Large-alphabet time-bin quantum key distribution and Einstein–Podolsky–Rosen steering via dispersive optics

Quantum key distribution (QKD) has established itself as a groundbreaking technology, showcasing inherent security features that are fundamentally proven. Qubit-based QKD protocols that rely on binary encoding encounter an inherent constraint related to the secret key capacity. This limitation restricts the maximum secret key capacity to one bit per photon. On the other hand, qudit-based QKD protocols have their advantages in scenarios where photons are scarce and noise is present, as they enable the transmission of more than one secret bit per photon. While proof-of-principle entangled-based qudit QKD systems have been successfully demonstrated over the years, the current limitation lies in the maximum distribution distance, which remains at 20 km fiber distance. Moreover, in these entangled high-dimensional QKD systems, the witness and distribution of quantum steering have not been shown before. Here we present a high-dimensional time-bin QKD protocol based on energy-time entanglement that generates a secure finite-length key capacity of 2.39 bit/coincidences and secure cryptographic finite-length keys at 0.24 Mbits s−1 in a 50 km optical fiber link. Our system is built entirely using readily available commercial off-the-shelf components, and secured by nonlocal dispersion cancellation technique against collective Gaussian attacks. Furthermore, we set new records for witnessing both energy-time entanglement and quantum steering over different fiber distances. When operating with a quantum channel loss of 39 dB, our system retains its inherent characteristic of utilizing large-alphabet. This enables us to achieve a secure key rate of 0.30 kbits s−1 and a secure key capacity of 1.10 bit/coincidences, considering finite-key effects. Our experimental results closely match the theoretical upper bound limit of secure cryptographic keys in high-dimensional time-bin QKD protocols (Mower et al 2013 Phys. Rev. A 87 062322; Zhang et al 2014 Phys. Rev. Lett. 112 120506), and outperform recent state-of-the-art qubit-based QKD protocols in terms of secure key throughput using commercial single-photon detectors (Wengerowsky et al 2019 Proc. Natl Acad. Sci. 116 6684; Wengerowsky et al 2020 npj Quantum Inf. 6 5; Zhang et al 2014 Phys. Rev. Lett. 112 120506; Zhang et al 2019 Nat. Photon. 13 839; Liu et al 2019 Phys. Rev. Lett. 122 160501; Zhang et al 2020 Phys. Rev. Lett. 125 010502; Wei et al 2020 Phys. Rev. X 10 031030). The simple and robust entanglement-based high-dimensional time-bin protocol presented here provides potential for practical long-distance quantum steering and QKD with multiple secure bits-per-coincidence, and higher secure cryptographic keys compared to mature qubit-based QKD protocols.


Introduction
Quantum cryptography provides a means for securely transferring information between distant parties [1].Among these fundamental tasks, the security of Quantum key distribution (QKD) with symmetric encryption relies on the security strength of the symmetric cryptographic algorithm itself.QKD with one-time pad stands out as one of the few methods capable of offering provable protection against different attacks [2][3][4].The reliable and efficient transmission of photonic entanglement plays a vital role in numerous quantum information processing tasks, including entanglement distribution [5][6][7][8][9][10], QKD [11][12][13][14][15][16][17][18], quantum teleportation [19], and quantum repeater [20,21].Entangled photons are highly desirable as carriers of secure quantum information due to their unique property-entanglement, steering, and Bell nonlocality [22].Any quantum state that violates a Bell inequality can be used for steering, and any steerable state is entangled, but not vice versa [22,23].In particular, for quantum cryptography, it makes a difference whether or not one assumes that the measurement devices are well characterized.For example, if a state is quantum steerable, its entanglement can be verified in a one-sided device-independent scenario, where Bob's measurements are characterized, but Alice's are not [23].Therefore, any practical quantum cryptography protocol based on quantum nonlocality and steering requires fewer assumptions and can guarantee the production of cryptographic keys that are genuinely random and secure [1,22,23].
In this study, we present an experimental demonstration of high-dimensional time-bin QKD in a 50 km fiber link, whose entanglement, steering witness, and security against collective Gaussian attacks are achieved simultaneously through commercially available dispersive optics [12,42].Time-frequency correlation measurements can bound Eve's Holevo information with finite-key effects via nonlocal dispersion cancelation capable of operating over extended fiber links without stabilizing interferometers.Furthermore, we extend our qudit-based QKD protocol to a high loss regime (up to 39 dB channel loss, as the current maximum attenuation available in our experiments) and are able to obtain over three hundred secret key rates (SKRs) per second with photon information efficiency (PIE) over 1 bit/coincidences, including the finite-key effects.By utilizing our specially designed ± 10 000 ps nm −1 dispersion emulator (compensator) at the optical telecommunications band, we show ≈ 1 order of magnitude improvement in both energy-time entanglement [60][61][62] and quantum steering [63] witness over a 50 km optical fiber.Leveraging our highly efficient single-photon detectors [10], and an effective error correction code [64,65], specifically designed for large-alphabet encoding with robustness against high quantum bit error rate (QBER), we realize a high-dimensional QKD that generates an SKR of 0.66 (0.24) Mbit s −1 through 21 km (50 km) of single-mode fiber with a secure PIE of 2.65 (2.39) bits/photon coincidences with finite-key effects, respectively.Here we obtained a 7.5× higher asymptotic SKR (a 6.6× higher SKR with finite-key effects) compared to the reported highest record using dispersive optics [47], and measured a 0.24 Mbits s −1 SKR with finite-key effects at 50 km fiber distance using energy-time entangled qudit QKD protocol.We also note that by using classical attenuated resources, the prepare-and-measurement protocols of high-dimensional QKD using dispersive optics have been demonstrated by field experiments with a key rate of 1.2 Mbits s −1 over optical fibers of 43 km [18].Additionally, a high-dimensional QKD protocol using large-alphabet encoding of time-energy entangled photons with security against collective Gaussian attacks has been demonstrated and obtained a SKR of 2.7 Mbits s −1 at 20 km fiber [16].Finally, we extend our high-dimensional protocol to the higher loss regime, where we realize that our system preserves a SKR of 0.30 kbits s −1 and a secure PIE of 1.10 bits/coincidences under a realistic maximum range of 195 km single-mode fiber (39 dB channel loss), approaching the upper bound of the theoretical limit of SKR [12,59].The obtained SKRs outperform recent demonstrated state-of-the-art qubit-based QKD protocols using standard single-photon detectors [25,26,[66][67][68][69].Our results demonstrate that not only the energy-time entanglement and quantum steering can be preserved over long-fiber distance, but also the potential of practical long-distance qudit QKD with multiple secure bits-per-coincidences and higher SKR over qubit-based QKD protocols.

