# Yu-Shiba-Rusinov states of single magnetic molecule in an $s-wave$
superconductor

Saurabh Pradhan  Jonas Fransson  Department of Physics and Astronomy, Box 516,
75120, Uppsala University, Uppsala, Sweden

###### Abstract

We use the numerical renormalization group theory to investigate the Yu-Shiba-
Rusinov (YSR) bound state properties of single magnetic molecules placed in an
s-wave superconducting substrate. The molecule consist of a large core spin
and a single orbital, coupled via an exchange interaction. The critical
Coulomb interaction for the singlet/doublet transition decreases in the
presence of this exchange interaction for both ferro and anti-ferromagnetic
couplings. The number of YSR states also increase to two pairs, however, in
the singlet phase, one of the pairs have zero spectral weight. We explore the
evolution of the in-gap states using the Anderson model. Away from the
particle-hole symmetry point, the results suggest a doublet-singlet-doublet
transition as the on-site energy is lowered while keeping the Coulomb
interaction fixed. To understand these results, we write down an effective
model for the molecule in the limit of large superconducting order parameter.
Qualitatively, it explains the various phase transitions and spectral nature
of the in-gap states. Finally, we analyze the effects of magnetic anisotropic
fields of the core spin on in-gap states. Due to internal degrees of freedom
of the spin excited states, a multitude of new states emerges within the gap.
Depending on the sign and strength of the uniaxial anisotropic field, the
results indicate up to three pairs of YSR states.

##  I Introduction

Nanoscale devices coupled in a tunnel junction give unique opportunities to
study quantum many-body effect of impurity systems. Recent years, there have
been tremendous advancements over the control of such devices, where the
number of electron is controlled electrostatically in a small restricted
region. Whenever these devices contain an odd number of electrons, the Kondo
effectscott ; hewsonBook ; colemanBook  arises due to multiple spin-flip
scattering processes. Quantum dotsdots1 ; dots2 , magnetic addatomsaddatoms1 ;
addatoms2 ; addatoms3 , and magnetic moleculesmolecule1 ; molecule2 ;
molecule3  are examples of microscopic systems which display the Kondo effect
when mounted in a junction between metallic electrodes.

Low temperature experiments with localized magnetic moments adsorbed onto
superconducting surface display the emergence of bound states inside the
superconducting gap. This was first measured using scanning tunneling
microscopy and spectroscopyexp1  for single magnetic impurities, which has
subsequently been reproduced by various groups under different experimental
conditions, such as, magnetic fieldexp2 ; exp3 . Theoretically, the emergence
of in-gap bound states was predicted by YuYu , ShibaShiba , and RusinovRusinov
, using semi-classical approaches where, specifically, the spin moment was
treated as classical. Quantum effects of magnetic impurities were later
studied within mean-field theorymft1 ; mft2 , perturbation theorypurtb1 ;
purtb2 , and numerical renormalization group (NRG) theorynrgsc1 ; nrgsc2 ;
nrgsc3 .

The ground state of a quantum magnetic impurity in a metal substrate is a
Kondo singlet with a characteristic energy scale related to the Kondo
temperature ($T_{k}$). However, in a superconductor, the substrate electrons
form Cooper pairs which are not compatible with the Kondo singlet state. The
fundamental interactions associated with the superconducting gap
($\Delta_{\text{sc}}$) and the Kondo temperature compete with each other, and
at large $\Delta_{\text{sc}}$ the ground state becomes a doublet formed by
substrate and impurity electrons. The ratio of the two energy scales
determines the nature of the ground state and energies of the bound states
inside the gap. The bound state energy coincides with the energy of the edge
of the superconducting gap for weak coupling between the spin moment and the
surface states, and move inside the gap for increasing coupling strength,
eventually crossing the Fermi energy when the two energy scales are similar
$T_{k}\approx\Delta_{\text{sc}}$.

The bound states always come as in pairs of particle-hole symmetric states
around the Fermi energy. Recently, more than one pair of Yu-Shiba-Rusinov
(YSR) states were observedorbital2 ; orbital3  in experiments with magnetic
molecules. Multiple pair of YSR states have been attributed to the presence of
many orbitals in the molecule. The coupling of these orbitals with the
substrate is not uniform due to the different nature of the orbitals. As a
result, the energies of the YSR states of the different orbitals may have
different energies and weights. Results from NRG calculations of large spin
moments with magnetic anisotropy, show that multiple pairs of YSR states may
appearorbital4  due to internal spin excitation. These calculations do,
however, not take into account differences due to the localized and
delocalized nature of the $d$\- and the ligand orbitals, respectively.

Here, we have considered an Anderson impurity model, in which superconducting
surface states play the role of the reservoir electrons, coupled with a core
spin. Due to the presence of the core spin, multiple YSR states emerge inside
the superconducting gap. This model naturally reflects the geometry of the
large spin molecular systems such as Fe8Fe8 , Mn12Mn12  and transition metal
phthalocyaninesorbital2 ; frankeReview . The ligand orbitals of the molecule
form degenerate orbitals which couple with the surface electrons in the
substrate. For simplicity, we have considered a single orbital Anderson
impurity model for the ligand orbitals. The $d$-orbital electrons of the
transition metal atom do not hybridize much and, therefore, form a local
magnetic moment. We have assumed that the spin moment of the transition metal
atom interacts only with electrons in the ligand orbital via exchange and has
no interaction with the substrate electrons. We have considered the magnetic
moment of the transition metal atom to be large ($S>1/2$). Due to spin-orbit
coupling and spatial structure of the substrate, we have also included
magnetic anisotropy for the core spin. In case of phthalocyanine molecules,
some $d$-orbitals can form a core-spin without hybridizing with the substrate
while other $d$-orbitals do hybridize. The latter scenario do give rise to a
pronounced Kondo effectorbital5 .

This paper is organized as follows. In Sec. II, the model is defined and we
present a brief description of the NRG method. In Sec. III, we derive an
effective model for our system in the limit of a large superconducting gap.
This gives a better understanding of the NRG results and qualitatively
explains various properties of the YSR states. In Sec. IV, we present the NRG
results. In Sec. IV A, we discuss the proximity induced superconducting order
parameter in the molecule, whereas in Sec. IV B, we discuss the behavior of
the YSR state as a function of the Coulomb interaction for different values of
the exchange interaction. In Sec. IV C, we discuss the spectral weight of the
YSR states. Single particle transition from the ground state is only possible
when the spectral weight is non-zero. In Sec. IV D, we change the on-site
energy of the orbital away from the particle-hole symmetric point, while in
Sec. IV E, finally, we look at the behavior of the YSR as we turn on the
magnetic anisotropy field. The paper is concluded and summarized in Sec. V.

##  II Model and Methods

Figure 1: (a) Schematic diagram of the magnetic molecule in a tunnel junction
with finite bias voltage ($V$). (b) Energy eigenvalues of the effective
Hamiltonian as function of Coulomb energy ($U$) for the molecule in the large
$\Delta$ limit. Solid lines are for eigenvalues when $J_{\text{ex}}$ and
$\Delta$ are finite, whereas dashed line represents vanishing values, that is,
$J_{\text{ex}}=\Delta=0$.

We consider the magnetic molecule to be embedded in a tunnel junction between
metallic electrodes, as depicted in Fig.1 (a). The total Hamiltonian of the
system is given by

$\displaystyle H=$ $\displaystyle H_{\text{mol}}+H_{\text{sc}}+H_{\text{T}}$
(1a) $\displaystyle H_{\text{mol}}=$
$\displaystyle\epsilon_{d}n_{d}+Un_{\uparrow}n_{\downarrow}+J_{\text{ex}}\mathbf{s}\cdot\mathbf{S}+H_{\text{S}}$
(1b) $\displaystyle H_{\text{S}}=$ $\displaystyle DS_{z}^{2}$ (1c)
$\displaystyle H_{\text{sc}}=$
$\displaystyle\sum_{k\sigma}\epsilon_{k}c^{\dagger}_{k\sigma}c_{k\sigma}-\Delta_{\text{sc}}\sum_{k}(c^{\dagger}_{k\uparrow}c_{-k\downarrow}+H.c.)$
(1d) $\displaystyle H_{\text{T}}=$
$\displaystyle\sum_{k\sigma}V_{k}(c^{\dagger}_{k\sigma}d_{\sigma}+h.c)$ (1e)

The molecule consists of a single orbital labelled with the on-site energy
$\epsilon_{d}$ and Coulomb repulsion energy $U$,
$n_{\sigma}=d_{\sigma}^{\dagger}d_{\sigma}$ is the number operator for each
spin, $d_{\sigma}^{\dagger}$ is the creation operator for the orbital, and
$n_{d}=n_{\uparrow}+n_{\downarrow}$ is the electron occupation number of the
orbital. The orbital spin ($\mathbf{s}$) and the core spin ($\mathbf{S}$)
interact via exchange interaction ($J_{\text{ex}}$). To describe magnetic
molecules in general, we have included an anisotropy field ($D$) for the core
spin. For simplicity, here we have not included transverse anisotropic term
$E(S_{x}^{2}-S_{y}^{2})$. The electrons in the superconducting substrate are
described by $s$-wave Bardeen-Schreiffer-Cooper (BCS) mean-field Hamiltonian
($H_{\text{sc}}$). The first term of $H_{\text{sc}}$ describe the kinetic
energy part of the free electrons in the substrate. In the absence of
superconductivity, the substrate has a constant density of electron states,
$\rho_{0}=1/2\cal{D}$, within $[-\cal{D},\cal{D}]$ with a bandwidth
$2\cal{D}$. Henceforth, we take $\cal{D}$ as the absolute energy scale of the
system and set it to be $\cal{D}=$1\. We have added a BCS order parameter
$\Delta_{\text{sc}}$, and the temperature dependence of the
$\Delta_{\text{sc}}$ is neglected, as we only discuss the ground state
properties. Here, we have neglected electron-electron interactions in the
substrate. We also fix $\Delta_{\text{sc}}/{\cal D}=2\cdot 10^{-4}$ and $S=2$.

In this work we use NRG theorynrg1 ; nrg2 ; nrg3 ; nrg4 ; nrg5 ; nrg6 ; nrg7 ,
which is an unbiased non-perturbative method that works perfectly at both zero
and finite temperatures. First, we discretize the non-interacting substrate
electrons such that the electrons are described by a finite number of states,
logarithmically separated from each other. Second, we transform this system
into a linear chain which begins with the molecule. The on-site energy of the
linear chain is put to zero for our constant density of electron states bath
electron and the hopping elements decrease exponentially with increasing
distance away from the molecule. We use the NRG discretization parameter
$\Lambda=2.5$ throughout this paper.

The exponential decrease of the energy scale of successive sites in the linear
chain ensures the success of the NRG method for the metallic substrate. For
the superconducting substrate it was initially thought, however, that the
superconducting gap $\Delta_{\text{sc}}$ would cause a problem for the NRG
iteration, since the argument of energy scale separation no longer holds for
large Wilson chains. In other words, the perturbation of adding a site to the
Wilson chain is no longer sufficiently small to allow truncating the NRG
iteration at site $N$ where $\Lambda^{-N/2}$ is comparable to
$\Delta_{\text{sc}}$nrg1 ; nrg2 . It was, nevertheless, pointed out that the
energy scale separation of NRG works even beyond this value of $N$, and that
the perturbations become even smaller with finite $\Delta_{\text{sc}}$nrg5 .
Hence, in the presence of superconductivity, the NRG approximation becomes
even more accurate.

