A direct GHz-clocked phase and intensity modulated transmitter applied to quantumkey distribution

G. L. Roberts,1, 2, ∗ M. Lucamarini,1 J. F. Dynes,1 S. J. Savory,2 Z. L. Yuan,1 and A. J. Shields1

1Toshiba Research Europe Ltd, 208 Cambridge Science Park,Milton Road, Cambridge, CB4 0GZ, United Kingdom

2Cambridge University Engineering Department,9 JJ Thomson Avenue, Cambridge, CB3 0FA, United Kingdom

Quantum key distribution (QKD), a technology that enables perfectly secure communication, hasevolved to the stage where many different protocols are being used in real-world implementations.Each protocol has its own advantages, meaning that users can choose the one best-suited to theirapplication, however each often requires different hardware. This complicates multi-user networks, inwhich users may need multiple transmitters to communicate with one another. Here, we demonstratea direct-modulation based transmitter that can be used to implement most weak coherent pulse basedQKD protocols with simple changes to the driving signals. This also has the potential to extend toclassical communications, providing a low chirp transmitter with simple driving requirements thatcombines phase shift keying with amplitude shift keying. We perform QKD with concurrent time-binand phase modulation, alongside phase randomisation. The acquired data is used to evaluate securekey rates for time-bin encoded BB84 with decoy states and a finite key-size analysis, giving megabitper second secure key rates, 1.60 times higher than if purely phase-encoded BB84 was used.

I. INTRODUCTION

Quantum key distribution (QKD) allows users to com-municate with information theoretic security [1, 2]. Thisis possible by encoding the key on single photons so thata malign party trying to measure a key bit will alter itsstate in a manner observable to the legitimate parties.The security provided is of great value to anyone wishingto future-proof the secrecy of their information transfer.The technology is also practical and is currently imple-mented in a number of metropolitan networks [3, 4] andeven in ground-satellite links [5–7].

Research developments tend to aim at improving thesecure key rate and the achievable distance of QKD sys-tems [8–11]. For example, the decoy-state BB84 protocolhas security against coherent attacks, is able to reach dis-tances of hundreds of kilometres and can achieve megabitper second secure key rates [12, 13]. However, this of-ten makes systems more complex, requiring stabilisationroutines and extra consideration to protect against sidechannels, where Eve attacks the practical implementa-tion [14, 15].

QKD can be carried out using orthogonal states withintwo or more non-orthogonal bases. This means the resultis non-deterministic if the state encoded in a certain basisis measured in a different basis. Time-bin qubits, pre-pared with the setup in Figure 1a, are the natural choicein optical fibres because the pulses travel along the fibrewith their phase reference, meaning that perturbationsapply to both pulses. Their state can be convenientlyrepresented using the Bloch sphere, as depicted in Fig-ure 1b. The equatorial bases, X and Y, correspond totwo equal intensity pulses with a phase difference betweenthem. States in X and Y can be realised by separating a

∗ Corresponding author: zhiliang.yuan@crl.toshiba.co.uk

single phase-randomised pulse into a signal and referencepulse using an asymmetric Mach-Zehnder interferometer(AMZI), then encoding a phase difference using a phasemodulator. This can be decoded using an identical AMZI.The polar basis, Z, corresponds to a pulse in just one ofthe two potential time bins. States in this basis can bedecoded by measuring the arrival time of the time-binsin the receiver’s detectors.

In this manuscript, we refer to the QKD protocol us-ing the Z basis alongside either the X or Y bases aspolar BB84, and the protocol using the X and Y basesas phase-encoded BB84. Polar BB84 could theoreticallybe implemented using the BS/switch component shownin Figure 1a. However this is not a commonly availablecomponent and it is challenging to build a device thatcan act reliably as a high-speed switch and beamsplit-ter at the rates required by QKD systems. One of themost practical setups to implement polar BB84 [16] usesa phase-randomised pulsed laser diode as the source, sep-arated into a reference and signal pulse by an AMZI andthen encoded using another intensity modulator (IM) anda phase modulator (PM). This setup is bulky and wouldrequire stabilisation routines to ensure the AMZI delayline is matched to that in Bob’s receiver for a real-worldimplementation. Another drawback is that the transmit-ter is not versatile, requiring modifications if one wishesto implement another QKD protocol, for example differ-ential phase shift [17, 18], coherent one way [19, 20] ordifferential quadrature phase shift [21, 22].

