# Efficient source-independent quantum conference key agreement

Yu Bao  National Laboratory of Solid State Microstructures and School of
Physics, Collaborative Innovation Center of Advanced Microstructures, Nanjing
University, Nanjing 210093, China  Department of Physics and Beijing Key
Laboratory of Opto-Electronic Functional Materials and Micro-Nano Devices, Key
Laboratory of Quantum State Construction and Manipulation (Ministry of
Education), Renmin University of China, Beijing 100872, China  Yi-Ran Xiao
National Laboratory of Solid State Microstructures and School of Physics,
Collaborative Innovation Center of Advanced Microstructures, Nanjing
University, Nanjing 210093, China  Department of Physics and Beijing Key
Laboratory of Opto-Electronic Functional Materials and Micro-Nano Devices, Key
Laboratory of Quantum State Construction and Manipulation (Ministry of
Education), Renmin University of China, Beijing 100872, China  Yu-Chen Song
Big Data Center, Ministry of Emergency Management, Beijing 100013, China
Xiao-Yu Cao  National Laboratory of Solid State Microstructures and School of
Physics, Collaborative Innovation Center of Advanced Microstructures, Nanjing
University, Nanjing 210093, China  Department of Physics and Beijing Key
Laboratory of Opto-Electronic Functional Materials and Micro-Nano Devices, Key
Laboratory of Quantum State Construction and Manipulation (Ministry of
Education), Renmin University of China, Beijing 100872, China  Yao Fu  Beijing
National Laboratory for Condensed Matter Physics and Institute of Physics,
Chinese Academy of Sciences, Beijing 100190, China  Hua-Lei Yin
<EMAIL_ADDRESS>Department of Physics and Beijing Key Laboratory of Opto-
Electronic Functional Materials and Micro-Nano Devices, Key Laboratory of
Quantum State Construction and Manipulation (Ministry of Education), Renmin
University of China, Beijing 100872, China  Beijing Academy of Quantum
Information Sciences, Beijing 100193, China  Yunnan Key Laboratory for Quantum
Information, Yunnan University, Kunming 650091, China  Zeng-Bing Chen
National Laboratory of Solid State Microstructures and School of Physics,
Collaborative Innovation Center of Advanced Microstructures, Nanjing
University, Nanjing 210093, China

###### Abstract

Quantum conference key agreement (QCKA) enables the unconditional secure
distribution of conference keys among multiple participants. Due to challenges
in high-fidelity preparation and long-distance distribution of multi-photon
entanglement, entanglement-based QCKA is facing severe limitations in both key
rate and scalability. Here, we propose a source-independent QCKA scheme
utilizing the post-matching method, feasible within the entangled photon pair
distribution network. We introduce an equivalent distributing virtual multi-
photon entanglement protocol for providing the unconditional security proof
even in the case of coherent attacks. For the symmetry star-network, comparing
with previous $n$-photon entanglement protocol, the conference key rate is
improved from $O(\eta^{n})$ to $O(\eta^{2})$, where $\eta$ is the
transmittance from the entanglement source to one participant. Simulation
results show that the performance of our protocol has multiple orders of
magnitude advantages in the intercity distance. We anticipate that our
approach will demonstrate its potential in the implementation of quantum
networks.

##  I INTRODUCTION

The goal of the quantum network is to establish a quantum internet that will
enhance the existing internet by allowing the collection, processing, storage
and transmission of quantum data [1, 2]. The development of quantum network is
divided into six stages according to the functional division [2], some well-
known cryptographic applications [3, 4, 5, 6, 7] can be performed through
quantum protocols at each stage. Quantum cryptography, which plays a crucial
role in quantum network, is moving towards practicality and provides
confidentiality, integrity, authenticity and non-repudiation [8]. For
instance, quantum privacy communication [9, 10, 11, 12, 13, 14] and quantum
digital signature [15, 16, 17, 18] are basic quantum cryptography primitives,
which can allow participants to implement data transmission with
confidentiality and non-repudiation in large scalable situation, respectively.
Quantum privacy communication includes quantum key distribution [19, 20, 21,
22, 23, 24], quantum secret sharing [25, 26, 27, 28, 29], quantum secure
direct communication [30, 31, 32] and quantum conference key agreement (QCKA)
[33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45]. Quantum key distribution
exploits two-party entanglement state, allowing two participants to share
secure secret keys with the insecure quantum channels, thereby enabling peer-
to-peer communication. QCKA is an extension of quantum key distribution to
scenarios involving multiple participants. Faced with multi-party
communication tasks, multi-photon entanglement-based QCKA allows for lower
quantum and classical resource consumption [46, 47, 48, 49] compared to
repeating quantum key distribution between every two participants and
possesses greater development potential.

Multi-photon entanglement-based QCKA protocols require the generation of
Greenberger-Horne-Zeilinger (GHZ) states [50, 51, 45, 42, 37] or “twisted”
versions of them [52, 53, 54] corresponding to the number of participants.
When employing such protocols, both the system complexity and error rate of
entanglement source will significantly increase as the number of protocol
participants rises. Several experimental studies [55, 40, 56, 57, 58, 34] have
already analyzed the actual performance of the GHZ state distribution
protocol, such as the experiment based on the “N-BB84” protocol [40], the
N-partite version of the asymmetric BB84 quantum key distribution protocol.
This work utilized state-of-the-art four-photon entanglement sources,
encrypting and securely sharing an image among four participants over 50 km
fiber. This kind of protocol is still far from being realized. Challenges such
as preparing multi-photon entanglement state [59, 60], as well as issues like
limited coincidence count rates, present significant obstacles.

A measurement-device-independent (MDI) QCKA protocol [25] was introduced to
avoid the preparation and transmission of multi-photon entanglement states. It
distributes post-selected GHZ entanglement, inspired by both the decoy state
method and entanglement swapping operation. Subsequently, various protocols
use weak coherent-state sources as a substitute for the entanglement source,
which include schemes based on single-photon interference [61, 36, 44]. These
types of protocol inherit features from related twin-field quantum key
distribution [12], which means strict request on the intensity and sending
probability of signal states and decoy states. The optimal parameters change
with both the number of participants and the distances between them. Moreover,
these schemes rely on the independence of measurement devices and cannot be
extended to scenarios involving more than three participants by only expanding
system structures. Recently, an MDI-QCKA protocol based on spatial
multiplexing and adaptive operation has been proposed [33], which has broken
the limitation on key rate under multiple participants. However, in this work,
confirming the arrival of transmitted photons requires quantum non-demolition
measurements, and guiding these photons to the GHZ analyzer through optical
switches necessitates high-speed active feedforward techniques. These
technical requirements constrains its practical applications. The issues of
poor practicality and low key rates in QCKA have not been completely
addressed, particularly in scenarios involving multiple participants.

