# Optimization of intensity-modulation/direct-detection optical key
distribution under passive eavesdropping

Konrad Banaszek  1,2,* Michał Jachura  1 Piotr Kolenderski  3 and Mikołaj
Lasota3  1Centre for Quantum Optical Technologies, Centre of New Technologies,
University of Warsaw, Banacha 2c, 02-097 Warszawa, Poland  2Faculty of
Physics, University of Warsaw, Pasteura 5, 02-093 Warszawa, Poland  3Faculty
of Physics, Astronomy and Informatics, Nicolaus Copernicus University,
Grudziądzka 5, 87-100 Toruń, Poland<EMAIL_ADDRESS>
###### Abstract

We analyze theoretically optimal operation of an optical key distribution
(OKD) link based on fine intensity modulation of an optical signal transmitted
over an attenuating channel to a direct detection receiver. With suitable
digital postprocessing, the users may generate a secret key that will be
unknown to an unauthorized party collecting passively a fraction of the signal
that escapes detection by the legitimate recipient. The security is ensured by
the presence of the shot noise that inevitably accompanies eavesdropper’s
attempt to detect the collected signal. It is shown that the key amount
depends on a ratio that compares legitimate recipient’s and eavesdropper’s
capabilities to detect the signal, including noise contributed by their
respective detectors. A simple proportionality relation is derived in the
strong eavesdropping regime and closed expressions for the optimal depth of
binary intensity modulation as well as the discrimination thresholds for hard-
decoded direct detection are given. The presented results substantially
simplify design of practical OKD systems operating under changing external
conditions, e.g. variable atmospheric absorption in the case of free-space
optical links.

††journal: oe

##  1 Introduction

Modern day cyber security relies primarily on software solutions. However,
there is a growing recognition for the need to protect also the physical layer
of communication systems [1]. One of the emerging techniques in this field is
quantum key distribution (QKD) [2, 3, 4], which allows two parties,
customarily called Alice and Bob, to generate a secure key. Any eavesdropping
attack carried out by an unauthorised third party, usually referred to as Eve,
can be detected by legitimate users as errors in the generated raw key. Such
an attack reduces the amount of a secure key after the privacy amplification
step or, if forceful enough, renders its generation impossible. The ambition
of QKD technology is to make the key distribution secure even against the most
sophisticated physical attacks permitted by quantum theory, including use of a
quantum processor to manipulate quantum signals transmitted between Alice and
Bob, or exploitation of side channels [5, 6, 7, 8]. However, this ambitious
goal is inseparably entwined with stringent requirements on noise properties
of components used in QKD systems and the quality of the communication
channel. In practice, such imperfections markedly limit the range of QKD links
and the attainable key rates.

An interesting alternative explored in recent years is to assume a restricted
class of eavesdropping attacks that can be viewed as imminent with current or
near-term technology. One relevant scenario is to consider the actual threat
in the form of passive eavesdropping, i.e. Eve’s ability to access a fraction
of the signal that does not reach Bob’s receiver. Such a threat is formally
equivalent to the beam splitting attack considered in the security analysis of
QKD systems [9]. As recently proposed [10] and discussed in a number of
following works [11, 12, 13, 14], in such a scenario the key security can be
ensured by shot noise properties of the electromagnetic radiation. In order to
distinguish this approach from QKD protocols, which rely essentially on
incompatible quantum measurements, we will use for the former the designation
of optical key distribution (OKD), as the optical band is the most obvious
choice for communication links operated at or near the shot noise limit.

The purpose of this paper is to analyze theoretically optimization of an OKD
link based on intensity modulation/direct detection (IM/DD) transmission,
which is one of the simplest options for communication systems. It is shown
that when the photodetection noise is modelled using Gaussian statistics, the
attainable key rate depends on a simple quantity that compares Bob’s and Eve’s
capabilities to detect the signal sent by Alice, including noise contributed
by their respective detection subsystems. Furthermore, in the strong
eavesdropping regime, when Eve’s capability significantly exceeds that of Bob,
we give simple recipes for determining the optimal signal modulation depth
used in Alice’s transmitter, as well as discrimination thresholds implemented
in Bob’s receiver. This regime is especially relevant to long-haul free-space
optical (FSO) links, where Bob’s device can often capture only a small
fraction of the optical signal produced by Alice, while a substantially higher
portion may be available to Eve. General results presented here substantially
simplify realistic modelling of practical OKD links, that needs to include
e.g. variable atmospheric conditions. The approach to physical layer security
explored here can be viewed as complementary to encodings designed for quantum
wiretap channels [15, 16, 17, 18], which usually give the legitimate user an
advantage in collecting the optical signal compared to an eavesdropper. In
contrast, postselection of detection events used in OKD enables Alice and Bob
to generate a secure key even when Eve has access to a substantially larger
fraction of the signal compared to Bob.

This work is organized as follows. Sec. 2 describes the model of an OKD link
investigated in subsequent parts of the paper. Sec. 3 analyzes the case of
Gaussian signal modulation, which will serve later as a reference for the
simpler and more practical technique of binary modulation. The latter is
discussed in Sec. 4 considering both soft and hard decoding at Bob’s receiver.
Finally, Sec. 5 concludes the paper.

##  2 Model

Figure 1: (a) Optical key distribution under passive eavesdropping. Alice’s
transmitter $\textrm{Tx}_{A}$ generates a finely intensity-modulated signal
with mean optical energy per slot $\bar{n}$. In the simplest case of binary
modulation shown in the inset, one of two optical energies $n_{0}$ or $n_{1}$
is chosen according to Alice’s bit value $q_{A}=0,1$. Bob’s and Eve’s
receivers $\textrm{Rx}_{B}$ and $\textrm{Rx}_{E}$ detect respectively
fractions $\tau_{B}$ and $\tau_{E}$ of the signal. The model assumes Gaussian
detection noise with respective variances $\sigma_{B}^{2}$ and
$\sigma_{E}^{2}$. A convenient figure to characterize the binary modulation
depth is $\delta_{E}=\tau_{E}(n_{1}-n_{0})/(2\sigma_{E})$. Binary-modulated
signal can be discriminated using two thresholds located symmetrically around
the mean value, as depicted at Bob’s location. (b) Statistics of Bob’s
outcomes for binary-modulated signal represented using a normalized variable
$y_{B}=(k_{B}-\tau_{B}\bar{n})/\sigma_{B}$. Discrimination thresholds are set
at $\pm\kappa$.

