1: \documentclass[twocolumn,showpacs,preprintnumbers,amsmath,amssymb]{revtex4}
2: \usepackage[T1]{fontenc}
3: \usepackage[latin1]{inputenc}
4:
5: \usepackage{amsmath}
6: \usepackage{amssymb}
7: \usepackage{amsfonts}
8: \usepackage{graphicx}
9:
10:
11: \newcommand{\ket}[1]{\lvert{#1}\rangle}
12: \newcommand{\bra}[1]{\langle{#1}\rvert}
13: \newcommand{\braket}[2]{\langle#1\vert#2\rangle}
14:
15: %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
16: \begin{document}
17:
18: \title{Efficiency of coherent state quantum cryptography in the presence of
19: loss: \\Influence of realistic error correction}
20:
21: \author{Matthias Heid}
22: \author{Norbert L\"utkenhaus}
23: \affiliation{Quantum Information Theory Group, Institut f\"ur theoretische
24: Physik I and Max-Planck Research Group, Institute of Optics, Information and
25: Photonics, Universit\"at Erlangen-N\"urnberg, Staudtstr. 7/B2, 91058
26: Erlangen, Germany}
27: \date{\today}
28:
29: \begin{abstract}
30: We investigate the performance of a continuous variable (CV) quantum key
31: distribution (QKD) scheme in a practical setting. More specifically, we take
32: non-ideal error reconciliation procedure into account. The quantum channel
33: connecting the two honest parties is assumed to be lossy but
34: noiseless. Secret key rates are given for the case that the measurement outcomes are postselected or a reverse reconciliation scheme
35: is applied. The reverse reconciliation scheme loses its
36: initial advantage in the practical setting. If one combines postselection
37: with reverse reconciliation however, much of this advantage can be
38: recovered.
39: \end{abstract}
40: \pacs{03.67.Dd, 42.50.-p, 89.70.+c}
41:
42: \maketitle
43: \section{Introduction}%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
44:
45: Quantum key distribution (QKD) allows two parties, the sender Alice and the
46: receiver Bob, to share a key which is provably secure against any attack by an
47: eavesdropper (Eve), who may have superior computational and technological
48: power. Practical implementations of QKD use weak laser pulses, which can be
49: easily controlled, or parametric down-conversion sources. These sources
50: are used together with single-photon detectors to realize QKD. For a
51: review see \cite{gisin02a}. Recently, it has been proposed to employ
52: quadrature measurements of optical modes as detection devices, thereby
53: introducing what is known as continuous variable (CV) QKD \cite{ralph00a,hillery00a,hirano03a,grosshans03a,silberhorn02a}. Some of
54: these schemes use non-classical states, while others use coherent laser
55: pulses. The aim is to exploit the high repetition
56: rates of homodyne detection to overcome the limitation in detection rate that
57: is typical for single-photon counting at standard telecom wavelength although
58: recently other approaches using frequency conversion have been reported
59: \cite{diamanti05a, tanzilli05a}.
60:
61: In the presence of loss, it seems to be
62: impossible at first sight to distill a secret key if the transmission falls
63: below 50\% (3dB loss) \cite{grosshans02a}. The reasoning is that Eve
64: can replace the lossy channel with an ideal one and use a beamsplitter to tap
65: off Alice's signals to simulate the losses. She then obtains the stronger
66: signals whenever the losses are bigger than 50\%. This apparent advantage of
67: Eve can be counteracted as it holds only on average, whether Alice and Bob are
68: closely or loosely correlated. Alice and Bob can use postselection (PS) to
69: retain only those events where they are closely correlated and then have
70: some advantage over Eve. The distillation of a secret key rate is then
71: possible for any transmittance of the quantum channel
72: \cite{silberhorn02b}. Another way to circumvent the 3dB loss limit is to use a
73: suitable one-way information reconciliation procedure. If one builds up the
74: key from Bob's measured data rather than from Alice's signals, Eve always has
75: less information about Bob's measurement result than Alice does. This
76: technique is known as reverse reconciliation (RR)
77: \cite{grosshans03a,grosshans03b} and leads to positive secret key rates
78: for an arbitrary loss of the quantum channel \cite{grosshans05a,navascues05a}.
79:
80: There are several ways to extend this scenario to a more realistic one. First,
81: one could consider quantum channels that are not only lossy, but also impose
82: excess Gaussian noise on the quadrature distributions, as is
83: seen in experiments. For any excess channel noise $\delta$, as seen by Bob,
84: there exists a lower limit for the tolerable single-photon transmittivity $\eta$, which is given by \cite{namiki04a}
85: \begin{equation}
86: \delta<2\eta \; .
87: \end{equation}
88: If the losses are higher, one can show that the data can be explained as
89: originating from an intercept resend attack. In this scenario, no secret key
90: can be distilled \cite{curty04a,curty05a}. In accordance with this bound, it has been shown that the key rate obtained from PS-schemes decreases with increasing excess noise
91: \cite{namiki05a}.
92:
93: Here we follow another direction to extend the work of
94: \cite{silberhorn02b,grosshans05a} and stick to the assumption of a lossy but
95: noiseless quantum channel. This scenario can be justified since detector
96: noise is the dominant contribution to the total noise seen in the experiment \cite{lorenz04a}. In a
97: trusted device scenario one can assume that Eve cannot exploit the noise of Bob's detectors. The remaining channel noise, which can leak information to
98: Eve, is typically less than one percent \cite{lorenz05suba} and can thus be neglected in a first
99: approximation. Similarly, in standard QKD with weak coherent pulses, the assumption of lossy but noiseless quantum channels together with detector dark counts which are inaccessible to Eve lead to a very good approximation to the rigorous secure key rate. In this scenario we investigate the
100: implications of the fact that any error
101: correction scheme in a real-world application cannot reach the fundamental
102: performance limit given by Shannon \cite{shannon48a}. The aim of this
103: article is to compare the performance of reverse reconciliation and
104: postselected schemes where the error correcting
105: carries a non-negligible overhead in the amount of necessary communication.
106:
107: This paper is organized as follows: In the first section, we introduce the
108: investigated protocol and give the framework to which our efficiency
109: analysis applies. Next we calculate a lower bound on the secret key rate under
110: the assumption that the quantum channel between Alice and Bob is lossy but
111: noiseless and Eve is restricted to collective attacks. It turns out that
112: Eve's information about the key can be decomposed into effective binary
113: channels. Her information gain per use of such a binary channel is computed
114: in section III A for the protocol using direct reconciliation (DR) and for the reverse reconciled protocol (RR) in section III B. Afterwards, we calculate the total secret key rates for the various protocols and include the possibility to use postselection
115: (PS). We then proceed by including inefficient but trusted
116: detectors on Bob's side in our analysis in section IV. Details about the
117: numerical optimization of the secret key rates are given in section V. In the last section we conclude and discuss our results.