Violation of EPR steering inequality, Bell-like inequality, and high-dimensional QKD protocol
In figure 1(a), we present the schematic of our experimental setup.In our system, we employ a prepareand-measure scheme, where Alice initiates the process by generating entangled continuous-wave spontaneous parametric down-conversion (SPDC) photon pairs.These pairs are created using a type-II phase-matched (signal photons have TE polarizations, and idler photons have orthogonal TM polarizations), single-spatial-mode periodically-poled potassium titanyl phosphate waveguide.For our SPDC source, the poling period of the waveguide is 78.74 µm, and the waveguide has a width of 3 µm (AdvR Inc.).The fiber polarization controller (FPC) is used to optimize the generation of orthogonally-polarized SPDC photons.The SPDC photons exiting the waveguide are directed into a short single-mode fiber and coupled into the free space setup via a collimator.In the free space setup, the residual pump photons are eliminated using a combination of a long-pass filter (LPF) and an angle-mounted band-pass filter (BPF).Here the BPF we used allows 95% of the desired passband transmission when filtered beam is incident in both perpendicular and oblique angles (Semrock NIR01-1570/3).Then, Alice uses a polarizing beam splitter (PBS) to separate her photon for local measurement and transmits the other entangled photon via an untrusted quantum channel to a distant receiver, Bob.Our quantum channel consists of two variations.In the first scenario, either 21 km or 50 km fiber spools are employed along with corresponding dispersion compensation modules (DCMs) to nullify the chromatic dispersion caused by the fiber spools.In the second part, a variable optical attenuator (VOA) introduces quantum channel losses of 18, 31, and 39 dB.We implemented a random selection of measurements between key generation and dispersive optics security checks using 90:10 fiber beam splitters.This asymmetric configuration maximizes the throughput of the system's key while ensuring sufficient number of coincidence counts for establishing security based on time-frequency mutually unbiased bases (MUB) [12,18,42].
The T 1 T 2 bases correspond to the direct detection of photon arrival-time from both parties, and the F 1 F 2 bases are the frequency basis that is mutually unbiased with respect to the temporal states.In the case of arrival-time large-alphabet encoding, Alice and Bob individually measure the arrival times of photons with a time slot τ , which establishes a time-bin.A time frame is created by both parties with N time-bins.Within each time frame, Alice and Bob make random selections to measure the arrival time-bin position of the photon, allowing them to extract a symbol consisting of k = log 2 N bits.Then, Alice and Bob carefully select a time frame in which each party detects precisely one event.Subsequently, they employ error correction and privacy amplification procedures.To ensure security, both parties conduct measurements involving time and frequency correlations.For time basis, Alice and Bob use their single-photon detectors to directly measure two-photon temporal correlation; while for frequency basis, they significantly spread out the single-photon wave packet such that its frequency components are well-resolved in time.Here we utilize a specially designed ± 10 000 ps nm −1 dispersion emulator (compensator) (using chirped fiber Bragg gratings, which provide a dispersion value equivalent to that of ≈ 600 km of standard single-mode fiber, but with a loss of only ≈ 3 dB) at telecom-band to realize nonlocal dispersion cancelation [70].We conduct measurements of all feasible time-frequency bases utilizing SNSPDs with high detection efficiency (SNSPDs, ≈ 90% detection efficiency, root-mean-square timing jitter ≈ 55 ps, dark counts ≈ 100 counts/s, PhotonSpot Inc.).The typical coincidence to single counts ratio is 1:9 from the SPDC source generation.These detectors saturate when the detection rate exceeds 3 Megacounts/s.Detection events were time-stamped by both parties with time-to-digital converters (Picoharp 300).