As shown in Fig. 1, Alice generates the optical signal by modulating finely
the intensity of laser light carried in discrete temporal slots. In order to
facilitate the analysis of shot noise effects it will be convenient to specify
the emitted optical energy as the mean number $n_{A}$ of photons contained in
an individual slot. The average optical energy per slot will be denoted as
$\mathbb{E}[n_{A}]=\bar{n}$. A fraction $\tau_{B}$ of the emitted signal
reaches Bob’s receiver, whereas a fraction $\tau_{E}$ can be accessed by Eve.
Bob measures the intensity of the received signal by means of direct
detection. If the phase of the optical field is random between individual
slots, Eve is also left with the intensity measurement to determine the signal
modulation. It will be assumed that the optical signals received by Bob and
Eve are strong enough to justify Gaussian statistics for the detection
outcomes, denoted respectively by variables $k_{B}$ and $k_{E}$. In the case
of small modulation depth it is reasonable to assume that the variances
$\sigma_{B}^{2}$ and $\sigma_{E}^{2}$ of Bob’s and Eve’s detectors are
independent of the mean photon number received in a given slot. Thus the
conditional distributions for Bob’s and Eve’s outcomes for a given optical
energy $n_{A}$ sent by Alice will be:

$k_{B}|n_{A}\sim{\cal N}(\tau_{B}n_{A},\sigma_{B}^{2}),\qquad
k_{E}|n_{A}\sim{\cal N}(\tau_{E}n_{A},\sigma_{E}^{2}).$ (1)

For shot noise limited detection of a weakly modulated signal one can take to
a good approximation $\sigma_{B}^{2}=\tau_{B}\bar{n}$ and
$\sigma_{E}^{2}=\tau_{E}\bar{n}$ [19].

The most intuitive protocol for key distribution in the setup described above
is based on binary modulation [10], when the optical energy $n_{A}$ in each
temporal slot assumes one of two equiprobable values $n_{0}$ or $n_{1}$
satisfying $(n_{0}+n_{1})/2=\bar{n}$ that are selected according to Alice’s
random bit value $q_{A}=0,1$. For concreteness, let us take $n_{1}>n_{0}$.
Suppose that Bob selects two discrimination thresholds located symmetrically
around $\tau_{B}\bar{n}$. For sufficiently large spacing between the
thresholds, obtaining a detection event in one of the two outer regions
enables Bob to identify almost unambiguously the value of $q_{A}$. Sifted
slots for which such events have been obtained are communicated by Bob to
Alice over a public channel. The recorded bit values form the raw key between
Alice and Bob. If the modulation depth is so low that the distributions of
Eve’s outcomes $k_{E}$ for $n_{A}=n_{0}$ and $n_{A}=n_{1}$ overlap
substantially, i.e. $\tau_{E}(n_{1}-n_{0})\lesssim\sigma_{E}$, Eve cannot
learn much about the sifted key. For example, if she implements dual-threshold
discrimination analogous to that used by Bob, most key generating events will
produce outcomes $k_{E}$ that lie in the central region. In general it is
advantageous for Eve to gain information about the key from the “soft” values
$k_{E}$, without threshold discrimination [12]. This more powerful
eavesdropping strategy will be investigated in the present work.

The basic theoretical tool in the security analysis will be the Csiszár-Körner
formula [20]:

${\sf K}=\max\\{{\sf I}(A;B)-{\sf I}(B;E),0\\}.$ (2)

which expresses the attainable key per slot ${\sf K}$ as the mutual
information ${\sf I}(A;B)$ between the legitimate users Alice and Bob reduced
by the mutual information ${\sf I}(B;E)$ specifying how much Eve might have
learnt about Bob’s outcomes. The above expression describes the reverse
reconciliation scenario, when Alice corrects her raw key according to
information received from Bob. This scenario is more robust against
eavesdropping compared to the direct reconciliation approach, in which Alice’s
and Bob’s roles in correcting the raw key are reversed. One can note here a
formal similarity with reconciliation in continuous-variable QKD protocols
[21, 22, 23, 24, 25].

##  3 Gaussian modulation

As a reference case that can be solved in a closed analytical form, we will
consider first Gaussian modulation implemented by Alice, where the mean photon
number in an individual temporal slot follows a normal distribution with a
variance $\sigma_{A}^{2}$:

$n_{A}\sim{\cal N}(\bar{n},\sigma_{A}^{2}).$ (3)

In the following, it will be convenient to use shifted and normalized
variables defined by

$y_{A}=(n_{A}-\bar{n})/\sigma_{A}\sim{\cal N}(0,1)$ (4)

for Alice and

$y_{B}=(k_{B}-\tau_{B}\bar{n})/\sigma_{B},\qquad
y_{E}=(k_{E}-\tau_{E}\bar{n})/\sigma_{E}$ (5)

for Bob and Eve, respectively. In the Gaussian scenario, Bob and Eve process
“soft” outcomes $y_{B}$ and $y_{B}$ without threshold discrimination.
Therefore mutual information in Eq. (2) needs to be calculated for pairs of
Gaussian variables $(y_{A},y_{B})$ and $(y_{B},y_{E})$.

It is straightforward to obtain that the covariance matrix $\mathbf{C}$ for
the triplet of the random variables $(y_{A},y_{B},y_{E})$ reads

$\mathbf{C}=\begin{pmatrix}1&\tau_{B}\sigma_{A}/\sigma_{B}&\tau_{E}\sigma_{A}/\sigma_{E}\\\
\tau_{B}\sigma_{A}/\sigma_{B}&1+(\tau_{B}\sigma_{A}/\sigma_{B})^{2}&(\tau_{B}\sigma_{A}/\sigma_{B})(\tau_{E}\sigma_{A}/\sigma_{E})\\\
\tau_{E}\sigma_{A}/\sigma_{E}&(\tau_{B}\sigma_{A}/\sigma_{B})(\tau_{E}\sigma_{A}/\sigma_{E})&1+(\tau_{E}\sigma_{A}/\sigma_{E})^{2}\end{pmatrix}.$
(6)

