}_{u}^{5}-1050{f}_{u}^{4}+546{f}_{u}^{3}-189{f}_{u}^{2}+42{f}_{u}-7)$
		$+{f}_{n}^{3}(960{f}_{u}^{7}-3360{f}_{u}^{6}+5040{f}_{u}^{5}-4200{f}_{u}^{4}+2016{f}_{u}^{3}-504{f}_{u}^{2}+42{f}_{u}+7)$
		$-6{f}_{n}^{2}{f}_{u}(160{f}_{u}^{6}-560{f}_{u}^{5}+840{f}_{u}^{4}-700{f}_{u}^{3}+336{f}_{u}^{2}-84{f}_{u}+7)$
		$+2{f}_{n}{f}_{u}(240{f}_{u}^{6}-840{f}_{u}^{5}+1260{f}_{u}^{4}-1050{f}_{u}^{3}+518{f}_{u}^{2}-147{f}_{u}+21)$
		$+2{f}_{u}^{2}(-48{f}_{u}^{5}+168{f}_{u}^{4}-252{f}_{u}^{3}+210{f}_{u}^{2}-98{f}_{u}+21))$
Psucc(fn)	=	$6{f}_{n}^{7}-7{f}_{n}^{6}+1$
		7-qubit Steane code (nmax = 6)
${\bar{f}}_{u}({f}_{u},{f}_{n})$	=	${f}_{n}^{7}\left(48{f}_{u}^{7}-168{f}_{u}^{6}+252{f}_{u}^{5}-210{f}_{u}^{4}+126{f}_{u}^{3}-63{f}_{u}^{2}+21{f}_{u}-\tfrac{7}{2}\right)$
		$-\tfrac{21}{2}{f}_{n}^{6}(2{f}_{u}-1){}^{3}(4{f}_{u}^{4}-8{f}_{u}^{3}+6{f}_{u}^{2}-2{f}_{u}+1)$
		$+\tfrac{21}{2}{f}_{n}^{5}(2{f}_{u}-1){}^{3}(12{f}_{u}^{4}-24{f}_{u}^{3}+18{f}_{u}^{2}-6{f}_{u}+1)$
		$-105{f}_{n}^{4}{f}_{u}(2{f}_{u}-1){}^{3}(2{f}_{u}^{3}-4{f}_{u}^{2}+3{f}_{u}-1)+\tfrac{7}{2}{f}_{n}^{3}(2{f}_{u}-1){}^{3}(60{f}_{u}^{4}-120{f}_{u}^{3}+90{f}_{u}^{2}-30{f}_{u}-1)$
		$-63{f}_{n}^{2}{f}_{u}(2{f}_{u}-1){}^{3}(2{f}_{u}^{3}-4{f}_{u}^{2}+3{f}_{u}-1)+21{f}_{n}{f}_{u}(2{f}_{u}-1){}^{3}(2{f}_{u}^{3}-4{f}_{u}^{2}+3{f}_{u}-1)$
		$+{f}_{u}^{2}(-48{f}_{u}^{5}+168{f}_{u}^{4}-252{f}_{u}^{3}+210{f}_{u}^{2}-98{f}_{u}+21)$
Psucc(fn)	=	$1-{f}_{n}^{7}$
		7-qubit Steane code (nmax = 7)
${\bar{f}}_{u}({f}_{u},{f}_{n})$	=	$3{f}_{n}^{7}(2{f}_{u}-1){}^{3}(2{f}_{u}^{4}-4{f}_{u}^{3}+3{f}_{u}^{2}-{f}_{u}+1)-\tfrac{21}{2}{f}_{n}^{6}(2{f}_{u}-1){}^{3}(4{f}_{u}^{4}-8{f}_{u}^{3}+6{f}_{u}^{2}-2{f}_{u}+1)$
		$+\tfrac{21}{2}{f}_{n}^{5}(2{f}_{u}-1){}^{3}(12{f}_{u}^{4}-24{f}_{u}^{3}+18{f}_{u}^{2}-6{f}_{u}+1)-105{f}_{n}^{4}{f}_{u}(2{f}_{u}-1){}^{3}(2{f}_{u}^{3}-4{f}_{u}^{2}+3{f}_{u}-1)$
		$+\tfrac{7}{2}{f}_{n}^{3}(2{f}_{u}-1){}^{3}(60{f}_{u}^{4}-120{f}_{u}^{3}+90{f}_{u}^{2}-30{f}_{u}-1)-63{f}_{n}^{2}{f}_{u}(2{f}_{u}-1){}^{3}(2{f}_{u}^{3}-4{f}_{u}^{2}+3{f}_{u}-1)$
		$+21{f}_{n}{f}_{u}(2{f}_{u}-1){}^{3}(2{f}_{u}^{3}-4{f}_{u}^{2}+3{f}_{u}-1)+{f}_{u}^{2}(-48{f}_{u}^{5}+168{f}_{u}^{4}-252{f}_{u}^{3}+210{f}_{u}^{2}-98{f}_{u}+21)$
Psucc(fn)	=	1

Table C2.  Logical error rate for the Golay-code.

