Introduction

Quantum key distribution is a method used to securely establish a secret key between two distant trusted parties, namely Alice and Bob1,2,3. Depending on the degrees of freedom of the underlying quantum system involved, QKD protocols are classified into two types: discrete-variable (DV) protocols where the key information is encoded on discrete degrees of freedom of photonic states such as polarisation4,5; and continuous-variable (CV) based protocols which encode the keys on continuous degrees of freedom such as amplitude and phase quadratures of the optical field6,7. In QKD, the main obstacle in establishing a secure key over large distances for a pure-loss channel is the photon losses.

Quantum repeaters are devices that can be used to improve the transmission distance of QKD protocols by dividing the total distance into smaller portions between the sender and receiver, making the losses in the channel more manageable8,9,10,11,12. Quantum repeaters12 use entanglement swapping13,14,15 to distribute entanglement, which is enhanced by entanglement distillation protocols16,17,18. One issue is that a majority of these repeater protocols require the use of quantum memories11,19,20. However, quantum memories are limited by their operational wavelengths and memory efficiencies. Even though solid-state quantum memories21,22 can operate at telecommunication wavelengths, their memory efficiency limits their efficacy. In contrast, cold-atom quantum memories currently hold the record for the efficiency, but operate outside of telecommunication wavelengths requiring frequency conversion to leverage communication infrastructure23,24. The frequency conversion results in low efficiencies limiting the performance of the current quantum repeaters25.

The PLOB bound26 sets the fundamental limit for the maximum amount of private states that can be transferred in QKD for a given quantum channel without the use of a repeater (See ref. 27 for the strong converse property of the bound and ref. 28 for the bounds generalised to repeater-assisted communication). No point-to-point QKD protocol can surpass this bound unless there is a quantum repeater splitting the channel. Therefore, the PLOB bound can also be used as a benchmark to test the quality of quantum repeaters3. It is known that the PLOB bound can be saturated with the squeezed-state protocol without the need for several copies of the states or a collective measurement for the pure-loss channel3. When there is a repeater-chain, the end-to-end quantum capacity scales with the number of repeaters28 and it is still an open question whether the corresponding repeater bounds can be saturated with a simple protocol without multiple copies of the quantum states.

Measurement-device-independent QKD (MDI-QKD) protocols are a type of repeater protocols in which the secret keys are established via the measurement of an untrusted third party29,30. These protocols are called ‘measurement-device-independent’as Alice and Bob do not perform a measurement in their stations, but the measurement is performed by an untrusted party, called Charlie. These protocols have been explored experimentally in refs. 30,31,32,33,34,35. Twin-field QKD (TF-QKD)36 is a DV based MDI protocol which utilises weak identical coherent states sent by both Alice and Bob to Charlie, who performs entanglement swapping via a probabilistic photon detection measurement. TF-QKD protocol is the first repeater protocol without a quantum memory that is able to surpass the PLOB bound36,37,38,39,40,41,42 as it scales proportionally to the single-repeater bound28. CV based MDI (CV-MDI) QKD protocols work in a similar fashion where Alice and Bob both send a distribution of either coherent or squeezed states to Charlie, where he performs a heterodyne measurement30,43,44. In order to achieve a positive key rate in these CV-MDI protocols, the relay is positioned very close to Alice resulting in a very asymmetric set-up. As the relay is not placed right in the middle between Alice and Bob, the protocols scale like the repeaterless bound instead of the single-repeater bound45. Hence, these protocols always sit below the PLOB bound.

In this work, we present a photon-number encoded MDI repeater protocol that surpasses the PLOB bound without the use of quantum memories through an entanglement swapping measurement. Unlike the TF-QKD protocol, the entanglement swapping is obtained by a coherent total photon number measurement performed by Charlie who measures the total number of photons coming from Alice and Bob without knowing the individual contributions. Even though the photon-number encoded states are vulnerable to losses, we show that in the short distance regime, the secret key rates are much higher than the ones of the single-photon encoded states. We also propose an experimentally feasible protocol using single-photons as these high dimensional states reduce down to the single-photon level over large distances. This protocol performs better than the existing MDI and TF-QKD protocols as it attains higher key rates for the same transmission distances.

Results

First, we introduce our MDI protocol providing the details of the states that Alice and Bob use for key generation and estimating Eve’s information followed by Charlie’s entanglement swapping measurement. We then derive the asymptotic key rate formula for the computation of the secret key rate. Finally, we present the results of the high-dimensional protocol followed by the experimentally feasible version of the MDI protocol using single-photons.

Alice and Bob’s states for generating a key

Let us assume that both Alice and Bob generate two-mode entangled states in their stations where they keep one arm of the entangled states to themselves and send the other to Charlie. Charlie then performs a joint entanglement swapping measurement on the states that Alice and Bob send.

QKD protocols can be expressed in either entanglement-based or prepare-and-measure schemes. Both of these models are mathematically equivalent46,47, however the entanglement-based representation is more convenient for the security analysis of a QKD protocol. In the conventional entanglement-based CV-QKD protocols, Alice sends one arm of a two-mode squeezed vacuum state (TMSV) to Bob while performing a heterodyne measurement on the other arm of the TMSV state she kept. This procedure is equivalent to Alice sending a coherent state in the prepare-and-measure scheme47. This entangled two-mode state in Fock basis is expressed as

$${\left\vert \Psi \right\rangle }_{{{{{\rm{A}}}}}_{1}{{{{\rm{A}}}}}_{2}}=\frac{1}{\sqrt{N}}\sqrt{1-{\gamma }^{2}}\mathop{\sum }\limits_{n=0}^{{n}_{\max }}{\gamma }^{n}{\left\vert nn\right\rangle }_{{{{{\rm{A}}}}}_{1}{{{{\rm{A}}}}}_{2}},$$
(1)

where \(\gamma \in \left[0,1\right)\) is the squeezing parameter and N is the normalisation coefficient given by \(\mathop{\sum }\nolimits_{n = 0}^{{n}_{\max }}(1-{\gamma }^{2}){\gamma }^{2n}\). \(\left\vert n\right\rangle\) denotes the n-photon Fock state. Note that a TMSV state is retrieved with when \({n}_{\max }\to \infty\)46.

In this paper, we use the entanglement-based version, shown in Fig. 1a, for the security analysis of the prepare-and-measure method, shown in Fig. 1b. We express Alice’s and Bob’s states as follows:

$${\left\vert \Psi \right\rangle }_{{{{{\rm{A}}}}}_{1}{{{{\rm{A}}}}}_{2}}=\mathop{\sum }\limits_{n=0}^{{n}_{\max }}\sqrt{{a}_{n}}{\left\vert nn\right\rangle }_{{{{{\rm{A}}}}}_{1}{{{{\rm{A}}}}}_{2}},$$
(2)
$${\left\vert \Psi \right\rangle }_{{{{{\rm{B}}}}}_{1}{{{{\rm{B}}}}}_{2}}=\mathop{\sum }\limits_{n=0}^{{n}_{\max }}\sqrt{{b}_{n}}{\left\vert nn\right\rangle }_{{{{{\rm{B}}}}}_{1}{{{{\rm{B}}}}}_{2}},$$
(3)

where \(\mathop{\sum }\nolimits_{n = 0}^{{n}_{\max }}{a}_{n}=1\) and \(\mathop{\sum }\nolimits_{n = 0}^{{n}_{\max }}{b}_{n}=1\). an and bn represent real coefficients of each Fock-number state \(\left\vert nn\right\rangle\) for Alice and Bob, respectively. These coefficients are the same for both Alice and Bob and optimised to achieve an optimal key rate explained in more detail in Calculation of the secret key rate. \({n}_{\max }\) is the maximum number of photons that Alice and Bob send individually, and each party encodes the key information on the Fock states \(\left\vert n\right\rangle\).

Fig. 1: Equivalent representations of the protocol.
figure 1

a Entanglement-based scheme where both Alice and Bob send optimised states with \({n}_{\max }=7\) to Charlie while keeping one arm of their states to themselves denoted as modes A1 and B1, respectively, and measure the number of photons using photon-number resolving detectors (PNRDs). Charlie interferes modes A2 and B2 coming from Alice and Bob and performs a coherent total photon number measurement. b Prepare-and-measure scheme where Alice and Bob send single-mode states to Charlie where they encode the key information on the single mode Fock state one at a time. Charlie then performs a total photon number measurement in his station on the modes that Alice and Bob send.

