Unidimensional Two-Way Continuous-Variable Quantum Key Distribution Using Coherent States

Abstract

We propose a unidimensional two-way continuous-variable quantum key distribution protocol with coherent states, where the sender modulates a single quadrature of the coherent states rather than both quadratures to simplify the structure of a two-way system. Security analysis is performed with a general attack strategy, known as two-mode attack, which helps to reduce limitations in the analysis. The performance of the protocol under all accessible two-mode attacks at fixed distance is illustrated. Further, two typical two-mode attack strategies are obtained from it, which are one-mode attack strategy and optimal two-mode attack strategy. Between them, the one-mode attack is the simplest form of the two-mode attack, while the optimal two-mode attack is the most complicated one. Simulations show that though the system is simplified, the performance of the two-way protocol with unidimensional modulation is still comparable to that of the counterpart with Gaussian modulation even against the optimal two-mode attack when Eve’s ability is maximized. Thus, the proposed protocol simplifies the two-way system while guaranteeing its performance to a certain extent. Especially in a practical system with short transmission distance and high excess noise, the protocol has a good application prospect.

1. Introduction

Quantum key distribution (QKD) [1] is an effective way to ensure communication security and resist the impact of quantum computing on an encryption system [2,3]. Based on the principles of quantum mechanics, a QKD protocol enables two trusted parties, usually called Alice and Bob, to distill secret keys with unconditional security in theory. Over the last three decades, QKD has developed rapidly and spawned two branches, discrete-variable QKD and continuous-variable QKD (CV-QKD) [4,5]. Compared with the discrete-variable QKD, CV-QKD has higher compatibility of standard telecom components [6], which reduces the cost, improves the integration and facilitates the large-scale application of QKD [7,8,9,10,11,12]. In recent years, CV-QKD has gathered momentum: the transmission distance of CV-QKD has been further extended in commercial fibers [10], low loss optical fibers in laboratory [12], and the theory of CV-QKD has also been widely improved [13,14,15,16,17,18].

To enhance the tolerable excess noise of the CV-QKD system, the two-way CV-QKD protocol was proposed [19]. In this protocol, Bob sends states to Alice through the forward channel. After which, Alice couples her own states with the received states and then sends them back to Bob through the backward channel. In this way, the information of the secret key is loaded onto the coupled quantum state, and transferred from Alice to Bob. In order to obtain the key information, an eavesdropper, Eve, must eavesdrop on both channels at the same time, which directly increases the eavesdropping difficulty. The structure is more beneficial to Alice and Bob when the channel is too noisy compared to the one-way protocol. Afterwards, an improved two-way CV-QKD protocol has also been proposed to make the two-way system easier to implement by replacing Alice’s displacement operation with a beam splitter [20], which promotes the practical application of two-way protocol, and thus, has been widely studied [21,22,23,24,25,26,27]. Although the performance of the two-way protocol is better than that of the one-way protocol, the complexity of the protocol is fairly high: It takes up two quantum channels and requires Gaussian modulation in both x and p quadratures at both Alice’s and Bob’s side. Therefore, it is necessary to build a simpler and more feasible two-way scheme.

Reducing the number of the modulators by waiving the symmetry of modulation is one of the strategies to simplify the protocol, namely, the unidimensional (UD) modulation [28]. It simplifies the system by abandoning one quadrature of the modulations, and shows a comparable performance to the conventional Gaussian modulated ones under low noise conditions [28]. Until now, the feasibility of using UD modulation has been demonstrated in the squeezed state protocol [29,30] and the measurement-device-independent protocol [31,32]. Simultaneously, the analysis of UD CV-QKD protocol in practical situations has been improved [33], and the methods to enhance the performance of UD protocol have also been proposed [34,35]. In addition, with single amplitude modulator, the UD protocol has been tested experimentally [36]. Considering that, on the one hand, the using of UD modulation is conducive to the simplification of two-way system. On the other hand, the high anti-noise performance of the two-way system contributes to the compensation of the sensitivity to noise caused by UD modulation. A simplified two-way CV-QKD with UD modulation is expected to have good performance.