Quantum entanglement networks based on entangled photon pairs have achieved
remarkable accomplishments through the utilization of spatial and wavelength
multiplexing techniques [62, 63, 64]. Here, we propose a source-independent
QCKA protocol based on the network of Bell states, which features
straightforward hardware implementation and good scalability. With the aid of
the post-matching method [65], measurement outcomes among participants can be
correlated through a series of classical operations (Note that post-matching
method has been extended to construct asynchronous measurement-device-
independent quantum key distribution [10, 11]). Thus, results equivalent to
measurements of GHZ states can be obtained and the need for multi-photon
entanglement sources is avoided. We employ an equivalent virtual protocol to
prove that our scheme can resist coherent attacks. The simulation results and
a composable finite-key analysis are also provided. The results indicate that
our protocol achieves a transmission distance of over 320 kilometers under the
condition of 6 participants. In the case of 3 participants, our protocol
achieves a key rate three orders of magnitude higher than N-BB84 [45] at a
transmission distance of 200 kilometers. As participant numbers increase, this
key rate advantage becomes more evident. Furthermore, our protocol allows for
freely adjusting the number of participants without altering the system
structure of the entanglement provider and other protocol participants. The
system of our protocol can be integrated into the complex and dynamic quantum
networks. We believe that our scheme provides a promising method for providing
keys to multiple participants with one entangled photon pair source.

##  II Protocol description

Figure 1: The setup of QCKA protocol. The untrusted entanglement provider at
the central node, named Eve, employs a polarization-entangled photon pair
source to generate entangled photon pairs. These pairs can be distributed to
$\rm Alice$ and $\rm Bob_{i}$ through the wavelength division multiplexer
(WDM) and optical switch. $\rm Alice$ and $\rm Bob_{i}$ utilize a combination
of polarization controller (PC), beam splitter (BS), half-wave plate (HWP),
polarization beam splitter (PBS), and superconducting nanowire single-photon
detector for their detection apparatus.

Our protocol is designed to be implemented based on entangled photon pairs
distribution network. Any network user can be a protocol participant. The
setup of our scheme, depicted in Fig. 1, illustrates a centrally symmetric and
source-independent design. To cover all wavelength channels effectively, we
select a wavelength division multiplexer (WDM) based on the frequency range of
the entanglement source. The generated Bell states, represented as
$\left|\Phi^{+}\right\rangle=\frac{1}{\sqrt{2}}(\left|00\right\rangle+\left|11\right\rangle)$
$(\left|\Phi^{+}\right\rangle=\frac{1}{\sqrt{2}}(\left|++\right\rangle+\left|--\right\rangle))$,
can be allocated to different participants through WDM and optical switch [66,
67, 68]. $\left|0\right\rangle$, $\left|1\right\rangle$ are a pair of
eigenstates of the Z basis, and $\left|+\right\rangle$, $\left|-\right\rangle$
are a pair of eigenstates of the X basis, where
$\left|+\right\rangle=\frac{1}{\sqrt{2}}(\left|0\right\rangle+\left|1\right\rangle)$,
$\left|-\right\rangle=\frac{1}{\sqrt{2}}(\left|0\right\rangle-\left|1\right\rangle)$.
The measurement results for $\left|0\right\rangle$ and $\left|+\right\rangle$
are noted as 0, and for $\left|1\right\rangle$ and $\left|-\right\rangle$,
they are noted as 1. All participants have a set of devices to perform
projection measurements on the received qubits.

While there exist $n$ participants named as $\rm Alice$, $\rm Bob_{1}$, $\rm
Bob_{2},\dots,\rm Bob_{\mathit{n}-1}$, the entire process of our protocol is
presented as follows:

1. $\rm Eve$ configures the optical switch according to the number and positions of the participants. Channel $\rm 1$, $\rm 2$, $\cdots$, $n-1$ are connected to $\rm Alice$ and Channel $\rm 1^{\prime}$, $\rm 2^{\prime}$, $\cdots$, $(n-1)^{\prime}$ are connected to the corresponding  $\rm Bob_{\mathit{i}}(\mathit{i}\in\\{1,2,\cdots,\mathit{n}-1\\})$. $\rm Eve$ prepares entangled photon pairs and distributes them to $\rm Alice$ and $\rm Bob_{\mathit{i}}$ via WDM and optical switch. The entangled photon pairs respectively pass through corresponding channels, $i$ and $i^{\prime}$.

2. $\rm Alice$ and $\rm Bob_{\mathit{i}}$ each select a basis and perform projection measurements on qubits, recording the outcomes and chosen basis. The probability of selecting the Z basis is represented as $p_{a}$ $(p_{b})$ and the probability of selecting the X basis is $1-p_{a}$ $(1-p_{b})$. All participants announce the bases they selected in the past period of time through classical channel in the agreed time slot. The events in which one entanglement state is both successfully measured by $\rm Alice$ and corresponding $\rm Bob_{\mathit{i}}$ under the same basis are denoted as valid events.

3. The participants apply the post-matching method to handle valid events under the Z and X-bases. $\rm Alice$ and $\rm Bob_{\mathit{i}}$ arrange the measurement results of valid events in order, represented as $a_{j}^{iz}$ $\left(a_{j}^{ix}\right)$ and $b_{j}^{iz}$ $\left(b_{j}^{ix}\right)$, $i$ is the index of $\rm Bob$ and $j$ indicates the sequence of outcomes. They classified the valid events according to the selected basis and matched the measurement results in the same basis sequentially. Considering their common origin in the same Bell state, $a_{j}^{iz}$ $\left(a_{j}^{ix}\right)$ and $b_{j}^{iz}$ $\left(b_{j}^{ix}\right)$ are equal without the effect of noise.

We provide a detailed explanation for post-matching method using an example.
In a three-party scenario, measurement events between $\rm Alice$ and $\rm
Bob_{i}(\mathit{i}\in\\{1,2\\})$ can be represented as $S_{k}^{i}$, where $k$
is the sequence of measurement events. It is supposed that the first four
measurement events can be denoted in sequence as $\\{S_{1}^{1,X}$,
$S_{2}^{1,D}$, $S_{3}^{1,Z}$, $S_{4}^{1,Z}\\}$ and $\\{S_{1}^{2,Z}$,
$S_{2}^{2,Z}$, $S_{3}^{2,X}$, $S_{4}^{2,D}\\}$. The superscript $X$ indicates
that $\rm Alice$ and $\rm Bob_{\mathit{i}}$ both conduct measurements in the X
basis, while the superscript $Z$ means that $\rm Alice$ and $\rm
Bob_{\mathit{i}}$ both conduct measurements in the Z basis. The superscript
$D$ encompasses all other cases. In this scenario, the measurement results of
$S_{1}^{1,X}$ are matched with those of $S_{3}^{2,X}$, and get $a_{1}^{1x}$,
$a_{1}^{2x}$, $b_{1}^{1x}$, and $b_{1}^{2x}$. Similarly, The measurement
results of $S_{3}^{1,Z}$ $(S_{4}^{1,Z})$ are matched with those of
$S_{1}^{2,Z}$ $(S_{2}^{2,Z})$ to get $a_{1}^{1z}$, $a_{1}^{2z}$, $b_{1}^{1z}$,
and $b_{1}^{2z}$ ($a_{2}^{1z}$, $a_{2}^{2z}$, $b_{2}^{1z}$, and $b_{2}^{2z}$).