In the entanglement-based scheme, Alice and Bob keep one arm of the entangled states to measure the number of photons using a photon-number resolving detector (PNRD) to establish a key while sending the other arm to Charlie. Charlie performs a coherent total photon number measurement on the incoming modes from Alice and Bob, and announces the outcome of his measurement (described in detail in Charlie’s measurement). Alice and Bob’s measurement in their own stations is represented as

$${\Pi}_{n}=\left\vert n\right\rangle\!\left\langle n\right\vert ,$$
(4)

where n denotes the number of photons being measured. In the prepare-and-measure scheme, this corresponds to preparing the Fock state \(\left\vert n\right\rangle\) with probability an or bn for Alice and Bob, respectively. The states in the prepare-and-measure scheme can be engineered experimentally with several different methods such as conditional teleportation48, coherent displacements and photon subtraction49, and repeated parametric-down conversion50. Alternatively, these states can be created by extending the work presented in ref. 51 to higher photon levels by using spontaneous parametric down-conversion on the signal channel and conditional measurements on the idler channel.

Charlie’s measurement

The states are sent to Charlie via a channel with a total transmissivity of τ [0, 1], which is split into smaller channels between Alice and Charlie and Charlie and Bob represented as τA and τB, respectively. Single-repeater protocols can be benchmarked based on the PLOB bound, which is given by \(-{\log }_{2}(1-\tau )\)26,28. In order to surpass this bound, the protocol needs to scale like the single-repeater bound28, which is expressed as \(-{\log }_{2}(1-\sqrt{\tau })\). This requires Charlie to be positioned in the middle of Alice and Bob such that the key-rate scales with the square root of the transmission probability, \(O(\sqrt{\tau })\). In this protocol, Charlie performs a collective photon number measurement on the incoming modes from Alice, A2, and Bob, B2. If Alice and Bob send a maximum of n photons each, denoted as \({n}_{\max }\), Charlie can measure from 0 to \(2{n}_{\max }\) photons. Charlie’s measurement can be realised by projecting the modes A2 and B2 onto the following states

$$\left\vert {\phi }_{c}^{j}\right\rangle =\mathop{\sum }\limits_{n=0}^{c}\frac{{\omega }^{nj}\left\vert n\right\rangle \left\vert c-n\right\rangle }{\sqrt{c+1}},$$
(5)

where \(c\in \{0,1,\cdots \,,2{n}_{\max }\}\) represents the total number of photons Charlie receives from the two modes, and j {0, 1,  , c} denotes the different states in the c-photon subspace states while ω is given by \(\omega ={{{{\rm{e}}}}}^{\frac{2\pi {{{\rm{i}}}}}{c+1}}\).

For example, when c = 2, Charlie’s three possible outcomes are

$$\left\vert {\phi }_{2}^{0}\right\rangle =\frac{1}{\sqrt{3}}(\left\vert 02\right\rangle +\left\vert 11\right\rangle +\left\vert 20\right\rangle ),$$
(6)
$$\left\vert {\phi }_{2}^{1}\right\rangle =\frac{1}{\sqrt{3}}\left(\left\vert 02\right\rangle +{{{{\rm{e}}}}}^{\frac{2\pi {{{\rm{i}}}}}{3}}\left\vert 11\right\rangle +{{{{\rm{e}}}}}^{-\frac{2\pi {{{\rm{i}}}}}{3}}\left\vert 20\right\rangle \right),$$
(7)
$$\left\vert {\phi }_{2}^{2}\right\rangle =\frac{1}{\sqrt{3}}\left(\left\vert 02\right\rangle +{{{{\rm{e}}}}}^{-\frac{2\pi {{{\rm{i}}}}}{3}}\left\vert 11\right\rangle +{{{{\rm{e}}}}}^{\frac{2\pi {{{\rm{i}}}}}{3}}\left\vert 20\right\rangle \right).$$
(8)

These measurements are designed such that even though Charlie knows the total number of photons between Alice and Bob, he does not know the number of photons in each mode separately.

The outcomes of Charlie’s measurement form a valid positive operator value measurement (POVM) for a given outcome

$${\Pi}_{c}^{j}=\left\vert {\phi}_{c}^{j}\right\rangle\!\left\langle {\phi}_{c}^{j}\right\vert ,$$
(9)

with all the possible outcomes satisfying the identity resolution with \(c\in \{0,1,\cdots \,,2{n}_{\max }\}\) and j {0, 1,  , c}, i.e.,

$$\mathop{\sum }\limits_{c=0}^{2{n}_{\max }}\mathop{\sum }\limits_{j=0}^{c}{\Pi }_{c}^{j}={\mathbb{I}}.$$
(10)

The measurement performed by Charlie establishes correlations between Alice and Bob. In the lossless channel, when Charlie detects two photons with his POVM element \(\left\vert {\phi }_{2}^{0}\right\rangle\), Alice and Bob’s state becomes \({\left\vert \psi \right\rangle }_{{{{{\rm{A}}}}}_{1}{{{{\rm{B}}}}}_{1}{| }_{c = 2}^{j = 0}}=\sqrt{{a}_{0}{a}_{2}}\left\vert 02\right\rangle +{a}_{1}\left\vert 11\right\rangle +\sqrt{{a}_{2}{a}_{0}}\left\vert 20\right\rangle\). Therefore, Charlie swaps the entanglement between Alice and Bob via the measurement he performs similar to many MDI protocols29,36.

Alice and Bob’s check states for security

A possible security issue is that Charlie can potentially lie to Alice and Bob about his measurement outcome, as he can perform separable measurements on Alice and Bob’s modes individually or announce a different photon number from the one he actually measured. When the latter occurs, Alice and Bob can tell that Charlie is not telling the truth as the probabilities of measuring different number of photons are not equal. However, when the former happens, Alice and Bob cannot distinguish whether Charlie is performing a total photon number measurement or a separable measurement on the two modes. Even though the separable measurement does not yield an entangled state between Alice and Bob, it still establishes classical correlations between the parties. The probability of Charlie measuring a given number of photons when he performs a separable measurement ends up being the same as his joint measurement described in Charlie’s measurement.

We address this security issue by Alice and Bob randomly switching from their key states and sending some check states to Charlie to detect any abnormalities in the system. One of the possible check states they send consists of a superposition of the photon number states, and are analogous to the original DV diagonal states in the following form

$$\left\vert +\right\rangle =\mathop{\sum }\limits_{n=0}^{{n}_{\max }}\sqrt{{\epsilon }_{n}}\left\vert n\right\rangle ,$$
(11)

where ϵn represents the coefficients an and bn in Eq. (2) and (3) for Alice and Bob, respectively.

The untrusted party, Charlie, is required to announce the total number of photons he measured as well as the outcome index (c, j). Table 1 shows Charlie’s probability of measuring c = 2 photons as Alice and Bob send a mixture of key states and check states. Whenever both parties send \({\left\vert ++\right\rangle }_{{{{\rm{AB}}}}}\), the probability of Charlie measuring c = 2 photons is different for the non-separable and separable measurements. This is due to the nature of Charlie’s POVM. For c = 2, Charlie has three different outcomes in this set labelled as \(\left\vert {\phi }_{2}^{0}\right\rangle ,\left\vert {\phi }_{2}^{1}\right\rangle\), and \(\left\vert {\phi }_{2}^{2}\right\rangle\). If Alice and Bob send \({\left\vert ++\right\rangle }_{{{{\rm{AB}}}}}\), the probability of measuring \(\left\vert {\phi }_{2}^{0}\right\rangle\) is 1/3 whereas the other two outcomes return 0. In the case of separable measurements, the probability of measuring a two-photon event is equal, allowing Alice and Bob to determine whether Charlie is being unfaithful or not.