##  III Large $\Delta$ limit

Before discussing the NRG results we consider a simplified version of the
model in Eq. (1), obtained in the limit of large $\Delta$, in order to gain
some understanding of the expected behavior of the many-body YSR bound states.
As is illustrated for the single orbital Anderson model in Refs.Rozhkov ;
Tanaka , the substrate induces superconducting order in the quantum dot when
the superconducting gap is the largest energy scale compared to any other
energy scales of the system. In this limit, the self-energy, due to the bath
electrons, give only finite off-diagonal component in the Bogoliubov-de Gennes
basis for energies much smaller than the superconducting gap. As a result, we
can write an effective Hamiltonian for the system. This procedure can also be
applied to the molecular system and the effective low energy Hamiltonian can
be written as

$\displaystyle
H_{\text{eff}}=\epsilon_{d}n+Un_{\uparrow}n_{\downarrow}+\tilde{\Gamma}\big{(}d_{\uparrow}d_{\downarrow}+h.c\big{)}+J_{\text{ex}}\mathbf{s}\cdot\mathbf{S},$
(2)

where $\tilde{\Gamma}$ is the induced superconducting order in the molecule.

In the absence of the exchange term between the orbital spin and the core
spin, the ground state behavior changes as function of $U$ at
$U/2=\tilde{\Gamma}$. The ground state is a doublet state (the anti-symmetric
combination of $|0\rangle$ and $|\uparrow\downarrow\rangle$) for small $U$ for
the symmetric Anderson impurity model ($\epsilon_{d}=-U/2$), while for large
$U$, the ground state is a singly occupied the state. The transition between
these two state occur at $U=2\tilde{\Gamma}$. The ground state degeneracy also
changes from one to two electrons across this transition, resulting in that
the expectation values of various operators change discontinuously.

The energy difference between the ground and first excited states mimics the
behavior of the YSR bound states when $\Delta_{\text{sc}}$ is comparable to
the other energy scales in the system. Within this effective model, we can see
that the bound state energy first decreases with increasing $U$ and approaches
zero at the transition point, while it increases again after the transition
point, see Fig.1 (b).

In the presence of a finite exchange interaction between the orbital spin and
core spin, the doublet ground state remains unaffected while the degeneracy of
the singly occupied state is lifted. The energy of the singlet states are now
$-U/2+J_{\text{ex}}S/2$ and $-U/2-J_{\text{ex}}(S+1)/2$. In Fig.1 (b), we have
shown the energies of the effective Hamiltonian as function of $U$. The first
excited state is split below a critical energy $U_{c}$, whereas the ground
state splits at larger $U$. Even though there are more states within the gap,
not all states are visible in the single particle spectrum at zero
temperature. This is clear since for $U<U_{c}$ transitions between the single
state to both doublet states are possible, while for $U>U_{c}$ only
transitions from the double state with the lowest energy to the single state
are allowed, given that the temperature is sufficiently low to prevent thermal
excitations of the second double state. The arrows in Fig.1 (b) indicate all
possible transitions. As a result, a single pair of YSR states emerges in the
singlet phase and while two pairs of YSR states should be observed in the
doublet phase. We also observe that $U_{c}$ is shifted towards the lower value
for both positive and negative values of the exchange interaction. This can be
understood from the fact that the exchange interaction always lowers the
energy of the many-body singlet state.

##  IV NRG Results

###  IV.1 Induced Superconductivty

Due to proximity, the superconductor induces a finite pairing potential, or,
supconducting order parameter in the molecular the dot. In Fig.2 we show the
expectation values of the induced order parameter as function of the Coulomb
interaction. First, consider the case of vanishing exchange interaction,
$J_{\text{ex}}=0$ (blue). It can be clearly seen that the largest values of
the order parameter is reached in the non-interacting limit, $U\rightarrow 0$,
and decreases with increasing interaction strength $U$. This can be explained
as an effect of that the doubly occupied (and empty state for the symmetric
Anderson model) state is less favorable for large $U$. Hence, since the BCS
states are a combination of the empty and doubly occupied states, the induced
superconducting order becomes suppressed as the Coulomb interactions become
increasingly influential.

Figure 2: The expectation value of superconducting order of the orbital label
at zero temperature for different values of Coloumb Interaction at fixed
values of the exchange interaction $J_{\text{ex}}/\Delta_{\text{sc}}\leq 0$
(a), $J_{\text{ex}}/\Delta_{\text{sc}}\geq 0$ (b).

A further increase of the Coulomg interaction strength, $U$, leads to that the
superconducting order parameter changes sign at the critical interaction
energy $U_{c}$. At this transition point, the ground state of the molecule
changes from doublet ($U<U_{c}$) to a singlet ($U>U_{c}$) state. The
discontinuity of the induced order parameter at $U=U_{c}$ reflects the change
in the degeneracy of the ground state when it undergoes a transition from
doublet to singlet state. In the context of Josephson junction, this
discontinuity is related to the _so-called_ $0-\pi$ transition. One important
thing to notice is that for Coulomb interactions weaker than the critical
energy $U_{c}$, the induced superconducting order has the same phase as the
substrate, whereas it is phase shifted by $\pi$ in the large $U$ limit. While
the order parameter remains negative for $U>U_{c}$, its magnitude decreases.

Figure 3: Bound state energies (a-e) and their spectral weight (f-j) of the in
gap states for different value of Coulomb Interaction at fixed exchange
interaction $J_{\text{ex}}/\Delta_{\text{sc}}$ = -0.5 (a,f), -0.2 (b,g), 0
(c,h), 0.2 (d,i), 0.5 (e,j). The spectral weight of each states are also color
coded. The dashed line indicate the YSR states for $J_{\text{ex}}=0$.

Next, we include a finite exchange interaction, $J_{\text{ex}}\neq 0$.
Previously, in the bound state analysis of the effective model, Eq. (2), it
was shown that the critical energy $U_{c}$ decreases in the presence of a
finite exchange interaction, irrespective of being ferro and anti-
ferromagnetic. Here, our numerical results corroborate this conclusion, which
can be seen in Fig.2. Specifically, the sign change of the induced
superconducting order parameter shifts to a lower $U$ for increasing
$|J_{\text{ex}}|$. The value of $U_{c}$ reduces much faster in the case of
positive exchange interaction compared to negative value of the exchange
interaction. The core spin ($S$) and the orbital spin ($s=1/2$) have
eigenstates that can be categorized as a triplet and a singlet, with
corresponding energies $J_{\text{ex}}S/2$ and $-J_{\text{ex}}(S+1)/2$,
respectively, in the absence of the substrate. Form this it is evident that
the ground state energy decreases faster when $J_{\text{ex}}$ is positive.
This makes the reduction in $U_{c}$ is larger when $J_{\text{ex}}>0$. Near the
transition point, $U\simeq U_{c}$, the induced superconducting order parameter
is strongly renormalized by the finite exchange interaction. The absolute
value of the order parameter is reduced comared to the case when
$J_{\text{ex}}$ is zero.

###  IV.2 Bound states

The dimensions of the Hilbert space of the Wilson chain increases by a factor
of 4 for each added site. Therefore, we discard higher energy states after a
few iterations to keep the size of the Hamiltonian manageable. The maximum
number of states that we retain is of the order of 5000. After sufficient
number of NRG iterations ($N=40$), we obtain all the pertinent many-body
states. This includes a continuum of states above the superconducting gap and
few states below. The states within the superconducting gap are known as
Andreevandreev , YSR statesYu ; Shiba ; Rusinov , and we shall use the latter
nomenclature for the remainder of this article. In Fig.3 (a) - (e), the YSR
state are plotted as function of the Coulomb energy $U$ of the molecule level,
for various values of the exchange interaction $J_{\text{ex}}$. Here, the on-
site energy of the molecule is $\epsilon_{d}=-U/2$; symmetric Anderson model.
In this case, the single particle spectrum of the system is particle-hole
symmetric. There exists a negative energy YSR state for each positive energy
YSR state; not shown in this figure. By turning off the exchange interaction,
that is, putting $J_{\text{ex}}=0$, the model is reduced to an Anderson model
with a superconducting reservoir. The associated positive energy YSR state for
this case is shown in Fig.3 (c). It can be seen that there is only one bound
state, as expected under degenerate conditions, emerging near the edge of the
superconducting gap for small values of $U$. The doublet state is ground state
and singlet state becomes the first excited state for lower Coulomb energy.
With increasing $U$, the bound state shifts into the gap, coinciding with the
Fermi level ($E_{b}-E_{F}=0$) at the critical energy $U=U_{c}$. The ground
state of the molecule changes from doublet to singlet state at this critical
energy ($U_{c}$). For Coulomb repulsion energies $U>U_{c}$, the bound state
energy shifts away from the Fermi level. At larger $U$, singlet state is the
ground state and doublet state is first excited state. In the metallic system,
Kondo temperature is only energy scale of the system and the ground state is
Kondo singlet state. Whereas in the presence of the superconductivity,
$\Delta_{\text{sc}}$ becomes a second energy scale of the system. The BCS
state of the superconductor and Kondo singlet state compete and giving rise to
a singlet to doublet transition.

In our previous discussion of the effective model, Eq. (2), we argued that a
large superconducting order parameter ($\Delta_{\text{sc}}\rightarrow\infty$)
accompanied by a finite exchange interaction ($J_{\text{ex}}$) splits the
singly occupied states. The result is also valid for finite
$\Delta_{\text{sc}}$, however, slightly modified to involve a lifting of the
$2S+1$-fold degeneracy of the Kondo singlet. The $2S+1$-fold degeneracy
originates from the core spin ($\mathbf{S}$) in the absence of the interaction
between the core spin and the molecular orbital. Due to internal spin
excitations in presence of the exchange iteration, new states emerge within
the superconducting gap, as shown in Fig.3. Due to finite exchange
interaction, there are three low energy states arises (one doublet state and
two singlet states). At zero temperature, one of these states becomes the
ground state and two other state becomes higher energy excited state. These
two higher energy states becomes the two YSR state that appear in the positive
part of spectrum both for positive and negative values of $J_{\text{ex}}$.
These two states arise from the transition doublet state to singlet states,
see Fig.1 (b), or the other way around depending on the values $U$. One of the
bound state energies coincides with the Fermi energy at a critical $U=U_{c}$.
One important thing to notice here is that $U_{c}$ always reduces both for
ferromagnetic and anti-ferromagnetic exchange interaction. The energy of the
second bound state remains finite for all values of $U$. The energy of this
bound state first decreases with $U$, has a minima at $U=U_{c}$, and increases
again for increasing value of $U$. This state appears because of the
transition from doublet state to higher energy singlet state for $U<U_{c}$.
For $U>U_{c}$, however, singlet to singlet transitions give rise to this
state. The energy of this YSR state is indicated as filled and empty hexagon
in Fig.3 (a), (b), (d), (e), respectively. The energy difference between two
singlet states increases with the absolute value of $J_{\text{ex}}$. As a
result, the energy of this YSR state (empty hexagon) steadily increases with
$|J_{\text{ex}}|$ for $U>U_{c}$. With large enough $|J_{\text{ex}}|$ compared
to $\Delta_{\text{sc}}$ this bound state merges with the continuum states
above the superconducting gap.

