Continuous variable quantum key distribution with a shared partially characterized entangled source

Shanna Du; Pu Wang; Jianqiang Liu; Yan Tian; Yongmin Li

doi:10.1364/PRJ.475943

Abstract

Locking the sophisticated and expensive entanglement sources at the shared relay node is a promising choice for building a star-type quantum network with efficient use of quantum resources, where the involved parties only need to equip low-cost and simple homodyne detectors. Here, to our best knowledge, we demonstrate the first experimental continuous variable quantum key distribution with an entanglement source between the two users. We consider a practical partially characterized entangled source and establish the security analysis model of the protocol under realistic conditions. By applying a biased base technology, the higher key rate than that of the original protocol is achieved. The experimental results demonstrate that the distance between two users can reach up to 60 km over telecom single-mode fiber, implying the feasibility for high-rate and secure communication with a shared entangled source at metropolitan distances.

1. INTRODUCTION

Quantum key distribution (QKD) allows two distant parties to distill a common secret key by exploring the fundamental principles of quantum mechanics [1 –3]. Different from the discrete-variable (DV) QKD schemes, the continuous-variable (CV) QKD [4 –6] systems encode key information on the multiphoton quantum states and measure their quadratures using high-efficiency homodyne (heterodyne) detectors instead of single-photon detection technologies, which have potential higher secret key rates at metropolitan distances. In the last two decades, CV-QKD has received extensive attention [7,8], and remarkable progress has been achieved both theoretically and experimentally [9 –25].

At present, most CV-QKD implementations are based on a one-way regime, where one of the two parties (transmitter) needs to establish a source, and the other (receiver) performs detection. Placing the entanglement source between two users offers an alternative route for secure communication with efficient use of quantum resources [26 –28]. Here, we demonstrate the first experimental CV-QKD with entanglement source between the two users, which is suitable to develop an entanglement-based CV-QKD network, where the sophisticated and expensive entanglement source can be shared by multiple end users [29,30]. The initial concept was introduced in Ref. [26], proposing a scheme that allowed communicating parties to achieve a secure key when the entanglement originates from the middle and, hence, is well suited to construct a centric CV-QKD network with a shared entanglement source. However, the challenge occurs due to the assumption that the entangled source is perfectly pure and the homodyne detection is ideal (quantum efficiency of 100% and no dark noises), which is not suitable for the practical applications. Note that any realistic preparation process of Einstein–Podolsky–Rosen (EPR) states inevitably introduces losses and excess noises, and no pure EPR states can be produced in real scenarios.

In this work, we treat the entanglement source as a realistic mixed EPR source and take the trusted losses and electronic noises of the realistic detectors into account. We focus on a practical consideration of a partially characterized source, where the variances and correlations of the two output modes of the source are known, and the output modes keep the characteristics of Gaussian and independent and identical distribution (i.i.d.), which can be verified by testing the output of the prepared source. Note that the state preparation process does not need to be characterized. This means that an attacker (Eve) is able to acquire additional information by purifying the practical mixed source while maintaining the output characteristics of the source unchanged. A general security model under above conditions is established, and an improved strategy for the secret key rate is proposed by using a biased base method. Finally, we experimentally demonstrate the protocol over long distance fibers, where the entanglement source is located at the relay node, and the distance between two users can reach up to 60 km, providing the possibility for the deployment of high-rate, cost-effective metropolitan quantum network.

Sign up for Photonics Research TOC. Get the latest issue of Photonics Research delivered right to you！Sign up now

2. PROTOCOL DESCRIPTION

The schematic of the protocol with entanglement source between the two users is illustrated in Fig. 1(a), which consists of two legitimate users, Alice and Bob, and a relay, Charlie, who prepares a mixed Gaussian EPR entangled state. Here, the actual physical implementation model of the state preparation process does not need to be characterized and can be regarded as a black box. The two modes of the EPR source are sent to Alice and Bob through two independent quantum channels and subsequently detected by homodyne detection. Due to the Gaussian and i.i.d. EPR source, according to the optimality of Gaussian attacks, the collective Gaussian attack is optimal for Eve. Therefore, we do not require the channel linearity assumption. By implementing parameter estimation, information reconciliation, and privacy amplification procedures, the secret keys can be extracted.