In this paper, a UD two-way CV-QKD protocol is proposed. UD modulation is used at Alice’s side instead of the conventional Gaussian modulation, which enables the two-way system to work with a single quadrature modulation. In this way, the complexity of the protocol and the number of quantum random numbers required are reduced. In this protocol, Bob still uses conventional Gaussian modulation to reduce the complexity of security analysis, and to avoid dramatic degradation of the protocol performance caused by multiple use of unidimensional modulation. For security analysis of a two-way protocol, a general two-mode attack strategy is used: Eve is assumed to have the ability to exploit the correlation between the modes used to attack the forward channel and backward channel. To illustrate the system performance against the general two-mode attack, we derive the expressions of the secret key rate of the protocol against general two-mode attacks and perform simulations of the protocol against all accessible two-mode attacks at fixed distance. Furthermore, two typical two-mode attack strategies, namely, the one-mode attack strategy and the optimal two-mode attack strategy, are obtained from the general two-mode attack, which are the simplest and the most complex cases of the general two-mode attack strategy, respectively. For the one-mode attack, there is no correlation between the two attack modes, while for the optimal two-mode attack, Eve is able to find the optimal attack correlations and minimize the performance of the protocol. Under these two attack strategies, performances of the protocol within secure transmission distances are simulated and compared with that of symmetrical modulated counterparts.

2. The Schemes of Unidimensional Two-Way CV-QKD Protocol

In this part, we first introduce the difference between UD modulation and symmetrical Gaussian modulation with the prepare-and-measure (PM) scheme of the UD two-way CV-QKD protocol. Then the entanglement-based (EB) scheme is illustrated, and the reason of using this modulation strategy is explained.

In terms of the structure of the protocol, as shown in Figure 1, the UD modulation is used at Alice’s side and the symmetrical modulation is used at Bob’s side. The most different part between the UD protocol and the symmetrical Gaussian modulated protocol is the number of the modulators. The symmetrical Gaussian modulation modulates x quadrature and p quadrature simultaneously, while the UD modulation modulates only one single quadrature (amplitude quadrature x or phase quadrature p). In this way, CV-QKD can be performed with only one modulator and the complexity of the protocol is reduced. Without loss of generality, the x quadrature is used in the discussion below.

The EB scheme of the UD two-way protocol is shown in Figure 2, and can be described as follows:

Step 1. Alice prepares an EPR state with variance $V_A$. She measures one mode $A_1$ with homodyne detection and sends the other mode $A_2$ to a squeezer, which is equivalent to the unidimensional modulation in the PM scheme [35]. At the same time, Bob prepares another EPR state with variance $V_B$. He keeps one mode $B_1$ and sends the other mode $B_2$ to Alice through $Channe{l}_1$ where Eve may perform an attack.

Step 2. Alice couples the received mode $A_{in}$ with her own mode $A_3$ through a beam splitter, she then sends the coupling mode $A_{out}$ back to Bob through $Channe{l}_2$ while measuring mode $A_4$ with homodyne detection for parameter estimation.

Step 3. Bob measures the retained mode $B_1$ with heterodyne detection to get $x_{{B_1}_x}$ and $p_{{B_1}_p}$, and the received mode $B_3$ is measured with homodyne detection by him to get $x_{B_3}$.

Step 4. Bob uses $x_{B_x}=x_{B_3}-k{x}_{{B_1}_x}$ to construct the estimator to Alice’s corresponding variable $x_A$. Here k is the parameter used to optimize Bob’s estimator of Alice’s corresponding value. Then the postprocessing including reconciliation and privacy amplification is performed.

It is essential to note that although the p quadrature is not modulated, it still needs to be measured sometimes to gather the properties of the channel in the p quadrature in order to ensure the security, and the impact of these measurements on secret key rate is considered negligible [28].

The cost of the simplification by using UD modulation is that the p quadrature is not modulated, which results in the impossibility of estimating the correlation and the channel transmittance in p. Thus, after passing the quantum channel, an unknown parameter $Co{r}_p$ is introduced into the security analysis to represent the unknown correlation in p quadrature [28], which has a negative impact on the performance of the protocol. In addition to the scheme shown in Figure 1, UD modulation can also be used solely at Bob’s side (while Alice still uses symmetrical Gaussian modulation) or both at Alice’s and Bob’s sides. However, by calculation, these two schemes introduce one or two more unknown parameters into the covariance matrix compared with the scheme shown in Figure 1, mainly because the two-way scheme amplifies the loss of correlation caused by UD modulation in these cases. Considering that more unknown parameters result in more loopholes open to eavesdropper and make numerical simulation in security analysis difficult, in the following security analysis, we focus on the scheme with UD modulation solely used at Alice’s side.

