# Polarized X-rays from windy accretion in Cygnus X-1

Juri Poutanen Department of Physics and Astronomy, FI-20014 University of
Turku, Finland Juri Poutanen<EMAIL_ADDRESS>Alexandra Veledina
Department of Physics and Astronomy, FI-20014 University of Turku, Finland
Nordita, KTH Royal Institute of Technology and Stockholm University, Hannes
Alfvéns väg 12, SE-106 91 Stockholm, Sweden  Andrei M. Beloborodov Physics
Department and Columbia Astrophysics Laboratory, Columbia University, 538 West
120th Street, New York, NY 10027, USA  Max Planck Institute for Astrophysics,
Karl-Schwarzschild-Str. 1, D-85741 Garching, Germany

###### Abstract

Recent X-ray polarimetric data on the prototypical black hole X-ray binary Cyg
X-1 from the Imaging X-ray Polarimetry Explorer present tight constraints on
accretion geometry in the hard spectral state. Contrary to general
expectations of a low, $\lesssim 1\%$ polarization degree (PD), the observed
average PD was found to be a factor of 4 higher. Aligned with the jet position
angle on the sky, the observed polarization favors geometry of the X-ray
emission region stretched normally to the jet in the accretion disk plane. The
high PD is, however, difficult to reconcile with the low orbital inclination
of the binary $i\approx 30\arcdeg$. We suggest that this puzzle can be
explained if the emitting plasma is outflowing with a mildly relativistic
velocity $\gtrsim 0.4\,c$. Our radiative transfer simulations show that
Comptonization in the outflowing medium elongated in the plane of the disk
radiates X-rays with the degree and direction of polarization consistent with
observations at $i\approx 30\arcdeg$.

accretion, accretion disks – magnetic fields – stars: individual: Cyg X-1 –
stars: black holes – X-rays: binaries

††journal: ApJ Letters††facilities: IXPE††software:  compps (Poutanen &
Svensson, 1996)

##  1 Introduction

Accreting black holes (BH) in X-ray binaries display different spectral
states, “hard” and “soft”, distinguished by the spectral shape and the
variability properties (Zdziarski & Gierliński, 2004; Remillard & McClintock,
2006). In the soft state, dominant contribution to the X-ray flux comes from a
thermally looking spectrum peaking at $\sim$1 keV energies, which is commonly
attributed to the multi-temperature blackbody accretion disk (Shakura &
Sunyaev, 1973; Novikov & Thorne, 1973). An additional power-law-like tail is
likely produced by inverse Compton scattering by relativistic electrons in a
corona (Poutanen & Coppi, 1998; Gierliński et al., 1999; Zdziarski et al.,
2001; McConnell et al., 2002). In the hard state, the spectrum is power-law-
like in the standard X-ray band and shows a cutoff at $\sim$100 keV, which is
interpreted as a signature of thermal Comptonization in a hot electron medium.
The geometry of this medium and the source of soft seed photons is a matter of
debates (Done et al., 2007; Poutanen & Veledina, 2014; Bambi et al., 2021).

The most popular model for the hot medium is the inner hot geometrically thick
optically thin flow (e.g. Shapiro et al., 1976; Ichimaru, 1977; Poutanen et
al., 1997; Esin et al., 1998; Yuan & Narayan, 2014). It is supported by a
number of arguments, including correlations between characteristic variability
frequencies of the aperiodic noise (Axelsson et al., 2005), the central
frequencies of quasi-periodic oscillations (Pottschmidt et al., 2003;
Ibragimov et al., 2005), the spectral slope of Comptonization continuum, and
the amplitude of Compton reflection (Zdziarski et al., 1999, 2003).

A corona on top of a cold disk near the black hole was also considered as a
source of hard X-rays (Haardt & Maraschi, 1993). Simple models with a slab-
like corona were found to produce too soft X-ray spectra (Stern et al., 1995),
because a large fraction of the coronal emission becomes reprocessed to soft
radiation by the underlying disk, and the reflection component becomes
stronger than observed. It was suggested that reprocessing could be reduced by
the high ionization of the disk surface (Nayakshin & Dove, 2001; Malzac et
al., 2005; Poutanen et al., 2018).

The observed spectrum may also be explained by a mildly relativistic
outflowing corona, which beams hard X-rays away from the accretion disk,
reducing their reflection and reprocessing (Beloborodov, 1999; Malzac et al.,
2001). Outflows are generally expected to accompany the heating process in the
magnetized corona. For instance, magnetic flares eject plasma, resembling
solar flares. Furthermore, if energy is released in compact flares, the plasma
can become dominated by electron-positron pairs (Svensson, 1984; Stern et al.,
1995; Poutanen & Svensson, 1996), which have a tiny inertial mass. In this
case, the plasma flows out with a saturated speed controlled by the local
radiation field. Coronal outflows have also been observed in global
simulations of accretion, which have begun to implement radiative effects in
electron-ion plasma (Liska et al., 2022). Mildly relativistic “winds” are
expected to surround the more relativistic “jets” seen in radio observations
during the hard state (Fender, 2001; Stirling et al., 2001).

In spite of a large body of the data on timing, spectra and imaging of BH
X-ray binaries, there is still a large uncertainty in the geometry of their
X-ray emission region. Polarization has long been anticipated to provide an
opportunity to determine the accretion geometry (Lightman & Shapiro, 1976).
One of the best-studied BH X-ray binaries Cyg X-1 was observed with the
Imaging X-ray Polarimeter Explorer (IXPE) (Weisskopf et al., 2022) on 2022 May
15–21 and June 18–20. A rather high polarization degree PD=$4.0\pm 0.2\%$ in
the 2–8 keV range at the polarization angle PA=$-20\arcdeg\pm 2\arcdeg$
consistent with the jet position angle (Stirling et al., 2001) was detected
(Krawczynski et al., 2022). Various models for the X-ray emitting region, such
as a slab-corona, a static inner hot flow, and conical or spherical lamp-post
corona at the disk rotation axis above the BH have been considered.
Krawczynski et al. (2022) suggest that the data can be reproduced only by
models where the emission region is extended orthogonally to the jet (which is
itself presumably perpendicular to the accretion disk). However, none of the
considered models reproduces the high PD at the measured inclination of
$i=27.5^{+0.8}_{-0.6}$ deg (Miller-Jones et al., 2021); higher inclination,
$i\gtrsim 45\arcdeg$ was required in order to reproduce the data.

In this paper, we show that the observed PD can be reproduced if the hot
medium forms an outflow from the accretion disk. The mildly relativistic speed
of the outflow affects polarization of scattered radiation, because the
angular distribution of seed photons is significantly aberrated in the plasma
rest frame (Beloborodov, 1998). This results in a higher polarization of
outgoing radiation at low inclinations. In Sect. 2 we describe the setup of
the model, and Sect. 3 presents the results of our radiative transfer
simulations. We discuss the obtained results and conclude in Sect. 4. The
Appendices present the radiative transfer equation describing our model and a
few examples of simulations.

##  2 Models for polarization

###  2.1 Geometry

We assume that the observed X-rays in the hard state of Cyg X-1 are produced
close to the compact object within the hot medium. We consider three
alternative geometries sketched in Figure 1:

  1. (A)

Hot corona covering the cold accretion disk (aka slab-corona) with the seed
unpolarized blackbody photons of temperature $kT_{\rm bb}=0.1$ keV from the
underlying accretion disk. Radiation produced by multiple Compton scattering
in such a slab is polarized at a level of $\sim$10% (e.g. Poutanen & Svensson,
1996; Schnittman & Krolik, 2010).

  2. (B)

Hot medium situated within the truncated cold accretion disk; this model is
usually referred to as a hot flow model. Here the seed photons could be
produced within the flow, for example, by the synchrotron emission of non-
thermal electrons with the peak at around 1 eV (Poutanen & Vurm, 2009; Malzac
& Belmont, 2009; Veledina et al., 2013), or by cold clouds embedded in the hot
flow (Celotti et al., 1992; Poutanen et al., 2018; Liska et al., 2022). We
consider the first case here.

  3. (C)

Same as model (B), but with the seed unpolarized photons coming from the outer
cold truncated disk of the temperature $kT_{\rm bb}=0.1$ keV. In this model,
the incident angles of the seed photons are limited by the aspect ratio of the
flow $h=H/R$ (see Appendix A for details).

For all models, the scattering geometry is approximated by a plane-parallel
slab extended along the disk plane.

Figure 1: Three alternative geometries considered in the work: panel (a) the
outflowing corona with the underlying cold disk producing seed photons
corresponding to model (A), panel (b) is for the outflowing hot flow with the
internal synchrotron seed photons corresponding to model (B), and panel (c) is
for the outflowing hot flow with the seed photons from the outer truncated
disk (model C).

###  2.2 Parameters of the outflow

The hot medium itself can be in a dynamical state, where in addition to the
azimuthal and radial motions, some fraction of the accreting matter leaves the
system in a mildly relativistic wind. For our simulations, to account for the
influence of the wind on polarization properties, we assume that the whole hot
medium has the vertical velocity (aka outflowing corona) following the profile

$\beta(\tau)=\beta_{0}\frac{\tau}{\tau_{0}},$ (1)

where $\tau$ is the Thomson optical depth measured from the central plane and
$\tau_{0}$ is the total optical depth through the corona. The flow diverges
sideways at some height $H$ which leads to a rapid drop of density. This
height then can be considered as the upper boundary of the outflow.

We note here that the continuity equation implies that $n_{\rm
e}(z)\beta(z)=n_{0}\beta_{0}$ is uniform with $z$ in a steady outflow. For the
velocity profile given by Equation (1), the optical depth then can be
expressed as

$d\tau(z)=n_{\rm e}(z)\sigma_{\rm T}dz=\sigma_{\rm
T}n_{0}\frac{\beta_{0}}{\beta(z)}dz=\sigma_{\rm
T}n_{0}\frac{\tau_{0}}{\tau(z)}dz,$ (2)

resulting in

$\tau(z)=\tau_{0}\,(z/H)^{1/2},\qquad\tau_{0}=2\sigma_{\rm T}n_{0}H.$ (3)

We thus get the electron density and velocity dependence on height,

$n_{\rm e}(z)=n_{0}(z/H)^{-1/2},\qquad\beta(z)=\beta_{0}(z/H)^{1/2}.$ (4)

The densest part of the outflow near the mid-plane has a small optical depth
$\tau(z)\propto\sqrt{z}$ and makes a negligible contribution to scattering, so
the details of how the inflow becomes the outflow near the mid-plane are not
very important.