Schematic illustration of CV-QKD protocol with partially characterized entangled source between the two users. (a) Prepare-and-measure (PM) scheme for protocol. (b) Equivalent purification scheme for protocol. Hom, homodyne detection; QM, quantum memory.

Figure 1.Schematic illustration of CV-QKD protocol with partially characterized entangled source between the two users. (a) Prepare-and-measure (PM) scheme for protocol. (b) Equivalent purification scheme for protocol. Hom, homodyne detection; QM, quantum memory.

For convenience of security analysis, a purification scheme of the protocol is given in Fig. 1(b). Here, we assume the mixed EPR states are prepared by Eve, and that she can obtain additional information by purifying the mixed EPR source [14]. In order to mask her attack, the characteristics of the EPR states $ρ_{A_{0} B_{0}}$ remain intact. The two quantum channels are modeled by their transmissions $T_{A}$ and $T_{B}$ and mixed with thermal noises $E_{1}$ and $E_{2}$ , which are extracted from a reservoir of entangled ancillae and have quantum correlations. This joint two-mode Gaussian attack is more powerful than two independent collective Gaussian attacks (see Appendix B for more details). At Alice’s and Bob’s sites, the realistic noisy detection is purified by a beam splitter with one of the input ports injected with a thermal state (one beam of an EPR state) followed by an ideal detector. The transformation of the beam splitter is employed to model the detection efficiency $η_{A}$ ( $η_{B}$ ), while the injected EPR beam is used to model the electronic noise $ν_{e l A}$ ( $ν_{e l B}$ ). Based on the above purification schemes, the secret key rate can be estimated.

3. BIASED BASE

In the previous entanglement-based CV-QKD protocols, both Alice and Bob randomly measure the amplitude or phase quadrature of one of the entangled modes with an equal probability of 1/2. However, the secret key can only be extracted when both parties choose the same quadrature measurement base. Thus, they must discard half of the raw data after the base-sifting procedure, which results in waste of quantum state resources and low efficiency of the protocol. To improve the secret key rate, we present a biased-base scheme for entanglement-based CV-QKD similar to DV-QKD [31], in which Alice and Bob choose their measurement bases with nonuniform probability.

Suppose that Alice randomly chooses to implement a measurement in the phase and amplitude quadratures with probabilities $P_{A}$ and $1 - P_{A}$ , respectively, and Bob measures the phase and amplitude quadratures with probabilities $P_{B}$ and $1 - P_{B}$ , respectively. To ensure security, Alice and Bob must evaluate the key rate from two sifted measurement bases. The secret key rate against collective attacks with reverse reconciliation in the asymptotic limit is given by $K_{R R}^{\infty} = (1 - P_{A}) (1 - P_{B}) (β I_{A B}^{x} - χ_{B E}^{x}) + P_{A} P_{B} (β I_{A B}^{p} - χ_{B E}^{p}),$ (1)where $(1 - P_{A}) (1 - P_{B})$ and $P_{A} P_{B}$ are the sifting efficiencies of the two bases. $β$ is the reconciliation efficiency. $I_{A B}^{x}$ ( $I_{A B}^{p}$ ) denotes the Shannon mutual information between Alice’s and Bob’s data on the amplitude (phase) quadrature. $χ_{B E}^{x}$ and $χ_{B E}^{p}$ denote the Holevo bound for the amplitude and phase quadratures, respectively, putting the upper limit on the information available to Eve on Bob’s sifted key. Using the purification treatment, $χ_{B E}^{x (p)}$ can be obtained by $χ_{B E}^{x (p)} = S (ρ_{E}) - S (ρ_{E / B}^{x (p)}) = S (ρ_{A_{1} B_{1}}) - S (ρ_{A_{1} F G / B}^{x (p)}),$ (2)where $S (ρ)$ is the von Neumann entropy, which can be directly calculated from the symplectic eigenvalues of the covariance matrix of quantum states (see Appendix A for more details).

