1558 Vol. 48, No.

7 / 1 April 2023 / Optics Letters Letter

Afterpulse effects in quantum key distribution

without monitoring signal disturbance
Hang Liu,1,2,3 Zhen-Qiang Yin,1,3,∗ Ze-Hao Wang,1,3 Yang-Guang Shan,1,3 Shuang
Wang,1,3 Wei Chen,1,3 Chen Dong,2 Guang-Can Guo,1,3 AND Zheng-Fu Han1,3
1
CAS Key Laboratory of Quantum Information, CAS Center for Excellence in Quantum Information and Quantum Physics, University of
Science and Technology of China, Hefei 230026, China
2
Information and Communication College, National University of Defense Technology, Wuhan 430030, China
3
State Key Laboratory of Cryptology, PO Box 5159, Beijing 100878, China
*Corresponding author: [email protected]

Received 13 December 2022; revised 9 February 2023; accepted 19 February 2023; posted 21 February 2023; published 20 March 2023

The round-robin differential phase shift (RRDPS) quantum phase difference between the ith and jth pulses as his sifted
key distribution (QKD) protocol is the only one that does bit. Then, Bob announces i, j to Alice, and she does xor on
not require monitoring of signal disturbance. Moreover, it the key bits of ith and jth pulses as her sifted bit. Finally,
has been proven that RRDPS has excellent performance Alice and Bob do error correction and privacy amplification
of resistance to finite-key effects and high error rate tol- to get the final secure keys. In the original secure analysis,
n
erance. However, the existing theories and experiments do the eavesdropper’s information is bounded by H2 ( L−1 ), where
not take the afterpulse effects into account, which cannot be H2 (x) := −x log2 (x) − (1 − x) log2 (1 − x) is the Shannon entropy
neglected in high-speed QKD systems. Here, we propose a function. It is obvious that RRDPS can be run without mon-
tight finite-key analysis with afterpulse effects. The results itoring signal disturbance, which contributes to reducing the
show that the non-Markovian afterpulse RRDPS model opti- finite-key effects and tolerating a nearly 50% bit error rate in
mizes the system performance considering afterpulse effects. principle.
The advantage of RRDPS over decoy-state BB84 under There are several successful theories [11–13] about decoy-
short-time communication still holds at typical values of state RRDPS, and experiments [14–18] to demonstrate RRDPS
afterpulse. © 2023 Optica Publishing Group with various experimental setups, most of them running in high-
speed QKD systems. Besides, many theories have been proposed
https://doi.org/10.1364/OL.483479
to improve the RRDPS performance and secure keys. Espe-
cially, the tight finite-key analysis [19] for RRDPS points out
Introduction. Quantum key distribution (QKD) [1] is well that it should be run in high-speed QKD systems. However,
known for its guarantee of unconditional secure communication. present theories and experiments for RRDPS lack analysis of
The first QKD protocol, BB84 [1], was proposed in 1984. After afterpulse effects, which should not be neglected in high-speed
that, many new protocols were proposed in turn, such as device- QKD systems.
independent protocol [2–4], measurement-device-independent Afterpulse is an inherent attribute of SPADs [20–22] that is
protocol [5–8], and twin-field protocol [9]. These QKD proto- widely applied to QKD systems. An ideal SPAD generates only
cols need to monitor signal disturbance to assess information one avalanche for a single incident photon. But in real life, a sin-
leakage. For example, BB84 needs to monitor the bit error rate. gle photon may result in more than one avalanche, thus affecting
However, the round-robin differential phase shift (RRDPS) pro- the subsequent single-photon detections. This is called the after-
tocol [10] does not require monitoring of signal disturbance, pulse effect. The higher the detection rate, the more serious are
which makes it unique. the afterpulse effects. Although afterpulse has been extensively
In RRDPS, Alice first prepares a packet including an n- studied [23], recently new research has shown that the afterpulse
photon L-pulse train. She randomly modulates the phase of probability is dependent on past events, i.e., the afterpulse is non-
every pulse as 0 or π to encode key bits 0 or 1. Alice records Markovian [24]. The non-Markovian afterpulse model has been
the encoding bits of information and then she sends the packet built to be applied to BB84 [25], reference-free-independent
to Bob through an insecure quantum channel. We assume (RFI) [26], and measurement-device-independent (MDI) [27]
that Bob has photon-number-resolving single-photon avalanche QKD systems, which is shown to be effective in improving
detectors (PNR SPADs). Hence, he can distinguish one pho- system performances.
ton and the others. When Bob receives the packet, he only There is no doubt that afterpulse will also impact the RRDPS
keeps the packet including a single photon. Meanwhile, Bob QKD system. In order to analyze afterpulse effects in RRDPS
gets the random integer number r ∈ {1, 2, . . . , L − 1} from his and make it more realistic, we propose a non-Markovian after-
local quantum random number generator (QRNG). Then he pulse model fit for RRDPS, i.e., the non-Markovian afterpulse
does an optical interference measurement to randomly interfere RRDPS model. The results show that the non-Markovian after-
with the ith and jth (j = i + r ≤ L, j ≠ i) pulses. Bob gets the pulse RRDPS model does improve the final secure key rate,

