Multi-partite entanglement can speed up quantum key distribution in networks

The entanglement-based Ekert protocol [7] can be generalised to N parties as follows, see also [31, 34]. The parties A and B₁, B₂, ..., ${B}_{N-1}$ share an N-partite entangled state and perform local projective measurements. The best performance in the ideal (noiseless) case is ensured if one requires that the measurement outcomes of all parties are perfectly correlated for one set of local bases—which we can choose without loss of generality to be the Z-bases—and occur with a uniform distribution. The only pure N-qubit quantum state that fulfils these requirements is the GHZ state [35]; however, for $N\geqslant 3$, the existence of perfect correlations in one set of bases forbids perfect correlations (even only pairwise) in any other bases, see appendix A. We remark that other protocols with less than perfectly correlated resource states are possible, but will introduce intrinsic errors [36].

1.1. The protocol for N-party quantum conference key distribution

1.2. N-party prepare-and-measure schemes

We now sketch two different prepare-and-measure schemes for conference key distribution.

(1) Preparing and measuring single qubits: Single qubits are experimentally easier to prepare and to distribute than entangled states. Thus, establishing a conference key for N parties by using single qubits is an interesting possibility, which has been studied for the case N = 3 in [38].

The protocol proceeds in complete analogy to the case of N = 2, e.g. for BB84 [5]: Alice prepares randomly $N-1$ copies of a state $| {\phi }_{k}\rangle ,k=1,\,\ldots \,4,$ taken from the set ${S}_{{\rm{BB}}84}=\{| 0\rangle ,| 1\rangle ,| +\rangle ,| -\rangle \}$, with $| \pm \rangle =1/\sqrt{2}(| 0\rangle \pm | 1\rangle )$. She sends each party B_i, with $i=1,\,\ldots ,\,N$, one of the copies. Each party B_i measures in the Z- or X-basis. In the sifting step, the N parties keep only those cases where all parties used the same basis, and thus establish a joint key.

We point out, however, that the secret key rate in this scenario decreases with increasing N, even for perfect channels and measurements, and goes to zero for $N\to \infty$: an eavesdropper can eavesdrop on all $N-1$ sent states at the same time, i.e. she has to distinguish the four global states $| {\phi }_{k}{\rangle }^{\otimes (N-1)}$, pairs of which have either overlap 0 or ${(1/\sqrt{2})}^{N-1}$, i.e. the distinguishability increases with increasing N. In the limit of infinite N the four global states are orthogonal and therefore perfectly distinguishable.

Thus, this prepare-and-measure-scheme is (for $N\geqslant 3$) not equivalent to entanglement-based NQKD as described in the present article.

(2) Prepare-and-measure equivalent of NQKD: The entanglement-based protocol NQKD described above can be formulated as a prepare-and-measure protocol, analogous to the six-state protocol [8]. Instead of producing the GHZ state of equation (1) and measuring her qubit afterwards, Alice can directly produce the ($N-1$)-qubit projection of the GHZ state according to her fictitious, random outcome. Thus, for the X-, Y- and Z-basis, the six different $(N-1)$-qubit states she distributes among the Bobs, are

$$\begin{eqnarray}| {\psi }_{x,\pm }\rangle & = & \displaystyle \frac{1}{\sqrt{2}}(| 00...0\rangle \pm | 11...1\rangle ),\\ | {\psi }_{y,\pm }\rangle & = & \displaystyle \frac{1}{\sqrt{2}}(| 00...0\rangle \mp i| 11...1\rangle ),\\ | {\psi }_{z,0}\rangle & = & | 00...0\rangle {\rm{}}\,{\rm{and}}\,{\rm{}}| {\psi }_{z,1}\rangle =| 11...1\rangle .\end{eqnarray} \tag{ 2 }$$

This protocol is equivalent to NQKD, because it reproduces the correlations between A, B₁, ... ${B}_{N-1}$. Note that the six-state protocol is included as the special case N = 2. The described protocol uses $(N-1)$-partite entanglement for four of the sent states, which are, however, sent much less frequent than the two product states. This fact renders an experimental implementation of our protocol more realistic than the entanglement-based description might suggest.

In the remainder of this article we use the equivalent entanglement-based description of the NQKD protocol.

1.3. Security analysis of the N-party QKD

The composable security definition of the bipartite scenario [16, 17] can be generalised in an analogous way to the N-partite case. Our security analysis proceeds along analogous lines as the bipartite case in [33]. See appendix B for explicit details of these generalisations. By employing this security definition and using one-way communication only, we prove secrecy of the key under the most general eavesdropping attack allowed by the laws of quantum mechanics, so-called coherent attacks [39, 40], independent of the context in which the key is used.

In the asymptotic limit, i.e. for infinitely many rounds, the secret fraction r_∞, i.e. the ratio of secret bits and the number of shared states (without parameter estimation rounds), is given by

$$\begin{eqnarray}&&{r}_{\infty }=\mathop{\sup }\limits_{U\leftarrow K}\mathop{\inf }\limits_{{\sigma }_{A\{{B}_{i}\}}\in {\rm{\Gamma }}}\left[S(U| E)-\mathop{\max }\limits_{i\in \{1,\ldots N-1\}}H(U| {K}_{i})\right],\end{eqnarray} \tag{ 3 }$$

where $U\leftarrow K$ denotes a bitwise preprocessing channel on Alice's raw key bit K, $S(U| E)$ is the conditional von-Neumann entropy of the (classical) key variable, given the state of Eve's system E, $H(U| {K}_{i})$ is the conditional Shannon entropy of U given K_i, which is B_i's guess of K, and Γ is the set of all density matrices ${\sigma }_{A\{{B}_{i}\}}$ of Alice and the Bobs which are consistent with the parameter estimation. The secret key rate is

$$\begin{eqnarray}&&R={r}_{\infty }{R}_{\mathrm{rep}},\end{eqnarray} \tag{ 4 }$$

where the repetition rate ${R}_{\mathrm{rep}}=\tfrac{1}{{t}_{\mathrm{rep}}}$ is given by the time ${t}_{\mathrm{rep}}$ that one round (steps 1 and 2) takes. For now we set ${t}_{\mathrm{rep}}=1$. The secret key rate in equation (4) as a figure of merit does not directly account for the amount of needed local randomness, classical communication, qubits and gates. Depending on the context one might want to incorporate one or more of the former quantities into a cost-performance ratio as a figure of merit [41].

Note that we have not assumed any symmetry about the quality of the channels connecting A and B_i. Therefore, the worst-case information leakage in the error correction step is determined by the noisiest channel, see the maximisation in the last term of equation (3). This is the main difference with respect to the bipartite case.

1.4. The secret key rate

We now derive an analytical formula for the multipartite secret key rate based on a variant of the method of depolarisation [33, 42]. In practice, the described depolarisation operations will be applied to the classical data only, as described in detail below. Readers who are not interested in the technical details can skip to equation (23).

Let us denote the GHZ basis of N qubits as follows:

$$\begin{eqnarray}&&| {\psi }_{j}^{\pm }\rangle =\displaystyle \frac{1}{\sqrt{2}}(| 0\rangle | j\rangle \pm | 1\rangle | \bar{j}\rangle ),\end{eqnarray} \tag{ 5 }$$

where j takes the values $0,\,\ldots ,\,{2}^{N-1}-1$ in binary notation, and $\bar{j}$ denotes the binary negation of j; i.e. for example if j = 01101 then $\bar{j}=10010$.