###  IV.3 Single particle spectrum

Next, we make connection with experiments through a discussion of the single
particle spectrum of the system. This can measured in the experiments, for
instance, using scanning tunneling microscopy. The conductance thus measured
is proportional to the local density of electron states of the single orbital.
In the zero temperature limit, the local density of electron states contain
two contributions, one from the states within the superconducting gap and
other from the states outside the superconducting gap. Formally the local
density of state can be written as
$A(\omega)=A_{1}(|\omega|<\Delta_{\text{sc}})+A_{2}(|\omega|>\Delta_{\text{sc}}),A_{1}(\omega)=\sum_{i}w_{b}^{i}\delta(\omega-
E_{b}^{i})$. In this article we will not discuss the continuam part of
spectrum ($A_{2}$) and we are only interested in the in-gap part of the
spectrum ($A_{1}$). The spectral weights and corresponding energies of these
in-gap states are plotted in Fig.3, for both positive and negative values of
the exchange interaction $J_{\text{ex}}$. Here, the on-site energy of the
orbital is $\epsilon_{d}=-U/2$; the symmetric Anderson model, imposing
particle-hole symmetry in the spectrum such that the bound states with
positive and negative energies have the equal weights. Previously, it has been
shown that the spectral weight is discontinuous at $U=U_{c}$nrgsc2 . Due to
the presence of the exchange interaction, two YSR states with finite weights
arise in the spectrum for $U<U_{c}$, which is consistent with the large
$\Delta_{\text{sc}}$ model (see the arrows in Fig.1 for smaller $U$). The two
bound states arise from transitions between the doublet ground state and the
two singlet states. These two YSR states reduce to one when $J_{\text{ex}}$ is
zero. It can be seen that both weights increase with $U$, and that the weight
of state with the higher energy state drops to zero at $U=U_{c}$; indicated by
empty symbols in Fig.3. The weight of the other state shows a discontinuity at
$U=U_{c}$. The size of the jump at the discontinuity depends on the sign of
the exchange interaction $J_{\text{ex}}$, which is more prominently appearing
for anti-ferromagnetic exchange interaction. To the right of the transition
point, that is, $U>U_{c}$, the spectral weights gradually decrease with
increasing $U$.

We summarize the discussion of the single particle spectrum by noticing, that
below the critical point, $U<U_{c}$, two pairs of YSR states emerge in the
superconducting gap whereas only one pair is observed above, $U>U_{c}$. This
is one important result of this article. In the molecular set-up, it should be
possible to vary the ratio $U/\Gamma$, and we expect that it through such
variations should be possible to observe a transition between two pairs and
one pairs of YSR states.

###  IV.4 Away from particle-hole symmetry

Figure 4: Bound state energies of the molecule for different value of on-site
energy of the orbital away from the particle-hole symmetric point for both
ferromagnetic $J_{\text{ex}}=-0.2$ (a) and anti-ferromagnetic
$J_{\text{ex}}=0.2$ (b) at a fixed $U=0.10$.

Even though the symmetric Anderson model is most often used in the existing
theoretical literature, such a symmetry is most likely not present in a
realistic experimental set-up. Apart from this, it is also possible to
effectively shift the on-site energy by applying a gate voltage to the system.
Thus motivated, we change the on-site energy of the molecular orbital from the
symmetric value, noticing that the particle-hole symmetry is removed for
$\epsilon_{d}\neq-U/2$. Therefore, we cannot expect the positive and negative
half of the spectrum to be symmetric. In Fig.4, we plot the energies and
spectral weights of the YSR bound states both for positive and negative
energies. Here, the Coulomb interaction is fixed at $U=0.10$ while varying the
on-site energy of the orbital for both ferromagnetic Fig.4 (a) and anti-
ferromagnetic Fig.4 (b) exchange interactions. It can be noticed, that for
both ferromagnetic and anti-ferromagnetic exchange interactions, the molecular
ground state remains in the doublet regime for small negative on-site energy,
which leads to the emergence of two pairs of YSR states. While the YSR states
in the doublet phase coincide with the edges of the superconducting gap at
$\epsilon/U=0$, they are shifted inside the gap with increasing
$-\epsilon_{d}/U$, and eventually transition into the singlet phase where only
a single pair of YSR states with finite weight exists. We have chosen Coulomb
interaction in such a way that at the symmetric points ($\epsilon_{d}=-U/2$)
we are in the singlet phase. With further increase of $-\epsilon_{d}/U$, the
system re-enters the doublet phase where two YSR states re-appear. This re-
entrance of the phases can be attributed to the nonlinear behavior of the
doublet ground state energy as a function of on-site energy and can be
understood in terms of the large $\Delta_{\text{sc}}$ effective model. The
energies of effective model, Eq. (2), in the absence of the exchange
interaction are $\epsilon_{d}$ and
$\epsilon_{d}+U/2\pm\sqrt{\tilde{\Gamma}^{2}+(\epsilon_{d}+U/2)^{2}}$. While
the former energy refers to the singlet state, depending linearly on
$\epsilon_{d}$, the latter energies refer to the doublet states, depending
nonlinearly on $\epsilon_{d}$. From this observation, it is evident that the
system is in the doublet phase for small $\epsilon_{d}$ and in the singlet
phase for intermediate values of $\epsilon_{d}$. It is also possible to always
remain in the doublet phase by varying $U$ and $\tilde{\Gamma}$ such that the
ration $U/\tilde{\Gamma}$ remains nearly unchanged.

###  IV.5 Effect of the anisotropy field

Large spin molecules are always subject to more or less strong anisotropic
fields due to spatial structure and the intrinsic spin-orbit coupling of the
substrate. In order to describe a physical molecular systems, we add an
uniaxial anisotropy term to the core spin Hamiltonian, that is,
$H_{\text{S}}=DS_{z}^{2}$. The anisotropy field lifts the degeneracy of the
singlet and doublet states, creating possibilities for the emergence of
additional YSR states inside the superconducting gap. We also notice that
positive (negative) values of the parameter $D$ refers to uniaxial
anisotropies which, respectively, leads to a low (high) spin ground state. In
Fig.5, we plot the evolution of the YSR states for various combinations of the
Coulomb and exchange interactions. We have chosen $U=0.07$ and $0.10$, such
that the ground state is in the doublet and singlet phase, respectively, both
for ferromagnetic and anti-ferromagnetic exchange interactions. In the
presence of exchange interaction and anisotropic field there many more states
appear within the gap. But not all of them have nonzero single particle
spectral weight. The states with zero spectral weight is denoted as empty
circles in the figures.

Figure 5: Bound state energies and the color-coded spectral weights of the
molecule for different value of an anisotropic field for $U=0.07$ (a,b), 0.10
(c,d), $J_{\text{ex}}/\Delta_{\text{sc}}=-0.2$ (a,c), 0.2 (b,d).

First, consider the lower Coulomb interaction, $U=0.07$ Fig.5 (a), (b). For
ferromagnetic interaction, Fig.5 (a), the two YSR states of the doublet phase,
evolve into three distinct YSR states for small negative values of the
anisotropy field $D$. For larger negative values of anisotropy parameter $D$,
however, one of these YSR merges into the edge of the superconducting gap,
while the energies of the two remaining YSR states remain almost constant. On
the other hand, for small positive values of the anisotropy parameter $D$, two
YSR states appear out of which one of merges into the edge of the
superconducting gap as $D$ increases. By contrast, for anti-ferromagnetic
exchange interaction the picture changes, which can be viewed in Fig.5 (b)
($U=0.07$ and $J_{\text{ex}}=0.2$). At this value of $U$, ground state is
still in the doublet phase and in the absence of anisotropic field we see two
YSR state. The higher energy YSR state split into two YSR state for negative
values of $D$ and it reamin as a single YSR state for positive values of $D$.
As it was shown in Fig.5 (b), one of the YSR state merges into the continuam
states above $\Delta_{\text{sc}}$ with increasing value of $|D|$. However the
lower energy YSR state at $D=0$ does not split and energy of it increases and
saturate for larger $|D|$. As a result, two YSR state for negative values of
$D$ and one YSR state are visible in the positive half of the spectrum.

Next we consider the case for larger Coloumb energy at $U=0.10$ in Fig.5 (c),
(d). We are now in the singlet phase and only one YSR state appear with finite
weight at $D=0$. We have shown the evolution of YSR states for negative value
$J_{\text{ex}}$ in the Fig.5 (c). Here, a single YSR state at $D=0$ remains as
a single YSR state for negative values of $D$ while it split into two YSR
states for positive values of $D$. The energy difference between these two
increases with $D$. The YSR states of the molecule for positive value of
exchange interaction ($J_{\text{ex}}/\Delta_{\text{sc}}=0.20$) is shown in
Fig.5 (d). Here, a single YSR state at $D=0$ splits into two YSR states for
both positive and negative values of the anisotropic field.

To summarize the effect of the anisotropic field, we see a huge change in YSR
states. The number of YSR increases due internal spin excitations of the
molecular core spin for small values of the anisotropic field. With larger
values of the anisotropic field some of the YSR state energies move to higher
energies and end up mixed up with the continuum of states above the
superconducting gap. Depending on the various experimental conditions and
spatial structure of the molecule and substrate the actual value of
$U/\Gamma$, $J_{\text{ex}}$, $D$ can be different. As a result the number of
visible YSR state in scanning tunneling microscopy experiment can be different
even for same molecule.

##  V Summary and conclusion

In conclusion, we have considered the properties of YSR states created from a
magnetic molecule absorbed on the surface of an s-wave superconductor. The
molecule is modeled as a single orbital and a core spin, coupled via an
exchange interaction. The competition between the Kondo effect and
superconductivity determines the nature of the many-body ground state and the
excited states of the molecule-superconductor complex. Depending on the ratio
between the energy scales associated with the Kondo effect and
superconductivity, the ground state of the emerging YSR states can be either a
singlet or a doublet. The induced superconducting order parameters on the
molecule shows a discontinuity and changes sign at the singlet-doublet
transition point, related to the different ground degeneracies of the singlet
and doublet states. The exchange interaction is a crucial ingredient of our
system as it lifts the degeneracy of the singlet states. As a result, two
pairs of YSR states appear, in general, however, in the singlet phase only one
of the pairs have finite spectral weight at zero temperature. These results
based on NRG simulations are qualitatively consistent with analytical
predictions made for large $\Delta_{\text{sc}}$ in terms of the effective
model given in Eq. (2).

We, furthermore, studied the effects of the on-site energy in a set-up out-of
the particle-hole symmetry point ($\epsilon_{d}=-U/2$). Here, the Coulomb
interaction is fixed such that the ground state retains the singlet phase with
one pair of YSR states at the particle-hole symmetric point. At a critical
point, the system undergoes a transition into a doublet state ground state as
the on-site single electron energy $\epsilon_{d}$ is either increased or
decreased. One of the YSR states approaches the Fermi energy at the transition
point. This effects is predicted to be measurable in experiments since the on-
site energy can be changed by means of a gate voltage.

Finally, we have investigated the effects of a uniaxial anisotropy field,
acting on the core spin, on the YSR states. Here, both the exchange and
Coulomb energies play crucial roles to determine the number of YSR states. Of
importance to notice, is that for small negative values of $D$, see Fig.5 (a),
(c), the number of YSR states changes from three to one. Hence, keeping the
values of the exchange interaction, $J_{\text{ex}}$, and the anisotropy, $D$,
small and negative value, a continuous variation of $U/\Gamma$ should enable
observation of a change in the number of YSR states. Excitation spectra of
MnPc resolved using scanning tunneling microscopyorbital4  also show similar
changes in the properties of the YSR states. The spectral weights of the
individual YSR states, moreover, show discontinuous changes across the phase
transition. Future studies should involve investigations of finite
temperatures and magnetic field effects the state emerging both inside and
outside the gap.