Applying the standard expression for the mutual information for a pair of
Gaussian variables $(y_{\mu},y_{\nu})$ given by

${\sf
I}(\mu;\nu)=-{\textstyle\frac{1}{2}}\log_{2}\left(1-\frac{\bigl{(}\textrm{Cov}[y_{\mu},y_{\nu}]\bigr{)}^{2}}{\textrm{Var}[y_{\mu}]\textrm{Var}[y_{\nu}]}\right),$
(7)

yields for Alice and Bob

${\sf
I}(A;B)={\textstyle\frac{1}{2}}\log_{2}[1+(\tau_{B}\sigma_{A}/\sigma_{B})^{2}],$
(8)

whereas for Bob and Eve one has

${\sf
I}(B;E)={\textstyle\frac{1}{2}}\log_{2}\left(\frac{[1+(\tau_{B}\sigma_{A}/\sigma_{B})^{2}][1+(\tau_{E}\sigma_{A}/\sigma_{E})^{2}]}{1+(\tau_{B}\sigma_{A}/\sigma_{B})^{2}+(\tau_{E}\sigma_{A}/\sigma_{E})^{2}}\right).$
(9)

The expression for the key in the reverse reconcilliation scenario calculated
according to Eq. (2) can be simplified to the form

${\sf K}_{\textrm{Gauss}}={\sf I}(A;B)-{\sf
I}(B;E)={\textstyle\frac{1}{2}}\log_{2}\left(1+\frac{(\tau_{B}\sigma_{A}/\sigma_{B})^{2}}{1+(\tau_{E}\sigma_{A}/\sigma_{E})^{2}}\right).$
(10)

It will be convenient to denote $s=\tau_{E}\sigma_{A}/\sigma_{E}$ and write

${\sf K}_{\textrm{Gauss}}={\textstyle\frac{1}{2}}\log_{2}\left(1+{\cal
R}\frac{s^{2}}{1+s^{2}}\right)$ (11)

where the ratio ${\cal R}$, defined by

${\cal R}=\left(\frac{\tau_{B}\sigma_{E}}{\tau_{E}\sigma_{B}}\right)^{2},$
(12)

compares Bob’s capability to detect the signal to that of Eve. It is
immediately seen that the right-hand side of Eq. (11) is a monotonically
increasing function of $s$ and the maximum is reached asymptotically for
$s\rightarrow\infty$,

${\sf K}_{\textrm{Gauss}}\leq{\sf
K}_{\textrm{Gauss}}^{\ast}={\textstyle\frac{1}{2}}\log_{2}(1+{\cal
R})\approx{\textstyle\frac{1}{2}}{\cal R}\log_{2}e,$ (13)

where the last, approximate form of the upper bound on the key is valid when
${\cal R}\ll 1$, i.e. when Eve has much stronger capability to detect the
signal compared to Bob. This regime will be designated as the strong
eavesdropping scenario and will be the main focus of further analysis. The
upper key bound ${\sf K}_{\textrm{Gauss}}^{\ast}$ is plotted as a function of
${\cal R}$ in Fig. 2(a).

Figure 2: (a) The key limit for Gaussian modulation ${\sf
K}_{\textrm{Gauss}}^{\ast}$ (grey dashed-dotted line) and the binary
modulation assuming soft ${\sf K}^{\ast}_{{\textrm{bin}},{\textrm{soft}}}$
(solid lines) and hard ${\sf K}^{\ast}_{{\textrm{bin}},{\textrm{hard}}}$
(dashed lines) decoding, plotted as a function of the ratio ${\cal R}$ for the
reconciliation efficiencies $\xi=100\%$ (black), $70\%$ (red), and $50\%$
(gold). (b) Corresponding optimal binary modulation depth, characterized by
$\delta_{E}=\tau_{E}(n_{1}-n_{0})/\sigma_{E}$. (c) The key reduction compared
to the Gaussian limit ${\sf K}^{\ast}_{{\textrm{bin}},{\textrm{soft}}}/{\sf
K}_{\textrm{Gauss}}^{\ast}$ (solid lines) and ${\sf
K}^{\ast}_{{\textrm{bin}},{\textrm{hard}}}/{\sf K}_{\textrm{Gauss}}^{\ast}$
(dashed lines). The asymptotic values in the limit ${\cal R}\rightarrow 0$
based on Eqs. (22), (23) and (29) are indicated with arrows on the vertical
axes of panels (b,c).

From the perspective of legitimate users it is natural to assume the worst-
case scenario that Eve’s detector operates at the shot noise level, i.e.
$\sigma_{E}^{2}=\tau_{E}\bar{n}$. Taking Bob’s detector variance as a sum of
contributions produced by the shot noise and the detector thermal noise,
$\sigma_{B}^{2}=\tau_{B}\bar{n}+\sigma_{B,{\textrm{th}}}^{2}$, yields:

${\cal
R}=\frac{\tau_{B}}{\tau_{E}}\left(1+\frac{\sigma_{B,{\textrm{th}}}^{2}}{\tau_{B}\bar{n}}\right)^{-1}$
(14)

The second term in the round brackets can be interpreted as Bob’s detector
thermal noise variance specified in shot noise units. When Bob’s detector
operates at the shot noise level, the above expression reduces to a simple
ratio of channel transmissions to Bob and to Eve, ${\cal
R}=\tau_{B}/\tau_{E}$.

Note that although the upper key bound ${\sf K}_{\textrm{Gauss}}^{\ast}$ given
in (13) is attained in the asymptotic limit of an infinite variance of Alice
modulation, the key amount becomes comparable with ${\sf
K}_{\textrm{Gauss}}^{\ast}$ when $s\gtrsim 1$, which translates into the
condition $\tau_{E}\sigma_{A}\gtrsim\sigma_{E}$. This means that fluctuations
of Eve’s detection outcome introduced by Alice’s modulation should be at least
as large as the noise of Eve’s detection.

