Long-distance and high-speed quantum key distribution

(1)

Thesis

Reference

Long-distance and high-speed quantum key distribution

BOARON, Alberto

Abstract

Depuis son invention en 1984, la distribution de clé quantique (QKD) a effectué d'énormes progrès techniques qui ont notamment permis sa réalisation sur des réseaux de télécommunication ou encore entre un satellite et une station terrestre. Au cours de cette thèse, j'ai réalisé diverses expériences dans le but d'améliorer les performances de la QKD, en termes de taux de répétition et de praticité d'utilisation, mais surtout en termes de distance maximale et de taux de clés secrètes. La partie centrale de mon travail repose sur la réalisation d'une plateforme de QKD à grande vitesse basée sur un encodage en time-bin ayant un taux de répétition de 2.5 GHz. L'utilisation d'un protocole BB84 simplifié a permis d'obtenir un dispositif expérimental simple, comprenant notamment un unique modulateur électro-optique ainsi qu'un appareil de détection entièrement passif et comprenant seulement deux détecteurs de photons uniques. Ce dispositif a permis tout d'abord d'effectuer une expérience à longue distance. En le couplant à des détecteurs supraconducteurs combinant faible taux de bruit et haute [...]

BOARON, Alberto. Long-distance and high-speed quantum key distribution. Thèse de doctorat : Univ. Genève, 2020, no. Sc. 5443

URN : urn:nbn:ch:unige-1469505

DOI : 10.13097/archive-ouverte/unige:146950

Available at:

http://archive-ouverte.unige.ch/unige:146950

Disclaimer: layout of this document may differ from the published version.

(2)

U

NIVERSITÉ DE

G

ENÈVE

F

ACULTÉ DES

S

CIENCES

Groupe de Physique Appliquée Professeur Hugo Z

BINDEN

Long-distance and high-speed quantum key distribution

Thèse

présentée à la Faculté des sciences de l’Université de Genève pour obtenir le grade de Docteur ès sciences, mention Physique

par

Alberto B

OARON

de Genève et d’Italie

Thèse N

^◦

5443

G

ENÈVE

Centre d’impression de l’Université de Genève

2020

(3)

(4)

Abstract

Since its invention in 1984, quantum key disribution (QKD) has done enormous technical progress which have enabled for instance its realisation on telecommunication networks or between a satellite and a ground station. In this thesis, I have realised experiments with the aim of improving the QKD performance. This includes its repetition rate and ease of use, but more importantly its maximal distance and secret key rate.

The centerpiece of my work is based on a high-speed QKD platform using time-bin encoding with a repetition rate of 2.5 GHz. A simplified BB84 protocol allowed to obtain a simple experimental setup, which comprises, for instance, a single electro- optic modulator as well as a passive detection apparatus with only two single-photon detectors. Combining this setup with low-noise and high-efficiency superconducting detectors enabled an exchange of secret keys at a record distance of 421 km of optical fibre. Moreover, I demonstrated the capacity of the system to work with single-photon avalanche diodes. Lastly, I investigated the low-attenuation and high detection rate operation regimes. Secret key rates approaching 10 Mbps have been achieved, which corresponds to the current state of the art. Further improvements are proposed in order to improve the results.

I also studied polarisation-based QKD using a source of polarisation BB84 states with a repetition rate of 625 MHz. This source enabled the realisation of a complete BB84 system, which achieved secret key rates of 23 bps at 200 km. It was also employed in a high-speed implementation of the detector-device-independent protocol. This work includes a detailed security analysis of this protocol.

(5)

(6)

Résumé

Depuis son invention en 1984, la distribution de clé quantique (QKD) a effectué d’énormes progrès techniques qui ont notamment permis sa réalisation sur des réseaux de télécom- munication ou encore entre un satellite et une station terrestre. Au cours de cette thèse, j’ai réalisé diverses expériences dans le but d’améliorer les performances de la QKD, en termes de taux de répétition et de praticité d’utilisation, mais surtout en termes de distance maximale et de taux de clés secrètes.

La partie centrale de mon travail repose sur la réalisation d’une plateforme de QKD à grande vitesse basée sur un encodage en time-bin ayant un taux de répétition de 2.5 GHz.

L’utilisation d’un protocole BB84 simplifié a permis d’obtenir un dispositif expérimental simple, comprenant notamment un unique modulateur électro-optique ainsi qu’un appareil de détection entièrement passif et comprenant seulement deux détecteurs de photons uniques. Ce dispositif a permis tout d’abord d’effectuer une expérience à longue distance. En le couplant à des détecteurs supraconducteurs combinant faible taux de bruit et haute efficacité de détection, il a été possible d’échanger des clés quantiques jusqu’à une distance record de 421 km de fibre optique. J’ai par ailleurs démontré la capacité du système à fonctionner avec des photodiodes à photon unique. Enfin, j’ai investigué le régime de fonctionnement à basse atténuation et haut taux de détection.

Des taux de clés secrètes approchant 10 Mbps ont été obtenus, ce qui correspond à l’état de l’art actuel. De futures améliorations sont proposées en vue d’augmenter ces performances.

J’ai également étudié la QKD basée sur la polarisation à l’aide d’une source d’états BB84 encodés en polarisation avec un taux de répétition de 625 MHz. Cette source a permis la réalisation d’un système BB84 complet capable d’obtenir des taux de clés secrètes de 23 bps à une distance de 200 km. Elle a également été utilisée dans une implémentation à haute vitesse du protocole detector-device-independent. Ce travail comprend une analyse détaillée de la sécurité de ce dernier.

(7)

(8)

1 Introduction

The need for transmission of confidential messages exists since thousands of years.

In today’s society, where telecommunication plays a fundamental role, cryptographic means are used daily by almost everyone. Among different uses, they enable for instance the exchange of sensitive diplomatic messages by governmental organisations but also the protection of individuals’ privacy or trade secrets of companies. After the revelations of Edward Snowden [1], the importance of protecting sensitive data should be obvious to everyone.

A perfectly secure exchange of encrypted messages between two remote parties, commonly denoted as Alice and Bob, can only be achieved via the Vernam’s one-time pad technique, which is the only encryption technique which is proven to be information- theoretic secure [2]. For that, Alice and Bob need to share a secret key, i.e. a random sequence of bits which is known only by them. The challenge is therefore to distribute a secret key between remote parties in a secure way. Today’s methods mostly rely on the combination of asymmetric and symmetric cryptographic protocols, whose security is based on computational assumptions, namely the fact that an eavesdropper, commonly denoted as Eve, requires a very large computational power to decrypt the ciphertext.