###### Acknowledgements.

We thank Stiftelsen Olle Engkvist Byggmästare and Vetenskapsrådet for
financial support. The computations were performed on resources provided by
SNIC through Uppsala Multidisciplinary Center for Advanced Computational
Science (UPPMAX) under Project SNIC 2019/8-211. We thank Felix von Oppen and
Katharina J. Franke for useful discussions.

## References

  * (1) G. D. Scott and D. Natelson, ACS Nano 4, 3560 (2010).
  * (2) A. C. Hewson, The Kondo Problem to Heavy Fermions (Cambridge University Press, Cambridge, 1997).
  * (3) P. Coleman, Introduction to Many-Body Physics (Cambridge University Press, Cambridge, 2015).
  * (4) D. Goldhaber-Gordon, H. Shtrikman, D. Mahalu, D. Abusch- Magder, U. Meirav, and M. A. Kastner, Nature (London) 391, 156 (1998).
  * (5) S. M. Cronenwett, T. H. Oosterkamp, and L. P. Kouwenhoven, Science 281, 540 (1998).
  * (6) J. Li, W. D. Schneider, R. Berndt, and B. Delley, Phys. Rev. Lett. 80, 2893 (1998).
  * (7) N. Knorr, M. A. Schneider, L. Diekhöner, P. Wahl, and K. Kern, Phys. Rev. Lett. 88, 096804 (2002).
  * (8) A. F. Otte, M. Ternes, K. von Bergmann, S. Loth, H. Brune, C. P. Lutz, C. F. Hirjibehedin, and A. J. Heinrich, Nat. Phys. 4, 847 (2008).
  * (9) W. Liang, M. P. Shores, M. Bockrath, J. R. Long, and H. Park, Nature (London) 417, 725 (2002).
  * (10) J. Park, A. N. Pasupathy, J. I. Goldsmith, C. Chang, Y. Yaish, J. R. Petta, M. Rinkoski, J. P. Sethna, H. D. Abruña, P. L. McEuen, and D. C. Ralph, Nature (London) 417, 722 (2002).
  * (11) S. Kubatkin, A. Danilov, M. Hjort, J. Cornil, J. L. Brèdas, Ni. Stuhr-Hansen, P. Hedegøard, and T. Bjørnholm, Nature (London) 425, 698 (2003).
  * (12) A. Zhao, Q. Li, L. Chen, H. Xiang, W. Wang, S. Pan, B. Wang, X. Xiao, J. Yang, J. G. Hou, and Q. Zhu, Science 309, 1542 (2005).
  * (13) A. Yazdani, B.A. Jones, C.P. Lutz, M.F. Crommie, D.M. Eigler, Science 275, 5307 (1997).
  * (14) S.-H. Ji, T. Zhang, Y.-S. Fu, X. Chen, X.-C. Ma, J. Li, W.-H. Duan, J.-F. Jia, Q.-K. Xue, Phys. Rev. Lett. 100, 226801 (2008).
  * (15) S.-H.H. Ji, T. Zhang, Y.-S.S. Fu, X. Chen, J.-F.F. Jia, Q.-K.K. Xue, X.-C.C. Ma, Appl. Phys. Lett. 96, 073113 (2010).
  * (16) A. F. Andreev, Sov. Phys. JETP, 19, 1228 (1964).
  * (17) Yu, L, Acta Phys. Sin. 21, 75 (1965).
  * (18) H. Shiba, Prog. Theor. Phys. 40, 435 (1968).
  * (19) A. I. Rusinov, Zh. Eksp. Teor. Fiz. Pisma Red. 9, 146 (1968).
  * (20) M.I. Salkola, A.V. Balatsky, J.R. Schrieffer, Phys. Rev. B 55, 12648 (1997).
  * (21) A. Martın-Rodero, A.L. Yeyati, J. Phys.: Condens. Matter. 24, 385303 (2012).
  * (22) M. Žonda, V. Pokorný, V. Jani, T. Novotný, Sci. Rep. 5, 8821 (2015).
  * (23) M. Žonda, V. Pokorný, V. Jani, T. Novotný, Phys. Rev. B 93, 024523 (2016).
  * (24) H. Shiba, K. Satori, O. Sakai, Y. Shimizu, Physica B 186, 239 (1993).
  * (25) J. Bauer, A. Oguri, A.C. Hewson, J. Phys.: Condens. Matter. 19, 486211 (2007).
  * (26) R. Žitko, Phys. B. Condens. Matter. 536, 203 (2018).
  * (27) N. Hatter, B.W. Heinrich, M. Ruby, J.I. Pascual, K.J. Franke, Nat. Commun. 6, (111) 8988 (2015).
  * (28) M.T. Randeria, B.E. Feldman, I.K. Drozdov, A. Yazdani, Phys. Rev. B 93, 161115(R) (2016).
  * (29) R. Žitko, O. Bodensiek, T. Pruschke, Phys. Rev. B 83, 054512 (2011).
  * (30) C. Sangregorio, T. Ohm, C. Paulsen, R. Sessoli, and D. Gatteschi, Phys. Rev. Lett. 78, 4645 (1997).
  * (31) L. Thomas, F. Lionti, R. Ballou, D. Gatteschi, R. Sessoli, and B. Barbara, Nature London 383, 145 (1996).
  * (32) B. W. Heinrich, J. I. Pascual, K. J. Franke, Progress in Surface Science 93, 1 (2018).
  * (33) D. Jacob, M. Soriano, and J. J. Palacios, Phys. Rev. B 88, 134417 (2013).
  * (34) K. Satori, H. Shiba, O. Sakai, and Y. Shimizu, J. Phys. Soc. Jpn. 61, 3239 (1992).
  * (35) O. Sakai, Y. Shimizu, H. Shiba, and K. Satori, J. Phys. Soc. Jpn. 62, 3181 (1993).
  * (36) J. Bauer, A. Oguri, and A. C. Hewson, J. Phys. Condens. Matter 19, 486211 (2007).
  * (37) R. Bulla, T. Costi, and T. Pruschke, Rev. Mod. Phys. 80, 395 (2008).
  * (38) T. Hecht, A. Weichselbaum, J. von Delft and R. Bulla, J. Phys.: Condens. Matter 20, 275213 (2008).
  * (39) V. Meden, J. Phys. Condens. Matter 31, 163001 (2019).
  * (40) R. Zitko, Proc. SPIE 10732, Spintronics XI, 107321N (2018).
  * (41) A. V. Rozhkov and D. P. Arovas, Phys. Rev. B 62, 6687 (2000).
  * (42) Y. Tanaka, A. Oguri and A.C. Hewson, New J. Phys. 9, 115 (2007).


# Go-and-return phase encoded SR QKD and its security consideration

Vadim Rodimin  1, 2, 3* Andrey Tayduganov  1, 2 Dmitry Kronberg  3,4,5 Yury
Durkin  1,2 Alexey Zharinov  1,2 and Yury Kurochkin1,2,3  1QRate, Skolkovo,
Moscow 143025, Russia
2NTI Center for Quantum Communications, National University of Science and
Technology MISiS, Leninsky prospekt 4, Moscow 119049, Russia
3Russian Quantum Center, Skolkovo, Moscow 143025, Russia
4Steklov Mathematical Institute of Russian Academy of Sciences, Moscow 119991,
Russia
5Institute of Physics and Technology (National Research University),
Institutskii per. 9, 141701 Dolgoprudnyi, Moscow region, Russia
<EMAIL_ADDRESS>
###### Abstract

In this work we study the security of coherent-state quantum key distribution
with a strong reference pulse. The consideration is based on a powerful soft
filtering attack and uses realistic parameters of the equipment. Our model
allows us to relate the secure key generation rate and distance with the
energy of signal and reference pulses. We propose a two-pass quantum key
distribution phase encoding optical scheme with a strong reference pulse. This
simple for realization scheme is experimentally tested showing stable
operation. Here we describe the tuning technique and solution for the problem
of weak signal pulse shadowing by a bright reference pulse with the relative
intensity difference of more than 60 dB between them.

††journal: oe††articletype: Research Article

##  1 Introduction

Quantum key distribution (QKD) is a technology for shared random secret key
generation between two distant parties, usually called Alice (transmitter) and
Bob (receiver). The security of QKD is based on the fundamental laws of
quantum physics what makes the encryption that uses QKD theoretically
absolutely secure. Due to essential breakthroughs in high-speed signal
processing and miniaturization of photoelectric devices in recent decades, QKD
technology significantly advanced. Provably secure commercial QKD systems are
already available on the market. The next breakthrough can be expected with
the development and cheapening of single-photon sources, and with the
appearance of a commercially available high-fidelity quantum memory.

So far, in commercial QKD systems the weak attenuated laser pulses are used
instead of single photons. The presence of multi-photon states in a laser
pulse and losses in quantum channel (QC) allow the eavesdropper (Eve) to carry
out a photon number splitting (PNS) attack [1] and obtain the full (or at
least significant part of) information without being detected. Eve performs a
non-demolition photon number measurement, blocks pulses containing one photon,
and splits all multi-photon pulses, leaving a part in her quantum memory for
subsequent information retrieval after basis reconciliation and delivering the
rest to Bob via lossless channel. If it is required to provide Bob the
expected raw key rate, she can adjust the fraction of blocked single-photon
pulses according to real optical scheme parameters. This QKD attack strategy
is so efficient that the secure key generation via lossy optical fiber using
weak attenuated laser pulses is limited to just a few dozens of kilometers.

Various finesses have been developed to counteract the PNS attack. The most
popular and efficient solution is the decoy state method [2, 3, 4, 5], which
significantly increases the QKD distance and has already become a non-official
standard. However, there is another way to avoid the problem as was proposed
earlier in the original B92 protocol [6] – to send also a bright reference
pulse which must be always detected on Bob’s side. Although inferior to the
decoy state method in terms of maximal distance, it wins in terms of
complexity of key post-processing and technical implementation. Typically, the
information bit in such scheme is encoded in the relative phase between the
weak signal pulse (SP) and the strong reference pulse (SRP). In practice, the
information-carrying dim SP is mixed with high-intensity SRP, forming a common
effective quantum state. Using SRP makes it impossible for Eve to perform the
PNS attack, since being projected onto the Fock basis SP looses its phase
relation with SRP. In this case, Eve loses the ability to block any pulse,
since SRP must always reach Bob.

Nevertheless, Eve still can extract some partial information from multi-photon
pulses. In Ref. [7] the authors studied various protocols, including B92 and
BB84 with SRP (which is equivalent to the 4+2 protocol [8]), resistant against
the PNS attack. By taking the limit of infinite SRP intensity for very large
distances, the authors made a rough estimation of Eve’s information and found
it to be negligible, thus concluding the security of the B92 protocol against
PNS attacks. It was explicitly stressed out that the SRP mean photon number on
Bob’s side has to be significant, and that it is important for Alice to
increase the SRP intensity with distance.

Although with all these arguments the presence of SRP seems to make the
considered protocols secure against the PNS attack, one requires a rigorous
mathematical proof for all types of attacks, deriving a corresponding explicit
secret key rate formula. The first unconditional security proof of the B92
protocol with perfect single-photon source was presented by Tamaki et al. in
Ref. [9] under assumption that Alice’s and Bob’s devices are ideal and the
quantum channel is lossless. Following the idea in Ref. [9], the security was
later proved for lossy and noisy channel but with assumption that Bob has a
perfect detector that discriminates between single-photon and vacuum or multi-
photon states [10]. The B92 version with SRP was considered in Ref. [11],
where the authors made a modification of Bob’s optical scheme by introducing a
second local oscillator, locked to the SRP mode, in order to simplify the
analysis. Avoiding this modification due to its practical implementation
complexity, another proof was made in Ref. [12] in which Bob is supposed to
have two types of detectors: one type can tell whether the photon number is in
a certain interval, and the other type can discriminate among vacuum, single-
photon and multi-photon events. Since that time, according to our knowledge,
there were no new and more general unconditional security studies that could
be applied to existing practical realizations of B92 or BB84 with SRP.