Entangled sources play an important role in many important quantum information processing tasks, such as QKD [11,15,16], entanglement distribution [9,10], quantum storage [71], and quantum teleportation [19].The energy-time entangled photon-pairs, which have both strong temporal correlation and frequency anti-correlation, are of great interest for long-distance quantum communication because of their insensitivity to the birefringence effect of fibers.Nonlocality is considered a central feature of energytime entanglement, which cannot be explained by classical or local hidden-variable theories [22,23].The quantum nonlocality can be tested via either a violation of time-frequency uncertainty relations [61,63], a steering inequality [63], or a Bell-like inequality (Wasak inequality) [60,62].The Bell-like inequality is the most strict quantum nonlocality, while the steering inequality is intermediate and the entanglement witness is the most relax criteria.For two unentangled (separable) photons, they must satisfy the following inequality: where each photon, labeled as signal and idler, is described by its frequency ω and its time of arrival t, and ∆ represents the standard deviation in the joint spectrum or joint temporal intensity.Hence, a violation of the above separability criterion implies entanglement.A sufficient and more strict condition to rule out the local realism is the quantum steering inequality [63,72]: For energy-time entangled photon-pairs, there is no lower limit for the joint frequency-time uncertainty product.Ideally, it can approach zero to witness both entanglement and quantum steering.Moreover, the quantum nonlocality nature can be verified by violation of a Bell-like inequality (Wasak inequality) [60,62]: 2 where ∆τ and ∆τ ′ are the variance in time difference before and after dispersive elements, respectively.2βl is the magnitude of the applied dispersions on both parties.A violation of this inequality is a clear indication that the photon-pairs have been initially prepared in an entangled state, and it cannot be obtained within the classical theory and local hidden hidden-variable theories.
A novel feature of our high-dimensional QKD system is that all the possible combinations of time-frequency correlation measurements (T 1 T 2 , T 1 F 2 , F 1 T 2 , and F 1 F 2 ) enable the witness of nonlocal energy-time entanglement and quantum steering by violating Bell-like inequality (Wasak inequality), and time-frequency uncertainty relations simultaneously.Under noiseless conditions, we performed measurements of temporal cross-correlations between Alice and Bob, encompassing all combinations of time-frequency MUB, as shown in figure 1(b).The full width at half maximum (FWHM) of matched MUB are observed to be 162.35 and 219.26 ps, and those of unmatched MUB are 19.62 and 19.57ns, respectively.Note that the asymmetric profile of correlation peaks in T 1 F 2 , F 1 T 2 , and F 1 F 2 comes from the slightly mismatched dispersion between ±10 000 ps nm −1 dispersion emulator (compensator) modules.This discrepancy in ±10 000 ps nm −1 dispersion emulator (compensator) modules include two parts, the difference of the passband of the dispersion spectrum, and the difference on the values of dispersion coefficients.Our dispersion emulator has a passband from 1557.2-1562.7 nm, while our dispersion compensator's spectrum lies between 1557.7-1562.3nm.At 1560.4 nm, the +10 000 ps nm −1 dispersion emulator has dispersion coefficients of 10 024 ps nm −1 , and the −10 000 ps nm −1 DCM has −9886 ps nm −1 dispersion coefficients (Proximion).The cutoff of T 1 F 2 correlation peak around 15 ns appears because the limitation of the passband of Bob's −10 000 ps nm −1 DCM.Based on these measurements and an average 2βl = 20 057 ps 2 , we extract W = 0.0302 ± 0.0072 to violate Bell-like inequality (Wasak inequality) by about 135 standard deviations and estimate a joint time-frequency uncertainty product of ∆(ω s +ω i )∆(t s − t i ) = 0.008 27 ± 0.000 97, which violates not only the energy-time entanglement inequality but also the quantum steering inequality by about 1022, and 507 standard deviations, respectively.Although we do not directly measure the joint spectrum intensity of biphotons due to the bandwidth limitation of commercial frequency filtering components, we can estimate the frequency product via transforming temporal correlation into spectral correlation using our ± 10 000 ps nm −1 dispersion emulator (compensator) modules.To the best of our knowledge, compared to previous works [61][62][63], we report new records on witnessing both energy-time entanglement and quantum steering by violating Bell-like inequality (Wasak inequality) and the joint time-frequency uncertainty product by 135 and 507 standard deviations, respectively.

High-dimensional time-bin QKD and EPR steering witness over 50 km optical fibers
Next, given that we have a highly entangled source, we report the entangled-based large-alphabet QKD key throughput and PIE at the local fiber link (with negligible loss).The raw key rate can be extracted directly from the time stamps using the high-dimensional QKD protocol and our layered error correction code.Upon capturing the time stamps of entangled photons, we proceeded to parse them into log 2 N bit symbols for each time frame in which Alice and Bob had a single coincidence detection.Then, we use a layered error correction [64,65] on all layers of the raw k-bit symbols, which maintains a high reconciliation efficiency β, even when facing a high QBER [16,42].The secure PIE can be expressed as ∆I AB = βI AB −χ E − ∆ FK , measured in bits-per-coincidence.Here I AB represents the Shannon information shared between both parties, χ E denotes Eve's eavesdropping in the infinite-key limit [12,47], and ∆ FK accounts for the finite-key length [16,18,42].In our approach, we employ a finite-key security parameter of ε s = 10 −5 , which encompasses error correction (ε EC ), privacy amplification (ε PA ), smooth min-entropy estimation (ε), and security parameter estimation (ε PE ) failures.We set ε EC = ε PA = ε = 10 −10 , and approximate ε PE to be around 10 −5 , following similar methods used in previous studies [16,18,42].By using a finite-key length on the order of 10 6 , we estimate an uncertainty in the excess spectral noise parameter ξ ω ≈ 0.002, over the Eve's Holevo leak in the finite-key limit [16,18,42].As for changing the bits/photon in figure 2(a), we can change either the time-bin size or the number of time-bins per frame.Considering the temporal uncertainty of our SNSPDs surpasses the SPDC correlation time (≈4 ps from the spectral bandwidth of our source), we opt for a time-bin size of 100 ps in our experiments.This selection ensures maximum throughput in our system.In figure 2(a), by using large-alphabet temporal encoding, we record the raw key rate and PIE of our photon-efficient energy-time entangled source to be 1.94 Mbits s −1 at 10 bits/photon encoding, and 3.88 bits/coincidences for 7 bits/photon encoding, respectively.By performing back-to-back T 1 T 2 and F 1 F 2 correlation peak measurements in figure 1(b), we calculate the time-frequency covariance matrix to obtain an upper bound on Eve's Holevo information of 0.226 bits/coincidences, including the finite-key effects.