Public-key cryptography is threatened for several reasons. First, an attacker could possess an undisclosed algorithm enabling to find the secret key with a limited computational power. Then, the notion of computational power is relative because the computing capacity follows the rapid evolution of computer technology. In addition, some entities have access to large computing capacity. Finally, the most significant threat is probably the quantum computer which would enable the use of Shor’s algorithm to break the public-key cryptography [3]. Considering the recent advances in this field [4], its advent seems likely to happen in the coming decades. It can thus be concluded that the current algorithms are not a safe choice for applications which require long-term security¹and

1More precisely, the problem arises when the length of time the classically-encrypted data need to be secure is longer than the time for a large quantum computer to be built [5].

(11)

that new quantum-safe methods need to be adopted in the coming years.

One possible solution to this problem is quantum key distribution (QKD), which has attracted an increasing attention over the last decades. Following a totally different approach compared to classical cryptographic protocols, the security of QKD is based on the laws of quantum physics. Indeed, in quantum physics a measurement performed on a state will disturb it. Hence, if Alice and Bob exchange a key encoded in quantum states, an eavesdropper trying to obtain any information about the states will disturb them, thus introducing errors in their measurements. From the error rate, they can properly estimate the amount of information potentially obtained by Eve and consequently the amount of secure key which can be extracted from their measurement results. Importantly, unlike in classical cryptography, if the security of the key has been guaranteed at the time of the exchange, the eavesdropper cannot attack it afterwards.

The first QKD protocol was the well-known BB84 protocol, proposed in 1984 by Bennett and Brassard [6]. Since then, a large number of protocols have been proposed offering various levels of security, complexity and performance. This thesis focuses on prepare- and-measure (P&M) discrete-variable (DV) QKD, where Alice prepares qubit states onto single photons. QKD can also be based on continuous-variables states. This is the so-called continuous-variable (CV) QKD, proposed by Ralph in 1999 [7] where the states are encoded in the field quadrature of weak coherent pulses.

While usual protocols assume some level of trust in the devices, another class of protocols has been proposed, in which part of the setup is untrusted. These protocols are referred to as device-independent (DI) QKD. They are, however, very demanding to implement.

In the full DI-QKD, proposed in 2007 by Acinet al., the security of the key generation is guaranteed by the violation of a loophole-free Bell test [8, 9]. The DI-QKD ensures the highest security level but provides, in the best case, very low secret key rates (SKRs) and is not loss-tolerant. To solve this issue, Lo, Curty and Qi, proposed an approach called measurement-device-independent (MDI) QKD, where the measurement apparatus is untrusted [10]. This approach is a good compromise between complexity and security.

To improve the rates of the MDI-QKD, Lucamariniet al.[11] proposed in 2018 a new protocol called twin-field (TF) QKD, where the measurement device is also untrusted, but exhibits a better SKR versus distance dependence.

On the experimental side, the first experimental demonstration in 1992 [12] was followed by rapid progress. Among many significant developments, we can cite exchanges of secret key over several hundreds of kilometres of optical fibre [13, 14, 15], but also free-space experiments [16] including a QKD link between a satellite and a ground station [17, 18]. Repetition rates of the systems have been increased beyond the GHz [19, 20, 21]. Finally, SKRs exceeding 10 Mbps have been achieved [22].

In this thesis the main focus was to push the limits of QKD in terms of repetition rate,

(12)

maximum transmission distance and SKR and at the same time keeping the implementation as simple as possible. Moreover, even though the main aim was not to build a commercial system, in many respects the realisations have a high level of practicality.

The centrepiece of the work is the implementation of a high-speed time-bin QKD platform with a repetition rate of 2.5 GHz. It was operated over optical fibre with different types of single-photon detectors (SPDs) and was based on an optimised version of a BB84 protocol. A second focus was using polarisation-based QKD. A polarisation-based BB84 with a repetition rate of 625 MHz was realised. The source of BB84 states was also employed in a detector-device-independent scheme which is a kind of DI protocol.

Outline of the thesis

Chapter 2 presents a review of the basic QKD concepts that we use. We then discuss improvements made to the BB84 protocol which render the implementation simpler and more efficient. The first modification consists of a decoy encoding with only two mean photon numbers whose performance in the finite-key regime is discussed (as well as in appendix A.3: Finite-key analysis for the 1-decoy state QKD protocol). The second modification is a BB84 protocol with less states prepared and detected (see also appendix A.6:Security proof for a simplified Bennett-Brassard 1984 quantum-key-distribution protocol).

The full QKD setup is described in chapter 3. It also includes a description of the optical fibres used in the experiments as well as a discussion of the limitations imposed by the chromatic dispersion. The main requirements of the SPDs for QKD are presented together with a basic description of the two detector types used in the experiments.

The experimental results obtained with the high-speed platform are presented in chapter 4. They include an experiment realised with single-photon avalanche diodes (SPADs) with an emphasis on the system simplicity and practicality (see also appendix A.4:

Simple 2.5 GHz time-bin quantum key distribution). Moreover, an experiment was performed with superconducting nanowire single-photon detectors (SNSPDs) and allowed to achieve a transmission of secret keys over a record distance of 421 km of fibre (see also appendix A.5:Secure Quantum Key Distribution over 421 km of Optical Fiber). Lastly, an experiment which has a target of achieving high rates over short distances is presented. Intermediary results corresponding to the state of the art are outlined as well as improvement perspectives.

Finally, the main results of two polarisation-based QKD setups are summarized in chapter 5. They correspond to appendix A.1: Detector-device-independent quantum key distribution: Security analysis and fast implementationand appendix A.2:Simple and high- speed polarisation-based QKD.

(13)

(14)

2 Protocols

This chapter is divided in two parts. The first one consists of a review of the basic theoretical concepts which are used in the experiments. In particular, the BB84 protocol is described, along with its implementation using the decoy-state time-bin encoding.

The second part covers possible simplifications to the BB84 protocol. We discuss a decoy encoding method with only two mean photon numbers and its performance in the finite-key regime. We then present the 3-state BB84 protocol. Finally, the latter is further simplified to obtain a BB84 protocol with less states detected by Bob. The 1-decoy state protocol and the BB84 protocol with less states detected by Bob were developed during this thesis within the research group, the main contributor being Davide Rusca. Other concepts in this chapter existed previously.

2.1 General principles of QKD

P&M protocols are usually composed of several steps involving manipulation of quantum states or classical information processing. First, Alice prepares quantum states and sends them over a quantum channel to Bob, who measures them. Alice and Bob communicate publicly their preparation/measurement bases and discard the incompat- ible events. A fraction of the events is used to estimate the eavesdropper’s potential information. The bit errors from the remaining fraction of the key are then removed through an error correction procedure. Finally, the size of the key is reduced through the privacy amplification procedure such that the remaining eavesdropper’s potential information is zero (except with a very small probability). In QKD, the bit error rate has the appellationquantumand is hence abbreviated QBER.

2.1.1 The BB84 protocol

The BB84 protocol can be implemented using for instance the polarisation degree of freedom of photons in the following way.

