Detector-device-independent quantum key distribution

(1)

Article

Reference

Detector-device-independent quantum key distribution

LIM, Ci Wen, et al.

Abstract

Recently, a quantum key distribution (QKD) scheme based on entanglement swapping, called measurement-device-independent QKD (mdiQKD), was proposed to bypass all measurement side-channel attacks. While mdiQKD is conceptually elegant and offers a supreme level of security, the experimental complexity is challenging for practical systems. For instance, it requires interference between two widely separated independent single-photon sources, and the secret key rates are dependent on detecting two photons—one from each source. Here, we demonstrate a proof-of- principle experiment of a QKD scheme that removes the need for a two-photon system and instead uses the idea of a two-qubit single-photon to significantly simplify the implementation and improve the efficiency of mdiQKD in several aspects.

LIM, Ci Wen, et al . Detector-device-independent quantum key distribution. Applied Physics Letters , 2014, vol. 105, no. 22, p. 221112

DOI : 10.1063/1.4903350

Available at:

http://archive-ouverte.unige.ch/unige:83939

Disclaimer: layout of this document may differ from the published version.

(2)

Detector-device-independent quantum key distribution

Charles Ci Wen Lim, Boris Korzh, Anthony Martin, Felix Bussie`res, Rob Thew,! and Hugo Zbinden

Group of Applied Physics, University of Geneva, Chemin de Pinchat 22, CH-1211 Geneva 4, Switzerland (Received 15 October 2014; accepted 21 November 2014; published online 4 December 2014) Recently, a quantum key distribution (QKD) scheme based on entanglement swapping, called measurement-device-independent QKD (mdiQKD), was proposed to bypass all measurement side-channel attacks. While mdiQKD is conceptually elegant and offers a supreme level of security, the experimental complexity is challenging for practical systems. For instance, it requires interference between two widely separated independent single-photon sources, and the secret key rates are dependent on detecting two photons—one from each source. Here, we demonstrate a proof-of- principle experiment of a QKD scheme that removes the need for a two-photon system and instead uses the idea of a two-qubit single-photon to significantly simplify the implementation and improve the efficiency of mdiQKD in several aspects.V^C 2014 AIP Publishing LLC.

[http://dx.doi.org/10.1063/1.4903350]

Quantum key distribution (QKD) enables the exchange of cryptographic keys between two separated users, Alice and Bob, who are connected by a potentially insecure quantum channel.^1–4Unlike conventional key distribution schemes, the security of QKD depends only on the principles of quantum physics and can be proven information-theoretically secure.

However, despite the potential of QKD, one still has to be pru- dent about potential side-channel attacks that may lead to security failures. For example, it has been shown that with detector blinding techniques, it is possible to remotely hack the measurement unit of some QKD systems.⁵Although it is possible to implement appropriate countermeasures for specific attacks, one may be wary that the adversary, Eve, could devise new detector control strategies, unforeseen by the users.

To prevent all known and yet-to-be-discovered measurement side-channel attacks, a measurement-device-independent QKD (mdiQKD) protocol was proposed⁶ (for a similar pro- posal see Ref. 7). In this scheme, Alice and Bob each randomly prepare one of the four Bennett-Brassard (BB84) states¹and send it to a third party, Charlie, whose role is to introduce entanglement between Alice and Bob via a Bell- state measurement (BSM).^8,9 In practice, mdiQKD can be implemented with phase-randomized weak coherent (BB84) states (WCSs), using either time-bin encoded qubits^10,11 or polarization-encoded qubits.^12,13To meet the assumption that Alice and Bob send single photons, as required by mdiQKD, they randomly vary the intensity of their laser pulses and use the decoy-state method^14,15to estimate the fraction of single- photon states sent to and detected by Charlie. A particular attraction of mdiQKD is its suitability for star-type QKD net- works,¹⁶ where the central node can be left completely untrusted, whilst the overall architecture is expected to be compatible¹⁰with future quantum repeaters.¹⁷

Unfortunately, mdiQKD possesses a few drawbacks.