0146-9592/23/071558-04 Journal © 2023 Optica Publishing Group

 Letter Vol. 48, No. 7 / 1 April 2023 / Optics Letters 1559

and the advantage of RRDPS over decoy-state [28–31] BB84 where Pap,r is the afterpulse probability of a packet when Bob
under short-time communication still holds at typical values of opens L − r time windows to detect the signal. For simplicity,
afterpulse. This is meaningful for its real-life applications. we assume that afterpulse clicks among L − r time windows are
Afterpulse model. Here, we introduce our non-Markovian independent and identical:
afterpulse model. We first clarify our detection model and begin
immediately to elaborate the afterpulse model. Pap,r = (L − r)P, (7)
According to the security proof of RRDPS protocol, once
Bob decides the time delay r ∈ {1, 2, . . . , L − 1}, he opens L − r where P is the probability of an afterpulse click in a time window.
time windows to detect the incident signal. The responses may Combining Eqs. (6) and (7), we get
be caused by dark counting, afterpulse, or photons. He only
keeps the events for which there is a single click in the L − r 2
time windows. Unlike the original non-Markovian afterpulse P= Pap . (8)
L
model in which Bob extracts one raw key bit from every pulse, a
raw key is extracted from a “train of pulses” in RRDPS. Hence, Furthermore, each Pap,r can be divided into L − r different
we should calculate the yield and the bit error rate of a “train of kinds:
pulses” so as to analyze the afterpulse effects in every packet. L−r
Our afterpulse model contains two parts. The first part 1 ∑︂
Pap,r = Pap,r,k , (9)
involves analyzing the afterpulse probability of every packet; L − 1 r=1
the second part involves analyzing the effective afterpulse prob-
ability of every packet of the RRDPS protocol. We define a where Pap,r,k is the afterpulse probability of a packet when Bob
probability of afterpulse in each packet, Pap . Now we analyze its opens L − r time windows and SPADs have k clicks caused by
non-Markovian nature in RRDPS. According to Ref. [25], the afterpulse. In RRDPS, Bob only retains those packets in which a
afterpulse can be divided into different orders: single click occurs among L − r time windows. Hence, we want
+∞
to obtain Pap,r,1 , which is given by
∑︂
Pap = P(i)
ap , (1)
i=1 Pap,r,1 = CL−r
1
P(1 − P)L−r−1 , (10)
where the superscript i means the order of Pap . The first order n!
where Cnm := m!(n−m)! is the binomial coefficient. This is the end
P(1)
ap is initiated by dark counting and photons: of the afterpulse model.
Nem
∑︂ We must point out that PNR-SPAD is not necessary in this
ap =
P(1) p̂j Qµ = p̂Qµ , (2) model. However, the security proof of RRDPS assumes that
j=1 Bob retains only the single-photon components of the signals,
which introduces a PNR-SPAD presumption. Although there is
where Nem represents the total number of packets emitted by
no PNR-SPAD in reality, the fraction of single-photon compo-
Alice, p̂j is an afterpulse rate coefficient, and p̂ = Nj=1em p̂j is
∑︁
nent can be estimated by coincidence counting of SPADs in
overall afterpulse rate. Qµ is an average of the gain (excluding
experiment, which has little influence on the secure key rate
afterpulse contributions) of a packet where the intensity per
[15]. Hence, we could still use the PNR-SPAD presumption to
pulse is µ. Qµ is given by
calculate the secure key rate of RRDPS using our afterpulse
1 ∑︂
L−1 [︃ ]︃ model in theory and compare with previous works.
−(L−r)η µ
Qµ = 1−e (1 − d)2(L−r)
, (3) Secure key rate. We now show the results of the simulation
L − 1 r=1
of non-Markovian afterpulse RRDPS in the finite-sized case.
With a weak coherent source, the mean yield of a single-photon
where d means the dark counting rate and η = 10− 10 is the
loss