Table 1 Charlie’s measurement probability for both non-separable and separable measurements for c = 2 when Alice and Bob send a combination of their check states, \((+),\left\vert +\right\rangle =\frac{1}{\sqrt{3}}(\left\vert 0\right\rangle +\left\vert 1\right\rangle +\left\vert 2\right\rangle )\) and key states, (K), \({\rho }_{{{{{\rm{A}}}}}_{2}}=\frac{1}{3}(\left\vert 0\right\rangle\!\left\langle 0\right\vert +\left\vert 1\right\rangle\!\left\langle 1\right\vert +\left\vert 2\right\rangle\!\left\langle 2\right\vert )\) in the prepare-and-measure representation with \({n}_{\max }=2\) photons.

The separable measurement is not the only possible measurement that Charlie can make. Ideally, Alice and Bob should not rely on Charlie’s announcement of his measurement basis to determine if Charlie was being reliable or estimate how much information is leaked to another malicious party, called Eve. For security purposes, it is essential to utilise two or more non-orthogonal bases in QKD. For example, in BB844 and the six-state protocol52, Alice sends states in two and three different orthogonal bases to Bob, respectively. By calculating the bit-error rates in these bases, Alice and Bob can estimate Eve’s information. However, these protocols use only the probabilities of the matched measurement outcomes, which overestimates Eve’s information resulting in a lower key rate53. Refs. 53,54 showed that full tomography of the quantum state between Alice and Bob can enhance the secret key rate due to bounding Eve’s information more accurately. Instead of using the statistics of the matched bases only, Alice and Bob can estimate their joint state from both the matched and unmatched bases. This joint state then can be used to calculate the Holevo bound on Eve’s information. The Holevo bound55 describes the maximum amount of classical information that can be extracted from a quantum channel. In QKD, Holevo bound can be used to upper bound the leaked information to Eve.

Our protocol requires a similar approach to the protocols discussed above53,54, where Alice and Bob measure their joint state in mutually unbiased bases to perform a full tomography of their joint state in the entanglement-based scheme. Two bases \({\{\left\vert {e}_{i}\right\rangle \}}_{i = 0}^{m-1}\) and \({\{\left\vert {h}_{i}\right\rangle \}}_{i = 0}^{m-1}\) are called mutually unbiased when \(\vert\langle{e_i}\vert{h_j}\rangle\vert^2=1/m\) for any i and j56, where m is the dimension of the Hilbert space. If the dimension of the Hilbert space, m, is a power of a prime number, there exists m + 1 mutually unbiased bases which form a complete set57. In Estimating Eve’s information using quantum tomography with single-photon states, we show how to estimate Eve’s information by reconstructing Alice and Bob’s joint state through full tomography when Alice and Bob send single-photon states, i.e., \({n}_{\max }=1\). In the entanglement-based scheme, Alice and Bob measure the modes they keep in their stations using the eigenvectors of the X, Y and Z bases which are expressed as

$$\left\vert \pm x\right\rangle =\frac{\left\vert 0\right\rangle \pm \left\vert 1\right\rangle }{\sqrt{2}},$$
(12)
$$\left\vert \pm y\right\rangle =\frac{\left\vert 0\right\rangle \pm {{{\rm{i}}}}\left\vert 1\right\rangle }{\sqrt{2}},$$
(13)
$$\left\vert +z\right\rangle =\left\vert 0\right\rangle ,\quad \left\vert -z\right\rangle =\left\vert 1\right\rangle .$$
(14)

These bases form a complete set of mutually unbiased bases for m = 2. In the equivalent prepare-and-measure scheme, Alice and Bob’s measurement on the two mode entangled states, \({\left\vert \Psi \right\rangle }_{{{{{\rm{A}}}}}_{1}{{{{\rm{A}}}}}_{2}}=\sqrt{{a}_{0}}\left\vert 00\right\rangle +\sqrt{{a}_{1}}\left\vert 11\right\rangle\) and \({\left\vert \Psi \right\rangle }_{{{{{\rm{B}}}}}_{1}{{{{\rm{B}}}}}_{2}}=\sqrt{{b}_{0}}\left\vert 00\right\rangle +\sqrt{{b}_{1}}\left\vert 11\right\rangle\) in the Z basis corresponds to them preparing the following states

$$\left\vert {\psi }_{+z}\right\rangle =\left\vert 0\right\rangle ,$$
(15)
$$\left\vert {\psi }_{-z}\right\rangle =\left\vert 1\right\rangle ,$$
(16)

with probability a0 and b0, and a1 and b1, respectively. Their measurement in the X basis is equivalent to them preparing the following states with equal probability

$$\left\vert {\psi }_{\pm x}\right\rangle =\sqrt{{\epsilon }_{0}}\left\vert 0\right\rangle \pm \sqrt{{\epsilon }_{1}}\left\vert 1\right\rangle ,$$
(17)

i.e., they prepare \(\left\vert {\psi }_{+x}\right\rangle\) and \(\left\vert {\psi }_{-x}\right\rangle\) with a probability of 0.5, where ϵ0 and ϵ1 represent the coefficients a0 and b0, and a1 and b1, respectively. Similarly, their measurement in the Y bases corresponds to them preparing the following states with equal probability

$$\left\vert {\psi }_{\pm y}\right\rangle =\sqrt{{\epsilon }_{0}}\left\vert 0\right\rangle \mp {{{\rm{i}}}}\sqrt{{\epsilon }_{1}}\left\vert 1\right\rangle .$$
(18)

We present the detailed results of this protocol in Realistic implementation of the MDI protocol with single-photon states.

When Alice and Bob wish to encode the key onto the higher dimensional states, i.e., \({n}_{\max }\, > \,1\), the number of check states they need to send increases. However, determining the existence of a complete set of mutually unbiased bases in an arbitrary dimensional Hilbert space is still an open problem in quantum information58. In this protocol, if Alice and Bob send states with \({n}_{\max }\) photons with a dimension of \(m={n}_{\max }+1\), they need to send check states using all the eigenvectors of m + 1 mutually unbiased bases to estimate Eve’s Holevo bound provided that m is a power of a prime number. These check states can be determined by following the method discussed in ref. 57. They can also be implemented experimentally using the methods discussed in refs. 48,49,50 and scaling the experiment performed by Bimbard et al.51 from two-photon level to higher dimensions similar to the key states in the prepare-and-measure scheme. We show the key rates of these higher dimensional states later in detail in The Results of the high-dimensional states with \({n}_{\max }=7\) photons.

Calculation of the secret key rate

In the entanglement-based protocol, the global state before Charlie’s measurement is a four-mode state. The dimension to simulate this protocol scales as m4. Therefore, the coefficients of Alice and Bob’s states in Eq. (2) and (3) are optimised by considering a classical protocol where Eve and Charlie perform a photon number measurement on their modes. We optimise the difference between the classical mutual information between Alice and Bob, and, Eve and Alice. We call this protocol the ‘classical protocol’ and an explicit method for the implementation of this protocol is shown in Classical protocol used to optimise the coefficients of the high dimensional states. The reason for doing this is to avoid having to optimise a high dimensional four mode joint state with a total dimension of m4. However, when computing the secret key rates, we do not assume any type of attacks for Eve and calculate Eve’s Holevo bound instead and Charlie performs his collective photon number measurement. It is also important to note that the optimisation problem is not convex for the high-dimensional states and the solution provided for the coefficients an and bn in this paper is one possible solution.

The states that Alice and Bob prepare are previously shown in Eq. (2) and (3), respectively. They send these states through a pure-loss channel with a transmissivity τA and τB for the channel between Alice and Charlie and Charlie and Bob, respectively. The pure-loss channel is modelled with a beamsplitter with a transmissivity τ, where the beamsplitter mixes the input mode with the vacuum. The beamsplitter transformation can be defined as

$$B(\tau )=\exp [{\cos }^{-1}(\sqrt{\tau })({\hat{a}}^{{\dagger} }\hat{b}-\hat{a}{\hat{b}}^{{\dagger} })],$$
(19)

where τ can be written as a function of the fibre distance, d, with a loss of 0.2dB per km with \(\tau=10^{-0.02d}\). \(\hat{a}\) and \(\hat{b}\) are the annihilation operators, while \({\hat{a}}^{{\dagger} }\) and \({\hat{b}}^{{\dagger} }\) are the creation operators of the two modes, respectively.