Subsequently, $\rm Alice$ performs XOR operations on the measurement results
in the Z basis: $c_{j}^{iz}=a_{j}^{1z}\oplus a_{j}^{iz}$ . After $\rm Alice$
publishes $c_{j}^{iz}$, $\rm Bob_{i}$ perform another XOR operation on
$c_{j}^{iz}$ and $b_{j}^{iz}$ to obtain a new classical bit string
${b_{j}^{iz}}^{\prime}$. In the case of the X basis, $\rm Alice$ acquires
${a_{j}^{1x}}^{\prime}$, which is the outcomes of $a_{j}^{1x}\oplus
a_{j}^{2x}\oplus\cdots\oplus a_{j}^{(n-1)x}$. Based on the self-inverse
property of XOR, there are:

${b_{j}^{iz}}^{\prime}=a_{j}^{iz}\oplus a_{j}^{1z}\oplus b_{j}^{iz}.$ (1)

Through the post-matching and data processing steps outlined above, $\rm
Alice$ and $\rm Bob_{\mathit{i}}$ establish correlations within each group of
outcomes. They can obtain bit strings with GHZ correlation through the
information processing steps above. There are:

$a_{j}^{1z}={b_{j}^{1z}}^{\prime}={b_{j}^{2z}}^{\prime}=\cdots={b_{j}^{(n-1)z}}^{\prime},$
(2)

${a_{j}^{1x}}^{\prime}=b_{j}^{1x}\oplus b_{j}^{2x}\oplus\cdots\oplus
b_{j}^{(n-1)x},$ (3)

without considering noise.

4. $\rm Alice$ and $\rm Bob_{\mathit{i}}$ use the valid events in the X-basis for information leakage estimation, and the valid events in the Z basis for obtaining raw keys. The bit string for QCKA can be derived through error correction and privacy amplification [69] applied to the raw keys. The specific calculation steps are outlined in Sec. IV.

In our protocol, Bell states are generated and distributed by an untrusted
provider (who can be the eavesdropper), which is similar to the Ekert91 [70]
protocol. We make no assumptions about the light source in the protocol, and
the attacker can generate any state he wants. However, the measurements for
all participants are what we need to assume, namely perfect Z and X bases.
Since the participants randomly choose the Z and X bases for measurement,
these disturbances inevitably lead to an increase in error rates, which is
unavoidably detectable through error rate estimation. Therefore, our protocol
is a source-independent protocol [71], circumventing the source
vulnerabilities present in traditional prepare-and-measure protocols. Its
security can be analyzed even when the source end is controlled by an
untrusted node.

The distribution of Bell states instead of multi-photon entanglement states
contributes to a simplified system design [72, 34]. As the number of
participants increases, the only requirement is adding detection devices with
a corresponding number and connecting them to the optical switch through
optical fibers. This scalability allows for the flexibility to add or remove
participants as needed.

##  III Security analysis

In this section, we introduce a virtual protocol that can be transformed into
the actual QCKA protocol outlined above to demonstrate the security of our
scheme. The virtual protocol allows participants to employ quantum memory for
storing the generated Bell states, while the classical data storage available
to participants in the actual protocol only permits them to store the results
of projection measurements. The correlations among multiple Bell states stored
are established by quantum gates, resulting in a different sequence of
operations and measurements in the virtual protocol compared to the actual
one. Figure 2 illustrates the generation process of GHZ states. Through multi-
party entanglement purification [69, 73, 74], the noise introduced during the
protocol can be eliminated, leading to the attainment of maximum entanglement.
The specific steps of the virtual protocol are as follows:

1. In the case of $n$ protocol participants, the polarization-entangled photon pair source generates $n-1$ pairs of Bell state $\left|\Phi^{+}\right\rangle=\frac{1}{\sqrt{2}}(\left|00\right\rangle+\left|11\right\rangle)$ $\left(\left|\Phi^{+}\right\rangle=\frac{1}{\sqrt{2}}(\left|++\right\rangle+\left|--\right\rangle)\right)$. One of the qubits in Bell state is distributed to $\rm Alice$ and the other to corresponding $\rm Bob_{\mathit{i}}$. $\rm Alice$ and $\rm Bob_{\mathit{i}}$ store them by quantum memory. The total system of the generated Bell states is given by:

$\left|\Phi^{+}\right\rangle^{\otimes(n-1)}=\frac{1}{\sqrt{2^{n-1}}}\sum_{\begin{subarray}{c}a_{i}=b_{i}\\\
b_{i}\in\\{0,1\\}\end{subarray}}\left|a_{1}b_{1}\cdots
a_{n-1}b_{n-1}\right\rangle.$ (4)

2. $\rm Alice$ and $\rm Bob_{\mathit{i}}$ establish entanglement among the qubits they store by performing multiple CNOT operations. Taking $a_{1}$ as control bits, $\rm Alice$ perform local CNOT operations with $a_{2},a_{3}\cdots a_{n-1}$ in order. Following this, the participants perform non-local CNOT operations sequentially on $a_{i}$ and corresponding $b_{i}(i\in\\{2,3,\cdots,\mathit{n}-1\\})$ as control and target bits, respectively. Without considering the noise, the evolution processes of the quantum state are as follows:

$\displaystyle\frac{1}{\sqrt{2^{n-1}}}\sum_{\begin{subarray}{c}a_{i}=b_{i}\\\
b_{i}\in\\{0,1\\}\end{subarray}}\left|a_{1}b_{1}\cdots
a_{n-1}b_{n-1}\right\rangle$ (5) $\displaystyle\stackrel{{\scriptstyle\rm
CNOT}}{{\longrightarrow}}$
$\displaystyle\frac{1}{\sqrt{2^{n-1}}}\sum_{\begin{subarray}{c}a_{i}=b_{i}\\\
b_{i}\in\\{0,1\\}\end{subarray}}[\left|00a_{2}b_{2}\cdots
a_{n-1}b_{n-1}\right\rangle+$ $\displaystyle\left|11(1\oplus
a_{2})b_{2}\cdots(1\oplus a_{n-1})b_{n-1}\right\rangle]$
$\displaystyle\stackrel{{\scriptstyle\begin{subarray}{c}\rm non-local\\\ \rm
CNOT\end{subarray}}}{{\longrightarrow}}$
$\displaystyle\frac{1}{\sqrt{2^{n-1}}}(\left|0\right\rangle+\left|1\right\rangle)_{a_{2}}\cdot\cdot\cdot(\left|0\right\rangle+\left|1\right\rangle)_{a_{n-1}}$
$\displaystyle(\left|00\cdot\cdot\cdot 0\right\rangle+\left|11\cdot\cdot\cdot
1\right\rangle)_{a_{1}b_{1}b_{2}\cdot\cdot\cdot b_{n-1}}.$

The state of subsystem
$\left\\{a_{1},b_{1},b_{2},\cdot\cdot\cdot,b_{n-1}\right\\}$ can be expressed
as:

$\left|\Phi^{+}\right\rangle_{a_{1}b_{1}b_{2}\cdot\cdot\cdot
b_{n-1}}=\frac{1}{\sqrt{2}}\left({\left|0\right\rangle}^{\otimes
n}+{\left|1\right\rangle}^{\otimes n}\right)_{a_{1}b_{1}b_{2}\cdot\cdot\cdot
b_{n-1}}.$ (6)

3. After obtaining a sufficient number of noisy GHZ states, the participants select a subset of them and perform measurements in the X basis to estimate parameters. Subsequently, they perform purification on the remaining GHZ states, extracting approximately pure GHZ states. The measurements of these GHZ states are performed in the Z basis. $\rm Alice$ and $\rm Bob_{i}$ record the results as secret keys.