packet Q′ is given by
transmission efficiency of the channel.
ap , Pap , . . . are given by
Moreover, higher-order afterpulses P(2) (3)
[︃ ]︃
Nem
Q′r = (1 − d)2(L−r)−1 e−(L−r)η µ (L − r)ηµ + 2(L − r)d + (1 − d)Pap,r,1 ,
∑︂
ap =
P(2) p̂j P(1)
ap , L−1
1 ∑︂ ′
j=1 Q′ = Q,
Nem L − 1 r=1 r
∑︂ (4)
ap =
P(3) p̂j P(2)
ap ,
(11)
j=1 where d, η, and µ represent the dark counting rate, transmission
··· efficiency of the channel, and intensity per pulse, respectively.
The bit error rate E′ is given by
Hence the afterpulse rate of a packet is given by
p̂ Er′ Q′r = (1 − d)2(L−r)−1 e−(L−r)η µ
Pap = Qµ . (5) [︃ ]︃
1 − p̂ 1
× (L − r)ηµemis + (L − r)d + (1 − d)Pap,r,1 ,
2 (12)
In RRDPS, considering the random time delay r, Pap can be ∑︁L−1 ′ ′
1
divided into L − 1 parts: r=1 E Q
r r
E′ = L−1 ,
L−1 Q′
1 ∑︂
Pap = Pap,r , (6)
L − 1 r=1 where emis represents the interferometer misalignment.
 1560 Vol. 48, No. 7 / 1 April 2023 / Optics Letters Letter

Fig. 1. Final secure key rate versus overall afterpulse rate. We Fig. 2. Final secure key rate versus channel loss. The solid
compare the final secure key rates between the non-Markovian (dashed) green, the solid (dashed) blue, and the solid (dashed) red
afterpulse RRDPS model (new) and the afterpulse-omitted RRDPS curves represent the final secure key rates in the non-Markovian
model (old). The solid (dashed) green and solid (dashed) red curves afterpulse RRDPS model at overall afterpulse rate p̂ = 5% (p̂ = 0%)
represent the final secure key rates in the non-Markovian afterpulse for, respectively, L = 8, total emitted pulses 1010 ; L = 16, total emit-
RRDPS model (afterpulse-omitted model) at losses of 15 dB and ted pulses 4 × 1010 ; and L = 32, total emitted pulses 6 × 1010 . The
20 dB, respectively. L = 8; total emitted pulses: 1010 . solid (dashed) yellow curve represents the final secure key rate of
Ref. [25] at p̂ = 5% (p̂ = 0%) with total emitted pulses of 109 .

According to Ref. [19], the final secure key rate per pulse, R,
is given by
[︄ (︃ vth )︃
1 1 ∑︂
R ≤ (Q′ − eusrc ) − Ncoi H2 (ephi ) − fQ′ H2 (E′ )
L Nem i=1
]︄ (13)
1 2vth
− log2 2v +5 ,
Nem ϵ) th
(˜︁
√︂
where eusrc ≤ esrc + 3eNem src
ln ϵ˜︁1 is the upper bound [32] of esrc
considering the fluctuation of photon number and esrc := 1 −
vth −Lµ
(Lµ)i /i! means the probability that the photon num-
∑︁
i=0 e
ber of a packet is greater than vth . Nem is the total ∑︁ th number of
emitted packets. H2 (∗) is the Shannon entropy. vi=1 Ncoi H2 (ephi ) Fig. 3. Final secure key rate versus total emitted pulses. The solid
represents the phase error, and its value can be obtained by green and solid blue curves represent the final secure key rates in
optimizing nonnegative real parameters ci (i ∈ [1, vth + 1]) as is the non-Markovian afterpulse RRDPS model at overall afterpulse
done in Ref. [19]. Parameter f is the bit error correction effi- rates p̂ = 0% and p̂ = 10%, respectively. The dashed yellow and
ciency. The total security parameter of the final secure key rate dashed red curves represent the finite-key analysis of decoy-state
is ϵtot , ϵtot >0: BB84 protocol [25] at p̂ = 0% and p̂ = 10%, respectively. We fix
ϵtot = (18vth − 3)˜︁
ϵ. (14) L = 53 and channel loss at 20 dB.

For a fixed ϵtot , one should optimize vth to maximize R.

