# Security flaw of counterfactual quantum cryptography in practical setting

Yan-Bing Li1,2,3, Qiao-yan Wen1, Zi-Chen Li2 1State Key Laboratory of
Networking and Switching Technology, Beijing University of Posts and
Telecommunications, Beijing, 100876, China
2Beijing Electronic Science and Technology Institute,Beijing 100070,China
3Department of Electrical Engineering and Computer Science, Northwestern
University, Evanston, Illinois 60208, USA<EMAIL_ADDRESS>
###### Abstract

Recently, counterfactual quantum cryptography proposed by T. G. Noh [Phys.
Rev. Lett. 103, 230501 (2009)] becomes an interesting direction in quantum
cryptography, and has been realized by some researchers (such as Y. Liu et
al’s [Phys. Rev. Lett. 109, 030501 (2012)]). However, we find out that it is
insecure in practical high lossy channel setting. We analyze the secret key
rates in lossy channel under a polarization-splitting-measurement attack.
Analysis indicates that the protocol is insecure when the loss rate of the
one-way channel exceeds $50\%$.

##  1 Introduction

Quantum cryptography allows higher security than classical cryptography as it
is based on the laws of physics instead of the difficulty of solving
mathematical problems. Quantum key distribution (QKD)[1]-[3], which is to
provide secure means of distributing secret keys between the sender (Alice)
and the receiver (Bob), is often used to represent quantum cryptography as the
primary most important part. Now it has been researched and developed in both
theoretics and experiments. In theoretic, QKD could offer unconditional
security guaranteed by the laws of physics[4]. But due to the limitations of
real-life setting[5], such as the imperfect source, imperfect detector, loss
and noise in channel, practical QKD has security loopholes and has suffered
some attacks, such as photon number splitting (PNS) attack[6], Trojan-horse
attack[7], faked state attack[8]. On the other hand, some achievements, such
as decoy states mothod[9], measurement-device-independent QKD (MDI-QKD)
scheme[10] were made to let practical QKD be more secure.

Recently, counterfactual quantum cryptography proposed by Noh[11] has
attracted a lot of research, which allows participants to share secret
information using counterfactual quantum phenomena. It is believed that the
security is based on that quantum particles carrying secret information are
seemingly not transmitted through quantum channels. So far, some security
proof[12], improvements[13] and experimental demonstrations[14]-[18] of
counterfactual quantum cryptography have been proposed.

However, we find out the counterfactual quantum cryptography[11] is insecure
in practical long distance communication. The secret key rate will be $0$
under a polarization-splitting-measurement attack when the loss rate of the
one-way channel is no less than $50\%$. Namely, the eavesdropper (commonly
called Eve) can obtain all the secret information. Nevertheless, the cheat is
unknowable to Alice and Bob because its effect just likes a reasonable loss in
practical channel.

This paper is organized as follows. Sec. II reviews the counterfactual QKD
proposed in Ref.[11]. In Sec. III, We analyze the error rate of raw key in
lossy channel. A polarization-splitting-measurement attack is given in Sec.
IV. In Sec. V, we analyze the secret key rate under the attack. Finally, a
short conclusion are provided in Section VI.

##  2 Counterfactual QKD

Figure 1: (color online). The schematic of counterfactual QKD. For simpleness,
we have made some equivalent adjustments on the original one. Whole space is
divided by dotted line into three sub-spaces, Alice’s site, Bob’s site and
public space (i.e., Eve’s space). Alice sends the $i$th single-photon in state
$|V\rangle$ or $|H\rangle$, representing bit $0$ or $1$, to beam splitter
$BS_{1}$. Then the split pulses are transmitted into two paths $a$ which is
always in Alice’s site, and $b$ which is in public space toward Bob’s site.
Bob randomly uses $|V\rangle$ (representing $0$) or $|H\rangle$ (representing
$1$) $PBS$ to block the pulse in path $b$ when his bit is identical to
Alice’s, or let it pass when his bit is differ to Alice’s. When their bits are
different, detectors $D_{2}$ should always click since the interferometry
happens in $BS_{2}$. Else when their bits are same, the detectors $D_{1}$ and
$D_{2}$ and $D_{3}$ will click with some probabilities since interaction-free
measurement happens. Additional, it is assumed that all of $D_{1}$, $D_{2}$
and $D_{3}$ could detect the state’s polarization $|V\rangle$ or $|H\rangle$.
All the $D_{2}$’s and $D_{3}$’s clicks and a part of $D_{1}$’s clicks are used
to detect eavesdropping, and the rest of $D_{1}$’s clicks with correct
polarization are used as the raw key.

Fig.1 is the schematic of counterfactual QKD[11]. For simpleness, we have made
some equivalent adjustments on it. Alice triggers the single-photon source
$S$, which emits a short optical pulse containing a single photon at a certain
time interval. She randomly chooses the photon polarization in $|V\rangle$
representing the bit value 0 , or $|H\rangle$ representing the bit value 1 .
Thereafter, the photon enters a beam splitter $BS_{1}$ and is split to two
wave pulses $s_{a}$ and $s_{b}$. Then the system state evolves into one of the
following states:

$\displaystyle|\phi_{0}\rangle=\sqrt{R}|0\rangle_{a}|V\rangle_{b}+\sqrt{T}|V\rangle_{a}|0\rangle_{b},$
(1)
$\displaystyle|\phi_{1}\rangle=\sqrt{R}|0\rangle_{a}|H\rangle_{b}+\sqrt{T}|H\rangle_{a}|0\rangle_{b}.$
(2)

where subscripts $a$ and $b$ represent the path towards Alice’s site and the
path toward Bob’s site, respectively, and $|0\rangle$ denotes the vacuum state
in the path $a$ or $b$. $R$ and $T=1-R$ are the reflectivity and
transmissivity of both $BS_{1}$ and $BS_{2}$, respectively.