(15)

1. State preparation: Alice prepares states chosen at random among the four states {|^Hi^,|^Vi^,|+i = 1/√

2(|^Hi+|^Vi),|−i = 1/√

2(|^Hi − |^Vi)}(called BB84 states) and sends them to Bob over the quantum channel. These states belong to two mutually unbiased bases: the horizontal/vertical basis (Z) or the diagonal/antidiagonal basis (X).

|^Hi^and|+iare associated with bit 0 and|^Vi^and|−iwith bit 1.

2. State measurement:Bob measures the states either in theZorXbasis.

3. Basis reconciliation: Alice and Bob disclose over the classical channel the chosen bases. They discard the events where they have used different bases. The resulting key is calledsifted key.

4. Parameter estimation: For the events in theXbasis, they also disclose the bit value prepared/measured. This allows them to estimate Eve’s information.

5. Error correction (EC):They use the events in theZbasis, calledraw key, to generate the key. Alice and Bob correct the errors in it using a classical error correction algorithm.

They end up with two identical keys calledcorrected key.

6. Privacy amplification (PA):Finally, they reduce the size of the the corrected key such that Eve’s information about the final key, calledsecret key, is zero, except with a very small probability.

In the infinite key regime, the maximum lengthlof the secret key extractable is [23]

l≤^sZ,0+s_Z,1−^sZ,1h(φZ)−^λEC. (2.1)

s_Z,0ands_Z,1are the lower bounds on the number of vacuum and single-photon detections in theZbasis, that is to say, events originating from vacuum and single-photon pulses, respectively. h(x) =−^x^log2x−(1−^x)log₂(1−^x)is the binary entropy function.φZ

is the upper bound on the phase error rate. h(φZ)corresponds to the upper bound on Eve’s information before the EC. Finally,λ_ECis the total number of bits revealed during the EC.

2.1.2 Time-bin BB84

Time-bin encoding is a very natural choice for implementing a QKD protocol. It is often preferred over polarisation-based encoding because it requires no stabilisation of the quantum channel. Let|⁰i^and|¹ibe two temporal modes that we denote asearlyand late, respectively. Time-bin states take the form (in case of single-photon)

|^ψi=α|⁰i+β|¹i^. ^(2.2)

The BB84 protocol can be performed using time-bin encoding with states in theXandY bases:

|^ψi= √¹

2(|⁰i+e^iφ^a|¹i), φ_a ∈ {^0,^π/2,^{π, 3π/2}}^. ^(2.3)

(16)

2.1. General principles of QKD

PMAφ_a ^PMBφ_b

SPDs Laser

Alice Bob

(a)

PMφ_a

SPDsX basis Laser

Alice

IM

BS

Bob

^SPD

Z basis

(b)

Figure 2.1: Simplified schematics of time-bin QKD setups. (a) Implementation based on the states of equation (2.3). (b) Implementation based on the states of equation (2.4).

PM: phase modulator; IM: intensity modulator; BS: beamsplitter; SPD: single-photon detector.

This can be implemented with the setup sketched in figure 2.1a. The state preparation is carried out with an unbalanced Mach-Zehnder interferometer. A phase modulator placed in one arm controls the phaseφaencoded by Alice. For the measurement, a similar interferometer associated with two SPDs at its outputs is employed. By choosing a phase φ_bwhich is either 0 orπ/2, Bob projects the states onto theXorYbasis, respectively.

It is also possible to choose states in theZandXbases:

|^ψi ∈ {|⁰i^,|¹i^,|+i= √¹

2(|⁰i+|¹i),|−i = √¹

2(|⁰i − |¹i)}^. ^(2.4) The generation and detection of those states, which is sketched in figure 2.1b, is slightly different. On Alice’s side, the states of theZbasis (|⁰i^and|¹i) require indeed an intensity modulator (IM). On Bob’s side, the basis choice is performed with a beamsplitter. The measurement in theZbasis just requires a detector which measures the arrival time of the photons. The measurement in the X basis is performed with an unbalanced interferometer similar to that of Alice, but without phase modulator.

2.1.3 QKD with weak coherent pulses

Ideally Alice would prepare her states onto single photons. However, today’s sources of single photons are highly impractical for an integration in a QKD system and their repetition rates are low compared to state-of-the-art QKD [24]. Alice can instead encode her states into weak coherent pulses, where the photon distribution follows Poisson

(17)

statistics. The probability of finding nphotons in such a coherent state with a mean photon numberµis given by

P(n,µ) = ^µ

ne⁻^µ

n! . (2.5)

Qualitatively, for aµlow enough, most of the pulses will contain 0 or 1 photon. We denote these pulses as vacuum and single-photon pulses, respectively. While these pulses are secure, the multiphoton pulses (where Alice has sent more than 1 photon) are vulnerable to the so-called photon number splitting (PNS) attack which works as follows [25, 26]. Eve performs a photon number measurement on each pulse sent by Alice. If the pulse contains 0 or 1 photon, she blocks it. If not, she keeps one photon, stores it in a quantum memory and lets the rest of the pulse continue to Bob. After the basis reconciliation, she can measure her photon in the same basis as Bob, gaining full information about the bit value. Moreover, the photons which arrived to Bob are undisturbed, therefore generating no errors. The consequence is that when weak coherent pulses are used, Alice and Bob have to subtract from their detection events the number of multiphoton pulses sent. This forces Alice to choose aµwell below 1 to keep the number of multiphoton pulses small compared to the detection events. QKD with weak coherent pluses implemented in this way, therefore exhibits a performance as a function of the transmission which is much worse than that of QKD with single photons.

2.1.4 Decoy-state QKD

The solution for mitigating the PNS attacks and at the same time regain a performance close to the QKD with single photons is the so-called decoy-state QKD. Alice encodes each state with a mean photon numberµ_ichosen at random among a set of mean photon numbers. The effect of a PNS attack varies for the differentµ_i, because the blocking probability depends onµ. Since Eve has no access to theµencoded, Alice and Bob can detect a PNS attack by checking the detection statistics corresponding to eachµ_i. The decoy-state protocol was proposed by Hwang in 2003 [27]. Loet al.published a complete security proof in 2005 for an infinite amount of intensities [28]. A solution for practical QKD came with Wang [29], which introduced the decoy method with only three mean photon numbers, that has become a standard way of implementing decoy-state QKD.

This is the so-called 2-decoy state protocol. Limet al.derived in 2013 concise and tight finite-key security bounds for the 2-decoy state QKD [23]. This method enables the estimation of the lower bounds ons_Z,0ands_Z,1as well as the upper bound onφZwhich are required to calculate the secret key length in equation (2.1).

To implement a time-bin BB84 protocol with the 2-decoy method, Alice’s setup should be capable of generating the 12 states depicted in figure 2.2 (we considered the BB84

(18)

2.2. Simplifications to the BB84 protocol

basis, bit state µ1 µ2 µ3

Z, 0 |0i Z, 1 |1i

X, 0 |+i X, 1 |−i

Figure 2.2: Encoding of the states sent by Alice in the time-bin 2-decoy BB84 protocol.

states of equation 2.4). This requires both phase and intensity modulation capacity¹. Note that for the choice of the threeµ_i, the optimum is to set one of them (µ₃) close to the vaccum state [30] (as far as permitted by the state preparation setup).