Remember that any state of N qubits can be depolarised to a state which is diagonal in the GHZ basis by a sequence of local operations [43, 44]. In our protocol we introduce the following extended depolarisation procedure. The set of depolarisation operators is

$$\begin{eqnarray}&&{ \mathcal D }=\{{X}^{\otimes N}\}\cup \{{Z}_{A}{Z}_{{B}_{j}}| 1\leqslant j\leqslant N-1\}\cup \{{R}_{k}| 1\leqslant k\leqslant N-1\},\end{eqnarray} \tag{ 6 }$$

where X and Z are Pauli operators and

$$\begin{eqnarray}&&{R}_{k}=\mathrm{diag}{(1,i)}_{A}\otimes \mathrm{diag}{(1,-i)}_{{B}_{k}}.\end{eqnarray} \tag{ 7 }$$

The parties apply each of these operators with probability 1/2 or ${\mathbb{1}}$ else. The operators from the first two sets of equation (6) make the density matrix GHZ diagonal as in [43, 44]. We denote the coefficient in front of $| {\psi }_{j}^{\sigma }\rangle \langle {\psi }_{j}^{\sigma }|$ by ${\lambda }_{j}^{\sigma }$ with $\sigma \in \{+,\,-\}$ and $j\in \{0,1,\,\ldots ,\,{2}^{N-1}-1\}$. The effect of R_k is

$$\begin{eqnarray}{R}_{k}| {\psi }_{j}^{\sigma }\rangle =\left\{\begin{array}{ll}| {\psi }_{j}^{\sigma }\rangle , & {\rm{if}}\,{\rm{}}{j}^{(k)}=0,\\ -i| {\psi }_{j}^{-\sigma }\rangle , & {\rm{if}}\,{\rm{}}{j}^{(k)}=1\end{array}\right.\end{eqnarray} \tag{ 8 }$$

so applying this operator with probability $\tfrac{1}{2}$ transforms

$$\begin{eqnarray}{\lambda }_{j}^{\sigma }\to \left\{\begin{array}{ll}{\lambda }_{j}^{\sigma }, & {\rm{if}}\,{\rm{}}{j}^{(k)}=0,\\ \tfrac{1}{2}({\lambda }_{j}^{-\sigma }+{\lambda }_{j}^{\sigma }), & {\rm{if}}\,{\rm{}}{j}^{(k)}=1,\end{array}\right.\end{eqnarray} \tag{ 9 }$$

where ${j}^{(k)}$ denotes the kth bit of the string j. As this operation is applied for all $k=1,2,\,\ldots ,\,N-1$, it achieves that

$$\begin{eqnarray}&&{\lambda }_{j}^{+}={\lambda }_{j}^{-}{\rm{}}\,{\rm{for}}\,{\rm{all}}\,{\rm{}}j\gt 0.\end{eqnarray} \tag{ 10 }$$

The resulting depolarised state reads

$$\begin{eqnarray}&&{\rho }_{{\rm{dep}}}={\lambda }_{0}^{+}| {\psi }_{0}^{+}\rangle \langle {\psi }_{0}^{+}| +{\lambda }_{0}^{-}| {\psi }_{0}^{-}\rangle \langle {\psi }_{0}^{-}| +\displaystyle \sum _{j=1}^{{2}^{N-1}-1}{\lambda }_{j}(| {\psi }_{j}^{+}\rangle \langle {\psi }_{j}^{+}| +| {\psi }_{j}^{-}\rangle \langle {\psi }_{j}^{-}| ).\end{eqnarray} \tag{ 11 }$$

In our multipartite scenario we define the qubit error rate (QBER) Q_Z to be the probability that at least one Bob obtains a different outcome than Alice in a Z-basis measurement. Note that this value is not the same as the bipartite qubit error rate ${Q}_{{{AB}}_{i}}$, which is the probability that the Z-measurement outcome of B_i disagrees with the one of Alice. Q_Z can be read directly from the structure of the depolarised state in equation (11) and is given by

$$\begin{eqnarray}&&{Q}_{Z}=1-{\lambda }_{0}^{+}-{\lambda }_{0}^{-}.\end{eqnarray} \tag{ 12 }$$

For simplicity we neglect the possibility of increasing the key rate by adding pre-processing noise, i.e. we set q = 0 in the notation of [33] such that ${\bf{U}}={\bf{K}}$. Because

$$\begin{eqnarray}S(K| E) & = & S(E| K)-S(E)+H(K)\\ {\rm{and}}\,{\rm{}}H(K| {K}_{i}) & = & H({K}_{i}| K)-H({K}_{i})+H(K)\end{eqnarray} \tag{ 13 }$$

the asymptotic secret fraction is

$$\begin{eqnarray}&&{r}_{\infty }=S(E| K)-S(E)-\mathop{\max }\limits_{1\leqslant i\leqslant N-1}(H({K}_{i}| K)-H({K}_{i})).\end{eqnarray} \tag{ 14 }$$

Note that we did not need to include the infimum over Γ, see equation (3), here because, as we will see below, the measurement statistics completely determine all relevant quantities in our protocol. The entropies involving the classical random variable K are directly obtained from the measurement statistics in the parameter estimation phase. They are given by

$$\begin{eqnarray}&&H(K| {K}_{i})=h({Q}_{{{AB}}_{i}}),\end{eqnarray} \tag{ 15 }$$

with the binary Shannon entropy

$$\begin{eqnarray}&&h(p)=-p{\mathrm{log}}_{2}p-(1-p){\mathrm{log}}_{2}(1-p)\end{eqnarray} \tag{ 16 }$$

and the bipartite error rate ${Q}_{{{AB}}_{i}}$, given by

$$\begin{eqnarray}&&{Q}_{{{AB}}_{i}}=\displaystyle \sum _{\displaystyle \genfrac{}{}{0em}{}{j}{{j}^{(i)}=1}}\displaystyle \sum _{\sigma =\pm }{\lambda }_{j}^{\sigma }\mathop{=}\limits^{{\rm{Eq}}.\ (10)}2\displaystyle \sum _{\displaystyle \genfrac{}{}{0em}{}{j}{{j}^{(i)}=1}}{\lambda }_{j},\end{eqnarray} \tag{ 17 }$$

where ${j}^{(i)}$ denotes the ith bit of j and, because both outcomes are equiprobable,

$$\begin{eqnarray}&&H({K}_{i})=1.\end{eqnarray} \tag{ 18 }$$

Giving Eve the purification of equation (11), the von-Neumann entropies involving Eve's system in equation (14) are given by

$$\begin{eqnarray}S(E| K) & = & \displaystyle \frac{1}{2}S(E| K=0)+\displaystyle \frac{1}{2}S(E| K=1)\\ & = & -\displaystyle \sum _{i=0}^{{2}^{N-1}-1}({\lambda }_{i}^{+}+{\lambda }_{i}^{-}){\mathrm{log}}_{2}({\lambda }_{i}^{+}+{\lambda }_{i}^{-})\\ & \mathop{=}\limits^{{\rm{Eq}}.\ (10)} & -(1-{Q}_{Z}){\mathrm{log}}_{2}(1-{Q}_{Z})-2\displaystyle \sum _{i=1}^{{2}^{N-1}-1}{\lambda }_{i}{\mathrm{log}}_{2}({\lambda }_{i})-{Q}_{Z}\end{eqnarray} \tag{ 19 }$$

and

$$\begin{eqnarray}S(E) & = & S\left(\displaystyle \frac{1}{2}({\sigma }_{E}^{0}+{\sigma }_{E}^{1})\right)=-\displaystyle \sum _{j,\sigma =\pm }{\lambda }_{j}^{\sigma }{\mathrm{log}}_{2}{\lambda }_{j}^{\sigma }\\ & \mathop{\begin{array}{c}=\end{array}}\limits^{{\rm{E}}{\rm{q}}.\,(10)} & -{\lambda }_{0}^{+}{\mathrm{log}}_{2}{\lambda }_{0}^{+}-{\lambda }_{0}^{-}{\mathrm{log}}_{2}{\lambda }_{0}^{-}-2\displaystyle \sum _{j\gt 0}{\lambda }_{j}{\mathrm{log}}_{2}{\lambda }_{j},\end{eqnarray} \tag{ 20 }$$

i.e.

$$\begin{eqnarray}&&S(E| K)-S(E)=-{Q}_{Z}-(1-{Q}_{Z}){\mathrm{log}}_{2}(1-{Q}_{Z})+{\lambda }_{0}^{+}{\mathrm{log}}_{2}{\lambda }_{0}^{+}+(1-{Q}_{Z}-{\lambda }_{0}^{+}){\mathrm{log}}_{2}(1-{Q}_{Z}-{\lambda }_{0}^{+}).\end{eqnarray} \tag{ 21 }$$

Now ${\lambda }_{0}^{+}$ and ${\lambda }_{0}^{-}$ can be obtained with the additional ${X}^{\otimes N}$ measurement in the parameter estimation, because ${\lambda }_{0}^{+}+{\lambda }_{0}^{-}=1-{Q}_{Z}=\mathrm{tr}({\rho }_{\mathrm{dep}}(| 0\rangle {\langle 0| }^{\otimes N}+| 1\rangle {\langle 1| }^{\otimes N}))$ is known from the QBER and $\mathrm{tr}({\rho }_{\mathrm{dep}}{X}^{\otimes N})\,={\sum }_{j}({\lambda }_{j}^{+}-{\lambda }_{j}^{-})={\lambda }_{0}^{+}-{\lambda }_{0}^{-}$. In analogy to Q_Z we denote the probability that the X-measurement gives an unexpected result, i.e. one that is incompatible with the noiseless state, by Q_X. Because $\langle {\psi }_{j}^{\sigma }| {X}^{\otimes N}| {\psi }_{j}^{\sigma }\rangle =\sigma$ this leads to

$$\begin{eqnarray}&&{Q}_{X}=\displaystyle \frac{1-\langle {X}^{\otimes N}{\rangle }_{\mathrm{dep}}}{2},\end{eqnarray} \tag{ 22 }$$

which can, as we will see in section 2.2, be obtained from the measured data in the parameter estimation step. We remark that Q_X is not the probability that at least one Bob gets a different X-measurement outcome than Alice, as the outcomes are not correlated, see appendix A.