Our model implies mass loss rate from the disk of radius $R$ of

$\dot{M}_{\rm out}=2\pi R^{2}c\beta_{0}n_{0}m_{\rm p}\mu_{\rm e},$ (5)

where $\mu_{\rm e}$ is the mean molecular weight per electron in the outflow.
On the other hand, the standard estimate for accretion rate in a disk with
luminosity $L$ and radiative efficiency $\epsilon$ is

$\dot{M}_{\rm acc}=\frac{L}{\epsilon c^{2}}=\frac{\ell}{\epsilon}\frac{4\pi
R_{\rm g}m_{\rm p}c}{\sigma_{\rm T}},$ (6)

where $\ell=L/L_{\rm Edd}$, $L_{\rm Edd}=4\pi GMm_{\rm p}c/\sigma_{\rm T}$ is
the Eddington luminosity, and $R_{\rm g}=GM/c^{2}$ is the gravitational
radius. This gives

$\frac{\dot{M}_{\rm out}}{\dot{M}_{\rm acc}}=\frac{\epsilon R^{2}\mu_{\rm
e}}{\ell}\frac{\sigma_{\rm T}\beta_{0}n_{0}}{2R_{\rm
g}}=\frac{\epsilon\mu_{\rm e}\beta_{0}\tau_{0}}{4\ell h}\,\frac{R}{R_{\rm
g}}.$ (7)

Our fiducial model has $h=1$, $\beta_{0}=1/2$, and $\tau_{0}=1$. The observed
luminosity of Cyg X-1 implies $\ell\sim 0.02$, assuming the black hole mass
$M\sim 10M_{\odot}$. Then, for an outflow made of electron-proton plasma
($\mu_{\rm e}=1$), we find $\dot{M}_{\rm out}/\dot{M}_{\rm acc}\sim 6\epsilon
R/R_{\rm g}$. This estimate is consistent with a large fraction of the
accretion flow being diverted into an outflow before reaching the black hole.
A significantly lower estimate for $\dot{M}_{\rm out}$ is found if the coronal
heating occurs intermittently in space and time, in magnetic flares. In this
case, the local radiation density can reach values sufficient for copious
$e^{\pm}$ pair production, reducing $\mu_{\rm e}$ and $\dot{M}_{\rm out}$.

###  2.3 Method

The parameters of the corona are the electron temperature $T_{\rm e}$, the
Thomson optical depth $\tau_{0}$, and the terminal velocity $\beta_{0}$ which
is varied from 0 to 0.6. In the simulations we considered $kT_{\rm e}=100$
keV, which is close to the observed values (Gierlinski et al., 1997). To
reproduce the spectral energy distribution of Cyg X-1 in the hard state
(Gierlinski et al., 1997; Krawczynski et al., 2022), we iterated $\tau_{0}$ to
achieve the observed photon index $\Gamma=1.6$ in the 2–10 keV energy range.

The radiative transfer equation that accounts for multiple Compton scattering
of linearly polarized radiation in the moving medium is given in Appendix A.
The only difference with the previously considered static models is that the
effect of relativistic aberration has to be taken into account. We start
simulations with some initial $\tau_{0}$ and solve radiative transfer equation
in the plane-parallel (slab) approximation assuming azimuthal symmetry. Once
the outgoing spectrum is obtained, we find the photon index $\Gamma$ in the
2–10 keV range (for an observer at $i=30\arcdeg$) and correct $\tau_{0}$.
Iterations continue until the desired $\Gamma$ is reproduced. The escaping
polarized radiation is described by two Stokes parameters $I$ and $Q$, with
$U$ being identically zero because of azimuthal symmetry. We can then define
PD$=Q/I$, which is positive when the dominant direction of oscillations of the
electric vector (aka polarization vector) is parallel to the slab normal. If
polarization vector is perpendicular to the flow normal, then PD is negative.
For example, the optically thick electron-scattering atmosphere produces
negative PD (Chandrasekhar, 1960).

The basic physics that controls the polarization production can be described
as follows. Polarization of radiation scattered in the hot flow once depends
strongly on the angular distribution of the incoming seed photons. If they
come from the underlying cold disk (and therefore beamed along the flow
normal), the scattered radiation is polarized perpendicular to the flow normal
(i.e. along the disk) resulting in negative PD. On the other hand, if they
come from the outer truncated disk (i.e. sideways), the scattered radiation is
polarized parallel to the normal, resulting in positive PD. In the latter
case, polarization can reach 33% in an ideal case when photons are injected in
a plane and scattering is coherent (Sunyaev & Titarchuk, 1985; Poutanen et
al., 2022). If the corona is moving upwards, external radiation will be
affected by relativistic aberration resulting in parallel polarization for
$0.1\lesssim\beta\lesssim 0.8$ (Beloborodov, 1998). When photons undergo many
scatterings in an optically thin plane-parallel medium, polarization is in
general parallel to the flow normal independently of the angular distribution
of seed photons.

Figure 2: Angular distribution of the PD for different outflow velocities
$\beta_{0}=0$ (black solid), 0.2 (red dotted), 0.4 (green dashed), and 0.6
(blue dot-dashed) in the middle of the IXPE range at 4 keV for the three
models are shown in Figure 1. Coronal parameters are $kT_{\rm e}=100$ keV,
$kT_{\rm bb}=0.1$ keV, $\Gamma=1.6$. The vertical blue stripe marks the
$i=27.5^{+0.8}_{-0.6}$ deg inclination (Miller-Jones et al., 2021) and the
horizontal beige stripe corresponds to the observed X-ray PD from Cyg X-1 of
$4.0\pm 0.2\%$ (Krawczynski et al., 2022).

##  3 Results

Figure 2a shows the angular distribution of the PD for model (A) in the middle
of the IXPE range at 4 keV. We see that for static corona, the peak in PD is
reached at $\sim$70°, while for the outflowing corona, the PD is growing with
inclination more or less monotonically. This figure clearly shows that the
static slab-corona can produce PD of 4% only at inclinations exceeding 60°.
The outflowing corona, on the other hand, can produce this high PD at
$i=30\arcdeg$ for $\beta_{0}\gtrsim 0.6$.

The angular distribution of the PD for model (B) is shown in Figure 2b. We see
that the PD for the static flow of $\beta_{0}=0$ is larger than in the case of
underlying disk seed photons. The reason is simple: the synchrotron seed
photons take more scattering to get to the IXPE range resulting in a more
anisotropic radiation field and higher PD. The observed 4% PD is reached only
at $i\approx 40\arcdeg$. For $\beta_{0}=0.2$, this PD is reached at
inclination of $\approx 33\arcdeg$, and the observed value of 4% at
$i<30\arcdeg$ is produced when $\beta_{0}\gtrsim 0.4$.

The angular distribution of the PD for model (C) is shown in Figure 2c. It is
similar to the other models, but shows a slightly higher PD. We see that the
PD observed in Cyg X-1 is well reproduced for the outflow velocity of
$\beta_{0}\approx 0.4$. We also considered a model of the seed photons from
the cold clouds within the hot flow, but its results are very similar to those
of models (b) and (c). We find that at all considered velocities models (b)
and (c) predict parallel polarization exceeding $\sim$10% at inclinations
$i=$60°–70°.

Figure 3: Energy dependence of the polarization degree for the three models
shown in Figure 2. The blue and red lines correspond to the inclinations of
$30\arcdeg$ and $60\arcdeg$, respectively. Solid, dotted, dashed and dot-
dashed lines correspond to the outflow velocities of $\beta_{0}=0,0.2,0.4$ and
0.6, respectively. In the middle panel, the red curves for $\beta_{0}=0.4$ and
0.6 coincide.

Let us now consider the energy dependence of PD. The results are shown in
Figure 3 for two selected inclinations of 30° and 60°. For model (A) and the
case of a static corona, polarization is negative (i.e. parallel to the disk)
at photon energies where the first scattering dominates (see Appendix B for
spectral decomposition in different scattering orders), it changes the sign at
around 1 keV and continues to grow to higher energies where the photons
undergo more than two scatterings. At $i=30\arcdeg$, PD does not exceed 3%
even at 100 keV. We note that a static slab-corona model cannot produce hard
spectra ($\Gamma\approx 1.6$) observed in Cyg X-1 once the reflection and
reprocessing of radiation is taken into account: thermalization of the hard
radiation in the disk would produce too many soft photons that cool the corona
producing soft spectra (Poutanen et al., 2018).

Motion of the corona away from the disk can be reconciled with the spectral
hardness (Beloborodov, 1999) resulting also in a higher PD (see dotted, dashed
and dot-dashed curves in Figure 3a). Because of the relativistic aberration,
the seed photon angular distribution is less beamed along the normal in the
flow comoving frame (see Figure 4), and even single-scattered photons have
polarization parallel to the disc axis (see also Beloborodov, 1998). At an
inclination $i<30\arcdeg$, the PD of 4% can be reached only for
$\beta_{0}>0.6$, which also predicts an increasing trend of PD with energy.

Let us now consider a truncated disk geometry with the inner hot flow. Figure
3b shows the results for model (B) corresponding to the synchrotron seed
photons. In the static case, the PD is 2–2.5% at $i=30\arcdeg$ (see blue solid
line). Because photons reaching IXPE range undergo many scatterings, the PD is
largely energy independent (see also Fig. 5). At the same inclination the PD
increases with the outflow velocity reaching $\sim$4% at $\beta_{0}\sim 0.4$
and 5% at $\beta_{0}\sim 0.6$. At a higher inclination of $i=60\arcdeg$, the
PD is about twice as large as for the $i=30\arcdeg$ case (see the set of red
curves).

Finally, we consider the model (C) with the hot flow geometry and the
truncated disk providing seed photons for Comptonization. The results for the
case of $H/R=1$ are shown in Figure 3c. Here we see that the static hot flow
produces nearly constant PD of $\sim$2.5% in the IXPE range at $i=30\arcdeg$.
For the outflow velocity $\beta_{0}=0.2$, the anisotropy of the seed photons
in the outflow rest frame is large enough to produce parallel polarization at
a 4% level for single-scattered photons, which then drops somewhat at higher
scattering orders. At $\beta_{0}=0.4$, the PD reaches 4.5–5% and weakly
depends on energy in the IXPE range. At even higher $\beta_{0}=0.6$, the PD
reaches 6%.

##  4 Discussion and summary

In our simulations, we ignored relativistic effects related to the rotation of
the flow resulting in a rotation of the polarization plane due to relativistic
effects. We note here that these effects are more important when the local
emitted spectrum is a blackbody like, when relativistic aberration and Doppler
boosting affect strongly the polarization vector just above the peak of the
blackbody (Connors et al., 1980; Dovčiak et al., 2008; Loktev et al., 2022).
However, for a power-law-like spectrum the effect is less pronounced because
of a relatively larger contribution from large radii of the flow to the
observed spectrum in a given energy range. Depolarization effects are
$\lesssim 1\%$ and can explain the difference between the required
inclinations for the static models found in this work and in Krawczynski et
al. (2022), where relativistic effects are taken into account.

Our simulations of the dynamic corona accounting for Comptonization confirm
previous results for Thomson scattering that PD strongly depends on the
angular distribution of incident photons (Beloborodov, 1998; Beloborodov &
Poutanen, 1999). This effect is more important at the energies where the first
scattering dominates. For the slab-corona, the static model results in a
rapidly growing PD in the IXPE range, but it stays below 2% for $i=30\arcdeg$.
Increasing velocity of the outflow gives a higher PD, which can reach the
observed 4% at $i=30\arcdeg$ only when $\beta_{0}>0.6$. Such a high terminal
velocity is required to produce the necessary photon anisotropy in the flow
rest-frame due to relativistic aberration. We note that the average velocity
of the outflow in that case is a factor of 2 smaller, and therefore is
consistent with the estimate $\beta=0.3$ by Beloborodov (1999) that is
required to achieve the photon spectral slope and the reflection fraction
observed in Cyg X-1. The terminal velocity is somewhat larger than the
equilibrium velocity of the electron-positron pairs, which may indicate the
presence of a significant amount of protons and ions in the outflow and the
role of magnetic processes (rather than radiation pressure) in the flow
acceleration.