The key rate can be improved by optimizing the total sifting efficiency $P_{A} P_{B} + (1 - P_{A}) (1 - P_{B})$ , where $P_{A}, P_{B} \in (0,1)$ . When the probabilities $P_{A}$ and $P_{B}$ are equal to 1 or 0, the total sifting efficiency reaches the maximum value. Note that $P_{A}$ and $P_{B}$ cannot be set to 1 or 0, or the covariance matrix cannot be accurately estimated due to the lack of nonobserved quadrature data. To ensure security, the unknown parameters of the covariance matrix must be constrained by the Heisenberg uncertainty principle as the manipulation in the unidimensional CV-QKD protocol [32], which results in a significant degradation of the key rate. In our experiment, we chose $P_{A} = P_{B} = P = 0.9$ , which indicates that the phase quadratures are selected to be observed for most of the time. Within this framework, the key rate generated is 64% higher than that of the original unbiased base protocol (see Appendix E for more details).

4. EXPERIMENTAL DEMONSTRATION

A. Experimental Setup

In our experiment, we implement the protocol with an asymmetric configuration, meaning that Charlie is located close to one of the users, which provides better performance compared with the near-symmetric channels (see Appendix D for details). Note that such asymmetric configurations find widespread applications in practical QKD network setups [17,33].

A schematic of our experimental setup is shown in Fig. 2. The EPR entanglement source is placed at Charlie’s site, which consists of a nonlinear resonator with a periodically poled ${KTiOPO}_{4}$ crystal inside. The nonlinear resonator is bidirectionally pumped by a 532 nm laser [34]. In the clockwise direction, the resonator operates above threshold and outputs bright downconversion fields that serve as the local oscillators (LOs) of Alice’s and Bob’s balanced homodyne detectors (BHD1 and BHD2), whereas in the anticlockwise direction, the resonator operates below threshold and generates the EPR entangled state (see Appendix G for more details).

Figure 2.Schematic drawing of the experimental setup. Charlie prepares a two-color EPR entangled state and sends one mode (810 nm) to Alice and the other mode (1550 nm) to Bob. The two users randomly measure the amplitude or phase quadrature of the received signal mode with BHDs. PZT, piezoelectric-transducer; AM, amplitude modulator; PM, phase modulator; FM, Faraday mirror; PBS, polarization beam splitter; DBS, dichroic beam splitter; HR, mirror with high reflection; HWP, half-wave plate; PC, polarization controller; EDFA, erbium-doped fiber amplifier; ATT, attenuator; FPS, fiber phase shifter; BS, 50:50 beam splitter.

The key rate depends on the two-mode squeezing and antisqueezing levels of the entangled state. However, higher two-mode squeezing does not necessarily mean higher key rate, especially at long distances, because higher two-mode squeezing is usually accompanied by a higher excess noise in anti-squeezing, which degrades the purity of the EPR states that can be exploited by Eve. To improve the key rate, a high-purity EPR state is prepared by suppressing the intracavity loss and improving the escape efficiency of the nonlinear resonator. Furthermore, the pump power of the nonlinear resonator is optimized to generate an EPR source with squeezing and antisqueezing levels of $- 7.1$ and 9.6 dB, respectively. In this case, the key rate is maximized within a transmission distance of 80 km (from Charlie to Bob $L_{B}$ ) when the distance between Alice and Charlie is close to 0 km (see Appendix D for more details).

The two modes of the EPR state and the corresponding LOs are separated by two dichroic beam splitters, and the mode at 810 nm is sent to Alice, whereas the other mode at 1550 nm is coupled into single-mode polarization-maintaining fiber devices. The LO beam at 1550 nm is converted into pulsed light with a 50 kHz repetition rate and 8.5 μs pulse width by an amplitude modulator (AM). It is delayed by a 1.8 km single-mode fiber and combined with the signal mode on a polarization beam splitter (PBS). Then, the polarization-multiplexing and time-division-multiplexing LO and signal beams are sent to Bob via a telecom single-mode fiber. In this way, the photon leakage and nonlinear scattering noise of the intense LO beam are suppressed.