3. Security Analysis of the Protocol Against Two-Mode Attack

In the security analysis of two-way protocols, one-mode attack strategy is usually used, which assumes that there are no correlations between the two modes of Eve used for attack. However, it has some limitations: It is a special attack structure which can not describe the other attack strategies, and it may not be optimal for the UD two-way protocol. Thus, it is essential to use the general two-mode attack strategies to make a comprehensive analysis. In this section, we first introduce the two-mode attack strategy used by Eve. Then, the process of calculating the secret key rate of the protocol is deduced. To obtain the worst secret key rate and analyze the protocol in the strictest case, we use a double pessimistic worst-case assumption, which is composed of two parts: The first part is used to obtain the optimal attack strategy from the two-mode attack, and the second part is used to get the worst unknown correlation parameters in p quadrature.

3.1. Two-Mode Attack Strategy

The entanglement-based (EB) scheme of two-mode attack strategy is shown in Figure 2. For a two-way system, Eve needs to attack both quantum channels, which makes it more difficult for her to carry out eavesdropping but also enables her to maximize the information eavesdropped by optimizing the correlation of $E_1$ and $E_2$ [26,37]. If we simply use a one-mode attack for analysis, the correlation of the two attacking modes cannot be reflected, therefore, a general two-mode attack is used for the following analysis to evaluate the protocol performance comprehensively and to get the optimal attack strategy.

As shown in Figure 2, Eve mixes the modes $B_2$ and $A_{out}$ with $E_1$ and $E_2$ in $Channe{l}_1$ and $Channe{l}_2$, through beam splitters with transmissivity $T_1$ and $T_2$. The other modes e, together with $E_1$ and $E_2$, form a whole, and can be globally described by a pure Gaussian state. Afterwards, $E_1^{\prime }$, $E_2^{\prime }$ and e are stored in a quantum memory and measured at the end of the protocol. The covariance matrix of $E_1$ and $E_2$ has the normal form

$${\gamma }_{E_1{E}_2}=\left(\begin{array}{cc}{V}_{E_1}·I_2& C_{E_1{E}_2}\\ C_{E_1{E}_2}& V_{E_2}·I_2\end{array}\right)$$

(1)

where $C_{E_1{E}_2}=\left(\begin{array}{cc}{C}_x& 0\\ 0& C_p\end{array}\right)$ is the correlation parameter matrix between $E_1$ and $E_2$, $I_2=\left(\begin{array}{cc}1& 0\\ 0& 1\end{array}\right).$ $V_{E_1}=1+\frac{T_1ϵ}{1-T_1}$, $V_{E_2}=1+\frac{T_2ϵ}{1-T_2}$ are the variances of the thermal noise. Here $T_1$ and $T_2$ are given by $T_1=T_2={10}^{-\alpha L/10}$, and $\alpha =0.2dB/km$ is the loss coefficient of the optical fibers. $ϵ$ is the excess noise, for simplicity, we assume that the excess noise of the two channels are the same. Thus, when $ϵ$ and L are fixed, $V_{E_1}$ and $V_{E_2}$ are also determined accordingly. At this point, Eve’s attack strength is totally determined by $C_x$ and $C_p$.

To explore the performance of the protocol in the worst case, the ability of Eve is maximized: We assume that Eve is able to determine $C_x$ and $C_p$ arbitrarily within the limits of physical existence condition [26,37,38], and she can further find the optimal attack parameters $C_{E_1{E}_2}^{worst}$ to minimize the performance of the protocol. This is the first part of our double pessimistic worst-case assumption.

The bound of $C_x$ and $C_p$ can be written as

$${\gamma }_{E_1{E}_2}>0,v_{-}\ge 1,$$

(2)

where $v_{-}$ is the least symplectic eigenvalue of ${\gamma }_{E_1{E}_2}$, written as

$$\begin{array}{cc}\hfill & v_{-}=\sqrt{0.5(\Delta -\sqrt{{\Delta }^2-4\det \left({\gamma }_{E_1{E}_2}\right)})},\hfill \end{array}$$

(3)

with

$$\begin{array}{c}\hfill \Delta =V_{E_1}^2+V_{E_2}^2+2C_x{C}_p.\end{array}$$

(4)