Bob has two polarizing beam splitter (PBS), $|V\rangle$ PBS (representing the
bit value 0 ) and $|H\rangle$ PBS (representing the bit value 1 ), where
$|V\rangle$ (or $|H\rangle$) PBS means it addresses the state $|V\rangle$ (or
$|H\rangle$) towards detector $D_{3}$, while the state $|H\rangle$ (or
$|V\rangle$) is sent towards the beam splitter $BS_{2}$. He randomly chooses
to use the $|V\rangle$ PBS or $|H\rangle$ PBS as his device $PBS_{1}$.

If Alice and Bob’s bits are different, the pulse on path $b$ will be reflected
by Bob and combined again at Alice’s device $BS_{2}$. The case just likes an
interferometry with a single photon. In the ideal setting, detector $D_{2}$
will click with certainty. Else if Alice and Bob’s bits are identical, the
path $b$ will be blocked by Bob’s $PBS_{1}$. The case just likes an
interaction-free measurement with a single photon. Here the state
$|\phi_{0}\rangle$ will be collapsed to $|0\rangle_{a}|V\rangle_{b}$ or
$|V\rangle_{a}|0\rangle_{b}$, $|\phi_{1}\rangle$ will be collapsed to
$|0\rangle_{a}|H\rangle_{b}$ or $|H\rangle_{a}|0\rangle_{b}$. In the ideal
setting, detector $D_{1}$, $D_{2}$ and $D_{3}$ will click with probability
$RT$, $T^{2}$ and $R$, respectively.

So in the ideal setting, $D_{1}$ clicks means Alice’s source photon basis and
Bob’s PBS basis are identify. Then Alice and Bob have a certain amount of
identify bits, some of which could be used to check possible eavesdropping,
and the rest of with could be used as raw key bits. And some statistical laws
are between $D_{2}$’s, $D_{3}$’s clicks and Alice, Bob’s bits, which could be
used to check possible eavesdropping and judge error rate. Additional, it is
assumed that all the detectors $D_{1}$, $D_{2}$ and $D_{3}$ could detect the
state’s polarization $|V\rangle$ and $|H\rangle$, which also could be used to
check possible eavesdropping.

Since the raw key bits come from the events of $D_{1}$ clicks which means that
Bob’s measurement result is vacuum state, peoples feel that the participles
which carry secret information seemingly have not travelled between Alice and
Bob. In fact, its security is based on a type of noncloning principle for
orthogonal states[11]: if reduced density matrices of an available subsystem
are nonorthogonal and the other subsystem is not allowed access, it is
impossible to distinguish two orthogonal quantum states $|\phi_{0}\rangle$ and
$|\phi_{1}\rangle$ without disturbing them.

##  3 Users’ error raw key rate depend on lossy channel

Similar to other QKD schemes, the limitations of real-life setting will also
bring some troubles to counterfactual QKD. Specially, high lossy channel will
be a formidable difficulty to it. In this section, we will analyze the error
rate of users’ raw key pair, i.e., the different rate of Alice and Bob’s raw
key pair, depend on lossy channel. ( Besides the the loss in channel, some
other loss also appear in the source and the devices and some noise appear in
the source, channel and the devices, but they are not in the paper’s range.)

In the counterfactual QKD, the raw key rate is proportional to the single
detector click rate ( i.e., the rate of the case in which only one of
detectors $D_{1}$, $D_{2}$ and $D_{3}$ clicks), which will be affected by
source single photon rate $R_{single}$ and the loss rate. Symmetrically, we
suppose that both the loss rates in channel from Bob to Alice, and that from
Alice to Bob are $\eta$, i.e., the single photon will loss with probability
$\eta$ in one of the two channels. We recall that (1) Alice’s raw key bits are
generated from the source single photons’ bases. (2) Bob’s raw key bits are
generated from his $PBS_{1}$’s basis, i.e., state in which basis would be sent
from $PBS_{1}$ toward $D_{3}$.

Then we analyze the cases in which the raw key will be generated by Alice and
Bob. The analysis will be done on one single photon sent by Alice, which is in
state $|V\rangle$ or $|H\rangle$ with probability $1/2$ respectively. And we
suppose that the channel loss in the channel in public space and Bob’s site,
which is denoted as channel $c_{A\rightarrow B\rightarrow A}$ and could be
divided to two parts ( the channels from Alice to Bob $b_{A\rightarrow B}$ and
from Bob to Alice $b_{B\rightarrow A}$), is independent with state’s
polarization $|V\rangle$ and $|H\rangle$, i.e., all the possible wave pulse
will loss when channel loss happens. ( Note that the channel loss in
$c_{A\rightarrow B\rightarrow A}$ is different to the loss happens in Bob’s
PBS in which only one polarization is blocked. And also note that channel loss
in $c_{A\rightarrow B\rightarrow A}$ does not mean that the photon vanishes in
$c_{A\rightarrow B\rightarrow A}$ with certainly since it might go through
path $a$ probably.) Theses cases are divided by two elements (i) whether the
loss happens or not in the channel in public space and Bob’s site (then we
divide the channel $c_{A\rightarrow B\rightarrow A}$ to two parts, the
channels from Alice to Bob $b_{A\rightarrow B}$ and from Bob to Alice
$b_{B\rightarrow A}$) and (ii) if loss happens, whether it happens in the
channels $b_{A\rightarrow B}$ or $b_{B\rightarrow A}$.

_Case I._ Channel loss does not happen either on $b_{A\rightarrow B}$ or
$b_{B\rightarrow A}$.

This case just like the single photon has transmitted in a no-lossy channel.
Namely, there are not any blocks except the possible block from Bob’s PBS.
Case I will generate a raw key bit with probability $P_{1}=\frac{RT}{2}$ as
the reasons (1) Bob’s PBS blocks the special polarization with probability
$\frac{1}{2}$ (2) a raw key bit will be generated with probability $RT$ when
Bob’s PBS blocks the special polarization.