At Alice’s site, we only couple the LO beam into the fiber-pigtailed phase modulator (PM) to randomly switch the measurement bases between the phase and amplitude quadrature. The signal beam propagates in free space and combines with the output LO beam from the collimator at a PBS. Then, the two beams interfere at a 50:50 beam splitter consisting of a half-wave plate and a PBS, and the output modes are detected by BHD1.

At Bob’s site, the signal and LO beams at 1550 nm output from the long-distance fiber are polarization-demultiplexed by a polarization controller (PC) and PBS. The signal mode is delayed by the same length of fiber as that of the LO at Charlie’s site to ensure the time synchronization between the signal and the LO. When the length of the transmission fiber is more than 40 km, an erbium-doped fiber amplifier followed by an optical filter (the full width at half-maximum is 160 pm) and an optical attenuator are employed to boost the LO power, so as to ensure that the signal-to-noise ratio of BHD2 is above 10 dB.

B. Switching Measurement Bases

Figure 3 shows a time-sequence diagram of the signal modes and measurement base pulses in our experiment. The orange and pink lines represent the signal modes measured at Alice’s and Bob’s sites, respectively. The solid squares indicate four pairs of entangled quantum states generated from the EPR entangled source at the same time; more precisely, $(1_{A}, 1_{B})$ , $(2_{A}, 2_{B})$ , $(3_{A}, 3_{B})$ , and $(4_{A}, 4_{B})$ . The time span of each quantum state is 6 μs. Bob’s quantum state has a delay of approximately 100 μs relative to Alice’s quantum state, which arises from the delay of 20 km of telecom single-mode fiber. The black line represents the pulsed LO that is synchronized with signal mode at Bob’s site. The green and blue lines represent the measurement base voltage pulses that Alice and Bob have independently chosen.

Figure 3.Time-sequence diagram of signal modes and measurement base pulses. It shows the relative timing relationship between the signal mode and its corresponding measurement base pulses.

To ensure that both users share the same phase reference frame and implement the correct quadrature measurement, we use a piezoelectric-transducer and a fiber phase shifter to compensate the slow phase drift between the LO and signal beams and lock their relative phase to $π / 2$ . Then, the electric pulses of the random and independent measurement bases are applied to the high-speed PM, so as to realize the random switching between the phase and amplitude quadratures. During the operation of the QKD system, the clocks of pulse-chopping, measurement bases, and quadrature sampling of Alice, Bob, and Charlie are strictly synchronized.

Particular attention must be paid to the introduction of excess noises, which seriously affect QKD performance. The base-switching pulses will affect the error signal of the slow drift phase and reduce the locking accuracy, which further disturbs the normal measurement of BHD. To measure the phase quadrature, zero voltage is applied to PM for the first 20 μs, followed by a $j V_{π / 2}$ ( $j = +, -$ ) voltage of 20 μs. For measurement of the amplitude quadrature, we first actuate the PM with voltage of $j V_{π / 2}$ for 20 μs and then switch the voltage to 0 for another 20 μs. The sign of the current voltage $j V_{π / 2}^{n}$ is opposite to that of the previous voltage $j V_{π / 2}^{n - 1}$ with $j = +$ for $n = 1$ . In this case, the high-frequency phase variation component caused by the bases switching can be averaged within a maximum period of 80 μs. In addition, a 5 kHz low-pass filter is used to filter the high-frequency phase variation component in the error signal before it is fed into the phase lock loop, so as to ensure that the locking accuracy remains intact with and without the measurement bases [18].

C. Experimental Results

Figure 4.Key rates for different distances and quantum correlation of the distributed EPR states. (a) Security key rates versus transmission distance from Charlie to Bob ( $L_{B}$ ) for different (equivalent) transmission distances from Charlie to Alice ( $L_{A}$ ) of 0, 1, and 2 km. Solid and dashed lines represent the theoretical simulation with the $p$ base choosing probabilities of $P = 0.9$ and 0.5, respectively. Circles and triangles represent experimental measurement data. (b) Under conditions of $L_{A} = 2 km$ and $L_{B} = 20 km$ , the quantum correlation between Alice’s and Bob’s amplitude quadrature ( $1 - P = 0.1$ ) and phase quadrature ( $P = 0.9$ ).