From ${\gamma }_{E_1{E}_2}>0$, the following restriction is derived,

$$\mid C_x\mid <\sqrt{V_{E_1}{V}_{E_2}},\mid C_p\mid <\sqrt{V_{E_1}{V}_{E_2}}.$$

(5)

3.2. The Secret Key Rate of the Protocol

In reverse reconciliation, the secret key rate K of the protocol against two-mode Gaussian attacks is given by [39]

$$K=\beta I(A:B)-\chi (B:E),$$

(6)

where $\beta$ is the reconciliation efficiency, $I(A:B)$ is the classical mutual information between Alice and Bob, and $\chi (B:E)$ is the upper bound of the von Neumann entropy between Eve and Bob, called the Holevo bound [40]. $I(A:B)$ and $\chi (B:E)$ can be derived from the covariance matrix ${\gamma }_{A_1{A}_4{B}_1{B}_3}$ and ${\gamma }_{A_1{A}_4{B}_6{B}_{1p}}^{B_x}$, which describes the system after the modes go through the channels, and the system after the measurements, respectively. Here, $I_{AB}$ is given by

$$I(A:B)=0.5lo{g}_2(V_{A_1}/V_{A1}^{x_{B_x}}),$$

(7)

where $V_{A_1}={\gamma }_{A_1{A}_4{B}_6{B}_{1p}}^{B_x}(2,2)$ and $V_{A1}^{x_{B_x}}={\gamma }_{A_1{A}_4{B}_6{B}_{1p}}^{B_x}(1,1)$. Assuming that Eve can purify Alice and Bob’s system, $\chi (B:E)$ is given by

$$\begin{array}{c}\hfill \chi (B:E)=S\left({\rho }_{A_1{A}_4{B}_1{B}_3}\right)-S\left({\rho }_{A_1{A}_4{B}_6{B}_{1p}}^{x_{B_x}}\right)=\sum _{i=1}^{4}G\left(\frac{{\lambda }_i-1}{2}\right)-\sum _{j=5}^{8}G\left(\frac{{\lambda }_j-1}{2}\right),\end{array}$$

(8)

where ${\lambda }_{1\sim 4}$ and ${\lambda }_{5\sim 8}$ are the symplectic eigenvalues of the covariance matrix ${\gamma }_{A_1{A}_4{B}_1{B}_3}$, and ${\gamma }_{A_1{A}_4{B}_6{B}_{1p}}^{x_{B_x}}$.

The derivation of the above two matrices is as follows. First, the covariance matrix which describes the states $A_1$, $A_2$, $B_1$ and $B_2$ is given by

$$\begin{array}{c}\hfill {\gamma }_{A_1{A}_2{B}_1{B}_2}=\left(\begin{array}{cccc}{V}_A·I_2& \sqrt{V_A^2-1}·{\sigma }_z& 0·I_2& 0·I_2\\ \sqrt{V_A^2-1}·{\sigma }_z& V_A·I_2& 0·I_2& 0·I_2\\ 0·I_2& 0·I_2& V_B·I_2& \sqrt{V_B^2-1}·{\sigma }_z\\ 0·I_2& 0·I_2& \sqrt{V_B^2-1}·{\sigma }_z& V_B·I_2\end{array}\right),\end{array}$$

(9)

where ${\sigma }_z=\left(\begin{array}{cc}1& 0\\ 0& -1\end{array}\right),$ $V_A$ and $V_B$ are the variances of Alice’s EPR state and Bob’s EPR state. Then, after $A_2$ goes through the squeezer, which is equivalent to the UD modulation in PM scheme, the covariance matrix which describes the state $A_1$, $A_3$ is given by

$$\begin{array}{c}\hfill {\gamma }_{A_1{A}_3}=\left(\begin{array}{cccc}{V}_A& 0& \sqrt{V_A(V_A^2-1)}& 0\\ 0& V_A& 0& -\sqrt{\frac{(V_A^2-1)}{V_A}}\\ \sqrt{V_A(V_A^2-1)}& 0& V_A^2& 0\\ 0& -\sqrt{\frac{(V_A^2-1)}{V_A}}& 0& 1\end{array}\right).\end{array}$$

(10)