The model with the internal synchrotron seed photons can reproduce an energy-
independent 4% PD at $i\approx 30\arcdeg$ for a more modest velocity of
$\beta_{0}=$0.4–0.5 because in the IXPE range multiple scatterings are
important and the angular distribution of seed photons does not play any role.
Once we combine the mildly relativistic velocity with the anisotropy of the
seed photons coming from the outer truncated disk, even higher PD can be
achieved. We conclude that in order to get 4% parallel polarization throughout
the IXPE range assuming inclination of 30°, a mildly relativistic outflow
velocity $\beta_{0}\approx 0.4$ is needed together with either anisotropic
distribution of seed soft photons coming from the outer cool disk or dominance
of multiple scattering, which is a natural outcome of synchrotron photon
injection at very lower energies.

We also note that our model predicts PD exceeding 10% at high inclinations
$i>60\arcdeg$, which potentially could be observed in other BH X-ray binaries.
Similarly high polarization is also expected from highly inclined accretion
flows in Seyfert galaxies of intermediate types (see, e.g., Gianolli et al.,
2023, for the case of NGC 4151).

We thank P. Abolmasov and the referee A. A. Zdziarski for valuable
suggestions. J.P. and A.V. acknowledge support from the Academy of Finland
grant 333112. A.M.B. is supported by NSF grant AST2009453, NASA grant
21-ATP21-0056, and Simons Foundation grant 446228. Nordita is supported in
part by NordForsk.

##  Appendix A Radiative transfer equation

The radiative transfer equation (RTE) describing Comptonization of polarized
radiation in the plane-parallel atmosphere in the lab frame (marked with
superscript ${\rm l}$) can be written in the form (Mihalas & Mihalas, 1984;
Nagirner & Poutanen, 1994; Beloborodov & Poutanen, 1999):

$\mu\frac{d\mbox{\boldmath${I}$}^{\rm
l}(\tau,x,\mu)}{d\tau}=[1-\beta(\tau)\mu]\left[-\sigma(x_{\rm
c})\mbox{\boldmath${I}$}^{\rm l}(\tau,x,\mu)+\mbox{\boldmath${S}$}^{\rm
l}(\tau,x,\mu)\right].$ (A1)

Here the photon energy is measured in the units of the electron rest mass
$x=E/m_{\rm e}c^{2}$, $\mu$ is the cosine of the angle the photon momentum
makes with the slab normal, $\mbox{\boldmath${I}$}=(I,Q)^{\rm T}$ is the
Stokes vector that fully describes linear polarization (Stokes $U$ parameter
is zero due to the azimuthal symmetry), $\mbox{\boldmath${S}$}^{\rm l}$ is the
source function (also Stokes vector) in the lab frame, and $\sigma(x_{\rm c})$
is the dimensionless total Compton scattering cross-section (in units of the
Thomson cross-section $\sigma_{\rm T}$) for isotropic Maxwellian electron gas
as a function of the photon energy in the comoving frame $x_{\rm c}=x/{\cal
D}$, where ${\cal D}=1/[\gamma(1-\beta\mu)]$ is the Doppler factor, and
$\gamma=1/\sqrt{1-\beta^{2}}$ is the Lorentz factor of the flow. Comoving
frame quantities are marked with sub- or superscript ${\rm c}$. We define the
Thomson optical depth across the slab as measure of the column density:
$d\tau=n_{\rm e}(z)\sigma_{\rm T}\,dz$, where $z$ is the vertical coordinate
and $n_{\rm e}$ is the electron concentration measured in the lab frame. The
source function in the lab frame is related to that in the comoving frame by
the Lorentz transformation (Rybicki & Lightman, 1979)

$\mbox{\boldmath${S}$}^{\rm l}(\tau,x,\mu)={\cal D}^{3}\
\mbox{\boldmath${S}$}^{\rm c}(\tau,x_{\rm c},\mu_{\rm c}),$ (A2)

where the angles are related by the aberration formulae

$\mu_{\rm c}=\frac{\mu-\beta}{1-\beta\mu},\qquad\mu=\frac{\mu_{\rm
c}+\beta}{1+\beta\mu_{\rm c}}.$ (A3)

The source function in the comoving frame is

$\mbox{\boldmath${S}$}^{\rm c}(\tau,x_{\rm c},\mu_{\rm c})=x_{\rm
c}^{2}\int_{0}^{\infty}\\!\frac{{\rm d}x^{\prime}_{\rm c}}{{x^{\prime}_{\rm
c}}^{2}}\int_{-1}^{1}\\!\\!\\!{\rm d}\mu^{\prime}_{\rm c}\
\mathbf{R}(x,\mu;x^{\prime}_{\rm c},\mu^{\prime}_{\rm
c})\mbox{\boldmath${I}$}^{\rm c}(\tau,x^{\prime}_{\rm c},\mu^{\prime}_{\rm
c})={\cal R}\mbox{\boldmath${I}$}^{\rm c},$ (A4)

where $\mathbf{R}$ is the $2\times 2$ azimuth-averaged redistribution matrix
describing Compton scattering by isotropic hot electrons (see Appendix A1 in
Poutanen & Svensson, 1996). The Stokes vectors $\mbox{\boldmath${I}$}^{\rm c}$
in the comoving frame is related to that in the lab frame as

$\mbox{\boldmath${I}$}^{\rm c}(\tau,x_{\rm c},\mu_{\rm c})={\cal D}^{-3}\
\mbox{\boldmath${I}$}^{\rm l}(\tau,x,\mu).$ (A5)

Figure 4: Spectro-polarimetric properties of model (A) of a slab-corona of
$T_{\rm e}=100$ keV and $T_{\rm bb}=0.1$ keV with the outflow of terminal
velocity $\beta_{0}=0.4$. (a) Spectral energy distribution of the escaping
radiation at inclination $i=30\arcdeg$ scaled to produce the angle-integrated
bolometric luminosity of $L=10^{37}$ erg s-1. Blue solid, dotted, dashed, dot-
dashed, triple-dot-dashed and long-dashed lines show the contribution of
different scattering orders $n=0,1,2,4,7$ and 10, respectively. The black
solid line gives the total spectrum. (b) The PD as a function of energy at the
same inclination for the total radiation (black solid) and for different
scattering orders is shown. (c) Angular distribution of the intensity at
optical depth $\tau=(3/4)\tau_{0}$ (where $\beta=0.3$) for the same scattering
orders as above at the corresponding peaks of $EI_{E}$. The black and red
curves correspond to the lab and comoving frame intensities, respectively. The
lab-frame intensities are normalized to unity at the maximum. (d) Angular
dependence of PD for the same scattering orders at the same energies as the
intensity. The IXPE energy range is marked by a beige vertical stripe in
panels (a) and (b). Figure 5: Same as in Figure 4, but for the seed
synchrotron photons of model (B).

We solve the RTE using iterative scattering method (Poutanen & Svensson, 1996)
accounting exactly for polarization by Compton scattering on isotropic (in the
flow frame) thermal electron gas (Nagirner & Poutanen, 1993). The only
difference from Poutanen & Svensson (1996) is that here we account for bulk
motion. At step 1, we specify the boundary condition at $\tau=0$, either on
the bottom of the slab-corona, or in the middle of the slab, in the case of
the hot flow–truncated disk geometry. We approximate the spectrum of seed
photons (marked by index 0) by the (unpolarized) blackbody

$\mbox{\boldmath${I}$}^{\rm l}_{0}(\tau=0,x,\mu)=B_{x}(T_{\rm
bb})\left(\begin{array}[]{l}1\\\ 0\end{array}\right){\cal H}(\mu_{0}-|\mu|),$
(A6)

where ${\cal H}$ is the Heaviside step function, $\mu_{0}=1$ for the slab-
corona, while for the truncated disk the injection of seed photons is limited
to the zenith angles corresponding to the aspect ratio of the inner hot flow
$h=H/R$, $|\mu|<\mu_{0}=h/\sqrt{1+h^{2}}$. At step 2, we use the formal
solution of the RTE (A1) (with zero source function ${S}$) to get the
intensity in all other layers of the slab:

$\mbox{\boldmath${I}$}^{\rm l}_{0}(\tau,x,\mu)=\mbox{\boldmath${I}$}^{\rm
l}_{0}(0,x,\mu)\ \exp(-\tau_{x}/\mu),$ (A7)

where $\tau_{x}=\tau\sigma(x_{\rm c})[1-\overline{\beta}(\tau,0)\mu]$ is the
energy- and angle-dependent optical depth measured from the bottom to a given
layer and $\overline{\beta}$ is the average velocity from the slab center (or
bottom for slab-corona model) $\tau=0$ to the given $\tau$, defined as

$\overline{\beta}(\tau,\tau^{\prime})=\frac{1}{\tau-\tau^{\prime}}\int_{\tau^{\prime}}^{\tau}\beta(t)\
dt=\frac{\beta(\tau)+\beta(\tau^{\prime})}{2}=\beta_{0}\frac{\tau+\tau^{\prime}}{2\tau_{0}}.$
(A8)

At step 3, we transform the Stokes vectors $\mbox{\boldmath${I}$}^{\rm l}_{n}$
in the lab frame for photons scattered $n$ times to the comoving frame using
Equation (A5). At step 4, we compute the source function in the comoving frame
for photons scattered $n+1$ times using Equation (A4) as
$\mbox{\boldmath${S}$}^{\rm c}_{n+1}={\cal R}\mbox{\boldmath${I}$}^{\rm
c}_{n}$. At step 5, we get the source function in the lab frame using Equation
(A2). And finally at step 6, we obtain the intensity of radiation scattered
$n+1$ times from the formal solution of the RTE:

$\mbox{\boldmath${I}$}^{\rm
l}_{n+1}(\tau,x,\mu)=\left\\{\begin{array}[]{ll}\displaystyle\int_{\tau_{\min}}^{\tau}\frac{{\rm
d}\tau^{\prime}}{\mu}\ \mbox{\boldmath${S}$}^{\rm
l}_{n+1}(\tau^{\prime},x,\mu)\ [1-\beta(\tau^{\prime})\mu]\ {\rm
e}^{-(\tau-\tau^{\prime})\sigma(x_{\rm
c})[1-\overline{\beta}(\tau,\tau^{\prime})\mu]/\mu},&\mu>0,\\\ &\\\
\displaystyle\int_{\tau}^{\tau_{0}}\frac{{\rm d}\tau^{\prime}}{(-\mu)}\
\mbox{\boldmath${S}$}^{\rm l}_{n+1}(\tau^{\prime},x,\mu)\
[1-\beta(\tau^{\prime})\mu]\ {\rm e}^{-(\tau^{\prime}-\tau)\sigma(x_{\rm
c})[1-\overline{\beta}(\tau^{\prime},\tau)\mu]/(-\mu)},&\mu<0,\end{array}\right.$
(A9)

where $\tau_{\min}=0$ for the slab-corona and $\tau_{\min}=-\tau_{0}$ for the
hot flow, and $\overline{\beta}$ is given by Equation (A8). The iteration
procedure continues with steps 3–6 until the desired accuracy for the total
Stokes vector $\mbox{\boldmath${I}$}^{\rm
l}=\sum_{n=0}^{\infty}\mbox{\boldmath${I}$}^{\rm l}_{n}$ is achieved at all
optical depths, angles and energies.