Figure 2: GHZ state generation. $\rm Alice$ and $\rm Bob_{\mathit{i}}$ perform
local and non-local CNOT operations on qubits they store, establishing
entanglement correlations in subsystem
$\left\\{a_{1},b_{1},b_{2},\cdot\cdot\cdot,b_{n-1}\right\\}$.

The steps of virtual and actual protocols correspond one-to-one. Quantum
memory corresponds to classical data storage. While quantum memory stores and
retrieves quantum information using qubits, classical data storage performs a
similar function in classical computing by storing and retrieving classical
bits. The CNOT operations are equivalent to XOR operations and bit flips. For
the Z basis, the local CNOT operations correspond to XOR operations between
$a_{j}^{1z}$ and $a_{j}^{iz}$ $\left(c_{j}^{iz}=a_{j}^{1z}\oplus
a_{j}^{iz}\right)$ in the actual protocol. The non-local CNOT operations
correspond to deciding whether to perform a bit flip on $b_{j}^{iz}$ based on
$c_{j}^{iz}$. For the X basis, the local CNOT operations correspond to that
$\rm Alice$ performs computation ${a_{j}^{1x}}^{\prime}=a_{j}^{1x}\oplus
a_{j}^{2x}\oplus\cdots\oplus a_{j}^{(n-1)x}$. The non-local CNOT operations do
not affect the measurement outcomes in the X basis.

Entanglement purification can be converted into the quantum error
correction[69, 74], where the Calderbank-Shor-Steane code are divided into two
subcodes, designed for qubit flip errors and phase errors, respectively. The
correction of qubit flip error and phase flip error are correspond to
classical bit error correction and privacy amplification. Considering the
monogamy of entanglement[75], these obtained pure GHZ states almost leak no
information to eavesdroppers. Therefore, the actual protocol is equivalent to
the virtual protocol and can effectively prevent information leakage.

##  IV Results and discussion

###  IV.1 Calculation of the key rate

According to the description of the protocol above, the bit strings with
entanglement correlation are finally shared by the protocol participants. The
key rate in the asymptotic case [25, 33] is given by:

$R_{\rm
QCKA}=Q_{Z}\left\\{1-H\left(E_{X(n)}\right)-f{\max_{i}}\left[H\left(E_{Z}^{1,i}\right)\right]\right\\},$
(7)

where $Q_{Z}$ is the gain of the system in the Z basis, $E_{X(n)}$ is the
total bit error rate in the X basis, and $E_{Z}^{1,i}$ indicates the marginal
error rates between $\rm Alice$ and corresponding $\rm Bob_{\mathit{i}}$. $f$
represents the error correction efficiency, and
$H(x)=-x\log_{2}x-(1-x)\log_{2}(1-x)$ is binary Shannon entropy function.

We denote the efficiency of all detectors as $\eta$. Considering the central
symmetric network architecture, the quantum channels efficiency of $\rm Alice$
and $\rm Bob_{\mathit{i}}$ can be gotten:
$\eta_{A}=\eta_{B}=\eta\times{10}^{\frac{-\alpha L}{10}}$, where $\alpha$ is
the optical fiber attenuation coefficient, and $L$ is the length of optical
fiber between participants and the untrusted entanglement provider. Taking
into account the type-II source of polarization entanglement, the gain for
$k$-photon pairs [76, 77] is as follows:

$\begin{split}Q_{k}&=\left[1-(1-Y_{0A})(1-\eta_{A})^{k}\right]\\\
&\left[1-(1-Y_{0B})(1-\eta_{B})^{k}\right]\frac{(k+1)\lambda^{k}}{\left(1+\lambda\right)^{k+2}}.\end{split}$
(8)

By summing up $Q_{k}$, we can get the gain in the Z basis of two-party
entanglement system:

$\begin{split}Q_{Z}=\sum_{k=0}^{\infty}Q_{k}=1&-\frac{1-Y_{0A}}{\left(1+\eta_{A}\lambda\right)^{2}}-\frac{1-Y_{0B}}{\left(1+\eta_{B}\lambda\right)^{2}}\\\
&+\frac{\left(1-Y_{0A}\right)\left(1-Y_{0B}\right)}{\left(1+\eta_{A}\lambda+\eta_{B}\lambda-\eta_{A}\eta_{B}\lambda\right)^{2}},\end{split}$
(9)

where $\lambda$ is half of the expected photon pair number $\mu$, and $Y_{0A}$
$(Y_{0B})$ is the detector dark count. Due to the entangled photon pair
source, we only need to consider the collection efficiency of two participants
involved. The gain of the system remains unchanged with variations in the
number of participants. Considering the symmetry between measurements in the Z
and X bases, we can derive the bit error rate $e$ in them:

$\begin{split}e=&e_{0}-\\\
&\frac{2\left(e_{0}-e_{d}\right)\eta_{A}\eta_{B}\lambda\left(1+\lambda\right)}{Q_{Z}\left(1+\eta_{A}\lambda\right)\left(1+\eta_{B}\lambda\right)\left(1+\eta_{A}\lambda+\eta_{B}\lambda-\eta_{A}\eta_{B}\lambda\right)},\end{split}$
(10)

where $e_{0}$ is the background error rate, $e_{d}$ is the misalignment rate.
$e$ represents the probability that $\rm Alice$ and $\rm Bob_{\mathit{i}}$
have discordant outcomes in a single valid event.

(a)

(b)

Figure 3: The error rate analysis. The probabilities of various outcomes
arising after measurement and classical operations are provided. (a) The
second and fourth row of the table represent the marginal error rate
$E_{Z}^{1,1}$. The third and fourth row represent the marginal error rate
$E_{Z}^{1,2}$. (b) The second and third row represent the total error rate
$E_{X(3)}$, which is the probability that measurement results fail to satisfy
entanglement correlation.

To estimate $E_{X(n)}$ and $E_{Z}^{1,i}$, we present tables in Fig. 3 for the
mesurement results in three-party scenario and extended the analysis to
multiple participants, assuming that no errors are introduced during the
classical operations. According to Fig. 3(a) the generation of a correct key
becomes unattainable if any one measurement result in the Z basis contains an
error. Since the marginal error rates $E_{Z}^{1,i}$ are exclusively introduced
by the discordant outcomes of $\rm Alice$ and $\rm Bob_{\mathit{i}}$ in a
single valid event, there are $E_{Z}^{1,i}=e(1-e)+e^{2}=e$. which remains
unaffected by variations in the number of participants. The total bit error
rate of $n$ participants where at least one measurement result of $\rm
Bob_{\mathit{i}}$ differs from $\rm Alice^{\prime}s$ in the Z basis is as
follows:

$E_{Z(n)}=1-\left(1-e\right)^{(n-1)}.$ (11)

While entangled photon pairs are measured in the X basis, the data in the
first and fourth rows in Fig. 3(b) satisfy Eq. 3. Therefore, in the three-
party scenario, the total bit error rate in the X basis is denoted as
$E_{X(3)}=2e(1-e)$. Considering the identity property of the XOR operation,
with an even number of incorrect measurements, the correctness of the results
will not be affected. In this case, the key distribution is considered to be
successful. Otherwise, it is deemed a failure. In the expansion of $E_{X(n)}$,
there are no even-powered terms of $e$, while odd-powered terms remain
unaffected:

$E_{X(n)}=\sum_{i=0}^{t}\mathrm{C}_{n-1}^{2i+1}\left(1-e\right)^{n-2i-2}e^{2i+1}.$
(12)

When $n$ is an even number, $t=\frac{n}{2}-1$. When $n$ is an odd number,
$t=\frac{n-3}{2}$.