First, the achievable secure key rates (SKR) are significantly lower compared to point-to-point¹⁸ prepare-and-measure (P&M) QKD systems.^19–22 This is mainly because a two- photon BSM relies on coincidence detections, meaning that the SKR scales with (gdetP1(l))², wheregdetis the efficiency

of the single photon detector (SPD) and P1(l) is the probability of the source emitting a single-photon.²³ Note, however, that coincidence detections make mdiQKD more robust against detector dark counts. Another factor is that a two- photon BSM implemented with linear optics is at most 50%

efficient,^24–26and, when using WCSs, the results from one of the bases cannot be used for the raw-key generation due to an inherent 25% error rate.^10,12 Furthermore, the resource overhead in the finite-key scenario¹⁴ is significantly larger compared to common P&M schemes,^22,27due to the need to apply the decoy-state method twice (once for each source), thus increasing the statistical fluctuations. For example, at around 150–200 km, Alice and Bob would have to send about 10¹³–10¹⁴laser pulses (depending on the detection efficiency) to Charlie before key distillation is possible.^14,28 Finally, although a number of complete mdiQKD experi- ments have been demonstrated,^10–13,28 their relative techni- cal complexity is greater than P&M schemes due to the need for two-photon interference, requiring both photons to be indistinguishable in all degrees of freedom (DOFs), e.g., temporal, polarization and frequency.

Here, we report on the implementation of a QKD scheme that overcomes the aforementioned limitations but is still secure against all detector side-channel attacks. This bridges the gap between the superior performance and practi- cality of P&M QKD schemes and the enhanced security offered by mdiQKD. Note that a similar scheme, following the same basic idea, has been proposed elsewhere.²⁹ Our scheme, henceforth referred to as detector-device-independent QKD (ddiQKD), essentially follows the idea of mdiQKD;

however, instead of encoding separate qubits into two independent photons, we exploit the concept of a two-qubit single-photon (TQSP). This scheme has the following advantages: (1) It requires only single-photon interference;

(2) the linear-optical BSM is 100% efficient;³⁰(3) the secret key rate scales linearly with the SPD detection efficiency;

and (4) it is expected that in the finite-key scenario, the mini- mum classical post-processing size is similar to that of P&M QKD schemes.

0003-6951/2014/105(22)/221112/5/$30.00 105, 221112-1 ^V^C2014 AIP Publishing LLC

(3)

The protocol works as follows: see Fig. 1. Alice first prepares a single photon in the qubit statejwAip chosen uniformly at random from the following set of BB84 states:

jwAip2^r

jþi¼ 1 ffiffiffi2

p jðHiþjViÞ; j%i¼ 1

ffiffiffi2

p jðHi%jViÞ; jþii¼ 1

ffiffiffi2

p jðHiþijViÞ; j%ii¼ 1

ffiffiffi2

p jðHi%ijViÞ; 8>

>>

><

>>

:

where the subscript p indicates that this is a qubit in the polarization DOF of the photon. Alice sendsjwAip to Bob via an untrusted quantum channel. Upon reception of the photon, Bob encodes his random qubit state jwBis in the spatial DOF (hence the subscript “s”). To achieve this, Bob sends the photon to a 50/50 beam splitter (BS). We denote juiandj‘ithe states of the basis defined by the “upper” and

“lower” arms after the BS, respectively. He then applies a phase u chosen uniformly at random in the set f0;p=2;

p;3p=2g on the lower arm to prepare the state jwBis

¼ ðjuiþeⁱ^uj‘iÞ, yielding BB84 states in the spatial modes.

Both DOFs have so far been created and manipulated inde- pendently of each other, and thus, the two-qubit state can be written asjwAip&jwBis.