Then, we extract the secure PIE and SKR of our SPDC source with finite-key effects at noiseless conditions, with the maximum SKR, and secure PIE of 1.62 Mbits s −1 and 3.55 bits/coincidences, respectively.We are operating near capacity-achieving conditions, where the gap between raw Shannon information capacity in terms of PIE and secure PIE is minimized due to high reconciliation efficiency β of 0.86, and strict Holevo bounds obtained from T 1 T 2 and F 1 F 2 correlation peaks.The increasing error bars in For four encoded bits/photon, due to the coincide of T1T2 correlation peak (example plot in the inset, also shown in figure 1(b)) and the time frame window, the error will occur in a less significant manner, causing the minimum of QBER.On the other hand, larger encoded bits/photon will increase time frame size, which leads to more accidental coincidence counts and higher QBER.At 4-bits encoding, the minimum QBER is 10.28%, while the QBER error rate reaches 44.96% at 10-bits encoding.Note that the measurement condition here is when detector bias is not fully applied due to the saturation of single counts of our SNSPDs (≈ 3 million single counts per channel).key throughput for larger encoded bits/photon is resulting from increasing time frame size, which leads to larger accidental coincidences.The error bars in the presented data are determined by calculating the standard deviation from three separate QKD sessions for each data set, and each data is recorded in 3 s.In figure 2(b), we report the QBER of our entangled SPDC source at the local fiber link.For four encoded bits/photon, due the coincidence of T 1 T 2 correlation peak (example plot in inset, also shown in figure 1(b)) and the time frame window, the error will occur in less significant manner, causing the minimum of QBER.On the other hand, larger encoded bits/photon will increase time frame size, which leads to more accidental coincidence counts and higher QBER.At 4-bits encoding, the minimum QBER is 10.28%, while the error rate increases to 44.96% at 10-bit encoding.In figure 2, our results confirm that the large-alphabet encoding with optimized key throughout can be achieved with high reconciliation efficiency β and tolerate high QBER.Note that the measurement condition for figure 2 is when detector bias is not fully applied (not operating at maximum detection efficiency) due to the saturation of single counts of our SNSPDs (≈3 million single counts per channel), causing the difficulty in detecting coincidence count rate in a reasonable duration.For all the other measurements presented in this work, we use maximum detection efficiency (fully biased) for best QKD performance.
So far, the experimental maximum transmitted fiber distance using entangled sources and high-dimensional QKD arrival-time encoding has been limited to 20 km [16,47].Here, we present the experimental measurements of key throughput and PIE of energy-time entangled high-dimensional QKD at 50 km fiber distance, as shown in figure 3.For longer distance qudit QKD measurements, we introduced two fiber spools with equal lengths L, between the source and the detectors of both Alice and Bob.Utilizing a matched-fiber configuration helps overcome the technical challenge of aligning two temporal peaks that are more than 10 µs apart.Our time-correlated single-photon counting module imposes this limitation.These matched fibers allowed us to proceed with our measurements and experiments effectively.Including finite-key effects, we measured SKR (raw key rate) and secure PIE at 21 km of 0.66 Mbits s −1 (0.83 Mbits s −1 ), 2.65 (3.04) bits/coincidences, respectively.We achieved a 7.5× higher asymptotic SKR (a 6.6× higher SKR with finite-key effects) compared to the reported highest record using dispersive optics [47].We also note that by using classical attenuated resources, the prepare-and-measurement protocols of high-dimensional QKD using dispersive optics have been demonstrated by field experiments with a key rate of 1.2 Mbits s −1 over optical fibers of 43 km [18].Additionally, a high-dimensional QKD protocol using large-alphabet encoding of time-energy entangled photons with security against collective Gaussian attacks has been demonstrated and obtained a SKR of 2.7 Mbits s −1 at 20 km fiber [16].At a 50 km fiber link, we  3.04) bits/ coincidences, respectively.At 50 km fiber distance, we measured maximized SKR (raw key rate) and secure PIE of 0.24 (0.30) Mbits s −1 , 2.39 (2.72) bits/coincidences, considering finite-key effects, respectively.The SKR (raw key rate) and secure PIE are optimized with 8 and 6 bits/photon encoding, respectively.Inset: distributed energy-time entanglement and EPR steering.At 50 km fiber distance, we extract W = 0.0332 ± 0.0127 to violate Bell-like inequality (Wasak inequality) by about 76 standard deviations.Furthermore, at this fiber distance, we estimate a joint time-frequency uncertainty product of ∆(ωs + ω i )∆(ts − t i ) of 0.00847 ± 0.00102, which violates not only the energy-time entanglement inequality (shaded region) but also the quantum steering inequality (shaded region) by about 972, and 482 standard deviations, respectively.Here we can still outperform previous works [61][62][63] and maintain records of energy-time entanglement and quantum steering witness after a 50 km fiber link.measured maximized SKR (raw key rate) and secure PIE of 0.24 (0.30) Mbits s −1 , 2.39 (2.72) bits/ coincidences, including finite-key effects, respectively.The SKR (raw key rate) and secure PIE are optimized with 8 and 6 bits/photon encoding, respectively.We have successfully maintained a secure PIE of 2.39 bits/coincidences and an SKR of 0.24 Mbits s −1 after the loss of 50 km standard telecom fiber spools (≈ 10 dB) and the corresponding DCM (≈ 2.6 dB), using our entangled photon-pair source.With an extended time frame, the secure PIE drops mainly as a result of the increased occurrence of multi-pair events.All the measured T 1 T 2 and F 1 F 2 correlation peaks are presented in figure A1 in appendix.The error bars are based on the standard deviation of three QKD sessions (3 s for each recording) for each data set.All of the other experimental key throughput and PIE data corresponding to different encoding bits/photon is given in figure A2 (see appendix).