As both of the loss rates in the channels $b_{A\rightarrow B}$ and
$b_{B\rightarrow A}$ are $\eta$, channel loss will not happen on
$b_{A\rightarrow B}$ and $b_{B\rightarrow A}$ with probability $1-\eta$
respectively. So the Case I, channel loss does not happen either on
$b_{A\rightarrow B}$ or $b_{B\rightarrow A}$, will occur with probability
$P_{I}=(1-\eta)^{2}$. The raw key rate comes from Case I is

$R_{raw_{1}}^{AB}=P_{I}\cdot P_{1}\cdot
R_{single}=(1-\eta)^{2}\cdot\frac{RT}{2}\cdot R_{single}.$ (3)

Alice and Bob’s raw key are identify in this case.

_Case II._ Channel loss happens in the channel $b_{A\rightarrow B}$,
regardless of whether channel loss happens in the channel $b_{B\rightarrow A}$
or not.

When channel loss happened in $b_{A\rightarrow B}$, no wave pulse will pass
through $b_{B\rightarrow A}$, so we combine the cases that (II-1) channel loss
happens both in the channels $b_{A\rightarrow B}$ and $b_{B\rightarrow A}$
(II-2) channel loss only happens in the channel $b_{A\rightarrow B}$, not in
the channel $b_{B\rightarrow A}$ to Case II. Case II will generate an
additional raw key bit with probability $P_{2}=RT$ as following analysis.

Without loss of generality, we suppose the single photon Alice sent is
$|V\rangle$. After $BS_{1}$, the state could be described as Eq.(1a). When it
comes into Bob’s site, the state evolves to $|V\rangle_{a}|0\rangle_{b}$ with
probability $T$, or $|0\rangle_{a}|0\rangle_{b}$ with probability $R$ as the
possible pulse wave $|V\rangle_{b}$ lost in the channel $b_{A\rightarrow B}$.
The state $|0\rangle_{a}|0\rangle_{b}$ will not lead to any clicks, so no raw
key will be generated. But as the state $|V\rangle_{a}|0\rangle_{b}$, the
photon in path $a$ will fire detector $D_{1}$ and let Alice generate a raw key
bit with probability $R$, fire detector $D_{2}$ with probability $T$. After
Alice announced that $D_{1}$ clicked, Bob would generate an according raw key
bit based on his $PBS$’s basis, i.e., state in which basis is sent toward
$D_{3}$. So Case II will generate an additional raw key bit with probability
$T\cdot R$ as following analysis.

Case II will happen with probability $P_{II}=\eta$. Hence, with the loss in
channel from Alice to Bob, additional raw key bits are generated, the totally
rate of which is

$R_{raw_{2}}^{AB}=P_{II}\cdot P_{2}\cdot R_{single}=\eta\cdot RT\cdot
R_{single}.$ (4)

Since Bob has chosen his $PBS$’s basis randomly, his raw key bit will be
identify, and different with Alice’s with equal probability $1/2$. So both of
the correct and error raw key rates are $\frac{R_{raw_{2}}^{AB}}{2}$.

_Case III._ Channel loss does not happen in the channel $b_{A\rightarrow B}$,
but happens in the channel $b_{B\rightarrow A}$. Namely, a complete block is
in the channel $b_{B\rightarrow A}$ except the possible block from Bob’s PBS.
Case III will generate a raw key bit with probability $P_{3}=RT$ as following
analysis.

We still suppose the single photon Alice sent is $|V\rangle$. If Bob’s $PBS$
basis is same with Alice’s basis, Bob’s $PBS$ will send possible wave pulse
$|V\rangle_{b}$ toward $D_{3}$. On one hand, the system state evolves to
$|0\rangle_{a}|V\rangle_{b}$ with probability $R$, which means that the photon
went through path $b$, and it will be destroyed by detector $D_{3}$. So no
pulse wave will transmit from Bob to Alice. On the other hand, the system
state evolves to $|V\rangle_{a}|0\rangle_{b}$ with probability $T$, which
means that the photon went through path $a$, then it will fire detectors
$D_{1}$ and $D_{2}$ with probabilities $R$ and $T$ respectively. Bob will
generate a raw key bit which is identify with Alice’s after she announces that
$D_{1}$ clicked, whose probability is $T\cdot R$.

Else if Bob’s $PBS$ basis is different with Alice’s basis, Bob’s $PBS$ would
pass possible wave pulse $|V\rangle_{b}$, and send it back to Alice. After it
lost in the channel from Bob to Alice, the system state evolves to
$|0\rangle_{a}|0\rangle_{b}$ (with probability $R$) which means that it is
destroyed by the lossy channel, or $|V\rangle_{a}|0\rangle_{b}$ (with
probability $T$) which means that it will fire $D_{1}$ or $D_{2}$ with
probabilities $R$ and $T$, respectively. Bob will generate a raw key bit which
is identify with Alice’s after she announces that $D_{1}$ clicked, whose
probability is $T\cdot R$.

So regardless Bob’s $PBS$ basis is $|V\rangle$ or $|H\rangle$, this case will
generate a raw key bit with probability $RT$. But Alice’s and Bob’s bits are
same and different with equal probability $\frac{1}{2}$.

The case will happen with probability $P_{III}=(1-\eta)\cdot\eta$ as channel
loss does not happen in the channel $b_{A\rightarrow B}$ with probability
$1-\eta$, happens in the channel $b_{B\rightarrow A}$ with probability $\eta$.
Hence, with the loss in channel from Bob to Alice, additional raw key bits is
generated, the totally rate of which is

$R_{raw_{3}}^{AB}=P_{III}\cdot P_{3}\cdot R_{single}=(1-\eta)\cdot\eta\cdot
RT\cdot R_{single}.$ (5)

Both of the same and different raw key rates are $\frac{R_{raw_{3}}}{2}$.