To the best of our knowledge, SR QKD systems have not gone beyond laboratory
demonstrations of capabilities, with the exception of the subcarrier system
[13], which has been brought to the level of practical applications. This
setup uses frequency bit coding [14] varying the sidebands intensity in
different measurement bases and the central frequency carrier plays the role
of SRP. The authors introduce “low intensity reference” and point out that a
hundred photons in SRP are enough to withstand the PNS attack. The absence in
the literature of a unified view on SRP energy prompted us to find an explicit
distance dependence on photon numbers in SRP for secure key generation.

This work is organized as follows. In Sec. 2 we consider the soft filtering
attack instead of PNS, estimate intensity of the SRP for secure key
distribution and the secret key rate that can be achieved. In Sec. 3 present
our optical scheme and experimental results. In Sec. 4 we mention some
unsolved experimental difficulties and discuss the optimal parameter choice
comparing the SRP-based QKD protocols. We summarize the results of our work
and conclude in Sec. 5.

##  2 Secret key rate estimation

###  2.1 Soft filtering attack

Due to the lack of an unconditionally secure key rate formula for the real
setup without any special source/detector assumption, in order to estimate
optimal weak signal and strong reference pulse intensities, in this work we
consider Eve’s attack in the form of quantum soft filtering operation [15,
16], which is a more general version of filtering (see e.g. Ref. [7]). This
unitary operation provides probabilistic information extraction and is an
interpolation between the standard beam-splitting (BS) attack and unambiguous
state discrimination (USD) technique. We consider a scenario when Eve does not
have access to Bob’s device and hence cannot control his detectors or replace
them by ideal ones. Now let us describe the steps of attack.

  1. 1.

Eve intercepts the coherent state $|A\rangle\otimes|\pm\alpha\rangle$,
consisted of SRP ($A$) and SP ($\pm\alpha$), attaches her ancilla and performs
a two-outcome soft filtering on
$|\Psi_{0,1}\rangle=|A\rangle\otimes|\pm\alpha\rangle\otimes|{\rm
ancilla}\rangle$, denoted by a unitary transformation $U$:

$|\Psi_{0,1}^{\rm
filter}\rangle=U|\Psi_{0,1}\rangle=\sqrt{p}\,|A_{s}\rangle\otimes|\pm\alpha_{s}\rangle\otimes|s\rangle+\sqrt{1-p}\,|A_{f}\rangle\otimes|\pm\alpha_{f}\rangle\otimes|f\rangle\,,$
(1)

obtaining either success $|s\rangle$ or fail $|f\rangle$ outcomes ($\langle
s|f\rangle=0$) in her auxiliary system with probabilities $p$ and $1-p$
respectively. Here success(fail) denotes obtaining more(less) distinguishable
non-orthogonal signal states $|\pm\alpha_{s(f)}\rangle$ compared to the
initial $|\pm\alpha\rangle$. The corresponding intensities of the states
before and after filtering are $|A|^{2}=\nu$, $|\alpha|^{2}=\mu$,
$|\alpha_{s}|^{2}=a\mu$ and $|\alpha_{f}|^{2}=b\mu$ with $a>1$, $b<1$.

From the unitarity condition $\langle\Psi_{0}^{\rm filter}|\Psi_{1}^{\rm
filter}\rangle=\langle\Psi_{0}|U^{\dagger}U|\Psi_{1}\rangle=\langle\Psi_{0}|\Psi_{1}\rangle$,
simplified to

$p\langle\alpha_{s}|-\alpha_{s}\rangle+(1-p)\langle\alpha_{f}|-\alpha_{f}\rangle=\langle\alpha|-\alpha\rangle\,,$
(2)

one obtains the following constraint on Eve’s attack parameter space, namely
the success probability $p$ and the amplification/attenuation coefficients
$a/b$:

$p\,e^{-2a\mu}+(1-p)\,e^{-2b\mu}=e^{-2\mu}\,.$ (3)

  2. 2.

In case of success(fail) Eve splits the outcome state and sends
$|B_{s(f)}\rangle\otimes|\pm\beta_{s(f)}\rangle$ to Bob via lossless channel,
storing the remaining part in her quantum memory for future collective
measurement. Apparently, the intensities of sent states have to be
$|B_{s(f)}|<|A_{s(f)}|$, $|\beta_{s(f)}|<|\alpha_{s(f)}|$. To remain
undetected it is very important for Eve to take into account all points of
Bob’s measurement procedure, listed below.

    1. (a)

Bob delays the signal pulse and makes it interfere with a fraction $\mu/\nu$
of the strong pulse. Therefore, in order not to spoil the interference, Eve
must always set

${|\beta_{s(f)}|^{2}\over|B_{s(f)}|^{2}}={\mu\over\nu}\,.$ (4)

Otherwise she will increase Bob’s error rate and hence will be detected.

    2. (b)

Since Bob monitors the intensity of detected SRP, Eve has to adjust $B_{s,f}$
such that $|B_{s,f}|^{2}\in[\nu_{\min}^{\prime},\nu_{\max}^{\prime}]$ with
$\nu_{\rm max(min)}^{\prime}=\nu^{\prime}(1\pm\delta)$, where
$\nu^{\prime}=\nu\times 10^{-0.2L/10}$ is the expected SRP intensity on
receiver’s side, and $\delta$ is determined by precision of Bob’s monitoring
device.

    3. (c)

From both conditions above follows
$|\beta_{s,f}|^{2}\in[\mu_{\min}^{\prime},\mu_{\max}^{\prime}]$ with similarly
defined limits $\mu_{\rm max(min)}^{\prime}=\mu^{\prime}(1\pm\delta)$ and
expected signal intensity $\mu^{\prime}=\mu\times 10^{-0.2L/10}$.

    4. (d)

Eve has to provide the expected raw key rate, determined by Bob’s USD
measurement (for the rate estimation in protocols based on non-orthogonal
states see Appendix A). This gives the following constraint on sent
intensities $|\beta_{s,f}|^{2}$:

$p\big{(}1-e^{-2\eta|\beta_{s}|^{2}}\big{)}+(1-p)\big{(}1-e^{-2\eta|\beta_{f}|^{2}}\big{)}=1-e^{-2\eta\mu^{\prime}}\,,$
(5)

where $\eta$ is the Bob’s detector efficiency.

Note that due to the constraints (3) and (5) the initial five-dimensional
parameter space $\\{p,a,b,|\beta_{s}|,|\beta_{f}|\\}$ is reduced to a three-
dimensional one, e.g. $\\{b,|\beta_{s}|,|\beta_{f}|\\}$.

In principle, if Eve gets more(less) distinguishable states
$|\pm\alpha_{s(f)}\rangle$ after filtering, it is natural for her to send Bob
as stronger(weaker) pulse as possible in order to increase(decrease) his
chance of having a conclusive measurement result. Therefore, in this work we
assume for simplicity $|\beta_{s(f)}|^{2}=\mu_{\max(\min)}^{\prime}$. In this
way we are left with only one free parameter $b$. Study of a more general and
optimal attack scenario we postpone for future publication.

To summarize the described attack, we find the maximum amount of information
that Eve can extract from her states $|\pm\epsilon_{s(f)}\rangle$ of intensity
$|\epsilon_{s(f)}|^{2}=|\alpha_{s(f)}|^{2}-|\beta_{s(f)}|^{2}$ [15]:

$\begin{split}I_{E}&=\max_{b}\bigg{\\{}{p\big{(}1-e^{-2\eta|\beta_{s}|^{2}}\big{)}\chi(|\epsilon_{s}|^{2})+(1-p)\big{(}1-e^{-2\eta|\beta_{f}|^{2}}\big{)}\chi(|\epsilon_{f}|^{2})\over
p\big{(}1-e^{-2\eta|\beta_{s}|^{2}}\big{)}+(1-p)\big{(}1-e^{-2\eta|\beta_{f}|^{2}}\big{)}}\bigg{\\}}\\\
&=\max_{b}\bigg{\\{}{p\big{(}1-e^{-2\eta\mu_{\max}^{\prime}}\big{)}\chi(a\mu-\mu_{\max}^{\prime})+(1-p)\big{(}1-e^{-2\eta\mu_{\min}^{\prime}}\big{)}\chi(b\mu-\mu_{\min}^{\prime})\over
1-e^{-2\eta\mu^{\prime}}}\bigg{\\}}\,.\end{split}$ (6)

where $p$ and $a$ are determined from Eqs. (5) and (3) respectively and are
given in Appendix B; Holevo $\chi$–value and Shannon binary entropy $H$ are
defined as

$\chi(\mu)=H\bigg{(}{1-e^{-2\mu}\over 2}\bigg{)}\,,\quad
H(x)=-x\log_{2}x-(1-x)\log_{2}(1-x)\,.$ (7)

For fixed setup configuration ($L$, $\mu$, $\delta$) Eve adjusts the
attenuation parameter $b$, providing her maximum possible information.

###  2.2 Protocol parameter optimization

The secret key rate is determined by

$R_{\rm sec}=R_{\rm raw}(I_{A:B}-I_{E})\simeq\xi
f(1-e^{-2\eta\mu^{\prime}})\big{[}1-f_{\rm ec}H({\rm QBER})-I_{E}\big{]}\,,$
(8)

where $\xi=1$ for B92 and $\xi=1/2$ for BB84 schemes, $f$ is the pulse
repetition frequency, $f_{\rm ec}\simeq 1.2$ is the typical error correction
efficiency.

Assuming for simplicity that Eve’s contribution to Bob’s quantum bit error
rate (QBER) is negligible, it can be estimated as follows,

${\rm QBER}={p_{\rm dc}+p_{\rm opt}(1-e^{-2\eta\mu^{\prime}})\over 2p_{\rm
dc}+1-e^{-2\eta\mu^{\prime}}}\,,$ (9)

with detector efficiency $\eta=20\%$, dark count (per detector) probability
$p_{\rm dc}=2\times 10^{-5}$ and optical error probability $p_{\rm opt}=2\%$.

The uncertainty of the SRP intensity measurement can be estimated by noise-
equivalent power (NEP) of Bob’s monitoring detector as

$\Delta\nu^{\prime}\simeq{{\rm NEP}\sqrt{\tau}\over E_{\rm photon}}={{\rm
NEP}\sqrt{\tau}\lambda\over hc}\,,$ (10)

with pulse width $\tau=5$ ns, NEP=25 pW$\cdot$Hz-1/2 and $\lambda=1550$ nm.
Defining the relative attenuation $t$ between strong and weak pulses as
$\mu/\nu=10^{-t/10}\ll 1$, one obtains

$\delta={\Delta\nu^{\prime}\over\nu^{\prime}}\simeq{{\rm
NEP}\sqrt{\tau}\lambda\over\mu^{\prime}hc}\times
10^{-t/10}\simeq{1.38\over\mu}\times 10^{4+0.02L-0.1t}\,.$ (11)

Note that $\delta$ depends on $\mu$ with fixed $t$.