In figure 3 inset, we report the distributed energy-time entanglement and EPR steering witness for 21 and 50 km fiber distances.At a 50 km fiber distance, we extract W = 0.0332 ± 0.0127 to violate Bell-like inequality (Wasak inequality) by about 76 standard deviations.At this fiber distance, we estimate a joint time-frequency uncertainty product ∆ (ω s + ω i ) ∆ (t s − t i ) of 0.00847 ± 0.00102, which violates both the energy-time entanglement inequality and the EPR steering inequality by about 972, and 482 standard deviations, respectively.Compared to the noiseless condition in figure 1(b), we can still outperform prior works [61][62][63] and maintain records of energy-time entanglement and quantum steering witness after distributing in a 50 km fiber link.Our findings from the quantum steering witness after a 50 km fiber distance suggest promising avenues for future experimental investigations into high-dimensional one-sided device-independent QKD, whose security is linked to the violation of quantum steering inequality [73][74][75].

Experimental maximum tolerance of channel loss in qudit time-bin QKD protocol
After demonstrating high-dimensional time-bin QKD and EPR steering via 50 km fiber distance, here we extend the maximum SKR and secure PIE of our entanglement-based high-dimensional QKD protocol up to 39 dB (as the current maximum attenuation available in our experiments), as shown in figure 4. For 18, 31, and 39 dB channel losses measurements, we utilize the VOA in figure 1(a), and the FWHM of T 1 T 2 and F 1 F 2 bases are consistent with the FWHM of T 1 T 2 and F 1 F 2 bases under the noiseless condition in figure 1(b), due to the VOA's negligible dispersion.At 18 dB loss, we are able to obtain a maximum SKR and a secure PIE of 38.33 kbits s −1 and 1.70 bits/coincidences, with 7 and 5 bits/photon encoding, respectively.For 31 dB channel loss, we observe an SKR and a secure PIE of 1.80 kbits s −1 , 1.19 bits/coincidences with 6 and 5 bits/photon encoding, respectively.Finally, under a 39 dB quantum channel loss (equivalently to ≈ 244 km-long ultra-low-loss fibers or 195 km standard single-mode fibers), we achieve an experimental SKR and a secure Here we present the maximum SKR and secure PIE of our protocol with channel losses from 6.63 dB (corresponding to losses at 21 km fiber distance) to 39 dB.Under 39 dB channel loss (equivalently to ≈ 244 km ultra-low-loss fibers, or 195 km standard single-mode fibers) and finite-key effects, we achieve a SKR and a secure PIE of 0.30 kbits s −1 and 1.10 bits/coincidences with 5 bits/photon encoding.For variable attenuations, the increasing error bars in key throughput and PIE is resulting from the increasing noise in a quantum channel.The error bars represent the standard deviation of three QKD sessions for every dataset.Our experimental results are closely match with theoretical upper bound limit of SKR at 39 dB channel loss from high-dimensional QKD protocols [12,59], and outperform recent state-of-the-art qubit QKD protocols using commercial single-photon detectors [25,26,[66][67][68][69]. PIE of 0.30 kbits s −1 and 1.10 bits/coincidences with 5 bits/photon encoding.Note that for all the reported SKR and secure PIE here, we include the penalties from the finite-key effects.For variable attenuations, the increasing error bars in key throughput and PIE result from the increasing noise in a quantum channel.The error bars are based on the standard deviation of three QKD sessions for each data set.All of the other experimental key throughput and PIE data corresponding to different encoding bits/photon is shown in figure A3 (see appendix).Our highly efficient SNSPDs exhibit consistent jitter and low dark counts, regardless of the detection rate.As a result, the error bars across all measurement data sets remain small.For this theoretical upper bound SKR calculation at 39 dB channel loss, we use our experimental parameters and the channel modeling from prior works [12,59].By using our measurement results and their corresponding quantum channel losses, we extrapolate to calculate the realistic photon-pair source flux at negligible loss condition, as this particular measurement is limited by the saturation of single counts in our SNSPDs (also noted in figure 2).For this particular analysis, we use a time frame size of 3.2 ns (5 bits/photon encoding and 100 ps time-bin size), and the FWHM of T 1 T 2 and F 1 F 2 from figure 1(b) to calculate the measured excess spectral noise factor ξ ω [12,42].Other experimental parameters are given as follows: timing jitter of our SNSPDs ≈ 155 ps; ≈ 90% detection efficiency; dark counts ≈ 100 counts s −1 ; maximum reconciliation efficiency β of 0.86.Here our results show that under a high loss regime of 39 dB, our entangled source and qudit-based QKD protocol can preserve its large-alphabet nature and still deliver several hundreds of secret keys per second.Compared to recently demonstrated BB84 [25,26], and continuous-variable [66,68] QKD protocols, we have over two orders of magnitude improvement on SKR under the same channel loss, while we have over one order of magnitude higher SKR than a recent measurement-device-independent QKD protocol [69].To summarize, our experimental results closely match the theoretical upper bound limit of SKR at 39 dB channel loss from high-dimensional time-bin QKD protocols [12,59], and outperform recent state-of-the-art qubit QKD protocols using standard single-photon detectors [25,26,[66][67][68][69].