We then define the following Bell states:

jU⁶i¼ 1 ffiffiffi2

p jHipjuis6jVipj‘is

" #; (1)

jW⁶i¼ 1 ffiffiffi2

p jHipj‘is6jVipjuis

" #

: (2)

A complete and deterministic BSM of these states is realized by first applying the unitary transformation jHui ! jVui and jVui ! jHui on the upper arm using a half-wave plate (HWP), followed by the recombination of the arms on a 50/50 BS, and finally by a projection in thefjHi;jVigbasis using two polarizing beam splitters (PBSs) on the two output arms followed by four SPDs. In this way, a click on each SPD corresponds to a projection on one of the four Bell states—see Fig.1.

To show how the raw key establishment works, let us first define the mutually unbiased basesB^X ¼fjþi;j%igand B^Y¼fjþii;j%iig. The bit to be established is encoded in Alice’s state, i.e., jþiand jþii encode bit 0, and j%i and j%ii encode bit 1. After the measurement phase, Bob announces the success of the BSM and reveals the basis he used to encode his qubit. Subsequently, Alice announces whether Bob’s basis choice was compatible with hers. Bob can then determine Alice’s bit value according to Table I, which shows all of the possible combinations. For example, ifjwBis¼jþi, the bit is 0 if he detectedjU^þiorjW^þi, and 1 otherwise. If more than one detector clicks, Bob announces a successful BSM and assigns a random bit value. Importantly, the knowledge of the bases used by Alice and Bob, along with which of the Bell states Bob obtained, does not reveal Alice’s bit. Hence, Eve cannot gain information about the key by controlling Bob’s detectors.

From a security point of view, it is important to consider carefully the operation of Bob’s device. Strictly speaking, the mathematical description of his qubit, outlined previ- ously, holds only if the light state entering the first BS is a single-photon excitation of a single optical-temporal mode.

As with any other QKD scheme, it is not possible to guaran- tee this. Indeed, Eve may send multi-photon states through the quantum channel and break the qubit description.

However, such an attack is only detrimental if she can interact with Bob’s prepared states, e.g., via unambiguous state discrimination measurements.³¹ This is not possible since the adversary can only interact with Alice’s qubits. In particular, Eve cannot access the output of Bobs interferometer.

Additionally, if the input is a multi-photon state, then with an increased probability, more than one detector clicks, in which case Bob would pick a random bit value, increasing the errors in the raw bit string. This is due to the fact that the optical linear circuit of the BSM randomizes the encoded state.

The security of our scheme requires that the final light state (just before the SPDs), taken over all possible encoding choices, is independent of the input light state. In particular,

BSM

Alice’s lab Single-photon source

Bob’s lab

Optical channel

FIG. 1. The conceptual setup. Alice encodes her qubitjwAipin the polarization DOF of a single photon, sends it to Bob who encodes his qubitjwBisin the spatial DOF using a 50/50 BS and a phase modulator (PM). Bob then performs a complete and deterministic BSM on both qubits using a HWP, PBSs and SPDs. Components inside the shaded regions of Alice and Bob’s labs are trusted devices, whilst the SPDs are untrusted.

TABLE I. Theoretical and experimentally observed probabilities for each Bell state. Rows and columns correspond to Alice’s and Bob’s statesjwAip

andjw_Bis, respectively. Given a certain Bell statek, for eachjw_Aip, there are four possiblejw_Bis: white cells should happen with probability Pr½k( ¼0, light grey cells with Pr½k( ¼1=4, and dark grey cells with Pr½k( ¼1=2. The experimentally observed probabilities are written in each cell. The relative uncertainty for each measurement was 1%.

(a) jU^þi (b) jW^þi

þ % þi %i þ % þi %i

þ 0.49 0.01 0.25 0.26 þ 0.49 0.02 0.25 0.27

% 0.01 0.50 0.25 0.27 % 0.00 0.50 0.27 0.24 þi 0.27 0.26 0.01 0.48 þi 0.29 0.23 0.49 0.00

%i 0.24 0.23 0.50 0.01 %i 0.23 0.25 0.01 0.55

(c) jW^%i (d) jU^%i

þ % þi %i þ % þi %i

þ 0.00 0.48 0.28 0.25 þ 0.00 0.47 0.25 0.25

% 0.54 0.00 0.25 0.23 % 0.54 0.00 0.23 0.25 þi 0.25 0.26 0.01 0.52 þi 0.26 0.26 0.48 0.00