All in all, the raw key rate is

$\begin{array}[]{ll}R_{raw}^{AB}=R_{raw_{1}}^{AB}+R_{raw_{2}}^{AB}+R_{raw_{3}}^{AB}\\\
\hskip 25.60747pt=\frac{1+2\eta-\eta^{2}}{2}\cdot TR\cdot
R_{single}.\end{array}$ (6)

The probability of that Alice’s and Bob’s raw keys in a same order are
identify is

$\begin{array}[]{ll}P_{raw}^{AB\\_same}=\frac{R_{raw_{1}}^{AB}+\frac{R_{raw_{2}}^{AB}}{2}+\frac{R_{raw_{3}}^{AB}}{2}}{R_{raw}}\\\
\hskip 45.5244pt=\frac{1}{1+2\eta-\eta^{2}},\end{array}$ (7)

the probability of that they are different is

$\begin{array}[]{ll}P_{raw}^{AB\\_diff}=\frac{\frac{R_{raw_{2}}^{AB}}{2}+\frac{R_{raw_{3}}^{AB}}{2}}{R_{raw}}\\\
\hskip 42.67912pt=\frac{2\eta-\eta^{2}}{1+2\eta-\eta^{2}}.\end{array}$ (8)

Namely, in users’ raw key pair, the error rate is $P_{raw}^{AB\\_diff}$ which
should be correct by some following classical postprocessing such as
information reconciliation.

The error in users’ raw key pairs will give a lot of chances to Eve to perform
some attacks. But to Eve, the first aim is that her attacks should not be
detected by the users. Following polarization-splitting-measurement attack is
one of the attacks.

##  4 Polarization-splitting-measurement attack

Usually, we assume that Eve has unlimited technological, which is only limited
by the laws of nature. So Eve could replace the lossy channel by a perfect
quantum channel, and use the excess power for her mischievous purposes. In
this section, we first give an attack method which can cheat the raw key bits
and be concealed by the practical lossy channel with loss rate $\frac{1}{2}$,
then give the special cheat strategies according to special loss rate range
for cheating maximal information.

In the _attack method_ , polarization-splitting and measurement will be used
to cheat secret information from channel $b_{A\rightarrow B}$ (shown in
fig.2). Eve first replaces the lossy channel $b_{A\rightarrow B}$ by a perfect
quantum channel. She also has two polarizing beam splitters, $|V\rangle$ PBS
representing the bit value $0$ and $|H\rangle$ PBS representing the bit value
$1$. She randomly chooses the $|V\rangle$ or $|H\rangle$ PBS for the $i$th
order, and inserts it in front of Bob’s site.

If Eve’s $i$th bit is identical with Alice’s $i$th bit, the detector $D_{4}$
will click with probability $R$, else if her $i$th bit is differ to Alice’s
$i$th bit, the detector $D_{4}$ will not click. In other words, the case that
$D_{4}$ clicks means that Eve’s bit is identical to Alice’s $i$th bit, and the
case that $D_{4}$ does not click means that Eve is uncertain about Alice’s
$i$th bit now. We recall that Alice and Bob’s raw key pair will product from
these uncertain bits corresponding to the case that detector $D_{4}$ does not
click. So Eve cannot make sure of the raw key bit. However, Eve could easily
extract the raw key bit according to what Alice and Bob will announce in the
following processing.

Figure 2: (color online). The schematic of polarization-splitting-measurement
attack on counterfactual QKD. Eve performs attack on channel $b_{A\rightarrow
B}$ in front of Bob’s site. Eve replaces the lossy channel $b_{A\rightarrow
B}$ by a perfect quantum channel. Then she randomly uses $|V\rangle$
(representing $0$) or $|H\rangle$ (representing $1$) $PBS$ to block the pulse
in path $b_{A\rightarrow B}$ when her bit is identical to Alice’s, or let it
pass when her bit is differ to Alice’s. What she dose just like a reasonable
loss in path $b_{A\rightarrow B}$.

Without loss of generality, we consider the case of Eve chooses $0$, i.e., she
inserts a $|V\rangle$ PBS. When Alice’s bit is $0$, two possible cases are
here. (1) When Eve’s detector $D_{4}$ clicked, the system state has been
collapsed to $|0\rangle_{a}|V\rangle_{b}$ which means Alice’s bit is identical
to Eve’s bit $0$, and vacuum state will go into Bob’s site. (2) Else when
Eve’s detector $D_{4}$ did not click, the system has been collapsed to
$|V\rangle_{a}|0\rangle_{b}$, and vacuum state still will go into Bob’s site.
Altogether, vacuum state (i.e., nothing) always will go into Bob’s site when
Eve and Alice’s bits are same, which likes the pulse in path $b$ has lost
completely by the lossy channel.

On the other hand, when Alice’s bit is $1$, the pulse in path $b$ will pass
Eve’s $PBS_{2}$ completely, so the system state still is
$|\phi_{1}\rangle$($=\sqrt{R}|0\rangle_{a}|H\rangle_{b}+\sqrt{T}|H\rangle_{a}|0\rangle_{b}$)
after Eve’s devices. The case is same to that Eve has done nothing, liking the
ideal setting. In the point view of Alice and Bob, all the following processes
will just like the normal processes. When $D_{1}$ clicks, the corresponding
bit will be chosen as a raw key bit by Alice followed by announcing its order.
Then Eve can always make sure that Alice’s raw key bit is $1$. In other words,
when Eve and Alice’s bits are different, a raw key bit will be produced with
probability. And the probability will be revealed with Alice’s announcement.
Since the raw key bit is generated from the inverse of Eve’s $PBS_{2}$’s
basis, Eve can not only know the raw key bits, but also decide its value with
some probability.

