Phase-Matching Continuous-Variable Measurement-Device-Independent Quantum Key Distribution

Abstract

Continuous-variable measurement-device-independent quantum key distribution (CV-MDI-QKD) allows remote parties to share information-theoretical secure keys while defending all the side-channel attacks on measurement devices. However, the secure transmission distance and the secret key rate are quite limited due to the high untrusted equivalent excess noise in the Gaussian modulation. More particularly, extremely high-efficiency homodyne detections are required for even non-zero secure transmission distances, which directly restrict its practical realization. Here, we propose a CV-MDI-QKD protocol by encoding the key information into matched discrete phases of two groups of coherent states, which decreases the required detection efficiency for ideally asymmetric cases, and makes it possible to practically achieve secure key distribution with current low-efficiency homodyne detections. Besides, a proof-of-principle experiment with a locally generated oscillator is implemented, which, for the first time, demonstrates the realizability of CV-MDI-QKD using all fiber-based devices. The discrete-modulated phase-matching method provides an alternative direction of an applicable quantum key distribution with practical security.

1. Introduction

Continuous-variable quantum key distribution (CV-QKD) [1,2,3,4,5] allows two remote authenticated users to establish a secure key through untrusted quantum channels, and authenticated classical channels, by using coherent detection. In particular, the secret keys are always encoded by Alice on the quadrature values [2,6,7] and the quadrature choices [8] of the quantized electronmagnetic field of coherent states, while they are distilled by homodyne or heterodyne detection in Bob’s side and the cooperative postprocessing procedure. The CV-QKD protocols have inherent features of high transmission capacity, simple hardware implementation, and effective compatibility with already deployed classical optical communication systems. In addition, the ideal implementation of CV-QKD can nearly approximate the ultimate limit of the secret key capacity of repeaterless quantum communication, i.e., the PLOB bound [9]. Since the ideal assumptions in the theoretical security proof of the CV-QKD protocol may be compromised in realistic implementations [10,11,12,13,14], eavesdroppers can exploit the security vulnerabilities arising from the imperfect implementations to capture the key information [15,16,17,18,19,20,21,22].

In order to thoroughly eliminate the practical security vulnerabilities at the measurement side, the Gaussian-modulated coherent-state (GMCS) continuous-variable measurement-device-independent quantum key distribution (CV-MDI-QKD) protocols are proposed [23,24,25,26]. In these CV-MDI-QKD schemes, two legitimate parties, Alice and Bob, are both senders, and an untrusted third party, Charlie, is employed to perform Bell-State Measurement (BSM) and broadcast the outcomes to help to create the secret correlations between Alice and Bob. Despite the possibility that Charlie’s station can be fully tampered with, the legitimate parties can still extract the secure keys under optimal coherent attacks via insecure quantum channels. Therefore, CV-MDI-QKD protocols can eliminate all side-channel attacks against detections. In recent years, some breakthroughs have been made in the theoretical security study of CV-MDI-QKD [27,28,29,30].

Unfortunately, the theoretical performance, including the secret key rate and secure transmission distance of the GMCS CV-MDI-QKD, are quite limited because of the induced high equivalent excess noise [23,25]. In particular, almost perfect detections are required even for a non-zero secure transmission distance, which restricts its practical implementations [14,23]. In order to improve the performance and develop the practical realization, many efforts are currently being dedicated, such as developing the parameter estimation [31], employing photon subtraction [32], employing non-Gaussian postselection [33], and employing discrete modulation [34]. Recently, the concept of optimized communication strategies to enhance the information transfer over a non-Gaussian noisy channel is also proposed [35]. However, the practical realization remains a challenge issue, especially since extremely high-efficiency homodyne detection is still required even against individual attacks. So far, the only experimentally confirmed CV-MDI-QKD is the one based on the free-space transmission and the advanced detection techniques with an efficiency about 98% [23,36]. Practically, the overall efficiency of fiber-based homodyne detection is around 60% at telecom wavelengths [37,38,39,40,41]. Therefore, the full implementation of CV-MDI-QKD with practical lengths of optical fibers has not been reported on in the literature yet [14]. However, there are efforts to extend the robustness of CV-MDI-QKD by resorting to postselection, such as in [42].