For synchrotron seed photons, we start instead from step 4 and specify the
source function in the comoving frame $\mbox{\boldmath${S}$}^{\rm c}_{0}$. We
assume it to be unpolarized, isotropic and optical-depth independent. Its
spectral energy distribution is computed assuming a thermal electron
distribution of $kT_{\rm e}=100$ keV with a weak nonthermal tail. The
resulting synchrotron spectrum has a shape of a broken power law with a peak
at $\sim$1 eV (Wardziński & Zdziarski, 2001; Veledina et al., 2013). The
iteration procedure now involves steps 5, 6 and then 3, 4, etc.

##  Appendix B Spectro-polarimetric properties of outflowing coronae

We show a few examples of simulations of polarized radiation escaping from an
outflowing corona for the same three models as considered in the main text. We
concentrate here on the case $\beta_{0}=0.4$, which describes well Cyg X-1
data, and the observer inclination $i=30\arcdeg$. Figure 4 shows the main
results for model (A), where seed unpolarized blackbody photons are injected
from the bottom of outflowing corona. We see the spectral energy distribution
of the total radiation as well as for selected scattering orders in panel (a).
The IXPE 2–8 keV range is dominated by photons scattered 2–4 times in the
flow. Panel (b) shows the energy dependence of the PD. The single-scattered
photons have small PD which becomes negative in the IXPE range, because the
angular distribution of the seed photons in the comoving frame of the flow is
still rather beamed outwards in spite of a high velocity as is seen in panel
(c). The black curves there show the angular distribution of the intensity at
the optical depth $\tau=(3/4)\tau_{0}$ at the energy, where $EI_{E}$ of the
corresponding scattering order peaks. The red curves are the corresponding
intensities in the comoving frame. We see that relativistic aberration is
responsible for anisotropy of the radiation, with the intensity of multiple
scattered photons in the lab frame peaking at $\mu\approx 0.1-0.3$ ($i\approx
70-80\arcdeg$). On the other hand, the peak of the intensity in the comoving
frame corresponds to $\mu_{\rm c}\approx-0.2$, i.e. it is directed more
downwards. The angular distribution of the PD in both frames is shown in panel
(d). We see that the PD grows with the scattering order. It reaches maximum
roughly at the same angles where the intensity peaks. Because of the
relativistic aberration, all curves in the lab-frame are shifted to higher
$\mu$, so that at a given inclination, the PD grows with $\beta$.

Figure 6: Same as in Figure 4, but for the seed photons from the truncated
disk with the coronal aspect ratio $H/R=1$ of model (C).

Figure 5 shows the same quantities for model (B) with the seed synchrotron
unpolarized photons which are isotropic in the comoving frame. The PD is
increasing monotonically with the number of scatterings (panel d), but already
at around $n>5$, very little variations is observed. Because about 7–8
scatterings is needed for seed photons to achieve the IXPE range, the PD is
nearly energy-independent (panel b). The angular distributions of both the
intensity and the PD (panels c and d) saturate.

Figure 6 shows the results for model (C) with coronal aspect ratio $H/R=1$. In
this model we see strong anisotropy of seed photons (panel c) both in the lab
and comoving frames. This anisotropy results in a large parallel polarization
reaching 12% (for the cases of high inclination) already at the first
scattering. The PD increases slightly at further scatterings having very
similar behavior to the previously considered models. The IXPE range is
dominated by photons scattered 2–4 times as in the case of model (A), but now
their PD is larger. The PD is nearly energy-independent as for the case of
model (B), where photons scattered many more times contribute to the signal in
the IXPE range.

## References

  * Axelsson et al. (2005) Axelsson, M., Borgonovo, L., & Larsson, S. 2005, A&A, 438, 999, doi: 10.1051/0004-6361:20042362
  * Bambi et al. (2021) Bambi, C., Brenneman, L. W., Dauser, T., et al. 2021, Space Sci. Rev., 217, 65, doi: 10.1007/s11214-021-00841-8
  * Beloborodov (1998) Beloborodov, A. M. 1998, ApJ, 496, L105, doi: 10.1086/311260
  * Beloborodov (1999) —. 1999, ApJ, 510, L123, doi: 10.1086/311810
  * Beloborodov & Poutanen (1999) Beloborodov, A. M., & Poutanen, J. 1999, ApJ, 517, L77, doi: 10.1086/312051
  * Celotti et al. (1992) Celotti, A., Fabian, A. C., & Rees, M. J. 1992, MNRAS, 255, 419, doi: 10.1093/mnras/255.3.419
  * Chandrasekhar (1960) Chandrasekhar, S. 1960, Radiative transfer (New York: Dover)
  * Connors et al. (1980) Connors, P. A., Piran, T., & Stark, R. F. 1980, ApJ, 235, 224, doi: 10.1086/157627
  * Done et al. (2007) Done, C., Gierliński, M., & Kubota, A. 2007, A&A Rev., 15, 1, doi: 10.1007/s00159-007-0006-1
  * Dovčiak et al. (2008) Dovčiak, M., Muleri, F., Goosmann, R. W., Karas, V., & Matt, G. 2008, MNRAS, 391, 32, doi: 10.1111/j.1365-2966.2008.13872.x
  * Esin et al. (1998) Esin, A. A., Narayan, R., Cui, W., Grove, J. E., & Zhang, S.-N. 1998, ApJ, 505, 854, doi: 10.1086/306186
  * Fender (2001) Fender, R. P. 2001, MNRAS, 322, 31, doi: 10.1046/j.1365-8711.2001.04080.x
  * Gianolli et al. (2023) Gianolli, V. E., Kim, D. E., Bianchi, S., et al. 2023, MNRAS, submitted, arXiv:2303.12541, doi: 10.48550/arXiv.2303.12541
  * Gierlinski et al. (1997) Gierlinski, M., Zdziarski, A. A., Done, C., et al. 1997, MNRAS, 288, 958
  * Gierliński et al. (1999) Gierliński, M., Zdziarski, A. A., Poutanen, J., et al. 1999, MNRAS, 309, 496, doi: 10.1046/j.1365-8711.1999.02875.x
  * Haardt & Maraschi (1993) Haardt, F., & Maraschi, L. 1993, ApJ, 413, 507, doi: 10.1086/173020
  * Ibragimov et al. (2005) Ibragimov, A., Poutanen, J., Gilfanov, M., Zdziarski, A. A., & Shrader, C. R. 2005, MNRAS, 362, 1435, doi: 10.1111/j.1365-2966.2005.09415.x
  * Ichimaru (1977) Ichimaru, S. 1977, ApJ, 214, 840, doi: 10.1086/155314
  * Krawczynski et al. (2022) Krawczynski, H., Muleri, F., Dovčiak, M., et al. 2022, Science, 378, 650, doi: 10.1126/science.add5399
  * Lightman & Shapiro (1976) Lightman, A. P., & Shapiro, S. L. 1976, ApJ, 203, 701, doi: 10.1086/154131
  * Liska et al. (2022) Liska, M. T. P., Musoke, G., Tchekhovskoy, A., Porth, O., & Beloborodov, A. M. 2022, ApJ, 935, L1, doi: 10.3847/2041-8213/ac84db
  * Loktev et al. (2022) Loktev, V., Veledina, A., & Poutanen, J. 2022, A&A, 660, A25, doi: 10.1051/0004-6361/202142360
  * Malzac & Belmont (2009) Malzac, J., & Belmont, R. 2009, MNRAS, 392, 570, doi: 10.1111/j.1365-2966.2008.14142.x
  * Malzac et al. (2001) Malzac, J., Beloborodov, A. M., & Poutanen, J. 2001, MNRAS, 326, 417, doi: 10.1046/j.1365-8711.2001.04450.x
  * Malzac et al. (2005) Malzac, J., Dumont, A. M., & Mouchet, M. 2005, A&A, 430, 761, doi: 10.1051/0004-6361:20041473
  * McConnell et al. (2002) McConnell, M. L., Zdziarski, A. A., Bennett, K., et al. 2002, ApJ, 572, 984, doi: 10.1086/340436
  * Mihalas & Mihalas (1984) Mihalas, D., & Mihalas, B. W. 1984, Foundations of radiation hydrodynamics (Mineola, NY: Dover)
  * Miller-Jones et al. (2021) Miller-Jones, J. C. A., Bahramian, A., Orosz, J. A., et al. 2021, Science, 371, 1046, doi: 10.1126/science.abb3363
  * Nagirner & Poutanen (1993) Nagirner, D. I., & Poutanen, J. 1993, A&A, 275, 325
  * Nagirner & Poutanen (1994) —. 1994, Astroph. Space Phys. Rev., 9, 1
  * Nayakshin & Dove (2001) Nayakshin, S., & Dove, J. B. 2001, ApJ, 560, 885, doi: 10.1086/323045
  * Novikov & Thorne (1973) Novikov, D. I., & Thorne, K. S. 1973, in Witt B., Witt C., eds, Les Astres Occlus (New York: Gordon & Breach), 343
  * Pottschmidt et al. (2003) Pottschmidt, K., Wilms, J., Nowak, M. A., et al. 2003, A&A, 407, 1039, doi: 10.1051/0004-6361:20030906
  * Poutanen & Coppi (1998) Poutanen, J., & Coppi, P. S. 1998, Physica Scripta, T77, 57.  https://arxiv.org/abs/astro-ph/9711316
  * Poutanen et al. (1997) Poutanen, J., Krolik, J. H., & Ryde, F. 1997, MNRAS, 292, L21
  * Poutanen & Svensson (1996) Poutanen, J., & Svensson, R. 1996, ApJ, 470, 249, doi: 10.1086/177865
  * Poutanen & Veledina (2014) Poutanen, J., & Veledina, A. 2014, Space Sci. Rev., 183, 61, doi: 10.1007/s11214-013-0033-3
  * Poutanen et al. (2018) Poutanen, J., Veledina, A., & Zdziarski, A. A. 2018, A&A, 614, A79, doi: 10.1051/0004-6361/201732345
  * Poutanen & Vurm (2009) Poutanen, J., & Vurm, I. 2009, ApJ, 690, L97, doi: 10.1088/0004-637X/690/2/L97
  * Poutanen et al. (2022) Poutanen, J., Veledina, A., Berdyugin, A. V., et al. 2022, Science, 375, 874, doi: 10.1126/science.abl4679
  * Remillard & McClintock (2006) Remillard, R. A., & McClintock, J. E. 2006, ARA&A, 44, 49, doi: 10.1146/annurev.astro.44.051905.092532
  * Rybicki & Lightman (1979) Rybicki, G. B., & Lightman, A. P. 1979, Radiative processes in astrophysics (New York: Wiley)
  * Schnittman & Krolik (2010) Schnittman, J. D., & Krolik, J. H. 2010, ApJ, 712, 908, doi: 10.1088/0004-637X/712/2/908
  * Shakura & Sunyaev (1973) Shakura, N. I., & Sunyaev, R. A. 1973, A&A, 500, 33
  * Shapiro et al. (1976) Shapiro, S. L., Lightman, A. P., & Eardley, D. M. 1976, ApJ, 204, 187, doi: 10.1086/154162
  * Stern et al. (1995) Stern, B. E., Poutanen, J., Svensson, R., Sikora, M., & Begelman, M. C. 1995, ApJ, 449, L13, doi: 10.1086/309617
  * Stirling et al. (2001) Stirling, A. M., Spencer, R. E., de la Force, C. J., et al. 2001, MNRAS, 327, 1273, doi: 10.1046/j.1365-8711.2001.04821.x
  * Sunyaev & Titarchuk (1985) Sunyaev, R. A., & Titarchuk, L. G. 1985, A&A, 143, 374
  * Svensson (1984) Svensson, R. 1984, MNRAS, 209, 175, doi: 10.1093/mnras/209.2.175
  * Veledina et al. (2013) Veledina, A., Poutanen, J., & Vurm, I. 2013, MNRAS, 430, 3196, doi: 10.1093/mnras/stt124
  * Wardziński & Zdziarski (2001) Wardziński, G., & Zdziarski, A. A. 2001, MNRAS, 325, 963, doi: 10.1046/j.1365-8711.2001.04387.x
  * Weisskopf et al. (2022) Weisskopf, M. C., Soffitta, P., Baldini, L., et al. 2022, JATIS, 8, 026002, doi: 10.1117/1.JATIS.8.2.026002
  * Yuan & Narayan (2014) Yuan, F., & Narayan, R. 2014, ARA&A, 52, 529, doi: 10.1146/annurev-astro-082812-141003
  * Zdziarski & Gierliński (2004) Zdziarski, A. A., & Gierliński, M. 2004, Progr. Theor. Phys. Suppl., 155, 99, doi: 10.1143/PTPS.155.99
  * Zdziarski et al. (2001) Zdziarski, A. A., Grove, J. E., Poutanen, J., Rao, A. R., & Vadawale, S. V. 2001, ApJ, 554, L45, doi: 10.1086/320932
  * Zdziarski et al. (2003) Zdziarski, A. A., Lubiński, P., Gilfanov, M., & Revnivtsev, M. 2003, MNRAS, 342, 355, doi: 10.1046/j.1365-8711.2003.06556.x
  * Zdziarski et al. (1999) Zdziarski, A. A., Lubiński, P., & Smith, D. A. 1999, MNRAS, 303, L11, doi: 10.1046/j.1365-8711.1999.02343.x