##  4 Binary modulation

In a more practical scenario, Alice uses binary modulation and choses the
optical energy $n_{q_{A}}$ determined by the value of her bit $q_{A}=0,1$, as
described in Sec. 2. The average optical energy constraint implies that
$(n_{0}+n_{1})/2=\bar{n}$. The normalized variables describing outcomes of
Bob’s and Eve’s detection are given by:

$y_{B}|q_{A}\sim{\cal N}\bigl{(}(-1)^{q_{A}+1}\delta_{B},1\bigr{)},\qquad
y_{E}|q_{A}\sim{\cal N}\bigl{(}(-1)^{q_{A}+1}\delta_{E},1\bigr{)}$ (15)

Here the parameters

$\delta_{B}=\tau_{B}(n_{1}-n_{0})/(2\sigma_{B}),\qquad\delta_{E}=\tau_{E}(n_{1}-n_{0})/(2\sigma_{E})$
(16)

characterize the modulation depth as detected respectively by Bob’s and Eve’s
receivers and mapped onto normalized variables $y_{B}$ and $y_{E}$. Note that
these two parameters are related through a simple rescaling:

$\delta_{B}=\sqrt{\cal R}\delta_{E},$ (17)

where the parameter ${\cal R}$ has been defined in Eq. (12). In order to make
the discussion more realistic, the expression for the key given in Eq. (2)
will be replaced by a more general formula

${\sf K}_{\textrm{bin}}=\xi{\sf I}(A;B)-{\sf I}(B;E)$ (18)

where the positive factor $\xi$ characterizes reconciliation efficiency that
is usually lower than its Shannon limit, $\xi\leq 1$. Further analysis depends
on whether Bob extracts the key from the continuous outcomes $y_{B}$
themselves (soft decoding), or applies dual-threshold discrimination to
convert in a fraction of cases the outcome $y_{B}$ into a binary variable
$q_{B}$ (hard decoding), as described qualitatively in Sec. 2.

###  4.1 Soft decoding

In the soft decoding approach, Bob aims to infer the value of $q_{A}$ from the
continuous outcome $y_{B}$. It is convenient to rewrite the expression (18)
for the key to the equivalent form

${\sf K}_{{\textrm{bin}},{\textrm{soft}}}={\sf H}(B|E)-\xi{\sf
H}(B|A)-(1-\xi){\sf H}(B).$ (19)

In the above formula, the conditional entropy ${\sf H}(B|E)$ is calculated for
the joint probability distribution

$p(y_{B},y_{E})={\textstyle\frac{1}{4\pi}}\\{\exp[-(y_{B}+\delta_{B})^{2}/2-(y_{E}+\delta_{E})^{2}/2]+\exp[-(y_{B}-\delta_{B})^{2}/2-(y_{E}-\delta_{E})^{2}/2]\\}.$
(20)

Further, the conditional entropy in the second term reads ${\sf
H}(B|A)=\frac{1}{2}\log_{2}(2\pi e)$, and the marginal entropy ${\sf H}(B)$ is
given by [26]:

${\sf H}(B)={\textstyle\frac{1}{2}}\log_{2}(2\pi
e)+\delta_{B}^{2}\log_{2}e-\int_{-\infty}^{\infty}\frac{dt}{\sqrt{2\pi}}\exp[-(t-\delta_{B})^{2}/2]\log_{2}[\cosh(\delta_{B}t)].$
(21)

The optimal modulation depth is found by maximizing ${\sf
K}_{{\textrm{bin}},{\textrm{soft}}}$ given in Eq. (19) over $\delta_{B}$, or
equivalently $\delta_{E}$, as these two variables are linearly dependent
through Eq. (17). Fig. 2(a) depicts the optimized key ${\sf
K}^{\ast}_{{\textrm{bin}},{\textrm{soft}}}$ as a function of ${\cal R}$ for
perfect reconciliation, $\xi=100\%$, as well as limited reconciliation
efficiencies $\xi=70\%$ and $\xi=50\%$. The corresponding optimal argument
values $\delta_{E}^{\ast}$ are shown in Fig. 2(b). It is seen that in the
strong eavesdropping regime, when ${\cal R}\ll 1$, the key exhibits linear
scaling with ${\cal R}$ and the parameter $\delta_{E}^{\ast}$ tends to a
constant value dependent on the reconciliation efficiency $\xi$. It will be
convenient to write

${\sf
K}_{{\textrm{bin}},{\textrm{soft}}}^{\ast}\approx\gamma^{\textrm{as}}(\xi)\times{\textstyle\frac{1}{2}}{\cal
R}\log_{2}e$ (22)

where the multiplicative factor $\gamma^{\textrm{as}}(\xi)$ characterizes
reduction in the key amount compared to the Gaussian upper bound in the
asymptotic limit ${\cal R}\rightarrow 0$. As shown in Appendix A, the factor
$\gamma^{\textrm{as}}(\xi)$ can be found by optimizing the expression

$\gamma^{\textrm{as}}(\xi)=\max_{\delta_{E}\geq
0}\left\\{\delta_{E}^{2}\left(1+\xi-\int_{-\infty}^{\infty}\frac{dt}{\sqrt{2\pi}}\,\frac{\sinh(2\delta_{E}t)+1}{\cosh^{2}(\delta_{E}t)}\exp[-(t-\delta_{E})^{2}/2]\right)\right\\}$
(23)

and the argument $\delta_{E}^{\textrm{as}}(\xi)$, for which the maximum on the
right-hand side of the above expression is attained, defines the optimal
modulation depth as detected by Eve. The asymptotic values match well the
results of numerical optimization as seen in Fig. 2(b,c). The analysis of the
strong eavesdropping scenario with soft decoding is summarized with Fig. 3
which depicts the reduction in the key amount $\gamma^{\textrm{as}}(\xi)$ and
the optimal modulation depth $\delta_{E}^{\textrm{as}}(\xi)$ as functions of
the reconciliation efficiency $\xi$.

Figure 3: (a) Reduction in the key amount $\gamma^{\textrm{as}}(\xi)$ in the
asymptotic limit ${\cal R}\rightarrow 0$ given by Eq. (23) as a function of
the reconciliation efficiency $\xi$. (b) The corresponding modulation depth
$\delta_{E}^{\textrm{as}}(\xi)$ in units determined by the normalized outcome
of Eve’s detection. Reconciliation efficiency values chosen for numerical
examples depicted in Fig. 2 are indicated with color arrows on the horizontal
axes of the panels.

