Sources, Detectors, and Quantum Links

5.1 Weak pulses and photon number

The first idealisation to go is the single-photon source. This section derives what an attenuated laser actually emits, shows why the difference is a security problem rather than a technicality, and reconstructs the single-photon contribution from measurements at two intensities.

5.1.1 Distinguish a qubit from a laser pulse

A phase-randomized coherent pulse with mean photon number \(\mu\) has photon-number probabilities

so the vacuum and multiphoton fractions are

Attenuating a laser therefore does not produce one photon per trial. Most pulses are empty, some carry one photon, and a small fraction carry two or more. Only the last group is dangerous. In a multiphoton pulse Eve can, in an idealised attack, keep one photon and forward the rest: after the basis announcement her stored copy reveals the bit without the intercept–resend disturbance derived in Section 2.2.1. Channel loss helps her, because she can forward only the pulses that suit her and let the others disappear into the loss budget.

Decoy-state methods answer this by varying the intensity and using the observed detection statistics to bound the single-photon contribution. The inference has a precondition: conditioned on the photon number, the signal and decoy preparations must be indistinguishable in all modes that Eve can access. A source whose pulses differ in spectrum or timing between intensities provides no such inference, however good the statistics.

What follows in this section is a source calculation plus one decoy bound. It describes a model; it is not a decoy-state security proof, which additionally fixes the attack model, the finite-count statistics, and the failure budget.

5.1.2 Derive the photon-number mixture

A coherent state of complex amplitude \(\alpha\) has the expansion

which is a superposition, not a mixture: the relative phases between different \(n\) are fixed and observable in principle. Write \(\alpha=\sqrt\mu\,e^{i\theta}\) and randomize \(\theta\) uniformly, then discard it. Every off-diagonal term carries a factor

so all coherence between different photon numbers vanishes and what remains is diagonal:

Phase randomization is therefore a physical operation the model relies on, not a figure of speech. Calling a pulse “weak” establishes nothing by itself: an unrandomised weak pulse has a definite phase and is not described by \(\rho_\mu\).

The trade is easiest to read as a table.

Conditioning changes what a small percentage means. At \(\mu=0.1\) the multiphoton fraction is 0.468% of pulses but 4.92% of nonvacuum pulses; at \(\mu=0.5\) it is 9.02% of pulses but 22.9% of nonvacuum pulses. A protocol that reasons only about the unconditional fraction will underestimate the danger in a lossy link.

Photon-number splitting shows why this is a security question rather than an engineering detail. Eve keeps one photon of a multiphoton signal, forwards the rest, waits for the basis announcement, and then measures her copy in the right basis. She gains full information with no additional disturbance to the single-photon events that the error test is calibrated on. A security proof is allowed to grant Eve this capability even when a laboratory implementation would find it hard; the proof must hold for the adversary, not for the most convenient one.

5.1.3 Infer a single-photon yield from decoy intensities

Let \(Y_n\) be the probability of a detection given an \(n\)-photon emission, and \(Q_\mu\) the measured detection probability per pulse at intensity \(\mu\). If the conditional \(n\)-photon preparations are identical across intensities—the assumption stated in Section 5.1.1—then the gains decompose by photon number:

Each intensity gives one such linear equation in the unknowns \(Y_n\); measuring two intensities gives two equations, not enough to solve for all of them. The decoy trick extracts a bound on \(Y_1\) instead. With \(0<\nu<\mu\), subtract \((\nu^2/\mu^2)\,Q_\mu e^{\mu}\) from \(Q_\nu e^{\nu}\). The \(n=2\) coefficient vanishes, and for \(n\ge3\) the coefficient is

because \(\nu<\mu\). Yields are nonnegative, so those higher terms can only lower the difference. The difference is therefore bounded above by its vacuum and single-photon terms alone, and rearranging gives the asymptotic vacuum-plus-weak-decoy bound

where \(D\) collects the measured gains and the background estimate,

Three practical rules follow from the algebra. Clip the result at zero: a negative lower bound means the data certify no single-photon yield, not a negative one. Treat a value above one as evidence of inconsistent inputs or of statistical fluctuations left out of the exact calculation, never as a yield. And remember that the bound is only as good as the indistinguishability assumption; exact arithmetic cannot repair a source that behaves differently at different intensities.