Figure 4(b) shows the quantum correlation outcomes of the amplitude quadrature $(x_{A}, x_{B})$ and phase quadrature $(p_{A}, p_{B})$ simultaneously observed by Alice and Bob at $L_{A} = 2 km$ and $L_{B} = 20 km$ . From the experimental data, we can determine the EPR criterion to be $\sqrt{V_{A | B}^{x} \cdot V_{A | B}^{p}} = 0.935 < 1$ , which clearly verifies the quadrature entanglement of the two modes shared between Alice and Bob.

We implement the protocol for three situations: (1) $L_{A} = 0 km$ , and $L_{B}$ varying from 10 to 60 km; (2) $L_{A} = 1 km$ , and $L_{B}$ varying from 10 to 40 km; (3) $L_{A} = 2 km$ , and $L_{B}$ varying from 10 to 20 km. Two biased-base choices of 0.9/0.1 (phase quadrature/amplitude quadrature) and 0.5/0.5 are demonstrated. The biased base of 0.9/0.1 increases the key rate significantly, i.e., by an amount of 64% compared with the unbiased base 0.5/0.5, which confirms our theoretical analysis of the optimal basis-selection ratio.

5. CONCLUSIONS AND OUTLOOK

The CV-QKD with the entanglement source between two users has the best performance at an asymmetric configuration; that is, one of the QKD users is closer to the entanglement source. This protocol is applicable to a number of star-type quantum networks with asymmetric configuration in practice, such as the quantum cryptography government network shown in Fig. 5, in which the private communication between each department of the civic center (Alice) and remote district government (Bob) can be established. More precisely, the sophisticated and expensive entangled source can be located in the civic center, so that each department of the civic center is very close to it. Computer-controlled optical switches can be used to connect the departments of the civic center and remote district government according to a user’s request in this network. Once the connection between a pair of users is established, the entangled beams are sent to them via quantum channels. In this case, the departments of the civic center can share secret keys with the remote district government using the protocol.

Figure 5.Star-type quantum network. The entanglement source is placed at a common network node and is shared by multiple end users.

We have demonstrated the first CV-QKD with partially characterized EPR entangled states as the common relay node. To increase the efficiency of the scheme, we proposed and demonstrated the biased base strategy, which significantly improves the key rate compared with the original unbiased protocol. We remark that this can be extended to the finite-size scenario [35] (see Appendix E). Our work contributes an important step to the establishment of a CV-QKD quantum network with shared entanglement source, in which users only need to employ inexpensive detection equipment. More precisely, the output modes of the EPR source between the two users can be connected to $1 \times M$ and $1 \times N$ optical switches with nearby and distant users, respectively. By controlling the optical switch using a computer, each nearby user connected to one mode of the source can share the secure key with any distant user connected to the other mode of the source. It forms an $M$ to $N$ quantum network with entanglement source sharing.

The performance of our experimental system can be improved by further optimization. For instance, one can increase the propagation efficiency from the source to the nearest receiver Alice from 97% to 99%, optimize the interference efficiency to 99% and quantum efficiency of the photodiode to 99%. Similarly, the detection efficiency of Bob can be improved to 0.6 by welding all optical fiber devices to reduce the connector loss. For the entangled source, the escape efficiency can be increased to 0.95 by increasing the transmittance of the output coupling mirror and reducing the intracavity loss. Through the above optimizations, the distribution distance from the source to Alice can increase to 5 km with $L_{B} = 25 km$ .

In our protocol, the entangled source is assumed to be partially characterized and the receiver is trusted. If the source is completely uncharacterized or untrusted, the non-Gaussian attack can be carried out by Eve to gain more information. The performance improvement of the protocol against this attack is worthy to be explored. For a completely characterized and trusted source, Eve can only attack the two quantum channels. In this case, the performance of the entanglement-in-the-middle protocol can be improved significantly (see Appendix F). For instance, the distribution distance can be increased to $L_{A} = L_{B} = 8 km$ or $L_{A} = 5 km$ and $L_{B} = 60 km$ , effectively extending the distance in the symmetric and asymmetric quantum channels.