A promising QKD transmitter that mitigates theseaforementioned drawbacks modulates the phase of onelaser, which is then inherited by the pulses of another laservia optical injection locking (OIL) [23]. This enables theprecise control of the output phase of pulses, as well as theability to perform on-demand phase randomisation [24].OIL also gives an enhanced modulation bandwidth, allow-ing time-bin encoding to be carried out on gain-switchedpulses at 2 GHz, whilst maintaining a coherent phase [25].

arX

iv:1

809.

0487

6v1

[qu

ant-

ph]

13

Sep

2018

2

a) b)

FIG. 1. X, Y, Z QKD bases a) A possible schematic to produce all the necessary QKD states using a phase-randomisedpulse source and a device that can act as a beamsplitter (BS) and a high-speed switch, plus a phase modulator (PM) producinga phase shift φ. To produce the X and Y bases, the device acts as a beamsplitter (BS), phase modulating one half of the pulseusing the PM and delaying the other half with an optical delay line. To produce the Z basis, the device acts as a switch, routingthe pulse down one path to place it in the desired time bin and b) Bloch sphere representation of qubit states.

However, it has not yet been possible to simultaneouslydirectly modulate the phase and intensity of a light sourcewith the high purity necessary for QKD.

Here, we use direct laser modulation to concurrentlymodulate the phase and intensity of the transmitter toprovide six states that can be used to perform QKD with-out the need for an interferometer in the transmitter. Thedirectly-modulated system produces signal and vacuumstates, allowing a single IM to be used to prepare thedecoy states and to equalise the mean photon numberin the phase bases. We use the Z and X bases to imple-ment the polar BB84 protocol and compare the resultsto phase-encoded BB84 implemented with the Y and Xbases. The low quantum bit error rate (QBER) of thepolar basis relative to the equatorial bases means that itsuse as the signal state allows for fewer bits to be lost toerror correction, enhancing the secure key rate.

II. EXPERIMENTAL REALIZATION

The transmitter we use is based on OIL and is shownin Figure 2. The protocols implemented are decoy-statepolar BB84 and decoy-state phase-encoded BB84 [26–28].

The phase preparation laser encodes a relative phasebetween pulse pairs using a 750 ps signal to bring the laserabove threshold and to coincide temporally with two pulsepreparation laser pulses 500 ps apart. A 250 ps modula-tion is applied in the middle of this signal to control therelative phase between the two pulses. The laser is thendriven below threshold for 250 ps to ensure the globalphase of every pulse pair is completely random due to therandom phase of spontaneous emission photons [23, 24].The optical signal is injected into the pulse preparationlaser via a circulator, where pulses adopt the phase of thephase preparation laser. This removes the need for a highspeed phase modulator and an extra random number gen-erator for phase-encoding and randomisation. A 1550 nmDFB laser diode with a 10 GHz bandwidth (Gooch &Housego AA0701) is used as the phase preparation laser

and a custom-made laser without an optical isolator asthe pulse preparation laser.

The electrical signal into the pulse preparation laser ispatterned to produce intensity-modulated gain-switchedpulses [25]. For polar BB84 with decoy states, emptypulses are required to prepare Z basis states and vacuumstates. 250 ps electrical pulses are input to the pulsepreparation laser at a frequency of 2 GHz and the DCis set to below the lasing threshold. When a signal ordecoy pulse is required, the electrical signal is above thelasing threshold. To prepare a vacuum state the electricalsignal is below the lasing threshold, as shown in Figure 2.The X and Y bases can then be attenuated by 3 dB sothat they contain the same mean photon number as theZ basis. Although only two bases are used for BB84, wetake experimental data for the X, Y and Z bases, allowingus to demonstrate the versatility of the transmitter.

