Discrete-phase-randomized coherent state source and its application in quantum key distribution

Coherent state photon sources are widely used in quantum information processing. In many applications, such as quantum key distribution (QKD), a coherent state functions as a mixture of Fock states by assuming that its phase is continuously randomized. In practice, such a crucial assumption is often not satisfied, and therefore the security of existing QKD experiments is not guaranteed. To bridge this gap, we provide a rigorous security proof of QKD with discrete-phase-randomized coherent state sources. Our results show that the performance of the discrete-phase randomization case is close to its continuous counterpart with only a small number (say, 10) of discrete phases. Compared to the conventional continuous phase randomization case, where an infinite amount of random bits are required, our result shows that only a small amount (say, 4 bits) of randomness is needed.

optics quantum computing 3 , bit commitment 4 , coin flipping 5 and blind quantum computing 6 , a perfect single photon source is assumed to be used, which is not feasible with current technology.Instead, a weak laser is widely used to replace the single photon source in practice.A laser can be well described by a coherent state 7 , on which a phase modulation by θ ∈ [0, 2π) implements the operation |α to αe iθ .For a coherent state, there is a nonzero probability to get components other than single photons, such as vacuum states and multi photon states.To model this imperfection, a photon number channel model is used 8 , which assumes the phase of the coherent state is randomized, A physical interpretation behind Eq. ( 2) is that when the phase of a coherent state is randomized, it is equivalent to a mixed state of Fock states whose photon number follows a Poisson distribution with a mean of |α| 2 .In other words, the Fock states are totally decohered from each other with continuous phase randomization.
We remark that phase randomization as specified in Eq. ( 2) is a common assumption in the theoretical models of many quantum information processing protocols including QKD 1,2 , blind quantum computing 6 and quantum coin tossing 5 .In practice, as will be discussed further below, the assumption of continuous phase randomization is often not satisfied in experiments.
Therefore, the security of a protocol (e.g. the security of a generated key in QKD) is not guaranteed.
To illustrate the problem, for simplicity, let us consider the example of QKD.The first QKD protocol is published in 1984 by Bennett and Brassard (BB84) 1 .Lots of progress has been made since then both theoretically and experimentally 9 .For the BB84 protocol, secure key bits can be transmitted only when single photon states are used.From the study of photon-numbersplitting (PNS) attacks 10 , one can see that multi photon components are not secure for QKD.The key idea to take this imperfection into consideration is by performing privacy amplification on key bits from good (single photon) states and bad (multi photon) states separately 11 .Meanwhile, in order to accurately quantify the amounts of key bits from good and bad states, the decoy-state method has been proposed 8,12,13 and experimentally demonstrated [14][15][16][17][18] .
For all the existing security analysis for coherent-state QKD protocols, including the recent RRDPS QKD protocol 19 , continuous phase randomization, Eq. ( 2), is assumed.It has been shown that when the phase is not randomized, either the security would be compromised or the performance will be reduced 20 .In fact, there are experimental quantum hacking demonstrations showing that a QKD system may be attacked when the phase is not randomized lately 21,22 .
There are two means to randomize the phase in practice, passive and active.In a passive phase randomization process, the laser is turned on and off to generate pulses.In this case, there can still be some residue correlations between adjacent pulses 23 , especially in the case of high-speed applications 24 .One might be tempted to make a naive argument that by switching a laser on and off, the phase is fully randomized.However, if we take such an argument seriously, it essentially claims that one can generate an infinite amount of randomness in a finite period of time, which is clearly not true from the study of quantum random number generation 23 .Thus we avoid this approach here.
In the active phase randomization process, a phase modulator is used to randomly modulate the phases.In this case, it can only perform discrete phase randomization, unless it uses an infinite amount of random numbers.In a recent experiment 25 with coherent state, each global phase is chosen from one of the over 1000 possible values.First, such a large number of phases demands high precision control, which is a challenge for real-time implementations.Second, even with 1000 phases, the phase is still discrete and no rigorous bound on key rate was derived.Since the work of Lo and Preskill was published 20 , it has been a long standing question to analyze the security of a practical QKD system with discrete phases.
In this work, we analyze the effect of discrete phase randomization and show that, as the number of phases goes up, coherence between the Fock states in Eq. (1) decreases rapidly.As an application, we provide tight security bounds for both non-decoy and decoy state QKD protocols with discrete phase randomization.In simulation, we compare the performance of our security bounds with the one provided by continuous phase randomization, which shows that our security bounds are tight when the number of phases goes to infinity.From a practical point of view, for small number of phases (say, only N = 10 phases!), with a typical set of experi-mental parameters, we observe that secret keys can be securely distributed over a fiber length of up to 138 km, very close to 140 km in the continuous phase randomized case.Thus Alice needs only less than 4 bits (2 4 > 10) of random numbers per pulse for phase randomization.
In contrast, all previous security proofs essentially assume an infinite number of bits of random numbers per pulse.Therefore, we are making a huge improvement here.Moreover, our scheme is very simple to implement.For instance, a much harder implementation of active phase randomization with 1000 discrete phases has been reported in literature 25 .Besides QKD protocols, our analysis of discrete phase randomization is also readily applicable to quantum computation and other quantum cryptographic primitives.