The decoy bound converts two measured gains into one certified quantity. It does not, by itself, bound Eve's information: that requires relating the single-photon phase error to the observed error rate, which is the entanglement argument of Chapter 3 applied to the single-photon component. Nor does it account for finite counts, which enter through confidence bounds whose signs must be tracked carefully in the subtraction—an upper bound on \(Q_\mu\) and a lower bound on \(Q_\nu\) both make \(Y_1^L\) smaller. Ma and colleagues develop the protocol analysis in detail, and the educational laboratory in this course recomputes the bound and checks it against the known pure-loss model.

5.2 Transmission and observed rates

A key rate is a ratio, and most confusion about QKD performance comes from mixing the ratios. This section separates transmission from error, adds background clicks, and then multiplies the pieces together in the right order.

5.2.1 Keep loss separate from error

For a fibre with attenuation \(\alpha\) decibels per kilometre over length \(L\), the transmission factor is

Detector efficiency, connector loss, basis sifting, and protocol acceptance reduce usable counts further. None of these factors is an error rate. A signal that never arrives carries no bit and cannot be wrong: the QBER conditions on retained detections, and is therefore blind to loss by construction.

For an idealised single-photon source pulsed at rate \(F\) through transmission \(\eta\) into detectors of efficiency \(d\), with unbiased bases, the sifted count rate is approximately

if further losses and dead time are neglected. Multiplying this by a secret fraction produces a planning model, not a performance claim. A reported number should carry its assumed parameters explicitly—attenuation, length, pulse rate, detector efficiency, background, and dead time—and any parameter that was chosen rather than measured should be labelled as hypothetical.

Every 50 km costs a factor of ten in rate; every 100 km costs a factor of a hundred. That exponential is why loss, rather than the error rate, sets the practical distance record of a QKD link—until background clicks take over, which is the subject of the next subsection.

5.2.2 Combine loss with background counts

Let \(d\) be detector efficiency and \(\eta\) the channel transmission. For a phase-randomized coherent pulse, the probability that at least one signal photon is detected is

If the background-click probability per time window is \(Y_0\), an independent-click model gives the total gain

in the low-click regime. If signal clicks carry misalignment error \(e_d\) while background bits are random, the observed error rate is the mixture of the two contributions:

The expression neglects simultaneous clicks and the rule used to assign them, so it is a model rather than a measurement formula. It still shows a physical limit. As \(p_s\to0\), the numerator and denominator are both dominated by \(Y_0\), so \(E\to1/2\) even though nothing has changed in the detector's alignment. Loss does not flip bits; it dilutes the signal until the background is all that is left, and a rate model that reduces the count while holding the observed error fixed will therefore overstate the achievable distance.

5.2.3 Use the correct rate for a weak-pulse source

The ideal single-photon expression \(1-h_2(e_b)-h_2(e_p)\) is a fraction per sifted single-photon key bit. Multiplying it by every detected coherent pulse would credit vacuum events (which carry no bit) and multiphoton events (whose information Eve may share) with secrecy they do not have. In a conventional asymptotic decoy analysis, a common lower-rate form per emitted signal pulse is

where \(q\) is the basis and key-selection factor, \(Q_1^L\) a certified single-photon gain from Section 5.1.3, and \(e_1^U\) an upper bound on the single-photon phase error in the stated symmetric model. The structure is worth reading aloud: the positive term credits only the certified single-photon part, while reconciliation is paid on all retained signal detections, because that is what was actually discussed in public. Substituting a single-photon rate into the second term would understate the leakage.

This is a stated asymptotic rate model, not a finite-size prescription. It has no smoothing terms, no confidence intervals on the gains, and no acceptance probability.