###  4.2 Hard decoding

The numerical complexity of key reconciliation can be reduced substantially by
applying dual-threshold discrimination to Bob’s detection outcome $y_{B}$ as
described in Sec. 2. Such hard decoding produces a discrete variable

$q_{B}=\begin{cases}0&\text{if $y_{B}<-\kappa$}\\\ {\sf X}&\text{if
$-\kappa\leq y_{B}\leq\kappa$}\\\ 1&\text{if $y_{B}>\kappa$}\end{cases}$ (24)

where $\kappa$ defines the discrimination threshold. Events ${\sf X}$ are
treated as erasures and removed from further processing in the sifting step.
The probability of generating a raw key bit is consequently given by

$p_{\textrm{raw}}={\textstyle\frac{1}{2}}\bigl{[}\textrm{erfc}\bigl{(}({\kappa-\delta_{B}})/{\sqrt{2}}\bigr{)}+\textrm{erfc}\bigl{(}({\kappa+\delta_{B}})/{\sqrt{2}}\bigr{)}\bigr{]}.$
(25)

The probability of error in the raw key is symmetric and reads

$\varepsilon=(2p_{\textrm{raw}})^{-1}\textrm{erfc}\bigl{(}({\kappa+\delta_{B}})/{\sqrt{2}}\bigr{)}.$
(26)

Under reverse reconciliation investigated here, the key amount per slot is
given by

${\sf K}_{{\textrm{bin}},{\textrm{hard}}}=p_{\textrm{raw}}\\{\xi[1-{\sf
H}_{\textrm{bin}}(\varepsilon)]-{\sf G}(\delta_{E},\varepsilon)\\},$ (27)

where $\xi$ is the reconciliation efficiency, ${\sf
H}_{\textrm{bin}}(\varepsilon)=-\varepsilon\log_{2}\varepsilon-(1-\varepsilon)\log_{2}(1-\varepsilon)$
is the binary entropy and the function ${\sf G}(\cdot,\cdot)$ is defined as:

${\sf
G}(s,\varepsilon)=\int_{-\infty}^{\infty}\frac{dt}{\sqrt{2\pi}}\exp[-(t-s)^{2}/2]\\{\varepsilon\log_{2}[\varepsilon
e^{st}+(1-\varepsilon)e^{-st}]\\\ +(1-\varepsilon)\log_{2}[\varepsilon
e^{-st}+(1-\varepsilon)e^{st}]-\log_{2}[\cosh(st)]\\}.$ (28)

In order to optimize the key amount, the right hand side of Eq. (27) needs to
be maximized over the modulation depth characterized by $\delta_{E}$ and the
discrimination threshold $\kappa$. Note that when $\delta_{E}$ is chosen as
the free parameter in the optimization procedure, one needs to express
$\delta_{B}=\sqrt{\cal R}\delta_{E}$ in Eqs. (25) and (26).

The optimized key ${\sf K}^{\ast}_{{\textrm{bin}},{\textrm{hard}}}$ and the
corresponding optimal modulation depth $\delta_{E}^{\ast}$ as functions of
${\cal R}$ are shown respectively in Fig. 2(a) and (b) for reconciliation
efficiencies $\xi=100\%,70\%$, and $50\%$. It is seen that in the strong
eavesdropping regime the key amount is reduced by a constant factor compared
to the soft decoding case, while the optimal modulation depth remains to a
very good approximation at the same level. Interestingly, the optimal
discrimination threshold $\kappa^{\ast}$ weakly depends on either ${\cal R}$
or $\xi$, as seen in Fig. 4(a). The resulting probability of generating a raw
key bit $p_{\textrm{raw}}$ and the probability of error $\varepsilon$ are
depicted in Fig. 4(b).

Figure 4: (a) The optimal discrimination threshold $\kappa^{\ast}$ for the
hard-decoded binary modulation scenario as a function of the ratio ${\cal R}$,
shown for reconciliation efficiencies $\xi=100\%$ (black), $\xi=70\%$ (red)
and $\xi=50\%$ (gold). The asymptotic value $\kappa^{\textrm{as}}=0.6120$
derived in Appendix B is indicated with an arrow. (b) The resulting
probability of generating a raw key bit $p_{\textrm{raw}}$ (solid lines) and
the probability of error $\varepsilon$ (dashed lines) for the same selection
of reconciliation efficiencies.

The features identified above in numerical results can be characterized
quantitatively with the help of the analysis of the asymptotic limit ${\cal
R}\rightarrow 0$ presented in Appendix B. In this limit, the reduction in the
key amount is given by a numerical factor

${\sf K}_{{\textrm{bin}},{\textrm{hard}}}^{\ast}\approx
0.8098\times\gamma^{\textrm{as}}(\xi)\times{\textstyle\frac{1}{2}}{\cal
R}\log_{2}e.$ (29)

Interestingly, the factor $\gamma^{\textrm{as}}(\xi)$ as well as the optimal
modulation depth $\delta^{\textrm{as}}_{E}(\xi)$ are the same as in the soft
decoding case. Furthermore, the optimal discrimination threshold
$\kappa^{\textrm{as}}=0.6120$ does not depend on the reconciliation
efficiency. The asymptotic values for the optimal modulation depth, the
reduction of the key amount, and the optimal threshold are indicated with
arrows on the vertical axis respectively in Figs. 2(b), 2(c), and 4(a). It is
seen that as long as the reconciliation efficiency is above $50\%$, the
asymptotic values can be used in the analysis for the ratio ${\cal R}$ below
approximately $-15$ dB.

##  5 Discussion and conclusions

The purpose of this work was to identify theoretically the optimal operation
of an optical key distribution link utilizing weak intensity modulation, when
an adversary implements a passive eavesdropping attack. In this scenario, the
key security is ensured by the shot noise present in the signal detected by
the eavesdropper. The key amount depends primarily on the ratio ${\cal R}$
defined in Eq. (12) which compares the capabilities of the legitimate user and
the eavesdropper to detect the optical signal. For Gaussian modulation, an
upper bound on the attainable key is given by Eq. (11). In the strong
eavesdropping regime, when ${\cal R}\ll 1$ the key amount is simplified to a
linear expression $\frac{1}{2}{\cal R}\log_{2}e$. For other signal modulation
formats and receivers setups considered in this work, this expression is
reduced by a certain multiplicative factor.