Finally, inserting equation (21) into equation (14), and using equation (4), we arrive at the achievable secret key rate,

$$\begin{eqnarray}R & = & \left(1-\displaystyle \frac{{Q}_{Z}}{2}-{Q}_{X}\right){\mathrm{log}}_{2}\left(1-\displaystyle \frac{{Q}_{Z}}{2}-{Q}_{X}\right)+\left({Q}_{X}-\displaystyle \frac{{Q}_{Z}}{2}\right){\mathrm{log}}_{2}\left({Q}_{X}-\displaystyle \frac{{Q}_{Z}}{2}\right)\\ & & +(1-{Q}_{Z})(1-{\mathrm{log}}_{2}(1-{Q}_{Z}))-h\left(\mathop{\max }\limits_{1\leqslant i\leqslant N-1}{Q}_{{{AB}}_{i}}\right).\end{eqnarray} \tag{ 23 }$$

Note that the parameters in this equation are obtained from the measured data and will depend on the number of parties N.

In this section we compare the multipartite-entanglement-based protocol (NQKD) as introduced above to a protocol based on bipartite entanglement (2QKD), which we define in the following.

2.1. Conference key distribution with bipartite entangled quantum states (2QKD)

2.2. Implementation of the NQKD protocol

We now describe how the depolarisation operations used in the security proof can effectively be implemented classically by adjusting the protocol.

For key generation and the Q_Z estimation, the parties perform ${Z}^{\otimes N}$-measurements. These are only affected by the ${X}^{\otimes N}$ depolarisation operator, which flips the outcomes of all parties. It can therefore be implemented on the classical data. The other depolarisation operators are diagonal in the Z-basis and thus do not change the Z-measurement outcome.

Let us call the parameter estimation rounds, in which the parties measure ${X}^{\otimes N}$ (after depolarisation), estimation rounds of the second type. How the depolarisation step affects the ${X}^{\otimes N}$-measurement is not so obvious and is described in the following.

Note that the depolarisation operators ${X}^{\otimes N}$ and ${Z}_{A}{Z}_{{B}_{k}}$, $k=1,2,\,\ldots ,\,N-1$ (see equation (6)), commute with the ${X}^{\otimes N}$-measurement and thus these depolarisation operators do not have an effect in second type rounds. But

$$\begin{eqnarray}&&{R}_{k}{X}_{A}{X}_{{B}_{k}}{R}_{k}^{\dagger }=(-{Y}_{A}){Y}_{{B}_{k}}\end{eqnarray} \tag{ 24 }$$

i.e. applying the depolarisation operator R_k is equivalent to Bob k measuring in Y-basis. Also note that

$$\begin{eqnarray}&&{R}_{k}(-{Y}_{A}){X}_{{B}_{k}}{R}_{k}^{\dagger }=(-{X}_{A}){Y}_{{B}_{k}},\end{eqnarray} \tag{ 25 }$$

so let ${\kappa }_{j}$ be the number of Bobs measuring in Y-basis in the jth round, then Alice measures in the basis

$$\begin{eqnarray}{M}_{A}(\kappa )=\left\{\begin{array}{ll}{X}_{A}, & {\rm{if}}\,{\rm{}}{\kappa }_{j}\mathrm{mod}\,4=0,\\ -{Y}_{A}, & {\rm{if}}\,{\rm{}}{\kappa }_{j}\mathrm{mod}\,4=1,\\ -{X}_{A}, & {\rm{if}}\,{\rm{}}{\kappa }_{j}\mathrm{mod}\,4=2,\\ {Y}_{A}, & {\rm{if}}\,{\rm{}}{\kappa }_{j}\mathrm{mod}\,4=3,\end{array}\right.\end{eqnarray} \tag{ 26 }$$

where a minus sign corresponds to a flip of the measurement outcome. Note that this measurement rule for Alice implies that always an even number of parties measures in Y-basis and that the outcome of the measurement is flipped whenever it is not a multiple of four. Each party measures in X or Y basis with probability 1/2. Note that the rule for M_A described above means that only half of all possible combinations of these measurement bases are actually measured. However, in practice the parties can measure X and Y independently with probability 1/2 and throw away half of their data (where an odd number of parties has measured in Y-basis) and Alice still flips her measurement outcome whenever the number of parties measuring in Y-basis was not a multiple of four. This is not a problem, because in the parameter estimation rounds each party announces its measurement setting and outcome. We thus arrive at the implementation described initially. Let ${\tilde{\kappa }}_{j}$ be the number of parties measuring in Y-basis in run j, i.e.

$$\begin{eqnarray}{\tilde{\kappa }}_{j}=\left\{\begin{array}{ll}{\kappa }_{j}+1, & {\rm{if}}\,{\rm{Alice}}\,{\rm{measured}}\,{\rm{in}}\,{\rm{}}Y \mbox{-} \mathrm{basis},\\ {\kappa }_{j}, & {\rm{else}}\end{array}\right.\end{eqnarray} \tag{ 27 }$$

then

$$\begin{eqnarray}&&\langle {X}^{\otimes N}{\rangle }_{\mathrm{dep}}=\mathop{\mathrm{lim}}\limits_{{\rm{\#exp}}\to \infty }\displaystyle \frac{1}{{\rm{\#exp}}}\displaystyle \sum _{j=1}^{{\rm{\#exp}}}f({\tilde{\kappa }}_{j})\displaystyle \prod _{i=1}^{N}{a}_{i,j}\end{eqnarray} \tag{ 28 }$$

$$\begin{eqnarray}&&=\mathop{\mathrm{lim}}\limits_{{\rm{\#exp}}\to \infty }\displaystyle \frac{{n}_{+}-{n}_{-}}{{n}_{+}+{n}_{-}},\end{eqnarray} \tag{ 29 }$$

where #exp is the number of experiments in the second type rounds with even ${\tilde{\kappa }}_{j}$, ${a}_{i,j}$ is the outcome of party i in experiment j,

$$\begin{eqnarray}f(\tilde{\kappa })=\left\{\begin{array}{ll}0, & {\rm{if}}\,{\rm{}}{\tilde{\kappa }}_{j}\ \mathrm{odd},\\ 1, & {\rm{if}}\,{\rm{}}{\tilde{\kappa }}_{j}\mathrm{mod}\,4=0,\\ -1, & {\rm{else}}\end{array}\right.\end{eqnarray} \tag{ 30 }$$

and

$$\begin{eqnarray}&&{n}_{\pm }=\displaystyle \frac{1}{2}{\rm{\#exp}}\pm \displaystyle \frac{1}{2}\displaystyle \sum _{j=1}^{{\rm{\#exp}}}f(\tilde{\kappa })\displaystyle \prod _{i=1}^{N}{a}_{i,j}.\end{eqnarray} \tag{ 31 }$$

We remark that, in contrast to full tomography, the number of rounds needed to get sufficient statistics for estimating $\langle {X}^{\otimes N}{\rangle }_{\mathrm{dep}}$ does not increase with the number of parties N.

