A fully passive transmitter for decoy-state quantum key distribution

A passive quantum key distribution (QKD) transmitter generates the quantum states prescribed by a QKD protocol at random, combining a fixed quantum mechanism and a post-selection step. By avoiding the use of active optical modulators externally driven by random number generators, passive QKD transmitters offer immunity to modulator side channels and potentially enable higher frequencies of operation. Recently, the first linear optics setup suitable for passive decoy-state QKD has been proposed. In this work, we simplify the prototype and adopt sharply different approaches for BB84 polarization encoding and decoy-state generation. On top of it, we elaborate a tight custom-made security analysis surpassing an unnecessary assumption and a post-selection step that are central to the former proposal.


I. INTRODUCTION
Quantum key distribution (QKD) allows for information-theoretically secure key exchange between distant parties through an insecure channel [1,2].This possibility, which is inaccessible from the point of view of classical communications, makes QKD a promising candidate for long-term communication security.Nowadays, QKD represents one of the most mature applications of quantum information science, and it is expected to become a prolific industry in the years to come.Notwithstanding, the security of real QKD implementations is not fully established yet, due to the difficulty of experimentally guaranteeing that the QKD devices stick to the assumptions and models presumed in the security proofs [3].
A particularly controversial assumption of most QKD security analyses is that no information leakage occurs through the boundaries of Alice's and Bob's labs.This premise opens the door for the so-called Trojan horse attacks (THAs) [4][5][6][7][8], where an adversary injects bright light pulses into a QKD transmitter/receiver and then measures the back-reflected light, aiming to extract information about the setting choices.Notably, a possible solution to deal with information leakage in the QKD transmitter consists of trying to upper bound Eve's accessible information gain and account for it in the estimation of the secret key length [9][10][11][12].Note, however, that this approach relies on modelling the information leakage to a certain extent, and it requires to add significant optical isolation to prevent a severe drop of the secret key rate and the achievable distance.
On the contrary, an alternative solution that might rule out THAs once and for all is to consider a fully passive (rather than active) QKD transmitter, as illustrated in Fig. 1.
FIG. 1. Schematic depiction of (a) active and (b) passive decoy-state QKD transmission.In the active case, a polarization modulator (Pol-M) and an intensity modulator (Decoy-IM) are driven by respective quantum random number generators (QRNGs), responsible for implementing the protocol settings.In the passive case, one or more laser diodes generate pulses that are sent through a linear optics network.Depending on the detection outcomes observed in the photodetectors ({Dj}), different signal states are actually generated, avoiding the use of active modulators or QRNGs.
In a passive transmitter (PT), the protocol states are generated at random using inherent quantum randomness of the device, in so avoiding the use of quantum random number generators (QRNGs) to actively modulate the protocol settings (e.g.intensity, phase or polarization), or the use of auxiliary optical modulators of any kind.Indeed, the advantages of passive encoding go beyond the obvious security upgrade.To be precise, the fact that a PT avoids using externally driven elements makes it very desirable to operate QKD systems at high transmission rates, and to reduce the complexity (and thus the cost) of practical QKD implementations [13].Indeed, the possibility to reach an enhanced bandwidth by suppressing active modulation has already been realized in [14], where the construction a modulator-free (although active) QKD transmission chip is reported.
However, these advantages come at the price of decreasing the key generation rate for two main reasons.On the one hand, in a PT, additional sifting is required to discard those rounds where the randomly generated settings do not lie in certain acceptance regions.On the other hand, the finite size of these acceptance regions is an inherent source of noise not present in the active case.
In short, a simple setup simultaneously generating random decoy states and random photon polarizations in a fully passive way remained elusive for more than a decade.Recently though, a linear-optics-based PT of this kind has been proposed in [35], combining the ideas of [22] and [31].Specifically, in [35], a passive decoy-state BB84 protocol is considered, using a single intensity for the key generation basis and three different intensities for the parameter estimation basis.In the present work, we devise a simplified architecture for the prototype presented there and consider the standard decoy-state BB84 protocol instead, with three common intensity settings per basis.For symmetry reasons, our protocol uses both bases for key generation.