quote

# Relaxing Trust Assumptions on Quantum Key Distribution Networks

Nilesh Vyas1, Paulo Mendes1 1Airbus, Willy-Messerschmitt-Strasse 1, 82024
Taufkirchen, Germany<EMAIL_ADDRESS>
###### Abstract

Quantum security over long distances with untrusted relays is largely
unfounded and is still an open question for active research. Nevertheless,
quantum networks based on trusted relays are being built across the globe.
However, standard QKD network architecture implores a complete trust
requirement on QKD relays, which is too demanding and limits the use cases for
QKD networks. In this work, we explore the possibility to securely relay a
secret in a QKD network by relaxing the trust assumptions (if not completely)
on the relay. We characterize QKD relays with different trust levels, namely,
Full Access Trust (FAT), Partial Access Trust (PAT), and No Access Trust
(NAT). As the name suggests, each level defines the degree with which a relay
is required to be trusted with the secret provided by the key management
system for end-to-end communication. We then review and propose multiple
constructions of the QKD key management system based on the different trust
levels. Main contribution of the paper is realized by evaluating key
management systems with no access trust level. In principle, we review key
management with centralized topology and propose a new decentralized key
management system. These different topologies provide various advantages based
on the QKD network requirements, allowing an operational flexibility in the
architecture. We believe this work presents a new perspective to the open
problem of providing a confiding and a practical solution for future long
range secure communications.

###### Index Terms:

QKD, Quantum Networks, Key management, Routing.

##  I Introduction

Quantum Key Distribution (QKD) facilitates the information-theoretic-secure
transmission of critical data, based on QKD protocols that allow the
distribution, over a quantum link, of symmetric random bit strings as a secret
key, securing communication against an eavesdropper with unbounded
computational resources [1]. Today, point-to-point QKD systems are already a
reality, with commercially available systems performing mostly around one
hundred kilometers over optical fibers, and recent academic demonstrations
over hundreds of kilometers.

Besides commercial systems, QKD is being studied by standardization
organizations such as European Telecommunications Standards Institute (ETSI)
and the International Telecommunication Union Telecommunication
Standardization Sector (ITU-T). ETSI activities aim to target QKD systems for
large-scale trusted networks, as is the case of the ETSI Industry
Specification Group on Quantum Key Distribution for Users (ISG-QKD) [2]. ITU-T
has released several QKD recommendations, in particular ITU-T Y.3803 [3], for
a Key Management System (KMS) in a QKD network. The development of KMS aims to
support realistic deployment scenarios, in which applications are installed on
devices connected to the same local area network as a QKD node and a KMS, as
illustrated in figure 1. It is assumed that controlling access inside such a
local network relies upon conventional classical cryptographic techniques that
strictly provide local authentication, and that KMS interacts with a local
system (e.g., kerberos) able to locally disseminate QKD generated keys.

Figure 1: Basic QKD network model

The basic QKD network model illustrated in figure 1 comprises multiple
geographically separated QKD nodes, being assumed that each QKD node is
trusted and physically located in a local area network consisting of several
heterogeneous computing devices. However, a large-scale development of such a
generic model is still fundamentally limited by the transmission loss [4]
between QKD nodes. This is a bottleneck for deploying large scale QKD networks
for end-to-end secure communication.

Extending the QKD range for point-to-point secure communication and overcoming
the current fundamental limitations requires sophisticated quantum repeater
technology, which is far from practicality. Therefore, quantum networks based
on point-to-point QKD links have been developed using QKD trusted relays [3]
instead of quantum repeaters. A QKD relay \- or just a relay in this paper -
is a QKD node able to forward secret material encrypted based on a pair of QKD
keys generated over quantum links towards adjacent QKD nodes. Besides relays,
a QKD network encompasses QKD end-hosts, which are QKD nodes able to provide
security keys to local applications.

In this context, Free-space QKD links to Low Earth Orbit (LEO) satellites have
been demonstrated by the Chinese Micius satellite as a trusted courier [5]. A
trusted relay acts as a node that measures the quantum optical signals to
yield a classical output, and new quantum optical signals are generated based
on the classical outcome and are sent out to the next relay. However, this
classical output is a weak link in the communication chain, as it is
vulnerable to hacking and eavesdropping, meaning that security is only
achieved if the relays can be trusted.

Providing quantum security over long distance with untrusted relays is still
an open question to realise in practice [6]. Hence this paper aims to answer
the following question: Is it possible to securely relay secret information in
a QKD network by relaxing the trust assumptions (if not completely) on the
relays?

We address this question and explore novel constructions of a KMS by relaxing
the trust requirements on relays. We believe that the answer to this question
presents a new perspective to the open problem of providing a confiding and a
practical solution for future long range secure communications.

##  II Related Work

In order to investigate suitable solutions for QKD networks, several
experiments have been conducted. For instance, BBN Technologies [7] proposed
the first - DARPA - QKD network with ten quantum nodes encompassing active
optical switches and trusted nodes. The DARPA network adopted the BB84
protocol [1] to generate security keys, achieving a key generating rate of 400
bps over 29 km.

In 2004, the European Commission project Secure Communication based on Quantum
Cryptography (SECOQC) launched a QKD Network [8] that adopted a trusted node
network framework with six quantum nodes and five different QKD protocols to
distribute local keys. The best performance in terms of the key generation
rate was 3.1 kbps over 33 km.

Although the DARPA and the SECOQC networks lay the groundwork for implementing
QKD networks, both rely on the existence of trusted nodes. To achieve key
distribution in the presence of untrusted nodes, previous research mainly
focused on two aspects. The first aspect is using Measurement Device
Independent QKD (MDI-QKD) [9] or Twin-Field QKD (TF-QKD) [10] to construct a
QKD network [11]. These studies propose a hybrid network architecture based on
trusted and untrusted nodes, which does not need to trust measurement devices.
The aim was to reduce the number of trusted nodes. However, the proposed
solution still requires trusted relays to extend the QKD distance, because it
does not allow direct connection between two untrusted nodes [12].

Another important factor to improve the ability of QKD networks to resist
untrusted nodes is to rely on space diversity, by making use of multiple paths
to protect key security. However, prior art shows the need to have at least
one more disjoint path than the number of relays in order to avoid
eavesdropping [13].

Other approaches aim to develop QKD networks based on quantum satellites [6].
In such a scenario a satellite generates QKD keys via a ground-to-satellite
quantum channel with two QKD nodes deployed in the ground. After generating
the two QKD keys, the satellite uses a XOR operation to create a joint QKD key
that can be transferred over a classical satellite channel to the two QKD
ground stations. The caveat here is that the satellite knows the two
intermediate keys, and therefore the final secret key, meaning that it must be
trusted by the ground devices. Moreover, the delay to deploy the QKD keys in
the ground nodes may be considerable if using LEO satellites, since it is
directly proportional to the orbit time of the satellite.

Figure 2: QKD Network based on FAT relays. Each chained relay decrypt and re-
encrypt incoming messages before forwarding it to the next hop.

##  III Relaxing trust assumptions in QKD Networks

This paper explores new techniques to securely relay a secret material in a
QKD network by relaxing the level of trust required on relays. In an ideal
scenario, we should be able to deploy large-scale QKD networks by
interconnecting a set of untrusted relays. The development of such a system
would represent a game-changer for QKD. However, practical demonstrations of
such systems are largely unfounded. Therefore, in this paper we provide an
analysis of different steps that may sustain the idea of progressively
relaxing the trust assumption of current QKD networking systems.

###  III-A Trust levels

We consider a QKD network setting where two distant nodes want to share a
secret key, for application use, via a series of relays, defined as honest-
but-curious: a legitimate participant in a communication protocol who will not
deviate from the defined protocol, but will attempt to learn all possible
information from legitimately received messages. This paper characterizes the
trust levels of such relays with respect to their capability to access
information about shared secret material. The levels of trust are defined as
follows:

  * •

Full Access Trust (FAT): relays have complete knowledge of secret keys and
need to be fully trusted.

  * •

Partial Access Trust (PAT): relays do not have complete knowledge, but have
partial access to secret keys and so need to be partially trusted.

  * •

No Access Trust (NAT): relays do not learn any information about secret keys.

When considering the terminology found in prior art about trusted and
untrusted relays, the former is a relay with FAT trust level, while untrusted
relays can be of PAT or NAT level, with respect to the information provided at
the key management level of the QKD network.

###  III-B Key management system constructions

We consider the setting where a sender ’Alice’ wants to exchange a secret
$K_{S}$ with a distant receiver ’Bob’. Alice and Bob do not share a direct
quantum link, but are connected via a chain of $N$ trusted relays. Let the
keys shared by adjacent relays be denoted as $K_{ij}$, for $i\neq j$,
$i,j\in\\{1,\cdots,N\\}$. Let $K_{A1}$ be the key shared between Alice and its
adjacent relay, similarly $K_{NB}$ is the key between the last relay and Bob.