Conclusion
Through our experiments, we have demonstrated a high-dimensional time-bin QKD protocol in a 50 km fiber link and under channel loss up to 39 dB, considering the finite-key effects.By using a specially designed ± 10 000 ps nm −1 dispersion emulator (compensator) at the telecom band to realize nonlocal dispersion cancelation, we are able to set new records on witnessing both energy-time entanglement and EPR steering after a 50 km fiber distribution.The security implementation of our entanglement-based qudit protocol is commercially available and robust, without the need to stabilize a Franson interferometer over long fiber transmission distances [16], and the dimensionality d of our temporal encoded states scales favorably without the requirement of 2d − 1 interferometers [17].Here we measured a SKR and a secure PIE at 21 km of 0.66 Mbits s −1 , and 2.65 bits/coincidences, respectively.We achieved a 7.5× higher SKR (a 6.6× higher SKR with finite-key effects) compared to the prior highest record using dispersive optics [47].We also note that by using classical attenuated resources, the prepare-and-measurement protocols of high-dimensional QKD using dispersive optics have been demonstrated by field experiments with a key rate of 1.2 Mbits s −1 over optical fibers of 43 km [18].Additionally, a high-dimensional QKD protocol using large-alphabet encoding of time-energy entangled photons with security against collective Gaussian attacks has been demonstrated and obtained a SKR of 2.7 Mbits s −1 at 20 km fiber [16].Here we obtained a SKR and secure PIE of 0.24 Mbits s −1 and 2.39 bits/coincidences at 50 km distance.Finally, we explore the maximum range of our entanglement-based qudit time-bin protocol under the high loss regime, including the finite-key effects.Under a 39 dB quantum channel loss (equivalently to ≈ 244 km ultra-low-loss fibers or 195 km standard single-mode fibers), we are able to preserve intrinsic high-dimensional nature to achieve an experimental SKR and a secure PIE of 0.30 kbits s −1 and 1.10 bits/coincidences, respectively.Our experimental results closely match the theoretical upper bound limit of SKR in energy-time entanglement-based high-dimensional QKD protocols [12,59], and outperform recent state-of-the-art qubit-based QKD protocols using commercial single-photon detectors [25,26,[66][67][68][69].Our simple and robust entanglement-based qudit time-bin protocol is promising for practical long-distance quantum steering and qudit QKD with multiple secure bits-per-coincidence and higher SKR than mature qubit-based QKD protocols.In the future, it is possible to combine existing theoretical analysis against general attacks in the finite-key regime [76,77] to our experimental hardware.Furthermore, the usage of energy-time entangled photons in the current large-alphabet QKD system is directly compatible with multi-user quantum networks, and is likely to play a vital role in the future implementation of quantum repeater technologies.For both fiber distances, the asymmetrical shape observed in correlation peaks for T1F2, F1T2, and F1F2 results from the slight discrepancy in dispersion between ±10 000 ps nm −1 dispersion emulator (compensator) modules.Additionally, the cutoff of T1F2 correlation peak at approximate 15 ns is due to the limitations of Bob's −10 000 ps nm −1 DCM passband.information after 21 and 50 km fiber distributions by calculating the time-frequency covariance matrix [12,42].

A.2 High-dimensional key throughput and PIE versus encoded bits/photon with different quantum channel losses
In figure A2, we present the high-dimensional key throughput and PIE versus different bits/photon encoding of energy-time entangled sources at 21 and 50 km fiber distances.To be consistent with the results in the main text, here we choose a time-bin size of 100 ps, and include same finite-key effects for all the data analysis in figures A2 and A3.In figure A2(a), for a 21 km fiber distribution, the maximum measured SKR (raw key rate) and secure PIE are 0.66 Mbits s −1 (0.83 Mbits s −1 ), 2.65 (3.04) bits/coincidences with 8 and 6 bits/photon encoding, respectively.The QBER at 8 and 6 bits/photon encoding are 42.31% and 28.23%, respectively.In figure A2(b), at 50 km fiber distance, we measured maximized SKR (raw key rate) and secure PIE of 0.24 (0.30) Mbits s −1 , 2.39 (2.72) bits/coincidences, with 8 and 6 bits/photon encoding, respectively.The QBER at 8 and 6 bits/photon encoding are 43.10% and 30.03%, respectively.We can see that as the loss of quantum channel increases, the QBER in corresponding bits/photon encoding also increases.As the time frame extends, the secure PIE diminishes due to the increasing detection of accidental photons.The error bars are based on the standard deviation of three QKD sessions for each data set.