Results
Coherent state mixture Here, we consider a coherent state source whose phase is randomly picked from N different values.For the sake of simplicity, we assume the random phases are evenly distributed in [0, 2π), In the case of continuous phase randomization (when N → ∞), Eq. ( 2) essentially shows that one can decompose the phase-randomized coherent mixed state into a statistical mixture of Fock states, |n n|.In the application of QKD, as well as quantum computing 3 , the single photon state, |1 1|, is the most important component.
In the case of a finite N, one can decompose the mixed state to a set of pure states and hopefully, one of which is close to single photon state.First let us consider the case N = 2.We start with the initial state where the phase of coherent state √ 2α B is controlled by a quantum coin A. The factor √ 2 is included in the state for system B to simplify later discussions.The normalization factor is ignored throughout the paper unless it matters.By performing a Schmidt decomposition where the two pure states are given by By substituting the definition of coherent state, Eq. (1), it is not hard to see that |λ 0 (|λ 1 ) is a superposition of even (odd) photon number Fock states.By this decomposition, the Hilbert space is divided into the even and odd number Fock state spaces, H even ⊕ H odd .Since |λ 1 only contains odd photon number Fock states, we expect it is close to a single photon state, which can be confirmed from the calculation of fidelity later.
In the case of general N ≥ 1, the decomposition is similar but a bit more complex, where |j A can be understood as a quantum coin with N random outputs and the N pure states are given by By substituting Eq. ( 1), we have the following observations for |λ j .It is a superposition of Fock states whose photon numbers modulo N are the same j, Then, it is not hard to see that |λ j becomes close to a Fock state when N is large since Next, we can figure out the probability if Alice performs a projection measurement on the photon state in the basis of |λ j , which is simply the norm of Eq. ( 9), where µ = 2|α| 2 .When N → ∞, it becomes a photon number channel and follows a Poisson distribution µ j e −µ /j!.
Coherent state scheme A phase encoding QKD scheme using a coherent state source is shown in Fig. 1, which is essentially an interferometer.In the state preparation stage, Alice prepares a weak coherent state √ 2α , whose phase is modulated randomly by the first phase modulator P M1.The state is separated into two pulses, |α r and |α s , by a beam splitter.And then Alice encodes the bit and basis information (say, according to the BB84 protocol) in the relative phase via the second phase modulator P M2.Here, for simplicity, we consider the case that the reference pulse has the same intensity with the signal.Our results can be extended to the strong reference case 26,27 and the asymmetric case 28 , as well as other encoding schemes such as polarization encoding and time-bin encoding 29 .
In the scheme with discrete N-phase randomization, the photon source is decomposed into states |λ j as shown in Eq. ( 8).After going through the phase encoding scheme as shown in Fig. 1, the four BB84 states encoded in |λ j can be written as where we omit the subscript j on the left side, but it should be understood that the four states do depend on j.
The key point to guarantee the security of the BB84 protocol is that Eve cannot distinguish the state in two conjugate bases, X and Y .The two density matrices in the two bases can be written as Note that each logical state should be regarded as a pure normalized state.In the ideal case, where a basis-independent source, such as a single photon source, is used, the density matrices in the two bases should be the same, In the security analysis, one of the key parameters is the basis dependence of the source, which is the fidelity between the two states in the X and Y bases, where µ = 2|α| 2 and the detailed fidelity evaluation is shown in Supplementary Materials. Denote j as the t-th order approximation of the fidelity, by taking l = 0, . . ., t in the summation.The zeroth order is One can see that = 1/4, . . . .Since when F < 1/ √ 2 would not render any positive key rate 20 , it is confirmed that multi photon states are not secure for QKD due to their large basis dependence in the BB84 protocol.
Take the first order for |λ 0 and |λ 1 , The fidelity approaches to 1 rapidly as N becomes large, especially when µ is small, as shown in Fig. 2.This shows with enough discrete phases, one can approximate the vacuum state and the single photon state infinitely well, which is extremely useful in applications such as QKD.