From a key management point of view, different systems can be used to develop
QKD networks with different trust levels. One example is a decentralized
system where a routing and forwarding scheme is used to allow QKD nodes
serving applications to exchange secret keys over a chain of trusted relays,
which decrypt and encrypt the forwarded keys.

An evolution of such a FAT system encompasses a QKD network that is able to
split a secret key into different parts, which are transmitted based on
spatial or temporal diversity methods. The former relies on multiple paths,
and the latter method requires different parts of the key to be sent over
different time windows over the same path. This constitutes a PAT system in
which relays are able to access part of the key used to encrypt end-to-end
communications.

Besides FAT and PAT systems, the most desirable configuration of a QKD network
is based on NAT relays, which have no access, totally or partially, to secret
keys used to encrypt end-to-end communications.

##  IV QKD Networks with Full Access Trust

In a simple networking setup, distant QKD nodes can exchange QKD keys by means
of a QKD network comprising two or more trusted relays, e.g., relays with a
full access Trust.

QKD networks with full access trust are built by having each relay, along a
lengthy chain, decrypting and re-encrypting received keys before forwarding
them to the next hop. Since forwarded keys are encrypted using QKD keys
generated over the quantum links connecting adjacent nodes, they are protected
from eavesdropping over classical channels. In this process, end-hosts share
the QKD key generated by one of them over its local quantum link, or by using
a local quantum device. However all relays are acquainted with the transmitted
key, which is used to secure the communication between end-hosts.

As illustrated in figure 2, key forwarding between two nodes, Alice and Bob,
that are not directly connected via a quantum link, requires, in a basic
approach, the following set of operations:

  1. 1.

Alice generates a key, $K_{S}$, to be shared with Bob via relays;

  2. 2.

Alice uses $K_{A1}$ to encrypt the key $K_{S}$ as $K_{S}\oplus K_{A1}$, and
send it to the Node 1;

  3. 3.

Node 1 uses $K_{A1}$ to decrypt the received message and acquires key $K_{S}$;

  4. 4.

Node 1 encrypts $K_{S}$ using $K_{12}$ shared with Node 2 as $K_{S}\oplus
K_{12}$, and send it to Node 2;

  5. 5.

Next relays perform the same operations as Node 1, until Bob is reached.

  6. 6.

Bob decrypts the received message, $K_{S}\oplus K_{NB}$, using $K_{NB}$ and
acquires the key $K_{S}$.

In this QKD network setting, relays are able to learn the complete information
about the secret $K_{S}$, that will be used by end-hosts to encrypt their
communication. Therefore this system is an example of a QKD network with a FAT
level. In this trust level, the security of the secret is guaranteed by XOR
operations, preserving security of the secret against chosen plain-text
attacks (IND-CPA).

This solution however allows all relays to be acquainted with the transmitted
secret, meaning that all relays need to be trusted. From a network management
perspective, such assumption is rather undesirable, since it is difficult to
quantify the security risk and hence meaningfully relate it to business assets
(confidential information) that are exchanged over the quantum network.
Nevertheless, this transmission paradigm is gaining attention and finds itself
implemented in various quantum demonstration networks.

Figure 3: Centralized KMS for QKD networks with NAT relays not acquainted with
secret keys $K_{S}$ shared between Alice and Bob via the central KMS.

##  V QKD Networks with Partial Access Trust

Transmission over multiple paths is a straightforward remedy to relieve the
stringent requirement of QKD networks with FAT trust level. In the simplest
setting, two QKD nodes, Alice and Bob, share a common secret over multiple
paths. This is achieved by having Alice splitting the secret into multiple
parts, sending each one of them though different paths in a similar fashion as
described in section IV. Bob combines all the different parts received over
different paths, thus obtaining the complete secret information. Alice and Bob
need to agree on the order in which the secret pieces are combined, which can
be achieved leveraging the classical channel.

A simple skeleton of multipath transmission can be derived from the well-known
polynomial $(k,n)$-secret-sharing due to Shamir (1979) . Let the adversary’s
threshold be $t$, i.e. no more than $t$ nodes in the network can be
compromised. Furthermore, Alice and Bob are connected by $r$ node-disjoint
paths between them. For $r>t$, the secret can be distributed between the two
as follows:

  1. 1.

Choose at least $k$ out of $r>t$ node-disjoint paths for transmission.

  2. 2.

Alice split the secret $K_{S}$ into $k$ shares, transmitted over each one of
the $k$ paths between Alice and Bob.

  3. 3.

Bob reconstructs the secret from the received shares.

As long as an adversary cannot control all paths, the security of the secret
can be ensured. The adversary can only learn partial information about the
secret by controlling up to $t<r$ paths. Thus, multipath key forwarding
satisfies the PAT level, as relays can access only partial information of the
secret flowing though its path.

##  VI QKD Networks with no Requirements for Access Trust

This section aims to discuss methods to develop QKD networks that do not rely
on trusted relays, this, a QKD network with no requirements for access trust.
In this regard we describe two methods to devise such QKD networks: the first
one relies on a Centralized
KMS111https://securecommunications.airbus.com/en/news/quantum-key-
distribution-qkd-networks-key-management, while the second method relies on a
Decentralized KMS.

###  VI-A Centralized Key Management System

A Centralized KMS consists of several chained relays connected to a central
key manager. The key manager is a logically centralized node and can be
implemented in different ways. Each relay is connected to two adjacent
neighbors, with whom it shares a pair of QKD keys.

In this approach, QKD keys generated by relays are used to create local secure
encrypted masks. In particular, each relay performs a XOR of the two QKD keys
shared with its neighbors, and Alice XORes the secret $K_{S}$ with the QKD key
shared with its adjacent node. The encrypted masks generated at the different
relays, with the exception of Bob, are collected by the central key manager.
It is assumed that the masks can not be eavesdropped during the creation and
submission to the central KMS. The central KMS XORes all the received keys and
share the output with Bob, allowing it to decrypt and receive the secret
$K_{S}$, as shown in figure 3.

As no secret information for end-to-end encryption is exchanged through the
relays, the trust requirements on the relay node can be relaxed to NAT level.
This centralized architecture reduces the trust requirements of the individual
relays however it has a single point of failure as central KMS. If the central
KMS fails, the whole QKD network is not operational. Therefore, the central
key manager must remain secure.

Key forwarding is the core functionality of the central KMS. As mentioned
above, the modus operandi for exchanging the secret between Alice and Bob
requires the central key manager to compute on all the keys shared by each
relay. The centralised secret key forwarding system encompasses the following
steps:

  1. 1.

Each QKD node, with the exception of Bob, computes XOR operation on adjacent
shared QKD keys: $K_{S}\oplus K_{A1}$ for Alice; $K_{(i-1)i}\oplus K_{i(i+1)}$
for each relay $i\in[n]$.

  2. 2.

Alice and each relay sends the computed key to the central key manager.

  3. 3.

Central key manager computes XOR on the all keys shared by the relays i.e., ,

$\displaystyle C$ $\displaystyle=$ $\displaystyle(K_{S}\oplus
K_{A1})\oplus(K_{A1}\oplus K_{12})\oplus\cdots$
$\displaystyle\oplus(K_{(N-1)N}\oplus K_{NB})$ $\displaystyle=$ $\displaystyle
K_{S}\oplus K_{NB}$ (2)

  4. 4.

Central key manager sends the output $C$ to Bob.

  5. 5.

Bob performs a XOR using $C$ and the shared QKD key $K_{NB}$ to obtain the
$K_{S}$.

The relays are not provided with secret key $K_{S}$ that is shared between
Alice and Bob for end-to-end communication, which is only relayed through the
central KMS. During the transmission from Alice to the central KMS, the
security of the secret $K_{S}$ is guaranteed by the XOR operations with the
QKD key $K_{A1}$. The XOR computation performed by the central KMS on all
shared keys results in $K_{S}\oplus K_{NB}$, which does not revel any
information about the secret $K_{S}$, as $K_{NB}$ is unknown to the central
KMS. Finally, XOR operation with $K_{NB}$ also protects the transmission of
$K_{S}$ from central KMS to Bob.

Figure 4: Decentralized KMS for QKD network with no-access trust on the
quantum nodes

###  VI-B Decentralized Key Management System

Decentralized KMS aim to support QKD networks based on a set of NAT QKD nodes,
while not relying on a central KMS system, which may be a single point of
failure.

In order to avoid relays to gather information about keys shared between QKD
end-hosts supporting end-to-end communication, several levels of security and
indirection can be used, as follows:

  1. 1.

Having QKD end-hosts splitting the key generated over their QKD link. If
splitting is done based on a local method, QKD end-hosts will not need to
trust adjacent relays.

  2. 2.

Use multiple paths to send keys, or parts of keys, in order to make it
difficult for an eavesdropper to gather relevant QKD key material.

  3. 3.

Sending the keys, or partial key material, encrypted via links protected by
QKD keys, or links protected by regular secure transport protocols.

  4. 4.

Encrypting application data with keys that are locally generated in each QKD
end-host, and never transmitted in a network.

A low cost high secure QKD network can be achieved with two paths only, one
over a set of relays and another over an regular Geostationary Orbit (GEO)
satellite. GEO satellites provide long range communication with lower cost and
higher security than regular Internet paths, which require data (keys) to
cross a higher number of active networking nodes. Over the satellite link,
keys may be transported by means of a regular secure transport protocol, such
as QUIC [14] or TCP/TLS [15].

The transmission of keys over a chain of relays is performed based on the
method illustrated in figure 2. In order to ensure that none of the visiting
relays have access to the QKD keys shared between the end-hosts, these should
leverage the available multiple paths to shared partial QKD key information
over each one of them; Partial key material results from splitting the QKD key
generated over the local QKD links.

Since executing the mentioned levels of security and indirection may induce
delay in furnishing applications with security keys, a suitable KMS should
ensure that key pools maintained by QKD end-hosts have always enough keys to
fulfill the key rate requirements of applications.

Figure 4 illustrates a possible implementation of a decentralized QKD network
based on fourth levels of security and indirection, based on the following
elements:

  1. 1.

QKD nodes implementing any suitable QKD protocol, such as BB84 to generate
secret keys over a quantum channel established with adjacent nodes. QKD nodes
can act as relays, operating as illustrated in figure 2, or as QKD end-hosts
providing pools of security keys to applications.

  2. 2.

A regular satellite providing coverage to all QKD nodes deployed in the
ground.

In such a decentralised QKD network, a QKD end-host can start an end-to-end
communication with a remote QKD end-host when triggered by a local
application. In this case, the two QKD end-nodes should establish a regular
transport connection (TCP/TLS or QUIC) over a satellite link, and should
create a local pool to store all the keys ($K_{S}$ in figure 4) to be used by
local applications. The size of the key pool should be configured based on
metrics negotiated during the set up of the transport connection.