The finite key analysis for the experiment is provided below. The universally
composable security framework is employed as our security criteria. We define
the length of the security key as $L_{\rm QCKA}$ according to the calculation
in Ref. [78, 45, 33]:

$\begin{split}L_{\rm
QCKA}&=n_{z}\left\\{1-H({\phi^{z}})-f\max_{i}\left[H\left(E_{Z}^{1,i}\right)\right]\right\\}\\\
&\quad-\log_{2}{\frac{2(n-1)}{\varepsilon_{\rm
cor}}}-2\log_{2}{\frac{1}{2\varepsilon_{\rm sec}}},\end{split}$ (13)

where $n_{z}$ is the number of entangled pairs measured in the Z basis.
$\phi^{z}$ is the upper limit of the phase error rate in the Z basis
considering statistical fluctuations. $\varepsilon_{\rm cor}$ is the failure
probability of error verification, and $\varepsilon_{\rm sec}$ is the failure
probability of privacy amplification [36].

Figure 4: Key rate of our protocol and N-BB84. Under the conditions of perfect entanglement sources, we numerically simulate the key rate for different number of participants (3, 4, 5, 6) using the parameters in Table 1. The horizontal axis represents the distance between the central node and each participants. The solid line represents key rate of our protocol, while the dashed line represents that of N-BB84 [45] protocol.  Table 1: Simulation parameters. $e_{0}$ is the background error rate. $e_{d}$ is the misalignment rate. $\eta_{d}$ is the detection efficiency of single photon detectors. $p_{d}$ is the dark count rate. $\alpha$ is the attenuation coefficient of the ultra-low-loss fiber. $f$ is the error correction efficiency. $\varepsilon_{\rm cor}$, $\varepsilon_{\rm sec}$ are the parameters of correctness and privacy. $e_{0}$ | $e_{d}$ | $\eta_{d}$ | $p_{d}$ | $\alpha$ | $f$ | $\varepsilon_{\rm cor}$ | $\varepsilon_{\rm sec}$
---|---|---|---|---|---|---|---
$0.5$ | $0.02$ | $56\%$ | $10^{-7}$ | $0.16$ | $1.16$ | $1.2\times 10^{-9}$ | $1.2\times 10^{-9}$
Figure 5: Simulation schematic under finite key conditions. The solid lines
represent the key rates corresponding to different key lengths in the case of
three participants, while the dashed lines indicate the key rates in the
scenario of five participants. $N$ is the number of pulses allocated to each
participant by the entanglement source. Figure 6: Simulation schematic under
different misalignment rate of the basis. We provide the asymptotic key rate
under the scenario of three participants. Our protocol can still achieve a
transmission distance exceeding 300 kilometers with a misalignment rate of
0.05 for the basis.

Due to the challenge of counting phase errors in valid events, it is not
feasible to obtain the phase error rate in the Z basis directly. However,
since the density matrix of the n-photon state is the same in the Z and X
bases, bit flips in the X basis correspond to phase flips in the Z basis.
Consequently, we can utilize the property that the phase error rate in the Z
basis is identical to the bit error rate in the X basis to calculate
$\phi^{z}$.

We define the superscript $*$ and overline to denote expected value and
observed value. The number of bit error under the X basis can be defined as
$m_{x}=NQ_{X}E_{X(n)}$, assuming that the gain in the X basis $Q_{X}=Q_{Z}$.
Then the numerical equation for the variant of Chernoff-bound [79, 78] is used
to obtain the limit of expected value $m_{x}^{*}$. $m_{x}^{*}$ =
$m_{x}+\beta+\sqrt{2\beta{m_{x}}+{\beta}^{2}}$, of which
$\beta=-\ln\varepsilon$ and $\varepsilon=10^{-10}$ is the failure probability.
Since the phase error rate in the Z basis is identical to the bit error rate
in the X basis in the asymptotic limit, there is
$m_{zt}^{*}=m_{x}^{*}n_{z}/n_{x}$, where $m_{zt}^{*}$ represents the upper
limit of the expected number of qubits with phase errors in the Z basis.
Subsequently, a similar procedure is employed to estimate the upper limit of
the number of phase errors observed in the Z basis:
${\bar{m}_{zt}}={m_{zt}^{*}}+\frac{\beta}{2}+\sqrt{2\beta{m_{zt}^{*}}+\frac{\beta^{2}}{4}}$.
Ultimately, the upper limit of the phase error rate can be determined as
$\phi^{z}={\bar{m}_{zt}}/n_{z}$.

###  IV.2 Simulation results

The convex optimization algorithm is used to simulate the protocol. We provide
the asymptotic key rates for both our protocol and N-BB84 in Fig. 4. For a
fair comparison, it is assumed that perfect entanglement sources are used in
the system, which means a guarantee of perfectly entangled photon pairs. The
specific parameters used are shown in Table 1. The results shows that under
identical experimental parameters and post-processing procedures, our protocol
consistently exhibits a higher key rate and achieves a longer transmission
distance. At a transmission distance of 200 km, the key rate of our protocol
can be three orders of magnitude higher than that of N-BB84. The advantage
becomes more evident with an increasing participant number. Our protocol still
achieves successful key generation with 6 participants at 320 km. The
robustness of our protocol in the face of rise in the number of participants
is attributed to the improvement of valid event probability. Therefore, the
protocol’s key rate is enhanced from$O(\eta^{n})$ to $O(\eta^{2})$, making it
more suitable for large-scale quantum networks compared to previous
entanglement-based QCKA protocols.

We have also calculated key rate under different constraint conditions taking
the imperfect source into consideration. Figure 5 shows the key rate at
different distances under finite-key conditions when the number of
participants is 3 and 5, which provides a reference for the application of
protocol. Under the condition of five participants, our protocol maintains the
ability to generate keys at a distance of 140 km when $N=10^{11}$. Figure 6
illustrates that in the case of three participants, the key rate under
different values of $e_{d}$. The transmission distance can reach more than 300
km with a basis misalignment rate of $5\%$, which means it can withstand more
interference from the field environment.

##  V Conclusion

We have proposed a QCKA scheme based on Bell states, which can be extended to
an arbitrary number of participants. The protocol establishes correlations
among the measurement results of Bell states through classical operations and
the post-matching method, thereby avoiding the challenges in generating multi-
photon entangled states. A performance comparison with N-BB84 and a finite key
analysis, considering composable security, is provided. Simulation results
show that our protocol achieves a transmission distance exceeding 320
kilometers in the case of 6 participants and can tolerate a $5\%$ misalignment
rate of the basis, which represents an improvement over existing entanglement-
based protocols. In recent years, significant progress has been made in the
advantage distillation technique [80, 81] within the realm of quantum key
distribution. This technique enhances the correlation between raw keys,
allowing for greater tolerance to channel loss and error rates. It’s
foreseeable that advantage distillation will be widely applied in QCKA. We
believe that incorporating this technique into our protocol can further
enhance its performance.