Let us summarise the steps of an implementation of the NQKD protocol:

• 1.  
  Distribution of the state GHZ state $| {\psi }_{0}^{+}\rangle$.
• 2.  
  $L\cdot h({p}_{p})$ bits of pre-shared key are used to mark the second type rounds, where L is the total number of rounds and p_p is the probability for an ${X}^{\otimes N}$-round. This amount of key suffices, because an L-bit binary string with a 1 for each second type round can asymptotically be compressed to $L\cdot h({p}_{p})$ bits.
• 3.  
  In each second type round each party measures randomly in the X- or Y-basis.
• 4.  
  In all other cases all parties measure in Z-direction.
• 5.  
  Parameter estimation:

  • (a)  
    Alice announces a randomly chosen small subset of size $L\cdot h({p}_{p})$ of Z-measurement rounds, in which all parties announce their Z-measurement results. From this data the QBER Q_Z and the individual QBER's ${Q}_{{{AB}}_{i}}$ are estimated.
  • (b)  
    The parties announce the measurement results of the second type rounds together with the chosen measurement basis. Alice flips her outcome if the number of parties who measured in Y-basis is not a multiple of four (see equation (30)). From the data where an even number of parties measured in Y-basis (including zero), the parameter Q_X is calculated according to equation (29).
• 6.  
  Alice announces which Z-measurement results all parties have to flip (the probability for each bit is 1/2). This effectively implements the depolarisation with operator ${X}^{\otimes N}$.
• 7.  
  Classical post-processing:

  • (a)  
    Alice sends error correction information (for ${\max }_{i}{Q}_{{{AB}}_{i}}$) to all Bobs, which perform the error correction.
  • (b)  
    In privacy amplification the parties obtain the key by applying a two-universal hash function, which was chosen randomly by Alice, to the error corrected data.
• 8.  
  The achievable key rate is then given by equation (23).

2.3. Example of depolarising noise

In this section we assume that ${\rho }_{{{AB}}_{1}...{B}_{N-1}}$ is a mixture of the GHZ-state and white noise, i.e. the parties share the state

$$\begin{eqnarray}&&\rho ={\lambda }_{0}^{+}| {\psi }_{0}^{+}\rangle \langle {\psi }_{0}^{+}| +\displaystyle \frac{1-{\lambda }_{0}^{+}}{{2}^{N}-1}({\mathbb{1}}-| {\psi }_{0}^{+}\rangle \langle {\psi }_{0}^{+}| ).\end{eqnarray} \tag{ 32 }$$

Here all coefficients other than ${\lambda }_{0}^{+}$ are equal, i.e. ${\lambda }_{j}^{\pm }={\lambda }_{0}^{-}={Q}_{Z}/({2}^{N}-2)$ for $j=1,\,\ldots ,\,{2}^{(N-1)}-1$ and ${\lambda }_{0}^{+}=1-{Q}_{Z}\tfrac{{2}^{N}-1}{{2}^{N}-2}$. The rate of unexpected results for the ${X}^{\otimes N}$-measurement is thus given by

$$\begin{eqnarray}&&{Q}_{X}=\displaystyle \frac{{2}^{N-2}}{{2}^{N-1}-1}{Q}_{Z}.\end{eqnarray} \tag{ 33 }$$

For the highly symmetric state of equation (32) the key rate is then a function of Q_Z and N only. The terms in equation (14) are

$$\begin{eqnarray}&&{Q}_{{{AB}}_{i}}=\displaystyle \frac{{2}^{N-1}}{{2}^{N}-2}{Q}_{Z},\end{eqnarray} \tag{ 34 }$$

$$\begin{eqnarray}&&S(E| U)=-(1-{Q}_{Z}){\mathrm{log}}_{2}(1-{Q}_{Z})-{Q}_{Z}{\mathrm{log}}_{2}\displaystyle \frac{2{Q}_{Z}}{{2}^{N}-2}\end{eqnarray} \tag{ 35 }$$

$$\begin{eqnarray}{\rm{and}}\,{\rm{}}S(E) & = & -\left(1-{Q}_{Z}\displaystyle \frac{{2}^{N}-1}{{2}^{N}-2}\right){\mathrm{log}}_{2}\left(1-{Q}_{Z}\displaystyle \frac{{2}^{N}-1}{{2}^{N}-2}\right)\\ & & -({2}^{N}-1)\displaystyle \frac{{Q}_{Z}}{{2}^{N}-2}{\mathrm{log}}_{2}\left(\displaystyle \frac{{Q}_{Z}}{{2}^{N}-2}\right)\end{eqnarray} \tag{ 36 }$$

and inserting them into equation (14) leads to the asymptotic secret key rate as function of $Q={Q}_{Z}$ and N, namely

$$\begin{eqnarray}&&R(Q,N)=1+h(Q)-h\left(Q\displaystyle \frac{{2}^{N}-1}{{2}^{N}-2}\right)-h\left(Q\displaystyle \frac{{2}^{N-1}}{{2}^{N}-2}\right)+\left({\mathrm{log}}_{2}({2}^{N-1}-1)-\displaystyle \frac{{2}^{N}-1}{{2}^{N}-2}{\mathrm{log}}_{2}({2}^{N}-1)\right)Q.\end{eqnarray} \tag{ 37 }$$

This function is shown in figure 2(a). For N = 2 the key rate coincides with the one of the six-state protocol [8, 33], namely

$$\begin{eqnarray}&&R(Q,2)=1-h\left(\displaystyle \frac{3}{2}Q\right)-\displaystyle \frac{3{\mathrm{log}}_{2}3}{2}Q.\end{eqnarray} \tag{ 38 }$$

In the limit of large N the key rate simplifies to

$$\begin{eqnarray}&&R(Q,\infty )=1-h\left(\displaystyle \frac{Q}{2}\right)-Q.\end{eqnarray} \tag{ 39 }$$

We also numerically determined the threshold values for the QBER, i.e. the value of Q until which a non-zero secret key rate is achievable, for different numbers of parties N, see table 1. Note that for fixed Q the key rate increases with the number of parties N. However, one might expect that in practice the QBER is not constant but increases with increasing number of parties N (because the experimental creation of the N-partite GHZ state becomes more demanding). This intuition is discussed quantitatively in the following section.

Zoom In Zoom Out Reset image size

Table 1.  Threshold values of the multipartite entanglement based protocol (NQKD) without preprocessing noise for different numbers of Parties N. The well-known bipartite case, i.e. N = 2, is also given for comparison. A non-zero secret key can be distilled if the QBER is below the listed value.

N	Threshold QBER
2	0.126 193
3	0.209 716
4	0.263 087
5	0.295 974
6	0.315 562
7	0.326 892
8	0.333 296
9	0.336 851
10	0.338 799
11	0.339 855
12	0.340 424
13	0.340 728
14	0.340 890
15	0.340 976
16	0.341 021
17	0.341 045
⋮
$\infty$	0.341 071

2.4. Noisy gates and channels

Let us compare the performance of NQKD and 2QKD when using imperfect two-qubit gates in the production of the entangled resource states. We employ, for both 2QKD and NQKD, the model of depolarising noise, i.e. if a two-qubit gate fails, which happens with probability f_G, then the two processed qubits are traced out and replaced by the completely mixed state.

When the GHZ resource state is produced in the network of figure 1(b), Alice starts with the state $| +{\rangle }_{A}| 0{\rangle }^{\otimes N-1}$ and applies a controlled-NOT gate from A to each of the other qubits.

The secret key rate is shown in figure 2(b) as a function of the gate error rate f_G. It captures the expectation that the demands on the gates for producing an N-party GHZ state increase with the number of parties N. We mention that the GHZ state could also be produced using a single multi-qubit gate, e.g. ${C}_{{X}^{\otimes (N-1)}}=| 0\rangle \langle 0| \otimes {\mathbb{1}}+| 1\rangle \langle 1| \otimes {X}^{\otimes (N-1)}$, which is locally equivalent to the controlled-Phase gate, see e.g. [45]. The QBER caused by this gate is $Q=\tfrac{{f}_{G}}{2}$. Because the threshold Q increases with N (see figure 2(a)), so does the threshold gate failure probability in this case.

In addition to imperfect gates, noise might be introduced by the transmission channel. Consider, for example, the situation when the qubit of each Bob is individually affected by a depolarising channel. Let the probability of depolarisation be f_C, then the QBER is

$$\begin{eqnarray}&&Q({f}_{C})=\displaystyle \frac{{2}^{N}-2}{{2}^{N}}(1-{(1-{f}_{C})}^{N})\end{eqnarray} \tag{ 40 }$$

and the key rate can be calculated according to equation (37).

We will now show that in quantum networks with constrained channel capacity and with quantum routers, employing multipartite entanglement leads to a higher secret key rate than bipartite entanglement, when the gate quality is higher than a threshold value.