After transmission through quantum channels, following the channel transmission relationships as below

$$\begin{array}{c}\hfill \left\{\begin{array}{cc}{A}_{in}=\sqrt{T_1}{B}_2+\sqrt{1-T_1}{E}_1,\hfill & \\ A_4=\sqrt{T_A}{A}_3-\sqrt{1-T_A}{A}_{in},\hfill & \\ A_{out}=\sqrt{T_A}{A}_{in}+\sqrt{1-T_A}{A}_3,\hfill & \\ B_3=\sqrt{T_2}{A}_{out}+\sqrt{1-T_2}{E}_2.\hfill \end{array}\right.\end{array}$$

(11)

The covariance matrix which describes the states $A_1$, $A_4$, $B_1$ and $B_3$ is given by

$${\gamma }_{A_1{A}_4{B}_1{B}_3}=\left(\begin{array}{cccc}{V}_A·I_2& C_{A_1{A}_4}& 0·I_2& C_{A_1{B}_3}\\ C_{A_1{A}_4}& {\gamma }_{A_4}& C_{A_4{B}_1}& C_{A_4{B}_3}\\ 0·I_2& C_{A_4{B}_1}& V_B·I_2& C_{B_1{B}_3}\\ C_{A_1{B}_3}& C_{A_4{B}_3}& C_{B_1{B}_3}& {\gamma }_{B_3}\end{array}\right),$$

(12)

where

$$\begin{array}{c}\hfill {\gamma }_{A_4}=\left(\begin{array}{cc}{T}_A{V_A}^2+[V_E\left(T_1-1\right)-T_1{V}_B]\left(T_A-1\right)& 0\\ 0& T_A+[V_E\left(T_1-1\right)-T_1{V}_B]\left(T_A-1\right)\end{array}\right),\end{array}$$

(13)

and

$$\begin{array}{c}\hfill {\gamma }_{B_3}=\left(\begin{array}{cc}{V}_{{B_3}_x}& 0\\ 0& V_{{B_3}_p}\end{array}\right).\end{array}$$

(14)

Here, $V_{{B_3}_x}$ and $V_{{B_3}_p}$ and the variances of the x quadrature and p quadrature of $B_3$, and have the following form:

$$\begin{array}{cc}\hfill V_{{B_3}_x}=& 2C_x\sqrt{T_2{T}_A\left(T_1-1\right)\left(T_2-1\right)}-V_E\left(T_2-1\right)\hfill \\ & -T_2{V_A}^2\left(T_A-1\right)-T_2{T}_A{V}_E\left(T_1-1\right)+T_1{T}_2{T}_A{V}_B,\hfill \end{array}$$

(15)

and

$$\begin{array}{cc}\hfill V_{{B_3}_p}=& 2C_p\sqrt{T_2{T}_A\left(T_1-1\right)\left(T_2-1\right)}-V_E\left(T_2-1\right)\hfill \\ \hfill & -T_2\left(T_A-1\right)-T_2{T}_A{V}_E\left(T_1-1\right)+T_1{T}_2{T}_A{V}_B.\hfill \end{array}$$

(16)

The correlation between modes $A_1$ and $A_4$ is represented by

$$\begin{array}{c}\hfill C_{A_1{A}_4}=\sqrt{T_A({V_A}^2-1)}\left(\begin{array}{cc}\sqrt{V_A}& 0\\ 0& -\sqrt{1/V_A}\end{array}\right),\end{array}$$

(17)

and the correlation between modes $A_1$ and $B_3$ is represented by

$$\begin{array}{c}\hfill C_{A_1{B}_3}=\left(\begin{array}{cc}\sqrt{V_A({V_A}^2-1)T_2\left(1-T_A\right)}& 0\\ 0& Co{r}_p\end{array}\right).\end{array}$$

(18)

Here, as discussed in Section 2, $Co{r}_p$ is used to represent the unknown correlation in p quadrature and assumed to be bounded by the physical existence condition, which is given by the Heisenberg uncertainty principle. In the strictest case, to get the worst protocol performance degradation caused by the loss of correlation parameters, the worst correlation parameter $Co{r}_p^{worst}$ which minimize the secret key rate is used for security analysis [28,29,30,31,32,33,34,35,36]. In this way, we get the worst key rate under UD modulation, and this is the second part of our double pessimistic worst-case assumption in terms of unknown correlation parameters.