In this paper, we propose a realizable CV-MDI-QKD protocol by encoding the key information into some discrete specific phases. When Alice and Bob’s discrete encoding phases match each other, the correlation between them can be established after Charlie publicly announces the outcomes of the two homodyne detectors. When comparing the conventional GMCS CV-MDI-QKD schemes, the proposed discrete-modulated phase-matching (DMPM) CV-MDI-QKD protocol can theoretically achieve secure key distribution with current low-efficiency detections for the ideally asymmetric case, against a typical and powerful non-Gaussian individual attack, which could reach the quantum limit of the discrimination of the discrete encoded quantum states. Moreover, we demonstrate the realizability of the proposed scheme by performing a proof-of-principle experiment with a local oscillator (LO) and realistic homodyne detection over standard single-mode fiber (SMF) spools. The proposed protocol can be applied in an access network for cryptography communications.

For simplicity, we start by introducing the DMPM protocol. We then analyze the security of the proposed scheme under the SD attacks and show the corresponding numerical simulation performances. Finally, the experimental realizability of the proposed phase-matching scheme under realistic conditions is demonstrated.

2. DMPM CV-MDI-QKD Protocol

The proposed DMPM CV-MDI-QKD protocol, which is illustrated in Figure 1, can be described as follows.

Step 1. Alice and Bob prepare four coherent states: $|\alpha e^{k\pi i/2}\rangle$ with $k\in \{0,1,2,3\}$, respectively. The states $|\alpha \rangle$ and $|\alpha e^{\pi i}\rangle$ with encoded binary values 0 and 1, respectively, are called X-basis states, while $|\alpha e^{\pi i/2}\rangle$ and $|\alpha e^{3\pi i/2}\rangle$ with encoded binary values of 0 and 1, respectively, are called P-basis states.

Step 2. According to the binary random values, Alice and Bob choose the corresponding encoded coherent states randomly from X- or P- basis states, respectively. Then they simultaneously send them to Charlie through two different channels after adjusting for the intensities by VOAs.

Step 3. The received two modes ($A_1$ and $B_1$) interfere at a 50:50 BS with two output modes $A_1^{\prime }$ and $B_1^{\prime }$ on Charlie’s side. Then, both the X quadrature of $A_1^{\prime }$ and the P quadrature of $B_1^{\prime }$ are measured by homodyne detections, and the measurement results $\{X_{A_2},P_{B_2}\}$ are broadcasted by Charlie.

Step 4. Alice and Bob publicly announce their bases. And according to Charlie’s measurement results, they collect the corresponding binary RNG values with the same bases as strings $K_A$ and $K_B$, respectively, for the X-basis case $\{X_{A_2}\in \mathbb{R}:-{\delta }_A\le X_{A_2}\le {\delta }_A\}$ and for the P-basis case $\{P_{B_2}\in \mathbb{R}:-{\delta }_B\le P_{B_2}\le {\delta }_B\}$. Besides, they preserve the quadratures of the prepared inconsistent-basis states $\{X_a^p,P_a^p\}$ and $\{X_b^p,P_b^p\}$ as strings $K_A^p$ and $K_B^p$, respectively.

Step 5. Alice keeps her binary string $K_A$ unchanged, and Bob generates a modified binary string $K_A^{\prime }$ by flipping the bits in $K_B$ when the corresponding encoding states are P-basis states. After these operations, Alice and Bob share a set of correlated binary raw keys $\{K_A,K_A^{\prime }\}$.

Step 6. Alice and Bob perform a parameter estimation based on strings $K_A^p$, $K_B^p$ and the corresponding broadcasted results $\{X_{A_2}^p,P_{B_2}^p\}$, and then further distill a string of secret keys from $\{K_A,K_A^{\prime }\}$ with information reconciliation and privacy amplification processes through an authenticated public channel.

In the proposed protocol, Alice and Bob prepare, independently, the coherent states, and the measurements are performed by a totally untrusted third party, Charlie. Here, Alice and Bob can optimize their amplitudes $\alpha$ and the phase-matching thresholds ${\delta }_A$, ${\delta }_B$ to maximize the evaluated secret key rate. The phase-matching conditions in step 4 and the decoding rules in step 5 give four effective secret key generation cases, as shown in

Table 1. Key generation cases for Alice and Bob in DMPM CV-MDI-QKD protocol.

Encoded States	Encoded Bits	Decoded Bits
($|\alpha \rangle$, $|\alpha \rangle$)	$(0,0)$	$(0,0)$
($|\alpha e^{\pi i}\rangle$, $|\alpha e^{\pi i}\rangle$)	$(1,1)$	$(1,1)$
($|\alpha e^{\pi i/2}\rangle$, $|\alpha e^{3\pi i/2}\rangle$)	$(0,1)$	$(0,0)$
($|\alpha e^{3\pi i/2}\rangle$, $|\alpha e^{\pi i/2}\rangle$)	$(1,0)$	$(1,1)$

.