The flexibility and scalability of our protocol enable the free selection of
new participants from network users, without requiring hardware changes for
existing participants and entanglement providers. Therefore, our protocol can
be inserted into the entanglement network with plug-and-play capability.
Additionally, it constitutes a crucial application of the post-matching
method, indicating greater adaptability to multi-party applications. Similar
to Ref. [35], our protocol requires only minor adjustments to basis selection
probabilities and post-processing procedures for efficient execution of
quantum secret sharing tasks. This suggests the potential for extending our
protocol to other areas of quantum cryptography.

## Acknowledgments

This work was supported by the National Natural Science Foundation of China
(No. 12274223); Program for Innovative Talents and Entrepreneurs in Jiangsu
(No. JSSCRC2021484) and Program of Song Shan Laboratory(included in the
management of Major Science and Technology Program of Henan Province) (No.
221100210800-02).

## References

  * Simon [2017] C. Simon, Towards a global quantum network, Nat. Photonics 11, 678 (2017).
  * Wehner  _et al._ [2018] S. Wehner, D. Elkouss, and R. Hanson, Quantum internet: A vision for the road ahead, Science 362, eaam9288 (2018).
  * Cao  _et al._ [2024] X.-Y. Cao, B.-H. Li, Y. Wang, Y. Fu, H.-L. Yin, and Z.-B. Chen, Experimental quantum e-commerce, Sci. Adv. 10, eadk3258 (2024).
  * Schiansky  _et al._ [2023] P. Schiansky, J. Kalb, E. Sztatecsny, M.-C. Roehsner, T. Guggemos, A. Trenti, M. Bozzio, and P. Walther, Demonstration of quantum-digital payments, Nat. Commun. 14, 3849 (2023).
  * Weng  _et al._ [2023] C.-X. Weng, R.-Q. Gao, Y. Bao, B.-H. Li, W.-B. Liu, Y.-M. Xie, Y.-S. Lu, H.-L. Yin, and Z.-B. Chen, Beating the fault-tolerance bound and security loopholes for byzantine agreement with a quantum solution, Research 6, 0272 (2023).
  * Stroh  _et al._ [2023] L. Stroh, N. Horová, R. Stárek, I. V. Puthoor, M. Mičuda, M. Dušek, and E. Andersson, Noninteractive xor quantum oblivious transfer: Optimal protocols and their experimental implementations, PRX Quantum 4, 020320 (2023).
  * Tham  _et al._ [2020] W. K. Tham, H. Ferretti, K. Bonsma-Fisher, A. Brodutch, B. C. Sanders, A. M. Steinberg, and S. Jeffery, Experimental demonstration of quantum fully homomorphic encryption with application in a two-party secure protocol, Phys. Rev. X 10, 011038 (2020).
  * Yin  _et al._ [2023] H.-L. Yin, Y. Fu, C.-L. Li, C.-X. Weng, B.-H. Li, J. Gu, Y.-S. Lu, S. Huang, and Z.-B. Chen, Experimental quantum secure network with digital signatures and encryption, Natl. Sci. Rev. 10, nwac228 (2023).
  * Lo  _et al._ [2012] H.-K. Lo, M. Curty, and B. Qi, Measurement-device-independent quantum key distribution, Phys. Rev. Lett. 108, 130503 (2012).
  * Xie  _et al._ [2022] Y.-M. Xie, Y.-S. Lu, C.-X. Weng, X.-Y. Cao, Z.-Y. Jia, Y. Bao, Y. Wang, Y. Fu, H.-L. Yin, and Z.-B. Chen, Breaking the rate-loss bound of quantum key distribution with asynchronous two-photon interference, PRX Quantum 3, 020315 (2022).
  * Zeng  _et al._ [2022] P. Zeng, H. Zhou, W. Wu, and X. Ma, Mode-pairing quantum key distribution, Nature Commun. 13, 3903 (2022).
  * Lucamarini  _et al._ [2018] M. Lucamarini, Z. L. Yuan, J. F. Dynes, and A. J. Shields, Overcoming the rate–distance limit of quantum key distribution without quantum repeaters, Nature 557, 400 (2018).
  * Hu  _et al._ [2016] J.-Y. Hu, B. Yu, M.-Y. Jing, L.-T. Xiao, S.-T. Jia, G.-Q. Qin, and G.-L. Long, Experimental quantum secure direct communication with single photons, Light Sci. Appl. 5, e16144 (2016).
  * Chen  _et al._ [2021] Y.-A. Chen, Q. Zhang, T.-Y. Chen, W.-Q. Cai, S.-K. Liao, J. Zhang, K. Chen, J. Yin, J.-G. Ren, Z. Chen, _et al._ , An integrated space-to-ground quantum communication network over 4,600 kilometres, Nature 589, 214 (2021).
  * Li  _et al._ [2023a] B.-H. Li, Y.-M. Xie, X.-Y. Cao, C.-L. Li, Y. Fu, H.-L. Yin, and Z.-B. Chen, One-time universal hashing quantum digital signatures without perfect keys, Phys. Rev. Applied 20, 044011 (2023a).
  * Dunjko  _et al._ [2014] V. Dunjko, P. Wallden, and E. Andersson, Quantum digital signatures without quantum memory, Phys. Rev. Lett. 112, 040502 (2014).
  * Yin  _et al._ [2016] H.-L. Yin, Y. Fu, and Z.-B. Chen, Practical quantum digital signature, Phys. Rev. A 93, 032316 (2016).
  * Richter  _et al._ [2021] S. Richter, M. Thornton, I. Khan, H. Scott, K. Jaksch, U. Vogl, B. Stiller, G. Leuchs, C. Marquardt, and N. Korolkova, Agile and versatile quantum communication: Signatures and secrets, Phys. Rev. X 11, 011038 (2021).
  * Zhou  _et al._ [2023] L. Zhou, J. Lin, Y.-M. Xie, Y.-S. Lu, Y. Jing, H.-L. Yin, and Z. Yuan, Experimental quantum communication overcomes the rate-loss limit without global phase tracking, Phys. Rev. Lett. 130, 250801 (2023).
  * Ghalaii  _et al._ [2023] M. Ghalaii, S. Bahrani, C. Liorni, F. Grasselli, H. Kampermann, L. Wooltorton, R. Kumar, S. Pirandola, T. P. Spiller, A. Ling, _et al._ , Satellite-based quantum key distribution in the presence of bypass channels, PRX Quantum 4, 040320 (2023).
  * Lu  _et al._ [2023] F.-Y. Lu, Z.-H. Wang, V. Zapatero, J.-L. Chen, S. Wang, Z.-Q. Yin, M. Curty, D.-Y. He, R. Wang, W. Chen, _et al._ , Experimental demonstration of fully passive quantum key distribution, Phys. Rev. Lett. 131, 110802 (2023).
  * Gu  _et al._ [2022] J. Gu, X.-Y. Cao, Y. Fu, Z.-W. He, Z.-J. Yin, H.-L. Yin, and Z.-B. Chen, Experimental measurement-device-independent type quantum key distribution with flawed and correlated sources, Sci. Bull. 67, 2167 (2022).