Remarkably as well, to avoid the assessment of the security analysis with mixed polarization states, the proposal in [35] relies on a facilitating assumption.Namely, that the actual protocol can be reduced to an ideal one where perfect Bell pairs are prepared for the single photon events and the effect of the mixed polarizations is incorporated a posteriori, adding post-processing noise at Alice's local measurements.Here, we circumvent this assumption by elaborating a custom-made security analysis for the mixed single-photon states.
On top of it, the decoy-state method in [35] relies on an auxiliary post-selection probability to decouple the intensity and the polarization of the output Fock states of the PT in the parameter estimation basis.This step, which entails an undesired discard of raw data, requires a QRNG and might be cumbersome to implement in practice.In this work, we avoid this extra sifting by tackling the decoy-state parameter estimation with the intensity-setting-dependent Fock states directly.
The structure of the paper goes as follows.We present the PT and its mixed output state in Sec.II.In Sec.III we describe a simple approach to post-select decoy-state BB84 acceptance regions, together with the quantum states that arise from this post-selection.Sec.IV is dedicated to explain our decoy-state parameter estimation method, and in Sec.V we derive the single-photon phase-error rate of the problem at hand.Coming next, in Sec.VI we evaluate the rate-distance performance of our passive QKD scheme and compare it to the performance achieved in the active setting.Finally, Sec.VII provides a summarizing discussion, and a series of appendices are included at the end of the paper to ensure the reproducibility of the results.

II. A PASSIVE QKD TRANSMITTER
The PT we propose is depicted in Fig. 2. In the figure, we use the notation |τ ⟩ a,R(L) to denote a right-handed (left-handed) circularly polarized weak coherent pulse (WCP) in the spatial mode a with complex amplitude τ ∈ C.
|vac⟩, where |vac⟩ is the vacuum state and {a † R(L) , a R(L) } denote the creation/annihilation operators of a right-handed (left-handed) circular polarization state in spatial mode a. Notably, a † R |vac⟩ and a † L |vac⟩ shall be viewed as the north and the south pole of a Bloch sphere throughout this work, which we shall refer to as "the RL Bloch sphere".The selection of the circularly polarized single-photon states as the poles of the sphere is such that the equator plane of the sphere contains all possible linearly polarized single-photon states, the specific orientation being determined by the azimuthal angle.In particular, the creation operator associated to an arbitrary polarization (θ, ϕ) in the RL Bloch sphere reads where θ (ϕ) stands for the polar (azimuthal) angle of the sphere.Also, a WCP in spatial mode a, with amplitude τ and polarization specified by (θ, ϕ) shall be denoted as |τ ⟩ a,θ,ϕ .This said, let us present the output state of the PT.When combined in the polarizing BS (PBS), these orthogonally polarized coherent pulses generate a final coherent state with random intensity and random polarization in the RL Bloch sphere, coupled to each other.Lastly, this state enters a BS with transmittance t ≪ 1, where the intensity is attenuated to the single-photon level.Importantly, while the transmitted signal goes to the quantum channel, the reflected signal reaches a photo-detection system that accurately measures its polarization and intensity for post-selection purposes.
If we now assume perfect phase-randomisation for the input coherent states, the mixed output state of the transmitter is The integral in α is direct (the purpose of changing variables from β, γ and δ to δ 1 , δ 2 and δ 3 is to enable this immediate integration in α) and yields a phase-randomised WCP, with the n-photon Fock states |n⟩ θ,ϕ given by Note that we have omitted the dependence on δ 1 , δ 2 and δ 3 in Eq. ( 5) for readability.Also, the spatial mode w is not explicitly indicated any more.The phase differences δ 1 , δ 2 and δ 3 uniquely determine the relevant output variables ϕ, θ and I, and it is desirable to describe the output state of the transmitter (given in Eq. ( 4)) in terms of the latter instead.The joint probability density function f ϕ,θ,I (ϕ, θ, I) is obtained in Appendix B and factors as where for ϕ ∈ (−π, π], θ ∈ [0, π] and I ∈ [0, I max,θ ), I max,θ being defined as Notably, the above distribution exhibits azimuthal symmetry and is peaked towards the equator plane of the RL Bloch sphere, given by θ = π/2.This makes the proposed architecture convenient for a passive decoy-state BB84 protocol using "equator-plane BB84 states".In the next section, we elaborate on this idea.