Figure 4 helps to understand how a decentralized QKD network may operate. To
leverage multiple paths in a secure matter, QKD end-hosts (e.g., Alice and
Bob) should start by dividing the local generated QKD keys (e.g. Key $K_{A}$
for Alice and $K_{B}$ for Bob), into two parts (e.g., $K_{A}=K_{A1}+K_{A2}$
for Alice and $K_{B}=K_{B1}+K_{B2}$ for Bob), which should not be equal in
size to avoid adjacent relays to replicate them. One part of the divided key
should be stored in the local pool (e.g., $K_{A2}$ in the case of Alice and
$K_{B2}$ in the case of Bob) to be used in the generation of keys to be used
by local applications. The indexes of the Key pool need to be shared between
the two involved QKD end-hosts to allow them to generate the same key to be
sent to both applications.

Since no key material should be transmitted openly in the network, the parts
of the divided key should be XORed to create a new key (e.g.,
$K_{Y}=K_{A1}\oplus K_{A2}$ at Alice, and $K_{X}=K_{B1}\oplus K_{B2}$ at Bob).
The new created key should be sent, together with the recorded pool index, to
the remote end-host over the chain of relays. After a random interval of time,
the other part of the local generated QKD key (e.g., $K_{A1}$ at Alice) should
be sent via the satellite transport connection, together with the index sent
before over the chain of relays. These operations should be repeated, after a
random time interval, while the local Key pool is not full.

QKD end-hosts should be prepared to get packets sent by the other QKD end-
hosts over the chain of QKD relays and over the satellite connection. When a
packet is receiver, the end-host should be able to decrypt the payload (e.g.,
$K_{Y}$ plus key index received by Bob from the adjacent relay, or $K_{A1}$
received over the satellite link), and store it in the local key pool,
associated with the connection opened with the remote QKD end-host. The
received secret material should be stored in the position indicated by the
received index, allowing the newly stored key to be XORed with any secret
material already stored in the same pool index.

By using the described levels of security and indirection methods, a
decentralized QKD system should be able to support secure communications, by
having QKD end-hosts furnishing applications with security keys stored in
local Key pools. Such security keys are created locally in the end-host by
XORing the three QKD keys stored in the same entry of the key pool associated
with such end-to-end communication. Such three QKD keys correspond to the key
received over the chain relays, the key received over the satellite link and
the locally generated divided key. For instance in the case of Bob, local
applications get $K_{S}$ = $K_{A1}\oplus K_{A2}\oplus K_{A1}\oplus K_{B2}$ =
$K_{A2}\oplus K_{B2}$.

##  VII Discussion

This section aims to briefly discuss methods that may support the development
of QKD networks that do not need to rely on trusted nodes, namely the methods
described in section VI related to centralized or decentralized key management
systems.

The Centralized KMS relies on a shared communication medium (e.g., satellite
link) to send secret material from several relays to a central device, a
satellite, via a wireless medium that may need to be protected. If a relay is
able to eavesdrop the communication over the shared wireless medium, it can in
principle obtain the secret key and the KMS setting will no longer offer NAT
trust level. Moreover, a computationally unbounded adversary with capabilities
to spoof the network traffic can easily impersonate the central KMS and obtain
all messages.

The practical limitation of a centralized approach may be mitigated, as
described in section VI-A, by securing and protecting the communication
channel between the central key manager and each QKD node (relays and end-
hosts). Such extra protection can be ensured by replacing a regular satellite
with a QKD-enabled satellite, in order to allow the transmission between the
satellite and the QKD nodes to be protected by a QKD key. Another possibility
is to use Post-Quantum Cryptography (PQC) to protect or encrypt the channel
between the QKD nodes and the central KMS. Both these solutions are able to
protect the secret material against a quantum adversary. The former solution
with a QKD-enabled satellite is an information theoretic solution (ITS)
upholding the ITS quality of the QKD network. However, this is an expensive
and not scalable solution as it puts a lot of hardware burden on the central
key manager. On the contrary, the PQC solution is an inexpensive and scalable
solution with simple implementation, but only offers computational security,
challenging the ITS security of the QKD.

On the other hand, Decentralized KMS aims to support QKD networks based on a
set of untrusted QKD nodes, while not relying on a central KMS system, which
may be a single point of failure and a security breach. A decentralized KMS
may bring several advantages, starting by the potential lower cost, since it
does not rely on Quantum enabled satellites and does not require QKD relays to
use expensive satellite communications. Moreover, by making use of
complementary security and indirection methods none of the relays have access
to the secure key used to protect the end-to-end communication. Finally, as
described, a decentralized framework does not require the deployment of a
third-party quantum device (e.g., quantum computer) to generate the secure key
to be used by applications.

However, in order to implement all the mentioned security and indirection
methods, a decentralized QKD network may induce a high delay in provisioning
the security keys requested by applications. So, there is the need to evaluate
how the system can provide QKD keys fulfilling the key rate requested by
applications, while ensuring a good usage of resources needed for the local
key pools.

In reality, a practical QKD network will be complex system with arbitrary
topology, which may benefit from a hybrid solution for relaying the secret
keys securely between two distant end hosts. In principle, a hybrid key
management system can be designed by considering a partially centralized and
partially decentralized topology, like a rooted tree structure. For instance,
a central KMS supporting key management in metropolitan areas under the
control of specific entities (e.g., local governments), being such areas
connected via a decentralized KMS allowing the secure routing of the secret
keys over long distances.

##  VIII Conclusion

In this work, we have investigated the possibility to securely relay secret
information in a QKD network by relaxing the trust assumptions (if not
completely) on QKD relays. To address this issue, we characterized the trust
assumptions on relays into three different levels, namely Full Access Trust
(FAT), Partial Access Trust (PAT), and No Access Trust (NAT). As the name
suggests, each level is defined by the ability of an QKD relay to access
information provided at the key management layer of the QKD network stack,
i.e., the secret key used for end-to-end communication.

We explore various constructions of a key management system considering
different trust levels. Striking feature of the work is the QKD network
construction with no access trust requirement on QKD relays. We describe two
different QKD key management frameworks, based on centralized and the
decentralized topology, respectively. These different topologies provide
various advantages based on the QKD network requirements, allowing an
operational flexibility in the architecture.

We believe that this work presents a new perspective to the open problem of
providing a confiding and a practical solution for future long range secure
communications based on QKD technology.

## References

  * [1] C. H. Bennett and G. Brassard, “Quantum cryptography: Public key distribution and coin tossing,” _Theoretical Computer Science_ , vol. 560, pp. 7–11, Dec. 2014.
  * [2] ETSI, “Quantum Key Distribution (QKD); Common criteria protection profile - Pair of prepare and measure quantum key distribution modules,” ETSI GS QKD 016 - V1.1.1, Tech. Rep., Apr. 2023.
  * [3] ITU-T, “Series Y: Quantum key distribution networks – Key management,” ITU ITU-T Y.3803, Tech. Rep., Dec. 2020.
  * [4] S. Pirandola, R. Laurenza, C. Ottaviani, and L. Banchi, “Fundamental limits of repeaterless quantum communications,” _Nature Communications_ , vol. 8, no. 1, p. 15043, Apr. 2017.
  * [5] S.-K. Liao, W.-Q. Cai, J. Handsteiner, B. Liu, J. Yin, L. Zhang, D. Rauch, M. Fink, J.-G. Ren, W.-Y. Liu, Y. Li, Q. Shen, Y. Cao, F.-Z. Li, J.-F. Wang, Y.-M. Huang, L. Deng, T. Xi, L. Ma, T. Hu, L. Li, N.-L. Liu, F. Koidl, P. Wang, Y.-A. Chen, X.-B. Wang, M. Steindorfer, G. Kirchner, C.-Y. Lu, R. Shu, R. Ursin, T. Scheidl, C.-Z. Peng, J.-Y. Wang, A. Zeilinger, and J.-W. Pan, “Satellite-relayed intercontinental quantum network,” _Physical Review Letters_ , vol. 120, no. 3, p. 30501, Jan. 2018.
  * [6] B. Huttner, I. D. Quantique, R. Alléaume, F. Fröwis, A. Poppe, J. A. Slater, W. Tittel, and A. Wonfor, “Long-Range QKD without trusted nodes is not possible with current technology,” _npj Quantum Information volume_ , vol. 108, no. 8, Sep. 2022.
  * [7] C. Elliott, A. Colvin, D. Pearson, O. Pikalo, J. Schlafer, and H. Yeh, “Current status of the DARPA quantum network,” in _SPIE 5815, Quantum Information and Computation III_ , Orlando, United States, May 2005.
  * [8] A. Poppe, M. Peev, and O. Maurhart, “Outline of the SECOQC quantum-key-distribution network in Vienna,” _International Journal of Quantum Information_ , vol. 6, pp. 209–218, Apr. 2008.
  * [9] H.-K. Lo, M. Curty, and B. Qi, “Measurement-device-independent quantum key distribution,” _Physical Review Letter_ , vol. 108, p. 130503, Mar. 2012.
  * [10] M. Lucamarini, Z. Yuan, J. F. Dynes, and A. J. Shields, “Overcoming the rate-distance barrier of quantum key distribution without using quantum repeaters,” _Nature_ , vol. 557, pp. 400–403, May 2018.
  * [11] G.-J. Fan-Yuan, F.-Y. Lu, S. Wang, Z.-Q. Yin, D.-Y. He, W. Chen, Z. Zhou, Z.-H. Wang, J. Teng, G.-C. Guo, and Z.-F. Han, “Robust and adaptable quantum key distribution network without trusted nodes,” _Optica_ , vol. 9, no. 7, p. 812, Jul. 2022.
  * [12] Y. Cao, Y. Zhao, J. Wang, X. Yu, Z. Ma, and J. Zhang, “SDQaaS: Software defined networking for quantum key distribution as a service,” _Optics Express_ , vol. 27, no. 5, p. 6892, Mar. 2019.
  * [13] H. Zhou, K. Lv, L. Huang, and X. Ma, “Quantum network: Security assessment and key management,” _IEEE/ACM Transactions on Networking_ , vol. 30, Jun. 2022.
  * [14] J. Iyengar and M. Thomson, “QUIC: A UDP-based multiplexed and secure transport,” IETF RFC9000, Tech. Rep., May 2021.
  * [15] T. Dierks and E. Rescorla, “Transport layer security (TLS) protocol,” IETF RFC 5246, Tech. Rep., Aug. 2008.

## Biographies

Nilesh Vyas (PhD 2021) is a Scientist on Metadata Private Communication at
Airbus. Nilesh holds a Ph.D. in Cryptography and Security from Institut
Polytechnique de Paris, 2021. After finishing his Ph.D. Nilesh joined Airbus
in Dec 2022. His research interest is focused on quantum communications (QKD
theory and engineering, quantum networks, quantum repeaters), and quantum
information (quantum cryptography, quantum information theory).

Paulo Mendes (PhD 2004) is Expert in Communication Network Architectures and
Design at Airbus. Paulo holds a Ph.D. in Informatics Engineering from
University of Coimbra, having done his research as invited researcher at
Columbia University. He is also Associate Researcher at the Technical
University of Munich and at the iSTAR-IUL research center. Paulo holds over
100 publications, 10 book chapters and 21 patents. He is an ACM member and an
IEEE senior member.