118:
119: \section{Protocol and beamsplitter attack}
120:
121: We consider the situation where Alice sends pure signal states
122: $\ket{\phi_{i}}$ through the quantum channel to Bob, who can verify, for
123: example by performing tomographic complete measurements, that he indeed always
124: receives pure conditional states as expected in the absence of channel noise $\ket{\Psi_{i}}$ \footnote{For a full
125: security proof one would have to make the point more precise. However, this
126: is not the aim of this letter.}. It follows that
127: the bipartite state of Eve and Bob has to be a product state. In the scenario
128: of collective attacks, the action of the channel can be modeled by a unitary
129: coupling to an ancilla system accessible to Eve, which is prepared in some
130: standard state $\ket{\epsilon^{0}}$. The absence of noise allows to fully characterize Eve's attack. We have
131: \begin{eqnarray*}
132: U\ket{\phi_{i}}\ket{\epsilon^{0}}=\ket{\Psi_{i}}\ket{\epsilon_{i}}.
133: \end{eqnarray*}
134: Since $U$ is unitary, we have
135: \begin{eqnarray*}
136: \braket{\phi_{i}}{\phi_{j}}=\braket{\Psi_{i}}{\Psi_{j}}\braket{\epsilon_{i}}{\epsilon_{j}},
137: \end{eqnarray*}
138: where $\braket{\phi_{i}}{\phi_{j}}$ is given by the state preparation and
139: $\braket{\Psi_{i}}{\Psi_{j}}$ is fixed by Bob's observation. Therefore the
140: overlaps $\braket{\epsilon_{i}}{\epsilon_{j}}$, which contain all of Eve's information about the signals, are fixed.
141:
142: In our protocol, Alice encodes her bit-value into the modulation of two
143: coherent states according to
144: \begin{eqnarray*}
145: \ket{\underline{0}}&=&\ket{\alpha}\\
146: \ket{\underline{1}}&=&\ket{-\alpha},
147: \end{eqnarray*}
148: with the coherent amplitude $\alpha$ chosen to be real without loss of
149: generality. The states are sent with equal a priori probabilities
150: $\mathrm{p}_{0}=\mathrm{p}_{1}=\frac{1}{2}$.
151: Bob performs a heterodyne measurement on the received states, which is
152: mathematically equivalent to a projection onto a coherent state
153: $\ket{\beta}=\ket{\beta_{x}+i \beta_{y}}$. From that he is able to conclude
154: that he indeed received pure states. That in turn fixes Eve's knowledge about
155: the signal states. Furthermore, if Bob receives attenuated coherent states
156: $\ket{\pm\sqrt{\eta}\alpha}$, the states that Eve holds have to be unitarily
157: equivalent to those obtainable by the beamsplitter attack. The input states
158: are transformed according to
159: \begin{equation}\label{BSattack}
160: \ket{\pm \alpha} \rightarrow \ket{\pm \sqrt{\eta}\alpha}_{B}\otimes \ket{\pm \sqrt{1-\eta}\alpha}_{E}
161: \end{equation}
162: in this attack. After measuring the signals, Bob assigns the
163: bit-value 0 (1), if $\beta_{x}$ is positive (negative) and then publicly
164: announces $\beta_{y}$ and the modulus of $\beta_{x}$ of the measured
165: $\beta$. As we will see, this announcement will enable us to decompose the protocol into effective binary information channels.
166:
167: \section{Lower bound on secret key rate}
168: After the exchange of quantum signals between Alice and Bob is
169: complete, they proceed with a classical post-processing phase in which
170: they correct for errors in their bit-strings and cut out Eve's knowledge about
171: the key (privacy amplification)\cite{bennett95a}. To do so, they need to transmit information though an authenticated
172: but otherwise insecure classical channel. Eve may listen and use any
173: information exchanged over the public channel to optimize her attack.
174:
175: Alice and Bob may use the classical channel only in one direction for error correction. This will result
176: in two non-equivalent ways of distilling a secret key from their shared
177: classical data. Communication from Alice to Bob is common in QKD and we will
178: refer to it as direct reconciliation (DR), whereas communication in the
179: opposite direction is called reverse reconciliation (RR) \cite{grosshans03a}. The secret key is
180: built from the data that the sender in the classical communication step
181: holds. In any case, Eve's knowledge is summarized in quantum states
182: $\rho_{i}$ conditioned on bit-values held by the person who transmits the
183: error correction information. Her knowledge about the data can be quantified by the Holevo quantity $\chi$ \cite{holevo73b}, given by
184: \begin{eqnarray}\label{Holevo}
185: \chi &=& S(\overline{\rho})-\sum_{i=0}^{1}\mathrm{p}_{i} S(\rho_{i})\\
186: \overline{\rho}&=& \sum_{i=0}^{1} \mathrm{p}_{i}\rho_{i}\nonumber,
187: \end{eqnarray}
188: which includes Eve being allowed to measure out her ancillas collectively.
189: It turns out \cite{devetak05a} that the secret
190: key rate $G$ in this collective attack scenario will then be bounded from below by
191: \begin{equation}\label{Dev/Win}
192: G \geq \mathrm{I}_{A:B}-\chi \; .
193: \end{equation}
194: Note that we have replaced the Holevo quantity between Alice and Bob in theorem 1 of \cite{devetak05a} by the classical mutual
195: Information $\mathrm{I}_{A:B}$, since we are investigating a practical QKD
196: scheme with our specified measurement setup.
197:
198: Next, we will evaluate $\mathrm{I}_{A:B}$ and $\chi$ for different protocols and noiseless detectors.
199:
200: \subsection{Mutual information between Alice and Bob}
201:
202: After the quantum states are distributed and measured, Alice and Bob
203: share classical correlated bit-strings. The mutual information
204: $\mathrm{I}_{A:B}$ between the two honest parties is determined by the
205: conditional probabilities that Bob projects onto $\beta$. These are given by
206: \begin{eqnarray}\label{condprob}
207: \mathrm{p}(\beta|0)&=&\frac{1}{\pi}\mathrm{e}^{-\left(\left(\beta_{x}-\sqrt{\eta}\alpha\right)^2+\beta_{y}^2\right)}\\
208: \mathrm{p}(\beta|1)&=&\frac{1}{\pi}\mathrm{e}^{-\left(\left(\beta_{x}+\sqrt{\eta}\alpha\right)^2+\beta_{y}^2\right)}\nonumber.
209: \end{eqnarray}
210: Since Eve is only performing an individual coupling of the signals to her
211: ancilla systems, Bob's measurement outcomes $\beta$
212: for different signals are independent. The mutual information
213: $\mathrm{I}_{A:B}$ between Alice and Bob cannot depend on the value of
214: $\beta_{y}$, since the agreement on a bit-value does not
215: depend on it. Furthermore, the total probability that Bob obtains the
216: measurement outcome $\beta_{x}$ is given by
217: \begin{eqnarray}\label{marginal}
218: \mathrm{p}(\beta_{x})&=&\int_{-\infty}^{\infty}\mathrm{d}\beta_{y}
219: \; \mathrm{p}(\beta)=\\&=&\frac{1}{2\sqrt{\pi}}\left(\mathrm{e}^{-\left(\beta_{x}+\sqrt{\eta}\alpha\right)^2}+\mathrm{e}^{-\left(\beta_{x}-\sqrt{\eta}\alpha\right)^2}\right)\nonumber.