The transmission basis probabilities are set to PZ = 0.8,PX = PY = 0.1 and the probabilities of sending a signal(photon flux s), decoy (photon flux v) and vacuum (photonflux w) state are Ps = 0.8, Pv = Pw = 0.1 respectively.The photon fluxes are 0.5, 0.038 and 0.001 for s, v andw respectively. A proof of principle experiment is thencarried out, where data is measured for 20 minutes perbasis at each distance, giving 40 minutes of key time forboth the polar BB84 protocol and phase-encoded BB84.This allows us to maximise the number of key bits, whilstproviding a sufficient number of bits in the check basis tokeep the fluctuations low.

The pulse preparation laser is clocked at 2 GHz, givingan effective system clock rate of 1 GHz. This is becausetwo time bins are required to encode a single qubit. A210-bit pseudorandom sequence is generated as Alice’spattern, allowing the corresponding electrical signals tobe input to drive the laser diodes. A fixed 12 GHz spec-tral filter (Advanced Optics Solutions – ASE Filter) at1550.12 nm is placed at Alice’s output to reduce anyamplified spontaneous emission. The pulses are then at-tenuated to the required photon number before being sentthrough the quantum channel to Bob.

3

The X and Y data are collected using an AMZI witha 500 ps time delay on one arm to interfere consecutivepulses. A polariser is placed at the output of the AMZIto clean the signal, necessitating the use of a polarisationcontroller in Alice for alignment. The AMZI has a 1.7 dBloss and half of the photons (the reference pulses) containno information so are discarded. A fixed attenuation of4.7 dB must be placed on the Z measurement arm tobalance the detection efficiencies for each measurementbasis. This is because the security of BB84 relies on iden-tical basis-independent detection probabilities [2, 29, 30].

The detected counts are tagged using a digitizer andbinned into 211-bin histograms for extraction of the countsand error rates. A 10 ns subset of this histogram beforecreation of decoy states and equalisation of the X andY bases intensities can be seen in Figure 3. Randominterference occurs in the X and Y bases when two pulsesfrom separate blocks interfere, giving an average interfer-ence intensity of half the maximum intensity. An emptypulse followed by a full pulse has no interference, thus

FIG. 2. Experimental design. a) Light from the phasepreparation laser diode (LD) is injected into the pulse prepara-tion laser diode via a circulator. The applied electrical signalsare shown beside each laser and the pulse intensities are shownalong the fibre. An intensity modulator (IM) can then be usedto prepare decoy states and to equalise the polar and equa-torial state intensities before attenuation and transmissionthrough the quantum channel. b) The Z basis is measuredthrough direct detection whereas X/Y basis detection usesan asymmetric Mach-Zehnder interferometer (AMZI) with aphase modulator (PM) on one arm. An attenuator (Att) onthe Z detection arm balances the losses of the X/Y detectionarm.

producing a quarter of the maximum intensity.

FIG. 3. Directly-modulated traces. Measurement tracesbefore decoy state preparation and basis intensity equalisation.The Z basis (top) has only a single trace, whereas the X andY bases (middle and bottom) have two AMZI outputs. Thecorresponding input pattern values are displayed at the top,labelled as Bb, where B is the basis and b is the logical bitvalue inside that basis. A red (grey) peak in the X and Ybases corresponds to a ‘0’ (‘1’) logical bit, where the photonexits through the upper (lower) AMZI port. Peaks in output 1(2) counts of the AMZI are complemented by small counts inoutput 2 (1) (middle inset), showing the high distinguishabilitybetween bits.

The detectors used are superconducting nanowire SPDswith a detection efficiency of 34 %, a dark count rate of30 Hz and a deadtime of <20 ns. The jitter increases andefficiency decreases with increasing count rate, so mea-surements are not taken at count rates over 10 MCounts/s.