2.2 Simplifications to the BB84 protocol

As seen previously, the standard implementation of the BB84 protocol together with the 2-decoy encoding requires the preparation of 12 states and the detection of 4 states. We simplify the standard BB84, such that our experimental realisation relies on a protocol where Alice prepares only 6 states and Bob detects 3 different states. In what follows, we first describe a decoy protocol with two mean photon numbers and then present a BB84 protocol with less states prepared and detected. These simplifications enable an easier implementation. Among other improvements, they allow to get rid of the requirement of phase modulation capacity.

2.2.1 The 1-decoy state protocol

The first modification is to use the decoy protocol with only one signal and one decoy state, which we will denote as the 1-decoy state protocol. The idea of implementing the decoy-state protocol in such a way was first proposed by Maet al.[30]. However, the analysis was carried out in the infinite-key regime only, where the 2-decoy outperforms the 1-decoy. In the finite-key regime, the situation is somewhat different. It appears that for most experimental settings and for most attenuations, the SKRs of the 1-decoy are slightly better than those of the 2-decoy. The details of the former protocol and a thorough comparison between the two protocols in the finite-key regime are presented in Appendix A.3.

1Considering the BB84 states of equation 2.3 would require the same modulation capacity.

(19)

The main difference compared to the 2-decoy state protocol lies in the estimation of the number of single-photon eventss_Z,1. The estimation of the lower bound of this quantity requires the upper bound of the vacuum eventss_Z,0 (while in the 2-decoy protocol it requires its lower bound). Since we cannot calculate the latter directly from the detection events, we employ a different method which relies on the fact that the probability of error from a vacuum event is 1/2. We obtain the number of vacuum events by considering that the total number of errorsm_Z,k(for the mean photon numberk) were due to vacuum events. Naively this would translate ass_Z,0is smaller than or equal to twice the number of errors. After a careful derivation, taking into account the finite-key analysis (with a failure probabilityε) and using only the errors relative to one mean photon numberk (which turns out to be optimal), we obtain

s_Z,0≤² ^τ0

e^k

p_k m_Z,k+ rmZ

2 log1 ε

! +

rnZ

2 log1 ε

!

, (2.6)

whereτ₀is the total probability to send a zero-photon state, p_k is the probability that Alice sends the mean photon numberk,m_Zis the total number of errors in theZbasis andnZis the total number of detections in theZbasis. It should be stressed that this method does not reduce in any respect the security of the protocol. This is indeed a pessimistic estimate, since only part of the errors are due to vacuum events (through the dark count rate (DCR) and the afterpulsing of the detectors), the rest originating from imperfections of the state preparation and measurement as well as from the channel decoherence.

We have simulated the performance of the 1-decoy and the 2-decoy protocols for different detector types (SNSPDs and SPADs) as well as different PA block sizes (between 10⁵ and 10¹¹). The results for the SNSPDs and considering a repetition rate of 1 GHz are summarized in figure 2.3. It appears that generally speaking the two protocols lead to very similar SKRs, which differ by no more than ∼ 10 %. Going into more detail, three trends can be identified. At low attenuation (0 to∼20 dB), the 2-decoy protocol is advantageous. Because of detector saturation, sending vacuum pulses does not reduce much the number of detected events while allowing a better estimate of the vacuum events. At medium to high attenuation (∼^{20 to}∼ 64 dB), the 1-decoy works best. In this range, sending vacuum events is detrimental for the number of detected events.

Moreover, having less states means having more events per state, which reduces the impact of the finite-key corrections. At high attenuation, just before the SKR quickly drops to zero, the 2-decoy protocol is again advantageous. However, this region is of little interest because it generally corresponds to impractical acquisition times exceeding one day. Finally it should be noted that for very large PA block sizes starting around 10¹⁰, the 2-decoy obviously outperforms the 1-decoy, but the corresponding acquisition times are impractical, if not unmanageable.

To sum up, the 1-decoy state protocol is more than an alternative to the 2-decoy. It is a

(20)

0.1 1 10 100 1000 10000 100000 1×10⁶ 1×10⁷

0 10 20 30 40 50 60 70 80

a)

SKR (Hz)

Global attenuation (dB) n_z = 10⁵

10⁷ 10⁹ 10¹¹

−20

−10 0 10 20 30

0 10 20 30 40 50 60 70 80

b) b)

SKR difference (%)

Global attenuation (dB) n_z = 10⁵

10⁷ 10⁹ 10¹¹

Figure 2.3: (a) Simulation of the SKR as a function of the attenuation for different PA block sizes for the 1-decoy state (continuous line) and the 2-decoy state (dashed line) protocols. (b) Relative SKR difference between the two protocols. The detection efficiency is included in the global attenuation.

much more reasonable way of implementing the decoy-state QKD which can greatly facilitate experimental realisations without affecting the performance. In our opinion, the 1-decoy should in general be preferred to the 2-decoy. This latter can be chosen in situations where it can lead to higher SKRs, that is at low attenuation, provided that this does not imply an unreasonable increase in complexity. It would be interesting to investigate if the 1-decoy encoding can be applied to the MDI-QKD. This protocol requires indeed an estimation of numerous terms which requires large PA block sizes.

Using the 1-decoy encoding, could greatly reduce the number of terms and hence, following the same reasoning as above, allow the use of smaller PA blocks.

(21)

2.2.2 A simplified BB84 protocol

The 3-state BB84 protocol

Another simplification consists of using the 3-state BB84 protocol which was proposed in 2006 by Fung and Lo [31]. In this protocol, Alice sends two states in theZbasis and only one in theXbasis. Its security has been proven in 2014 by Tamakiet al. [32]. In addition, they have shown that not all four BB84 states are necessary and that equal SKR can be achieved with three or four states.

Using the 3-state BB84 protocol with the encoding of equation (2.4), we obtain the following states:

|^ψi ∈ {|⁰i^,|¹i^,|+i}^. ^(2.7)

This enables a simplification of the preparation setup. Since|−iis not used anymore, phase modulation is not required and the three states can be generated using only an IM.

A BB84 with less states detected by Bob

In the work presented in appendix A.6, we propose further simplifications to the 3-state BB84 which allow to simplify its experimental implementation and in particular Bob’s setup. In the 3-state BB84 protocol (as in the standard BB84 protocol), Bob has the ability to measure the states in the two bases,ZandX, that we denote asdataandmonitoring lines, respectively. The corresponding states detected are |⁰i^,|¹i ^and |+i^,|−i^{. It is} however possible to use a scheme where Bob measures only three states. We consider the case where he has access to |⁰i ^and |¹i ^{in the} ^Z basis but only to |−i ^{in the} ^X basis. This requires a new expression for the estimation of the phase error rate. We derive an expression with terms which do not depend on events where Bob detects|+i^. Note, however, that this expression takes into account detections in both the data and the monitoring lines. This has a small drawback, namely that it is necessary to know precisely the probability of choosing each basis as well as the detection efficiency of each detector. It should be noted that the BB84 protocol with less states detected by Bob is not specific to the time-bin encoding.