III. POST-SELECTION OF BB84 ACCEPTANCE REGIONS
From Eq. ( 4) to Eq. ( 8), it follows that the mixed output state of the transmitter reads if no post-selection step is performed.Coming next, we define acceptance regions in the (ϕ, θ, I) space for the postselection, which are presumed to be accurately identified by the photo-detection system in Fig. 2. For the standard decoy-state BB84 protocol with three intensity settings, an obvious choice is where x ∈ {0, π, π/2, −π/2} tags the BB84 polarization states, ∆ϕ ∈ (0, π/4) and ∆θ ∈ (0, π/2) define the angular widths of the acceptance regions in the RL Bloch sphere (see Fig. 3), and I j stands for the interval of intensities that defines the j-th intensity setting, j ∈ {s ("signal"), d ("decoy"), v ("vacuum")}.As the notation suggests, we shall assume below that the key is extracted from the signal setting, while the decoy and the vacuum settings are only used for parameter estimation.The resulting post-selected states read σ x,j = σx,j / Tr [σ x,j ] for σx,j = 1 2π Note that That is to say, Tr [σ x,j ] provides the probability that the output state lies in the acceptance region Ω x,j .Notably as well, given the set {Ω x,j } x , the Z (X) basis acceptance region associated to the j-th intensity setting is constructed as In what follows, we shall use the shorthand notation ⟨•⟩ Ω to denote the triple integral of any input "•" weighted by f ϕ,θ,I (ϕ, θ, I) = f θ,I (θ, I)/2π in the region Ω of the (ϕ, θ, I)-space.As an example, with this convention Eq. ( 11) and Tr [σ x,j ] = ⟨1⟩ Ωx,j .Also, with this notation, it is obvious that σ x,j is a convex combination of Fock states.To be precise, normalizing Eq. ( 13) immediately yields where 1 Ωx,j and is a Fock state with photon number n. Notably, the conditional photon-number statistics p (n|Ω x,j ) are independent of x because of the azimuthal symmetry.Therefore, below we shall denote p (n|Ω x,j ) simply as p n|j for all x.
Similarly, the same symmetry shows that, if we focus on the acceptance region Ω Z j = Ω 0,j ∪ Ω π,j , the post-selected output state of the transmitter reads with σ Z j,n = (σ 0,j,n + σ π,j,n ) /2. Identically, for the X basis we have σ

IV. DECOY-STATE ANALYSIS
In this section, we present the decoy-state equations for the Z basis, and the ones for the X basis are discussed at the end.
In the first place, it is necessary to introduce some notation.Let Q Z j (E Z j ) be the probability that a "click" (an "error") is recorded conditioned on the event that σ Z j is post-selected and Bob performs his measurement in the Z basis.Namely, Q Z j = p click|σ Z j , Z and E Z j = p err|σ Z j , Z .Similarly, let y Z j,n and e Z j,n denote the corresponding n-photon yield and n-photon error probability, respectively, such that y Z j,n = p click|σ Z j,n , Z and e Z j,n = p err|σ Z j,n , Z .
From the above definitions and Eq. ( 16), it follows that p n|j e Z j,n for all j.Therefore, truncating the sums to a threshold photon number n cut , we find the constraints for j ∈ {s, d, v}.Setting a threshold photon number n cut as we do allows to define finite linear programs to estimate the single-photon yield and the single-photon error probability of the signal intensity window (i.e., the one devoted to key extraction).Note that the Fock states σ Z j,n and σ x,j,n are (generally) different for each setting j, and thus distinguishable for Eve.This implies that the yields y Z j,n and the error probabilities e Z j,n might be setting-dependent.As a consequence, it is mandatory to incorporate additional constraints in the decoy-state analysis.For this purpose, the tool that we use is the TD argument [36], presented in Appendix C.This tool fundamentally limits the maximum bias that Eve may induce between the measurement statistics of two non-orthogonal quantum states, thus naturally providing upper bounds on the differences y Z j,n − y Z k,n and e Z j,n − e Z k,n for all j, k ∈ {s, d, v} (j ̸ = k) and n ∈ N. If we denote these bounds respectively as ∆ Z j,k,n and ∆Z j,k,n , the resulting linear programs that fulfil the decoy-state method read min y Z s,1 for the signal-setting single-photon yield, and max e Z s,1 p n|j e Z j,n (j ∈ {s, d, v}), for the signal-setting single-photon error probability.