In order to determine optimal parameters for our experimental QKD setup, we
present in Fig. 1 two contour plots of $R_{\rm sec}$ as function of signal
intensity $\mu$ and attenuation $t$ for $L=10,50$ km. At each $(\mu,t)$–point
Eve’s information, determined by Eq. (6), is maximized by numerical search for
optimal $b$–value. One can see from the plots that for Alice and Bob the
optimal intensity $\mu_{\rm opt}$ that provides them maximum rate with SRP
monitoring precision $\delta\lesssim 5\%$ is around 0.3(0.1), and $t$ starts
from about 60(70) dB for 10(50) km. For more accurate determination of
$\mu_{\rm opt}$ see the plot on the left in Fig. 2. The plot on the right
demonstrates that starting from some value of attenuation $R_{\rm sec}$
becomes constant, and consequently further increase of $t$ does not improve
the final key rate. Therefore, in our experimental setup we set $t=65$ dB as
universal for $L\lesssim 50$ km.

Figure 1: Contour plot of secure key generation rate as function of signal
pulse intensity $\mu$ and its attenuation $t$ with respect to SRP for optic
line lengths 10 km (left) and 50 km (right). Grey region represents the
parameter space for which the SRP monitoring precision $\delta$, determined by
Eq. (11), is worse than 50% – such measurement can be considered as
unacceptable.

Figure 2: Secure key generation rate as function of signal pulse intensity
$\mu$ (left) and attenuation $t$ with respect to SRP (right). The optimal
intensities $\mu_{\rm opt}$ are determined from maximums of $R_{\rm sec}(\mu)$
in the left plot.

##  3 Experimental realization

###  3.1 Experimental setup

(a)(b)

Figure 3: The fiber-optic go-and-return scheme, consisted of circulators
(CIR0, CIR1), single photon detectors (SPD1, SPD2), variable optical
attenuators (VOA1, VOA2), phase modulators (PM), beam splitters (BS),
photodetector (PD), optical terminator (OT), delay line (DL), polarization
beam splitter (PBS), quantum channel (QC), isolators (iso1, iso2), storage
line (SL), Faraday mirror (FM), polarization controller (PC), and 1550 nm
telecom laser. The polarization-maintaining and single-mode fibers are
represented in blue and yellow colors respectively. For more details and
specifications see the main text.

We took the modular QKD platform for research and education [17, 18] as a
basis for our experimental setup. Component specifications not listed here, as
well as automation of control and data acquisition, are described in [18]. The
two-pass auto compensation plug&play scheme [19] was modified to generate both
SP and SRP (see Fig. 3). The attenuator VOA1 (Exfo FVA600) was placed in one
of the arms of Bob’s interferometer in order to adjust the SP/SRP ratio. Some
of the implementation details, in particular the location of VOA1, we
reproduced from Ref. [20], where a similar two-pass QKD scheme with two pulses
of significantly different intensities was built. Although the scheme in [20]
was designed for continuous variables QKD with a homodyne detection, replacing
the homodyne detector by single photon detectors (SPD) and making several
other modifications, discussed below, makes the optical scheme suitable for SR
QKD.

Due to significant difference between the SP and SRP intensities ($t\gtrsim
60$ dB), any reflections of SRP (e.g. on connectors) can have much larger
intensity than the signal and thus make the signal undetectable. In order to
get rid of such backside reflection and Rayleigh backscattering effects, it is
crucial to avoid the overlap between pulses travelling to Alice and those
already returning back to Bob. The well-known solution for plug&play QKD
schemes with weak pulses is to send pulses in trains and use a storage line
(SL) on Alice’s side. However, the relation between SRP and SP is preserved in
the storage line as well, keeping the same issue with the parasitic back
reflectons, which makes this solution not sufficient enough and hence requires
some additional counter-measure.

To solve this issue we added a bypath on Alice’s side using two single-mode
circulators, denoted in Fig. 3b as CIR1 and CIR2 (Opto-Link OLCIR-I-3-155).
The measured isolation between ports 1 and 3 of the circulators is more than
70 dB. A train of pulses, sent by Bob, passes through CIR1 and then entirely
fits inside the SL. So when the head pulses arrive to the output of CIR1 via
the bypath on the way back after being reflected on the Faraday mirror (FM),
there will be no overlap with the tail of the train, and all background
reflections will be blocked by the isolator iso1. The allowed number of pulses
per train, $N_{\rm p}$, is determined by the SL length: $N_{\rm p}Tc/n_{\rm
fib}\lesssim\ell_{\rm SL}$, with optical fiber refractive index $n_{\rm
fib}=1.47$ and pulse period $T=f^{-1}$. For $\ell_{\rm SL}=10$ km and $f=5$
MHz we obtain $N_{\rm p}\lesssim 245$ pulses. It is important to note that by
introducing the bypath we break the polarization auto-compensation of the
plug&play scheme. Therefore, in order to restore the polarization
transformations in the SL, a polarization controller (PC) has to be used.

Alice prepares quantum states of qubits using phase coding. For this purpose
she randomly chooses 1 of 4 phase shifts $0,\pi,\pi/2,3\pi/2$ between SRP and
SP. This shift is applied on SP using the phase modulator (PM) in the section
between CIR2 and Faraday mirror (FM). Bob chooses qubit measurement basis
applying with PM 0 or $\pi/2$ phase shift on SRP when it passes through the
long arm of Mach-Zehnder interferometer on the way back.

###  3.2 Setup adjustment

The typical value of reflections from FC/PC connectors and some other
extinction parts of optical components is about 20 dB, which is 4-5 orders of
magnitude less than the required SRP and SP difference. This must be taken
into account when preparing the system. Besides usual for QKD synchronization
signals settings, the laser pulses of such a huge difference in the optical
scheme lead to that the following preparatory procedures come to the fore:

  * •

Optical signals reflections reducing from connectors

  * •

SP and SRP pulses isolating in time-scale and by polarization

  * •

Detector time-window minimization, particularly, when using a free-run
detector

Below we describe these refinement procedures.

Because of intensive SRP pulse, many reflections of unclear origin return back
to the detectors, shading the signal. One needs to figure out where the
parasitic reflections come from that superimpose with SP. Then the reflections
may be reduced by cleaning and polishing the connectors, replacing the FC/PC
connectors with APC ones, or even fusion splicing of fibers.

In order to understand the origin of various reflected signals, we simulated
reflections in our optical scheme [21]. The simulation demonstrated that the
most critical parasitic reflections originate from the connectors on Alice’s
side between CIR2 and FM. A replacement of FC/PC by APC connectors in this
section provided a sufficient purification of the signal.

When the polarization controller is not adjusted to restore polarization
changes, all pulses return from Alice to Bob’s PBS in an arbitrary state of
polarization. Therefore, SRP has a nonzero projection onto the polarization
state which corresponds to the short unattenuated interferometer arm. As a
result, some fraction of SRP with corresponding polarization component passes
through PBS and arrives at BS via the short arm ahead of schedule, i.e. when
there is no pulse coming from the other arm to interfere with. On the
reflectogram in Fig. 4, obtained by detection window scanning, one can see
that the outstripping pulse forms a peak before the signal one, according to
the arm length difference (21 m in our case). Thus, the PC state is tuned to
minimize the outstripping peak intensity, in this way making the pulses enter
the correct arms of the interferometer and as a result providing the maximum
QKD rate.

Figure 4: Alice polarization controller can be tuned by minimizing the signal
measured in an advance time-window, corresponding to difference between the
arms of the interferometer.

For weak coherent pulses detection in the interferometric scheme, the four-
channel free-run superconducting nanowire single-photon detector (SNSPD)
Scontel FCOPRS-CCR-TW-60/0.01 was used. To reduce the noise acquisition, each
SNSPD click from a laser pulse of width 3 ns is recorded within a short 5 ns
time window. Beyond these periodic detection time windows the free-run
detector clicks as well, but these clicks are not recorded to memory. For
noise reduction, it is important to make the registration slot as short as
possible. However, the signal front jitter of the SNSPD we used appeared to be
comparable with our 5 ns window. Therefore, a comparator with essentially
lower jitter was constructed and put in one channel of the SNSPD to digitize
the analog signal. The key generation results described below are obtained
using one SNSPD channel, randomly applying four phase shifts with Bob’s PM;
this in turn leads to two-times lower QKD rate.

In order to evaluate optical and noise characteristics of the scheme adjusted
with 65 dB between SP and SRP, we measured the interference curves – the
number of detector counts as function of the SP/SRP phase shift at different
laser intensities (see Fig. 5). One can see that with increasing the SP
intensity not only maximums but also minimums rise as well. This noise
increase leads to a bad visibility of the scheme making it unacceptable for
QKD. Below we set out the most essential reason leading to this.

Figure 5: Interference curves at various signal brightness: the number of
detection clicks as function of the phase shift in the long arm of Bob’s
interferometer.

Upon photon absorption by a superconducting nanowire of SNSPD, the detector
enters a state characterized by formation of a non-superconducting domain. The
voltage drop across the nanowire is about 1 mV. The transition back to the
working state is associated with the absorption of heat released on the
nanowire and is about several nanoseconds. As the pulse energy increases, it
takes more time to absorb this energy and return the detector back to the
working state from the metastable one. On the oscillogram, this looks like a
noisy tail formation after the front of SNSPD response signal [22]. In our
case, the presence of outstripping parasitic pulse in 21 meters before the
working signal encounters the effect of free-run SNSPD detector blinding. If
the outstripping pulse is bright enough, noisy tail after it gives rise to a
trail of false detections, which, as the brightness of the pulses increases,
reaches the signal pulse, Fig. 6. With an increase in the SRP/SP ratio it is
necessary to adjust the polarization compensation on the PC more and more
precisely in order to reduce the outstripping parasitic pulse. But even with
an ideal setting, starting from a certain SRP/SP ratio, it is not possible to
suppress the outstripping pulse, since the typical value of the PBS extinction
is about 23 dB; for SRP/SP 60 dB the intensity of the outstripping pulse is
much higher than the signal one. Thus, intensity increasing of the laser
pulses leads not only to the stray lighting of the whole line, but due to the
detectors blinding, gives rise to the QBER increase.

Figure 6: SNSPD blinding with the laser pulse brightness increase. A tail of
the false clicks is formed after the outstripping parasitic pulse. The signal
becomes difficult to distinguish when the tail reaches the signal pulse.
Signal scanning was performed within the 200 ns window with a step of 5 ns.

###  3.3 Scheme operability check results

For confirming the operability of the scheme, there is no difference which
protocol, B92 or BB84 with SRP, to use. We choose BB84 since both the software
and the firmware have already been prepared and tested for this protocol. With
the plug&play scheme modification and tuning as described above, the results
of the key generation are presented in Fig. 7. We choose the SRP as bright as
possible, avoiding the SNSPD blinding. The QBER of 1.5–2% is characteristic
for the contrast of our fiber optic scheme with Mach-Zehnder interferometer.
We use the 1 km long quantum channel. The SNSPD efficiency is set to be 25%
with about 100 Hz of dark count rate, caused by ambient light as well. As the
SP energy decreases, the detector dark counts prevail. Herewith, the QBER
starts to grow and the visibility decreases. An acceptable relative difference
between SRP and SP of $t=65$ dB was obtained with $\mu=0.005$ photons per SP.
This value would have been increased up to the required optimal level
$\mu=\mathcal{O}(0.1)$ if a gated SPD was used. In this way, the blinding
effect could be avoided.

Figure 7: Results of experimental key generation in a two-pass scheme using
the BB84 protocol with a reference pulse.