Implementing theXbasis measurement with the encoding of equation (2.7) requires an unbalanced interferometer (as shown in figure 2.1b). Bob can use different setups which are sketched in figure 2.4. When the full detection scheme with four states is considered, in order to measure |+i^and|−i, it is necessary to monitor both outputs of the interferometer (each output corresponding to one state). This can be achieved either by using a Mach-Zehnder type interferometer which has two outputs (a) or by using a Michelson type interferometer preceded by a circulator (b). The scheme with

(22)

SPDs

(a)

FM FM SPDs

CIR

(b)

FM SPD FM

(c)

Figure 2.4: Possible implementations of Bob’s measurement scheme in the X basis.

Setups (a) and (b) enable the measurement of both|+i^and|−i, while (c) can measure only|−i. (a) with a Mach-Zehnder interferometer, one detector can be placed at each output. (b) in a Michelson interferometer, the second output coincides with the input.

A circulator is therefore required to detect the second state. (c) to detect only one state, it is sufficient to place a detector in one arm of a Michelson interferometer. SPD:

single-photon detector; CIR: circulator; FM: Faraday mirror.

Alice Bob det

(a)

t0 t1 t2 t0 t1 t2 t0 t1 t2

Alice Bob det

(b)

+

t0 t1 t2 t0 t1 t2 t1 t0+t2 t1

t0+t2 t0+t2

Figure 2.5: States prepared by Alice and detected by Bob in the monitoring line. Since the interferometer can delay the pulses by one time-bin, there are three detection times for each qubit. (a)t₀andt₂depend only on the time-bins early and late, respectively.

The interference between the time-bins early and late takes place att₁. Since Bob projects onto the state|−i, when Alice sends the state|+ithe interference is destructive and consequently no detection should occur int₁. (b) When the qubit duration corresponds to the double of the time-bin duration, there is an overlap of the detection timest0and t₂of consecutive qubits.

only three states detected by Bob enables to implement the measurement in theXbasis using a Michelson type interferometer and only one detector (c). It is clear that this latter solution is favourable. First, it allows to use only one detector instead of two (in theXbasis). Moreover, using a Mach-Zehnder requires polarisation management which implies a more complex setup and consequently reduces the phase stability of the interferometer. Finally, option (b) requires to characterise (and trust) the circulator loss as well as the detectors’ efficiencies.

Application to the time-bin encoding

In the case of time-bin encoding, the detection in the monitoring line, after the interferometer, can occur at three different times denoted as t0,t₁,t2(see figure 2.5a). The interference between the time-bins early and late occurs att₁which is therefore an actual

(23)

basis, bit state µ1 µ2

Z, 0 |0i Z, 1 |1i X, 0 |+i

Figure 2.6: Encoding of the states sent by Alice in the time-bin 1-decoy simplified BB84 protocol.

measurement in theX basis. By contrast,t0 (t2) depends only on the time-bin early (late). This means that detections at timest₀andt₂can be seen as projections in theZ basis. This feature enables the derivation of an expression for the phase error rate which depends only on detections events in the monitoring line.

In general, if the qubit duration (the inverse of the repetition rate) is long enough compared to the time-bin duration (the time delay between|⁰i^and|¹i), Bob has access to the three detection times after the interferometer². To increase the repetition rate, the most efficient way of implementing the time-bin encoding is when the duration of a qubit is two times the duration of a time-bin (see figure 2.5b). However, when such a scheme is employed, the time-bint₀ of one qubit overlaps with the time-bint₂of the previous qubit. We therefore adapt once again the phase error rate calculation to match this situation. Finally, we show how to combine the simplified time-bin BB84 presented above with the 1-decoy encoding.

Summary: a simplified time-bin BB84 protocol

To sum up, we have developed a simplified BB84 protocol where Alice prepares only three states ({|⁰i^,|¹i^,|+i}) and Bob projects onto only three states ({|⁰i^,|¹i^,|−i}^{). Fig-} ure 2.6 shows the states prepared by Alice when this protocol is implemented with the time-bin encoding and the 1-decoy state method. This enables an efficient implementation where Alice employs only one IM and Bob has a stable and passive measurement apparatus with two detectors in total. This experimental setup is described in detail in the next section.

2This is the case when the qubit duration is at least three times the time-bin duration.

(24)

3 Time-bin QKD - implementation

Time-bin QKD has been used in numerous experimental demonstrations [21, 14]. In particular, most of the experiments realised in our group are based on time-bin encoding [33, 34, 35, 13]. This encoding has the advantage that it requires no stabilisation of the quantum channel. It is therefore also used in commercial systems [36, 37]. In this chapter we describe our main setup, a time-bin QKD platform which has a repetition rate of 2.5 GHz. The goal is to highlight the requirements of each component, describe and motivate our technical choices as well as to provide a characterisation of the system building blocks.

The general overview of the experimental platform is depicted in figure 3.1. We describe first the lower dashed box which contains the state generation (Alice’s optics and electronics), the state transmission (quantum channel) and the state acquisition (Bob’s optics and electronics). Then, we describe the upper dotted box, that consists of the signal generation and the experiment control by the FPGAs and the PCs. The optical setup is sketched in figure 3.2.

3.1 A source of BB84 states clocked at 2.5 GHz

3.1.1 Laser

The light source is a distributed feedback laser at 1550.92 nm [Gooch & Housego AA0701].

We operate it in gain-switched mode at a repetition rate of 2.5 GHz. The driving electric pulses which are generated by a radio-frequency pulse generator [HP 8133A] have an amplitude of∼^{2.5 V.}

A requirement for the laser pulses is the phase randomisation, which means that consecutive pulses have a random phase [38]. The gain-switching ensures a priori the phase randomisation, on condition that when an electric pulse is applied to switch the laser on, the laser cavity contains no photons from the previous pulse. The new pulse is

(25)

10 Gbps service channel

Optics High-speed electronics FPGA

settings

detection stat.

PC keys PC

quantum channel digital RF signals

analog RF signals

FPGA synchronisation

sifting

error correction ethernet link

Optics detection stat.

keys

High-speed electronics analog RF signals

digital RF signals

settings

error correction, service communication

Alice Bob

Figure 3.1: Block diagram of the QKD platform. The experiment control is performed by two FPGAs and two PCs (upper dotted box). The state preparation is performed by high-speed electronics and optics (lower dashed box). Alice’s and Bob’s setup are connected through a 10 Gbps service channel used for synchronisation, sifting and error correction (at high rate). An Ethernet link is used for error correction (at low rate) and service communication.