In this protocol, we assume that Eve has full access to the channel between Alice and Charlie and Charlie and Bob including Charlie’s measurements. Eve mixes vacuum with the incoming modes causing Alice and Bob to lose photons. Thus, we can express the state between Alice and Charlie and Charlie and Bob after Eve’s attack as

$${\rho }_{{{{{\rm{A}}}}}_{1}{{{{\rm{C}}}}}_{{{{\rm{A}}}}}}={{{{\rm{Tr}}}}}_{3}\!\left[\big\{{{\mathbb{I}}}_{m}\!\otimes\! B({\tau }_{{{{\rm{A}}}}})\big\}\big\{{\rho }_{{{{{\rm{A}}}}}_{1}{{{{\rm{A}}}}}_{2}}\!\otimes\! \left\vert 0\right\rangle\!\left\langle 0\right\vert \big\}{\big\{{{\mathbb{I}}}_{m}\!\otimes\! B({\tau }_{{{{\rm{A}}}}})\big\}}^{{\dagger} }\right],$$
(20)
$${\rho }_{{{{{\rm{C}}}}}_{{{{\rm{B}}}}}{{{{\rm{B}}}}}_{1}}={{{{\rm{Tr}}}}}_{1}\!\left[\big\{B({\tau }_{{{{\rm{B}}}}})\!\otimes\! {{\mathbb{I}}}_{m}\big\}\big\{\left\vert 0\right\rangle\!\left\langle 0\right\vert \!\otimes\! {\rho }_{{{{{\rm{B}}}}}_{2}{{{{\rm{B}}}}}_{1}}\big\}{\big\{B({\tau }_{{{{\rm{B}}}}})\!\otimes\! {{\mathbb{I}}}_{m}\big\}}^{{\dagger} }\right],$$
(21)

where Tri[ρ] stands for tracing out the i-th mode of the state ρ.

After Charlie’s measurement and tracing out his modes, the subnormalised state between Alice and Bob becomes

$${\tilde{\rho }}_{{{{\rm{AB}}}}{| }_{c}^{j}}={{{{\rm{Tr}}}}}_{23}\!\left[\left({{\mathbb{I}}}_{m}\!\otimes\! {\Pi }_{c}^{j}\!\otimes\! {{\mathbb{I}}}_{m}\right)\left({\rho }_{{{{{\rm{A}}}}}_{1}{{{{\rm{C}}}}}_{{{{\rm{A}}}}}}\!\otimes\! {\rho }_{{{{{\rm{C}}}}}_{{{{\rm{B}}}}}{{{{\rm{B}}}}}_{1}}\right){\left({{\mathbb{I}}}_{m}\!\otimes\! {\Pi }_{c}^{j}\!\otimes\! {{\mathbb{I}}}_{m}\right)}^{{\dagger} }\right].$$
(22)

We can calculate Charlie’s probability of obtaining outcomes (c, j) from the following expression

$${P}_{{}_{c}^{j}}={{{\rm{Tr}}}}\left[{\tilde{\rho }}_{{{{\rm{AB}}}}{| }_{c}^{j}}\right].$$
(23)

Normalising Alice and Bob’s joint state by Charlie’s probability of measuring c photons for his measurement j gives us the final conditional state between them as

$${\rho }_{{{{\rm{AB}}}}{| }_{c}^{j}}=\frac{{\tilde{\rho }}_{{{{\rm{AB}}}}{| }_{c}^{j}}}{{P}_{c}^{j}}.$$
(24)

However, for the key states that Alice and Bob send, the probability of Charlie measuring c photons, Alice and Bob’s conditional mutual information and Eve’s conditional information do not change for each j ranging from 0 to c. As such, there is no need to calculate Alice and Bob’s conditional joint state for each value of j. Therefore, we omit j from the following equations and set it to zero.

We then calculate Charlie’s total probability of measuring c photons from

$${P}_{c}=\mathop{\sum}\limits_{j=0}^{c}{{{\rm{Tr}}}}\!\left[{\tilde{\rho}}_{{{{\rm{AB}}}}{|}_{c}^{j}}\right]=(c+1){{{\rm{Tr}}}}\!\left[{\tilde{\rho}}_{{{{\rm{AB}}}}{|}_{c}^{j = 0}}\right],$$
(25)

since there are c + 1 POVM outcomes with a total photon number c.

In order to calculate Alice and Bob’s mutual information, we first generate Alice and Bob’s probability table as follows

$$P({n}_{a},{n}_{b}| c)=\left\langle {n}_{a},{n}_{b}\right\vert {\rho }_{{{{\rm{AB}}}}{| }_{c}}\left\vert {n}_{a},{n}_{b}\right\rangle ,$$
(26)

where each term in Alice and Bob’s mutual information is given by the conditional Shannon’s entropy as expressed below

$$H(A| c)=-\mathop{\sum }\limits_{{n}_{a}=0}^{{n}_{\max }}P({n}_{a}| c){\log }_{2}P({n}_{a}| c),$$
(27)
$$H(B| c)=-\mathop{\sum }\limits_{{n}_{b}=0}^{{n}_{\max }}P({n}_{b}| c){\log }_{2}P({n}_{b}| c),$$
(28)
$$H(AB| c)=-\mathop{\sum }\limits_{{n}_{a}=0}^{{n}_{\max }}\mathop{\sum }\limits_{{n}_{b}=0}^{{n}_{\max }}P({n}_{a},{n}_{b}| c){\log }_{2}P({n}_{a},{n}_{b}| c).$$
(29)

Using the equations above, we evaluate Alice and Bob’s mutual information conditioned on Charlie’s measurement outcome from \(I_{AB \vert c} = H(A \vert c) + H(B \vert c)-H(AB \vert c)\).

Eve’s information is calculated from Alice and Bob’s conditional state after Bob’s measurement outcome on this joint state using

$${I}_{E| c}=S({\rho }_{{{{\rm{AB}}}}| c})-\mathop{\sum }\limits_{b=0}^{{n}_{\max }}{P}_{b}S({\rho }_{{{{\rm{A}}}}| cb}),$$
(30)

where Bob’s POVM is shown in Eq. (4) in Alice and Bob’s states for generating a key. b represents the number of photons that Bob measures while Pb corresponds to Bob’s probability of measuring b photons. The subnormalised state \({\tilde{\rho }}_{{{{\rm{A}}}}| cb}\) is obtained from

$${\tilde{\rho }}_{{{{\rm{A}}}}| cb}={{{{\rm{Tr}}}}}_{2}\big[\big({{\mathbb{I}}}_{m}\otimes {\Pi }_{b}\big){\rho }_{{{{\rm{AB}}}}{| }_{c}}{\big({{\mathbb{I}}}_{m}\otimes {\Pi }_{b}\big)}^{{\dagger} }\big],$$
(31)

where Bob’s probability of measuring b photons is given by

$${P}_{b}={{{\rm{Tr}}}}[{\tilde{\rho }}_{{{{\rm{A}}}}| cb}].$$
(32)

Alice’s subnormalised state conditioned on Bob’s and Charlie’s measurement outcomes, \({\tilde{\rho }}_{{{{\rm{A}}}}| cb}\) is then normalised by Bob’s measurement probability by

$${\rho }_{{{{\rm{A}}}}| cb}=\frac{{\tilde{\rho }}_{{{{\rm{A}}}}| cb}}{{P}_{b}}.$$
(33)

The asymptotic key rate of this protocol requires the combination of all the possible outcomes of Charlie’s POVM since Alice and Bob are sending states with n photons each with a possibility of measuring 0 to 2n photons by Charlie. However, we discard events where Eve’s conditional information is greater than Alice and Bob’s conditional mutual information. For example, when a zero photon occurs, Eve gets more information than Alice and Bob due to all the photons being lost to Eve. As such we exclude the case when c = 0. Similarly, when Charlie measures \(c=2{n}_{\max }\) photons, the key rate conditioned on this measurement outcome is zero even though Eve’s conditional information is zero. Therefore, the resulting asymptotic key rate can be expressed as

$$K=\mathop{\sum}\limits_{c=0}^{2{n}_{\max}}{P}_{c}\max\!\big[0,{I}_{AB| c}-{I}_{E| c}\big].$$
(34)

The Results of the high-dimensional states

Our simulation results are shown in Fig. 2a for the pure-loss channel with 0.2dB loss per km. We compare our results with the existing MDI protocols such as the CV-MDI protocol from Pirandola et al.30 and one of the best performing TF-QKD protocols known as TF-QKD without phase post-selection (NPP-TF-QKD) from Cui et al.59 and Lu et al.60.