220: \end{eqnarray}
221: From this we see that the two outcomes $\pm \beta_{x}$ occur with the same
222: probability. It follows that the announcement of $\beta_y$ and $|\beta_{x}|$
223: defines an effective binary information channel. The probability $e^{+}$ that Bob
224: assigns the wrong bit-value for a given positive value of $\beta_{x}>0$ is given by
225: \begin{eqnarray*}
226: e^{+}=
227: \frac{\mathrm{p}\left(\beta_{x}|1\right)}{\mathrm{p}\left(\beta_{x}|0\right)+\mathrm{p}\left(\beta_{x}|1\right)} ,
228: \end{eqnarray*}
229: whereas the corresponding error probability $e^{-}$ for negative outcomes
230: $\beta_{x}<0$ is given by
231: \begin{eqnarray*}
232: e^{-}=
233: \frac{\mathrm{p}\left(\beta_{x}|0\right)}{\mathrm{p}\left(\beta_{x}|0\right)+\mathrm{p}\left(\beta_{x}|1\right)} .
234: \end{eqnarray*}
235: From Eqn. (\ref{condprob}) it follows that
236: \begin{eqnarray}\label{erate}
237: e^{+}=e^{-}=e=\frac{1}{1+\mathrm{e}^{4\sqrt{\eta}\alpha|\beta_{x}|}},
238: \end{eqnarray}
239: so that the effective information channels are symmetric in the error rate.
240: Each information channel contributes an
241: amount of $1-\mathrm{H}^{\mathrm{bin}}(e)$ to the mutual information, $\mathrm{I}_{A:B}$,
242: where $\mathrm{H}^{\mathrm{bin}}(e)$ is the entropy of the
243: binary symmetric channel,
244: \begin{eqnarray*}
245: \mathrm{H}^{\mathrm{bin}}(e)=-e\;\mathrm{log}_{2}(e)-(1-e)\;\mathrm{log}_{2}(1-e).
246: \end{eqnarray*}
247: The probability that an effective information channel is being used, is given by
248: \begin{equation}\label{probchannel}
249: \mathrm{p}_{c}(\beta_{x})=2\mathrm{p}(\beta_{x}).
250: \end{equation}
251: For the total transmission we find
252: \begin{equation}
253: \label{totalinfo}
254: \mathrm{I}_{A:B}= \int_{0}^{\infty} \mathrm{d}\beta_{x}
255: \;\mathrm{p}_{c}(\beta_{x})\left[1-\mathrm{H}^{\mathrm{bin}}\left(e\right) \right] \;.
256: \end{equation}
257: In order to calculate the secret key rate $G$ according to Eqn.
258: (\ref{Dev/Win}), we proceed by bounding Eve's knowledge $\chi$ decomposed in
259: the effective binary information channels.
260:
261: \subsection{Direct reconciliation}
262:
263: Usually in QKD the DR case is considered where the secret key is determined by Alice's data. This means that Alice sends Bob error correction information in the
264: information reconciliation step of the protocol. After Alice and Bob have
265: corrected their bit-strings, Eve can make use of the information transmitted
266: over the public channel to optimize her measurements on her ancilla
267: systems.
268:
269: The quantum states in Eve's hand, conditioned on Alice's data, are given by (\ref{BSattack}) as
270: \begin{equation}\label{condDR}
271: \ket{\epsilon_{i}}=\ket{\pm\sqrt{1-\eta}\alpha}\; .
272: \end{equation}
273: These states are pure, so that we have
274: $\chi^{DR} = S(\overline{\rho})$. What remains to be calculated are the eigenvalues of
275: \begin{equation*}
276: \overline{\rho}=\frac{1}{2}\left(\ket{\epsilon_{0}}\bra{\epsilon_{0}}+\ket{\epsilon_{1}}\bra{\epsilon_{1}}\right).
277: \end{equation*}
278: The symmetry allows us to write the states $\ket{\epsilon_{i}}$ as
279: \begin{eqnarray}\label{sym}
280: \ket{\epsilon_{0}}&=&c_{0}\ket{\Phi_{0}}+c_{1}\ket{\Phi_{1}}\\
281: \ket{\epsilon_{1}}&=&c_{0}\ket{\Phi_{0}}-c_{1}\ket{\Phi_{1}}\nonumber,
282: \end{eqnarray}
283: where the $\ket{\Phi_{i}}$ are orthonormal states. A short calculation shows
284: that $\overline{\rho}$ is already diagonal in this basis with eigenvalues
285: $\left|c_{i}\right|^2$, so that the Holevo quantity is given by
286: \begin{eqnarray}\label{entropyrho}
287: &&\chi^{DR}=S(\overline{\rho})=-\sum_{i=0}^{1} \left|c_{i}\right|^2 \mathrm{log} \left(\left|c_{i}\right|^2\right).
288: \end{eqnarray}
289: The normalization of $\rho$
290: \begin{eqnarray*}
291: \left|c_{0}\right|^2+\left|c_{1}\right|^2=1
292: \end{eqnarray*}
293: and the overlap
294: \begin{eqnarray*}
295: \left|c_{0}\right|^2-\left|c_{1}\right|^2=\braket{\epsilon_{0}}{\epsilon_{1}}
296: \end{eqnarray*}
297: give the expression for the coefficients
298: \begin{eqnarray}
299: \left|c_{0}\right|^2&=&\frac{1}{2}\left(1+\braket{\epsilon_{0}}{\epsilon_{1}}\right)\label{c0c1def}\\
300: \left|c_{1}\right|^2&=&\frac{1}{2}\left(1-\braket{\epsilon_{0}}{\epsilon_{1}}\right).\nonumber
301: \end{eqnarray}
302: The overlap of the two coherent states (\ref{condDR}) is
303: \begin{eqnarray}\label{eveoverlap}
304: \braket{\epsilon_{0}}{\epsilon_{1}}=\mathrm{e}^{-2(1-\eta)\alpha^2},
305: \end{eqnarray}
306: so that the Holevo quantity can be directly computed.
307: Since Eve's quantum states are independent of Bob's measurement outcomes (see
308: formula (\ref{eveoverlap})), the value of the Holevo quantity for each
309: effective channel, $\chi^{DR}(\beta_{x})$, does not depend on $\beta$. Therefore, we find that the total Holevo quantity for all effective channels becomes
310: \begin{equation}
311: \label{DRchannel}
312: \chi^{DR}=\chi^{DR}(\beta_{x})\;.