Importantly, replacing Z by X everywhere above, the relevant quantities -Q X j , E X j , y X j,n , e X j,n , ∆ X j,k,n and ∆X j,k,nand linear programs for the X basis follow.Coming next, we compute the specific values of ∆ Z j,k,n , ∆ X j,k,n , ∆Z j,k,n and ∆X j,k,n using the TD argument.
A. Calculation of ∆ Z j,k,n and ∆ X j,k,n For simplicity of the notation, the derivation below assumes collective attacks.Nevertheless, explicit calculation easily shows that the resulting bounds hold against fully general attacks too.This feature follows from the tensor product structure of the global state of all protocol rounds.
Let ÛBE denote Eve's unitary operation in any given round, acting on the system B transmitted through the channel and a probe system E under Eve's control, initialized in a certain state |φ⟩ E .Also, for the purpose of evaluating the yields, Bob's possible measurement outcomes are either "click" or "no click".Therefore, his Z basis measurement is described by a positive-operator-valued measure (POVM) with elements . Note that we are assuming the basis-independent detection efficiency condition here, such that no basis dependence is included in the POVM elements.Now, recalling that y Z j,n = p click|σ Z j,n , Z , it follows that for all j ∈ {s, d, v} and n ∈ N. Note that, aiming to keep the notation introduced in Sec.II, the subscript B of Bob's system is not made explicit in the state between brackets.From Eq. ( 20), direct application of the TD argument (see Appendix C) yields for all j, k ∈ {s, d, v} and n ∈ N, where is the TD between σ Z j,n and σ Z k,n .A similar procedure leads to ∆ X j,k,n = D σ X j,n , σ X k,n , and in virtue of the azimuthal symmetry it follows that ∆ X j,k,n = ∆ Z j,k,n for all possible inputs.To finish with, we remark that evaluating the TD values ∆ Z j,k,n requires to provide a matrix representation of the input density matrices.In this regard, a natural representation is given in Appendix D.
For the purpose of evaluating the Z basis error probabilities, finer-grained measurement operators are required, in a one-to-one correspondence with Bob's possible outcomes "0", "π" and "no click" (as usual, double clicks are randomly assigned to a detection event, i.e., "0" or "π" in this case).Therefore, error-wise, Bob's measurement is described by a POVM with elements Recalling that e Z j,n = p err|σ Z j,n , Z and that σ Z j,n = (σ 0,j,n + σ π,j,n ) /2, it follows that e Z j,n = 1 2 p (err|σ 0,j,n , Z) + p (err|σ π,j,n , Z) for all j ∈ {s, d, v} and n ∈ N.That is to say, upon post-selection of σ 0,j,n (σ π,j,n ), an error occurs if Bob records the outcome "π" ("0").Hence, defining e 0,j,n = p (err|σ 0,j,n , Z) and e π,j,n = p (err|σ π,j,n , Z), the TD argument provides the constraints for all j, k ∈ {s, d, v} and n ∈ N. From Eq. ( 24) and the triangle inequality, the desired bound on the bias e Z j,n − e Z k,n follows.Namely, for all j, k ∈ {s, d, v} and n ∈ N. In conclusion, ∆Z j,k,n = D (σ 0,j,n , σ 0,k,n ) + D (σ π,j,n , σ π,k,n ) 2. What is more, the azimuthal symmetry assures that D (σ 0,j,n , σ 0,k,n ) = D (σ π,j,n , σ π,k,n ), and thus Again, proceeding identically and invoking the symmetry, for the X basis one finds ∆X j,k,n = D σ π 2 ,j,n , σ π 2 ,k,n = D (σ 0,j,n , σ 0,k,n ) = ∆Z j,k,n for all possible inputs.As before, the reader is referred to Appendix D for a matrix representation of the σ x,j,n , necessary for the calculation of the TD values ∆Z j,k,n .