Fig. 2: Simulation results of our repeater protocol for a pure-loss channel with a loss of 0.2 dB/km.
figure 2

a Solid orange and red dashed lines show the key rates of our protocol using the states shown in Eq. (1) with \({n}_{\max }=7\) photons with optimised squeezing coefficients and a squeezing coefficient of γ = 0.26, respectively. Blue dashed line shows the results of the optimised states with \({n}_{\max }=1\) photon given in Eq. (2) and (3) and using Charlie’s POVM with an outcome of 1 and 2 photons. The solid blue line shows our protocol using the optimised states with \({n}_{\max }=7\) photons given in Eq. (2) and (3). Black solid lines show the single-repeater and repeaterless bounds. Solid grey line represents the CV-MDI protocol30 with a variance of 1000 and relay positioned at 0.01 m away from Alice, while the solid green line shows the TF-QKD protocol with no phase post-selection (NPP-TF-QKD)60 using optimised coherent states and infinite decoy states. b The comparison of the reverse coherent information of the optimised states with \({n}_{\max }=7\) and \({n}_{\max }=1\) photons in the form of Eq. (2) and (3) in point-to-point communications between Alice and Bob and with a single-repeater. The faint blue and orange lines represent the RCI of the single-repeater and point-to-point communications of the optimised states with \({n}_{\max }=7\) photons correspondingly, while the blue and red dashed lines show the RCI of the single-repeater and point-to-point communications of the optimised states with \({n}_{\max }=1\) photon. The black solid line shows the reverse coherent information of an infinitely squeezed TMSV state denoted as PLOB.

We first show the case where Alice and Bob send the states shown in Eq. (1) with a squeezing coefficient of γ = 0.26 for each distance with \({n}_{\max }=7\) photons. The squeezing level of γ = 0.26 was determined based on the shortest distance that the protocol exceeds the PLOB bound (refer to Coefficients of the optimised states, Table 4 for the details). With these states, the PLOB bound and the CV-MDI protocol are surpassed at 144 km and 114 km, respectively, while the protocol is performing worse than the TF-QKD protocol. We also demonstrate the key rates of the same states where the values of γ are optimised to give the maximum secret key rate at the corresponding distance. For distances greater than 50 km, there is not much difference compared to the states with γ = 0.26 and the PLOB bound is still surpassed at the same distance as the case of γ = 0.26. However, the key rates are now higher at short distances below 50 km. This indicates that in the short distance regime, the contribution of the higher order photons to the key rate is significant while at larger distances, the main contribution comes from the the first few photons of the state as the majority of the photons are lost to the environment at such distances. This can also be seen from the optimal squeezing level given in Table 4, which is higher for short distances and lower for larger distances.

When Alice and Bob send the optimised states shown in Eq. (2) and (3), these states outperform the results of the states with optimised γ by surpassing the repeaterless bound and the CV-MDI protocol at 108 km and 75 km, respectively. These states also do considerably better than the TF-QKD protocol as the TF-QKD protocol exceeds the PLOB bound at only 130 km and its key rates are lower than our protocol at each distance. It is important to note that this result can also be achieved by using the optimised states with \({n}_{\max }=1\) photon in the form of \(\sqrt{{a}_{0}}\left\vert 00\right\rangle +\sqrt{{a}_{1}}\left\vert 11\right\rangle\) as shown in Fig. 2a since both states reach the PLOB bound at the same distance and the key-rates converge beyond 10 km. In Fig. 2a, both high-dimensional and single-photons states have the same gradient, scaling like the single-repeater bound with \(O(\sqrt{\tau })\). The probability of receiving n-photons in this case is given by \({(\sqrt{\tau })}^{n}\). Therefore, the main scaling of the key rates comes from the single-photon level, while the remaining photons help the key rate incrementally. As the loss gets higher, the probability of receiving higher photons drops. Therefore, beyond 10 km, we are only interested in 1 or 2 photons. This is further emphasised in Fig. 3a where we show the probability of sending each Fock-number state of the optimised states given in Eq. (2) and (3) for each transmission distance. At short distances, the high-dimensional states have contribution from each photon number. It is important to note that at 0 km, the probability of sending each Fock-number state is not equal due to key rate being equal to zero when Charlie receives 0 or 14 photons in total. Therefore, the coefficients of the Fock states \(\left\vert 0\right\rangle\) and \(\left\vert 7\right\rangle\) are minimised accordingly. As the distance increases, the high-dimensional states reduce down to the single-photon level as the coefficients of the Fock states above one photon approach zero. The probabilities of sending zero and one photon, denoted as a0 and a1, of these high-dimensional states shown in Fig. 3a converge to the coefficients of the optimised states with \({n}_{\max }=1\) photon shown in Fig. 3b beyond approximately 50 km. However, the main advantage of using the optimised states with \({n}_{\max }=7\) is the ability of obtaining higher key rates at shorter distances. This is shown in Fig. 4, as the secret key rate increases when the number of encoded photons changes from 1 to 7 photons.

Fig. 3: Simulation results of the optimised coefficients.
figure 3

a The optimised coefficients of the states shown in Eq. (2) and (3) with \({n}_{\max }=7\) photons, where the coefficients are explicitly shown in Table 2. b The optimised coefficients of the states shown in Eq. (2) and (3) with \({n}_{\max }=1\) photon (refer to Table 3 for the optimised coefficients for each distance).

Fig. 4: Simulation results of the secret key rate when the number of encoded photons varies from 1 to 7 photons at 5 km.
figure 4

The states are in the form of Eq. (2) and (3) where the coefficients of each state are optimised.

As the key rates of the optimised states with \({n}_{\max }=7\) converge with the results of the states with optimised γ below 10 km and with the optimised states with \({n}_{\max }=1\) photon, one can use the combination of the states with optimised γ and optimised states with \({n}_{\max }=1\) photon beyond this distance to achieve the same results of the states given in Eq. (2) and (3).

As mentioned previously, the maximum key rate achievable by QKD for the point-to-point and single-repeater communication is bounded by the PLOB and single-repeater bounds, respectively26,28. These bounds are determined by the maximum amount of entanglement that a channel can sustain, also known as the entanglement flux, which coincides with reverse coherent information (RCI) of a maximally entangled TMSV state for the pure-loss channel26,61,62. RCI is used to lower bound the distillable entanglement of a given channel62 and is a measure of the transmission of quantum information. While the key rates above demonstrate that our protocol surpasses the PLOB bound and acts as a repeater, the secret key rate is a measure of the transmission of classical information. The key rates are also bounded by the amount of entanglement that Alice and Bob can distill. Therefore, we also compute the RCI of our quantum states to verify the distillable entanglement between Alice and Bob after Charlie’s measurement using

$${{\mbox{RCI}}}\,=\mathop{\sum}\limits_{c=0}^{2{n}_{\max}}{P}_{c}\max \!\big[0,S({\rho}_{{{{\rm{A}}}}| c})-S({\rho}_{{{{\rm{AB}}}}| c})\big],$$
(35)

where \(S(\rho_{AB \vert c})\) and \(S(\rho_{A \vert c})\) are the von Neumann entropies of the joint state between Alice and Bob \(\rho_{AB \vert c}\) and Alice’s state \(Tr_{2}[\rho_{AB|c}]\), respectively.

In Fig. 2b, we show the RCI of the optimised states with \({n}_{\max }=7\) and \({n}_{\max }=1\) when Alice and Bob perform point-to-point and single-repeater communications. We compare these results with the PLOB bound as it coincides with the RCI of a maximally entangled TMSV state in the pure-loss channel. Note that when Alice and Bob communicate directly using the optimised states with \({n}_{\max }=7\), they cannot saturate the PLOB bound due to sending states with a limited number of photons. However, they can reach the PLOB bound if they send infinitely squeezed TMSV states with an infinite number of photons3. In Fig. 2b, when Alice and Bob perform point-to-point communication, they can distill more entanglement at short distances. However, with the use of a repeater, they are able to distill more entanglement beyond 47 km and surpass the RCI of an infinitely squeezed TMSV state at 108 km. Note that they also surpass the PLOB bound at this distance when we calculate their secret key rate as shown in Fig. 2a and the key rates coincide with the reverse coherent information of Alice and Bob’s conditional joint state on Charlie’s measurement outcome. This indicates that after Charlie’s measurement, Alice and Bob’s PNRD measurement is optimal as Alice and Bob achieve the same key rates as the distillable entanglement of their joint state.