313: \end{equation}
314:
315: \subsection{Reverse reconciliation}%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
316:
317: In a reverse reconciliation scheme \cite{grosshans03a}, Bob sends error correction information to
318: Alice. Therefore Eve is interested in obtaining information about Bob's measurement results rather than Alice's signals. After Bob's announcement of
319: $|\beta_{x}|$ and $\beta_{y}$, Eve knows which information channel is used and, depending on Bob's measurement result,that she either holds the state
320: \begin{eqnarray*}
321: \rho_{+}=\left(1-e\right)\ket{\epsilon_{0}}\bra{\epsilon_{0}}+e\ket{\epsilon_{1}}\bra{\epsilon_{1}}
322: \end{eqnarray*} or
323: \begin{eqnarray*}
324: \rho_{-}=e\ket{\epsilon_{0}}\bra{\epsilon_{0}}+\left(1-e\right)\ket{\epsilon_{1}}\bra{\epsilon_{1}}
325: \end{eqnarray*}
326: in her ancilla system. Here $e$ is the error rate of the effective binary
327: information channel (\ref{erate}). In order
328: to obtain the correct bit-value, she needs to find out the sign of $\beta_{x}$. Both signs of the measurement outcome occur with the same
329: probability $\mathrm{p}(\beta_{x})$ of Eqn. (\ref{marginal}), so that the
330: probability of the effective information channel being used is again
331: $\mathrm{p}_{c}=2 \mathrm{p}(\beta_{x})$. The Holevo quantity (\ref{Holevo}) in the case of reverse reconciliation reads
332: \begin{eqnarray*}
333: \chi^{RR}(\beta_{x})&=&S(\overline{\rho})-\mathrm{p}_{+}S(\rho_{+})-\mathrm{p}_{-}S(\rho_{-})\\
334: &=&S(\overline{\rho})-\frac{1}{2}\left[S(\rho_{+})+S(\rho_{-})\right],
335: \end{eqnarray*}
336: since the probability that Bob gets a positive (negative) outcome for a given
337: binary information channel, is simply $\mathrm{p}_{\pm}=\frac{1}{2}$ (see
338: Eqn. \ref{marginal}).
339: The entropy of $\overline{\rho}$ has already been calculated and is given by
340: Eqns. (\ref{entropyrho}) and (\ref{c0c1def}).
341:
342: Furthermore there exists a unitary operation $U$ (a phase-shift of $\pi$) with
343: \begin{eqnarray*}
344: \rho_{+}=U\rho_{-}U^{\dagger},
345: \end{eqnarray*}
346: so that $S(\rho_{+})=S(\rho_{-})$.
347: The basis states $\ket{\Phi_{i}}$ of Eqn. (\ref{sym}), which are adapted to
348: the symmetry, can again be used to calculate $S(\rho_{+})$. In this basis
349: $\rho_{+}$ reads
350: \begin{eqnarray*}
351: \rho_{+}=\left(
352: \begin{array}{cc}\left|c_{0}\right|^2& \left(1-2e\right)c_{1}^{*}c_{0}\\
353: \left(1-2e\right)c_{0}^{*}c_{1}&\left|c_{1}\right|^2
354: \end{array}
355: \right).
356: \end{eqnarray*}
357: One can show with the help of Eqn. (\ref{c0c1def}) that the eigenvalues
358: $\lambda_{1,2}$ of this matrix are of the form
359: \begin{eqnarray}\label{eig}
360: \lambda_{1,2}=\frac{1}{2}\left(1\pm\sqrt{1+4e\left(e-1\right)(1-|\braket{\epsilon_{0}}{\epsilon_{1}}|^2)}\right),
361: \end{eqnarray}
362: so that we have explicitly given
363: \begin{eqnarray}\label{entrrho+}
364: S(\rho_{+})=\sum_{i=1}^{2}-\lambda_{i}\mathrm{log}\lambda_{i}.
365: \end{eqnarray}
366: With the help of Eqns. (\ref{entropyrho}),(\ref{eveoverlap}), (\ref{eig})
367: and (\ref{entrrho+}), the Holevo quantity per information channel can now be
368: explicitly evaluated via
369: \begin{eqnarray}\label{HolevoRR2}
370: \chi^{RR}(\beta_{x}) =S(\rho)-S(\rho_{+}).
371: \end{eqnarray}
372: This quantity varies for the different effective channels.
373:
374: \subsection{Postselection}
375:
376: We have calculated an upper bound $\chi$ of Eve's information about the
377: key for a given information channel for DR and for RR. Also, we have an expression for the total mutual information shared between the two parties, Eqn. (\ref{totalinfo}). The
378: total achievable key rate per signal, as given by Eqn. (\ref{Dev/Win}), can then be written as
379: \begin{eqnarray}\label{keyideal}
380: \mathrm{G}&=&\int_{0}^{\infty} \mathrm{d}\beta_{x}
381: \;\mathrm{p}_{c}(\beta_{x})\underbrace{\left[1-\mathrm{H}^{\mathrm{bin}}\left(e\right)-\chi(\beta_{x})
382: \right]}_{=:\Delta\mathrm{I}^{\mathrm{ideal}}(\beta_{x}) } \; ,
383: \end{eqnarray}
384: where $\chi(\beta_x)$ is given by Eqns. (\ref{entropyrho}) and (\ref{DRchannel}) for DR and by formula
385: (\ref{HolevoRR2}) for RR. Here the sum runs over all possible information
386: channels. In principle one can improve the performance of the protocols by
387: dismissing channels where $\Delta\mathrm{I}^{\mathrm{ideal}}(\beta_{x})<0$,
388: since Eve learns more on average about the
389: signals than Bob for those values of $\beta_{x}$. This procedure is called postselection.
390:
391: The key rate (\ref{keyideal}) refers to the case where a perfect
392: error correction procedure is used (Shannon limit). Ideally, in order to
393: correct a bit-string of large length $n$, one has to exchange asymptotically $n \mathrm{H}^{\mathrm{bin}}(e)$ bits over
394: the public channel. This information has to be hidden from Eve, which can be
395: done in principle by using a one-time-pad of exactly the same length. In the
396: end, each use of an information channel with error rate $e$ costs
397: $\mathrm{H}^{\mathrm{bin}}(e)$ secret bits to encrypt the necessary error
398: correction information
399: \footnote{Alternatively, one can think of Eve simply learning
400: $\mathrm{H}^{\mathrm{bin}}(e)$ bits per exchanged signal during error
401: correction. This amount of information has then to be cut out in the privacy
402: amplification steps. The final formulas do not change,
403: however \cite{cachin97a}.}.
404:
405: It turns out that all effective information channels yield a positive
406: contribution $\Delta\mathrm{I}^{\mathrm{ideal}}_{RR}(\beta_{x}) \geq 0$ for the
407: RR protocols in this idealized setting. This is in agreement with the result
408: found in \cite{grosshans05a}. Therefore, it is possible to distill
409: a secret key for any transmission of the quantum channel, and the
410: performance of the RR protocol cannot be improved further by using postselection.
411:
412: Practical codes that work exactly at the Shannon limit are not
413: known. Efficient codes work close to that
414: limit, so in practice one has to reveal more
415: information to correct one bit, i.e. $f(e)\mathrm{H}^{\mathrm{bin}}(e)$,
416: where $f(e)$ represents the efficiency of the used protocol ($f(e)\geq1$). The
417: coefficient $f(e)$, which determines the overhead one has to pay for realistic error correction, depends in all practical schemes on the error
418: rate $e$. To see how the key rate $G$ scales when an error correction scheme
419: with efficiency $f(e)$ is used, we can rewrite formula (\ref{keyideal}) as
420: \begin{eqnarray}\label{keyprac}
421: \mathrm{G}&=&\int_{0}^{\infty} \mathrm{d}\beta_{x}
422: \;\mathrm{p}_c(\beta_{x})\left[\underbrace{1-f(e)\mathrm{H}^{\mathrm{bin}}(e)-\chi(\beta_{x})}_{=:\Delta\mathrm{I}^{\mathrm{prac}}(\beta_{x})} \right] .