At present, a number of attacks against the receiver have been found, including saturation attack [36], blinding attack [37], calibration attack [38], and LO intensity attack [39]. However, these loopholes can be effectively eliminated by employing proper countermeasures [7,8]. For instance, one solution against these attacks is to add a real-time monitoring module for the LO power and the shot noise. The locally LO (LLO) scheme is also a useful countermeasure to prevent LO attacks [40,41]. In future work, we will employ the LLO scheme and implement real-time shot-noise measurement to guarantee the practical security at the receiver side.

Further research contains several directions. First, the user’s detection equipment can be integrated into photonic and electronic chips to form a miniaturized and convenient QKD network [42,43]. Second, the protocol may be extended to a fully connected quantum network architecture via wavelength-division multiplexing technologies [44]. In addition, the protocol is limited to asymmetric situations at present for good performance, where one user is located relatively closer to the relay. For symmetric case, our QKD system can reach $L_{A} = L_{B} = 5 km$ . Extending the distance of the protocol in a symmetric case is an issue to be addressed in the future to meet the wider applications.

Although our work focuses on the proof-of-principle experimental demonstration, the stability of the experimental system is critical to support the long-term use of future quantum networks. The main issue to solve is the development of an integrated, miniaturized, and stable entanglement source that supports long-term stable operation. The other key issue is that the implementation of all control and data-processing tasks of the system should be fully automated without human interaction.

APPENDIX A: THEORETICAL SECRET KEY RATE

K_{R R}^{\infty} = P_{A} P_{B} (β I_{A B}^{x} - χ_{B E}^{x}) + (1 - P_{A}) (1 - P_{B}) (β I_{A B}^{p} - χ_{B E}^{p}) .

χ_{B E}^{x (p)}

γ_{A_{0} B_{0}}

γ_{A_{1} F G / B}^{x (p)}

γ_{A_{1} B_{1}}

APPENDIX B: MINIMIZATION OF THE KEY RATE

(g, g^{'})

I_{A B}^{x} = \frac{1}{2} \log_{2} \frac{V_{A_{1}} V_{B_{1}}}{V_{A_{1}} V_{B_{1}} - {(C_{A_{1} B_{1}}^{x})}^{2}}, I_{A B}^{p} = \frac{1}{2} \log_{2} \frac{V_{A_{1}} V_{B_{1}}}{V_{A_{1}} V_{B_{1}} - {(C_{A_{1} B_{1}}^{p})}^{2}} .

P_{A} = P_{B} = 1 / 2

g^{'} = - g

Figure 6.Accessible points and key rate in the correlation plane $(g, g^{'})$ for $L_{A} = 1 km$ and $L_{B} = 20 km$ . The other parameters are set to $β = 0.95$ , $ε_{A} = 0.001$ , $ε_{B} = 0.01$ , $η_{A} = 0.884$ , $η_{B} = 0.506$ , $ν_{e l A} = 0.02$ , $ν_{e l B} = 0.05$ , and $P_{A} = P_{B} = 0.9$ .

Figure 7.Zoom of top-left corner of Fig. 6.

APPENDIX C: EXPERIMENTAL SECRET KEY RATE

γ_{A B}

m_{x}

APPENDIX D: PERFORMANCE DEPENDENCE OF THE PROTOCOL ON THE EPR STATES

(x_{d A}, x_{d B})

To fully investigate the dependence of protocol on the entanglement degree of the EPR states, we experimentally prepare the two-mode entangled state with different levels of squeezing and antisqueezing. In Fig. 8, we simulate the asymptotic secret key rate versus transmission distance for EPR states with the experimental squeezing and antisqueezing values. Figure 8 (a) represents the situation where the distance between Alice and Charlie is close to 0 km, and Fig. 8 (b) simulates a 1 km of channel loss between Alice and Charlie. It is clear that the key rate can be significantly improved by raising the efficiency of Alice’s detector, because high efficiency increases the mutual information between Alice and Bob while keeping the knowledge of Eve about Bob’s results unchanged.