The correlations between modes $A_4$ and $B_1$, and between $A_4$ and $B_3$, are represented by $C_{A_4{B}_1}$ and $C_{A_4{B}_3}$, written as below:

$$\begin{array}{c}\hfill C_{A_4{B}_1}=\sqrt{({V_B}^2-1)\left(1-T_A\right)T_1}\left(\begin{array}{cc}-1& 0\\ 0& 1\end{array}\right),\end{array}$$

(19)

$$\begin{array}{c}\hfill C_{A_4{B}_3}=\left(\begin{array}{cc}{C}_{A_4{B_3}_x}& 0\\ 0& C_{A_4{B_3}_p}\end{array}\right),\end{array}$$

(20)

with

$$\begin{array}{c}\hfill C_{A_4{B_3}_x}=\sqrt{T_2{T}_A\left(1-T_A\right)}\left[{V_A}^2-V_B{T}_1-V_E\left(1-T_1\right)\right.\left.-C_x\sqrt{(1-T_2)\left(1-T_1\right)/\left(T_2{T}_A\right)}\right],\end{array}$$

(21)

and

$$\begin{array}{c}\hfill C_{A_4{B_3}_p}=\sqrt{T_2{T}_A(1-T_A)}\left[1-V_B{T}_1-V_E\left(1-T_1\right)\right.\left.-C_p\sqrt{(1-T_2)\left(1-T_1\right)/\left(T_2{T}_A\right)}\right].\end{array}$$

(22)

$C_{B_1{B}_3}$ represents the correlation between modes $B_1$ and $B_3$, and can be written as

$$\begin{array}{c}\hfill C_{B_1{B}_3}=\sqrt{({V_B}^2-1)T_1{T}_2{T}_A}\left(\begin{array}{cc}1& 0\\ 0& -1\end{array}\right).\end{array}$$

(23)

In the formulas above, $T_A$ is the transmission efficiency of the beam splitter at Alice’s side. With heterodyne detection of $B_1$ at Bob’s side, we can get ${\gamma }_{A_1{A}_4{B}_3{B}_{1x}{B}_{1p}}$, which is given by

$$\begin{array}{c}\hfill {\gamma }_{A_1{A}_4{B}_3{B}_{1x}{B}_{1p}}={\gamma }_{BS}·({\gamma }_{A_1{A}_4{B}_3{B}_1}\oplus I_2)·{\gamma }_{BS}^T,\end{array}$$

(24)

where ${\gamma }_{BS}=(I_6\oplus {\gamma }_{BS}^0)$, $I_6$ is an identity matrix of $6\times 6$, and ${\gamma }_{BS}^0=\sqrt{\eta }\left(\begin{array}{cc}{I}_2& I_2\\ -I_2& I_2\end{array}\right).$ For heterodyne detection, $\eta =0.5$. In the same way as the original two-way system for covariance matrix derivation [20], the construction of the estimator mentioned in Section 2 can be simplified with a Control-Not gate, thus ${\gamma }_{A_1{A}_4{B}_{1p}{B}_6{B}_x}$ is given by

$${\gamma }_{A_1{A}_4{B}_{1p}{B}_6{B}_x}={\Gamma }^T·{\gamma }_{A_1{A}_4{B}_{1p}{B}_{1x}{B}_3}·\Gamma ,$$

(25)

where

$$\Gamma =I_6\oplus {\Gamma }_x,$$

(26)

and

$${\Gamma }_x=\left(\begin{array}{cccc}1& 0& -k& 0\\ 0& 1& 0& 0\\ 0& 0& 1& 0\\ 0& k& 0& 1\end{array}\right)$$

(27)

represents a Control-Not gate, $k=\sqrt{2T_A{T}_1{T}_2\frac{V_B-1}{V_B+1}}$ is used to optimize the performance of system.

Finally we get ${\gamma }_{A_1{A}_4{B}_6{B}_{1p}}^{x_{B_x}}$, which is given by

$${\gamma }_{A_1{A}_4{B}_6{B}_{1p}}^{x_{B_x}}={\gamma }_{A_1{A}_4{B}_6{B}_{1p}}-{\sigma }_{A_1{A}_4{B}_6{B}_{1p}{B}_x}^T·H_{hom}·{\sigma }_{A_1{A}_4{B}_6{B}_{1p}{B}_x},$$