In the case of binary modulation and soft decoding with reconciliation
efficiency $\xi$, the key amount is reduced by a factor
$\gamma^{\textrm{as}}(\xi)$ that can be calculated using Eq. (23). The
dependence of $\gamma^{\textrm{as}}(\xi)$ on $\xi$ is depicted in Fig. 3(a).
The argument $\delta_{E}^{\textrm{as}}(\xi)$ maximizing the expression on the
right hand side of Eq. (23) specifies the optimal modulation depth: namely,
the sender should use in individual slots optical energies given by
$\bar{n}\pm\delta_{E}^{\textrm{as}}(\xi)\sigma_{E}/\tau_{E}$. Importantly,
when ${\cal R}\ll 1$ the optimal modulation depth depends only on Eve’s
channel transmission $\tau_{E}$ and the detection noise $\sigma_{E}$ of her
receiver, rather then corresponding parameters for Bob’s link.

When dual-threshold hard decoding is used in the receiver, the key amount is
further reduced by an approximately constant factor specified in Eq. (29). The
optimal discrimination threshold exhibits weak dependence on either ${\cal R}$
or $\xi$. A possible difficulty in practical implementation of the binary
modulation scheme with dual-threshold discrimination is the high probability
of error in the raw key, as seen in Fig. 4(b), which may limit the practically
attainable reconciliation efficiency [27]. Finally let us note that if there
is uncertainty regarding Eve’s eavesdropping capability, the worst-case
scenario should be assumed. This will overestimate Eve’s information about
Bob’s detection outcomes and hence ensure the security of the generated key,
although may diminish its amount.

Qualitatively, the key per slot for all variants of the OKD protocol
considered here has the same linear dependence on the ratio ${\cal R}$. While
Gaussian modulation offers the highest efficiency in terms of attainable key
rate, its practical implementation may be technically challenging and pose
difficulties to attain high reconciliation efficiencies [28, 29]. Therefore
one can envisage that in practice the variant of choice will be binary
modulation combined with hard-decision detection, whose overall simplicity
should compensate for the minor reduction in the secret key rate.

LEO satellite orbit
---
Inclination angle | $51.64^{\circ}$
Orbit apogee/perigee | $420~{}\mathrm{km}$
Orbital period | 91 min 43 s
Transmitter parameters
Beam power | $1~{}\mathrm{W}$
Slot duration | $1~{}\mathrm{ns}$
Beam divergence (full angle) | $0.06^{\circ}$
Wavelength | $1550~{}\mathrm{nm}$
Receiver parameters
Ground station latitude | $52^{\circ}\mathrm{N}$
Receiver telescope diameter | $40~{}\mathrm{cm}$
Detection power threshold | $-38~{}\mathrm{dBm}$
Table 1: Parameters of a LEO-to-ground optical link used to estimate the
length of a secure key that could be generated using the OKD technique during
a single satellite pass.

To illustrate the practical potential of OKD we calculated the length of a
secure key that can be generated during a single pass of a low Earth orbit
(LEO) satellite equipped with an optical transmitter over an optical ground
station (OGS) using parameters collected in Table 1. The parameter ${\cal R}$
has been taken as $-20$ dB, which describes a scenario where both Bob’s and
Eve’s detectors are shot-noise limited, but Eve’s receive telescope has ten
times larger diameter than that of Bob. An equivalent scenario is equal
apertures of Bob’s and Eve’s telescopes, but Bob’s detector noise approx. $20$
dB above the shot noise level. For a pass with a maximum elevation angle of
$55^{\circ}$ the optical power received by the OGS exceeds the detection
threshold during an interval of $122~{}\mathrm{s}$. Taking the slot rate of 1
Gbaud/s and theoretical limit for binary modulation and hard-decoding with
100% reconciliation efficiency yields the total length of the generated key
equal to 340 Mbits corresponding to the key rate of 2.79 Mbps. For a non-unit
reconciliation efficiency $\xi$ these figures are reduced by a factor depicted
in Fig. 3(a). The presented example indicates that for passive eavesdropping
attacks OKD can provide secure key rates contending with those offered by
conventional QKD [9] while dispensing with some of elaborate technologies
required by the latter.

## Acknowledgments

We wish to acknowledge insightful discussions with K. Inoue, P. V. Trinh, J.
Kołodyński, M. Parniak-Niedojadło, and W. Wasilewski.

## Funding

This work is a part of the project “Quantum Optical Technologies” carried out
within the International Research Agendas programme of the Foundation for
Polish Science co-financed by the European Union under the European Regional
Development Fund. ML and PK acknowledge financial support by the Foundation
for Polish Science (FNP) (project First Team co-financed by the European Union
under the European Regional Development Fund, POIR.04.04.00-00-3FD9/17).

## Data availability

Data underlying the results presented in this paper are not publicly available
at this time but may be obtained from the authors upon reasonable request.

## Disclosures

The authors declare no conflicts of interest.

##  Appendix A Asymptotics for binary modulation, soft decoding

The conditional entropy ${\sf H}(B|E)$ entering Eq. (19) can be expressed as

${\sf
H}(B|E)=-\int_{-\infty}^{\infty}dy_{B}\int_{-\infty}^{\infty}dy_{E}p(y_{B},y_{E})\log_{2}p(y_{B}|y_{E})$
(30)

which involves the joint probability distribution $p(y_{B},y_{E})$ specified
in Eq. (20) and the conditional probability distribution $p(y_{B}|y_{E})$ that
can be written as

$p(y_{B}|y_{E})=\frac{p(y_{B},y_{E})}{\int_{-\infty}^{\infty}dy_{B}\,p(y_{B},y_{E})}=\frac{\cosh(\delta_{E}y_{E}+\delta_{B}y_{B})}{\sqrt{2\pi}\cosh(\delta_{E}y_{E})}\exp(-y_{B}^{2}/2-\delta_{B}^{2}/2).$
(31)

Consequently, the expression for the conditional entropy ${\sf H}(B|E)$ can be
simplified to the form

${\sf H}(B|E)={\textstyle\frac{1}{2}}\log_{2}(2\pi
e)+\delta_{B}^{2}\log_{2}e-\int_{-\infty}^{\infty}dy_{B}\int_{-\infty}^{\infty}dy_{E}\,p(y_{B},y_{E})\log_{2}\frac{\cosh(\delta_{E}y_{E}+\delta_{B}y_{B})}{\cosh(\delta_{E}y_{E})}.$
(32)