  * Hu  _et al._ [2023] C. Hu, W. Wang, K.-S. Chan, Z. Yuan, and H.-K. Lo, Proof-of-principle demonstration of fully passive quantum key distribution, Phys. Rev. Lett. 131, 110801 (2023).
  * Li  _et al._ [2023b] W. Li, L. Zhang, Y. Lu, Z.-P. Li, C. Jiang, Y. Liu, J. Huang, H. Li, Z. Wang, X.-B. Wang, _et al._ , Twin-field quantum key distribution without phase locking, Phys. Rev. Lett. 130, 250802 (2023b).
  * Fu  _et al._ [2015] Y. Fu, H.-L. Yin, T.-Y. Chen, and Z.-B. Chen, Long-distance measurement-device-independent multiparty quantum communication, Phys. Rev. Lett. 114, 090501 (2015).
  * Kogias  _et al._ [2017] I. Kogias, Y. Xiang, Q. He, and G. Adesso, Unconditional security of entanglement-based continuous-variable quantum secret sharing, Phys. Rev. A 95, 012315 (2017).
  * Li  _et al._ [2023c] C.-L. Li, Y. Fu, W.-B. Liu, Y.-M. Xie, B.-H. Li, M.-G. Zhou, H.-L. Yin, and Z.-B. Chen, Breaking the rate-distance limitation of measurement-device-independent quantum secret sharing, Phys. Rev. Research 5, 033077 (2023c).
  * Senthoor and Sarvepalli [2019] K. Senthoor and P. K. Sarvepalli, Communication efficient quantum secret sharing, Phys. Rev. A 100, 052313 (2019).
  * Gu  _et al._ [2021] J. Gu, Y.-M. Xie, W.-B. Liu, Y. Fu, H.-L. Yin, and Z.-B. Chen, Secure quantum secret sharing without signal disturbance monitoring, Opt. Express 29, 32244 (2021).
  * Zhang  _et al._ [2017] W. Zhang, D.-S. Ding, Y.-B. Sheng, L. Zhou, B.-S. Shi, and G.-C. Guo, Quantum secure direct communication with quantum memory, Phys. Rev. Lett. 118, 220501 (2017).
  * Qi  _et al._ [2021] Z. Qi, Y. Li, Y. Huang, J. Feng, Y. Zheng, and X. Chen, A 15-user quantum secure direct communication network, Light Sci. Appl. 10, 183 (2021).
  * Sheng  _et al._ [2022] Y.-B. Sheng, L. Zhou, and G.-L. Long, One-step quantum secure direct communication, Sci. Bull. 67, 367 (2022).
  * Li  _et al._ [2023d] C.-L. Li, Y. Fu, W.-B. Liu, Y.-M. Xie, B.-H. Li, M.-G. Zhou, H.-L. Yin, and Z.-B. Chen, Breaking universal limitations on quantum conference key agreement without quantum memory, Commun. Phys. 6, 122 (2023d).
  * Pickston  _et al._ [2023] A. Pickston, J. Ho, A. Ulibarrena, F. Grasselli, M. Proietti, C. L. Morrison, P. Barrow, F. Graffitti, and A. Fedrizzi, Conference key agreement in a quantum network, npj Quantum Inf. 9, 82 (2023).
  * Liu  _et al._ [2023] S. Liu, Z. Lu, P. Wang, Y. Tian, X. Wang, and Y. Li, Experimental demonstration of multiparty quantum secret sharing and conference key agreement, npj Quantum Information 9, 92 (2023).
  * Bai  _et al._ [2022] J.-L. Bai, Y.-M. Xie, Z. Li, H.-L. Yin, and Z.-B. Chen, Post-matching quantum conference key agreement, Opt. Express 30, 28865 (2022).
  * Hahn  _et al._ [2020] F. Hahn, J. de Jong, and A. Pappa, Anonymous quantum conference key agreement, PRX Quantum 1, 020325 (2020).
  * Li  _et al._ [2021] Z. Li, X.-Y. Cao, C.-L. Li, C.-X. Weng, J. Gu, H.-L. Yin, and Z.-B. Chen, Finite-key analysis for quantum conference key agreement with asymmetric channels, Quantum Sci. Technol. 6, 045019 (2021).
  * Carrara  _et al._ [2023] G. Carrara, G. Murta, and F. Grasselli, Overcoming fundamental bounds on quantum conference key agreement, Phys. Rev. Applied 19, 064017 (2023).
  * Proietti  _et al._ [2021] M. Proietti, J. Ho, F. Grasselli, P. Barrow, M. Malik, and A. Fedrizzi, Experimental quantum conference key agreement, Sci. Adv. 7, eabe0395 (2021).
  * Epping  _et al._ [2017] M. Epping, H. Kampermann, D. Bruß, _et al._ , Multi-partite entanglement can speed up quantum key distribution in networks, New J. Phys. 19, 093012 (2017).
  * Murta  _et al._ [2020] G. Murta, F. Grasselli, H. Kampermann, and D. Bruß, Quantum conference key agreement: A review, Adv. Quantum Technol. 3, 2000025 (2020).
  * Zhao  _et al._ [2020] S. Zhao, P. Zeng, W.-F. Cao, X.-Y. Xu, Y.-Z. Zhen, X. Ma, L. Li, N.-L. Liu, and K. Chen, Phase-matching quantum cryptographic conferencing, Phys. Rev. Applied 14, 024010 (2020).
  * Cao  _et al._ [2021a] X.-Y. Cao, J. Gu, Y.-S. Lu, H.-L. Yin, and Z.-B. Chen, Coherent one-way quantum conference key agreement based on twin field, New J. Phys. 23, 043002 (2021a).
  * Grasselli  _et al._ [2018] F. Grasselli, H. Kampermann, and D. Bruß, Finite-key effects in multipartite quantum key distribution protocols, New J. Phys. 20, 113014 (2018).
  * Miguel-Ramiro  _et al._ [2023] J. Miguel-Ramiro, A. Pirker, and W. Dür, Optimized quantum networks, Quantum 7, 919 (2023).
  * Wallnöfer  _et al._ [2019] J. Wallnöfer, A. Pirker, M. Zwerger, and W. Dür, Multipartite state generation in quantum networks with optimal scaling, Sci. Rep. 9, 314 (2019).
  * Li  _et al._ [2023e] C.-L. Li, Y. Fu, W.-B. Liu, Y.-M. Xie, B.-H. Li, M.-G. Zhou, H.-L. Yin, and Z.-B. Chen, All-photonic quantum repeater for multipartite entanglement generation, Opt. Lett. 48, 1244 (2023e).
  * Kuzmin  _et al._ [2019] V. Kuzmin, D. Vasilyev, N. Sangouard, W. Dür, and C. Muschik, Scalable repeater architectures for multi-party states, npj Quantum Inf. 5, 115 (2019).
  * Bose  _et al._ [1998] S. Bose, V. Vedral, and P. L. Knight, Multiparticle generalization of entanglement swapping, Phys. Rev. A 57, 822 (1998).
  * Chen and Lo [2005] K. Chen and H.-K. Lo, Conference key agreement and quantum sharing of classical secrets with noisy ghz states, in  _Proceedings. International Symposium on Information Theory, 2005. ISIT 2005._ (IEEE, 2005) pp. 1607–1611.
  * Mermin [1990] N. D. Mermin, Extreme quantum entanglement in a superposition of macroscopically distinct states, Phys. Rev. Lett. 65, 1838 (1990).