Since Eve chooses bit $0$ or $1$ randomly, her bit will be same and different
with Alice’s bit with probability $1/2$ respectively. The complete loss will
happen when their bits are same, and the ideal setting will happen when their
bits are different. Totally, the cheat method likes a loss of rate
$\frac{1}{2}$ happens in the channel $b_{A\rightarrow B}$. The cheat method
could be used on every photon to cheat the secret information when
$\eta=\frac{1}{2}$ and will not be detected (the analysis will be given in the
following). To other value of $\eta$, more complex strategies should be
designed for optimal cheating.

We suppose the amount of Alice sent single photons is $n$. Using the above
attack method, Eve could simulate practical loss channel with loss rate
$0\leq\eta\leq 1$ and cheat raw key bits with following strategies.

_Cheat strategy (I)_ When $0\leq\eta<\frac{1}{2}$, Eve performs the attack
method on $2\eta\cdot n$ single photons randomly, and fills the raw key orders
which she has not attacked in with random bits.

_Cheat strategy (II)_ When $\frac{1}{2}\leq\eta\leq 1$, Eve performs the
attack method on $2(1-\eta)\cdot n$ single photons randomly, and blocks the
remaining $(2\eta-1)\cdot n$ single photons. After Alice announced in which
orders the remaining single photons have fired detector $D_{1}$, she fills
these raw key orders in with random bits.

Like the loss in practical channel, what Eve did has brought some errors to
the protocol (we will analyze the details in next section). For instance, some
$D_{1}$’s clicks happened not only when Alice and Bob’s bits were same, but
also when they were different as long as Eve blocked the channel. However,
since the error rate is same as that brought by practical lossy channel, it
will be judged as a legal case by the protocol’s detection process. The basis
reason is that, the system state under the above cheat strategies is same to
the system state transmitted from a practical channel. We will analyze it as
follows.

We suppose the photon Alice sent is $|V\rangle$. If Eve’s $PBS$ past wave
pulse $|V\rangle$ to Bob’s site, the density matrix of system state is

$\begin{array}[]{ll}\rho_{1}^{attack}=|\phi_{0}\rangle\langle\phi_{0}|,\end{array}$
(9)

when it comes into Bob’s site. If Eve’s $PBS$ blocked wave pulse $|V\rangle$,
the system state is a mixed state with density matrix

$\begin{array}[]{ll}\rho_{2}^{attack}=R|0\rangle_{a}|0\rangle_{b}\langle
0|_{b}\langle 0|_{a}+T|V\rangle_{a}|0\rangle_{b}\langle 0|_{b}\langle
V|_{a},\end{array}$ (10)

when it comes into Bob’s site.

So after the strategy (I), the system state is a mixed state with density
matrix

$\begin{array}[]{ll}\rho_{I}^{attack}=(1-2\eta)\cdot|\phi_{0}\rangle\langle\phi_{0}|+\eta\cdot\rho_{1}^{attack}+\eta\cdot\rho_{2}^{attack}\\\
\hskip
31.29802pt=(1-\eta)\cdot\rho_{1}^{attack}+\eta\cdot\rho_{2}^{attack},\end{array}$
(11)

where $0\leq\eta<\frac{1}{2}$. After the strategy (II), the system state is a
mixed state with density matrix

$\begin{array}[]{ll}\rho_{II}^{attack}=(1-\eta)\cdot\rho_{1}^{attack}+[(1-\eta)+(2\eta-1)]\cdot\rho_{2}^{attack}\\\
\hskip
31.29802pt=(1-\eta)\cdot\rho_{1}^{attack}+\eta\cdot\rho_{2}^{attack},\end{array}$
(12)

where $\frac{1}{2}\leq\eta\leq 1$.

Now we analyze the system state in practical lossy channel without the attack
strategies. If the wave pulse in channel $b_{A\rightarrow B}$ has not lost,
the density matrix of the system state is

$\begin{array}[]{ll}\rho_{1}^{loss}=|\phi_{0}\rangle\langle\phi_{0}|,\end{array}$
(13)

when it come into Bob’s site. If the wave pulse in channel $b_{A\rightarrow
B}$ has lost, the system state will be a mixed state with density matrix

$\begin{array}[]{ll}\rho_{2}^{loss}=R|0\rangle_{a}|0\rangle_{b}\langle
0|_{b}\langle 0|_{a}+T|V\rangle_{a}|0\rangle_{b}\langle 0|_{b}\langle
V|_{a}\end{array}$ (14)

when it come into Bob’s site.

Since the loss rate is $\eta$ on the practical lossy channel $b_{A\rightarrow
B}$, the general system state is a mixed state with density matrix

$\begin{array}[]{ll}\rho^{loss}=(1-\eta)\cdot\rho_{1}^{loss}+\eta\cdot\rho_{2}^{loss}\\\
\hskip
22.76219pt=(1-\eta)\cdot\rho_{1}^{attack}+\eta\cdot\rho_{2}^{attack},\end{array}$
(15)

when it goes into Bob’s site, which is same with $\rho_{I}^{attack}$ when
$0\leq\eta<\frac{1}{2}$, $\rho_{II}^{attack}$ when $\frac{1}{2}\leq\eta\leq
1$.

So the states are same either when the protocol suffers a lossy channel or
when it is under the cheat strategies. The conclusion is still tenable when
the photon Alice sent is $|H\rangle$. Consequently, Alice and Bob could not
distinguish between the practical lossy channel and the cheat strategies.

##  5 Secret key rate under the cheat strategies in lossy channel

In this section, we will analyze the protocol in lossy channel with the secret
key rate $R_{QKD}$[19, 20], a convenient and commonly used quantitate measure
of protocol security.