Simulation and discussion. We use Mathematica to run the Figure 2 shows the final secure key rate versus channel loss,
numerical simulations. The channel efficiency is η = 10− 10 . We
loss
depicting the results of Ref. [25] and of our afterpulse model.
also assume that SPADs have 100% efficiency and dark count- We fix L parameter at 8, 16, 32. The overall afterpulse rate p̂
ing rate d = 10−6 per pulse. The interferometer misalignment is 0% or 5%. The results show that from no afterpulse to an
is emis = 0.015. The bit error correction efficiency f is set to overall afterpulse rate of 5%, the final secure key rates remain
be 1.1. The total security parameter of the final secure key of the same order of magnitude and the reduction of the limiting
rate is ϵtot = 10−10 . The parameters to be optimized are inten- communication distance is about 2 dB in RRDPS and 3 dB in
sity per pulse µ, threshold photon number vth , and nonnegative decoy-state BB84.
real values {ci } (i ∈ [1, vth + 1]). Figure 3 shows the final secure key rate versus total emitted
Figure 1 shows the final secure key rate versus overall after- pulses. We fix the channel loss at 20 dB, L = 53. Liu et al. [19]
pulse rate with or without our non-Markovian afterpulse RRDPS simulate a simple finite-key analysis just applicable for inde-
model in the finite-sized case. The results show the advantage of pendent random variables and non-iterative sifting. Our results
our non-Markovian afterpulse RRDPS model for the final secure show an advantage of RRDPS over decoy-state BB84 when com-
key rate when the transmission is fixed at 15 dB and 20 dB. It is munication time is very short, and considering the afterpulse
obvious that the final secure key rate has been greatly improved effects, this advantage is held even if the overall afterpulse rate
by the non-Markovian afterpulse RRDPS model. is 10%. Hence, the non-Markovian afterpulse RRDPS model
 Letter Vol. 48, No. 7 / 1 April 2023 / Optics Letters 1561