FM PiezoFM

FM FM

IM DCF SMF

Alice

Bob

VA

Filter

BS

Laser

SNSPDs

Figure 3.2: Schematics of the optical part of the setup. Laser: 1550 nm distributed feedback laser; Filter: 270 pm bandpass filter; Piezo: piezoelectric fibre stretcher; FM:

Faraday mirror; IM: intensity modulator; DCF: dispersion compensating fibre; VA:

variable attenuator; SMF: single-mode fibre; BS: beamsplitter; SNSPDs: superconducting nanowire single-photon detectors. Dashed lines represent temperature stabilised boxes.

(26)

3.1. A source of BB84 states clocked at 2.5 GHz

thus initiated by a seed photon created from spontaneous emission and has therefore a random phase. However, as shown in reference [39] this is not always the case when the driving frequency exceeds a few GHz. We therefore tested the phase randomisation of our laser in different configurations. The first one was with a laser repetition rate of 2.5 GHz. We sent pulses through a Michelson interferometer with an arm length difference of 800 ps and measured the visibility at the output port. Note that this arm length difference was chosen for practical reasons and results in an interference of pulses separated by two periods (instead of consecutive pulses). This already provides some information about the phase randomisation, because if there is some phase correlation between two consecutive pulses, there should also be some correlation between pulses which are two periods apart. We could not observe any such phase correlation. The phase randomisation for a repetition rate of 5 GHz was also tested and resulted in a visibility of 0.15 % for consecutive pulses.

The laser pulse duration is ∼ 50-60 ps. Since the pulses are chirped, it is possible to reduce their temporal duration through filtering. We filter them with a tunable narrowband filter which has a 270 pm bandwidth. This reduces the pulse duration down to∼30 ps. The laser is placed in a temperature stabilised box to minimise spectrum and power fluctuations.

3.1.2 Unbalanced interferometer

The laser pulses are sent through an unbalanced interferometer with an arm length difference of 200 ps, which leads to each laser pulse generating two pulses with a fixed phase. We employ the Michelson configuration with Faraday mirrors which requires no polarisation management. To adjust the interferometer phase, the fibre of one arm is wrapped around a piezoelectric cylinder. By applying a voltage between 0 and 110 V on the cylinder, we are able to change the phase by∼^{6π. A 2π}range would in principle be sufficient to perform the phase stabilisation. Phase fluctuations of the interferometer are due to temperature changes which affect the path length difference between the two arms. To minimise this effect, we kept the arm length as short as possible, around 40 cm. The minimum length is limited by the circumference of the piezoelectric cylinder (∼12 cm) and by the fibre length necessary to perform splices (∼10 cm per splice).

The loss of the two arms should be balanced for two reasons. The first reason is that a difference in loss reduces the visibility of the interferometer, therefore increasing the QBER. That being said, this effect is rather limited because even a loss imbalance as big as 0.5 dB leads to a visibility of 99.8 % which corresponds to a QBER contribution of less than 0.1 %. In practice it is easy to achieve a loss difference smaller than a few tenth of dB. The second reason is that the mean photon number per qubit should be independent of the state encoded. A loss imbalance would result in having different mean photon numbers for the states|⁰i^and|¹i^.

(27)

3-bit DAC FPGA

10 GHz transceivers

IM AMP

bit 0 bit 1 bit 2 clock

Delays

Figure 3.3: Intensity modulator driving electronics. DAC: digital-to-analog converter;

AMP: radio-frequency amplifier; IM: intensity modulator. Thin blue lines: digital signals;

thick dark lines: analog signal. The FPGA outputs three high-speed signals (bit 0, 1 and 2) and a clock. A custom variable delay card is used for signal resynchronisation.

A 3-bit DAC converts the digital signal to an analog signal which is amplified by a radio-frequency amplifier.

3.1.3 High-speed driving electronics

To prepare the states shown in figure 2.6 Alice should generate four different mean photon numbers:µ₁,µ₂ =µ₁/2,µ₂/2 and 0. To do this, Alice’s FPGA outputs several digital high-speed signals, which are converted to an analog signal, amplified and sent to the IM to generate the required optical pulses. A schematics of the driving electronics is shown in figure 3.3. In principle, four analog levels could be encoded by only two bits (encoded in two digital signals) but we use three bits in order to adjust the four levels independently. More precisely, the FPGA outputs three digital high-speed signals with a bit rate of 5 GHz (corresponding to a pulse length of 200 ps) and a clock with a period of 5 GHz (pulse length of 100 ps). Each FPGA channel is delayed independently by a custom-made electronic card for the signals resynchronisation (deskewing). This feature is nice to have in a prototype system, but could be removed in a further version by carefully adjusting the track length of the different bits. The DAC [SHF 611 D] can operate at symbol rates up to 32 GBaud and its maximal output amplitude is 805 mV.

The amplitude of each bit can be adjusted. The electric pulses are finally amplified by a radio-frequency amplifier [Picosecond 5865] with a 12 GHz bandwidth. Their final maximal amplitudes are up to 7 V.

3.1.4 Intensity modulator

We use a lithium niobate (LiNbO₃) IM (IXblue MXER-LN-10) to modulate the intensity of the pulses exiting the interferometer. It has a 12 GHz bandwidth and a static extinction ratio (ER) of 35 dB. A high ER is necessary to prepare accurately the states|⁰i^and|¹i^. The contribution of the ER, notedr_e, to the QBER in theZbasis can be modelled as

Q_Z,ER = ^r^e

1+re. (3.1)

We have also tested an IM with an ER of 30 dB and could not observe a significant QBER change between 30 and 35 dB. The IM insertion loss is 3.5 dB but this is not a relevant

(28)

3.2. Transmission over optical fibres

parameter, since additional attenuation should anyway be inserted at the end of Alice’s setup to obtain the desired mean photon number per pulse. The IM exhibits polarisation dependency, both in terms of loss and ER. We therefore control the incoming polarisation with a polarisation controller.

The bandwidth of the whole driving electronics chain and the IM is crucial to achieve a state generation with a small preparation error. Note that an even more relevant quantity (which is closely related to the bandwidth) is the rise time. It should be short enough to avoid the so-called patterning-effect, namely to guarantee that the value encoded by the IM is independent from the values encoded previously. If this condition is not fulfilled, on one side the QBER is worsened and on the other side the patterning-effect can represent a security threat [40]. We ensure that at the IM, the optical pulses coincide with the end of the electric pulses to minimise the pattering-effect.

3.2 Transmission over optical fibres

Optical fibres allow to efficiently send photons over distances of hundreds of kilometres, that is why they are a common choice as a communication channel for QKD systems.

They are also widely employed for classical communication, their applications ranging from intercontinental cables up to fibre to the home networks. This means that they are readily accessible even for practical implementations of QKD which require installed links.