%i 0.26 0.24 0.50 0.01 %i 0.26 0.21 0.00 0.56

221112-2 Limet al. Appl. Phys. Lett.105, 221112 (2014)

(4)

for any input state with a givenn-photon excitation, the average final state after passing through the linear optical circuit is a fixed state. This requirement is in fact similar to the one used in the security analysis of BB84, where the average of the BB84 states has to be independent of the basis choice.³² Once this requirement is met, the security of the scheme can be obtained following proof techniques for the BB84 QKD scheme. A common method to prove the security of P&M QKD schemes is to consider an equivalent entanglement- based version, where Alice and Bob make random measurements on bipartite quantum states distributed by the adversary. To this end, we point to a formalism that allows us to see Bob’s linear optical circuit as random measurements made on some entangled bipartite state.

First, let us relate the two different DOFs, i.e., Ap, Bp

denoting the polarization states of Alice and Bob, respectively, whileBs denotes Bob’s spatial state. Since Alice is able to prepare the four polarization BB84 states correctly, it is equivalent to consider the entanglement based version, where Alice first prepares a two-qubit maximally entangled state,jU^þi, and then performs a projective measurement on one half of the state to prepare the other half for Bob.

Mathematically, we have Mx&IjU^þi hU^þjA_pB_p&jsi hsjB_s, whereMx is the positive-operator valued measure (POVM) element corresponding to preparation x2 fþ;%;þi;%ig andjsiB_sis an auxiliary state related to the spatial DOF.

Second, Alice sends the quantum systems Bp and Bs

using a single photon through the quantum channel to Bob.

At this point, the resulting state is not necessarily a single photon state. In this case, the state, after tracing out system Ap, is described by a bipartite density operator,qC_pC_s, whose dimension is unknown but fixed. To proceed, we use a result from Ref.33, Lemma. 1, which says that if, for any input state, the linear optical circuit (parameterized byu) outputs a state that is fixed on the average, the encoding can be seen as a purified measurement acting on the same input state and one half of a bipartite pure state, where the other half of the bipartite is the same output state. More formally, let the linear optical circuit be described by a set of completely positive trace-preserving maps,fEug_u, taking the input quantum system Cs to an output quantum system Ds, such that for any input quantum state qC_s, the output quantum state is fixed over all possible encoding choices, i.e., 1=4P

uEuðqC_sÞ ¼qD_s

for anyqC_s. Then, the linear optical circuit is equivalent to making a joint measurement fF^u_C_s_K_sgu on the same input state,qC_s, and one half of a bipartite pure state,jriK_sD_s, living in a joint quantum system Ks&Ds, where the other half gives the fixed stateqD_s. Therefore, the purification provides a method to analyze the security of our scheme in an entanglement-based picture, where Alice makes random BB84 measurements on one half of a bipartite quantum state and Bob makes random purified measurements on the other half.

Finally, the security of ddiQKD follows directly from that of the BB84 QKD scheme, with the additional benefit that detectors are excluded from the security analysis. In particular, the security can be obtained by using the entropic uncertainty relation proof technique:^27,34 in the asymptotic limit, and under the approximation that the BB84 polarization states are prepared correctly, the secret key fraction is

/1%2hðQÞ, wherehis the binary entropy function andQis the error rate of the sifted key. In fact, the finite-key security performance of ddiQKD with the decoy-state method^35–37 is expected to be similar to the one of Ref.27, but with a slightly shorter maximum distance due to a higher overall dark count rate since four SPDs are needed instead of two.