Key rate
The key rate formula given by the standard security analysis for QKD with imperfect devices 8,11 is ], Here, I ec is the cost of error correction; Q µ and E µ are the overall gain and quantum bit error rate (QBER) which can be directly measured in QKD experiments; µ denotes the expected photon number of the signal state; f denotes the error correction efficiency; and H(e) = −e log 2 (e) − (1 − e) log 2 (1 − e) is the binary Shannon entropy function.We assume that Alice and Bob run the efficient BB84 30 and take the basis sift factor to be 1.The core of the security analysis is to figure out the privacy amplification term probability that Alice sends single photon states.
In this case of discrete phase randomization, the photon source is not decomposed of Fock states.Instead, we decomposed the channel into |λ j according to Eq. ( 7).The single photon state will be replaced by |λ j and the Poisson distribution will be replaced by Eq. ( 10).
Now we can slightly modify Eq. ( 17) to fit our case where P j is given in Eq. (10).The yield Y j and bit error rate e b j of |λ j , can be estimated by the decoy state method.Here, without any confusion, we use the same notation as the Fock state case for simplicity.One can bound the phase error rate e p j from e b j similar to the work of Lo and Preskill 20 , which is shown in the Supplementary Materials.
From the basis dependence we know that only j = 0 and j = 1 would contribute positively to the final key rate.Thus, the key rate evaluation becomes the following minimization problem.
There are other constraints based on the gain and QBER obtained from the experiments.Note that with other security proof techniques the key rate given in Eq. ( 18) can be improved.For example, the vacuum component Q 0 is showed 31 to have no phase errors when the photon number channel model is applied.
Parameter estimation Now, we need to estimate key parameters, Y j and e b j .First, let us consider the no-decoy state case, where we assume all the losses and errors come from |λ 0 and |λ 1 , in the worst case scenario, Since the right side of Eq. ( 53) can be obtained from the experiment directly, one can easily solve the minimization problem presented in Eq. ( 19) to get the key rate.
We simulate a typical QKD system 32 and compare various cases of N. The result is shown in Fig. 3, from which we can see that with only 4 random phases, the performance of discrete phase randomization is very close to the one of continuous phase randomization.We can also observe the key rate of one phase and two phases are similar, but there is a gap when the phase number becomes three.This can be explained as follows.We note that F For the case of the decoy-state method, the analysis is trickier.In the security proof of the since all the Fock states |n n| are the same in the signal and decoy states.This is not so straightforward in N discrete phase randomization case, because as defined in Eq. ( 9), where µ and ν are the intensities of signal and decoy states.Thus, we do not have the simple relations as the continuous phase randomization case, Eq. ( 21).Fortunately, we have shown that |λ j is very close to the Fock state |j .We expect the inequality shown in Eq. ( 22) to be an approximate equality.
Following the quantum coin argument used in the GLLP security analysis 11 , the yield and error rate difference between the signal and decoy states are given by where Now the extra constraints added to the minimization problem of Eq. ( 19) for the decoystate method are, along with Eq. ( 54), where P µ j are given in Eq. (10).If more decoy states are used, more linear equations will be added to Eq. ( 25).
We simulate a QKD system 33 with vacuum+weak decoy state 34 and compare various cases of phase number N. The decoy and signal intensities are numerically optimized to maximize the key rate.The result is shown in Fig. 4, from which we can see that with only 10 random phases, the performance of discrete phase randomization is very close to the one of continuous phase randomization.