3.2.1 Fibre loss

The most important feature of optical fibres is the low loss. Commercial single-mode optical fibres typically exhibit loss around 0.2 dB/km in the telecom window (∼^{1550 nm).}

The total loss is the sum of different factors which can be split into intrinsic factors such as Rayleigh scattering, infrared absorption and ultraviolet absorption as well as extrinsic factors such as absorption due to transition metals or OH ions, waveguide imperfections and bending loss. In practical situations, extra loss is due to connectors and splices between different spools. Connector loss is typically around 0.1 dB per connector for FC-UPC type connectors which are used in the experiments presented in this thesis. The loss due to a splice is typically smaller than 0.1 dB unless fibres with different mode field diameters are spliced together. Most of the optical fibres we use are provided in spools of 25 km which are connected one to each other either with splices or connectors.

By checking carefully the quality of the splices and connectors and by ensuring that no bending loss arises due to small bending radius, we are able to have a final total loss which is only∼0.01 dB/km higher than the loss of the fibres themselves.

For long-distance operation, we use Corning^R SMF-28^R ultra-low loss (ULL) fibre

(29)

which exhibit loss of only 0.16 dB/km [41]. It is commercially available and is typically used in transoceanic submarine links. While standard single-mode fibres (SMFs) are composed of a doped core and a pure silica cladding, ULL fibres have a pure silica core and a fluorine doped cladding [42].

3.2.2 Dispersion management

Both the standard and ULL fibres have a chromatic dispersion which is∼^{17 ps nm}⁻¹^km⁻¹ at 1550 nm. For our system, which has a 2.5 GHz repetition rate, this dispersion hinders the exchange of secret keys already over distances of a few tens of kilometres. For instance, given that our source has a bandwidth of 270 pm, the dispersion after 50 km is 230 ps which obviously has a tremendously detrimental effect on the signal reaching Bob.

We therefore pre-compensate the quantum channel dispersion by placing dispersion compensating fibre (DCF) inside Alice’s setup.

The DCF is fabricated by Corning Inc. and its dispersion is around−^{140 ps nm}⁻¹^km⁻¹^. The fibre has a loss of 0.5 dB/km. An additional loss of∼1-3 dB arises at the interface between DCF and SMF due to the mode field diameter mismatch. Note that the DCF loss is not a problem since it is included in Alice’s setup and is not part of the quantum channel. Also, we have not seen any performance deterioration due to the usage of the DCF (due for instance to reflections at the DCF/SMF boundary) provided that the DCF length is set carefully to compensate the dispersion of the quantum channel.

Other means of dispersion management exist, such as fibre Bragg gratings or Gires- Tournois etalons. One advantage of the DCF is that we can adapt the DCF fibre length to the quantum channel length. The final choice of a dispersion management solution is a trade-off between flexibility, loss and latency.

Let’s examine the effect of the chromatic dispersion as a function of the repetition rate of the experiment. Firstly, to minimise chromatic dispersion, the spectral bandwidth of the source can be reduced up to the Fourier limit, where the pulses start to broaden temporally. As the repetition rate increases, the pulse duration has to decrease linearly in order to keep a constant QBER and therefore the spectral bandwidth has to increase linearly. Secondly, the error generated by a given chromatic dispersion increases linearly with the repetition rate. Namely, the QBER contribution for a dispersion (or distance) Dand a repetition rateris equivalent to the contribution for a dispersionD/2 and a repetition rate 2r. Therefore, the total effect of the chromatic dispersion varies quadrati- cally with the repetition rate of Alice’s source. For a commercial system, this is a strong argument to choose a repetition rate not higher than approximately 1 GHz such that no dispersion compensation is required, even at distances as long as 500 km. To illustrate this, figure 3.4 depicts the maximal fibre length such as the pulse duration after the fibre

(30)

3.3. Bob’s measurement apparatus

2 4 6 8 10

Repetition rate (GHz) 0

500 1000 1500 2000

Fibre length (km)

Figure 3.4: Maximal fibre length such as the pulse duration after the fibre is shorter than half of the qubit duration as a function of the repetition rate of the experiment. Note that for time-bin encoding, the repetition rate to be considered is twice the qubit rate.

is shorter than half of the qubit duration¹.

3.3 Bob’s measurement apparatus

On Bob’s side, the basis choice is performed passively by a beamsplitter. The splitting ratio is optimised depending on the distance under study. Qualitatively, Bob’s proba- bilities P_Z^B and P_X^B of choosing the basesZandX, respectively can be biased towards P_Z^B at short distance in order to maximize the sifting probability in theZbasis. At high attenuation, it is advantageous to balance them, in order to minimise the penalty due to finite-key analysis in theXbasis.

For theX basis measurement, Bob has an unbalanced interferometer similar to that of Alice, except that it has no fibre stretcher. This enables it to be very compact and consequently very stable, with an intrinsic phase stability exceeding∼10 minutes. An automatic feedback loop stabilises the relative phase between Alice and Bob interferometers by means of Alice’s fibre stretcher. The difference in the temporal imbalance of the interferometers of Alice and Bob is smaller than 3 ps.

1This criterion corresponds roughly to the point where dispersion starts to significantly reduce the performance.

(31)

attenuation (log scale, a.u.)

secret key rate (log scale, a.u.)

Ideal detector with infinite key Ideal detector with finite key Realistic detector

Figure 3.5: Qualitative influence of the SPDs on the SKR as a function of the attenuation.

Solid line: With an ideal detector and infinite keys, the SKR drops proportionally to the attenuation. Dash-dotted line: With a constraint on the acquisition time, the SKR deviates towards zero at high attenuation. Dashed line: When realistic detectors are used, the SKR is lower in the proportional region. At low attenuation the SKR is even lower due to the saturation. At high attenuation, the deviation towards zero is enhanced by the effect of the DCR.

3.4 Single-photon detectors

The SPDs are a crucial part of a QKD system as they largely affect its overall performance.

In this section, we first discuss the general performance requirements that they should fulfil, which can vary depending on the operating regime (which is mostly depending on the transmission distance). Then we describe more specifically the two types of detectors which were involved in the experiments: SPADs and SNSPDs.

3.4.1 General requirements of SPDs for QKD

We shall start our discussion with an ideal SPD which has the following characteristics:

• 100 % detection efficiency,

• no timing jitter,

• no dark counts,

• no recovery time (the detector can detect a photon immediately after a detection has occurred),

• no afterpulsing.

(32)

3.4. Single-photon detectors

60 80 100 120 140

Jitter (ps) 0.0

0.5 1.0 1.5 2.0 2.5 3.0

QBER induced (%)

Figure 3.6: QBER induced as a function of the detector timing jitter. The simulation was performed considering a time-bin encoding with a repetition rate of 2.5 GHz, detection bins of 100 ps as described in section 3.5.2 and Gaussian jitter distribution.

The resulting SKR as a function of the attenuation is plotted on figure 3.5. In the infinite key regime (continuous blue line), the SKR decreases proportionally to the attenuation.