Realistic implementation of the MDI protocol with single-photon states

The experimental realisation of the higher dimensional optimised states and Charlie’s measurement is quite challenging with state of the art technology. In this section, we present an experimentally feasible implementation of our protocol, shown in Fig. 5, by using single-photon states which can be performed with existing technology. Fig. 2a demonstrates that beyond 10 km, the single-photon states achieve the same key rates as the higher dimensional states and the high-dimensional states reduce down to the single-photon level as demonstrated in Fig. 3a and Fig. 3b.

Fig. 5: Equivalent representations of the protocol with single photons.
figure 5

a Entanglement-based scheme where both Alice and Bob send the optimised states in the form of \(\sqrt{{a}_{0}}\left\vert 00\right\rangle +\sqrt{{a}_{1}}\left\vert 11\right\rangle\) and \(\sqrt{{b}_{0}}\left\vert 00\right\rangle +\sqrt{{b}_{1}}\left\vert 11\right\rangle\) to Charlie while keeping one arm of their states to themselves denoted as modes A1 and B1. They perform a measurement in the X, Y, and Z bases to compute the statistics of their matched and unmatched results. This measurement also projects the arm they sent to Charlie onto a single-mode state in the corresponding basis as shown in b. Charlie interferes modes A2 and B2 coming from Alice and Bob, respectively, at a 50:50 beamsplitter and performs single-photon detection with PNRDs. A successful outcome occurs when Charlie’s left (10 event) or right detector (01 event) registers a single click only. Alice and Bob ignore the instances of 02, 20 and 11 photon events. b Prepare-and-measure scheme where Alice and Bob send single-mode states to Charlie where they encode the key information in the Z basis. They send the states \(\left\vert 0\right\rangle\) and \(\left\vert 1\right\rangle\) with probabilities a0, b0 and a1, b1, respectively. They randomly switch to X and Y bases to send check states to estimate Eve’s information (refer to Alice and Bob’s check states for security for the details of the check states). Charlie’s measurement is the same as the one in the entanglement-based scheme shown in a.

When Alice and Bob send single-photon states, Charlie can measure from 0 to 2 photons. However, as mentioned previously in Calculation of the secret key rate, when Charlie measures 2 photons, the conditional secret key rate is zero as such the contribution to the key rate comes from only the single-photon detection events. This eliminates Charlie having to distinguish between c = 2 photon outcomes, i.e., \(\left\vert {\phi }_{2}^{0}\right\rangle ,\left\vert {\phi }_{2}^{1}\right\rangle\) and \(\left\vert {\phi }_{2}^{2}\right\rangle\) and requires him to only distinguish between the single-photon outcomes. Therefore, we can simplify our protocol to Fig. 5, where Charlie interferes the single photons coming from Alice and Bob at a 50:50 beamsplitter and uses two photon-number resolving detectors up to the two-photon level. After Charlie’s measurement, Alice and Bob can estimate their joint state to bound Eve’s information using the statistics of their matched and unmatched data of X, Y, and Z bases as mentioned in Calculation of the secret key rate. This protocol is conceptually similar to Protocol 1 and Protocol 2 of Curty et al.63. One of the main differences is that our single-photon protocol uses PNRDs at Charlie’s station which helps Alice and Bob to disregard any measurement that is a two-photon click (i.e. Charlie receives no clicks at one detector and two clicks on the other), resulting in a lower bit-error rate. Our protocol also estimates Eve’s information more tightly as Alice and Bob perform a full tomography of their joint state using the eigenvectors of the X, Y, and Z bases, whereas ref. 63 only uses the measurement results of the X and Z bases. These two differences yield a higher key rate than the results of ref. 63.

Additionally, we consider the detrimental effects of the detector inefficiency and dark counts to the key rates. The single-photon states are optimised for a detector with an efficiency of 85% and a dark count rate of 5 × 10−8, where the coefficients of the zero and single photons are shown in Table 5 and in Fig. 3b. In a lossless channel, the probability of sending a single-photon initially is half. However, as the channel becomes more lossy, it is likely that the single-photon will be lost during transmission. When Charlie receives no photons, this corresponds to a large bit-error rate reducing the key rates. This is compensated by reducing the probability of sending single-photons to decrease the bit-error rates and increase the key rates64. With realistic dark count rates and detector efficiencies, our protocol using perfect single-photon sources surpasses the PLOB bound at 116 km while the NPP-TF-QKD with infinite decoy states surpasses at 137 km as shown in Fig. 6. The NPP-TF-QKD protocol drops to zero beyond 518 km whereas our protocol drops to zero beyond 542 km showing a 24 km advancement in the transmission distance.

Fig. 6: Simulation results of our repeater protocol using single-photon states with experimental parameters.
figure 6

The blue dashed line shows our protocol using the single-photon states in the form of \(\sqrt{{a}_{0}}\left\vert 00\right\rangle +\sqrt{{a}_{1}}\left\vert 11\right\rangle\) and \(\sqrt{{b}_{0}}\left\vert 00\right\rangle +\sqrt{{b}_{1}}\left\vert 11\right\rangle\) with optimised coefficients and perfect single-photon sources. The solid green line and black lines are the NPP-TF-QKD protocol60 with infinite decoy states and the PLOB bound, respectively. We assume a dark count rate of 5 × 10−8 with a detector efficiency of 0.85 for both protocols.

To account for a more practical scenario, we simulate our protocol with imperfect single-photon sources and compare it with the NPP-TF-QKD protocol60 with a finite number of decoy states. When the single-photon sources used by Alice and Bob are heralded with imperfect detectors with a dark count rate of 5 × 10−8 and a detector efficiency of 0.85 for state preparation, the single-photon protocol achieves a total transmission distance of 480 km assuming 0.2 dB loss per km. When NPP-TF-QKD protocol60 uses finite decoy states with two decoy modes with four intensities and the same dark count rates and detector efficiencies, the protocol achieves a total transmission distance of 470 km. Using a more realistic experimental set-up our protocol still performs better. However, as the heralding detectors used by Alice and Bob for the state preparation get more lossy, our protocol is likely to start performing worse than the TF-QKD protocols as these protocols use coherent states. Current superconducting nanowire single-photon detectors can achieve detector efficiencies up to 90% with dark count rates as low as 10−9 as demonstrated previously in ref. 40.

The improvements made to the total transmission distance in our protocol are a result of several factors. Even though both the single-photon and NPP-TF-QKD60 protocols use optimised states, our protocol has more freedom over optimising the coefficients of the single-photon state while the TF-QKD protocols need to ensure that the intensities of the coherent states are still weak enough while optimising the key rates. This is also one of the key differences between our protocol and the Sending-or-Not-Sending TF-QKD (SNS-TF-QKD) protocol65, where Alice and Bob send weak coherent states and no states with a probability of ϵ and 1 − ϵ, respectively. However, the probability of the single-photon detection is still determined by the intensity of the weak coherent states in the SNS-TF-QKD protocol whereas in this protocol, Alice and Bob send single-photon states with a probability of ϵ which determines the probability of detection at Charlie’s detectors. Our protocol also has the ability to distinguish two-photon events occurring at a single detector at Charlie. For example, if Charlie receives no photons on one detector and two photons on the other, these events can be disregarded and do not contribute to bit-error rates. However, in TF-QKD protocols with single-photon detectors, this event would register as one click, causing an increase in the bit-error rate. Therefore, the use of PNRDs in Charlie’s station improves the bit-error rates. Furthermore, our protocol can estimate Eve’s information more accurately due to the use of the probabilities of the matched and unmatched bases. These are the main factors that distinguish our protocol from the existing MDI and TF-QKD protocols.