Secret key rate $R_{QKD}$ is the product of the raw key rate $R_{raw}$ and the
secret fraction $r_{\infty}$. The secret fraction represents the fraction of
secure bits that may be extracted from the raw key. Formally, we have

$R_{QKD}=R_{raw}\cdot r_{\infty}.$ (16)

The expression for the secret fraction extractable[19, 21] using one-way
classical postprocessing reads

$r_{\infty}=I(A;B)-\min(I_{EA},I_{EB}),$ (17)

where $I(A;B)$ is Alice and Bob’s mutual information,
$I_{EA}=\max_{Eve}I(A;E)$, $I_{EB}=\max_{Eve}I(B;E)$. Since Alice and Bob’s
each raw key pair is randomly in $\\{0,1\\}$, it should be $H(A)=H(B)=1$. We
also have $P(A=0,B=0)=P(A=1,B=1)=P_{raw}^{AB\\_same}/2$,
$P(A=0,B=1)=P(A=1,B=0)=P_{raw}^{AB\\_diff}/2$. Combined with Eqs.(6) and (7),
it should be that

$\begin{array}[]{ll}I(A;B)=H(A)+H(B)-H(A,B)\\\ \hskip
34.1433pt=1+1+\sum_{A\in\\{0,1\\},B\in\\{0,1\\}}p(A,B)\log p(A,B)\\\ \hskip
34.1433pt=2+2\cdot\frac{1}{2(1+2\eta-\eta^{2})}\log\frac{1}{2(1+2\eta-\eta^{2})}\\\
\hskip
45.5244pt+2\cdot\frac{2\eta-\eta^{2}}{2(1+2\eta-\eta^{2})}\log\frac{2\eta-\eta^{2}}{2(1+2\eta-\eta^{2})}.\end{array}$
(18)

Then we analyze the secret key rate under the cheat strategies (I) and (II)
respectively depend on the loss rate $\eta$ by calculating
$\min(I_{EA},I_{EB})$.

We recall that (1) Alice’s raw key bits are generated from the source single
photons’ bases. (2) Bob’s raw key bits are generated from his $PBS_{1}$’s
basis, i.e., state in which basis would be sent from $PBS_{1}$ toward $D_{3}$.
(3) Eve’s raw key bits are generated from the inverse of her $PBS_{2}$’s
basis, i.e., state in which basis would be sent from $PBS_{2}$ toward Bob’s
site. Now we analyze the cases in which the raw key will be cheated by Eve
when she cheats in the channel from Alice to Bob. And we still suppose the
single photon Alice sent is $|V\rangle$.

###  5.1 Secret key rate under the cheat strategy (I) in lossy channel

We first analyze the cases in _cheat strategy (I)_ , i.e., the strategy with
$0\leq\eta<\frac{1}{2}$. We recall _Cheat strategy (I)_ : When
$0\leq\eta<\frac{1}{2}$, Eve performs the attack method on $2\eta\cdot n$
single photons randomly, and fills the raw key orders which she has not
attacked in with random bits. We divide the cases with elements (i) whether
Eve performs the attack method or not and (ii) if Eve performs the attack
method, whether her $PBS$ basis is same with Alice’s basis or not.

_Cheated raw key I._ The cheated raw key when Eve does not perform the attack
method.

For $0\leq\eta<\frac{1}{2}$, Eve does not perform the attack method on
$(1-2\eta)\cdot n$ source single photons, in which raw key bits will be
generated as the _case I_ and _case III_ (shown in Sec.III). Due to that the
loss rate in the channel $b_{A\rightarrow B}$ is $\eta$, _case I_ will happen
with probability $(1-2\eta)\cdot(1-\eta)$, _case III_ will happen with
probability $(1-2\eta)\cdot\eta$. The totally rate of these raw key is

$\begin{array}[]{ll}R_{raw_{1}}^{E}=((1-2\eta)\cdot(1-\eta)\cdot
P_{1}+(1-2\eta)\cdot\eta\cdot P_{3})\cdot R_{single}\\\ \hskip
31.29802pt=\frac{1-\eta-2\eta^{2}}{2}\cdot RT\cdot R_{single}.\end{array}$
(19)

Eve will guess these raw key bits, so the correct probability is
$\frac{1}{2}$. So compared to Alice’s and Bob’s raw keys, both of Eve’s same
and different raw key rates in this case are

$\begin{array}[]{ll}R_{raw_{1}}^{EA\\_same}=R_{raw_{1}}^{EA\\_diff}=R_{raw_{1}}^{EB\\_same}=R_{raw_{1}}^{EB\\_diff}\\\
\hskip 48.36967pt=\frac{1-\eta-2\eta^{2}}{4}\cdot RT\cdot
R_{single}.\end{array}$ (20)

_Cheated raw key II._ The cheated raw key when Eve performs the attack method,
and her $PBS$ basis is same with Alice’s basis.

When Eve’s $PBS$ basis is same with Alice’s basis (namely, Eve’s $PBS$ will
send wave pulse $|V\rangle$ toward $D_{4}$), raw key bits will be generated as
the _case II_(shown in Sec.III). It will happen with probability $\eta$. So
the totally rate of these raw key is

$\begin{array}[]{ll}R_{raw_{2}}^{E}=\eta\cdot P_{2}\cdot R_{single}\\\ \hskip
31.29802pt=\eta\cdot RT\cdot R_{single}.\end{array}$ (21)

Since Eve always generates her raw key bit as the inverse of her $PBS_{2}$’s
basis, all her raw key bits are different to Alice’s, and different to Bob’s
with probability $\frac{1}{2}$. Compared to Alice’s raw key, Eve’s same and
different raw key rates are

$\begin{array}[]{ll}R_{raw_{2}}^{EA\\_same}=0,\\\
R_{raw_{2}}^{EA\\_diff}=\eta\cdot RT\cdot R_{single},\end{array}$ (22)

respectively. Compared to Bob’s raw key, Eve’s same and different raw key
rates are

$\begin{array}[]{ll}R_{raw_{2}}^{EB\\_same}=R_{raw_{2}}^{EB\\_diff}=\frac{\eta}{2}\cdot
RT\cdot R_{single},\end{array}$ (23)

_Cheated raw key III._ The cheated raw key when Eve performs the attack
method, and her $PBS$ basis is different with Alice’s basis.