However, when the block acquisition time is fixed to a finite duration, we note a break at long distance due to the finite key analysis (dash-dotted red line).

In a realistic scenario, the SKR as a function of the distance is instead similar to the dashed green line. In the low-attenuation regime, the SKR is limited by the saturation of the detectors. For every attenuation, the SKR is lower than the ideal case due to limited detection efficiency. Finally, at high attenuation, a break in the SKR appears also because of the DCR of the detectors.

Let’s examine the effect of varying each SPD characteristic individually. A reduction of the detection efficiency is equivalent to a change of the overall attenuation and can therefore be seen as an horizontal displacement of the curve on the figure 3.5. A high detection efficiency is obviously beneficial for the performance of a QKD system but no lower limit can be specified since it is possible to exchange secret keys even with very low detection efficiency.

A growing timing jitter increases the probability that a detection occurs in a neighbouring time-bin, therefore generating an error. The maximum allowable timing jitter depends on the repetition rate of the experiment. Figure 3.6 depicts the QBER contribution of the jitter as a function of the jitter for a time-bin encoding system with a repetition rate of 2.5 GHz. We assumed a Gaussian jitter distribution.

(33)

While the detection efficiency and the timing jitter affect the SKR for every attenuation uniformly, the DCR and the recovery time are crucial for the long distance and short distance regimes, respectively. As the attenuation increases, the detection rate decreases but the DCR is constant. The QBER contribution due to the DCR is close to zero for most attenuations because the DCR is negligible compared to the total detection rate. At long distance, when these two quantities become comparable, the DCR is the main QBER contribution. This prevents any secret key exchange at high attenuation and generates a break in the SKR curve, even in the infinite key regime. Two ways can be followed to determine how low the DCR should be. The first approach is based on the fact that for a fixed accumulation time (and a given repetition rate) there is a maximum attenuation achievable with a positive SKR. The second approach is to state that it is impractical and of little use to have a SKR below a certain value (probably around∼ 1 bps [43]).

Therefore, the DCR has to be low enough in order not to reduce significantly the SKR up to the maximum achievable attenuation in the first approach or at least up to the attenuation corresponding to a practical SKR in the second approach.

The recovery time affects the SKR at low attenuation due to the increasing probability of having photons arriving when the detector is inactive. Therefore some photons are not detected, which can be viewed as a decrease in the effective detector efficiency and as a consequence, the resulting SKR is lower than in the unsaturated case. The rule of thumb is that the recovery timeτ_rshould be much smaller than the inverse of the photon arrival rater_γ:

τr^1/rγ. (3.2)

Finally, the afterpulsing of the detector acts in a similar way to Alice’s preparation error. Therefore the afterpulsing contribution to the QBER is roughly proportional to the afterpulsing probability.

3.4.2 Single-photon avalanche diodes

SPADs are a natural choice for single-photon detection in QKD as they are a mature technology which is relatively easy to use and features good performances. They demonstrated their usefulness both in state-of-the-art experiments [13, 14] and in commercial systems. We use InGaAs/InP negative feedback avalanche diodes (NFADs) which have separate absorption and multiplication regions made of InGaAs and InP, respectively.

We operate them in the free-running mode. They are cooled by a free-piston Stirling cooler which can operate to temperatures as low as−¹³⁰^◦^C.

Our SPADs have demonstrated the following performance: system detection efficiency approaching 30 %, DCR as low as 1 Hz and timing jitter as low as 52 ps [44, 45]. How- ever, one cannot obtain these numbers all at the same time. Careful optimisation of the detector parameters is required for each operating regime in order to maximize the final

(34)

3.4. Single-photon detectors

SKR. The relation between the detector parameters (bias voltage, operating temperature and dead time) and the detector performance (efficiency, DCR, jitter and afterpulsing) can be summarized as following. As the bias voltage is raised, the avalanche probability increases and consequently also the detection efficiency. However, also the DCR grows strongly, which limits the maximum efficiency achievable with a reasonable DCR. More- over, short jitter is obtained with high bias voltage. The SPAD jitter does not exhibit a Gaussian distribution [45], which is detrimental for QKD. Since the dark counts are mostly thermally generated [46], lowering the temperature decreases the DCR. However, the price to pay is that this increases the afterpulsing probability because the lifetime of the charge carrier traps is longer at low temperature. The afterpulsing can be reduced by increasing the dead timeτ[47] but this also influences the maximum detection rate since saturation effect appears as the detection rate approaches 1/τ.

For QKD applications, the detector temperature is generally lowered as the attenuation increases. This allows, at low attenuation, to have a high detection efficiency together with a low afterpulsing probability. This latter permits to choose short dead times which in turn enables high detection rates. At higher attenuation the detection rate is lower, therefore the dead time can be increased without affecting the performance. It is then possible to lower the temperature which reduces the DCR (which is the main QBER contribution at high attenuation) while keeping the afterpulsing probability at the same level as at low attenuation.

3.4.3 Superconducting nanowire single-photon detectors

An SNSPD consists of a nanowire which is cooled down to its superconducting state. It is biased just below its critical current, the current beyond which the nanowire becomes resistive. A photon hitting the nanowire creates a local resistive hotspot which triggers a fast voltage pulse that can be detected by an appropriate electronic readout circuit.

We use in-house-made SNSPDs which are made from amorphous molybdenum silicide (MoSi) (see references [48, 49, 50] for specific information about those detectors). This material enables high detection efficiencies at telecom wavelength as it exhibits a large saturation regime when cooled down around 1 K. The detectors are cooled down in a sorption cryostat reaching 0.8 K. Detector design can be varied depending on the performance requirements and results from a trade-off between the different features.

The majority of the detectors we used, which we denote as standard detectors, have the following characteristics. They are composed of a single nanowire which forms a meander covering an area of 16×¹⁶^µm². The nanowire widths are typically∼^{100 nm} and their thicknesses∼5 nm. The photon absorption is enhanced by an optical cavity.

Light is sent on the detector through a SMF which is placed directly on top of the device.

These detectors have system detection efficiencies as high as∼85 %. The DCR is around

Long-distance and high-speed quantum key distribution

Thesis

Reference

Long-distance and high-speed quantum key distribution

U

G

F

S

Groupe de Physique Appliquée Professeur Hugo Z

Long-distance and high-speed quantum key distribution

Thèse

présentée à la Faculté des sciences de l’Université de Genève pour obtenir le grade de Docteur ès sciences, mention Physique

par

Alberto B

de Genève et d’Italie

Thèse N

5443

G

Centre d’impression de l’Université de Genève

2020

Abstract

Résumé

Contents

1 Introduction

2 Protocols

2.1 General principles of QKD

Alice Bob

Alice

Bob

2.2 Simplifications to the BB84 protocol

3 Time-bin QKD - implementation

3.1 A source of BB84 states clocked at 2.5 GHz

Bob

3.2 Transmission over optical fibres

3.3 Bob’s measurement apparatus

3.4 Single-photon detectors