(28)

where $H_{hom}={(X·{\gamma }_{B_x}·X)}^{MP}$, $X=\left(\begin{array}{cc}1& 0\\ 0& 0\end{array}\right)$ and MP means the Moore–Penrose pseudo-inverse of a matrix. The matrices ${\gamma }_{A_1{A}_4{B}_6{B}_{1p}}$, ${\sigma }_{A_1{A}_4{B}_6{B}_{1p}{B}_x}$, ${\gamma }_{B_x}$ are derived from ${\gamma }_{A_1{A}_4{B}_6{B}_{1p}{B}_x}$ in the following way:

$$\begin{array}{c}\hfill {\gamma }_{A_1{A}_4{B}_6{B}_{1p}{B}_x}=\left(\begin{array}{cc}{\gamma }_{A_1{A}_4{B}_6{B}_{1p}}& {\sigma }_{A_1{A}_4{B}_6{B}_{1p}{B}_x}^T\\ {\sigma }_{A_1{A}_4{B}_6{B}_{1p}{B}_x}& {\gamma }_{B_x}\end{array}\right).\end{array}$$

(29)

So far, we get the two matrices needed to calculate the secret key rate, and here the secret key rate can be written as a function form as below:

$$K=K(\beta ,ϵ,V_A,V_B,Co{r}_p,C_x,C_p,T_A,L).$$

(30)

From Equation (30), the parameters that determines the secret key rate are shown. Compared with the analysis of the symmetrical modulated two-way protocols [20], three more parameters are introduced, which are $Co{r}_p$, $C_x$ and $C_p$, respectively. Here, different values of $Co{r}_p$ represent different correlations of $A_1$ and $B_3$ in p quadrature, and $C_x$ and $C_p$ represent different two-mode attack strategies. Furthermore, the worst-case secret key rate $K^{worst}$ can be obtained by using $Co{r}_p^{worst}$ and $C_{E_1{E}_2}^{worst}$ instead of $Co{r}_p$ and $(C_x,C_p)$, where $Co{r}_p^{worst}$ and $C_{E_1{E}_2}^{worst}$ can be obtained by simulations. At this point, the theoretical derivation of security analysis is finished.

4. Simulation and Discussion

In this section, we first show the performance of the UD two-way protocol against all accessible two-mode attacks at fixed distance, which is the basis of the analysis. Then, from the general two-mode attacks, two typical two-mode attack strategies are obtained, which are one-mode attack strategy and the optimal two-mode attack strategy. The simulations of the protocol against these two attack strategies are performed, which is conducive to the accurate analysis of the protocol performance. For all the simulations, $Co{r}_p^{worst}$ is used, which can be obtained from the comparison of $K\left(Co{r}_p\right)$, when all the parameters except for $Co{r}_p$ are fixed and $Co{r}_p$ traverses within the physical existence constraint. This is a reflection of the pessimistic worst-case assumption of the unknown correlation parameters in the simulations. Ideal cases and practical cases are mainly simulated, with reconciliation efficiency of 1 and $0.956$ [41,42], and variance of 1000 and 5, respectively.

As shown in Figure 3, on a $C_x$, $C_p$ plane, each point represents a two-mode attack strategy of Eve, the region that resembles an olive pit represents the physical existing two-mode attack, which means that Eve can choose these pairs of $C_x$ and $C_p$ for two-mode attack at the fixed parameters of the protocol. When L and $ϵ$ are fixed, as shown in Figure 3a,b, the boundaries of the regions are same, but the distribution of the secret key rate varies with modulation variance and reconciliation efficiency. As the distance increases, as shown in Figure 3a,c, the region will gradually shrink, which means the two-mode attack is limited. What is more, the point $(0,0)$ on the $C_x$, $C_p$ plane represents the one-mode attack, which is the simplest case of two-mode attacks.

Despite the different secret key rate distributions, these two-mode attack simulations still have one thing in common, that is, all of them have a minimum secret key rate center, shown in dark blue in the figure. This confirms that Eve can achieve a set of optimal two-mode attack parameters $C_{E_1{E}_2}^{worst}$ to get the most information, which minimizes the performance of the protocol and can be obtained from the comparison of $K(C_x,C_p)$, when all the parameters except for $(C_x,C_p)$ are fixed and $(C_x,C_p)$ traverses within the physical existence constraint. Thus, it requires us to perform two-mode attack at each distance and obtain the optimal attack parameters in security analysis to avoid overestimating the performance of the protocol. In this way, the performance of the protocol under the optimal two-mode attack is obtained and the worst performance of the UD two-way CV-QKD protocol is reflected, which is a representation of the pessimistic worst-case assumption of two-mode attack in the simulations.