Discussion

In this paper, we introduced an MDI protocol using higher dimensional states that surpasses the repeaterless bound without the need of quantum memories as it scales like the single-repeater bound. However, for large distances, the states required in this protocol reduce down to the single-photon level due to the losses in the channel. Based on this, we proposed an experimentally feasible implementation of this protocol just using single-photons and photon-number resolving detectors which performs better than the existing protocols such as NPP-TF-QKD protocol59,60.

Furthermore, we investigated whether the single-repeater bound can be saturated with a simple protocol by using only single copies of the states sent by Alice and Bob and without collective measurements performed by Charlie. Our results show that unlike the repeaterless bound, this is probably not possible with single copies of the states and likely to require many copies of the states sent by Alice and Bob and collective measurements as previously shown by García-Patrón et al.62 and a protocol proposed by Winnel et al.66.

The results presented in this work refer to the asymptotic key rates, and the security of this protocol with finite-size effects needs to be considered in the future. In this protocol, there are no misalignment errors in the Z basis due to sending single-photons. However, the misalignment errors are likely to impact the statistics of the check states in the X and Y bases which can be investigated in future work. The feasibility of extending this protocol to a network of multiple users can also be studied.

Note that there are two challenges in our protocol which are the implementation of the states that Alice and Bob prepare and Charlie’s coherent total photon number measurement. Ref. 51 managed to implement the states we require for this protocol up to the two-photon level. We would like to motivate the community with a possible extension of the work presented in ref. 51 to higher dimensions for state preparation and exploring ways to implement Charlie’s measurement as they are likely to contribute to many areas in quantum information not only QKD, but also quantum metrology, entanglement swapping, entanglement distillation, optical quantum computing and error correction.

Methods

Estimating Eve’s information using quantum tomography with single-photon states

In this section, we show how Alice and Bob can estimate their joint state conditioned on Charlie’s measurement outcome to bound Eve’s information.

Alice and Bob measure their joint state in the X, Y, and Z bases in the entanglement-based scheme as introduced in Alice and Bob’s check states for security to construct the statistics of their matched and unmatched results. From the probabilities measured in these bases, Alice and Bob can estimate their joint state. Writing their joint state as

$${\hat{\rho}}_{{{{\rm{AB}}}}| c = 1}=\frac{1}{4}\left({{\mathbb{I}}}_{4}+{\overrightarrow{s}}_{a}\!\cdot\! {\overrightarrow{\sigma}}_{a}+{\overrightarrow{s}}_{b}\!\cdot\! {\overrightarrow{\sigma}}_{b}+\mathop{\sum}\limits_{j,k}{r}_{jk}({\sigma}_{j}\otimes {\sigma}_{k})\right),$$
(36)

where \({\overrightarrow{s}}_{a}\!\cdot\! {\overrightarrow{\sigma }}_{a}\) and \({\overrightarrow{s}}_{b}\!\cdot\! {\overrightarrow{\sigma }}_{b}\) describe Alice and Bob’s reduced states calculated from their local measurements, while rjk(σjσk) gives the correlations between Alice and Bob determined from their measurements performed in the bases j = {X, Y, Z} and k = {X, Y, Z}, where rjk is the correlation coefficient and σj and σk are the standard Pauli matrices σX, σY and σZ. The terms \({\overrightarrow{s}}_{a}\!\cdot\! {\overrightarrow{\sigma }}_{a}\) and \({\overrightarrow{s}}_{b}\!\cdot\! {\overrightarrow{\sigma }}_{b}\) can be expressed as

$${\overrightarrow{s}}_{a}\!\cdot\! {\overrightarrow{\sigma }}_{a}={a}_{X}({\sigma }_{X}\otimes {{\mathbb{I}}}_{2})+{a}_{Y}({\sigma }_{Y}\otimes {{\mathbb{I}}}_{2})+{a}_{Z}({\sigma }_{Z}\otimes {{\mathbb{I}}}_{2}),$$
(37)
$${\overrightarrow{s}}_{b}\!\cdot\! {\overrightarrow{\sigma }}_{b}={b}_{X}({{\mathbb{I}}}_{2}\otimes {\sigma }_{X})+{b}_{Y}({{\mathbb{I}}}_{2}\otimes {\sigma }_{Y})+{b}_{Z}({{\mathbb{I}}}_{2}\otimes {\sigma }_{Z}),$$
(38)

where {aX, aY, aZ} and {bX, bY, bZ} represent the coefficients given in Eq. (42) and (43) when Alice and Bob measure in the bases j = {X, Y, Z}.

When Alice and Bob measure their own qubits in any basis j = {X, Y, Z}, their measurement outcomes can be expressed as

$${\Pi }_{\pm j}=\left\vert \pm j\right\rangle\! \left\langle \pm j\right\vert ,$$
(39)

which can be calculated using the eigenvectors of the X, Y and Z bases as defined previously in Eq. (12), (13) and (14). The probability of their measurement then can be calculated from

$${P}_{a}(\pm j)={{{\rm{Tr}}}}\!\left[\left({\Pi }_{\pm j}\otimes {{\mathbb{I}}}_{2}\right){\rho }_{{{{\rm{AB}}}}| c = 1}{\left({\Pi }_{\pm j}\otimes {{\mathbb{I}}}_{2}\right)}^{{\dagger} }\right],$$
(40)
$${P}_{b}(\pm j)={{{\rm{Tr}}}}\!\left[\left({{\mathbb{I}}}_{2}\otimes {\Pi }_{\pm j}\right){\rho }_{{{{\rm{AB}}}}| c = 1}{\left({{\mathbb{I}}}_{2}\otimes {\Pi }_{\pm j}\right)}^{{\dagger} }\right],$$
(41)

where ρABc=1 is determined from Eq. (24).

The coefficients in Eq. (37) and (38) can be computed from Eq. (40) and (41) where

$${a}_{j}={P}_{a}(+j)-{P}_{a}(-j),$$
(42)
$${b}_{j}={P}_{b}(+j)-{P}_{b}(-j).$$
(43)

In order to determine the correlation coefficients rjk, Alice and Bob construct a joint probability table of their measurements in all the bases where these probabilities are calculated from

$$P(a\!=\!\pm j,b\!=\!\pm k)={{{\rm{Tr}}}}\!\left[\left({\Pi }_{\pm j}\otimes {\Pi }_{\pm k}\right){\rho }_{{{{\rm{AB}}}}| c = 1}{\left({\Pi }_{\pm j}\otimes {\Pi }_{\pm k}\right)}^{{\dagger} }\right].$$
(44)

Using Eq. (44), the correlation coefficients become

$$\begin{array}{rcl}{r}_{jk}&=&P(a=+j,b=+k)+P(a=-j,b=-k)\\ &&-P(a=+j,b=-k)-P(a=-j,b=+k).\end{array}$$
(45)

After Alice and Bob reconstruct their estimated joint matrix \({\hat{\rho }}_{{{{\rm{AB}}}}| c = 1}\), they can estimate Eve’s information using the Holevo bound as given in Eq. (30).

Classical protocol used to optimise the coefficients of the high dimensional states

This section describes how the states that Alice and Bob prepare are chosen. The coefficients of these states are determined based on the following classical protocol. We assume Eve taps off the signal sent by Alice and Bob, and measures the number of photons denoted as \({n}_{{e}_{a}}\) and \({n}_{{e}_{b}}\). Then we maximise the average difference in mutual information

$$\mathop{\max }\limits_{\{P({n}_{a}),P({n}_{b})\}}\left[\mathop{\sum }\limits_{c=0}^{2{n}_{\max }}{P}_{c}({n}_{c})\left({I}_{AB| c}-{I}_{AE| c}\right)\right],$$
(46)

where IABc and IAEc are Alice and Bob’s mutual information and mutual information between Alice and Eve conditioned on Charlie’s measurement outcome, respectively. P(nc) represents the probability of Charlie measuring nc photons in total. Note that P(na) and P(nb) are related to the optimised coefficients from Eq. (2) and (3) as they are the probability of sending n photons for the corresponding Fock-number state \(\left\vert n\right\rangle\), also expressed as an and bn throughout this paper.