V. ENTANGLEMENT-BASED PROTOCOL AND SINGLE-PHOTON PHASE-ERROR RATE
As in the previous section, we assume the restricted scenario of collective attacks, and recall that this suffices to establish a valid asymptotic key rate analysis against coherent attacks in virtue of the de Finetti theorem [37] or the post-selection technique [38].
Throughout this section, we shall only refer to the single-photon component σ x,s,1 of the output states σ x,s (see Eq. ( 15)), where we recall that we set j = s because we assume that the key is extracted from the signal intensity window, I s .For convenience, we define |R⟩ = a † R |vac⟩ and |L⟩ = a † L |vac⟩ (poles of the RL Bloch sphere).The formulation of the virtual entanglement-based (EB) protocol proceeds in two steps.In a first step, we consider a purification of σ x,s,1 via a shield qubit system A inaccessible to all Alice, Bob and Eve.In particular, this requires diagonalizing σ x,s,1 first.In a second step, we consider an additional purification via an ancillary system A ′ held by Alice, which determines the states she prepares for Bob via projective measurements as usual.Bob's system shall be denoted by the subscript B.
For the purpose of diagonalizing σ x,s,1 = ⟨e −I I |1⟩⟨1| θ,ϕ ⟩ Ωx,s /⟨e −I I⟩ Ωx,s , we use again the matrix representation provided in Appendix D. In particular, from Eq. (D7), straightforward algebra leads to in the orthonormal basis {|R⟩ , |L⟩}, where 1 B denotes the identity operator and such that after attaching the shield system A -with, say, orthonormal basis {|0⟩ A , |π⟩ A }-, the purified state reads As stated above, in the virtual EB approach Alice holds an ancillary polarization qubit A ′ maximally entangled to Bob's purified qubit AB.That is to say, whenever Ω Z s is post-selected and a single-photon is emitted, the equivalent three-partite state prepared by Alice in the EB protocol reads where again we are using the RL Bloch sphere notation Importantly, it is shown in Appendix E that Eq. ( 31) can be rewritten as Therefore, the Z basis phase-error probability ϕ Z s is defined as the bit-error probability between the outcomes X A ′ and X B , reached by measuring the polarization qubits A ′ and B in the test bases [39] (i.e., {|π/2⟩⟨π/2| A ′ , |−π/2⟩⟨−π/2| A ′ } and {|π/2⟩⟨π/2| B , |−π/2⟩⟨−π/2| B }, respectively).In the prepare-and-measure picture, this matches the bit-error probability that arises when Ω X s is post-selected, a single-photon is emitted (these two features are equivalent to asserting that σ X s,1 is post-selected), and Bob selects the X basis.Namely, As usual, one can define the X basis single-photon phase-error probability ϕ X s in an entirely identical fashion, and it can be computed as ϕ X s = e Z s,1 /y Z s,1 following the same argument presented here.

VI. PERFORMANCE
The secret key rate formula of our passive QKD scheme is determined by the fact that we consider a decoy-state BB84 protocol, with the minor difference that one must deal with the continuous post-selection regions introduced by the PT.
Naturally, we assume that both bases are used for key extraction, because they are equally likely to be post-selected.In short, the secret key rate reads K = K Z + K X with where M ∈ {Z, X}, q M stands for Bob's probability to select basis M (q M = 1/2 being optimal for symmetry reasons), h(•) stands for Shannon's binary entropy function, and f EC denotes the error correction efficiency.