Discussion
In summary, we just need 10 random phases for the discrete phase randomization, the fidelity of which is very close to the continuous case.We demonstrate the effect of discrete phase randomization by taking the QKD protocol as an example and show that it gives a big improvement on the performance.Without phase randomization, the key rate decays rapidly as a function of the transmittance of the channel and drops to zero after less than 15km of optical fibers as shown in Fig. 3.In contrast, with discrete phase randomization, the key rate scales linearly as a function of the transmittance and QKD remains feasible over 138km of fibers as shown in Fig. 4. Since only four bits of random numbers per pulse, which already give 2 4 = 16 > 10 possible phases, are required for phase randomization, our scheme is highly practical.Note that a much harder discrete phase randomization experiment with 1000 phases 25 has already been demonstrated.Moreover, our method may not only apply to the same signal and reference pulse amplitudes case, but also to the asymmetric amplitude case and the strong reference pulse case.
We remark that our discrete phase randomization idea applies to other quantum information processing protocols including blind quantum computing and quantum coin tossing.
There are a few interesting prospective projects.First, due to the finite length of the key, statistical fluctuation needs to be taken into consideration which can be dealt with by finite key analysis as in a recent work. 35Second, N discrete phase randomization process is not perfect in an actual system, i.e., there will be a small error in the phase modulation such that the actual phase applied will be δ + 2πk N where δ is a small number that can be positive or negative.The imperfect phase modulation can be dealt with by modifying our fidelity calculations.Besides the usual BB84 QKD protocols, our idea can also be extended to Measurement-Device-Independent QKD 36 by treating both sources as discrete phase randomized.

A Basis dependence
This document provides the Supplementary materials to the manuscript, "Quantum key distribution with discrete-phase-randomized coherent states".In Section A, the basis dependence between the X and Y (fidelity of two density matrices) for |λ j is calculated when N discrete randomized phases are used.In Section B, we present the parameter estimation of the decoystate method.In Section C, the pseudo codes for both nondecoy and decoy simulation are given as well as the bound for phase error e p j .
In order to make the derivation easier to understand, we use index n to represent the photon number, index k to represent the discrete phase, index j to represent the decomposed Fock state approximations.
We restate the four BB84 states phase encoded in the decomposed state |λ j as presented in Main Text, where the denominators are the normalization factors.
To evaluate the fidelity between the two states in the two bases, we calculate the related inner products of these four states, The detailed calculations of inner products and norms are shown in Section A. Now we substitute these values to evaluate fidelity, where |± and |±i are the normalized eigenstates of the X and Y bases.The inequality comes from the fact that the fidelity of two mixed states is the maximal of the fidelity of all the purifications.Here, we use the intuition that two Bell states are the same, Now, let us simplify Eq. ( 28) and we expect it to be very close to 1 when N is large.
where the summation is taken over x = 1, e 2πi/N , . . ., e 2πi(N −1)/N , N dots evenly distributed on the unit circle of the complex plane.Take the Taylor expansion of µ = 2|α| 2 ≥ 0 around 0, The the details of Taylor expansion and the calculation of x n−j are shown in Section A.
Approximations: large N or small µ Here, we want to check the fidelity given in Eq. ( 31) when N is large or µ is small.Zeroth order, by taking l = 0 in the summation, One can see that F First order approximation, by taking l = 0 and l = 1 in the summation, Since N ≥ j, the second O(•) in the last equality can be neglected.The first order approximation will approach to the zeroth order exponentially fast, O(µ N /N!).We are interested in the first two cases j = 0 and j = 1, F We notes that the second order approximation of F 0 when N = 1 coincides with Eq. ( 22) in 20 , thus our fidelity formula also extends to N = 1 case.Also we notice the first order term when N = 1 vanishes, making the key rate performance of N = 1 and N = 2 to be similar, both of order 1 − O(µ 2 ).For N ≥ 3, the performance is improved greatly to 1 − O(µ N ).
Norms, (37) Here, we use the inner products between two coherent states, It is not hard to see that by adding a same phase to φ and θ, the result is the same.