When Eve’s $PBS$ basis is different with Alice’s basis, Eve’s $PBS$ will send
wave pulse $|V\rangle$ toward Bob’s site. It will happen with probability
$\frac{1}{2}\cdot 2\eta=\eta$. And raw key bits will be generated as the _case
I_ and _case III_. Due to that the loss rate in channel from Bob to Alice is
$\eta$, _case I_ will happen with probability $\eta\cdot(1-\eta)$, _case III_
will happen with probability $\eta\cdot\eta$. So the totally rate of these raw
key is

$\begin{array}[]{ll}R_{raw_{3}}^{E}=[\eta\cdot(1-\eta)\cdot
P_{1}+\eta\cdot\eta\cdot P_{3}]\cdot R_{single}\\\ \hskip
31.29802pt=\frac{\eta+\eta^{2}}{2}\cdot RT\cdot R_{single}.\end{array}$ (24)

Since Eve always generates her raw key bit as the inverse of her $PBS_{2}$’s
basis, all her raw key bits are identify with Alice’s. Compared to Alice’s raw
key, Eve’s same and different raw key rates are

$\begin{array}[]{ll}R_{raw_{3}}^{EA\\_same}=\frac{\eta+\eta^{2}}{2}\cdot
RT\cdot R_{single},\\\ R_{raw_{3}}^{EA\\_diff}=0.\end{array}$ (25)

Compared to Bob’s raw key, Eve’s same and different raw key rates are

$\begin{array}[]{ll}R_{raw_{3}}^{EB\\_same}=\frac{\eta\cdot(1-\eta)}{2}\cdot
RT\cdot R_{single},\\\ R_{raw_{3}}^{EB\\_diff}=\eta\cdot\eta\cdot RT\cdot
R_{single}.\end{array}$ (26)

All in all, the raw key rate Eve cheated is

$\begin{array}[]{ll}R_{raw}^{E}=R_{raw_{1}}^{E}+R_{raw_{2}}^{E}+R_{raw_{3}}^{E}\\\
\hskip 25.60747pt=\frac{1+2\eta-\eta^{2}}{2}RT\cdot R_{single},\end{array}$
(27)

which is same as users’ raw key rate. The probabilities of that Eve and
Alice’s raw key bits are same and different are

$\begin{array}[]{ll}P_{raw}^{EA\\_same}=\frac{P_{raw_{1}}^{EA\\_same}+P_{raw_{2}}^{EA\\_same}+P_{raw_{3}}^{EA\\_same}}{R_{raw}^{E}}\\\
\hskip 45.5244pt=\frac{1+\eta}{2(1+2\eta-\eta^{2})},\\\ \end{array}$ (28)
$\begin{array}[]{ll}P_{raw}^{EA\\_diff}=\frac{P_{raw_{1}}^{EA\\_diff}+P_{raw_{2}}^{EA\\_diff}+P_{raw_{3}}^{EA\\_diff}}{R_{raw}^{E}}\\\
\hskip 42.67912pt=\frac{1+3\eta-2\eta^{2}}{2(1+2\eta-\eta^{2})}.\end{array}$
(29)

The probabilities of that Eve and Bob’s raw key bits are same and different
are

$\begin{array}[]{ll}P_{raw}^{EB\\_same}=\frac{P_{raw_{1}}^{EB\\_same}+P_{raw_{2}}^{EB\\_same}+P_{raw_{3}}^{EB\\_same}}{R_{raw}^{E}}\\\
\hskip 45.5244pt=\frac{1+3\eta-4\eta^{2}}{2(1+2\eta-\eta^{2})},\\\
\end{array}$ (30)

and

$\begin{array}[]{ll}P_{raw}^{EB\\_diff}=\frac{P_{raw_{1}}^{EB\\_diff}+P_{raw_{2}}^{EB\\_diff}+P_{raw_{3}}^{EB\\_diff}}{R_{raw}^{E}}\\\
\hskip 42.67912pt=\frac{1+\eta+2\eta^{2}}{2(1+2\eta-\eta^{2})}.\end{array}$
(31)

. In fact, Eve’s error rate will not be larger than $50\%$ by using a simple
way[22].

Similar to the calculation of $I(A;B)$, combined with Eqs.(27-30) it should be

$\begin{array}[]{ll}I(E;A)^{i}=H(E)+H(A)-H(E,A)\\\ \hskip
39.83385pt=1+1+\sum_{E\in\\{0,1\\},A\in\\{0,1\\}}p(E,A)\log p(E,A)\\\ \hskip
39.83385pt=2+2\cdot\frac{1+\eta}{4(1+2\eta-\eta^{2})}\log\frac{1+\eta}{4(1+2\eta-\eta^{2})}\\\
\hskip
48.36967pt+2\cdot\frac{1+3\eta-2\eta^{2}}{4(1+2\eta-\eta^{2})}\log\frac{1+3\eta-2\eta^{2}}{4(1+2\eta-\eta^{2})},\end{array}$
(32)

and

$\begin{array}[]{ll}I(E;B)^{i}=H(E)+H(B)-H(E,B)\\\ \hskip
39.83385pt=1+1+\sum_{E\in\\{0,1\\},B\in\\{0,1\\}}p(E,B)\log p(E,B)\\\ \hskip
39.83385pt=2+2\cdot\frac{1+3\eta-4\eta^{2}}{4(1+2\eta-\eta^{2})}\log\frac{1+3\eta-4\eta^{2}}{4(1+2\eta-\eta^{2})}\\\
\hskip
48.36967pt+2\cdot\frac{1+\eta+2\eta^{2}}{4(1+2\eta-\eta^{2})}\log\frac{1+\eta+2\eta^{2}}{4(1+2\eta-\eta^{2})},\end{array}$
(33)

Then the secret fraction is

$\begin{array}[]{ll}r_{\infty}^{i}=I(A;B)-\min(I_{EA}^{i},I_{EB}^{i}),\end{array}$
(34)

where $0\leq\eta<\frac{1}{2}$.