3. Eavesdropping and Simulations

Here, we exemplify the security of the proposed protocol under a typical and powerful non-Gaussian individual attack, i.e., the beam-splitting (BS) and partial intercept-resend (IR) attacks, combined with the SD attacks [43], which are constructed by a SD receiver [44,45,46,47] and a heralded noiseless linear amplifier (NLA) [48,49,50,51]. Specifically, Eve can apply SD receivers to directly capture the discrete-encoded secret key with low average error probability, which has two lower bounds, i.e., the standard quantum limit (SQL) $P_{\mathrm{SQL}}$ and the quantum limit (QL) $P_{\mathrm{QL}}$ [44,45,46,47], respectively. Here, SQL defines the minimum average error probability with which the nonorthogonal states can be distinguished by directly measuring the encoded physical observable coherent states, such as the intensity and phase, with conventional receivers. The QL is a lower bound which is fundamentally allowed in quantum mechanics, and it is shown in [43] that for the discrete-modulated types of CVQKD schemes, the SD attacks are powerful and can be almost close to optimal levels when combined with the NLA in some specific conditions.In practical scenarios, the phase-matching thresholds ${\delta }_A, {\delta }_B$ should be set according to the parameter estimation of the two quantum channels. Here, we will consider two typical cases, i.e, the symmetric case that the transmission efficiencies and excess noises of the two quantum channels are both T and ${\epsilon }_c$, and the ideally asymmetric case has a transmission efficiency $T_B=1$ and excess noises ${\epsilon }_B=0, {\epsilon }_A={\epsilon }_c$, respectively. For the symmetric or asymmetric cases, Alice and Bob can adjust their VOAs to balance the total transmission efficiencies to optimize the performance.

For the BS-combined SD attacks, Eve first performs a standard BS attack on the transmitted signals, then she takes SD attacks on the split photons to directly capture the secret key information after the announcement of bases and Charlie’s measurement outcomes. Thus, she can decrease the discrimination error probability by just discriminating the nonorthogonal coherent states in a binary phase-shift keying (BPSK) format, other than QPSK. For the symmetric case, Eve will directly discriminate Bob’s states for eavesdropping when using reverse reconciliation. While for the ideally asymmetric case, Eve needs to judge Bob’s encoded keys according to Charlie’s measurement outcomes and the results of the SD attacks on Alice’s states. It should be mentioned that Eve will amplify the split coherent states with a heralded NLA to further lower the discriminating error probability, but with a probability of success. In this way, when the legitimate parities set the suitable intensity of coherent states and phase-matching thresholds, Eve can not obtain the secret key for both symmetric and ideally asymmetric cases. See the Appendix A and Appendix B for further details about the calculation of the secret key rate under BS-combined SD attacks.

For the IR attacks, Eve intercepts the transmitted quantum states from both Alice and Bob’s stations (for symmetric or, ideally, asymmetric cases). In particular, Eve will control the untrusted party, Charlie, and intercept the transmitted states from Alice and Bob to perform perfect heterodyne detections. However, she will not resend the reproduced quantum state here, but will directly resend the forged broadcasted measurement results. Moreover, she can capture the secret key by using the measurement results of the intercepted quantum state through the channel between Bob and Charlie. In this way, Eve can obtain the secret key for both symmetric and, ideally, asymmetric cases. See the Appendix C for further details about the calculation of the secret key rate under the complete IR attacks.However, the error discrimination will induce extra excess noise, which could be found by the legitimate parties in the parameter estimation. So, she will use the channel excess noise to cover her eavesdropping to try her best to capture the secret key.

Here, we evaluate the secret key rate under Eve’s specific attack strategy for the symmetric and, ideally, asymmetric cases. In particular, if the total channel excess noise ${\epsilon }_c^t$ is equal to, or larger than, the total extra excess noise ${\epsilon }_c^e$ induced by the complete IR attacks, Alice and Bob cannot share the secure secret key, since Eve can replace the quantum channels with noiseless ones to cover the induced extra excess noise and capture all the secret keys by performing complete IR attacks. When ${\epsilon }_c^t<{\epsilon }_c^e$, Eve will perform partial IR attacks with the probability $\mu =\frac{{\epsilon }_c^t}{{\epsilon }_c^e}$ and will perform BS-combined SD attacks for other cases. Here, both the quantum channels are replaced with noiseless ones to cover Eve’s induced extra excess noise. In this state, the secret key rate can be calculated as