Against one-mode attack, the secret key rate and tolerable excess noise of UD two-way CV-QKD protocol is simulated and compared with the conventional symmetrical Gaussian modulated two-way CV-QKD protocol ($Het-Ho{m}_M$) [20] in ideal case and practical case, as shown in Figure 4 and Figure 5. Here, $Het-Ho{m}_M$ represents a two-way protocol with coherent state and homodyne detection at Bob’s side. Compared with the conventional two-way protocol, the performance of the UD two-way protocol is reduced to some extent because of the missing of information in p quadrature, which is similar to the performance degradation caused by UD modulation in one-way scheme [28]. In terms of the secret key rate, in the ideal case shown in Figure 4a, the key rate attenuation of the UD two-way protocol is acceptable when the excess noise is low. When $\beta =1$ and $ϵ=0.04$, in the range of 50 km to 150 km, the key rate of UD two-way protocol is approximately 1 to 1.5 orders of magnitude lower than the original protocol. In the practical case shown in Figure 4b, the performance gap is smaller, in the range of 0 km to 10 km, the secret key rate of UD two-way protocol is even higher than that of the original two-way protocol. Here, the outperformance of the UD two-way protocol in the practical case at short distances is mainly due to the fact that the modulation variance V is not optimal for the two protocols under the practical simulation parameters. The optimal modulation variance of the UD two-way protocol is about 10, while it is more than 20 for the original ones. This property limits the performance of the original two-way protocol when the modulation variance is low, and thus, causes the outperformance of the UD two-way protocol. In the aspect of the tolerable excess noise, as shown in Figure 5, the performance of the UD two-way protocol is similar to that of the original two-way protocol in practical, and is acceptable in the ideal conditions especially when the transmission distance is long. At 80 km, in the ideal case, the tolerable excess noise of UD two-way protocol is less than 0.1 lower compared with the original two-way protocol, and the performance gap is further reduced with the increase of distance.

By using the optimal two-mode attack parameters $C_{E_1{E}_2}^{worst}$ and the worst correlation parameters $Co{r}_p^{worst}$, we get the secret key rate simulation of the UD two-way CV-QKD protocol against the optimal two-mode attack, which is shown in Figure 6. Against the optimal two-mode attack, the performance of the UD two-way CV-QKD protocol is further reduced, however, compared with the performance of the protocol against one-mode attack, the performance loss is not serious when the excess noise is low. Especially under the practical case where $ϵ=0.04$, the loss of transmission distance is less than 5 km. This means, though Eve is able to utilize the two-mode correlation between $E_1$ and $E_2$ to optimize the attack strategy, the enhancement of the attack strength is limited. These show that the UD two-way protocol has good resistance to two-mode attacks under low noise condition, and its lower performance limit is acceptable. Thus, the lower bound of the UD two-way CV-QKD protocol is obtained.

5. Conclusions

In this paper, a two-way CV-QKD protocol with UD modulation is proposed, and we focus on the case where UD modulation and symmetrical modulation are used at the sender’s (Alice’s) side and receiver’s (Bob’s) side, respectively. The expressions of the secret key rate of the protocol against general two-mode attacks are derived, and the simulations of the protocol against all accessible two-mode attacks are performed. Here, we use a double pessimistic worst-case assumption to analyze the protocol in the strictest case. Through this assumption, the missing correlation parameters and the two-mode attack strength are limited to the worst case, which minimize the protocol performance. Furthermore, one-mode attack strategy and optimal two-mode attack strategy are obtained from the general two-mode attacks, and the lower bound of the protocol performance is shown.

Through simulations, although the performance of UD two-way protocol is partially reduced, which is the price of the protocol simplification, it is still acceptable compared to that of the symmetrical Gaussian modulated counterpart. In practical cases, the performance of the UD two-way CV-QKD protocol is similar to the symmetrical Gaussian modulated counterpart, and at a short transmission distance, the UD two-way protocol even performs better. Therefore, it is reasonable to use unidimensional modulation in a two-way scheme to simplify the system, which expands the application scenario of the two-way CV-QKD system. The future research on the protocol will focus on the other UD modulation strategy of the two-way scheme, such as using UD modulation singly at Bob’s side or at both Alice’s and Bob’s side. Multiple pessimistic worst-case assumptions can be used for security analysis of those cases, and the study of the analytic solution of the security bound is also helpful to simplify the security analysis of unidimensional two-way CV-QKD protocols.