##  4 Discussion

As stated above, for the SR QKD security, the SRP must be reliably detected on
Bob’s side. In the developed scheme, this is done using a photodetector,
denoted as PD in Fig. 3a. Most of the SRP power goes to the PD when the train
comes back. In our case, the accuracy of the SRP control $\delta$ becomes a
key part of the security consideration, determining the relative ratio between
the SRP and SP intensities $t$ and the maximum QKD distance. In direct
photodetection of a weak optical signal, the main noise source is the thermal
noise [23]. To fairly introduce it in our theoretical model, we use the
typical NEP value of high-quality photodetectors available on the market.

To deprive Eve of the opportunity to amplify the SP on the way from Bob to
Alice, it is necessary to control the SP on Alice’s side. This is fraught with
technical difficulties; in this work, we have not made a technical
implementation of this solution. The problem is that the SP intensity coming
to Alice should be high enough for measurement, while the laser power should
be enough to generate the SRP. We can assume that Eve does not amplify the SP
if we do not distinguish it against the background of the photodiode thermal
noise while making the intensity of SP equal to the intensity of the thermal
noise. Estimated at a load resistance of $50\,\Omega$ and room temperature,
the sensitivity limit of direct photodetection against background of thermal
noise corresponds to the laser pulse energy of $10^{3}$ photons. Then, with
$t=60$ dB and the quantum channel length $L=20$ km, the peak laser power
should be about 150 mW. This is quite achievable, the DFB Diode Lasers on the
market have a peak power of several times more. We see also other solutions to
the SP control problem, namely the use of other powerful lasers, EDFA, multi-
pixel avalanche photodetector, SP+SRP homodyning. But these solutions lead to
higher costs and/or complications of equipment.

In terms of technical implementation, the realized SR BB84 scheme does not
differ much from the B92 protocol with SRP. As for the raw key rates, there is
factor two reduction for BB84 due to the basis reconciliation. Therefore, from
practical point of view, it seems not reasonable to use the four-state BB84
scheme. In Fig. 8 we compare the secret key generation rates for the SR B92
protocol (given by Eq. (8)) and classic BB84 with and without decoy states
(see Appendix C). One can see from the plot that for the short distances up to
60 km the SR B92 has a higher key rate, making it more advantageous even with
respect to the decoy-state method. However, as it was mentioned in the
introduction, it lacks the rigorous unconditional security proof. One can also
mention that for $\mu=\mathcal{O}(0.1)$ the optical error contribution to QBER
(the term proportional to $p_{\rm opt}$ in Eq. (9)) is practically constant
and is dominant for short and mid-range distances, while at long distances the
dark count contribution becomes crucial. Therefore, even with perfect single-
photon detectors there is a lower bound on QBER due to imperfect visibility of
optical scheme.

Figure 8: Distance dependence of secure key generation rate. Solid, dotted and
dashed lines represent B92 with SRP, standard BB84 and decoy-state BB84
protocols respectively. For the decoy-state protocol we fix
$\nu_{2}:\nu_{1}:\mu=1:25:100$ and $p_{\mu}=0.5$.

##  5 Conclusion

Here we have presented the theoretical consideration of SR QKD security based
on the properties of realistic photon detectors. For the given setup
parameters the optimal photons number values in SP were found to be from 0.15
for 50 km to 0.35 for 10 km at 65 dB between SRP and SP. It was demonstrated
that secure key generation is possible only with a bright SRP starting from
$4\times 10^{4}$ photons per pulse at 10 km and more than $5\times 10^{5}$
photons per pulse are needed to maximize the secure key generation rate at 50
km. Our study shows that SR QKD has advantages for short distances. At 20 km,
the B92 with SR protocol has more than four times higher generation speed
compared to the decoy-state BB84 protocol, while at 60 km, their rates become
equal.

We have to emphasize that the above consideration of the security of SR QKD is
not a strict unconditional security proof. Our approach relies on particular
Eve’s attack using the soft filtering operation which is very effective but
might be not the ultimate attack on SR QKD. We use the characteristics of
realistic equipment available in our laboratory to parametrize the formula for
the secret key generation rate. In that sense, the obtained results may be
regarded as a somewhat pessimistic estimate, since for theoretical
calculations one can use the best attainable characteristics of the equipment.

We have developed the go&return optical scheme which allows forming laser
pulse trains for SR QKD. This scheme was tested by running the sifted key
generation, demonstrating the technical feasibility of a 65 dB difference
between SP and SRP. The effect of blinding of the free-run SNSPD we used did
not allow us to reach a bigger SRP/SP difference, as well as to generate more
than 0.005 photons in SP at 65 dB. We believe that using of a gated detector
will solve this issue. Mostly, the scheme setup is identical to the well-
researched and commercially available plug&play scheme. The frequency of the
polarization correction is related to the thermal stability of the segment
responsible for the polarization distortion, mainly the storage line. In our
experience, the characteristic drift time of polarization, even in field
conditions, might be minutes per tens of kilometers.

When developing the optical scheme, one of our motivations was to find and
test a practical implementation for CV QKD. We plan to adopt this scheme for
homodyning Gaussian-modulated coherent states.

## Acknowledgments

This work is supported by the Russian Science Foundation under project
17-71-20146.

## Disclosures

The authors declare no conflicts of interest.

## Data availability

Data underlying the results presented in this paper are not publicly available
at this time but may be obtained from the authors upon reasonable request.

##  Appendix A Non-orthogonal state discrimination

In the B92 protocol Alice sends two non-orthogonal states, $|\psi_{0}\rangle$
and $|\psi_{1}\rangle$, where $|\langle\psi_{0}|\psi_{1}\rangle|=\cos\gamma$
($0<\gamma<\pi/2$) is the main parameter of the protocol. Bob on his side
performs a three-outcome measurement, described by a positive-operator-valued
measure (POVM) [24] (for the first studies of non-orthogonal state
discrimination see [25, 26, 27]),

$\begin{split}M_{0}&={|\psi_{1}^{\perp}\rangle\langle\psi_{1}^{\perp}|\over
1+\cos\gamma}={\mathbb{1}-|\psi_{1}\rangle\langle\psi_{1}|\over
1+\cos\gamma}\,,\\\
M_{1}&={|\psi_{0}^{\perp}\rangle\langle\psi_{0}^{\perp}|\over
1+\cos\gamma}={\mathbb{1}-|\psi_{0}\rangle\langle\psi_{0}|\over
1+\cos\gamma}\,,\\\ M_{?}&=\mathbb{1}-M_{0}-M_{1}\,,\end{split}$ (12)

where $M_{0(1)}$ gives a conclusive 0(1)–bit measurement result, while $M_{?}$
denotes an inconclusive result that does not provide any knowledge about the
encoded bit. If Alice sends a state $|\psi_{i}\rangle$, the corresponding
$X$–outcome probability is determined as $p_{X|i}={\rm
Tr}(M_{X}|\psi_{i}\rangle\langle\psi_{i}|)=\langle\psi_{i}|M_{X}|\psi_{i}\rangle$.
One can easily verify that
$\langle\psi_{1}|M_{0}|\psi_{1}\rangle=\langle\psi_{0}|M_{1}|\psi_{0}\rangle=0$,
i.e. applying $M_{0}$ to measure $|\psi_{1}\rangle$ there is no chance to
obtain the outcome “0” and vice versa. The inconclusive result probability is
given by

$p_{?}=\langle\psi_{0}|M_{?}|\psi_{0}\rangle=\langle\psi_{1}|M_{?}|\psi_{1}\rangle=\cos\gamma\,.$
(13)

and the probability of a conclusive result is

$p_{\rm ok}={1\over 2}\langle\psi_{0}|M_{0}|\psi_{0}\rangle+{1\over
2}\langle\psi_{1}|M_{1}|\psi_{1}\rangle=1-p_{?}=1-\cos\gamma\,.$ (14)

Now let us consider two particular non-orthogonal states,
$|\psi_{0}\rangle=|\alpha\rangle$ and $|\psi_{1}\rangle=|-\alpha\rangle$ with
$|\alpha|^{2}=\mu$. Writing these coherent states as

$|\pm\alpha\rangle=e^{-\mu/2}\sum_{n=0}^{\infty}{(\pm\alpha)^{n}\over\sqrt{n!}}|n\rangle\,,$
(15)

one finds the overlap between these states,

$\cos\gamma=\langle\alpha|-\alpha\rangle=e^{-\mu}\sum_{n,m=0}^{\infty}{\alpha^{*n}\over\sqrt{n!}}{(-\alpha)^{m}\over\sqrt{m!}}\langle
n|m\rangle=e^{-2\mu}\,.$ (16)

Note that the equations above are valid only for the limit case of lossless
channel and ideal Bob’s detector. So taking into account the optical losses
and detector’s efficiency, the realistic bit acceptance rate is

$p_{\rm ok}=1-e^{-2\eta\mu^{\prime}}\,,$ (17)

where $\mu^{\prime}$ is the expected signal intensity on Bob’s side.
Neglecting dark counts, the raw key rate can be estimated as $R_{\rm
raw}\simeq fp_{\rm ok}$, where $f$ is the laser pulse repetition frequency.

In the 4+2 protocol [8] the basic ideas of BB84 and B92 are combined: Alice
randomly chooses a basis and a non-orthogonal state in this basis,
$\\{|\psi_{0}^{z}\rangle,|\psi_{1}^{z}\rangle\\}$ and
$\\{|\psi_{0}^{x}\rangle,|\psi_{1}^{x}\rangle\\}$, with overlap parameter
$|\langle\psi_{0}^{z}|\psi_{1}^{z}\rangle|=|\langle\psi_{0}^{x}|\psi_{1}^{x}\rangle|=\cos\gamma$.
For instance, one can use laser pulses with $\\{0,\pi\\}$ and
$\\{\pi/2,3\pi/2\\}$ phase shifts for $z$\- and $x$-basis respectively:
$|\psi_{0,1}^{z}\rangle=|\pm\alpha\rangle$, $|\psi_{0,1}^{x}\rangle=|\pm
i\alpha\rangle$. Bob in turn randomly performs one of POVMs to distinguish the
states in each set. Due to the basis reconciliation the acceptance rate of
conclusive measurements (17) has to be multiplied by 1/2 for the 4+2 protocol.

##  Appendix B Soft filtering parameter constraints

Assuming
$|\beta_{s(f)}|^{2}=\mu_{\max(\min)}^{\prime}=\mu^{\prime}(1\pm\delta)$, the
success probability $p$ and the amplification parameter $a$ are determined
from Eqs. (5) and (3) respectively:

$p={e^{-2\eta\mu_{\min}}-e^{-2\eta\mu^{\prime}}\over
e^{-2\eta\mu_{\min}}-e^{-2\eta\mu_{\max}}}={1\over
1+e^{-2\eta\mu^{\prime}\delta}}\,,$ (18) $a=-{1\over
2\mu}\ln\bigg{[}{e^{-2\mu}-(1-p)e^{-2b\mu}\over
p}\bigg{]}=1-{\ln\big{[}1-e^{-2\eta\mu^{\prime}\delta}\big{(}e^{2\mu(1-b)}-1\big{)}\big{]}\over
2\mu}\,.$ (19)

One can easily verify that for

$1-{\ln\big{[}1+e^{2\eta\mu^{\prime}\delta}\big{]}\over 2\mu}<b<1\,,$ (20)

the argument of logarithm in Eq. (19) is always positive and smaller than 1,
and hence $a>1$ as required by the unitarity condition (3). Combining the
constraint $|\beta_{f}|<|\alpha_{f}|$ and Eq. (20), one obtains the
generalized lower bound,

$b>b_{\min}={\max}\bigg{\\{}1-{\ln\big{[}1+e^{2\eta\mu^{\prime}\delta}\big{]}\over
2\mu}\,,~{}(1-\delta)\times 10^{-0.2L/10}\bigg{\\}}\,.$ (21)

For the limit case $|\beta_{s}|^{2}=\mu_{\max}^{\prime}$, one has to take into
account the $|\beta_{s}|^{2}<a\mu$ constraint as well. As a result, using Eq.
(19), one gets the upper bound

$b<b_{\max}=\min\bigg{\\{}1-{\ln\big{[}1-e^{2\eta\mu^{\prime}\delta}\big{(}e^{2\mu-2\mu^{\prime}(1+\delta)}-1\big{)}]\over
2\mu},\,1\bigg{\\}}\,.$ (22)

One can see that if $\mu>\mu^{\prime}(1+\delta)$, i.e.
$L>50\log_{10}(1+\delta)$, the logarithm in (22) turns out to be negative, and
hence $b_{\max}=1$ must be used due to unitarity condition.