Beyond the simple network of figure 1, the GHZ resource state can be distributed in many different networks. Consider a fixed but general network as given via a graph with vertices and directed edges. Let all channels have the same transmission capacity (also called bandwidth), which is associated with the direction of the corresponding edge. For the sake of a simple presentation, we assume that this transmission capacity is one qubit per second. Thus, the time ${t}_{\mathrm{rep}}$ consumed in one round (steps 1 and 2 of the protocol) is proportional to the number of network uses in that round. A generic network has some bottlenecks. In this case the difference between the NQKD and 2QKD protocol becomes evident: Alice may send a single qubit in the NQKD scheme, while she has to transmit $N-1$ qubits in the 2QKD case.

As an example consider the quantum network where all parties are connected to a single central router C, see figure 3.

Zoom In Zoom Out Reset image size

Because C is not trusted we assume it to be in the control of Eve. In this network the channel from A to C constitutes a bottleneck. Note, however, that this network can be much more economical than the one of figure 1 if the distance between A and C is large. The 2QKD protocol needs $N-1$ network uses, i.e. ${t}_{\mathrm{rep}}^{(2\mathrm{QKD})}=(N-1)\,{\rm{s}}$, to distribute the Bell pairs. In contrast to this the NQKD protocol can employ the quantum network coding [46–52] scheme of [27] to distribute the GHZ state in a single network use, i.e. ${t}_{\mathrm{rep}}^{(\mathrm{NQKD})}=1\,{\rm{s}}$. See appendix C for the explicit calculation. Thus the key rate of the NQKD protocol is $(N-1)$ times larger than the one of the 2QKD protocol in the ideal case (${r}_{\infty }=1$).

When again using noisy two-qubit gates (the QBER calculation is analogous to the case of the network shown in figure 1(b) discussed above), the QBER for the NQKD protocol increases with N. These two effects lead to gate error thresholds below which the NQKD protocol outperforms 2QKD, see figure 4(a). For a fixed number of parties N there is a maximal gate error probability below which the NQKD protocol outperforms the bipartite approach in the quantum network of figure 3. For N = 3 already gate failure rates below $7.2 \%$ imply that NQKD outperforms 2QKD. More values are listed in the appendix D.

Zoom In Zoom Out Reset image size

The exact same behaviour can be observed when considering noisy channels. In the ideal case NQKD outperforms 2QKD, while NQKD is more prone to channel noise. The resulting threshold noise levels are shown in figure 4(b).

We mention that the famous butterfly network [46] leads to a similar advantage, see appendix E for details.

In this paper we analysed a quantum conference key distribution (QKD) protocol for N parties which is based on multipartite entangled resource states. We generalised the information theoretic security analysis of [16] to this N-partite scenario. Using the depolarisation method we derived an analytical formula for the secret key rate as a function of the quantum bit error rate (QBER). For a fixed QBER the secret key rate is found to increase with the number of parties. Accordingly, the threshold QBER until which a non-zero secret key can be obtained increases with the number of parties.

Furthermore, we presented an example where multipartite entanglement-based QKD outperforms the approach based on bipartite QKD links in networks with bottlenecks. We argued that for imperfect channels or preparation this advantage holds up to a noise threshold which depends on the number of parties. In this article we did the explicit comparison only for depolarising noise and a specific preparation scheme and we leave a more general analysis for further research.

We expect more interesting insights from analysing further aspects of the multipartite entanglement-based QKD protocol. Regarding implementations the secret key calculation of the protocol for finite numbers of rounds will be beneficial. Various examples of network layouts and the link to network coding schemes will deserve more detailed investigations.

We acknowledge Jan Börker's preliminary work during his master's project and helpful discussions with Norbert Lütkenhaus. This work was financially supported by BMBF (network Q.com-Q) and ARL.

In this section we derive the form of a pure quantum state that fulfils the requirements of perfect correlations for one set of local measurement bases, with uniformly distributed random measurement outcomes. (These local bases are used for the key generation.) We also prove properties of the resource state regarding correlations of measurement outcomes in any other set of local bases.

A general normalised N-qubit state reads

$$\begin{eqnarray}&&| \phi \rangle =\displaystyle \sum _{{i}_{1},{i}_{2},\ldots {i}_{N}=0}^{1}{a}_{{i}_{1},{i}_{2},\ldots {i}_{N}}| {i}_{1},{i}_{2},\ldots {i}_{N}\rangle ,\end{eqnarray} \tag{ A1 }$$

with complex coefficients ${a}_{{i}_{1},{i}_{2},\ldots {i}_{N}}$ that satisfy ${\sum }_{{i}_{1},{i}_{2},\ldots {i}_{N}=0}^{1}| {a}_{{i}_{1},{i}_{2},\ldots {i}_{N}}{| }^{2}=1$. To achieve perfect correlations, we can assume without loss of generality that all parties measure in the Z-basis and get the same outcome, as the choice of another local basis corresponds to a local rotation, and an opposite outcome could be flipped locally. The requirement of perfect correlations in the Z-basis is only fulfilled by a quantum correlated state of the form

$$\begin{eqnarray}&&| {\phi }_{{\rm{corr}}}\rangle ={a}_{0,\ldots ,0}| 0,\,\ldots ,\,0\rangle +{a}_{1,\ldots ,1}| 1,\,\ldots ,\,1\rangle .\end{eqnarray} \tag{ A2 }$$

It turns out that this requirement of perfect correlations in one set of local bases forbids perfect correlations, even only pairwise, in any other local bases, for all $N\geqslant 3$.

Theorem 1. For N qubits, with $N\geqslant 3$, the state $| {\phi }_{{\rm{corr}}}\rangle ={a}_{0,\ldots ,0}| 0,\,\ldots ,\,0\rangle +{a}_{1,\ldots ,1}| 1,\,\ldots ,\,1\rangle$ leads to perfect classical correlations between any number of parties, if and only if each of them measures in the $Z$-basis.

Proof. Measuring in the Z-basis, perfect correlations follow trivially. For the reverse implication, let us denote the direction of measurement for party i by the vector $\vec{{M}_{i}}$, with components ${M}_{i}^{x},{M}_{i}^{y}$ and ${M}_{i}^{z}$. An observable ${{ \mathcal M }}_{{ij}}$ of two parties i and j is given by

$$\begin{eqnarray}&&{{ \mathcal M }}_{{ij}}=(\vec{{M}_{i}}\cdot \vec{\sigma })\otimes (\vec{{M}_{j}}\cdot \vec{\sigma })=\displaystyle \sum _{\alpha ,\beta \in \{x,y,z\}}{M}_{i}^{\alpha }{M}_{j}^{\beta }{\sigma }_{i}^{\alpha }\otimes {\sigma }_{j}^{\beta },\end{eqnarray} \tag{ A3 }$$

where $\vec{\sigma }$ denotes the vector of Pauli matrices and the identity operators for the parties $\ne i,j$ are omitted. Observe that

$$\begin{eqnarray}&&\langle {\phi }_{{\rm{corr}}}| {\sigma }_{i}^{\alpha }\otimes {\sigma }_{j}^{\beta }| {\phi }_{{\rm{corr}}}\rangle =0\ \ {\rm{unless}}\ \ \alpha =\beta =z,\end{eqnarray} \tag{ A4 }$$

because all other combinations of Pauli operators change $| {\phi }_{{\rm{corr}}}\rangle$ to an orthogonal state.

Denoting by ${p}_{i}^{\alpha }(\pm )$ the probability that party i finds eigenvalue ±1 when measuring ${\sigma }^{\alpha }$, we also have $\langle {\phi }_{{\rm{corr}}}| {\sigma }_{i}^{\alpha }\otimes {\sigma }_{j}^{\beta }| {\phi }_{{\rm{corr}}}\rangle =2[{p}_{i}^{\alpha }(+){p}_{j}^{\beta }(+)+{p}_{i}^{\alpha }(-){p}_{j}^{\beta }(-)]-1$, and thus ${p}_{i}^{\alpha }(+){p}_{j}^{\beta }(+)+{p}_{i}^{\alpha }(-){p}_{j}^{\beta }(-)\ne 1$, unless $\alpha =\beta =z$. Therefore, perfect correlations between two parties are not possible in any other than the Z-basis. This also excludes perfect correlations between any other number of parties. Note that the above argument, in particular equation (A4), does not hold for N = 2, which is special.□

Thus, any state of the form (A2) contains the resource of perfect multipartite correlations in the local Z-bases. In order to ensure uniformity of the outcome, i.e. randomness of the resulting secure bit string, we choose for the key generation protocol $| {a}_{0,\ldots ,0}| =1/\sqrt{2}=| {a}_{1,\ldots ,1}|$, i.e. the unique perfect resource is a GHZ state [35].