  * Greenberger  _et al._ [1989] D. M. Greenberger, M. A. Horne, and A. Zeilinger, Going beyond bell’s theorem, in  _Bell’s theorem, quantum theory and conceptions of the universe_ (Springer, 1989) pp. 69–72.
  * Cai  _et al._ [2018] B. Cai, G. Guo, S. Lin, H. Zuo, and C. Yu, Multipartite quantum key agreement over collective noise channels, IEEE Photon. J. 10, 1 (2018).
  * Tittel  _et al._ [2001] W. Tittel, H. Zbinden, and N. Gisin, Experimental demonstration of quantum secret sharing, Physical Review A 63, 042301 (2001).
  * Schmid  _et al._ [2005] C. Schmid, P. Trojek, M. Bourennane, C. Kurtsiefer, M. Żukowski, and H. Weinfurter, Experimental single qubit quantum secret sharing, Physical Review Letters 95, 230505 (2005).
  * Gaertner  _et al._ [2007] S. Gaertner, C. Kurtsiefer, M. Bourennane, and H. Weinfurter, Experimental demonstration of four-party quantum secret sharing, Physical Review Letters 98, 020503 (2007).
  * Erven  _et al._ [2014] C. Erven, E. Meyer-Scott, K. Fisher, J. Lavoie, B. Higgins, Z. Yan, C. Pugh, J.-P. Bourgoin, R. Prevedel, L. Shalm, _et al._ , Experimental three-photon quantum nonlocality under strict locality conditions, Nature photonics 8, 292 (2014).
  * Jöns  _et al._ [2017] K. D. Jöns, L. Schweickert, M. A. Versteegh, D. Dalacu, P. J. Poole, A. Gulinatti, A. Giudice, V. Zwiller, and M. E. Reimer, Bright nanoscale source of deterministic entangled photon pairs violating bell’s inequality, Sci. Rep. 7, 1700 (2017).
  * Uppu  _et al._ [2021] R. Uppu, L. Midolo, X. Zhou, J. Carolan, and P. Lodahl, Quantum-dot-based deterministic photon–emitter interfaces for scalable photonic quantum technology, Nat. Nanotechnol. 16, 1308 (2021).
  * Cao  _et al._ [2021b] X.-Y. Cao, Y.-S. Lu, Z. Li, J. Gu, H.-L. Yin, and Z.-B. Chen, High key rate quantum conference key agreement with unconditional security, IEEE Access 9, 128870 (2021b).
  * Wengerowsky  _et al._ [2018] S. Wengerowsky, S. K. Joshi, F. Steinlechner, H. Hübel, and R. Ursin, An entanglement-based wavelength-multiplexed quantum communication network, Nature 564, 225 (2018).
  * Joshi  _et al._ [2020] S. K. Joshi, D. Aktas, S. Wengerowsky, M. Lončarić, S. P. Neumann, B. Liu, T. Scheidl, G. C. Lorenzo, Ž. Samec, L. Kling, _et al._ , A trusted node–free eight-user metropolitan quantum communication network, Sci. Adv. 6, eaba0959 (2020).
  * Liu  _et al._ [2022] X. Liu, J. Liu, R. Xue, H. Wang, H. Li, X. Feng, F. Liu, K. Cui, Z. Wang, L. You, _et al._ , 40-user fully connected entanglement-based quantum key distribution network without trusted node, PhotoniX 3, 1 (2022).
  * Lu  _et al._ [2021] Y.-S. Lu, X.-Y. Cao, C.-X. Weng, J. Gu, Y.-M. Xie, M.-G. Zhou, H.-L. Yin, and Z.-B. Chen, Efficient quantum digital signatures without symmetrization step, Opt. Express 29, 10162 (2021).
  * Aktas  _et al._ [2016] D. Aktas, B. Fedrici, F. Kaiser, T. Lunghi, L. Labonté, and S. Tanzilli, Entanglement distribution over 150 km in wavelength division multiplexed channels for quantum cryptography, Laser Photonics Rev. 10, 451 (2016).
  * Chang  _et al._ [2016] X.-Y. Chang, D.-L. Deng, X.-X. Yuan, P.-Y. Hou, Y.-Y. Huang, and L.-M. Duan, Experimental realization of an entanglement access network and secure multi-party computation, Sci. Rep. 6, 29453 (2016).
  * Lim  _et al._ [2008] H. C. Lim, A. Yoshizawa, H. Tsuchida, and K. Kikuchi, Broadband source of telecom-band polarization-entangled photon-pairs for wavelength-multiplexed entanglement distribution, Opt. Express 16, 16052 (2008).
  * Bennett  _et al._ [1996] C. H. Bennett, D. P. DiVincenzo, J. A. Smolin, and W. K. Wootters, Mixed-state entanglement and quantum error correction, Phys. Rev. A 54, 3824 (1996).
  * Ekert [1991] A. K. Ekert, Quantum cryptography based on bell’s theorem, Phys. Rev. Lett. 67, 661 (1991).
  * Koashi and Preskill [2003] M. Koashi and J. Preskill, Secure quantum key distribution with an uncharacterized source, Phys. Rev. Lett. 90, 057902 (2003).
  * Jennewein  _et al._ [2000] T. Jennewein, C. Simon, G. Weihs, H. Weinfurter, and A. Zeilinger, Quantum cryptography with entangled photons, Phys. Rev. Lett. 84, 4729 (2000).
  * Lo and Chau [1999] H.-K. Lo and H. F. Chau, Unconditional security of quantum key distribution over arbitrarily long distances, S cience 283, 2050 (1999).
  * Shor and Preskill [2000] P. W. Shor and J. Preskill, Simple proof of security of the bb84 quantum key distribution protocol, Phys. Rev. Lett. 85, 441 (2000).
  * De Oliveira  _et al._ [2014] T. R. De Oliveira, M. F. Cornelio, and F. F. Fanchini, Monogamy of entanglement of formation, Physical Review A 89, 034303 (2014).
  * Kok and Braunstein [2000] P. Kok and S. L. Braunstein, Postselected versus nonpostselected quantum teleportation using parametric down-conversion, Phys. Rev. A 61, 042304 (2000).
  * Ma  _et al._ [2007] X. Ma, C.-H. F. Fung, and H.-K. Lo, Quantum key distribution with entangled photon sources, Phys. Rev. A 76, 012307 (2007).
  * Yin  _et al._ [2020] H.-L. Yin, M.-G. Zhou, J. Gu, Y.-M. Xie, Y.-S. Lu, and Z.-B. Chen, Tight security bounds for decoy-state quantum key distribution, Sci. Rep. 10, 14312 (2020).
  * Chernoff [1952] H. Chernoff, A measure of asymptotic efficiency for tests of a hypothesis based on the sum of observations, The Annals of Mathematical Statistics , 493 (1952).
  * Li  _et al._ [2022] H.-W. Li, C.-M. Zhang, M.-S. Jiang, and Q.-Y. Cai, Improving the performance of practical decoy-state quantum key distribution with advantage distillation technology, Communications Physics 5, 53 (2022).
  * Zhang  _et al._ [2024] C.-M. Zhang, Z. Wang, Y.-D. Wu, J.-R. Zhu, R. Wang, and H.-W. Li, Discrete-phase-randomized twin-field quantum key distribution with advantage distillation, Phys. Rev. A 109, 052432 (2024).