	Golay code[47] assuming ${\bar{f}}_{u}\approx \tfrac{{p}_{w}}{2}$
${\bar{f}}_{u}({f}_{u},{f}_{n})$ =	$\tfrac{1}{2}\left(-\tfrac{{f}_{n}^{23}}{4096}+\tfrac{23({f}_{n}+{f}_{u}-1){f}_{n}^{22}}{2048}-\tfrac{253({f}_{n}+{f}_{u}-1){}^{2}{f}_{n}^{21}}{1024}+\tfrac{1771}{512}({f}_{n}+{f}_{u}-1){}^{3}{f}_{n}^{20}-\tfrac{8855}{256}({f}_{n}+{f}_{u}-1){}^{4}{f}_{n}^{19}\right.$
	$+\tfrac{33649}{128}({f}_{n}+{f}_{u}-1){}^{5}{f}_{n}^{18}-\tfrac{100947}{64}({f}_{n}+{f}_{u}-1){}^{6}{f}_{n}^{17}+\tfrac{245157}{32}({f}_{n}+{f}_{u}-1){}^{7}{f}_{n}^{16}-30613({f}_{n}+{f}_{u}-1){}^{8}{f}_{n}^{15}$
	$-\tfrac{253}{16}({f}_{n}-1)({f}_{n}+{f}_{u}-1){}^{7}{f}_{n}^{15}+101200({f}_{n}+{f}_{u}-1){}^{9}{f}_{n}^{14}$
	$+\tfrac{3795}{8}({f}_{n}-1)({f}_{n}+{f}_{u}-1){}^{8}{f}_{n}^{14}-272734({f}_{n}+{f}_{u}-1){}^{10}{f}_{n}^{13}-\tfrac{26565}{4}({f}_{n}-1)({f}_{n}+{f}_{u}-1){}^{9}{f}_{n}^{13}$
	$+560924({f}_{n}+{f}_{u}-1){}^{11}{f}_{n}^{12}+\tfrac{115115}{2}({f}_{n}-1)({f}_{n}+{f}_{u}-1){}^{10}{f}_{n}^{12}-695520({f}_{n}+{f}_{u}-1){}^{12}{f}_{n}^{11}$
	$-319424({f}_{n}-1)({f}_{n}+{f}_{u}-1){}^{11}{f}_{n}^{11}+\tfrac{8855}{2}({f}_{n}+{f}_{u}-1){}^{11}(-{f}_{n}+2{f}_{u}+1){f}_{n}^{11}$
	$+949256({f}_{n}-1)({f}_{n}+{f}_{u}-1){}^{12}{f}_{n}^{10}-97405({f}_{n}+{f}_{u}-1){}^{12}(-{f}_{n}+2{f}_{u}+1){f}_{n}^{10}$
	$+779240({f}_{n}+{f}_{u}-1){}^{13}(-{f}_{n}+2{f}_{u}+1){f}_{n}^{9}\quad +\quad 18975({f}_{n}+{f}_{u}-1){}^{13}(-{f}_{n}+6{f}_{u}+1){f}_{n}^{9}$
	$-485760({f}_{n}+{f}_{u}-1){}^{14}(-{f}_{n}+6{f}_{u}+1){f}_{n}^{8}-2277({f}_{n}+{f}_{u}-1){}^{14}(-{f}_{n}+14{f}_{u}+1){f}_{n}^{8}$
	$+32384({f}_{n}+{f}_{u}-1){}^{15}(-{f}_{n}+14{f}_{u}+1){f}_{n}^{7}+\tfrac{253}{2}({f}_{n}-1)({f}_{n}+{f}_{u}-1){}^{14}(-{f}_{n}+14{f}_{u}+1){f}_{n}^{7}$
	$+212520({f}_{n}+{f}_{u}-1){}^{14}(-({f}_{n}-1){}^{2}\quad +\quad 10{f}_{u}({f}_{n}-1)+8{f}_{u}^{2}){f}_{n}^{7}$
	$-100947({f}_{n}-1)({f}_{n}+{f}_{u}-1){}^{15}(-{f}_{n}+14{f}_{u}+1){f}_{n}^{6}$
	$-28336({f}_{n}+{f}_{u}-1){}^{16}(-{f}_{n}+2{f}_{u}+1)(-{f}_{n}+14{f}_{u}+1){f}_{n}^{5}$
	$-5313({f}_{n}+{f}_{u}-1){}^{16}(({f}_{n}-1){}^{2}-15{f}_{u}({f}_{n}-1)+30{f}_{u}^{2}){f}_{n}^{5}$
	$+8855({f}_{n}+{f}_{u}-1){}^{17}(({f}_{n}-1){}^{2}-17{f}_{u}({f}_{n}-1)+90{f}_{u}^{2}){f}_{n}^{4}$
	$-1771({f}_{n}+{f}_{u}-1){}^{17}(({f}_{n}-1){}^{3}-17{f}_{u}({f}_{n}-1){}^{2}\quad +\quad 138{f}_{u}^{2}({f}_{n}-1)+96{f}_{u}^{3}){f}_{n}^{3}$
	$-253({f}_{n}+{f}_{u}-1){}^{18}(-({f}_{n}-1){}^{3}\quad +\quad 18{f}_{u}({f}_{n}-1){}^{2}-171{f}_{u}^{2}({f}_{n}-1)+90{f}_{u}^{3}){f}_{n}^{2}$
	$+23({f}_{n}+{f}_{u}-1){}^{19}(-({f}_{n}-1){}^{3}\quad +\quad 19{f}_{u}({f}_{n}-1){}^{2}-190{f}_{u}^{2}({f}_{n}-1)+560{f}_{u}^{3}){f}_{n}+({f}_{n}+{f}_{u}-1){}^{23}$
	$-23{f}_{u}({f}_{n}+{f}_{u}-1){}^{22}+253{f}_{u}^{2}({f}_{n}+{f}_{u}-1){}^{21}-1771{f}_{u}^{3}({f}_{n}+{f}_{u}-1){}^{20}+1)$
Psucc =	1