We implemented a proof-of-principle experiment as illus- trated in Fig. 2. We started with the generation of a pair of correlated photons by type-0 SPDC in a fiber-pigtailed periodically-poled lithium-niobate waveguide (PPLN-WG).³⁸ The waveguide was pumped with a continuous wave diode laser (Toptica DL100), and the signal and idler photons were deterministically separated by dense wavelength division multiplexers. The idler photon was detected by a free-running InGaAs single-photon detector (ID Quantique ID220). The polarization of the heralded signal photon was set to jþi before passing through a Soleil-Babinet, which allowed us to rotate the state around the equator of the Bloch sphere and prepare Alice’s single-photon state. Bob’s device consisted of a balanced interferometer, with a polarization controller in the upper arm acting as a HWP and a piezo phase modulator in the lower arm. The outputs of the BSM corresponding tojU^%i andjW^%iwere delayed by 2.5 ns before being combined using two PBSs (see Fig. 2) with the other two outputs, which allowed the use of two detectors for all four outcomes. Bob’s free-running InGaAs SPDs operated at%90⁾C and had a dark count rate of less than 50 cps at 25% efficiency.³⁹The detection events were recorded by a time-to-digital converter (TDC). The g⁽²⁾(0) of the single photons at Alice was about 10^%³in a 1 ns coincidence window. The probability of having a double detection at Bob was<10^%⁶.

To analyze the detection outcomes for all combinations of Alice and Bob’s settings, we fixed the state prepared by Alice and scanned the phase of Bob’s interferometer. Figure3 shows four graphs, one for each of the polarization states chosen by Alice, representing the normalized probability of each Bell-state being announced at any given phase setting in Bob’s interferometer. The measurement points were fitted in order to calculate the visibility, with the highest average value obtained being 99.2%61.5% for thej%iiinput state and the lowest value of 96.0%62.1% for the j%i state.

FIG. 2. Experimental realization of the ddiQKD protocol. Labelled components include, dense wavelength division multiplexers (DWDM), bandpass filter (F), waveplates (WP), Soleil-Babinet compensator (SB), polarization controllers (PC), PM, 50/50 BS, PBS, and SPD.

(5)

TableIshows the theoretical Bell-state announcement probability for every combination of Alice and Bob’s settings.

We complete this correlation table with the experimental results by selecting points from Fig.3closest to the desired settings for Bob. The experimental values coincide with the predictions with an overall quantum bit error rate, Q, of 1.560.5%. The total detection rate was around 60 cps.

While the concept of ddiQKD is fundamentally the same as mdiQKD, some subtleties need to be pointed out.

For instance, in mdiQKD, the whole measurement device can be untrusted, whilst in ddiQKD, the trusted device boundary in Bob’s laboratory must include the linear optical elements of the BSM, leaving only the SPDs as untrusted devices. This is a reasonable scenario to consider, since it is typically the detectors themselves which are the most vulner- able part of a QKD system (see recent review⁴ for attacks targeting the detectors), whilst it is much easier to fully char- acterize the linear optical elements.⁴⁰ This means that Eve can have full control of the detectors, e.g., she can control their response functions.⁴¹However, Bob has to ensure that no additional information, other than the outcome of the BSM, leaks out of his lab. As with any other one-way QKD system, including mdiQKD, to prevent Trojan-horse attacks⁴² attempting to use back reflections, Alice and Bob have to install optical isolators and spectral filters. For an extended discussion of the security assumptions, please refer to Ref.29.

In practice, an implementation of ddiQKD using WCSs together with the decoy-state method could yield SKRs com- parable with existing GHz clocked systems.^19–22 In particular, ultra-fast generation of polarization states could be achieved using a birefringence modulator scheme as used in Ref. 43. We would like to highlight that the concept of TQSP entanglement employed in the ddiQKD scheme can be achieved by using any two DOFs of the single-photon.

For example, Alice could encode a time-bin qubit⁴⁴followed by Bob’s addition of a polarization qubit to the same photon.

In summary, we demonstrated a proof-of-principle experiment of the ddiQKD protocol, which overcomes the main disadvantages of the mdiQKD protocol whilst offering the same level of security. Future theoretical work should focus on deriving a bound on the extractable key length in a

finite key scenario. This work paves the way to practical, high-performance, and detector-side-channel free QKD.