Figure 8.Secret key rate versus transmission distance in the asymptotic case. The simulation parameters are set to $β = 0.95$ , $ε_{A} = 0.001$ , $ε_{B} = 0.01$ , $η_{A} = 0.884$ , $η_{s} = 0.81$ , $η_{B} = 0.506$ , $ν_{e l A} = 0.02$ , and $ν_{e l B} = 0.05$ .

Figure 9.Maximum transmission distance from Charlie to Bob ( $L_{B}$ ) versus the distance from Charlie to Alice ( $L_{A}$ ).

APPENDIX E: IMPROVING THE SECRET KEY RATE VIA A BIASED BASE METHOD

K^{\infty} = P_{A} P_{B} (β I_{A B}^{x} - χ_{B E}^{x}) + (1 - P_{A}) (1 - P_{B}) (β I_{A B}^{p} - χ_{B E}^{p}) \approx [P_{A} P_{B} + (1 - P_{A}) (1 - P_{B})] (β I_{A B} - χ_{B E}) .

In CV-QKD, there are two detection methods for the quantum signals: homodyne detection and heterodyne detection. The heterodyne detection does not need to randomly switch the measurement bases; instead, it measures two quadratures at the same time. Therefore, all the data can be used to extract the key; however, it will inevitably introduce vacuum noises. The homodyne detection detects only a quadrature by randomly switching the measurement bases. The secret key can only be extracted when both parties choose the same measurement bases. Thus, in the original unbiased base scheme, half of the raw data have to be discarded, which results in the waste of quantum state resources and low efficiency of the protocol. By changing the switching ratio of bases, the total base sifted efficiency and the key rate can be significantly increased.

As shown in Fig. 10, we compare the key rates for the three different protocols. The black solid lines indicate the original case where Alice and Bob both perform homodyne detection with equal base choice ratio of 0.5/0.5, which is equivalent to the squeezed states protocol with homodyne detection and reverse reconciliation. The blue dashed lines indicate the case where Alice performs homodyne detection and Bob performs heterodyne detection, which is equivalent to the squeezed states protocol with heterodyne detection and reverse reconciliation. The red dashed lines indicate the case where Alice and Bob both perform homodyne detection with biased-base choices of 0.9/0.1. The simulation parameters are set to be the same as those in Fig. 4 (or Table 1) of the main text. We can see that the proposed biased-base scheme can achieve a higher key rate at most of the distribution distance. The heterodyne detection, instead of homodyne detection at Bob’s side, can only increase the transmission distance a little. Note that the case where both Alice and Bob perform heterodyne detection, which is equivalent to the coherent states protocol and heterodyne detection, is not shown here as there is no positive key rate.

Figure 10.Secret key rate versus the transmission distance for three different protocols. The simulation parameters are set to $β = 0.95$ , $ε_{A} = 0.001$ , $ε_{B} = 0.01$ , $η_{A} = 0.884$ , $η_{s} = 0.81$ , $η_{B} = 0.506$ , $ν_{e l A} = 0.02$ , and $ν_{e l B} = 0.05$ .

N

APPENDIX F: COMPLETELY CHARACTERIZED SOURCE

ρ_{A_{0} B_{0}}

Figure 11.PM and EB schemes of CV-QKD protocol with completely characterized entangled source. Hom, homodyne detection; SQZ, quadrature squeezer; QM, quantum memory.

Figure 12.Maximum transmission distance from Charlie to Bob ( $L_{B}$ ) versus the distance from Charlie to Alice ( $L_{A}$ ) for completely characterized entangled source with two-mode squeezing and antisqueezing of $- 7.1$ and 9.6 dB. The simulation parameters are set to $β = 0.95$ , $ε_{B} = 0.01$ , $η_{A} = 0.884$ , $η_{B} = 0.506$ , $ν_{e l A} = 0.02,$ and $ν_{e l B} = 0.05$ .