423: \end{eqnarray}
424: The quantity $\chi(\beta_{x})$ is again given by Eqns. (\ref{entropyrho}) and (\ref{DRchannel}) in the DR and
425: by (\ref{HolevoRR2}) in the RR case respectively. Postselection can again be
426: applied once Alice and Bob know the efficiency $f(e)$ of their error correction
427: procedure approximately. Thus postselection now is relevant not only for DR, but also for the RR scenario.
428:
429:
430: \section{Detector noise}
431:
432: By now we have obtained secret key rates while neglecting any kind of
433: noise. While experiments show that the channel noise is low, the noise of the
434: detector is not negligible, but of the order of 0.1 shot noise units. In a
435: trusted device scenario we assume that Eve cannot manipulate the detector
436: noise to leak information about the signals to her. On the other hand, this
437: noise increases the cost of error correction. It is interesting to see how
438: this affects the key rate. We define the excess noise $\delta$ imposed by the detector by
439: \begin{equation}\label{excess}
440: \delta=\frac{\Delta^2_{\mathrm{obs}}\beta_{x}}{\Delta^2_{\mathrm{SNL}}\beta_{x}}-1,
441: \end{equation}
442: where $\Delta^2_{\mathrm{obs}}\beta_{x}$ is the observed variance of
443: $\beta_{x}$ seen in experiments and $\Delta^2_{\mathrm{SNL}}\beta_{x}$
444: is the shot noise limited variance of $\beta_{x}$.
445: The probability that Bob obtains the measurement outcome $\beta_{x}$ is then
446: given by
447: \begin{eqnarray}\label{modprob}
448: &&\mathrm{p^{\mathrm{Det}}}(\beta_{x})=\\&&\frac{1}{2\sqrt{\pi(1+\delta)}}\left(\mathrm{e}^{\frac{-\left(\beta_{x}+\sqrt{\eta}\alpha\right)^2}{1+\delta}}+\mathrm{e}^{\frac{-\left(\beta_{x}-\sqrt{\eta}\alpha\right)^2}{1+\delta}}\right)\nonumber \;,
449: \end{eqnarray}
450: including detector noise. This leads to a modified error rate of the efficient binary channels, given by
451: \begin{equation}\label{moderate}
452: e^{\mathrm{Det}}=\frac{1}{1+\mathrm{e}^{\frac{4\sqrt{\eta}\alpha|\beta_{x}|}{1+\delta}}}.
453: \end{equation}
454: The secret key rate can then be calculated as described in the previous
455: sections for any value of the excess noise $\delta$, one has only to use the
456: modified expressions for Bob's probability distribution (\ref{modprob}) and for
457: the error rate (\ref{moderate}) instead of Eqns. (\ref{marginal}) and
458: (\ref{erate}) in all preceding formulas. This will lead to a decrease of the
459: mutual information $\mathrm{I}_{AB}$ between Alice and Bob with growing excess
460: noise $\delta$ to account for the higher cost of error correction. While the
461: cost of privacy amplification $\chi^{DR}$ per use of an effective binary
462: information channel in the DR protocol (\ref{DRchannel}) is unaffected by the
463: detector noise, the corresponding quantity $\chi^{RR}$ (\ref{HolevoRR2}) for
464: the RR protocol decreases with increasing detector noise. This effect
465: originates from the fact that Eve is more uncertain about Bob's measurement
466: outcomes if he uses inefficient detectors.
467:
468: \section{Numerical procedure for calculating the key rate}
469:
470: Now we have everything at hand to compute $G$. For this, we resort to
471: numerical calculations. We assume that our
472: error correction can work as efficiently as the bidirectional protocol Cascade \cite{brassard93a}. To be precise, we use a linear fit
473: of the efficiency of Cascade (see table \ref{effcascade}) for the function $f(e)$ in our numerical
474: optimization.
475: \begin{table}
476: \begin{center}
477: \begin{tabular}{c|c}
478: $e$ & $f(e)$\\
479: \hline \hline
480: 0.01 & 1.16\\
481: 0.05 & 1.16\\
482: 0.1 & 1.22\\
483: 0.15 & 1.32\\
484: \end{tabular}
485: \caption{\label{effcascade} Efficiency of Cascade \cite{brassard93a} for different values of
486: the error rate $e$}
487: \end{center}
488: \end{table}
489: Formally, one-way communication would be needed to justify the use of the
490: Devetak-Winter bound (\ref{Dev/Win}). However in the worst case scenario when
491: using two-way communication, Eve learns all positions where Bob assigned the wrong bit-value. Therefore the Devetak-Winter bound could still be applied if
492: one additionally announces Bob's error positions. But since Eve's knowledge
493: about the key (\ref{entropyrho}) in the DR setting does not depend on Bob's measurement
494: outcome $\beta_{x}$, the resulting key rate would remain unchanged. Therefore two-way error correction methods can be applied directly in
495: connection with DR methods in the lossy channel. In RR, however,
496: strict one-way communication is essential. Since we are here interested in
497: efficiency considerations only, we ignore the problem of finding a practical
498: one-way protocol that can be as efficient as Cascade and simply assume we have such a protocol. Still, we have to keep
499: in mind that the rate for DR can be implemented directly with known
500: protocols, whereas the RR rate requires the usage of efficient one-way error
501: correction protocols.
502:
503: For given transmission $\eta$ of the quantum channel and excess noise
504: $\delta$ imposed by Bob's detector we
505: \begin{itemize}
506: \item choose an amplitude $\alpha$ of Alice's coherent signal states,
507: \item calculate $\Delta \mathrm{I}^{\mathrm{prac}}(\beta_{x})$ for all information channels
508: $\beta_{x}$ taking realistic error correction into account,
509: \item discard all channels where $\Delta \mathrm{I}^{\mathrm{prac}}(\beta_{x})<0$ in
510: postselection protocols,
511: \item integrate over the remaining channels to obtain the key rate $G(\eta,\alpha)$,
512: \item start over such as to optimize over $\alpha$ for a given transmission $\eta$.
513: \end{itemize}
514:
515: \section{Numerical evaluation and discussion}
516:
517: Let us first neglect any detector noise on Bob's side. Fig. \ref{figure}
518: summarizes our numerical results for the RR protocol and for the postselected
519: DR scheme for the case that Bob's detectors are noiseless.
520: \begin{figure}
521: \begin{center}
522: \includegraphics[width=0.48\textwidth]{BSDRRR.eps}
523: \end{center}
524: \caption{\label{figure} Comparison of the secret key rate $G$ versus
525: transmission $\eta$ for ideal (solid lines) and realistic error correction
526: (dashed lines) for a postselected DR protocol and a RR protocol. The dotted
527: line represents a postselected RR protocol with realistic error correction.}
528: \end{figure}
529: If ideal error correction is assumed, the RR scheme clearly performs
530: better than the postselected DR scheme. In this setting, an additional
531: postselection step in the RR protocol cannot improve the performance, since
532: all information channels yield a positive advantage $\Delta
533: \mathrm{I}^{\mathrm{ideal}}_{RR}(\beta_{x})\geq 0$ for Alice and Bob. The key rate for a
534: non-postselected DR scheme is not shown, since it would be limited by 50\%
535: losses and is therefore not of interest for practical QKD.