In the classical protocol, Charlie measures the number of photons coming from Alice and Bob individually with two separate PNRDs. In Fock basis, both classical and quantum simulations yield the same probabilities for Charlie’s measurement outcome. The probability of Charlie measuring \({n}_{{c}_{a}}\) or \({n}_{{c}_{b}}\) photons on Alice’s and Bob’s mode individually can be computed as

$${P}_{{c}_{a}}({n}_{{c}_{a}})=\mathop{\sum }\limits_{{n}_{a}=0}^{{n}_{\max }}\left(\begin{array}{c}{n}_{a}\\ {n}_{{c}_{a}}\end{array}\right){\tau }_{{{{\rm{A}}}}}^{{n}_{{c}_{a}}}{(1-{\tau }_{{{{\rm{A}}}}})}^{{n}_{a}-{n}_{{c}_{a}}}P({n}_{a}),$$
(47)

where \({n}_{\max }\) refers to the maximum number of photons Alice and Bob are sending individually. τA is the probability of a photon arriving at Charlie from Alice or Bob as a function of the fibre distance with \(\tau_A=10^{-0.02d}\). \({(1-{\tau }_{{{{\rm{A}}}}})}^{{n}_{a}-{n}_{{c}_{a}}}\) is the probability of losing \({n}_{a}-{n}_{{c}_{a}}\) photons to Eve. The probability of the collective photon number measurement performed by Charlie for a given number of photons nc can be calculated using Eq. (47) as shown below

$${P}_{c}({n}_{c})=\mathop{\sum }\limits_{{n}_{{c}_{a}}=0}^{{n}_{c}}{P}_{{c}_{a}}({n}_{{c}_{a}}){P}_{{c}_{b}}({n}_{c}-{n}_{{c}_{a}}),$$
(48)

where \({n}_{c}-{n}_{{c}_{a}}\) gives the number of photons measured on Bob’s mode.

Alice and Bob’s mutual information conditioned on Charlie’s measurement outcome is obtained from the probability table between Alice and Bob which is as follows

$$P({n}_{a},{n}_{b}| {n}_{c})=\left(\begin{array}{c}{n}_{a}+{n}_{b}\\ {n}_{c}\end{array}\right)\frac{{\tau }^{{n}_{c}}{(1-\tau )}^{{n}_{a}+{n}_{b}-{n}_{c}}P({n}_{a})P({n}_{b})}{{P}_{c}({n}_{c})},$$
(49)

where na + nb is equal to the total number of photons in the system and τ in the equation above corresponds to the transmission probability in one channel only. We evaluate Alice and Bob’s mutual information conditioned on Charlie’s measurement outcome from the same approach shown in Calculation of the secret key rate using \(I_{AB \vert c} = H(A \vert c) + H(B \vert c)-H(AB \vert c)\) and Eq. (27), (28) and (29).

We quantify Eve’s information conditioned on each photon measurement in a similar fashion to Alice and Bob’s mutual information using \(I_{E \vert c} = H(A \vert c) + H(E \vert c) - H(AE \vert c)\). Since Eve has access to both channels between Alice and Charlie and Charlie and Bob, we need to consider events where each party loses photons to Eve. We compute the probability table between Alice, Bob and the two modes of Eve conditioned on Charlie’s outcome as follows

$$\begin{array}{rcl}&&P({n}_{a},{n}_{b},{n}_{{e}_{a}},{n}_{{e}_{b}}| {n}_{c})=\frac{1}{{P}_{c}({n}_{c})}\left(\begin{array}{c}{n}_{a}\\ {n}_{{e}_{a}}\end{array}\right)\left(\begin{array}{c}{n}_{b}\\ {n}_{{e}_{b}}\end{array}\right)\\ &&{\tau }^{{n}_{a}+{n}_{b}-({n}_{{e}_{a}}+{n}_{{e}_{b}})}{(1-\tau )}^{{n}_{{e}_{a}}+{n}_{{e}_{b}}}P({n}_{a})P({n}_{b}),\end{array}$$
(50)

provided \({n}_{a}+{n}_{b}-({n}_{{e}_{a}}+{n}_{{e}_{b}})={n}_{c}\), where \({n}_{{e}_{a}}\) and \({n}_{{e}_{b}}\) are the photons lost to Eve by Alice and Bob, respectively, and \({n}_{a}+{n}_{b}-({n}_{{e}_{a}}+{n}_{{e}_{b}})\) corresponds to the total number of photons measured by Charlie. Therefore, using the probability table between Alice, Bob and Eve, we can calculate the entropies below to compute Eve’s information

$$\begin{array}{rcl}&&H({E}_{{{{\rm{A}}}}}{E}_{{{{\rm{B}}}}}| c)=-\mathop{\sum }\limits_{{n}_{{e}_{a}}=0}^{{n}_{\max }}\mathop{\sum }\limits_{{n}_{{e}_{b}}=0}^{{n}_{\max }}\\ &&P({n}_{{e}_{a}},{n}_{{e}_{b}}| c){\log }_{2}P({n}_{{e}_{a}},{n}_{{e}_{b}}| c),\end{array}$$
(51)
$$\begin{array}{rcl}&&H(A{E}_{{{{\rm{A}}}}}{E}_{{{{\rm{B}}}}}| c)=-\mathop{\sum }\limits_{{n}_{a}=0}^{{n}_{\max }}\mathop{\sum }\limits_{{n}_{{e}_{a}}=0}^{{n}_{\max }}\mathop{\sum }\limits_{{n}_{{e}_{b}}=0}^{{n}_{\max }}P({n}_{a},{n}_{{e}_{a}},{n}_{{e}_{b}}| c)\\ &&{\log }_{2}P({n}_{a},{n}_{{e}_{a}},{n}_{{e}_{b}}| c).\end{array}$$
(52)

Modelling dark noise and detector efficiency in the entanglement swapping measurement and heralded single-photon sources

This section describes how to model the dark noise and detector efficiency at Charlie’s photon number resolving detectors to achieve the results of Fig. 6 and the single-photon sources heralded by these detectors. The effects of dark noise is modelled by interacting the incoming state with a thermal state at a beamsplitter as shown in Fig. 7.

Fig. 7: Diagram of the method used to simulate the effect of dark counts in the PNRDs.
figure 7

ρin is the density matrix of the input state. The grey box represents a realistic photon number resolving detector with efficiency ηd and dark noise \((1-{\eta }_{d})\bar{n}\).

The efficiency of the single photon detection in this framework is the transmissivity of the beamsplitter (τ), i.e., ηd = τ. The density matrix of the state to be detected can be written down as

$${\rho }_{{{{\rm{out}}}}}=B({\eta }_{d})\big({\rho }_{{{{\rm{in}}}}}\otimes \rho (\bar{n})\big)B{({\eta }_{d})}^{{\dagger} },$$
(53)

where \(\rho (\bar{n})\) is the density matrix of the thermal state. The beamsplitter transformation is shown in Eq. (19). The density matrix of the thermal state is given by

$$\rho (\bar{n})=\mathop{\sum}\limits_{n=0}^{\infty}\frac{{\bar{n}}^{n}}{{(1+\bar{n})}^{n+1}}\left\vert n\right\rangle\!\left\langle n\right\vert ,$$
(54)

where \(\bar{n}=\,{{\mbox{Tr}}}\,[\rho (\bar{n}){a}^{{\dagger} }a]\) is the mean photon number of the thermal state. Consequently, the dark count is given by \((1-{\eta }_{d})\bar{n}\). For low dark counts, the summation in Eq. (54) can be truncated accordingly.

Coefficients of the optimised states

In this section, we present some of the coefficients of the optimised states with \({n}_{\max }=7\) and \({n}_{\max }=1\) photons used in Fig. 2a, b for each distance in Tables 2 and 3, correspondingly. These coefficients represent the probability of sending the corresponding Fock-number state. We give the values of the optimised squeezing parameters of the states given in Eq. (1) with \({n}_{\max }=7\) photons for each distance used in Fig. 2a in Table 4. In Table 5, we present the coefficients of the optimised single-photon states shown in Fig. 6.

Table 2 The coefficients of the optimised states with \({n}_{\max }=7\) photons.
Table 3 The coefficients of the optimised states with \({n}_{\max }=1\) photon.
Table 4 The optimised squeezing parameters (γ) of the states shown in Eq. (1) with nmax = 7 photons.
Table 5 The coefficients of the single-photon states when the detector dark count rate is 5 × 10−8 and with a detector efficiency of 0.85.