Then, we report the high-dimensional key throughput and PIE versus different bits/photon encoding of energy-time entangled source under 18, 31, and 39 dB quantum channel loss in figure A3. Figure A3(a) shows the maximum measured SKR (raw key rate) and secure PIE with 18 dB transmission loss are 38.33 kbits s −1 (51.87 kbits s −1 ), 1.70 (1.99) bits/coincidences with 7 and 5 bits/photon encoding, respectively.The QBER at 7 and 5 bits/photon encoding are 42.54% and 27.79%, respectively.In figure A3(b), at 31 dB channel loss, we measured maximized SKR (raw key rate) and secure PIE of 1.80 (2.35) kbits s −1 , 1.19 (1.51) bits/coincidences, with 6 and 5 bits/photon encoding, respectively.The QBER at 6 and 5 bits/photon encoding are 39.21% and 32.43%, respectively.Finally, in figure A3(c), under 39 dB transmission loss, we measured maximized SKR (raw key rate) and secure PIE of 0.30 (0.39) kbits s −1 , 1.10 (1.35) bits/coincidences, with 5 bits/photon encoding.The QBER at 5 bits/photon encoding is 34.46%.Note that for all the secure PIE and SKR presented in this appendix, the finite-key effects have been considered.) bits/coincidences, with 6 and 5 bits/photon encoding and finite-key effects, respectively.The QBER at 6 and 5 bits/photon encoding are 39.21% and 32.43%, respectively.(c) Under 39 dB transmission loss, we measured maximized SKR (raw key rate) and secure PIE of 0.30 (0.39) kbits s −1 , 1.10 (1.35) bits/ coincidences, with 5 bits/photon encoding in finite-key regime.The QBER at 5 bits/photon encoding is 34.46%.For variable attenuations, the increasing error bars in key throughput and PIE is resulting from the increasing noise in a quantum channel.The error bars are based on the standard deviation of three QKD sessions for each data set.
For variable attenuations, the increasing error bars in key throughput and PIE result from the increasing noise in a quantum channel.The error bars are based on the standard deviation of three QKD sessions for each data set.For QBER analysis, we can see that in same bits/photon encoding, the QBER increases with higher quantum channel losses.By using our photon-efficient energy-time entangled qudit-based QKD protocol, at 50 km fiber link, including finite-key effects, we measured maximized SKR (raw key rate) and secure PIE of 0.24 (0.30) Mbits s −1 , 2.39 (2.72) bits/coincidences, respectively.Our results show that under a high loss regime of 39 dB, our entangled source and qudit QKD protocol can preserve its high-dimensional nature and deliver several hundreds of secret keys per second with PIE over 1 bits/coincidences.These results closely match the theoretical upper bound limit of SKR of energy-time entanglement-based high-dimensional QKD protocols [12,59], and outperform recent state-of-the-art qubit QKD protocols using standard single-photon detectors [25,26,[66][67][68][69].

Figure 1 .
Figure 1.Schematic of entanglement, quantum steering witness, and high-dimensional time-bin QKD protocol.(a) Schematic of the experimental setup.FPC, fiber polarization controller; SPDC, spontaneous parametric down-conversion; LPF, long-pass filter; BPF, band-pass filter; PBS, polarization beam-splitter; D, detector; DCM, dispersion compensation modules; DEM, dispersion emulation modules; VOA, variable optical attenuators; T, Time; F, Frequency.Fiber beam splitters of 90:10 ratios are used for distributing keys and cross-correlation measurements.(b) Measured temporal cross-correlations between Alice and Bob, using all combinations of time-frequency pairs under noiseless conditions.The FWHMs of matched MUB are observed to be 162.35 and 219.26 ps, and those of unmatched MUB are 19.62 and 19.57ns, respectively.Based on these measurements, we extract W = 0.0302 ± 0.0072 to violate Wasak inequality (Bell-like inequality) by about 135 standard deviations and estimate a joint time-frequency uncertainty product of ∆(ωs+ω i )∆(ts − t i ) = 0.00827 ± 0.00097, which violate not only the energy-time entanglement inequality but also the quantum steering inequality by about 1022, and 507 standard deviations, respectively.

Figure 2 .
Figure 2. High-dimensional time-bin QKD performances of entangled source at local fiber link.(a) Here we measured secure PIE and SKR using our source at a 5 m local link, and the maximum SKR with finite-key effects is 1.62 Mbits s −1 at 10 bits/photon encoding, with the maximum secure PIE is measured to be 3.55 bits/coincidences at 7 bits/photon encoding.The error bars in the presented data are determined by calculating the standard deviation from 3 separate QKD sessions for each data set.(b)For four encoded bits/photon, due to the coincide of T1T2 correlation peak (example plot in the inset, also shown in figure1(b)) and the time frame window, the error will occur in a less significant manner, causing the minimum of QBER.On the other hand, larger encoded bits/photon will increase time frame size, which leads to more accidental coincidence counts and higher QBER.At 4-bits encoding, the minimum QBER is 10.28%, while the QBER error rate reaches 44.96% at 10-bits encoding.Note that the measurement condition here is when detector bias is not fully applied due to the saturation of single counts of our SNSPDs (≈ 3 million single counts per channel).

Figure 3 .