Numerical optimization indicates that for strong eavesdropping,when ${\cal
R}\ll 1$ the optimal value $\delta_{E}^{\ast}$ is of the order of one. Hence
in this regime $\delta_{B}=\sqrt{\cal R}\delta_{E}$ becomes small compared to
one. This justifies expanding the logarithm in Eq. (32) up to the quadratic
term in $\delta_{B}$, which yields

$\log_{2}\frac{\cosh(\delta_{E}y_{E}+\delta_{B}y_{B})}{\cosh(\delta_{E}y_{E})}\\\
\approx\left(\delta_{B}y_{B}\tanh(\delta_{E}y_{E})+\frac{(\delta_{B}y_{B})^{2}}{2\cosh^{2}(\delta_{E}y_{E})}\right)\log_{2}e$
(33)

and allows one to perform integration over $y_{B}$. Further, the marginal
entropy ${\sf H}(B)$ can be approximated by [26]

${\sf H}(B)\approx{\textstyle\frac{1}{2}}\log_{2}(2\pi
e)+{\textstyle\frac{1}{2}}\delta_{B}^{2}\log_{2}e.$ (34)

This leaves one with the following approximate expression for the key in the
leading order of $\delta_{B}^{2}={\cal R}\delta_{E}^{2}$:

${\sf
K}_{{\textrm{bin}},{\textrm{soft}}}\approx\delta_{E}^{2}\left(1+\xi-\int_{-\infty}^{\infty}\frac{dt}{\sqrt{2\pi}}\,\frac{\sinh(2\delta_{E}t)+1}{\cosh^{2}(\delta_{E}t)}\exp[-(t-\delta_{E})^{2}/2]\right)\times{\textstyle\frac{1}{2}}{\cal
R}\log_{2}e$ (35)

where for the sake of clarity the integration variable has been changed from
$y_{E}$ to $t$. In order to identify the optimal modulation depth for a given
reconciliation efficiency $\xi$, the factor $\delta_{E}^{2}(\ldots)$ needs to
be maximized over $\delta_{E}$, as specified in Eq. (23).

##  Appendix B Hard decoding in the asymptotic limit

Analogously to the soft decoding scenario, numerics suggests that for ${\cal
R}\ll 1$ one should consider $\delta_{B}\ll 1$. Expansion of the probability
of generating a raw key bit $p_{\textrm{raw}}$ and the probability of error
$\varepsilon$ up to the second order in $\delta_{B}$ yields:

$p_{\textrm{raw}}=\textrm{erfc}(\kappa/\sqrt{2})+O(\delta_{B}^{2}),\qquad\varepsilon=\frac{1}{2}\left(1-\sqrt{\frac{2}{\pi}}\frac{\exp(-\kappa^{2}/2)}{\textrm{erfc}(\kappa/\sqrt{2})}\delta_{B}\right)+O(\delta_{B}^{2}).$
(36)

Given the above approximate form of $\varepsilon$, in the following it will be
convenient take $\varepsilon=(1-\eta)/2$ and expand ${\sf
G}\bigl{(}s,(1-\eta)/2\bigr{)}$ around $\eta=0$:

${\sf
G}\bigl{(}s,(1-\eta)/2\bigr{)}\approx\eta^{2}\log_{2}e\times\int_{-\infty}^{\infty}\frac{dt}{\sqrt{2\pi}}[\tanh(st)-{\textstyle\frac{1}{2}}\tanh^{2}(st)]\exp[-(t-s)^{2}/2].$
(37)

Note that

$\tanh(st)-{\textstyle\frac{1}{2}}\tanh^{2}(st)=\frac{\sinh(2st)+1}{2\cosh^{2}(st)}-\frac{1}{2}.$
(38)

Further, for $\eta\ll 1$ mutual information for a binary symmetric channel can
be approximated by

$1-{\sf
H}_{\textrm{bin}}\bigl{(}(1-\eta)/2\bigr{)}\approx{\textstyle\frac{1}{2}}\eta^{2}\log_{2}e.$
(39)

Inserting the approximate expressions into Eq. (27) yields in the leading
order quadratic in $\delta_{B}^{2}={\cal R}\delta_{E}^{2}$:

$K_{{\textrm{bin}},{\textrm{hard}}}\approx\frac{2}{\pi}\frac{\exp(-\kappa^{2})}{\textrm{erfc}(\kappa/\sqrt{2})}\times\delta_{E}^{2}\left(1+\xi-\int_{-\infty}^{\infty}\frac{dt}{\sqrt{2\pi}}\frac{\sinh(2\delta_{E}t)+1}{\cosh^{2}(\delta_{E}t)}e^{-(t-\delta_{E})^{2}/2}\right)\times{\textstyle\frac{1}{2}}{\cal
R}\log_{2}e$ (40)

Interestingly, the discrimination threshold $\kappa$ and the modulation depth
$\delta_{E}$ enter two separate multiplicative factors. Hence, optimization
with respect to these two parameters can be carried out independently.
Moreover, the factor $2\exp(-\kappa^{2})/[\pi\textrm{erfc}(\kappa/\sqrt{2})]$
dependent on $\kappa$ does not involve the reconciliation efficiency $\xi$.
Its numerical optimization yields the maximum value equal to $0.809826$ that
is obtained for the argument $\kappa^{\textrm{as}}=0.612003$. The second
factor, dependent on $\delta_{E}$ has exactly the same form as in the case of
soft decoding and its optimization yields again the factor
$\gamma^{\textrm{as}}(\xi)$ given by Eq. (23).