Taylor expansion and summation
Taylor expansion: Summation: where the summation is taken over x = 1, e 2πi/N , . . ., e 2πi(N −1)/N , N dots evenly distributed on the unit circle of the complex plane.

B Parameter deviation in the decoy-state method
Here we consider the parameter (Y j and e j ) deviations between the signal states and the decoy states in the case of N discrete phase randomization.Denote the intensity of the signal state to be µ and decoy state to be ν, ν < µ.We want to figure out the relationships between Y µ j , e µ j and Y ν j , e ν j , respectively.
We follow the tagged idea for the phase error estimation 11 .First, we need to evaluate the fidelity between λ µ j and λ ν j as defined in Main Text, where µ = |α| 2 and ν = |β| 2 .We note that these are the states after phase randomization and before qubit encoding.Then the fidelity is given by In the last equality, we assume α * β is a real number, which can be set when their phases are the same.In experiment, one can think of the scenario where the decoy state intensity modulation is done after phase randomization.When N → ∞, this fidelity will go to 1 as the photon number channel model.Take the first order approximation when N is large or µ is small, One can show that Eq. ( 42) is a non-decreasing function with increasing j, Apply the quantum coin idea from GLLP 11 , Normally Y j is in the order of channel transmittance η.One can see that if F ( λ µ j , λ ν j ) ≤ √ 1 − η, the difference can be from [0, 1], which would result in zero key rate.On the other hand, if F = 1, we have Y µ j = Y ν j , which is reasonable since the yields of the same states should be the same.
With the calculations presented in Section B, we can solve Eq. ( 46), Note that once N, µ and ν are given, F µν is given by Eq. ( 44) and hence the yield and error rate differences are fixed.

C Simulation
In this section, we calculate the key rates of both decoy and non-decoy methods derived in the Main text.We use typical experimental parameters 33 where the basis dependence ratio is defined as Here, the fidelities F j are given in Eq. (28).
2. Then we calculate F j (ρ x , ρ y ) ≥ according to Eq. ( 23) and (25) from Main text, we calculate ∆ j and e p j according to Eq. ( 51) and ( 52) in this Supplementary Material.

Figure 1 :
Figure 1: Schematic diagram for the phase-encoding QKD scheme with coherent states.The

Figure 2 :
Figure 2: (Color Online) Plots of fidelity for different values of mean photon number µ.The the gain of single photon state; Y 1 and e p 1 are the yield and the phase error rate of the single-photon signal state, respectively, which are estimated by the decoy-state method.Here, µe −µ is the (Poisson)

N = 1
coincides with Eq.(22) in the work of Lo and Preskill 20 , thus our fidelity formula also extends to the N = 1 case.Also we notice that the first order term of N = 1 vanishes, making the key rate performance of N = 1 and N = 2 to be similar, both of order 1 − O(µ 2 ).For N ≥ 3, the performance is improved greatly to 1 − O(µ N ).The details of this simulation and all following simulations are shown in Supplementary Materials.

Figure 3 :
Figure 3: (Color Online) Plots of key rates for different numbers of random phases N. When

Figure 4 :
Figure 4: (Color Online) Plots of key rates for different numbers of random phases N. Dashed

5 .
Substitute the above quantities into min0≤Y j ,e b j ≤1 {P 0 Y 0 [1 − H(e p 0 )] + P 1 Y 1 [1 − H(e p 1 )]}according to Eq. (19) from Main text and numerically optimize (e 0 , e 1 , Y 0 , Y 1 ) for the minimum.The decoy and signal intensities µ and ν are numerically optimized to maximize the key rate.Typical value of µ is 0.5.One weak decoy state with typical mean photon number of ν = 0.001 and one vacuum state are used.
it becomes a Fock state |λ j = |j .Later in the simulation, one can see that when N = 10, the mixed coherent state becomes very close to Fock state mixture in terms of performance of QKD.Similar to the case of N = 2, the Hilbert space is divided into