In this appendix we generalise the composable security definition of the bipartite scenario [16, 17] to the N-partite case. As mentioned in the main text, the security analysis proceeds along analogous lines as the bipartite case in [33, 53]. We assume that the parties A and B_i, for $i=1,\,\ldots ,\,N-1$ share n multipartite states. The eavesdropper E is supposed to hold a purification of the global state. The total quantum state after Z-measurement of A and all B_i is described by the density operator

$$\begin{eqnarray}{\rho }_{{{\bf{KK}}}_{{\bf{1}}}...{{\bf{K}}}_{{\bf{N}}-{\bf{1}}}E}^{n} & = & \displaystyle \sum _{{\bf{x}},{{\bf{x}}}_{{\bf{1}}},\ldots ,{{\bf{x}}}_{{\bf{N}}-{\bf{1}}}}{P}_{{{\bf{KK}}}_{{\bf{1}}}...{{\bf{K}}}_{{\bf{N}}-{\bf{1}}}}({\bf{x}},{{\bf{x}}}_{{\bf{1}}},\,\ldots ,\,{{\bf{x}}}_{{\bf{N}}-{\bf{1}}})\\ & & | {\bf{x}}\rangle \langle {\bf{x}}| \otimes \underset{i=1}{\overset{N-1}{\displaystyle \bigotimes }}| {{\bf{x}}}_{{\bf{i}}}\rangle {\langle {{\bf{x}}}_{{\bf{i}}}| }_{}\otimes {\rho }_{E}^{{\bf{x}},{{\bf{x}}}_{{\bf{1}}},\ldots {{\bf{x}}}_{{\bf{N}}-{\bf{1}}}},\end{eqnarray} \tag{ B1 }$$

where the classical strings of the Z-measurement outcomes ${\bf{x}}$ and ${{\bf{x}}}_{{\bf{i}}}$ of Alice and B_i, which occur with probability ${P}_{{{\bf{KK}}}_{{\bf{1}}}...{{\bf{K}}}_{{\bf{N}}-{\bf{1}}}}({\bf{x}},{{\bf{x}}}_{{\bf{1}}},\,\ldots ,\,{{\bf{x}}}_{{\bf{N}}-{\bf{1}}})$, are stored in system ${\bf{K}}$ and ${{\bf{K}}}_{{\bf{i}}}$, respectively. Note that the classical post-processing is identical to the bipartite case: in an error correction step the parties transform their only partially correlated raw data into a fully correlated shorter string. Party A pre-processes her random string ${\bf{K}}$ according to the channel ${\bf{U}}\leftarrow {\bf{K}}$ and sends classical error correction information ${\bf{W}}$ to parties B_i, who compute their respective guesses ${{\bf{U}}}_{{\bf{i}}}$ for ${\bf{U}}$ from ${{\bf{K}}}_{{\bf{i}}}$ and ${\bf{W}}$. The error correction information ${\bf{W}}$ is the same for all Bobs, thus there is no additional information leakage compared to the bipartite case. In a second step, the privacy amplification, party A randomly chooses f from a two-universal family of hash functions, computes her key ${{\bf{S}}}_{{\bf{A}}}=f({\bf{U}})$ and sends the description of f to all parties B_i who also perform the privacy amplification to arrive at their respective keys ${{\bf{S}}}_{{{\bf{B}}}_{{\bf{i}}}}=f({{\bf{U}}}_{{\bf{i}}})$. The total quantum state will then be denoted as ${\rho }_{{{\bf{S}}}_{{\bf{A}}}{{\bf{S}}}_{{{\bf{B}}}_{{\bf{1}}}}...{{\bf{S}}}_{{{\bf{B}}}_{{\bf{N}}-{\bf{1}}}}E{\rm{ \mbox{`} }}}$. The key tuple (${{\bf{S}}}_{{\bf{A}}},{{\bf{S}}}_{{{\bf{B}}}_{{\bf{1}}}},\,\ldots ,\,{{\bf{S}}}_{{{\bf{B}}}_{{\bf{N}}-{\bf{1}}}}$) is called -secure, if it is -close to the ideal state, i.e. if

$$\begin{eqnarray}&&\delta ({\rho }_{{{\bf{S}}}_{{\bf{A}}}{{\bf{S}}}_{{{\bf{B}}}_{{\bf{1}}}}...{{\bf{S}}}_{{{\bf{B}}}_{{\bf{N}}-{\bf{1}}}}E{\rm{ \mbox{`} }}},{\rho }_{{\bf{SS}}...{\bf{S}}}\otimes {\rho }_{E{\rm{ \mbox{`} }}})\leqslant \epsilon ,\end{eqnarray} \tag{ B2 }$$

where $\delta (\rho ,\sigma )={\rm{tr}}| \rho -\sigma | /2$ denotes the trace distance.

Note that we have not assumed any symmetry about the quality of the channels connecting A and B_i. The information leaking to the eavesdropper in the error correction step is determined by the amount of error correction information which the Bob with the noisiest channel requires. This is the main difference with respect to the bipartite case.

Therefore we arrive at the following key length ${{\ell }}^{(n)}$, generated from n multipartite entangled states, in analogy to [33, 53]:

$$\begin{eqnarray}&&{{\ell }}^{(n)}=\mathop{\sup }\limits_{{\bf{U}}\leftarrow {\bf{K}}}\left[{S}_{2}^{\epsilon }({\bf{U}}E)-{S}_{0}^{\epsilon }(E)-\mathop{\max }\limits_{i\in \{1,\ldots N-1\}}{H}_{0}^{\epsilon }({\bf{U}}| {{\bf{K}}}_{i})\right],\end{eqnarray} \tag{ B3 }$$

where the smooth Rényi entropy ${S}_{\alpha }^{\epsilon }$ is defined as

$$\begin{eqnarray}&&{S}_{\alpha }^{\epsilon }(\rho )=\displaystyle \frac{1}{1-\alpha }{\mathrm{log}}_{2}\left(\mathop{\inf }\limits_{\sigma \in {{\bf{B}}}^{\epsilon }(\rho )}\mathrm{tr}({\sigma }^{\alpha })\right),\end{eqnarray} \tag{ B4 }$$

which for $\alpha \in \{0,\infty \}$ is to be understood as ${S}_{\alpha }^{\epsilon }(\rho )={\mathrm{lim}}_{\beta \to \alpha }{S}_{\beta }^{\epsilon }(\rho )$. The infimum is to be taken over all states σ in a ball with radius ε (w.r.t. the trace distance) around ρ, denoted as ${{\bf{B}}}^{\epsilon }(\rho )$. For a (classical) probability distribution P the smooth Rényi entropy is

$$\begin{eqnarray}&&{H}_{\alpha }^{\epsilon }(P)=\displaystyle \frac{1}{1-\alpha }\mathop{\inf }\limits_{\displaystyle \genfrac{}{}{0em}{}{Q}{\bar{\delta }(Q,P)\leqslant \epsilon }}{\mathrm{log}}_{2}\left(\displaystyle \sum _{z}Q{(z)}^{\alpha }\right),\end{eqnarray} \tag{ B5 }$$

where the infimum is taken over all probability distributions $\epsilon$-close to P in the sense of the statistical distance $\bar{\delta }$ (the classical analogon of the trace distance). The conditional smooth Rényi entropy is

$$\begin{eqnarray}&&{H}_{0}^{\epsilon }({P}_{X}| {P}_{Y})=\mathop{\max }\limits_{y}{H}_{0}^{\epsilon }({P}_{X| Y=y}).\end{eqnarray} \tag{ B6 }$$

Note that, differently to the bipartite case [33], the worst of the $N-1$ channels influences the key length via the maximal leakage to the eavesdropper in the error correction step, see the last term of equation (B3). In the following the symbols K, K_i and U denote the single bit random variables corresponding to the respective bold-face strings. For the limit $n\to \infty$ the secret fraction r is given by

$$\begin{eqnarray}{r}_{\infty } & = & \mathop{\mathrm{lim}}\limits_{n\to \infty }\displaystyle \frac{{{\ell }}^{(n)}}{n}\\ & = & \mathop{\sup }\limits_{U\leftarrow K}\mathop{\inf }\limits_{{\sigma }_{A\{{B}_{i}\}}\in {\rm{\Gamma }}}\left[S(U| E)-\mathop{\max }\limits_{i\in \{1,\ldots N-1\}}H(U| {K}_{i})\right],\end{eqnarray} \tag{ B7 }$$

where $S(U| E)$ is the conditional von Neumann entropy, $H(U| K)$ is the conditional Shannon entropy and Γ is the set of all density matrices of Alice and the Bobs which are consistent with the parameter estimation.