We would like to acknowledge Gustavo Lima, Guilherme Xavier, and Marcos Curty for stimulating discussions regarding the basic idea. We thank ID Quantique and Battelle for the PPLN-WG and the Swiss NCCR QSIT for financial support.

1C. H. Bennett and G. Brassard, in Proceedings of IEEE International Conference on Computer Systems and Signal Processing, Banglore, India (IEEE, New York, 1984), pp. 175–179.

2N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden,Rev. Mod. Phys.74, 145 (2002).

3V. Scarani, H. Bechmann-Pasquinucci, N. Cerf, M. Du"sek, N. L€utkenhaus, and M. Peev,Rev. Mod. Phys.81, 1301 (2009).

4H.-K. Lo, M. Curty, and K. Tamaki,Nat. Photonics8, 595 (2014).

5L. Lydersen, C. Wiechers, C. Wittmann, D. Elser, J. Skaar, and V.

Makarov,Nat. Photonics4, 686 (2010).

6H.-K. Lo, M. Curty, and B. Qi,Phys. Rev. Lett.108, 130503 (2012).

7S. L. Braunstein and S. Pirandola,Phys. Rev. Lett.108, 130502 (2012).

8E. Biham, B. Huttner, and T. Mor,Phys. Rev. A54, 2651 (1996).

9H. Inamori,Algorithmica34, 340 (2002).

10A. Rubenok, J. A. Slater, P. Chan, I. Lucio-Martinez, and W. Tittel,Phys.

Rev. Lett.111, 130501 (2013).

11Y. Liu, T.-Y. Chen, L.-J. Wang, H. Liang, G.-L. Shentu, J. Wang, K. Cui, H.-L. Yin, N.-L. Liu, L. Li, X. Ma, J. S. Pelc, M. M. Fejer, C.-Z. Peng, Q.

Zhang, and J.-W. Pan,Phys. Rev. Lett.111, 130502 (2013).

12T. Ferreira da Silva, D. Vitoreti, G. B. Xavier, G. C. do Amaral, G. P.

Tempor~ao, and J. P. von der Weid,Phys. Rev. A88, 052303 (2013).

13Z. Tang, Z. Liao, F. Xu, B. Qi, L. Qian, and H.-K. Lo,Phys. Rev. Lett.

112, 190503 (2014).

14M. Curty, F. Xu, W. Cui, C. C. W. Lim, K. Tamaki, and H.-K. Lo,Nat.

Commun.5, 3732 (2014).

15F. Xu, H. Xu, and H.-K. Lo,Phys. Rev. A89, 052333 (2014).

16B. Frohlich, J. F. Dynes, M. Lucamarini, A. W. Sharpe, Z. Yuan, and A. J.

Shields,Nature501, 69 (2013).

17N. Sangouard, C. Simon, H. de Riedmatten, and N. Gisin, Rev. Mod.

Phys.83, 33 (2011).

18Star-type networking is possible with P&M systems;¹⁶however, the central node would have to be trusted.

19A. R. Dixon, Z. L. Yuan, J. F. Dynes, A. W. Sharpe, and A. J. Shields, Appl. Phys. Lett.96, 161102 (2010).

20A. Tanaka, M. Fujiwara, K.-i. Yoshino, S. Takahashi, Y. Nambu, A.

Tomita, S. Miki, T. Yamashita, Z. Wang, M. Sasaki, and A. Tajima,IEEE J. Quantum Electron.48, 542 (2012).

21N. Walenta, A. Burg, D. Caselunghe, J. Constantin, N. Gisin, O. Guinnard, R. Houlmann, P. Junod, B. Korzh, N. Kulesza, M. Legr!e, C. C. W. Lim, T.

Lunghi, L. Monat, C. Portmann, M. Soucarros, R. T. Thew, P. Trinkler, G.

Trolliet, F. Vannel, and H. Zbinden,New J. Phys.16, 013047 (2014).

FIG. 3. Experimental Bell-state measurement outcomes as a function of the phase setting inside Bob’s interferometer. Four sets of measurements are shown, one for each of the possible states sent by Alice.