is more robust than the non-Markovian afterpulse decoy-state 7. Y.-M. Xie, Y.-S. Lu, C.-X. Weng, X.-Y. Cao, Z.-Y. Jia, Y. Bao, Y. Wang,
BB84 model in the finite-key case. Y. Fu, H.-L. Yin, and Z.-B. Chen, PRX Quantum 3, 020315 (2022).
Conclusion. In conclusion, we propose a new non-Markovian 8. P. Zeng, H. Zhou, W. Wu, and X. Ma, Nat. Commun. 13, 3903 (2022).
9. M. Lucamarini, Z. L. Yuan, J. F. Dynes, and A. J. Shields, Nature 557,
afterpulse model and apply it to the tight finite-key analysis of
400 (2018).
RRDPS improving its performance. Although the afterpulse 10. T. Sasaki, Y. Yamamoto, and M. Koashi, Nature 509, 475 (2014).
affects yield and introduces more bit errors, decreasing the 11. Y.-Y. Zhang, W.-S. Bao, C. Zhou, H.-W. Li, Y. Wang, and M.-S. Jiang,
final secure key rate, the non-Markovian afterpulse RRDPS Opt. Express 24, 20763 (2016).
model shows the robustness of RRDPS against afterpulse effects. 12. Z. Zhang, X. Yuan, Z. Cao, and X. Ma, New J. Phys. 19, 033013
In this model, the final secure key rate is decreased a little; (2017).
13. R. Wang, Z.-Q. Yin, S. Wang, W. Chen, G.-C. Guo, and Z.-F. Han,
however, in the afterpulse-omitted model, the final secure key
Opt. Lett. 43, 4228 (2018).
rate is seriously affected by afterpulse effects. Therefore, in 14. J.-Y. Guan, Z. Cao, Y. Liu, G.-L. Shen-Tu, J. S. Pelc, M. Fejer, C.-Z.
practical RRDPS QKD systems, using the non-Markovian after- Peng, X. Ma, Q. Zhang, and J.-W. Pan, Phys. Rev. Lett. 114, 180502
pulse RRDPS model, the tolerance to afterpulse effects will be (2015).
improved. Besides, in our non-Markovian afterpulse RRDPS 15. H. Takesue, T. Sasaki, K. Tamaki, and M. Koashi, Nat. Photonics 9,
model, the advantage of RRDPS over decoy-state BB84 under 827 (2015).
short-time communication is valid at typical afterpulse values. 16. S. Wang, Z.-Q. Yin, W. Chen, D.-Y. He, X.-T. Song, H.-W. Li, L.-J.
Zhang, Z. Zhou, G.-C. Guo, and Z.-F. Han, Nat. Photonics 9, 832
We also point out that our non-Markovian afterpulse model can (2015).
be applied to the protocol of Ref. [33] which does not need 17. Y.-H. Li, Y. Cao, H. Dai, J. Lin, Z. Zhang, W. Chen, Y. Xu, J.-Y. Guan,
PNR-SPAD presumption. We believe that the non-Markovian S.-K. Liao, J. Yin, Q. Zhang, X.-F. Ma, C.-Z. Peng, and J.-W. Pan,
afterpulse RRDPS model will make the RRDPS protocol more Phys. Rev. A 93, 030302 (2016).
practical. 18. F. Bouchard, A. Sit, K. Heshami, R. Fickler, and E. Karimi, Phys. Rev.
A 98, 010301 (2018).
Funding. National Key Research and Development Program of China 19. H. Liu, Z.-Q. Yin, R. Wang, Z.-H. Wang, S. Wang, W. Chen, G.-C.
(2018YFA0306400); National Natural Science Foundation of China Guo, and Z.-F. Han, npj Quantum Inf 7, 95 (2021).
(61961136004, 62171424, 62271463). 20. R. H. Hadfield, Nat. Photonics 3, 696 (2009).
21. L. C. Comandar, B. FröHlich, M. Lucamarini, K. A. Patel, A. W.
Sharpe, J. F. Dynes, Z. L. Yuan, R. V. Penty, and A. J. Shields, Appl.
Disclosures. The authors declare no conflicts of interest. Phys. Lett. 104, 175 (2014).
22. D. Y. He, S. Wang, W. Chen, Z. Q. Yin, Y. J. Qian, Z. Zhou, G. C. Guo,
Data availability. Data underlying the results presented in this paper are and Z. F. Han, Appl. Phys. Lett. 110, 111104 (2017).
not publicly available at this time but may be obtained from the authors upon 23. A. W. Ziarkash, S. K. Joshi, M. Stipcevic, and R. Ursin, Sci. Rep. 8,
reasonable request. 5076 (2018).
24. F. X. Wang, W. Chen, Y. P. Li, D. Y. He, C. Wang, Y. G. Han, W.
Shuang, Z. Q. Yin, and Z. F. Han, J. Lightwave Technol. 34, 3610
(2016).
REFERENCES 25. G.-J. Fan-Yuan, C. Wang, S. Wang, Z.-Q. Yin, H. Liu, W. Chen, D.-Y.
1. C. H. Bennett and G. Brassard, in IEEE International Conference He, Z.-F. Han, and G.-C. Guo, Phys. Rev. Appl. 10, 064032 (2018).
on Computers, Systems and Signal Processing (IEEE, 1984), pp. 26. Y.-F. Nie and C.-M. Zhang, Quantum Inf. Process. 21, 340 (2022).
175–179. 27. Z.-H. Wang, S. Wang, G.-J. Fan-Yuan, F.-Y. Lu, Z.-Q. Yin, W. Chen,
2. A. Acín, N. Brunner, N. Gisin, S. Massar, S. Pironio, and V. Scarani, D.-Y. He, G.-C. Guo, and Z.-F. Han, Opt. Express 30, 28534 (2022).
Phys. Rev. Lett. 98, 230501 (2007). 28. W.-Y. Hwang, Phys. Rev. Lett. 91, 057901 (2003).
3. S. Pironio, A. Acín, N. Brunner, N. Gisin, S. Massar, and V. Scarani, 29. X.-B. Wang, Phys. Rev. Lett. 94, 230503 (2005).
New J. Phys. 11, 045021 (2009). 30. H.-K. Lo, X. Ma, and K. Chen, Phys. Rev. Lett. 94, 230504 (2005).
4. C. C. W. Lim, C. Portmann, M. Tomamichel, R. Renner, and N. Gisin, 31. X. Ma, B. Qi, Y. Zhao, and H.-K. Lo, Phys. Rev. A 72, 012326 (2005).
Phys. Rev. X 3, 031006 (2013). 32. H. Chernoff, Ann. Math. Statist. 23, 493 (1952).
5. H.-K. Lo, M. Curty, and B. Qi, Phys. Rev. Lett. 108, 130503 (2012). 33. C. Jiang, Z.-W. Yu, and X.-B. Wang, “Round robin differential phase
6. S. L. Braunstein and S. Pirandola, Phys. Rev. Lett. 108, 130502 shift quantum key distribution with yes-no detectors only,” arXiv,
(2012). arXiv:1904.08403 (2019).