$$R^{s\left(a\right)}=\beta I_{AB}^{s\left(a\right)}-I_{BE}^{s\left(a\right)},$$

(1)

where $I_{AB}^{s\left(a\right)}$ is the classical mutual information between Alice and Bob, $I_{BE}^{s\left(a\right)}$ is the leaked information to Eve, and $\beta$ is the reconciliation efficiency. Here, all the superscripts s and a denote the symmetric and asymmetric cases, respectively. See the Appendix D for further details about the evaluation of the secret key rate of the proposed protocol under the non-Gaussian individual attack.

As shown in Figure 2, the proposed CV-MDI-QKD protocol can achieve secure key distribution with a realistic low-efficiency homodyne detector for the ideally asymmetric case. The scheme is also sensitive to channel excess noise for both symmetric and, ideally, asymmetric cases. Moreover, there exists an optimal amplitude $\alpha$ and a threshold of ${\delta }_A\left({\delta }_B\right)=\kappa \alpha$ for the given transmission distance and channel excess noise. Therefore, one can optimize the amplitude and thresholds to maximize the secret key rate and the secure transmission distance. It should be mentioned that the secure transmission distances for both the symmetric and, ideally, asymmetric cases are limited to the access network, since the direct IR attack utilizes the untrusted property of the measurement party, Charlie. Moreover, it restricts the required detection efficiency (RDE) (at least larger than 0.5, in theory) to guarantee a positive secret key rate for both the symmetric and, ideally, asymmetric cases. However, due to the restriction of the direct access to the encoded states from Bob’s station in the BS-combined SD attacks, the demand of extremely high-efficiency homodyne detection is removed for the ideally asymmetric case.

The RDE for the different transmission distances in an ideally asymmetric case are depicted in Figure 3. The results show that the proposed protocol exhibits the capability of low RDE, which can be well implemented in realistic conditions. Compared to the conventional GMCS CV-MDI-QKD protocol [25] under the general individual attacks [52] with similar parameters (the modulation variance is set under the practical condition $V_A=V_B=39$ [25]) for the ideally asymmetric case, the RDEs of the proposed scheme are lower for most of the reachable secure transmission distances when the SD receivers reach SQL and QL. Specifically, the RDEs are 0.5344 and 0.5342 for the non-zero secure transmission distance when the SD receivers reach SQL and QL without the consideration of finite-size effects, respectively. While the RDEs are 0.6722, 0.7837, and 0.8870 for conventional GMCS CV-MDI-QKD protocols under the same type of non-Gaussian individual, as well as the general individual and collective attacks, respectively. However, for the symmetric case, the RDEs of the proposed DMPM CV-MDI-QKD are similar to the ones of conventional GMCS CV-MDI-QKD protocols, which are all approximately 0.7 for the same parameters.

4. Proof-of-Principle Experiment

For the realistic implementation of the proposed DMPM CV-MDI-QKD scheme, the key issues are the interference and random phase drifts between the two remote independent lasers. By using frequency-locking and phase-reference techniques, the latest experiments [53,54] show the feasibilities of this kind of interference and phase compensation, with even weaker optical signals and a much longer transmission distance. Recently, an alternative method was proposed and demonstrated experimentally by using carrier synchronization to compensate the frequency offsets and phase drifts for the similar interference of continuous-variable quantum states with the local-LO implementation [55]. These methods pave the way for the realistic implementation of the proposed scheme.

Inspired by the method proposed in [55], a proof-of-principle experiment for the ideally asymmetric case of the DMPM CV-MDI-QKD protocol is designed here with the local-LO. It should be mentioned that the local-LO realization shows the superiority of the compatibility of the continuous-variable technique with classical optical communication, which is a promising direction for high-speed, high-integration, and low-cost applications. The schematic diagram is shown in Figure 4. $L_1$ is a narrow linewidth frequency-stabilized laser with a center wavelength of 1542.38 nm and a linewidth around 150 kHz, which is employed to generate both Alice and Bob’s signal states. The generated continuous-wave light (Wavelength Reference, Clarity-NLL-1542-HP) is split into two beams used as the carriers from Alice and Bob. The emission power of $L_1$ is controlled at −40 dbm, which meets the requirements of modulation variance in the theoretical protocol. Two VOAs are applied to control the intensities of the optical signals, where the signal includes M consecutive pilot signals and cascaded N consecutive data signals. The pilot signals are used for the cursory estimation of the frequency offset between the signals and the local-LO, and some of the data signals are used for further estimations of frequency offset and phase drifts caused by the fluctuations in the path length.