Figure 3.Experimental high-dimensional time-bin QKD and EPR steering witness over a 50 km optical fiber.Including finite-key effects, the measured SKR (raw key rate) and secure PIE at 21 km are 0.66 Mbits s −1 (0.83 Mbits s −1 ), 2.65 (3.04) bits/ coincidences, respectively.At 50 km fiber distance, we measured maximized SKR (raw key rate) and secure PIE of 0.24 (0.30) Mbits s −1 , 2.39 (2.72) bits/coincidences, considering finite-key effects, respectively.The SKR (raw key rate) and secure PIE are optimized with 8 and 6 bits/photon encoding, respectively.Inset: distributed energy-time entanglement and EPR steering.At 50 km fiber distance, we extract W = 0.0332 ± 0.0127 to violate Bell-like inequality (Wasak inequality) by about 76 standard deviations.Furthermore, at this fiber distance, we estimate a joint time-frequency uncertainty product of ∆(ωs + ω i )∆(ts − t i ) of 0.00847 ± 0.00102, which violates not only the energy-time entanglement inequality (shaded region) but also the quantum steering inequality (shaded region) by about 972, and 482 standard deviations, respectively.Here we can still outperform previous works[61][62][63] and maintain records of energy-time entanglement and quantum steering witness after a 50 km fiber link.

Figure 4 .
Figure 4. Maximum experimental tolerable loss of large-alphabet time-bin QKD protocol.Here we present the maximum SKR and secure PIE of our protocol with channel losses from 6.63 dB (corresponding to losses at 21 km fiber distance) to 39 dB.Under 39 dB channel loss (equivalently to ≈ 244 km ultra-low-loss fibers, or 195 km standard single-mode fibers) and finite-key effects, we achieve a SKR and a secure PIE of 0.30 kbits s −1 and 1.10 bits/coincidences with 5 bits/photon encoding.For variable attenuations, the increasing error bars in key throughput and PIE is resulting from the increasing noise in a quantum channel.The error bars represent the standard deviation of three QKD sessions for every dataset.Our experimental results are closely match with theoretical upper bound limit of SKR at 39 dB channel loss from high-dimensional QKD protocols[12,59], and outperform recent state-of-the-art qubit QKD protocols using commercial single-photon detectors[25,26,[66][67][68][69].

Figure A1 .
Figure A1.Measured cross-correlation between Alice and Bob at 21 and 50 km fiber distances.(a) Measured cross-correlations between Alice and Bob, using all possible combination of time-frequency pairs at 21 km fiber distance.The FWHMs of matched MUB are observed to be 170.99 and 235.63 ps, and those of unmatched MUB are 19.86 and 19.90 ns, respectively.(b) Measured cross-correlations between Alice and Bob, using all possible combination of time-frequency pairs at 50 km fiber distance.The FWHMs of matched MUB are observed to be 167.16 and 228.09 ps, and those of unmatched MUB are 19.73 and 19.69 ns, respectively.All the FWHM of time-frequency correlation peaks increase slightly compared to noiseless condition in main text figure 1(b) due to imperfect nonlocal dispersion cancelations after 21 and 50 km fiber distributions.For both fiber distances, the asymmetrical shape observed in correlation peaks for T1F2, F1T2, and F1F2 results from the slight discrepancy in dispersion between ±10 000 ps nm −1 dispersion emulator (compensator) modules.Additionally, the cutoff of T1F2 correlation peak at approximate 15 ns is due to the limitations of Bob's −10 000 ps nm −1 DCM passband.

Figure A2 .
Figure A2.High-dimensional time-bin QKD with various encoded bits/photon at 21 and 50 km fiber distances.(a) Including the finite-key effects, the maximum measured SKR (raw key rate) and secure PIE at 21 km are 0.66 Mbits s −1 (0.83 Mbits s −1 ), 2.65 (3.04) bits/coincidences with 8 and 6 bits/photon encoding, respectively.The QBER at 8 and 6 bits/photon encoding are 42.31% and 28.23%, respectively.(b) At 50 km fiber distance, we measured maximized SKR (raw key rate) and secure PIE of 0.24 (0.30) Mbits s −1 , 2.39 (2.72) bits/coincidences, with 8 and 6 bits/photon encoding and finite-key effects, respectively.The QBER at 8 and 6 bits/photon encoding are 43.10% and 30.03%, respectively.As the time frame extends, the secure PIE diminishes due to the increasing detection of accidental photons.The error bars are based on the standard deviation of three QKD sessions for each data set.

Figure A3 .
Figure A3.High-dimensional key throughput and PIE with various encoded bits/photon under higher quantum channel losses.(a) With the finite-key effects, the maximum measured SKR (raw key rate) and secure PIE with 18 dB transmission loss are 38.33 kbits s −1 (51.87 kbits s −1 ), 1.70 (1.99) bits/coincidences with 7 and 5 bits/photon encoding, respectively.The QBER at 7 and 5 bits/photon encoding are 42.54% and 27.79%, respectively.(b) At 31 dB channel loss, we measured maximized SKR (raw key rate) and secure PIE (PIE) of 1.80 (2.35) kbits s −1 , 1.19 (1.51) bits/coincidences, with 6 and 5 bits/photon encoding and finite-key effects, respectively.The QBER at 6 and 5 bits/photon encoding are 39.21% and 32.43%, respectively.(c) Under 39 dB transmission loss, we measured maximized SKR (raw key rate) and secure PIE of 0.30 (0.39) kbits s −1 , 1.10 (1.35) bits/ coincidences, with 5 bits/photon encoding in finite-key regime.The QBER at 5 bits/photon encoding is 34.46%.For variable attenuations, the increasing error bars in key throughput and PIE is resulting from the increasing noise in a quantum channel.The error bars are based on the standard deviation of three QKD sessions for each data set.