In what follows, we evaluate the rate-distance performance of the PT illustrated in Fig. 2. For this purpose, in the absence of experimental data, we consider a natural channel and detector model presented in Appendix F. The model is specified by the channel transmittance, η ch = 10 −αattL/10 -where α att denotes the attenuation coefficient of the channel and L stands for its transmission length-, the detector efficiency of Bob's detectors, η Bob , and their dark count rate, p d .For illustration purposes, we set these parameters to typical values of α att = 0.2 dB/km (telecom wavelength attenuation), η Bob = 65% and p d = 10 −6 .As for the input settings of the PT, we assume that no intensity value in the accessible range (0, 4νt) is withdrawn, such that the intervals I v , I d and I s are strictly consecutive and exhaustive in this range.Also, we fix the width of I v /4νt and I d /4νt to a reasonable small value of 5 × 10 −3 for the numerics.Hence, I v /4νt = (0, 5) × 10 −3 and I d /4νt = (5, 10) × 10 −3 .The product νt and the angular widths ∆θ and ∆ϕ of the post-selection regions are numerically optimized to maximize the secret key rate for each value of L, and the optimization reveals a roughly constant optimal value νt ≈ 0.25.Finally, we set the threshold photon number for the decoy-state linear programs to n cut = 3. Importantly, the loss of generality of the above numerical specifications is very small, as we check that the delivered secret key rate is remarkably close to the perfect decoy-state parameter estimation limit (which we compute under full optimization as well).The results are shown in Fig. 4, where we further include the secret key rate reached in the active setting for comparison purposes.The figure shows that the security and simplicity upgrades of the PT come at the price of lowering the secret key rate by a factor ∼ 1/20.As mentioned in Sec.I, the origin of this discrepancy is twofold.In the first place, the post-selection of acceptance regions requires additional sifting compared to the active setting.In the second place, the post-selected σ x,j,n are in a mixed polarization state.This represents an inherent source of noise not present in the active case, where one typically considers pure states with fixed polarizations.

VII. DISCUSSION
Active QKD systems often rely on the use of externally driven modulators, whose imperfections lead to security loopholes and side-channels (e.g.THAs), and whose frequency of operation typically limits the repetition rate of the system.Therefore, replacing all externally driven elements by a passive mechanism could be a very appealing feature for QKD: it provides immunity to modulator side channels and, in principle, it enables the operation of QKD systems at higher repetition rates.On top of it, passive architectures could reduce the complexity (and thereby the cost) of QKD infrastructures.Needless to say, this would entail an advantage in many practical situations, for instance, when it comes to deploying QKD on a satellite.
Despite the intense research in the field, working out a fully passive linear-optics setup for the celebrated decoystate BB84 protocol remained an open problem for more than a decade.Nonetheless, the present work, together with that in [35], elucidate this possibility for the first time, and explicitly construct different fully passive protocols with very diverse approaches to polarization encoding and decoy-state parameter estimation.This clearly illustrates the versatility of the considered prototype.On top of it, we provide a detailed security analysis for the mixed single-photon states generated by the transmitter, tightening a loose end present in [35].
For implementation purposes, we remark that the usage of four independent lasers in the PT is not a necessity by any means, but rather an instrument we use for theoretical convenience.Identically as in [35] -where a detailed discussion is included-, the same physical states can be generated by using a single laser and suitable Mach-Zehnder interferometry.This configuration benefits from an enhanced simplicity, because high-visibility interference demands photon indistinguishability, which is typically hard to enforce when using independent lasers.Furthermore, despite the resilience to modulator side-channels or THAs, certain other vulnerabilities may affect a PT.For instance, Eve could try to perform a laser-seeding attack to modify the phase/intensity of the laser pulses generated in the PT [40][41][42].Attacks of this kind, known to threaten actively modulated systems too, could invalidate the estimation of the secret key length in the passive scenario.What is more, in the case of a PT, Eve could launch a laser-seeding attack to alter the measurement outcome of its photo-detection system.To counter these problems, optical isolation must be incorporated at the output port of the transmitter, as it is done to protect active systems against attacks that inject light from the channel (like e.g.THAs).Notwithstanding, current security proofs against THAs in the active setting typically require the intensity of the back-reflected light to be minuscule for the information leakage to be irrelevant (as an example, the analyses in [10][11][12] demand such intensity to lie below 10 −7 or 10 −8 photons/pulse).In contrast to this, much less isolation is expected to be required to deal with laser-seeding attacks in the PT.This is so because "classical" (high intensity) light pulses are generated in the PT and arrive at Alice's measurement unit, say, containing 10 6 -10 8 photons/signal.Therefore, as long as the intensity of the injected light is attenuated well below this level, its effect on the generated pulses or on the reading of the detection scheme will probably be negligible.Moreover, any slight modification of the actual measurement outcome due to Eve's action could be readily incorporated in the security proof.Similarly, laser-damage attacks [43] -which, again, have been proposed against active systems-may as well jeopardize the security of the PT.An attack of this kind might try to reduce the optical isolation of the transmitter, or to manipulate the behaviour of its internal components.As in the active setting, protection against laser-damage may be achieved with optical isolators, circulators, filters or even an optical fuse [44,45].In any case, a detailed analysis of these and other potential attacks where Eve actively meddles with the hardware lies beyond the scope of this work.