Given a graph G = (V, E) with vertices V and edges E. The state $| G\rangle$ is stabilised by the generators of the stabiliser g_i ($i=1,\ldots ,| V|$).The repeater network that creates the graph state $| G\rangle$ is obtained by replacing each edge (i, j) in E by a line graph with w_ij additional vertices (the repeater stations). Let us assume that w_ij is even, for simplicity. All repeater stations are measured in the $\bar{X}$ basis. This projects onto a state that is stabilised by the g_i up to byproduct operators that depend on the measurement outcomes. Thus after application of the byproduct operators ${g}_{i}| G\rangle =| G\rangle$ holds. A flip of one measurement outcome on the ith main stabiliser (g_i connected by chains of X-operators) leads to ${g}_{i}| G\rangle =-| G\rangle$. The same holds for $\bar{X}$ errors on the neighbours of party i or a Z error on the qubit of party i. The corresponding error probability is f_i. We denote the probability for the wrong sign in the stabiliser equation of g_i by e_i. It is

$$\begin{eqnarray}&&{e}_{i}={\tilde{P}}_{\mathrm{odd}}\left(\left({P}_{\mathrm{odd}}\left({\bar{f}}_{u},\displaystyle \sum _{j}{w}_{{ij}}\right),{f}_{i},{f}_{j}| (i,j)\in E\right)\right).\end{eqnarray} \tag{ D1 }$$

In analogy to equations (14) and (16) of the article one can estimate the error rate

$$\begin{eqnarray}&&{f}_{i,u}={\tilde{P}}_{\mathrm{odd}}\left(\left({P}_{\mathrm{odd}}\left(\displaystyle \frac{{f}_{P,u}}{2},1+{\mathrm{deg}}^{-}(i)\right),\right.\right.\\ &&\quad {P}_{\mathrm{odd}}\left(\displaystyle \frac{{f}_{P,n}+{f}_{P,u}}{2},{\mathrm{deg}}^{+}(i)\right),\\ &&\quad {P}_{\mathrm{odd}}\left(\displaystyle \frac{{f}_{G,u}}{2},1+\mathrm{deg}(i)\right),\\ &&\quad {P}_{\mathrm{odd}}\left(\left.\left.\displaystyle \frac{{f}_{T,u}}{2},1+{\mathrm{deg}}^{-}(i)\right),\displaystyle \frac{{f}_{M,u}}{2}\right)\right)\end{eqnarray} \tag{ D2 }$$

and

$$\begin{eqnarray}&&{f}_{i,n}=1-{(1-{f}_{P,n})}^{1+{\mathrm{deg}}^{-}(i)}{(1-{f}_{G,n})}^{1+\mathrm{deg}(i)}\\ &&\quad {(1-{f}_{T,n})}^{1+{\mathrm{deg}}^{-}(i)}{(1-{f}_{M,n})}^{1+{\mathrm{deg}}^{-}(i)},\end{eqnarray} \tag{ D3 }$$

where $\mathrm{deg}(i)$, ${\mathrm{deg}}^{-}(i)$, and ${\mathrm{deg}}^{+}(i)$ are the degree, in-degree, and out-degree of vertex i, respectively. From these physical error rates one can calculate the logical error rate in analogy to ${\bar{f}}_{u}$, i.e. ${\bar{f}}_{i}={\bar{f}}_{u}({f}_{u}={f}_{i,u},{f}_{n}={f}_{i,n})$.