536:
537: The key rate decreases significantly in the non-postselected RR protocols if one does not
538: assume an ideal error correction. This is however not a problem of RR itself,
539: but due to the fact that in the simple approach all bits have to be corrected. Since one has to
540: shrink the key by $f(e)\mathrm{H}^{\mathrm{bin}}(e)$ bits of information to
541: correct a bit coming from a channel with error rate $e$ in a realistic
542: scenario, it follows that the usage of information channels with high error
543: rate $e$ effectively shrinks the key. Using all information channels would completely
544: negate the advantage of non-postselected RR versus postselected DR in a realistic scenario. As a remedy, we propose to introduce
545: postselection of effective binary channels in the RR protocol as well. This
546: combination of the RR idea and postselection can help to give good performance with realistic protocols. The dotted curve in
547: Fig. \ref{figure} represents our numerical results for a postselected RR
548: protocol.
549:
550: Our results for imperfect detectors are summarized in Fig.
551: \ref{detector}. Since it is necessary to postselect the data in the RR case
552: even in absence of detector noise, we omit the curves for the
553: non-postselected RR protocol. We find that all investigated postselected
554: protocols are robust against typical values of the detector excess noise
555: $\delta$. The dashed lines in Fig. \ref{detector} include a detector noise
556: of $\delta=0.1$ and do not differ significantly from the corresponding curves
557: in Fig. \ref{figure} which include an inefficient error
558: correction protocol but neglect noisy detectors. For the RR protocol, the
559: effect of detector noise is almost negligible. As mentioned before, this is due
560: to the fact that the cost of privacy amplification $\chi^{RR}$ decreases in
561: the RR scenario. This can partially compensate for the higher cost of error correction.
562:
563: \begin{figure}
564: \includegraphics[width=0.48\textwidth]{BSDRRRpracdet.eps}
565: \caption{\label{detector} Influence of detector noise. Secret key rates $G$ versus transmission $\eta$ for ideal (solid lines) and realistic error correction
566: (dashed lines) for a postselected DR protocol and a postselected RR protocol
567: are shown. The dashed lines include an excess noise of $\delta=0.1$.}
568: \end{figure}
569:
570: In conclusion we find that it is important to take the influence of
571: inefficient error correction into account in evaluating QKD protocols. We propose to combine postselection
572: with reverse reconciliation to deal with losses in realistic continuous
573: variable QKD. It should be emphasized that efficient one-way error
574: reconciliation procedures are essential to make this approach work. As a
575: fall-back position, we can use the DR scheme with PS for which protocols are
576: available already today.
577:
578: We thank F. Grosshans for helpful discussions. This work has been supported by
579: the network of competence QIP of the state of Bavaria (A8), the EU-IST network
580: SECOQC and the German Research Council (DFG) under the Emmy-Noether program.
581: \begin{thebibliography}{25}
582: \expandafter\ifx\csname natexlab\endcsname\relax\def\natexlab#1{#1}\fi
583: \expandafter\ifx\csname bibnamefont\endcsname\relax
584: \def\bibnamefont#1{#1}\fi
585: \expandafter\ifx\csname bibfnamefont\endcsname\relax
586: \def\bibfnamefont#1{#1}\fi
587: \expandafter\ifx\csname citenamefont\endcsname\relax
588: \def\citenamefont#1{#1}\fi
589: \expandafter\ifx\csname url\endcsname\relax
590: \def\url#1{\texttt{#1}}\fi
591: \expandafter\ifx\csname urlprefix\endcsname\relax\def\urlprefix{URL }\fi
592: \providecommand{\bibinfo}[2]{#2}
593: \providecommand{\eprint}[2][]{\url{#2}}
594:
595: \bibitem[{\citenamefont{Gisin et~al.}(2002)\citenamefont{Gisin, Ribordy,
596: Tittel, and Zbinden}}]{gisin02a}
597: \bibinfo{author}{\bibfnamefont{N.}~\bibnamefont{Gisin}},
598: \bibinfo{author}{\bibfnamefont{G.}~\bibnamefont{Ribordy}},
599: \bibinfo{author}{\bibfnamefont{W.}~\bibnamefont{Tittel}}, \bibnamefont{and}
600: \bibinfo{author}{\bibfnamefont{H.}~\bibnamefont{Zbinden}},
601: \bibinfo{journal}{Rev. Mod. Phys.} \textbf{\bibinfo{volume}{74}},
602: \bibinfo{pages}{145} (\bibinfo{year}{2002}).
603:
604: \bibitem[{\citenamefont{Grosshans
605: et~al.}(2003{\natexlab{a}})\citenamefont{Grosshans, van Assche, Wenger,
606: Brouri, Cerf, and Grangier}}]{grosshans03a}
607: \bibinfo{author}{\bibfnamefont{F.}~\bibnamefont{Grosshans}},
608: \bibinfo{author}{\bibfnamefont{G.}~\bibnamefont{van Assche}},
609: \bibinfo{author}{\bibfnamefont{J.}~\bibnamefont{Wenger}},
610: \bibinfo{author}{\bibfnamefont{R.}~\bibnamefont{Brouri}},
611: \bibinfo{author}{\bibfnamefont{N.}~\bibnamefont{Cerf}}, \bibnamefont{and}
612: \bibinfo{author}{\bibfnamefont{P.}~\bibnamefont{Grangier}},
613: \bibinfo{journal}{Nature} \textbf{\bibinfo{volume}{421}},
614: \bibinfo{pages}{238} (\bibinfo{year}{2003}{\natexlab{a}}).
615:
616: \bibitem[{\citenamefont{Silberhorn
617: et~al.}(2002{\natexlab{a}})\citenamefont{Silberhorn, Korolkova, and
618: Leuchs}}]{silberhorn02a}
619: \bibinfo{author}{\bibfnamefont{C.}~\bibnamefont{Silberhorn}},
620: \bibinfo{author}{\bibfnamefont{N.}~\bibnamefont{Korolkova}},
621: \bibnamefont{and} \bibinfo{author}{\bibfnamefont{G.}~\bibnamefont{Leuchs}},
622: \bibinfo{journal}{Phys. Rev. Lett.} \textbf{\bibinfo{volume}{88}},
623: \bibinfo{pages}{167902} (\bibinfo{year}{2002}{\natexlab{a}}).
624:
625: \bibitem[{\citenamefont{Ralph}(1999)}]{ralph00a}
626: \bibinfo{author}{\bibfnamefont{T.~C.} \bibnamefont{Ralph}},
627: \bibinfo{journal}{Phys. Rev. A} \textbf{\bibinfo{volume}{61}},
628: \bibinfo{pages}{010303(R)} (\bibinfo{year}{1999}).