Since the state of polarization (SOP) in the single-mode fiber will change independently due to the birefringence effect, the SOP cannot be kept the same. After being transmitted through two 5-km SMF spools with a measured loss of 0.2 dB/km at 1542.38 nm, it is adjusted by the manual PCs to ensure that the polarization directions of the coherent states transmitted by Alice and Bob are consistent to interfere by a 50:50 BS at the receiver.Here, we consider the ideally asymmetric case, where one SMF spool is served as the quantum channel and the other is used as a the delay line to synchronize the two signals in Bob’s station, which cannot be intercepted by Eve. The quantum channel between Bob and Charlie can be seen as the one with $T_B=1$ and ${\epsilon }_B=0$. Here, the actual fiber coupling efficiency and the natural loss of the fiber are all attributed to the attenuation of the quantum channel, which has been analyzed in the theoretical analysis. Another frequency stabilized laser $L_2$ is used as the local-LO, which is the same type as $L_1$ and is also divided into two beams. The optical power of $L_2$ is controlled by a VOA at 5 dbm to meet the shot noise detection requirement. Specifically, the power is adjusted while it is monitored in real-time by a power meter. Each of the LOs are mixed with one interference output followed by a homodyne detector with a 350-MHz bandwidth to measure the quadratures $X_{A_2}$ and $P_{B_2}$, which contain the pilot segments $X_{P{A}_2}, P_{P{B}_2}$, and the data segments $X_{D{A}_2}, P_{D{B}_2}$. An oscilloscope with a 1 GS/s sampling rate is used to acquire the output results from the two homodyne detectors.

It should be mentioned that since we use a continuous-wave mode of the quantum signal, the bandwidth of the whole system mainly depends on the bandwidth of the homodyne detectors. Here, the cursory frequency offset estimation is firstly performed by using the acquired outputs from the pilot segments $X_{P{A}_2}$. In our experiment, this frequency offset $\delta f$ mainly originates from the phase noise caused by the spontaneous emission in two lasers, which is related to the linewidth and is around 15 MHz in this experiment. In order to perform a further estimate of the frequency offset and phase drift, some data signals should be revealed. To monitor the phase drift in the quantum channel, here, the interference output power is directly detected by a PD through port 2, which reflects the phase drift of two optical fields after passing through their respective channels. The output is sampled as 2 kS/s and the result is shown in Figure 5a, and the average phase drift rate is 0.6541 rad/ms. By using these values, Alice and Bob will modify their prepared values $\{X_{a\left(b\right)},P_{a\left(b\right)}\}$ and $\{X_{a\left(b\right)}^p,P_{a\left(b\right)}^p\}$ with frequency their offset recovery and phase drift compensation algorithms. A parameter estimation can then be performed, just like in the original protocol. See the Appendix E for further details about the method of the frequency offset recovery and phase drift compensation.

For simplicity, here we don’t perform modulation on the signal state and therefore random number generators are omitted, but measure the quadratures of the carrier signal, i.e., the quadratures $X_{A_2}$ and $P_{B_2}$ of pilot segments, and then perform communication simulations with constructed key data and the measured quadratures and monitored phase drifts for the same simulation model [55]. The result reflects the phase drift situation in the actual optical fiber channel and its influence on the theoretical performance. By adopting the algorithm we proposed in Ref. [55], the phase misalignment problem can be solved, and the practical realization of the proposed protocol can be guaranteed.

Especially, we evaluate the excess noise for different frame sizes, where the first symbol is used to compensate the phase of the next four symbols. It can be seen from Figure 5b that the excess noise increases with the frame sizes. The reason is that when the phase drift rate is specified, shorter frame can be used to track the phase drift more accurately, which reducing the excess noise caused by the phase deviation. More detailedly, the frame length affects the accuracy of phase compensation. Specifically, the designed phase compensation algorithm for phase drift is to make an overall compensation for each frame. If the length of a frame is longer, then the symbol phase drift in one frame is not consistent and has a significant difference, and the residual phase noise will become more prominent after the compensation. The secret key rates are also shown in Figure 5b, which are evaluated under the conditions that the length of the SMF spool served as the quantum channel is 2 km with the channel loss $0.2$ dB/km and $\left|\alpha \right|=2.5$. We can find that the frame size should be controlled smaller enough to guarantee secure key distribution.