A digitizer with 100 ps time bins and constant factordiscrimination then processes the counts. The detectorshave a polarisation dependence, so a polarisation con-troller is used for optimal detection efficiency. Althoughthe receiver is adapted to each specific protocol, the trans-mitter remains entirely unchanged. This is a necessaryfeature for a multi-protocol QKD transmitter.

4

III. RESULTS

The number of signal and decoy counts measured ineach basis is shown in Figure 4a). These decrease expo-nentially because the measurement time remains constantat 20 minutes, regardless of the distance, whereas receivedcounts scales exponentially with channel loss. Figure 4b)highlights the 2.6 percentage point drop in QBER be-tween the XY bases and Z basis. Simulations using theexperimental parameters and the predicted count ratebased on the system losses are also shown. The finite key-size analysis is detailed by Lim et al [12], which quantifiesthe security and correctness of the protocol through theparameters εsec and εcor. In this implementation, thesevalues are set to 2 × 10−11 and 1 × 10−15 respectively.The key rate, RL is calculated using

RL = [sZZ;0 + sZZ;1(1 − h(φz)) − λEC − ∆(εsec, εcor)] /t,(1)

where sXX,ZZ;n is the number of counts measured byBob in the X or Z basis, given that Alice prepared ann-photon state in the X or Z basis respectively, φZ isthe single photon phase error rate in Z, λEC is the errorcorrection information, ∆ is the finite key-size correctionterm and t is the time used to collect the experimentaldata block [12]. The key rates displayed in 4c) show anexperimental secure key rate of 1.26 megabits per secondat an equivalent distance of 40 km (assuming opticalfibre with a 0.2 dB/km loss) using an attenuator and246 kilobits per second in real fibre of length 75 km. Apositive secure key rate could be achieved up to 250 kmin the asymptotic limit and up to 180 km with the finitekey-size analysis of Eq 1 for just 40 minutes of key time.

To compare between polar BB84 and phase-encodedBB84, we looked at the secure key rate in the asymptoticlimit using the experimental parameters obtained in theZX and the YX bases respectively. The transmissionbasis probabilities are renormalised to allow for a faircomparison. The key rate is improved by 1.60 times whenusing the ZX bases compared to the YX bases. Also,phase-encoded BB84 is able to reach an attenuation of48.5 dB with a positive secure key rate, whereas polarBB84 can reach slightly further, at 50.1 dB.

IV. DISCUSSION

Our implementation produced six states in order toshow the versatility of the source, however only used fourfor the QKD implementations. Six-state QKD is possibleand has a slightly higher tolerance to noise than its four-state counterpart, leading to the ability to share securekeys at slightly longer distances [2]. The main drawbackis found in the receiver. Polar BB84 can be implementedwith three SPDs (phase-encoded BB84 would require twoSPDs in an active receiver and four SPDs in a passivereceiver). Six-state QKD, on the other hand, requires anextra AMZI and two extra SPDs if it is to remain passive,or a high speed PM in the AMZI to choose the basis

0 5 0 1 0 0 1 5 0 2 0 0 2 5 0

1 0 4

1 0 6

1 0 8

1 0 1 0

02468

1 0

0 1 0 2 0 3 0 4 0 5 01 0 11 0 21 0 31 0 41 0 51 0 61 0 7

Coun

ts

Z s X s Y s Z v X v Y v

Z X Y

E z = 0 . 2 %

QBER

(%)

E x = 2 . 8 %

E q u i v a l e n t d i s t a n c e ( k m )

SKR (

bps)

C h a n n e l a t t e n u a t i o n ( d B )

A s y m p t o t i c F i n i t e

FIG. 4. Polar BB84 results with decoy states, secure againstcoherent attacks. Lines are theoretical results and symbolsare experimentally measured or calculated values. a) Numberof counts measured in each basis, b) QBER for each basis,c) Secure key rate (SKR) in the asymptotic (filled symbols,dotted line) and finite key-size regimes (empty symbols, solidline). The star symbols are data measured with real fibre asthe quantum channel.

in an active implementation. Both of these options addsignificant complexity when compared to their meagerincrease in secure key distance. Indeed, four-state QKDcould be carried out for a longer time-period to reducestatistical fluctuations and increase the achievable dis-tance. Reference frame independent-QKD [31] is anotherprotocol that requires three bases, allowing two bases todrift in time while the other stays constant. This basisdrift is a problem for polarisation-encoded systems in realfibre, however is not an issue for phase encoded systemslike the one demonstrated here because the signal travelsalong the fibre with the phase reference. Multi-protocoltransmitters have also been demonstrated in [32, 33], al-though these have the drawbacks of being complex andnot offering phase randomisation, respectively.