629:
630: \bibitem[{\citenamefont{Hillery}(2000)}]{hillery00a}
631: \bibinfo{author}{\bibfnamefont{M.}~\bibnamefont{Hillery}},
632: \bibinfo{journal}{Phys. Rev. A} \textbf{\bibinfo{volume}{61}},
633: \bibinfo{pages}{022309} (\bibinfo{year}{2000}).
634:
635: \bibitem[{\citenamefont{Hirano et~al.}(2003)\citenamefont{Hirano, , Yamanaka,
636: Ashikaga, Konishi, and Namiki}}]{hirano03a}
637: \bibinfo{author}{\bibfnamefont{T.}~\bibnamefont{Hirano}}, ,
638: \bibinfo{author}{\bibfnamefont{H.}~\bibnamefont{Yamanaka}},
639: \bibinfo{author}{\bibfnamefont{M.}~\bibnamefont{Ashikaga}},
640: \bibinfo{author}{\bibfnamefont{T.}~\bibnamefont{Konishi}}, \bibnamefont{and}
641: \bibinfo{author}{\bibfnamefont{R.}~\bibnamefont{Namiki}},
642: \bibinfo{journal}{Phys. Rev. A} \textbf{\bibinfo{volume}{68}},
643: \bibinfo{pages}{042331} (\bibinfo{year}{2003}).
644:
645: \bibitem[{\citenamefont{Diamanti et~al.}(2005)\citenamefont{Diamanti, Takesue,
646: Honjo, Inoue, and Yamamoto}}]{diamanti05a}
647: \bibinfo{author}{\bibfnamefont{E.}~\bibnamefont{Diamanti}},
648: \bibinfo{author}{\bibfnamefont{H.}~\bibnamefont{Takesue}},
649: \bibinfo{author}{\bibfnamefont{T.}~\bibnamefont{Honjo}},
650: \bibinfo{author}{\bibfnamefont{K.}~\bibnamefont{Inoue}}, \bibnamefont{and}
651: \bibinfo{author}{\bibfnamefont{Y.}~\bibnamefont{Yamamoto}},
652: \bibinfo{journal}{Phys. Rev. A} \textbf{\bibinfo{volume}{72}},
653: \bibinfo{pages}{052311} (\bibinfo{year}{2005}).
654:
655: \bibitem[{\citenamefont{Tanzilli et~al.}(2005)\citenamefont{Tanzilli, Tittel,
656: Halder, Alibart, Baldi, Gisin, and Zbinden}}]{tanzilli05a}
657: \bibinfo{author}{\bibfnamefont{S.}~\bibnamefont{Tanzilli}},
658: \bibinfo{author}{\bibfnamefont{W.}~\bibnamefont{Tittel}},
659: \bibinfo{author}{\bibfnamefont{M.}~\bibnamefont{Halder}},
660: \bibinfo{author}{\bibfnamefont{O.}~\bibnamefont{Alibart}},
661: \bibinfo{author}{\bibfnamefont{P.}~\bibnamefont{Baldi}},
662: \bibinfo{author}{\bibfnamefont{N.}~\bibnamefont{Gisin}}, \bibnamefont{and}
663: \bibinfo{author}{\bibfnamefont{H.}~\bibnamefont{Zbinden}},
664: \bibinfo{journal}{Nature} \textbf{\bibinfo{volume}{437}},
665: \bibinfo{pages}{116} (\bibinfo{year}{2005}).
666:
667: \bibitem[{\citenamefont{Grosshans and Grangier}(2002)}]{grosshans02a}
668: \bibinfo{author}{\bibfnamefont{F.}~\bibnamefont{Grosshans}} \bibnamefont{and}
669: \bibinfo{author}{\bibfnamefont{P.}~\bibnamefont{Grangier}},
670: \bibinfo{journal}{Phys. Rev. Lett.} \textbf{\bibinfo{volume}{88}},
671: \bibinfo{pages}{057902} (\bibinfo{year}{2002}).
672:
673: \bibitem[{\citenamefont{Silberhorn
674: et~al.}(2002{\natexlab{b}})\citenamefont{Silberhorn, Ralph, L\"utkenhaus, and
675: Leuchs}}]{silberhorn02b}
676: \bibinfo{author}{\bibfnamefont{C.}~\bibnamefont{Silberhorn}},
677: \bibinfo{author}{\bibfnamefont{T.~C.} \bibnamefont{Ralph}},
678: \bibinfo{author}{\bibfnamefont{N.}~\bibnamefont{L\"utkenhaus}},
679: \bibnamefont{and} \bibinfo{author}{\bibfnamefont{G.}~\bibnamefont{Leuchs}},
680: \bibinfo{journal}{Phys. Rev. Lett.} \textbf{\bibinfo{volume}{89}},
681: \bibinfo{pages}{167901} (\bibinfo{year}{2002}{\natexlab{b}}).
682:
683: \bibitem[{\citenamefont{Grosshans
684: et~al.}(2003{\natexlab{b}})\citenamefont{Grosshans, Cerf, Wenger,
685: Tualle-Brouri, and Grangier}}]{grosshans03b}
686: \bibinfo{author}{\bibfnamefont{F.}~\bibnamefont{Grosshans}},
687: \bibinfo{author}{\bibfnamefont{N.~J.} \bibnamefont{Cerf}},
688: \bibinfo{author}{\bibfnamefont{J.}~\bibnamefont{Wenger}},
689: \bibinfo{author}{\bibfnamefont{R.}~\bibnamefont{Tualle-Brouri}},
690: \bibnamefont{and} \bibinfo{author}{\bibfnamefont{P.}~\bibnamefont{Grangier}},
691: \bibinfo{journal}{Quantum Information and Computation}
692: \textbf{\bibinfo{volume}{3}}, \bibinfo{pages}{535}
693: (\bibinfo{year}{2003}{\natexlab{b}}).
694:
695: \bibitem[{\citenamefont{Grosshans}(2005)}]{grosshans05a}
696: \bibinfo{author}{\bibfnamefont{F.}~\bibnamefont{Grosshans}},
697: \bibinfo{journal}{Phys. Rev. Lett.} \textbf{\bibinfo{volume}{94}},
698: \bibinfo{pages}{020504} (\bibinfo{year}{2005}).
699:
700: \bibitem[{\citenamefont{Navascu\'es and Ac\'in}(2005)}]{navascues05a}
701: \bibinfo{author}{\bibfnamefont{M.}~\bibnamefont{Navascu\'es}} \bibnamefont{and}
702: \bibinfo{author}{\bibfnamefont{A.}~\bibnamefont{Ac\'in}},
703: \bibinfo{journal}{Phys. Rev. Lett.} \textbf{\bibinfo{volume}{94}},
704: \bibinfo{pages}{020505} (\bibinfo{year}{2005}).
705:
706: \bibitem[{\citenamefont{Namiki and Hirano}(2004)}]{namiki04a}
707: \bibinfo{author}{\bibfnamefont{R.}~\bibnamefont{Namiki}} \bibnamefont{and}
708: \bibinfo{author}{\bibfnamefont{T.}~\bibnamefont{Hirano}},
709: \bibinfo{journal}{Phys. Rev. Lett.} \textbf{\bibinfo{volume}{92}},
710: \bibinfo{pages}{117901} (\bibinfo{year}{2004}).