# Another proof of Seymour’s 6-flow theorem

Matt DeVos  Email<EMAIL_ADDRESS>Supported by an NSERC Discovery Grant
(Canada) Jessica McDonald  Email<EMAIL_ADDRESS>Supported in part by
Simons Foundation Grant #845698  Kathryn Nurse  Email<EMAIL_ADDRESS>
###### Abstract

In 1981 Seymour proved his famous 6-flow theorem asserting that every 2-edge-
connected graph has a nowhere-zero flow in the group
${\mathbb{Z}}_{2}\times{\mathbb{Z}}_{3}$ (in fact, he offers two proofs of
this result). In this note we give a new short proof of a generalization of
this theorem where ${\mathbb{Z}}_{2}\times{\mathbb{Z}}_{3}$-valued functions
are found subject to certain boundary constraints.

Throughout we permit loops and parallel edges. Let $G=(V,E)$ be a digraph and
let $v\in V$. We define $\delta^{+}(v)$ $(\delta^{-}(v))$ to be the set of
edges with tail (head) $v$. Let $\Gamma$ be an abelian group written
additively and let $\phi:E\rightarrow\Gamma$. The _boundary_ of $\phi$ is the
function $\partial\phi:V\rightarrow\Gamma$ given by the rule:

$\partial\phi(v)=\sum_{e\in\delta^{+}(v)}\phi(e)-\sum_{e\in\delta^{-}(v)}\phi(e).$

Note that the condition $\sum_{v\in V}\partial\phi(v)=0$ is always satisfied
since every edge contributes 0 to this quantity. We say that $\phi$ is
_nowhere-zero_ if $0\not\in\phi(E)$ and we say that $\phi$ is a
$\Gamma$-_flow_ if $\partial\phi$ is the constant 0 function. Let us comment
that reversing an edge and replacing the value assigned to this edge by its
additive inverse preserves the boundary and maintains the condition nowhere-
zero. So, in particular, the question of when a graph has a nowhere-zero
function $\phi:E\rightarrow\Gamma$ with a given boundary is independent of the
orientation. Setting ${\mathbb{Z}}_{k}={\mathbb{Z}}/k{\mathbb{Z}}$ we may
state Seymour’s theorem as follows.

######  Theorem 1 (Seymour [2]).

Every 2-edge-connected digraph has a nowhere-zero ${\mathbb{Z}}_{6}$-flow.

This result combines with a theorem of Tutte [3] to show that every 2-edge-
connected digraph has a nowhere-zero 6-flow (i.e. a ${\mathbb{Z}}$-flow with
range a subset of $\\{\pm 1,\pm 2,\ldots,\pm 5\\}$). In this article we prove
the following generalization of Seymour’s theorem (set $T=U=\emptyset$ to
derive Theorem 1). Here $\mathrm{supp}(f)$ denotes the support of a function
$f$ and for a graph $G$ and a set $X\subseteq V(G)$ we use $d(X)$ to denote
the number of edges with exactly one end in $X$.

######  Theorem 2.

Let $G=(V,E)$ be a connected digraph and let $T\subseteq U\subseteq V$ have
$|T|$ even and $|U|\neq 1$. Assume further that every $\emptyset\neq
V^{\prime}\subset V$ with $V^{\prime}\cap U=\emptyset$ satisfies
$d(V^{\prime})\geq 2$. Then for $k=2,3$ there exist functions
$\phi_{k}:E(G)\rightarrow{\mathbb{Z}}_{k}$ satisfying the following
properties:

  * •

$(\phi_{2}(e),\phi_{3}(e))\neq(0,0)$ for every $e\in E$,

  * •

$\mathrm{supp}\left(\partial\phi_{2}\right)=T$, and

  * •

$\mathrm{supp}\left(\partial\phi_{3}\right)=U$.

Under the stronger hypothesis that $G$ is 3-edge-connected, a theorem of
Jaeger et. al. [1] shows that one may find a nowhere-zero
${\mathbb{Z}}_{6}$-valued function with any desired zero-sum boundary
function. The main novelty of our result is that the hypotheses are relatively
weak and the result has a quick proof by induction. In particular, we do not
require the standard reductions to 3-connected cubic graphs.

Our notation is fairly standard. For sets $X,Y$ we use $X\oplus Y=(X\setminus
Y)\cup(Y\setminus X)$ to denote symmetric difference. If $G$ is a graph and
$(G_{1},G_{2})$ is a pair of subgraphs satisfying $E(G_{1})\cup
E(G_{2})=E(G)$, $E(G_{1})\cap E(G_{2})=\emptyset$, and $|V(G_{1})\cap
V(G_{2})|=k$, then we call $(G_{1},G_{2})$ a $k$-separation. This separation
is _proper_ if $V(G_{1})\setminus V(G_{2})\neq\emptyset\neq V(G_{2})\setminus
V(G_{1})$. Note that a graph with at least $k+1$ vertices is $k$-connected if
and only if it has no proper $(k-1)$-separation.

###### Proof of Theorem 2.

We proceed by induction on $|E|$. The case when $|V|\leq 2$ holds by
inspection, so we may assume $|V|\geq 3$. If there exists $v\in V\setminus U$
with $\mathrm{deg}(v)=2$, then the result follows by contracting an edge
incident with $v$ (to eliminate this vertex) and applying induction. So we may
assume no such vertex exists. Next suppose that $G$ has a proper 1-separation
$(G_{1},G_{2})$ with $\\{v\\}=V(G_{1})\cap V(G_{2})$. First suppose that
$U\subseteq V(G_{1})$. In this case the result follows by applying the theorem
inductively to $G_{1}$ with the given sets $T,U$ and to $G_{2}$ with
$T=U=\emptyset$. Next suppose that $U$ contains a vertex in both
$V(G_{1})\setminus\\{v\\}$ and $V(G_{2})\setminus\\{v\\}$. For $i=1,2$ let
$U_{i}=(V(G_{i})\cap U)\cup\\{v\\}$ and choose $T_{i}=T\cap V(G_{i})$ or
$T_{i}=(T\cap V(G_{i}))\oplus\\{v\\}$ so that $|T_{i}|$ is even. For $i=1,2$
apply the theorem inductively to $G_{i}$ with $T_{i},U_{i}$ to obtain the
functions $\phi_{2}^{i}$ and $\phi_{3}^{i}$. Now taking
$\phi_{2}=\phi_{2}^{1}\cup\phi_{2}^{2}$ and a suitable choice of
$\phi_{3}=\phi_{3}^{1}\cup\pm\phi_{3}^{2}$ gives the desired functions for
$G$. (To see this note that by choosing $\pm\phi_{3}^{2}$ we may arrange for
$\partial\phi_{3}(v)$ to be zero or nonzero as desired).

By the above arguments, we may now assume that $G$ is 2-connected. If
$U=\emptyset$, choose an edge $e=uw$ and apply the theorem inductively to
$G^{\prime}=G-e$ with $T^{\prime}=\emptyset$ and $U^{\prime}=\\{u,w\\}$ to
obtain $\phi_{2}^{\prime}$ and $\phi_{3}^{\prime}$. Extend $\phi_{2}^{\prime}$
to a function $\phi_{2}:E\rightarrow{\mathbb{Z}}_{2}$ by setting
$\phi_{2}(e)=0$. Since $\sum_{v\in V}\partial\phi_{3}^{\prime}=0$ we have
$\partial\phi_{3}^{\prime}(u)=-\partial_{3}^{\prime}(w)=\pm 1$. Therefore, we
may extend $\phi_{3}^{\prime}$ to a function
$\phi_{3}:E\rightarrow{\mathbb{Z}}_{3}$ by setting $\phi_{3}(e)=\pm 1$ so that
$\partial\phi_{3}=0$, thus completing the proof in this case.

Now we may assume $|U|\geq 2$. By Menger’s theorem we may choose a nontrivial
path $P$ so that both ends of $P$ are in $U$ and furthermore, some component,
say $H$, of $G-E(P)$ contains both ends of $P$. Over all such paths, choose
one $P$ so that $H$ is maximal. Suppose (for a contradiction) that some
component $H^{\prime}\neq H$ of $G-E(P)$ satisfies $V(H^{\prime})\cap
U\neq\emptyset$. Choose $u\in V(H^{\prime})\cap U$ and choose two internally
vertex-disjoint paths $Q_{1},Q_{2}\subseteq H^{\prime}$ starting at $u$ and
ending in $V(P)$. Now we may choose a nontrival path $P^{\prime}\subseteq
P\cup Q_{1}$ with one end $u$ and the other an end of $P$ so that $H\cup
Q_{2}$ is contained in some connected component of $G-E(P^{\prime})$, thus
contradicting our choice of $P$. Therefore, every component of $G-E(P)$ apart
from $H$ contains no vertices in $U$. Note that by our choice, every interior
vertex of $P$ is in $V\setminus U$ (and thus has degree $\geq 3$).

Let $\\{u_{1},u_{2}\\}$ be the ends of $P$ and let $G^{\prime}=G-E(P)$. Define
$T^{\prime}=T\oplus\\{u_{1},u_{2}\\}$ and $U^{\prime}=U\cup V(P)$. Now apply
the theorem inductively to each component of $G^{\prime}$ with the
corresponding restrictions of $T^{\prime}$ and $U^{\prime}$ to obtain
$\phi_{2}^{\prime}:E(G^{\prime})\rightarrow{\mathbb{Z}}_{2}$ and
$\phi_{3}^{\prime}:E(G^{\prime})\rightarrow{\mathbb{Z}}_{3}$. Extend
$\phi_{2}^{\prime}$ to a function $\phi_{2}:E\rightarrow{\mathbb{Z}}_{2}$ by
defining $\phi_{2}(e)=1$ for every $e\in E(P)$ and note that
$\operatorname{supp}(\partial\phi_{2})=T$ as desired. By possibly reorienting
we may assume that $P$ is a directed path with edges in order
$e_{1},\ldots,e_{k}$. By greedily assigning values to these edges in order, we
may extend $\phi_{3}^{\prime}$ to a function
$\phi_{3}:E\rightarrow{\mathbb{Z}}_{3}$ with the property that
$\partial\phi_{3}(v)=0$ for every internal vertex $v$ of $P$. Now the function
$\phi_{3}$ satisfies the desired boundary condition at every vertex except
possibly the ends of $P$. Let $t\in{\mathbb{Z}}_{3}$ and modify $\phi_{3}$ by
adding $t$ to $\phi_{3}(e)$ for every $e\in E(P)$. This has no effect on the
boundaries of the internal vertices of $P$, and for some
$t\in{\mathbb{Z}}_{3}$ the resulting function will have nonzero boundary at
both ends of $P$. This gives us our desired functions $\phi_{2}$ and
$\phi_{3}$. ∎

## References

  * [1] F. Jaeger, N. Linial, C. Payan, M. Tarsi, _Group connectivity of graphs–A nonhomogeneous analogue of nowhere-zero flow properties_ , J. Combin. Theory Ser. B 56 (1992), no.2, 165–182.
  * [2] P.D. Seymour, Nowhere-zero 6-flows, J. Combin. Theory Ser. B 30 (1981), 130–135.
  * [3] W. T. Tutte, A contribution to the theory of chromatic polynomials, Canad. J. Math. 6 (1954), 80–91.