5

As well as the aforementioned benefit of requiring onefewer SPD for polar BB84 compared to phase-encodedBB84, the key rates are also improved by a factor of 1.60times. This is made possible by the reduced QBER of thesignal basis from 2.8% to 0.2%, which reduces the bitslost to error correction, hence improving the secure keyrate.

Direct preparation of decoy states can be realised bydriving the pulse preparation laser at different levels abovethe lasing threshold to reach different intensities. Thisis ideal because no external hardware, for example anintensity modulator, is required. This would also be usefulfor classical communications, increasing the number ofbits encoded per symbol [34]. We have achieved intensitymodulation using this method. This creates a patterningeffect for the decoy states, however, where the intensityof a pulse is correlated with the intensity of the precedingpulse, opening the door to side-channel attacks [16]. Toavoid this security loophole, the QKD decoy states areinstead produced using a two-level Sagnac-based IM [35].

The transmitter also shows promise to be useful in clas-sical communications. The patterning effects that provedprohibitive for QKD when directly producing multipleintensity states are not a major concern here, it will justadd a slight degradation to the distinguishability betweenstates. The direct modulation means that the system isnot reliant on multiple external modulators, making itcheaper, less complex and also easier to integrate withother components. The optical injection locking ensuresthat all pulses have the same wavelength. This removesa side channel for QKD, but also means the system haslow chirp, reducing the inter-symbol interference causedby dispersion effects. In this paper we have shown theaccurate production of four phase states, however thiscan easily be increased by using more phase-preparationlevels. Different intensities can be produced directly, andalso a vacuum state can be produced, further increasingthe amount of information encoded per symbol.

V. CONCLUSION

In this paper, we have demonstrated a transmitter ca-pable of performing all weak coherent pulse-based QKDprotocols, performing phase and intensity encoding si-multaneously. With this system, we have demonstratedthe decoy-state polar BB84 protocol and the decoy-statephase-encoded BB84 protocol in a single experiment,preparing the six states in three different bases requiredby the simultaneous execution of these two protocols froma single transmitter. In both bases we found a securekey rate in the order of 1 megabit per second at 8 dBattenuation, with the decoy-state polar BB84 protocolproviding a 1.6 times larger secure key rate on averageand a slightly higher tolerance to losses.

The ability to adapt to different protocols with simplesoftware changes makes the transmitter more robust innetwork scenarios where all the users could potentiallyhave different receivers. Alongside this, the system is moresimple than many other transmitters that are dedicatedto a single protocol, which is appealing for real worldimplementations. Also the relatively few componentsensure it has a good power efficiency and make it idealfor on-chip implementations. The versatility, low powerconsumption and stability of this transmitter make it thenatural choice for use in metropolitan multi-user quantumnetworks.

ACKNOWLEDGMENTS

G. L. R gratefully acknowledges financial support fromthe EPSRC CDT in Integrated Photonic and Electron-ics Systems, Toshiba Research Europe Limited and anindustrial fellowship with The Royal Commission for theExhibition of 1851. This work has been supported byfunding through the EPSRC Quantum CommunicationsHub EP/M013472/1.

[1] N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, Rev.Mod. Phys. 74, 145 (2002).

[2] V. Scarani, H. Bechmann-Pasquinucci, N. J. Cerf,M. Dusek, N. Lutkenhaus, and M. Peev, Rev. Mod.Phys. 81, 1301 (2009).