5.3 Trust in measurement devices

Every result so far assumed that a detector implements the measurement the proof describes. Real detectors can be blinded, saturated, or made to click on command, so the question of which devices a proof must trust is a security question in its own right.

5.3.1 Compare security models

A detector is a physical apparatus, and its behaviour outside the assumed input range need not match the textbook measurement. Tailored bright illumination, for instance, has been used to force commercial detectors into click patterns of an attacker's choosing, which is why “the detector is fine because it passes its calibration” is not a security argument.

Two labels are often used to describe protocols that reduce this trust. Measurement-device-independent QKD places a joint measurement at an untrusted relay while keeping characterised sources and the rest of the laboratory model. Device-independent QKD uses Bell-test statistics to certify security under a different model, which requires suitable isolation, trusted randomness for setting choices, and control of detection loopholes.

Neither label removes every assumption, and the labels are not nested in a way that makes one strictly safer. A Bell violation by itself is not a finite-key certificate, and a conventional entanglement-based protocol is not automatically device independent just because it uses entanglement.

For any proposed experiment, list four things before interpreting a click as key material: which components Eve controls, what information can leave each laboratory, how the random choices are generated, and which statistics the proof consumes. Those four answers determine which row of the table the implementation occupies—and whether its security claim applies at all.

5.3.2 Understand what an untrusted relay measures

In MDI QKD, Alice and Bob each prepare signals and send them to a relay, which performs a joint measurement and announces its outcome. Consider an ideal projection onto the antisymmetric Bell state

For opposite Z inputs, \(|\langle\psi^-|01\rangle|^2=|\langle\psi^-|10\rangle|^2=1/2\); for equal Z inputs, both amplitudes vanish. A successful announcement therefore selects anticorrelated bits, and one party flips to align the raw strings. The same projection is antisymmetric in X, so the property holds in both bases—which is why the relay's announcement is useful to Alice and Bob whatever the relay intended.

What makes the arrangement measurement-device-independent is that the security argument never needs to know what the relay actually did. A malicious relay can announce arbitrary results, so the proof uses the observed basis-dependent statistics together with source characterisation to bound what accepted announcements can imply. The successful projection is a correlation-generating operation, not a trusted declaration of secrecy. In an optical implementation, decoy methods bound the events in which both sources emitted exactly one photon, which is where the single-photon inference of Section 5.1.3 reappears. Lo, Curty, and Qi establish the measurement-device-independent approach.

5.3.3 Calculate a Bell test before using the word independent

For outputs \(a,b\in\{-1,+1\}\), define the correlators \(E_{xy}=\langle ab\rangle\) for settings \(x,y\) and the CHSH combination

A deterministic local assignment \(a_x,b_y\in\{\pm1\}\) gives

Exactly one parenthesis vanishes and the other equals \(\pm2\), so \(|S|=2\). Probabilistic local strategies are convex mixtures of such assignments and cannot exceed the bound, provided the settings are chosen independently of any hidden variables and each response depends only on its own setting and shared randomness. That proviso is the substance of the word “independent”: without it the bound does not apply.

For \(|\Phi^+\rangle\), take \(A_0=Z\), \(A_1=X\), \(B_0=(Z+X)/\sqrt2\), and \(B_1=(Z-X)/\sqrt2\). The ZZ and XX correlations equal one and the cross correlations vanish, so each term contributes \(1/\sqrt2\):

The total is \(S=4/\sqrt2=2\sqrt2\approx2.828\), the largest value quantum theory allows for two-outcome measurements on a qubit—the Tsirelson bound. Mixing the pair with maximally mixed noise,

scales every correlator by \(v\), so \(S=2\sqrt2\,v\) and the local bound is violated only when \(v>1/\sqrt2\approx0.707\). A visibility below that value is compatible with a local model, and no device-independent claim can be based on it.

A loophole-controlled violation constrains local explanations and can support a device-independent security proof, but converting \(S\) into a key length needs a separate theorem plus treatment of finite statistics, device memory, isolation, free setting choices, and detection events. Acín and colleagues derive a collective-attack security bound; that scope should not be relabelled as a general finite-key result.