Leaving active tampering aside, potential information leakage via back-flash emission from the detection system might be another weakness of a PT that deserves further experimental investigation.If needed, this could probably be circumvented by simply using an anti-reflective coating.Also, we remark that Alice's intensity and polarization measurements are presumed to be noiseless in our analysis.However, to provide protection against a noisy measurement, the noise must be characterized to a certain extent because it affects the post-selected light pulses.Once characterized, it could be incorporated to the security analysis using similar techniques as it is done in the active setting to deal with e.g.state preparation flaws or intensity fluctuations.
After these various pending tasks are properly addressed, passive schemes could play a crucial role in the development of practical and affordable QKD solutions, in view of the increasing concerns related to the implementation security of QKD.This being the case, the present work is a valuable input to the topic.
(PRTR-C17.I1)-and the Galician Regional Government -with own funding-through the "Planes Complementarios de I+D+I con las Comunidades Autonomas" in Quantum Communication.WW is supported by the University of Hong Kong Seed Fund for Basic Research for New Staff and the Hong Kong RGC General Research Fund.
where J G is the jacobian determinant of the G function, We remark that the r.h.s. in Eq. (B4) follows from explicit calculation of the derivatives and the determinant.Notably, |J G (δ 1 , δ 3 )| is invariant under reflections with respect to δ 1 = π and/or δ 3 = π, such that J G G −1 (θ, y) ∩ Q k in Eq. (B3) takes the same value for all four contributions to the preimage of (θ, y).Since, in addition, f δ1,δ3 (δ 1 , δ 3 ) = 1/(2π) 2 for all pairs (δ 1 , δ 3 ), Eq. (B3) simplifies as At the symmetry axes δ 1 = π and δ 3 = π, which are necessarily mapped to the boundary of G(R), J G (δ 1 , δ 3 ) vanishes.As a consequence, f θ,y is divergent in this frontier.Note, however, that this feature does not compromise the normalization of f θ,y or the finiteness of any physical quantity relevant to the problem.All that remains is to write down the jacobian determinant of Eq. (B4) in terms of θ and y.In order to do this, it suffices to notice that in virtue of Eq. (B2), such that Substituting these two relations in Eq. (B4) and plugging the result in Eq. (B5) yields To finish with, let us explicitly identify the domain of f θ,y (θ, y), given by the image of the domain R via G.In virtue of the symmetry of G, G(R) = G(Q k ) for all k, and thus it suffices to show that G maps, say, the quadrant where y max,θ = min 1/ cos 2 (θ/2) , 1/ sin 2 (θ/2) .For this purpose, we identify the image of the boundary of Q 1 via G, which certainly defines the boundary of G(Q 1 ).If, for instance, we label the sides of the rectangle Q 1 as These four borders (together with the defining constraint y ≥ 0) shape the boundary of the region G(Q 1 ) = G(R) defined in Eq. (B9).