APPENDIX G: EXPERIMENTAL DETAILS AND RESULTS

In the CV-QKD experiment based on EPR entangled states, Charlie prepares a two-color EPR entangled state and sends one mode (810 nm) to Alice and the other mode (1550 nm) to Bob. Then, Alice and Bob randomly measure the amplitude or phase quadrature of the received EPR mode with the balanced homodyne detectors (BHDs). The quantum state has a time span of 6 μs and repetition rate of 50 kHz. The output signals of two BHDs are sampled by high-speed acquisition cards with a sampling rate of 50 MHz. Due to the large difference of the propagation paths for the two modes of the EPR state, the recorded data of Alice and Bob are required to be synchronized accurately. Because the interval of the sampling data points is 0.02 μs, which is much smaller than the duration of a quantum signal, we can realize the synchronization by aligning the two user’s data directly. The recorded 300 data points for each quantum state mix with a sinusoidal signal at 3.5 MHz and low-pass filtered with a cutoff frequency of 0.5 MHz digitally. The digital low-pass filter we use is a 200-tap finite impulse response (FIR) filter. The filtered data are added up to obtain the quadrature value of the quantum state, which is located at the sideband frequency of 3.5 MHz with a bandwidth of 1 MHz.

\pm V_{π / 2}

Bob’s excess noise mentioned in Table 1 of the main text mainly comes from three parts. The first part is the imperfect phase-locking accuracy between the LO beam and signal light, which contributes to 0.002 shot-noise unit (SNU) excess noise. The second part is the scattered noise photons due to the depolarized guided acoustic Brillouin scattering of the LO light in a long-distance single-mode optical fiber, which induces an excess noise level about 0.001 SNU. The third part comes from the experimental system noise including stability of the EPR entanglement source and the calibration of the SNU, and the resulting excess noise is about 0.007 SNU. Other excess noise sources such as the leakage of LO light and the spontaneous Raman noise are suppressed to a negligible level by using the time multiplexing and polarization multiplexing of LO and signal light.

V_{A (B)}^{x}

Original Data of the Data Point in Fig. 4(a) ( $P = 0.9$ )

$L_{A}$	0 km				1 km			2 km
$L_{B}$	10 km	20 km	40 km	60 km	10 km	20 km	40 km	10 km	20 km
$V_{A}^{x}$	4.215	3.968	4.106	4.277	3.663	3.944	4.169	3.860	3.822
$V_{B}^{x}$	1.937	1.519	1.239	1.090	1.816	1.576	1.237	1.957	1.555
$C_{A B}^{x}$	2.106	1.529	1.039	0.646	1.846	1.590	1.059	2.015	1.533
$V_{A}^{p}$	4.275	4.468	4.398	4.226	3.741	4.020	4.353	4.147	4.066
$V_{B}^{p}$	1.858	1.534	1.245	1.066	1.848	1.512	1.255	1.909	1.497
$C_{A B}^{p}$	−2.053	−1.650	−1.118	−0.580	−1.891	−1.523	−1.103	−2.059	−1.509
$K$	0.0961	0.0477	0.0126	0.0038	0.0718	0.0283	0.0053	0.0543	0.0235

Table 3.

Original Data of the Data Point in Fig. 4(a) ( $P = 0.5$ )

$L_{A}$	0 km				1 km			2 km
$L_{B}$	10 km	20 km	40 km	60 km	10 km	20 km	40 km	10 km	20 km
$V_{A}^{x}$	4.309	3.902	4.187	3.976	3.533	3.870	4.031	3.300	3.686
$V_{B}^{x}$	1.851	1.531	1.297	1.079	1.786	1.542	1.243	1.837	1.522
$C_{A B}^{x}$	2.059	1.560	1.155	0.594	1.770	1.544	1.044	1.760	1.446
$V_{A}^{p}$	4.223	4.286	4.760	3.933	3.736	4.116	4.355	3.915	3.791
$V_{B}^{p}$	1.913	1.518	1.213	1.069	1.808	1.550	1.246	1.970	1.437
$C_{A B}^{p}$	−2.079	−1.588	−1.100	−0.566	−1.847	−1.590	−1.099	−2.044	−1.388
$K$	0.0602	0.0402	0.0076	0.0026	0.0363	0.0205	0.0042	0.0261	0.0124