##  Appendix C BB84

The secret key generation rate is given by GLLP [28] formula, rewritten as [4]

$R_{\rm sec}={1\over 2}f\big{\\{}Q_{1}\big{[}1-H(E_{1})\big{]}-Q_{\mu}f_{\rm
ec}H(E_{\mu})\big{\\}},$ (23)

where $Q_{1}$ and $Q_{\mu}$ are the single-photon and overall gains with
corresponding error rates $E_{1}$ and $E_{\mu}$ respectively (for definition
see Refs. [4, 5]). In particular, with no eavesdropping $Q_{\mu}$ and
$E_{\mu}$ can be modelled as

$Q_{\mu}=\sum_{n=0}^{\infty}Q_{n}=\sum_{n=0}^{\infty}{\mu^{n}\over
n!}e^{-\mu}\big{[}Y_{0}+1-\big{(}1-\eta\times
10^{-0.2L/10}\big{)}^{n}\big{]}=Y_{0}+1-e^{-\eta\mu^{\prime}}\,,$ (24)
$E_{\mu}={1\over Q_{\mu}}\sum_{n=0}^{\infty}E_{n}Q_{n}={{1\over 2}Y_{0}+p_{\rm
opt}(1-e^{-\eta\mu^{\prime}})\over Y_{0}+1-e^{-\eta\mu^{\prime}}}\,,$ (25)

where $Y_{0}=2p_{\rm dc}$ is the dark count yield. For simplicity we neglect
the effect of afterpulses, stray light and other potential background
contributions.

In the standard BB84 without decoy states $Q_{1}$ and $E_{1}$ cannot be
determined experimentally, only $Q_{\mu}$ and $E_{\mu}$ can. Therefore, in
order to estimate them we consider the following optimal PNS attack: Eve
blocks significant fraction of single-photon pulses and splits all multi-
photon pulses, leaving one photon in her quantum memory and forwarding the
rest to Bob via lossless channel. To be more realistic, we assume that Eve
cannot break in Bob’s device and control/replace photon detectors. For this
scenario we get the following estimation of the lower bound on $Q_{1}$ and the
upper bound on $E_{1}$:

$Q_{1}^{l}=Q_{\mu}-\sum_{n=2}^{\infty}{\mu^{n}\over
n!}e^{-\mu}\big{[}1-(1-\eta)^{n-1}\big{]}=Q_{\mu}-1+{e^{-\eta\mu}-\eta
e^{-\mu}\over 1-\eta}\,,$ (26) $E_{1}^{u}={Q_{\mu}E_{\mu}\over Q_{1}^{l}}\,,$
(27)

giving the lower bound on the secret key rate,

$R_{\rm sec}^{l}={1\over 2}f\big{\\{}Q_{1}^{l}[1-H(E_{1}^{u})]-Q_{\mu}f_{\rm
ec}H(E_{\mu})\big{\\}}\,.$ (28)

One of the advantages of the decoy-state method is that it allows to determine
the lower bounds on background and signal single-photon yields and the upper
bound on $E_{1}$ directly from experiment [5]:

$Y_{0}^{l}={\max}\bigg{\\{}{\nu_{1}Q_{\nu_{2}}e^{\nu_{2}}-\nu_{2}Q_{\nu_{1}}e^{\nu_{1}}\over\nu_{1}-\nu_{2}}\,,0\bigg{\\}}\,,$
(29)
$Q_{1}^{l}={\mu^{2}\,e^{-\mu}\over(\nu_{1}-\nu_{2})(\mu-\nu_{1}-\nu_{2})}\bigg{[}Q_{\nu_{1}}e^{\nu_{1}}-Q_{\nu_{2}}e^{\nu_{2}}-{\nu_{1}^{2}-\nu_{2}^{2}\over\mu^{2}}(Q_{\mu}e^{\mu}-Y_{0}^{l})\bigg{]}\,,$
(30)
$E_{1}^{u}={(E_{\nu_{1}}Q_{\nu_{1}}e^{\nu_{1}}-E_{\nu_{2}}Q_{\nu_{2}}e^{\nu_{2}})\mu\,e^{-\mu}\over(\nu_{1}-\nu_{2})Q_{1}^{l}}\,,$
(31)

where $\mu$, $\nu_{1}$ and $\nu_{2}$ are the signal, weak decoy and vacuum
decoy state intensities respectively. Since the state type is chosen randomly
with corresponding probability, the key rate (28) must be multiplied by
additional factor $p_{\mu}$. For illustration, we fix
$\nu_{2}:\nu_{1}:\mu=1:25:100$ and $p_{\mu}=2p_{\nu_{1,2}}=0.5$. Further
parameter optimization and taking into account statistical fluctuations are
beyond this work.

## References

  * [1] G. Brassard, N. Lütkenhaus, T. Mor, and B. C. Sanders, “Limitations on practical quantum cryptography,” Phys. Rev. Lett. 85, 1330–1333 (2000).
  * [2] W.-Y. Hwang, “Quantum key distribution with high loss: Toward global secure communication,” Phys. Rev. Lett. 91 (2003).
  * [3] X.-B. Wang, “Beating the photon-number-splitting attack in practical quantum cryptography,” Phys. Rev. Lett. 94 (2005).
  * [4] H.-K. Lo, X. Ma, and K. Chen, “Decoy state quantum key distribution,” Phys. Rev. Lett. 94, 230504 (2005).
  * [5] X. Ma, B. Qi, Y. Zhao, and H.-K. Lo, “Practical decoy state for quantum key distribution,” Phys. Rev. A 72, 012326 (2005).
  * [6] C. H. Bennett, “Quantum cryptography using any two nonorthogonal states,” Phys. Rev. Lett. 68, 3121–3124 (1992).
  * [7] A. Acín, N. Gisin, and V. Scarani, “Coherent-pulse implementations of quantum cryptography protocols resistant to photon-number-splitting attacks,” Phys. Rev. A 69, 012309 (2004).
  * [8] B. Huttner, N. Imoto, N. Gisin, and T. Mor, “Quantum cryptography with coherent states,” Phys. Rev. A 51, 1863–1869 (1995).
  * [9] K. Tamaki, M. Koashi, and N. Imoto, “Unconditionally secure key distribution based on two nonorthogonal states,” Phys. Rev. Lett. 90, 167904 (2003).
  * [10] K. Tamaki and N. Lütkenhaus, “Unconditional security of the bennett 1992 quantum key-distribution protocol over a lossy and noisy channel,” Phys. Rev. A 69, 032316 (2004).
  * [11] M. Koashi, “Unconditional security of coherent-state quantum key distribution with a strong phase-reference pulse,” Phys. Rev. Lett. 93, 120501 (2004).
  * [12] K. Tamaki, N. Lütkenhaus, M. Koashi, and J. Batuwantudawe, “Unconditional security of the bennett 1992 quantum-key-distribution scheme with a strong reference pulse,” Phys. Rev. A 80, 032302 (2009).
  * [13] A. V. Gleim, V. I. Egorov, Y. V. Nazarov, S. V. Smirnov, V. V. Chistyakov, O. I. Bannik, A. A. Anisimov, S. M. Kynev, A. E. Ivanova, R. J. Collins, S. A. Kozlov, and G. S. Buller, “Secure polarization-independent subcarrier quantum key distribution in optical fiber channel using BB84 protocol with a strong reference,” Optics Express 24, 2619–2633 (2016).
  * [14] M. Bloch, S. W. McLaughlin, J.-M. Merolla, and F. Patois, “Frequency-coded quantum key distribution,” Optics Letters 32, 301–303 (2007).
  * [15] D. Kronberg and Y. Kurochkin, “Role of intensity fluctuations in quantum cryptography with coherent states,” Quantum Electronics 48, 843–848 (2018).
  * [16] D. Kronberg, A. Nikolaeva, Y. Kurochkin, and A. Fedorov, “Quantum soft filtering for the improved security analysis of the coherent one-way quantum-key-distribution protocol,” Phys. Rev. A 101, 032334 (2020).
  * [17] V. E. Rodimin, E. O. Kiktenko, V. V. Usova, M. Y. Ponomarev, T. V. Kazieva, A. V. Miller, A. S. Sokolov, A. A. Kanapin, A. V. Losev, A. S. Trushechkin, M. N. Anufriev, N. O. Pozhar, V. L. Kurochkin, Y. V. Kurochkin, and A. K. Fedorov, “Modular Quantum Key Distribution Setup for Research and Development Applications,” Journal of Russian Laser Research 40, 221–229 (2019).
  * [18] V. Rodimin, M. Ponomarev, T. Kazieva, V. Sharoglazova, E. Krivoshin, and Y. Kurochkin, “Modular Platform for Photonic Optical Experiments and Quantum Cryptography,” in _2019 International Siberian Conference on Control and Communications (SIBCON),_ (IEEE, 2019), pp. 1–3.
  * [19] D. Stucki, N. Gisin, O. Guinnard, G. Ribordy, and H. Zbinden, “Quantum key distribution over 67 km with a plug&play system,” New Journal of Physics 4, 341 (2002).
  * [20] M. Legré, H. Zbinden, and N. Gisin, “Implementation of continuous variable quantum cryptography in optical fibres using a go-&-return configuration,” Quantum Information & Computation 6, 326–335 (2006).
  * [21] V. Rodimin and A. Bendersky, “Fiber-reflections: reflected fiber-optics signals simulation,” (2020). [retrieved 01 Febrary 2021], https://github.com/VadimRodimin/fiber-reflections.
  * [22] M. Elezov, R. Ozhegov, G. Goltsman, and V. Makarov, “Countermeasure against bright-light attack on superconducting nanowire single-photon detector in quantum key distribution,” Optics Express 27, 30979–30988 (2019).
  * [23] R. Hui, _Introduction to fiber-optic communications_ (Academic Press, 2019).
  * [24] A. Peres, _Quantum Theory: Concepts and Methods_ (Kluwer Academic Publishers, 1993).
  * [25] I. Ivanovic, “How to differentiate between non-orthogonal states,” Phys. Lett. A 123, 257–259 (1987).
  * [26] A. Peres, “How to differentiate between non-orthogonal states,” Phys. Lett. A 128, 19 (1988).
  * [27] D. Dieks, “Overlap and distinguishability of quantum states,” Phys. Lett. A 126, 303–306 (1988).
  * [28] D. Gottesman, H.-K. Lo, N. Lüttkenhaus, and J. Preskill, “Security of quantum key distribution with imperfect devices,” Quant. Inf. Comput. 4, 325–360 (2004).