Needless to say, f θ,I (θ, I) follows trivially from f θ,y (θ, y) and the fact that y = I/2νt, leading to Eq. ( 8) in the main text (where the border {θ ∈ [0, π], y = y max,θ } is excluded because of the divergence of f θ,I ).2) a quantum measurement at Bob's lab.The measurement is modelled with a polarization rotator (PR) that selects Bob's basis setting, followed by a PBS that splits orthogonal polarizations in the Z basis (say, H and V).A noisy-and-lossy threshold detector is located in each output port of the PBS and we assume that both detectors are equal.Notably, channel and detector loss are jointly accounted for with a BS of effective transmittance η = η ch η det , where η ch (η det ) stands for the channel transmittance (detection efficiency).Also, the relevant spatial modes are indicated in red.
for known phases Γ + and Γ − irrelevant to the discussion.Coming next, the measurement implemented by each photo-detector is described by a POVM with elements { Êno click = (1 − p d ) |0⟩⟨0| , Êclick = 1 − Êno click }, where p d stands for the dark count probability and 1 stands for the identity operator (note that detector loss has already been accounted for in the channel).Denoting the first (second) ket in the r.h.s. of Eq. (F4) by |B⟩ (|C⟩), it follows that detectors "H" and "V" in Fig. 5  Notably, Eq. (F6) does not use the fact that ρ I,θ,ϕ w belongs to a Z basis acceptance region in any way.This consideration only matters for the calculation of the error probability p err ρ I,θ,ϕ w , Z , which we do next.For this purpose, we further assume that ρ I,θ,ϕ w belongs to an acceptance region associated to the horizontal polarization.This amounts to saying that ϕ ∈ [x − ∆ϕ, x + ∆ϕ] with x = 0, or equivalently that (ϕ, θ, I) ∈ Ω 0,j for some j ∈ {s, d, v}.In this case, a bit error occurs if the outcome "V" is recorded.Considering, as usual, that double-clicks are randomly assigned to a specific outcome, this means that p err ρ I,θ,ϕ w , Z = p V (1 − p H ) + p V p H /2 for all (ϕ, θ, I) ∈ Ω 0,j , which is easily taken to the form Finally, given Eq.(F6) and Eq.(F7), it is straightforward to compute Q Z j = p click|σ Z j , Z and E Z j = p err|σ Z j , Z .To be precise, since σ Z j = ρ I,θ,ϕ w Ω Z j /⟨1⟩ Ω Z j , it follows that On the other hand, E Z j = p (err|σ 0,j , Z) + p (err|σ π,j , Z) /2, and both σ 0,j and σ π,j are equally likely to trigger an error for symmetry reasons within our channel model.Therefore, E Z j = p (err|σ 0,j , Z), and thus

FIG. 2 .
FIG.2.Architecture of the PT.All input coherent states in the figure have a common large intensity ν and independent random phases α, β, γ and δ.Red color is used to denote the relevant spatial modes, while unused modes are tagged by the symbol "⊗".The interference occurring in the 50:50 beamsplitter (BS) of the top (bottom) arm yields a coherent state with a random intensity dependent on the phase difference β − α (δ − γ), while the polarization -common to both input statesis preserved.Crucially, the polarization of the top arm (right-handed) is orthogonal to that of the bottom arm (left-handed).When combined in the polarizing BS (PBS), these orthogonally polarized coherent pulses generate a final coherent state with random intensity and random polarization in the RL Bloch sphere, coupled to each other.Lastly, this state enters a BS with transmittance t ≪ 1, where the intensity is attenuated to the single-photon level.Importantly, while the transmitted signal goes to the quantum channel, the reflected signal reaches a photo-detection system that accurately measures its polarization and intensity for post-selection purposes.

FIG. 4 .
FIG.4.Rate-distance performance of our fully passive decoy-state BB84 proposal.For the sake of comparison, we include the secret key rate attained in the active setting as well (solid red line).The experimental parameters are set as specified in the main text.

FIG. 5 .
FIG.5.Schematic of the channel model.The quantum states generated in the PT undergo (1) a lossy quantum channel and (2) a quantum measurement at Bob's lab.The measurement is modelled with a polarization rotator (PR) that selects Bob's basis setting, followed by a PBS that splits orthogonal polarizations in the Z basis (say, H and V).A noisy-and-lossy threshold detector is located in each output port of the PBS and we assume that both detectors are equal.Notably, channel and detector loss are jointly accounted for with a BS of effective transmittance η = η ch η det , where η ch (η det ) stands for the channel transmittance (detection efficiency).Also, the relevant spatial modes are indicated in red.