Here we explicitly describe the distribution of the GHZ state in the network of figure 3. This is a special case of the quantum network coding scheme which some of the authors described in [27]. Let $| +\rangle =\tfrac{1}{\sqrt{2}}(| 0\rangle +| 1\rangle )$ and $| -\rangle =\tfrac{1}{\sqrt{2}}(| 0\rangle -| 1\rangle )$.

• 1.  
  Alice produces two qubits C and A, each in the state $| +\rangle$. She then applies a controlled-Phase gate ${C}_{Z}=| 0\rangle \langle 0| \otimes {\mathbb{1}}+| 1\rangle \langle 1| \otimes Z$ to produce the Bell state

  
• 2.  
  Alice sends the qubit C to the router station.
• 3.  
  The router produces $(N-1)$ qubits B_i, $i=1,2,\,\ldots ,\,N-1$, in the state $| +\rangle$ and entangles each of them with the qubit C using $(N-1)$ C_Z gates. At this stage the total state is

  $$\begin{eqnarray}&&| {\psi }_{C}\rangle =\displaystyle \frac{1}{\sqrt{2}}(| 0+...+\rangle +| 1-...-\rangle )\end{eqnarray} \tag{ C2 }$$

  $$\begin{eqnarray}&&=\,\displaystyle \frac{1}{\sqrt{2}}(| +{\rangle }_{C}| {\rm{GHZ}}^{\prime} \rangle +| -{\rangle }_{C}{X}_{{B}_{1}}| {\rm{GHZ}}^{\prime} \rangle ),\end{eqnarray} \tag{ C3 }$$

  where

  $$\begin{eqnarray}&&| {\rm{GHZ}}^{\prime} \rangle =\displaystyle \frac{1}{\sqrt{2}}(| ++...+\rangle +| --...-\rangle )\end{eqnarray} \tag{ C4 }$$

  is the GHZ state in the X-basis.
• 4.  
  The router measures C in X basis. If the outcome is −1, i.e. $| -{\rangle }_{C}$, then it applies ${X}_{{B}_{1}}$. The state is now $| \pm {\rangle }_{C}| {\rm{GHZ}}^{\prime} \rangle$.
• 5.  
  The router now distributes the qubits B₁, B₂, ..., ${B}_{N-1}$ to the corresponding parties.

Up to a local basis choice (Hadamard gate), the resource state of the main text has been distributed and the multipartite entanglement based quantum key distribution (NQKD) protocol can be performed.

To see that it is impossible to create $N-1$ Bell pairs by sending a single qubit from Alice to the router, let us group the router and all Bobs into a single party B. When Alice sends one qubit across the channel, the entropy of entanglement ${E}_{A| B}\leqslant 1$. The $N-1$ Bell pairs, however, have entropy of entanglement ${E}_{A| B}=N-1$, so they cannot be created from the received state by local operations on B. Instead, $N-1$ network uses are necessary and the key rate decreases accordingly.

In this appendix we give details for the key rate calculations regarding the quantum networks of figures 1(b) and 3 with imperfect gates. We start with the simple network of figure 1(b). The GHZ resource state is prepared as follows. Alice starts with the state $| +{\rangle }_{A}| 0{\rangle }^{\otimes N-1}$ and applies a controlled-Not gate from A to each of the other qubits, see figure D1.

Zoom In Zoom Out Reset image size

When a controlled-Not gate acts on qubits i (control) and j (target) we denote it by

$$\begin{eqnarray}&&{C}_{X}^{(i,j)}=(| 0\rangle {\langle 0| }_{i}\otimes {{\mathbb{1}}}_{j}+| 1\rangle {\langle 1| }_{i}\otimes {X}_{j})\otimes {{\mathbb{1}}}_{\mathrm{rest}},\end{eqnarray} \tag{ D1 }$$

where $X=| 0\rangle \langle 1| +| 1\rangle \langle 0|$ is a Pauli matrix. We use a depolarising noise model for the gate errors. The action of the imperfect gate on the density matrix is

$$\begin{eqnarray}&&{C}_{X,{f}_{G}}^{(i,j)}(\rho )=(1-{f}_{G}){C}_{X}^{(i,j)}\rho {C}_{X}^{(i,j)}+{f}_{G}{\mathrm{tr}}_{i,j}(\rho )\otimes {{\mathbb{1}}}_{{ij}}\end{eqnarray} \tag{ D2 }$$

$$\begin{eqnarray}&&=\,(1-{f}_{G}){C}_{X}^{(i,j)}\rho {C}_{X}^{(i,j)}+\displaystyle \sum _{a,b\in \sigma }{a}_{i}{b}_{j}\rho {a}_{i}{b}_{j},\end{eqnarray} \tag{ D3 }$$

where $\sigma =\{{\mathbb{1}},X,Y,Z\}$ contains Pauli matrices.

It will be convenient to extend the notation of the GHZ basis to include the number of parties as a subscript, i.e.

$$\begin{eqnarray}&&| {\psi }_{j,N}^{\pm }\rangle =\displaystyle \frac{1}{\sqrt{2}}(| 0{\rangle }_{1}| j{\rangle }_{2...N}\pm | 1{\rangle }_{1}| \bar{j}{\rangle }_{2...N}).\end{eqnarray} \tag{ D4 }$$

The initial state is

$$\begin{eqnarray}&&{\rho }_{\mathrm{in}}=| {\psi }_{0,1}^{+}\rangle \langle {\psi }_{0,1}^{+}| \otimes {(| 0\rangle \langle 0| )}^{\otimes (N-1)}.\end{eqnarray} \tag{ D5 }$$

The first gate turns it into

$$\begin{eqnarray}&&{\rho }_{1,\mathrm{out}}=\left((1-{f}_{G})| {\psi }_{0,2}^{+}\rangle \langle {\psi }_{0,2}^{+}| +{f}_{G}\displaystyle \frac{{\mathbb{1}}}{4}\right)\otimes {(| 0\rangle \langle 0| )}^{\otimes N-2},\end{eqnarray} \tag{ D6 }$$

the second into

$$\begin{eqnarray}{\rho }_{2,\mathrm{out}} & = & \phantom{\rule{}{3.0ex}}({(1-{f}_{G})}^{2}| {\psi }_{0,3}^{+}\rangle \langle {\psi }_{0,3}^{+}| \\ & & +(1-{f}_{G}){f}_{G}\displaystyle \frac{1}{2}\left(| 0\rangle \langle 0| \otimes \displaystyle \frac{{\mathbb{1}}}{2}\otimes | 0\rangle \langle 0| +| 1\rangle \langle 1| \otimes \displaystyle \frac{{\mathbb{1}}}{2}\otimes | 1\rangle \langle 1| \right)\\ & & +\left.{f}_{G}\displaystyle \frac{{\mathbb{1}}}{8}\right)\otimes {(| 0\rangle \langle 0| )}^{\otimes N-3},\end{eqnarray} \tag{ D7 }$$

and the third into

$$\begin{eqnarray}{\rho }_{3,\mathrm{out}} & = & \phantom{\rule{}{3.0ex}}({(1-{f}_{G})}^{3}| {\psi }_{0,4}^{+}\rangle \langle {\psi }_{0,4}^{+}| \\ & & +{f}_{G}{(1-{f}_{G})}^{2}\displaystyle \frac{1}{2}\left(\displaystyle \frac{{\mathbb{1}}}{2}\otimes | 00\rangle \langle 00| \otimes \displaystyle \frac{{\mathbb{1}}}{2}+\displaystyle \frac{{\mathbb{1}}}{2}\otimes | 11\rangle \langle 11| \otimes \displaystyle \frac{{\mathbb{1}}}{2}\right)\\ & & +{(1-{f}_{G})}^{2}{f}_{G}\displaystyle \frac{1}{2}\left(| 0\rangle \langle 0| \otimes \displaystyle \frac{{\mathbb{1}}}{2}\otimes | 00\rangle \langle 00| +| 1\rangle \langle 1| \otimes \displaystyle \frac{{\mathbb{1}}}{2}\otimes | 11\rangle \langle 11| \right)\\ & & +(1-{f}_{G}){f}_{G}\displaystyle \frac{1}{2}\left(| 0\rangle \langle 0| \otimes \displaystyle \frac{{\mathbb{1}}}{4}\otimes | 0\rangle \langle 0| +| 1\rangle \langle 1| \otimes \displaystyle \frac{{\mathbb{1}}}{4}\otimes | 1\rangle \langle 1| \right)\\ & & +(2-{f}_{G})\left.{f}_{G}^{2}\displaystyle \frac{{\mathbb{1}}}{16}\right)\otimes {(| 0\rangle \langle 0| )}^{\otimes N-4}.\end{eqnarray} \tag{ D8 }$$

One may deduce the following observation. Let us denote the pattern of actual gate successes/failures as the binary representation of an $(N-1)$-bit number ${\bf{x}}$, where a 0 at position i indicates the failure of gate i and 1 means the corresponding gate was successful. The number of connected blocks of ones in the bit string ${\bf{x}}1$ plus the number of zeros, $b({\bf{x}}1)$, is the number of subsets of parties that are correlated amongst each other. This gives the prefactor

$$\begin{eqnarray}{c}_{{\bf{x}}}=\left\{\begin{array}{ll}1, & {\rm{if}}\,{\rm{}}{\bf{x}}=11...1,\\ {2}^{-b({\bf{x}}1),} & {\rm{else}}\,{\rm{}}\end{array}\right.\end{eqnarray} \tag{ D9 }$$

in front of the corresponding term in ρ. These prefactors determine the overlap between $| {\psi }_{j,0}^{\pm }\rangle \langle {\psi }_{j,0}^{\pm }|$ and ρ, i.e. the coefficients ${\lambda }_{0}^{\pm }({f}_{G})$ of ρ in the GHZ basis. They read

$$\begin{eqnarray}{\lambda }_{0}^{+}({f}_{G}) & = & \displaystyle \sum _{{\bf{x}}=0}^{{2}^{N-1}-1}{c}_{{\bf{x}}}{f}_{G}^{N-1-| {\bf{x}}{| }_{H}}{(1-{f}_{G})}^{| {\bf{x}}{| }_{H}}\\ \text{and}{\lambda }_{0}^{-}({f}_{G}) & = & {\lambda }_{0}^{+}-{(1-{f}_{G})}^{N-1},\end{eqnarray} \tag{ D10 }$$

where $| {\bf{x}}{| }_{H}$ is the Hamming weight of ${\bf{x}}$. After some combinatorics ${\sum }_{{\bf{x}}}c({\bf{x}})$ for a given weight $w=| {\bf{x}}{| }_{H}$ (unequal to $N-1$) can be expressed in a more compact form by summing over all possible 'subset counts' β as

$$\begin{eqnarray}&&\displaystyle \sum _{\displaystyle \genfrac{}{}{0em}{}{{\bf{x}}}{| {\bf{x}}{| }_{H}=w}}c({\bf{x}})=\displaystyle \sum _{\beta =N-w}^{N}\displaystyle \left(\genfrac{}{}{0em}{}{w}{N-\beta }\right)\displaystyle \left(\genfrac{}{}{0em}{}{N-w-1}{\beta -N+w}\right){2}^{-\beta },\end{eqnarray} \tag{ D11 }$$

which leads to the relevant coefficients in the GHZ basis,

$$\begin{eqnarray}{\lambda }_{0}^{-}({f}_{G}) & = & \displaystyle \sum _{w=0}^{N-2}c^{\prime} (w){f}_{G}^{N-1-w}{(1-{f}_{G})}^{w}\\ {\rm{and}}\,{\rm{}}{\lambda }_{0}^{+}({f}_{G}) & = & {(1-{f}_{G})}^{N-1}+{\lambda }_{0}^{-}({f}_{G})\end{eqnarray} \tag{ D12 }$$

with

$$\begin{eqnarray}&&c^{\prime} (w)=\displaystyle \sum _{\beta =N-w}^{N}\displaystyle \left(\genfrac{}{}{0em}{}{w}{N-\beta }\right)\displaystyle \left(\genfrac{}{}{0em}{}{N-w-1}{\beta -N+w}\right){2}^{-\beta }.\end{eqnarray} \tag{ D13 }$$

From equation (D12) one obtains the QBER using equation (12). We show it in figure D2. The secret key rate is calculated using equation (23) with

$$\begin{eqnarray}&&{Q}_{{{AB}}_{i}}=\displaystyle \frac{1}{N-1}\displaystyle \sum _{k=1}^{N-1}\displaystyle \frac{1}{2}(1-{(1-{f}_{G})}^{k})\end{eqnarray} \tag{ D14 }$$

$$\begin{eqnarray}&&=\,\displaystyle \frac{{(1-{f}_{G})}^{N}+{f}_{G}N-1}{2{f}_{G}(N-1)},\end{eqnarray} \tag{ D15 }$$

which is the average ${Q}_{{{AB}}_{i}}$ for one to $N-1$ gates, because we use a random order of the gates. This effectively mixes all ${\lambda }_{j}^{\pm }$ with j of same Hamming weight and accomplishes that all ${Q}_{{{AB}}_{i}}$ are equal. Compared to a fixed gate order it improves the key rate and removes the maximum in equation (23).

Zoom In Zoom Out Reset image size

In the case of the network shown in figure 3, $N-1$ gates are performed at C and one additional gate is performed at A. The initial state at C depends on whether the gate of A was successful, i.e. it is

$$\begin{eqnarray}&&{\rho }_{\mathrm{in},\mathrm{QNC}}=(1-{f}_{G}){\rho }_{\mathrm{in}}+{f}_{G}\displaystyle \frac{{\mathbb{1}}}{2}\otimes | 0\rangle {\langle 0| }^{\otimes (N-1)}\end{eqnarray} \tag{ D16 }$$

$$\begin{eqnarray}&&=\,(1-{f}_{G}){\rho }_{\mathrm{in}}+{f}_{G}\displaystyle \frac{1}{2}({\rho }_{\mathrm{in}}+{Z}_{1}{\rho }_{\mathrm{in}}{Z}_{1}),\end{eqnarray} \tag{ D17 }$$

i.e.

$$\begin{eqnarray}&&{\lambda }_{0,{\rm{QNC}}}^{+}({f}_{G})=(1-{f}_{G}){\lambda }_{0}^{+}({f}_{G})+\displaystyle \frac{{f}_{G}}{2}({\lambda }_{0}^{+}({f}_{G})+{\lambda }_{0}^{-}({f}_{G})),\end{eqnarray} \tag{ D18 }$$

$$\begin{eqnarray}&&{\lambda }_{0,{\rm{QNC}}}^{-}({f}_{G})=(1-{f}_{G}){\lambda }_{0}^{-}({f}_{G})+\displaystyle \frac{{f}_{G}}{2}({\lambda }_{0}^{+}({f}_{G})+{\lambda }_{0}^{-}({f}_{G})),\end{eqnarray} \tag{ D19 }$$

and the previous results can be used to obtain the key rate in this case. Note that while the final density matrix depends on whether a router was used or not, the QBER (and ${Q}_{{{AB}}_{i}}$) does not, because the additional phase error does not contribute to it.

For a fixed number of parties N there is a threshold gate error probability below which the NQKD protocol outperforms the bipartite approach in the quantum network of figure 3. These values are listed in table D1.

The key rate as a function of N is shown for different values of the gate error rate f_G in figure D3.

Zoom In Zoom Out Reset image size

We sketch how the NQKD protocol can be employed in the butterfly network shown in figure E1. As usual, the rate constraints on the channels are one, i.e. each channel can send a single qubit per time step.

• 1.  
  The quantum network code corresponding to the linear code shown in figure E1(a) is employed to produce two GHZ states shared by A, B₁ and B₂ (figure E1(b)). See theorem 1 of [27].
• 2.  
  These two GHZ states allow to perform two rounds of the NQKD protocol in a single time step.

In contrast the bipartite entanglement based (2QKD) protocol (also in its prepare and measure formulation) can only do a single round, because only two Bell pairs can be distributed (due to the outgoing capacity at A). Thus the key rate of the NQKD protocol is twice as high as in the 'standard approach'.

Zoom In Zoom Out Reset image size

From the construction of this example it is clear how it generalises: if the network allows A to multicast n bits, then a single use of the corresponding quantum network will produce n GHZ states. Thus the NQKD protocol can be performed n times per time step. However, the 2QKD protocol can only perform $\tfrac{n}{N-1}$ rounds in the same time.