221112-4 Limet al. Appl. Phys. Lett.105, 221112 (2014)

(6)

22B. Korzh, C. C. W. Lim, R. Houlmann, N. Gisin, M. J. Li, D. Nolan, B. Sanguinetti, R. Thew, and H. Zbinden, preprint arXiv:1407.7427 (2014).

23For a WCS,P1(l)¼le^%l, wherel<1 is the average photon number per pulse. Typical values ofgdetare 10%–30% for practical InGaAs SPDs.

24L. Vaidman and N. Yoran,Phys. Rev. A59, 116 (1999).

25N. L€utkenhaus, J. Calsamiglia, and K.-A. Suominen,Phys. Rev. A 59, 3295 (1999).

26R. Valivarthi, I. Lucio-Martinez, A. Rubenok, P. Chan, F. Marsili, V. B.

Verma, M. D. Shaw, J. A. Stern, J. A. Slater, D. Oblak, S. W. Nam, and W. Tittel,Opt. Express22, 24497 (2014).

27C. C. W. Lim, M. Curty, N. Walenta, F. Xu, and H. Zbinden,Phys. Rev. A 89, 022307 (2014).

28Y.-L. Tang, H.-L. Yin, S.-J. Chen, Y. Liu, W.-J. Zhang, X. Jiang, L.

Zhang, J. Wang, L.-X. You, J.-Y. Guan, D.-X. Yang, Z. Wang, H. Liang, Z. Zhang, N. Zhou, X. Ma, T.-Y. Chen, Q. Zhang, and J.-W. Pan,Phys.

Rev. Lett.113, 190501 (2014).

29P. Gonzalez, L. Rebon, T. F. da Silva, M. Figueroa, C. Saavedra, M.

Curty, G. Lima, G. B. Xavier, and W. A. T. Nogueira, preprint arXiv:1410.1422(2014).

30D. Boschi, S. Branca, F. De Martini, L. Hardy, and S. Popescu,Phys. Rev.

Lett.80, 1121 (1998).

31V. Scarani, A. Ac!ın, G. Ribordy, and N. Gisin, Phys. Rev. Lett. 92, 057901 (2004).

32D. Gottesman, H.-K. Lo, N. Lutkenhaus, and J. Preskill, Quantum Inf.

Comput.5, 325 (2004).

33N. J. Beaudry, M. Lucamarini, S. Mancini, and R. Renner,Phys. Rev. A 88, 62302 (2013).

34M. Tomamichel, C. C. W. Lim, N. Gisin, and R. Renner,Nat. Commun.3, 634 (2012).

35W.-Y. Hwang,Phys. Rev. Lett.91, 57901 (2003).

36H.-K. Lo, X. Ma, and K. Chen,Phys. Rev. Lett.94, 230504 (2005).

37X.-B. Wang,Phys. Rev. Lett.94, 230503 (2005).

38S. Tanzilli, A. Martin, F. Kaiser, M. De Micheli, O. Alibart, and D.

Ostrowsky,Las. Photon. Rev.6, 115 (2012).

39B. Korzh, N. Walenta, T. Lunghi, N. Gisin, and H. Zbinden,Appl. Phys.

Lett.104, 081108 (2014).

40In practice, this requirement could be fulfilled by adding appropriate filtering to ensure that the light state belongs to the correct optical mode.

41Q. Liu, A. Lamas-Linares, C. Kurtsiefer, J. Skaar, V. Makarov, and I.

Gerhardt,Rev. Sci. Instrum.85, 013108 (2014).

42N. Gisin, S. Fasel, B. Kraus, H. Zbinden, and G. Ribordy,Phys. Rev. A 73, 22320 (2006).

43T. Lunghi, J. B. Brask, C. C. W. Lim, Q. Lavigne, J. Bowles, A. Martin, H. Zbinden, and N. Brunner, preprintarXiv:1410.2790(2014).

44B. Korzh, N. Walenta, R. Houlmann, and H. Zbinden,Opt. Express21, 19579 (2013).