[3] M. Peev, C. Pacher, R. Alleaume, C. Barreiro, J. Bouda,W. Boxleitner, T. Debuisschert, E. Diamanti, M. Dianati,J. F. Dynes, S. Fasel, S. Fossier, M. Furst, J.-D. Gau-tier, O. Gay, N. Gisin, P. Grangier, A. Happe, Y. Hasani,M. Hentschel, H. Hubel, G. Humer, T. Langer, M. Legre,R. Lieger, J. Lodewyck, T. Lorunser, N. Lutkenhaus,A. Marhold, T. Matyus, O. Maurhart, L. Monat,S. Nauerth, J.-B. Page, A. Poppe, E. Querasser, G. Ri-bordy, S. Robyr, L. Salvail, A. W. Sharpe, A. J. Shields,D. Stucki, M. Suda, C. Tamas, T. Themel, R. T. Thew,Y. Thoma, A. Treiber, P. Trinkler, R. Tualle-Brouri,F. Vannel, N. Walenta, H. Weier, H. Weinfurter, I. Wim-berger, Z. L. Yuan, H. Zbinden, and A. Zeilinger, NewJournal of Physics 11, 075001 (2009).

[4] M. Sasaki, M. Fujiwara, H. Ishizuka, W. Klaus,K. Wakui, M. Takeoka, S. Miki, T. Yamashita, Z. Wang,A. Tanaka, K. Yoshino, Y. Nambu, S. Takahashi,A. Tajima, A. Tomita, T. Domeki, T. Hasegawa, Y. Sakai,H. Kobayashi, T. Asai, K. Shimizu, T. Tokura, T. Tsu-rumaru, M. Matsui, T. Honjo, K. Tamaki, H. Takesue,Y. Tokura, J. F. Dynes, A. R. Dixon, A. W. Sharpe, Z. L.Yuan, A. J. Shields, S. Uchikoga, M. Legre, S. Robyr,P. Trinkler, L. Monat, J.-B. Page, G. Ribordy, A. Poppe,A. Allacher, O. Maurhart, T. Langer, M. Peev, andA. Zeilinger, Optics Express 19, 10387 (2011).

[5] G. Vallone, D. Bacco, D. Dequal, S. Gaiarin, V. Luceri,G. Bianco, and P. Villoresi, Physical Review Letters 115,040502 (2015).

[6] S.-K. Liao, H.-L. Yong, C. Liu, G.-L. Shentu, D.-D. Li,J. Lin, H. Dai, S.-Q. Zhao, B. Li, J.-Y. Guan, W. Chen,Y.-H. Gong, Y. Li, Z.-H. Lin, G.-S. Pan, J. S. Pelc, M. M.Fejer, W.-Z. Zhang, W.-Y. Liu, J. Yin, J.-G. Ren, X.-B.Wang, Q. Zhang, C.-Z. Peng, and J.-W. Pan, Nature

6

Photonics 11, 509 (2017).[7] H. Takenaka, A. Carrasco-Casado, M. Fujiwara, M. Kita-

mura, M. Sasaki, and M. Toyoshima, Nature Photonics11, 502 (2017).

[8] X. Ma, B. Qi, Y. Zhao, and H.-K. Lo, Physical ReviewA 72, 012326 (2005).

[9] A. R. Dixon, Z. L. Yuan, J. F. Dynes, A. W. Sharpe, andA. J. Shields, Optics Express 16, 18790 (2008).

[10] D. Bacco, J. B. Christensen, M. A. U. Castaneda, Y. Ding,S. Forchhammer, K. Rottwitt, and L. K. Oxenløwe,Scientific Reports 6, 36756 (2016).

[11] H.-L. Yin, T.-Y. Chen, Z.-W. Yu, H. Liu, L.-X. You, Y.-H.Zhou, S.-J. Chen, Y. Mao, M.-Q. Huang, W.-J. Zhang,H. Chen, M. J. Li, D. Nolan, F. Zhou, X. Jiang, Z. Wang,Q. Zhang, X.-B. Wang, and J.-W. Pan, Physical ReviewLetters 117, 190501 (2016).