## References

  * [1] M. Bloch and J. Barros, _Physical-Layer Security: From Information Theory to Security Engineering_ (Cambridge University, 2011).
  * [2] V. Scarani, H. Bechmann-Pasquinucci, N. J. Cerf, M. Dušek, N. Lütkenhaus, and M. Peev, “The security of practical quantum key distribution,” Rev. Mod. Phys. 81, 1301–1350 (2009).
  * [3] F. Xu, X. Ma, Q. Zhang, H.-K. Lo, and J.-W. Pan, “Secure quantum key distribution with realistic devices,” Rev. Mod. Phys. 92, 025002 (2020).
  * [4] S. Pirandola, U. L. Andersen, L. Banchi, M. Berta, D. Bunandar, R. Colbeck, D. Englund, T. Gehring, C. Lupo, C. Ottaviani, J. L. Pereira, M. Razavi, J. S. Shaari, M. Tomamichel, V. C. Usenko, G. Vallone, P. Villoresi, and P. Wallden, “Advances in quantum cryptography,” Adv. Opt. Photon. 12, 1012–1236 (2020).
  * [5] I. Derkach, V. C. Usenko, and R. Filip, “Preventing side-channel effects in continuous-variable quantum key distribution,” Phys. Rev. A 93, 032309 (2016).
  * [6] I. Derkach, V. C. Usenko, and R. Filip, “Continuous-variable quantum key distribution with a leakage from state preparation,” Phys. Rev. A 96, 062309 (2017).
  * [7] J. Pereira and S. Pirandola, “Hacking alice’s box in continuous-variable quantum key distribution,” Phys. Rev. A 98, 062319 (2018).
  * [8] N. Jain, I. Derkach, H.-M. Chin, R. Filip, U. L. Andersen, V. C. Usenko, and T. Gehring, “Modulation leakage vulnerability in continuous-variable quantum key distribution,” Quantum Science and Technology 6, 045001 (2021).
  * [9] Z. Pan and I. B. Djordjevic, “Secret key distillation over satellite-to-satellite free-space optics channel with a limited-sized aperture eavesdropper in the same plane of the legitimate receiver,” Opt. Express 28, 37129–37148 (2020).
  * [10] T. Ikuta and K. Inoue, “Intensity modulation and direct detection quantum key distribution based on quantum noise,” New Journal of Physics 18, 013018 (2016).
  * [11] P. V. Trinh, T. V. Pham, N. T. Dang, H. V. Nguyen, S. X. Ng, and A. T. Pham, “Design and security analysis of quantum key distribution protocol over free-space optics using dual-threshold direct-detection receiver,” IEEE Access 6, 4159–4175 (2018).
  * [12] T. A. Eriksson, P. V. Trinh, H. Endo, M. Takeoka, and M. Sasaki, “Secret key rates for intensity-modulated dual-threshold detection key distribution under individual beam splitting attacks,” Opt. Express 26, 20409–20419 (2018).
  * [13] N. Yamamori and K. Inoue, “Experimental demonstration of intensity-modulation/direct-detection secret key distribution,” Japanese Journal of Applied Physics 59, 022003 (2020).
  * [14] P. V. Trinh, A. Carrasco-Casado, A. T. Pham, and M. Toyoshima, “Secrecy analysis of FSO systems considering misalignments and eavesdropper’s location,” IEEE Trans. Commun. 68, 7810–7823 (2020).
  * [15] H. Endo, T. S. Han, T. Aoki, and M. Sasaki, “Numerical study on secrecy capacity and code length dependence of the performances in optical wiretap channels,” IEEE Photonics Journal 7, 1–18 (2015).
  * [16] M. Fujiwara, T. Ito, M. Kitamura, H. Endo, O. Tsuzuki, M. Toyoshima, H. Takenaka, Y. Takayama, R. Shimizu, M. Takeoka, R. Matsumoto, and M. Sasaki, “Free-space optical wiretap channel and experimental secret key agreement in 7.8 km terrestrial link,” Opt. Express 26, 19513–19523 (2018).
  * [17] Z. Pan, K. P. Seshadreesan, W. Clark, M. R. Adcock, I. B. Djordjevic, J. H. Shapiro, and S. Guha, “Secret-key distillation across a quantum wiretap channel under restricted eavesdropping,” Phys. Rev. Applied 14, 024044 (2020).
  * [18] A. Vázquez-Castro, D. Rusca, and H. Zbinden, “Quantum keyless private communication versus quantum key distribution for space links,” Phys. Rev. Applied 16, 014006 (2021).
  * [19] K. Banaszek, L. Kunz, M. Jachura, and M. Jarzyna, “Quantum limits in optical communications,” Journal of Lightwave Technology 38, 2741–2754 (2020).
  * [20] I. Csiszár and J. Körner, “Broadcast channels with confidential messages,” IEEE Trans. Inf. Theory 24, 339–348 (1978).
  * [21] C. Silberhorn, T. C. Ralph, N. Lütkenhaus, and G. Leuchs, “Continuous variable quantum cryptography: Beating the 3 dB loss limit,” Phys. Rev. Lett. 89, 167901 (2002).
  * [22] F. Grosshans, G. Van Assche, J. Wenger, R. Brouri, N. J. Cerf, and P. Grangier, “Quantum key distribution using gaussian-modulated coherent states,” Nature 421, 238–241 (2003).
  * [23] F. Grosshans, N. J. Cerf, J. Wenger, R. Tualle-Brouri, and P. Grangier, “Virtual entanglement and reconciliation protocols for quantum cryptography with continuous variables,” Quantum Inf. Comput. 3, 535–552 (2003).
  * [24] V. C. Usenko and R. Filip, “Squeezed-state quantum key distribution upon imperfect reconciliation,” New Journal of Physics 13, 113007 (2011).
  * [25] F. Laudenbach, C. Pacher, C.-H. F. Fung, A. Poppe, M. Peev, B. Schrenk, M. Hentschel, P. Walther, and H. Hübel, “Continuous-variable quantum key distribution with gaussian modulation—the theory of practical implementations,” Advanced Quantum Technologies 1, 1800011 (2018).
  * [26] L. Kunz, M. Jarzyna, W. Zwoliński, and K. Banaszek, “Low-cost limit of classical communication with restricted quantum measurements,” New Journal of Physics 22, 043010 (2020).
  * [27] D. Elkouss, J. Martinez-Mateo, and V. Martin, “Information reconciliation for quantum key distribution,” Quantum Inf. Comput. 11, 226–238 (2011).
  * [28] H.-X. Ma, P. Huang, D.-Y. Bai, T. Wang, S.-Y. Wang, W.-S. Bao, and G.-H. Zeng, “Long-distance continuous-variable measurement-device-independent quantum key distribution with discrete modulation,” Phys. Rev. A 99, 022322 (2019).
  * [29] P. Jouguet, S. Kunz-Jacques, and A. Leverrier, “Long-distance continuous-variable quantum key distribution with a gaussian modulation,” Phys. Rev. A 84, 062317 (2011).