5. Conclusions

We propose a realizable CV-MDI-QKD scheme by encoding the key information into some discrete and matched specific phases, where the correlation between the legitimate parities can be established after Charlie publicly announces the results of the homodyne detections. The eavesdropping analysis is provided under a typical non-Gaussian attack, which is constructed by an SD receiver and a heralded NLA, when combined with the BS and partial IR attacks. The simulation results show that the two legitimate parties can obtain a secure secret key at relatively short distances against the strongest SD attacks, even with the currently low-efficiency homodyne detections for an ideally asymmetric case. For the symmetric case, the demand of the high-efficiency homodyne detection remains.

Different from the conventional discrete-modulated CV-MDI-QKD and CVQKD protocols, the encoding of secret keys here is based on the choices of discrete-distributed matched specific phases, but not directly encoding the secret information on continuous-distributed quadrature values with further judgments. This encoding way efficiently decreases the RDE and weakens the effect of the channel’s excess noise on the secret key rate, especially for the ideally asymmetric case, which is similar to the basis of the encoding for the QKD scheme [8] where the secret keys are encoded on the quadrature choices, i.e., the discrete-distributed measurement bases of the Gaussian-modulated coherent states. However, the discrete modulation and phase-matching encoding lead to a low utilization efficiency and a low capacity of the quantum channel, thus restricting the secret key rate to a relatively low level. The proof-of-principle experiment, with a locally-generated LO, demonstrates, for the first time, that CV-MDI-QKD can be currently well implemented using fiber-based devices under realistic conditions, which also shows the potentiality to be further integrated with low-cost classical optical communications.

From the security analysis, we found that the proposed DMPM CV-MDI-QKD protocol is not able to overcome the PLOB bound. However, for the discrete-variable (DV) PM QKD protocol proposed in [56], it is shown that the secret key rate can overcome the PLOB bound. The fundamental reason may be that they have different physical principles of implementations, which leads to different security analyses frameworks. In the DV case, the PM QKD protocol executes based on single-photon interference, where the unfolding of the used Mach–Zehnder interferometer doubles the transmission distance. In the CV case, the proposed CV-MDI-QKD protocol is based on the first-order interference of the light field quadratures of the multiphoton quantum states. The optical structure is the same as the one in the known Gaussian-modulated CV-MDI-QKD protocol, but it instead uses the phase-matching method with discrete-encoding. Thus, the performances of this protocol are also fundamentally restricted by the security framework of CV-QKD, and it is not able to overcome the PLOB bound. However, the introduction of the phase-matching method with discrete-encoding relatively increases the correlation between the legitimated parties, which, to some extent, relieves the required detection efficiency.

Here, the analysed non-Gaussian individual attack against the proposed scheme are realistic and important attacks for cryptography communication, which has been thoroughly studied in theory and in experiments [57,58]. Moreover, it is shown in [43] that for the discrete-modulated four-state CV-QKD schemes, the leaked information under the SD attacks can be larger than the Holevo bound that is calculated directly with the estimated parameters from the reconstructed covariance matrix under the linear channel assumption [7], when combining with the NLA in some specific conditions. Actually, the asymptotic security of the discrete-modulated CV-QKD against the collective attacks has only recently been proven [59]. The security has also been proven, in a composable finite-size way, against the collective Gaussian attacks [60]. In particular, a lower bound of the secret key rate is given for the four-state protocol, which is also lower than the one while assuming a linear channel [59]. This proof shows that the SD attacks are powerful and close to optimal, since the proposed protocol also performs essentially discrete modulations. Nevertheless, the security should be further developed against more general attacks. Under realistic conditions, the discrete modulation can achieve a high symbol rate to G Hz, and the secret key rate with practical security can reach applicable levels for accessing networks in cryptography communications.

It should be mentioned here that the fiber chromatic dispersion and polarization mode dispersion will not affect the current theoretical protocols and experiments. It is because the symbol rate of the discrete-modulation, currently, is not high, less than G Baud. Therefore, under a single-mode fiber, chromatic dispersion and polarization mode dispersion will not cause inter-symbol crosstalk. However, if the operation symbol rate exceeds G Baud in the future, the influence of fiber dispersion needs to be further considered. Moreover, the protocol can be also applied in the case of the free-space quantum channel [61,62,63] and the encoding may be extended to the squeezed states [64] with discrete-modulation.