[12] C. C. W. Lim, M. Curty, N. Walenta, F. Xu, andH. Zbinden, Physical Review A 89, 022307 (2014).

[13] B. Frohlich, M. Lucamarini, J. F. Dynes, L. C. Comandar,W. W.-S. Tam, A. Plews, A. W. Sharpe, Z. Yuan, andA. J. Shields, Optica 4, 163 (2017).

[14] A. R. Dixon, J. F. Dynes, M. Lucamarini, B. Frohlich,A. W. Sharpe, A. Plews, W. Tam, Z. L. Yuan,Y. Tanizawa, H. Sato, S. Kawamura, M. Fujiwara,M. Sasaki, and A. J. Shields, Scientific Reports 7 (2017),10.1038/s41598-017-01884-0.

[15] H.-K. Lo, M. Curty, and B. Qi, Physical Review Letters108 (2012), 10.1103/PhysRevLett.108.130503.

[16] K.-i. Yoshino, M. Fujiwara, K. Nakata, T. Sumiya,T. Sasaki, M. Takeoka, M. Sasaki, A. Tajima, M. Koashi,and A. Tomita, npj Quantum Information 4 (2018),10.1038/s41534-017-0057-8.

[17] H. Shibata, T. Honjo, and K. Shimizu, Optics Letters39, 5078 (2014).

[18] K. Inoue, IEEE Journal of Selected Topics in QuantumElectronics 21, 109 (2015).

[19] B. Korzh, C. C. W. Lim, R. Houlmann, N. Gisin, M. J.Li, D. Nolan, B. Sanguinetti, R. Thew, and H. Zbinden,Nature Photonics 9, 163 (2015).

[20] C. Branciard, N. Gisin, and V. Scarani, New Journal ofPhysics 10, 013031 (2008).

[21] K. Inoue and Y. Iwai, Physical Review A 79 (2009),10.1103/PhysRevA.79.022319.

[22] S. Kawakami, T. Sasaki, and M. Koashi, Physical ReviewA 94 (2016), 10.1103/PhysRevA.94.022332.

[23] Z. L. Yuan, B. Frohlich, M. Lucamarini, G. L. Roberts,J. F. Dynes, and A. J. Shields, Physical Review X 6,031044 (2016).

[24] G. L. Roberts, M. Lucamarini, J. F. Dynes, S. J. Savory,Z. Yuan, and A. J. Shields, Applied Physics Letters 111,261106 (2017).

[25] G. L. Roberts, M. Lucamarini, J. F. Dynes, S. J. Savory,Z. L. Yuan, and A. J. Shields, Laser & Photonics Reviews11, 1700067 (2017).

[26] W.-Y. Hwang, Physical Review Letters 91, 057901 (2003).[27] X.-B. Wang, Physical Review Letters 94, 230503 (2005).[28] H.-K. Lo, X. Ma, and K. Chen, Physical Review Letters

94, 230504 (2005).[29] M. Koashi, arXiv:quant-ph/0609180 (2006).[30] M. Tomamichel, C. C. W. Lim, N. Gisin, and R. Renner,

Nature Communications 3, 634 (2012).[31] A. Laing, V. Scarani, J. G. Rarity, and J. L. O’Brien,

Physical Review A 82, 012304 (2010).[32] P. Sibson, C. Erven, M. Godfrey, S. Miki, T. Yamashita,

M. Fujiwara, M. Sasaki, H. Terai, M. G. Tanner, C. M.Natarajan, R. H. Hadfield, J. L. O’Brien, and M. G.Thompson, Nature Communications 8, 13984 (2017).

[33] B. Korzh, N. Walenta, R. Houlmann, and H. Zbinden,Optics Express 21, 19579 (2013).

[34] T. Noguchi, Y. Daido, and J. A. Nossek, IEEE Commu-nications Magazine 24, 21 (1986).

[35] G. L. Roberts, M. Pittaluga, M. Minder, M. Luca-marini, J. F. Dynes, Z. L. Yuan, and A. J. Shields,arXiv:1807.07414 [quant-ph] (2018).