711:
712: \bibitem[{\citenamefont{Curty et~al.}(2004)\citenamefont{Curty, Lewenstein, and
713: L\"utkenhaus}}]{curty04a}
714: \bibinfo{author}{\bibfnamefont{M.}~\bibnamefont{Curty}},
715: \bibinfo{author}{\bibfnamefont{M.}~\bibnamefont{Lewenstein}},
716: \bibnamefont{and}
717: \bibinfo{author}{\bibfnamefont{N.}~\bibnamefont{L\"utkenhaus}},
718: \bibinfo{journal}{Phys. Rev. Lett.} \textbf{\bibinfo{volume}{92}},
719: \bibinfo{pages}{217903} (\bibinfo{year}{2004}).
720:
721: \bibitem[{\citenamefont{Curty et~al.}(2005)\citenamefont{Curty, G\"uhne,
722: Lewenstein, and L\"utkenhaus}}]{curty05a}
723: \bibinfo{author}{\bibfnamefont{M.}~\bibnamefont{Curty}},
724: \bibinfo{author}{\bibfnamefont{O.}~\bibnamefont{G\"uhne}},
725: \bibinfo{author}{\bibfnamefont{M.}~\bibnamefont{Lewenstein}},
726: \bibnamefont{and}
727: \bibinfo{author}{\bibfnamefont{N.}~\bibnamefont{L\"utkenhaus}},
728: \bibinfo{journal}{Phys. Rev. A} \textbf{\bibinfo{volume}{71}},
729: \bibinfo{pages}{022306} (\bibinfo{year}{2005}).
730:
731: \bibitem[{\citenamefont{Namiki and Hirano}(2005)}]{namiki05a}
732: \bibinfo{author}{\bibfnamefont{R.}~\bibnamefont{Namiki}} \bibnamefont{and}
733: \bibinfo{author}{\bibfnamefont{T.}~\bibnamefont{Hirano}},
734: \bibinfo{journal}{Phys. Rev. A} \textbf{\bibinfo{volume}{72}},
735: \bibinfo{pages}{024301} (\bibinfo{year}{2005}).
736:
737: \bibitem[{\citenamefont{Lorenz et~al.}(2004)\citenamefont{Lorenz, Korolkova,
738: and Leuchs}}]{lorenz04a}
739: \bibinfo{author}{\bibfnamefont{S.~K.} \bibnamefont{Lorenz}},
740: \bibinfo{author}{\bibfnamefont{N.}~\bibnamefont{Korolkova}},
741: \bibnamefont{and} \bibinfo{author}{\bibfnamefont{G.}~\bibnamefont{Leuchs}},
742: \bibinfo{journal}{Appl. Phys. B} \textbf{\bibinfo{volume}{79}},
743: \bibinfo{pages}{273} (\bibinfo{year}{2004}).
744:
745: \bibitem[{\citenamefont{Lorenz et~al.}()\citenamefont{Lorenz, Rigas, Heid,
746: Andersen, L\"utkenhaus, and Leuchs}}]{lorenz05suba}
747: \bibinfo{author}{\bibfnamefont{S.}~\bibnamefont{Lorenz}},
748: \bibinfo{author}{\bibfnamefont{J.}~\bibnamefont{Rigas}},
749: \bibinfo{author}{\bibfnamefont{M.}~\bibnamefont{Heid}},
750: \bibinfo{author}{\bibfnamefont{U.~L.} \bibnamefont{Andersen}},
751: \bibinfo{author}{\bibfnamefont{N.}~\bibnamefont{L\"utkenhaus}},
752: \bibnamefont{and} \bibinfo{author}{\bibfnamefont{G.}~\bibnamefont{Leuchs}},
753: \bibinfo{note}{quant-ph/0603271}.
754:
755: \bibitem[{\citenamefont{Shannon}(1948)}]{shannon48a}
756: \bibinfo{author}{\bibfnamefont{C.}~\bibnamefont{Shannon}},
757: \bibinfo{journal}{Bell Syst. Tech. J.} \textbf{\bibinfo{volume}{27}},
758: \bibinfo{pages}{379} (\bibinfo{year}{1948}).
759:
760: \bibitem[{\citenamefont{Bennett et~al.}(1995)\citenamefont{Bennett, Brassard,
761: and Maurer}}]{bennett95a}
762: \bibinfo{author}{\bibfnamefont{C.~H.} \bibnamefont{Bennett}},
763: \bibinfo{author}{\bibfnamefont{G.}~\bibnamefont{Brassard}}, \bibnamefont{and}
764: \bibinfo{author}{\bibfnamefont{U.~M.} \bibnamefont{Maurer}},
765: \bibinfo{journal}{IEEE Trans. Inf. Theory} \textbf{\bibinfo{volume}{41}},
766: \bibinfo{pages}{1915} (\bibinfo{year}{1995}).
767:
768: \bibitem[{\citenamefont{Holevo}(1973)}]{holevo73b}
769: \bibinfo{author}{\bibfnamefont{A.~S.} \bibnamefont{Holevo}},
770: \bibinfo{journal}{Probl. Inf. Transm.} \textbf{\bibinfo{volume}{9}},
771: \bibinfo{pages}{177} (\bibinfo{year}{1973}).
772:
773: \bibitem[{\citenamefont{Devetak and Winter}(2005)}]{devetak05a}
774: \bibinfo{author}{\bibfnamefont{I.}~\bibnamefont{Devetak}} \bibnamefont{and}
775: \bibinfo{author}{\bibfnamefont{A.}~\bibnamefont{Winter}},
776: \bibinfo{journal}{Proc. of the Roy. Soc. of London Series A}
777: \textbf{\bibinfo{volume}{461}}, \bibinfo{pages}{207} (\bibinfo{year}{2005}).
778:
779: \bibitem[{\citenamefont{Brassard and Salvail}(1994)}]{brassard93a}
780: \bibinfo{author}{\bibfnamefont{G.}~\bibnamefont{Brassard}} \bibnamefont{and}
781: \bibinfo{author}{\bibfnamefont{L.}~\bibnamefont{Salvail}}, in
782: \emph{\bibinfo{booktitle}{Advances in Cryptology - EUROCRYPT '93}}, edited by
783: \bibinfo{editor}{\bibfnamefont{T.}~\bibnamefont{Helleseth}}
784: (\bibinfo{publisher}{Springer}, \bibinfo{address}{Berlin},
785: \bibinfo{year}{1994}), vol. \bibinfo{volume}{765} of
786: \emph{\bibinfo{series}{Lecture Notes in Computer Science}}, pp.
787: \bibinfo{pages}{410--423}.
788:
789: \bibitem[{\citenamefont{Cachin and Maurer}(1997)}]{cachin97a}
790: \bibinfo{author}{\bibfnamefont{C.}~\bibnamefont{Cachin}} \bibnamefont{and}
791: \bibinfo{author}{\bibfnamefont{U.~M.} \bibnamefont{Maurer}},
792: \bibinfo{journal}{J. Cryptology} \textbf{\bibinfo{volume}{10}},
793: \bibinfo{pages}{97} (\bibinfo{year}{1997}).
794:
795: \end{thebibliography}
796:
797: \end{document}
798: