Quantum Secrecy in Thermal States II

In this paper we consider a scheme for cryptographic key distribution based on a variation of continuous variable quantum key distribution called central broadcast. In the continuous variable central broadcast scheme, security arises from discord present in the Hanbury Brown and Twiss effect from a thermal source. The benefit of this scheme is that it expands the range of frequencies into the microwave regime. Longer wavelengths, where the thermal photon number is higher and correlations remain robust over long distances, may even be preferable to optical wavelengths. Assming that Alice controls the source but not the distribution of the light (eg satellite broadcasts), then we demonstrate that the central broadcast scheme is robust to an entangling cloner attack. We establish the security of the protocol both experimentally and theoretically.

(Some gures may appear in colour only in the online journal) Quantum key distribution (QKD) is rapidly gaining widespread acceptance [1] as a method of secure key exchange and several high bandwidth devices have been demonstrated. However, the connection between the core network and the edge devices remains a weak link. For the end user, wireless access is the ideal use model. The user interface must be both inexpensive and accessible without compromising security and maintaining the ability to work on scales of the order of metres to tens of metres.
Recently, the potential of thermal states for QKD has been established [2,3]. Although thermal states have sometimes been described as too noisy [4,5], they exhibit Hanbury Brown and Twiss correlations which have been found to exhibit positive discord [6], a necessary condition for QKD [7].
Consider a central broadcast protocol in which the radiation is split between two parties, who now have correlated 3 Author to whom any correspondence should be addressed.
Original content from this work may be used under the terms of the Creative Commons Attribution 4.0 licence. Any further distribution of this work must maintain attribution to the author(s) and the title of the work, journal citation and DOI. signals from which they can build a key. A typical central broadcast scheme is shown on gure 1. Another advantage to using thermal states is that they are easy and low-cost to produce. Whereas large-scale implementations of QKD such as those described above require speci c infrastructure, thermal states central broadcasting protocols can be implemented over short distances, with low-power devices.
In the scheme proposed in [2], a thermal source is incident on a beamsplitter, with one output port connected to Alice and the other to Bob. Alice controls the source, the beamsplitter and the channels from the source to their detector, via the splitter. The eavesdropper is limited to the channel leading from the splitter to Bob and therefore, has an equal rank to Bob. We found that there is both a positive key rate and positive discord between the legal parties, both at optical frequencies (experimental result) and microwave frequencies (theoretical analysis).
In the present paper, as illustrated in gure 2, Alice and Eve switch places, giving Eve control of the higher level channel. This provides Eve with greater knowledge of the states making up the thermal radiation. She can intercept and resend bunched pairs at her leisure, pairs which are indistinguishable from  This is the schematic for this iteration of the protocol. A combination half-wave plate λ/2 and polarising beamsplitter is used to make a variable transmittance beamsplitter. Part of the signal is transmitted to Eve, and the other part goes through the same assembly to split between Alice and Bob. Having variable beamsplitters is especially important so that we can check the security of the protocol even if most of the signal is detected by Eve. Each signal is detected with photodiodes, and the signal is fed to the oscilloscope via the analog to digital converters for data collection. those radiated by the source. Fortunately, the security of a central broadcast protocol naturally arises from the correlations within the pairs. Their origin itself is irrelevant. As a result, the protocol allows for quantum secure key to be distributed, even with Eve on the superior channel.
In the following, we describe the protocol and its modelling in more details. We use an optical experiment so that the eavesdropper channel is uncluttered by extraneous sources of noise. In microwave, it becomes dif cult to differentiate Eve from all other sources of noises. The optical regime is the model of the perfect microwave experiment. Then we allow higher levels of noise in the theoretical modelling.

Protocol
This protocol is illustrated in gure 1. A source (for instance a trusted satellite) emits thermal radiation which is picked by the legal parties and the eavesdropper. We can consider that Eve can access quite a large portion of the signal, intercepting much of what should go to Alice and Bob. We model this by giving Eve an entangling cloner, so she can divert as much of the signal to her as convenient. However, we consider that the source is trusted; this means that the eavesdropper does not use the satellite to relay her own signal.
We express the protocol formally as follows: • Alice creates a beam from a trusted thermal source.
• On the way to their trusted beamsplitter with transmittance η 2 , the signal is interfered with by Eve, via an entangling cloner denoted η 1 . • Alice uses η 2 to divert part of the signal to her detector and send the rest on to Bob. • Similarly to [2], the bunched nature of the pairs coming out of η 1 means that uctuations present at Alice's detector are correlated with those at Bob's detector. • To derive their data, Alice and Bob slice these uctuations as convenient; as an example, a uctuation above the mean could be a 1 and a uctuation below the mean, a 0. • Like any QKD scheme, our protocol requires quantum correlations. To con rm that the signal from Alice and Bob are correlated is done through verifying the thermal nature of their signal. Thus, Alice sends Bob small chunks of data for him to perform a g (2) (0) calculation. A g (2) (0) > 1 means that the signal is thermal. • Alice and Bob now have a stream of independent and randomly correlated bits from which they can derive a key, the security of which they can improve with cascade and advantage distillation, as per any QKD scheme.
This scheme was implemented as shown in gure 2. A thermal source shines onto a beamsplitter which is controlled by the eavesdropper and therefore, allows her to capture as much of the signal as she wants. This is the same situation as that described in gure 1, where the eavesdropper can receive most of the signal, but does not control the source. In order to simulate high levels of noise, we consider two attenuator channels between η 2 and the legal parties, equivalent to adding a beamsplitter of transmittance η 3 between η 2 and Alice (η 4 for Bob), with an input state of variance N 3 (and N 4 ) at the second input arm.
Once again, this is not a prepare-and-send scheme. Alice controls the source, but the process of splitting pairs happening at the beamsplitter is stochastic, therefore unpredictable. Eve has no access to the channels between η 2 and either Alice or Bob, nor any control over their detectors.
Maurer and Wolf [8] have proved a theorem providing conditions to be satis ed for a scheme such as ours to be secure. The theorem reads as follows: [quote] Theorem 1. In scenario 1, the following conditions are equivalent: [16] where K(A : B E) is the secret key rate. The third condition is actually the most restrictive.
is the intrinsic conditional mutual information; it determines the unreducible amount of conditional mutual information between Alice and Bob, regardless of any attempts by Eve at acquiring more information through local operations; in other words, it is information inaccessible to Eve. Furthermore, it satis es which makes it a tighter condition on the secret key rate.
We can see its relation to the quantum discord if we recall that the latter, D(B|A), is de ned as the difference between the mutual information I(A : B) and the classical mutual information J(B|A) (or J(A|B)). I(A : B) quanti es all possible correlations between Alice and Bob, but J(B|A) quanti es those measured by local operations at Alice's and Bob's sites. Therefore, it can be understood as the intrinsic conditional mutual information as described previously. Let us therefore, rewrite the theorem as: Theorem 2. In our central broadcast scheme, the following conditions are equivalent: It is therefore enough in principle, to demonstrate that either condition is satis ed. We shall however, prove two, namely the positivity of the conditional mutual information and that of the discord. The latter will allow us to demonstrate the quantum nature of the secrecy.

Theoretical modelling
Let us recall that thermal states can be modelled using Gaussian statistics, which makes them easily de ned and manipulated through their rst and second moments [9,10]. The former are contained in the displacement vector r , wherê r is the system's operator, and ρ the state's density operator. The second moments are contained in the covariance matrix γ de ned as where we write the anti-commutator using {}. A thermal state has covariance matrix γ in = 2(n + 1)I, wheren is the average photon number and I the 2 × 2 identity matrix, and null displacement. We consider single mode states, which is appropriate since we consider narrowband detectors. The beamsplitters are modelled as where η i is the transmittance and µ i = √ 1 − η i represents the noise. They act on the state as γ out = Vγ in V T .
The input state at the rst beamsplitter contains the thermal source and Eve's source; it has covariance matrix and displacement vector where (V x s , V p s , x s , p s ) are the source parameters and (V x e , V p e , x e , p e ) the eavesdropper's. The variances are given in shot noise units (SNU). We note the structure of the covariance matrix as γ in = γ source ⊕ γ Eve . The two empty sub-matrices would represent potential pre-existing correlations between the source and Eve, which in our set-up, is unrealistic.
The output of the second beamsplitter is We make the channel between η 2 and Alice, and between η 2 and Bob thermal noise channels by inputting states of variance N 3 on Alice's branch and N 4 on Bob's as with i = 3, 4 and ǫ i the channel excess noise [10]. The input state at η 3 and η 4 is then where γ out is the state at the output of η 2 , the rst block submatrix is the input state at η 3 and the last sub-matrix, the input state at η 4 . The output covariance matrix is where the block sub-matrices are given in the appendix A. The mutual information I(A : B) is given by where S(x) is the von Neumann entropy and Γ i the covariance matrices of A, B and AB respectively. The von Neumann entropy is given by where x i are the symplectic eigenvalues of Γ. The conditional mutual information is The discord is de ned explicitly as where Γ b|x A is the covariance matrix of B conditioned by a with X = 1 0 0 0 and () −1 the pseudo-inverse.

Results and discussion
The protocol was realised experimentally, as described on gure 2. The thermal source is provided by a superluminescent diode coupled to an external cavity, making it a tuneable laser, run without any added modulation. The laser can be run separately in coherent or in thermal mode, and the thermality of the source was established in [2]. The source bandwidth was measured at ∆λ = 0.4 nm spread around a centre wavelength of λ 0 = 780.09 nm; this give a coherence time of τ c = 4.8 ps. The detectors are ThorLabs Det36A photodiodes with a bandwidth of 25 MHz, coupled to a LeCroy Waverunner 44xi oscilloscope of bandwidth 400 MHz; the combined integration time is 14 ns and the oscilloscope samples at 5 GSps. Thermal states are correlated in amplitudes, which can be measured in terms of the strength of the electric eld and therefore, single photon detectors are not necessary.
The conditional mutual information is calculated from the sliced data strings using Shannon entropies H(x) = − p(x)log(p(x)) in terms of the measured frequencies p(x). Figure 3 shows that the scheme works experimentally as predicted. I(A : B|E) is best as η 1 tends to 1, and at η 2 = 0.5, so when Alice and Bob gets equal shares of most of the thermal source signal. This corresponds to a situation where the eavesdropper is absent, and where there is minimal loss. As long as the η 1 > 0.5, the eavesdropper gets little of the signal and the advantage is to the legal parties. However, no matter how much signal Eve receives, the conditional mutual information is always positive, and never exhibits a sharp fall-off, typical of point-to-point schemes over the 3dB limit. This means that it is always possible to build key, albeit slowly. The key can be built from the data distributed using reconciliation schemes such as advantage distillation [12] and cascade [13]. Figure 3 allows us also to illustrate that this scheme cannot work in the coherent regime. As mentioned before in [2], coherent radiation is not bunched; therefore, it holds none of the intrinsic correlations contained in bunched pairs. There is no splitting of pairs occurring at the beamsplitters, because there are no such pairs; single photons travel through uncorrelated to Alice and Bob, who as a result can build no key from them. This is shown on the right-hand graph of the gure I(A : B|E) remains constant, no matter how much Eve lets through, no matter the split between Alice and Bob. Let us now compare these results to those obtained through our theoretical modelling. Figure 4 shows the behaviour of the conditional mutual information as Eve lets more and more of the signal through. When compared with gure 3, we can see that as η 1 → 1, so as the amount of Eve's signal vanishes, I(A : B|E) increases. The simulations obtained through our theoretical modelling match the experimental results. Furthermore, I(A : B|E) is always positive, so by virtue of our theorem, there is always secrecy.
We can also explore how the initial state of Eve in uences the secrecy between Alice and Bob. For that, we vary V e and see that as it increases, I(A : B|E) increases also. The reason for this, we have mentioned before and will detail further in the lines below. Figure 5 illustrates the positivity of the discord, regardless of η 1 . This means that there always are quantum correlations between Alice and Bob. This satis es the third of the conditions from our theorem, and we can af rm quantum secrecy.
What is remarkable is the value of the discord when η 1 is null, so before Eve begins to let the source signal through. In this case, what is actually measured is the amount of quantum correlations within Eve's state. We have seen that the higher V e is, the higher I(A : B|E), but here we see that the discord follows a similar trend. This is particularly evident when V e = 250 SNU. This is a result of the physics of thermal states and the reason why this scheme is secure even under Eve's interceptand-resend. To understand this, let us step back and consider a single beamsplitter (input arms labelled 1 and 2, output arms labelled 3 and 4) with a thermal state at one input, as shown in gure 6.
Since it is bunched, there will be correlated photon pairs travelling into the beamsplitter. If both photons travel into the same input (say arm 1), we can expect three outputs [14]: • both photons are travelling through on arm 3 P(2 3 , 0 4 ), • both photons travel onto arm 4 P(0 3 , 2 4 ) or • one photon for each arm P(1 3 , 1 4 ).
This corresponds to Eve inputting a vacuum or a coherent state at arm 2 and why we can in fact equate her to any loss in the channel.
On the other hand, if Eve inputs a thermal state as well, there is now a correlated pair of photons travelling into each input arm. This is illustrated in gure 7. This will gives us the following outputs: P(4 3 , 0 4 ), P(0 3 , 4 4 ), P(2 3 , 2 4 ), P(3 3 , 1 4 ), and P(1 3 , 3 4 ). The third case P(2 3 , 2 4 ), is three-degenerate; either both pairs get to the other side in one piece (which accounts for two degeneracies) or both pairs are split (the remaining degeneracy). This means that accounting for all possible outcomes, there are only two cases where there will not be at least one correlated pair travelling into η 2 to Alice and Bob: either one pair is split at η 1 and Eve gets three photons P(3 3 , 1 4 ) (mitigated by the fact that Eve would choose to let most of the signal through at η 1 in order not to be noticed) or both pairs are split at η 1 , which is one of the P(2 3 , 2 4 ) degeneracies.
If V e = 1SNU, then Eve inputs a vacuum state, and Alice and Bob build key solely from the pairs produced at the source. As a result, the discord is minimal at η 1 → 0. If V e > 1 SNU, Eve's state can be regarded as thermal; in this case, she contributes pairs to those coming from the source. In fact, if the eavesdropper's input is too signi cant, the legal parties can build a quantum secure key, regardless of how much signal is coming from the source. As in any QKD, we expect that the eavesdropper will try to minimise her input, if only to escape detection. At best, she can hope to merely 'listen' in, in which case, her input is V e = 1 SNU. Yet, as soon as signal begins going through (η 1 > 0.1), the legal parties can build a quantum secure key, albeit slowly.
Let us point out that these plots have been obtained for very high level of noise on Alice's and Bob's branches. Indeed η 3 and η 4 are such that 80% of their signal is lost. Yet, even in this case, the legal parties are able to construct a quantum secure key.

Concluding remarks
In our previous work, we demonstrated that a central broadcast protocol using thermal states is quantum secure. In the present work, we allowed the eavesdropper to access the higher channel and thus, to have more power and control over the signal than either of the legal parties. She can intercept and resend photons pairs at will, and she can hide in the noise effectively. However, we nd that the conditional mutual information I(A : B|E) is always positive, which means that Alice and Bob are able to build a secret key from their signal. Furthermore, the discord D(B|A) is also always positive, so the secret key is quantum secure.
This protocol is secure as long as Alice and Bob have correlated pairs, which they show by checking that their g (2) (0) > 1. As we have explained, the origin of the pairs itself (either the source or the eavesdropper) makes no difference to there being secrecy. The quantum discord shows that there are always correlations between Alice and Bob, even under Eve's in uence.
This is the strength of this scheme. Even if Eve succeeds in hiding in the noise, if her input is not either vacuum or a perfect coherent state, she will contribute correlations to the pool which Alice and Bob can build key from, but she cannot know when or if these injected states have contributed to the key. Another option for Eve is to actually become the source; we explore this in a forthcoming publication.
This experiment was carried out at optical frequencies using a pseudo thermal source, however, the theoretical modelling was performed at values ofn consistent with the microwave regime. Interferometers used in radio astronomy rely on the presence of thermal correlations being preserved over astronomical distances, and the results in this paper suggest that the results are highly portable to the microwave regime. Hence, this method of key exchange appears to be a viable option for long distance key exchange. Defense & Space. Data that support the ndings of this study are available from the Research Data Leeds Repository [15].

Appendix A. Protocol 2
A.1. After η 2 The submatrices are as follows .

A.2. After η 3 and η 4
The submatrices are as follows