For simpleness, we set $R=T=\frac{1}{2}$. Then secret key rate is

$\begin{array}[]{ll}R_{QKD}=R_{raw}\cdot r_{\infty}^{i}\\\ \hskip
31.29802pt=\frac{1+2\eta-\eta^{2}}{8}\cdot r_{\infty}^{i}\cdot
R_{single},\end{array}$ (35)

where $0\leq\eta<\frac{1}{2}$.

###  5.2 Secret key rate under the cheat strategy (II) in lossy channel

Now we analyze the cases in which the raw key will be cheated by Eve using
_cheat strategy (II)_ , i.e., the strategy with $\frac{1}{2}\leq\eta\leq 1$.
We recall _Cheat strategy (II)_ : When $\frac{1}{2}\leq\eta\leq 1$, Eve
performs the attack method on $2(1-\eta)\cdot n$ single photons randomly, and
blocks the remaining $(2\eta-1)\cdot n$ single photons. After Alice announced
in which orders the remaining single photons have fired detector $D_{1}$, she
fills these raw key orders in with random bits.

In the strategy, the attack is performed with probability $2(1-\eta)$
replacing the probability $2\eta$ in _cheat strategy (I)_. So the amount of
raw key rate generated by the attack is
$\frac{1-\eta}{\eta}\cdot(R_{raw_{2}}^{E}+R_{raw_{3}}^{E})$.

In addition, Eve blocks the remaining $(2\eta-1)\cdot n$ wave pulses in the
channel $b_{A\rightarrow B}$ followed by guessing the possible raw key bits.
This just likes _case II_. It will generate raw key bits whose amount is
$(2\eta-1)\cdot P_{2}\cdot R_{single}$. And both of the probabilities of them
are same and different with Alice (and Bob’s) are $\frac{1}{2}$.

Hence, the raw key rate is

$\begin{array}[]{ll}R_{raw}^{E}=[\frac{1-\eta}{\eta}\cdot(R_{raw_{2}}^{E}+R_{raw_{3}}^{E})+(2\eta-1)\cdot
P_{2}]\cdot R_{single}\\\ \hskip 25.60747pt=\frac{1+2\eta-\eta^{2}}{2}RT\cdot
R_{single},\end{array}$ (36)

which is same as users’ raw key rate. The probabilities of that Eve’s and
Alice’s raw key bits are same and different are

$\begin{array}[]{ll}P_{raw}^{EA\\_same}=\frac{\frac{1-\eta}{\eta}\cdot(R_{raw_{2}}^{EA\\_same}+R_{raw_{3}}^{EA\\_same})+\frac{(2\eta-1)}{2}\cdot
P_{2}}{R_{raw}^{E}}\\\ \hskip
45.5244pt=\frac{2\eta-\eta^{2}}{1+2\eta-\eta^{2}},\\\ \end{array}$ (37)

and

$\begin{array}[]{ll}P_{raw}^{EA\\_diff}=\frac{\frac{1-\eta}{\eta}\cdot(R_{raw_{2}}^{EA\\_diff}+R_{raw_{3}}^{EA\\_diff})+\frac{(2\eta-1)}{2}\cdot
P_{2}}{R_{raw}^{E}}\\\ \hskip
45.5244pt=\frac{1}{1+2\eta-\eta^{2}}.\end{array}$ (38)

The probabilities of that Eve’s and Bob’s raw key bits are same and different
are

$\begin{array}[]{ll}P_{raw}^{EB\\_same}=\frac{\frac{1-\eta}{\eta}\cdot(R_{raw_{2}}^{EB\\_same}+R_{raw_{3}}^{EB\\_same})+\frac{(2\eta-1)}{2}\cdot
P_{2}}{R_{raw}^{E}}\\\ \hskip
45.5244pt=\frac{1-\eta+\eta^{2}}{1+2\eta-\eta^{2}},\end{array}$ (39)

and

$\begin{array}[]{ll}P_{raw}^{EB\\_diff}=\frac{\frac{1-\eta}{\eta}\cdot(R_{raw_{2}}^{EB\\_diff}+R_{raw_{3}}^{EB\\_diff})+\frac{(2\eta-1)}{2}\cdot
P_{2}}{R_{raw}^{E}}\\\ \hskip
45.5244pt=\frac{3\eta-2\eta^{2}}{1+2\eta-\eta^{2}}.\end{array}$ (40)

Then we have

$\begin{array}[]{ll}I(E;A)^{ii}=H(E)+H(A)-H(E,A)\\\ \hskip
42.67912pt=1+1+\sum_{E\in\\{0,1\\},A\in\\{0,1\\}}p(E,A)\log p(E,A)\\\ \hskip
42.67912pt=2+2\cdot\frac{2\eta-\eta^{2}}{2(1+2\eta-\eta^{2})}\log\frac{2\eta-\eta^{2}}{2(1+2\eta-\eta^{2})}\\\
\hskip
51.21495pt+2\cdot\frac{1}{2(1+2\eta-\eta^{2})}\log\frac{1}{2(1+2\eta-\eta^{2})},\end{array}$
(41)

and

$\begin{array}[]{ll}I(E;B)^{ii}=H(E)+H(B)-H(E,B)\\\ \hskip
42.67912pt=1+1+\sum_{E\in\\{0,1\\},B\in\\{0,1\\}}p(E,B)\log p(E,B)\\\ \hskip
42.67912pt=2+2\cdot\frac{1-\eta+\eta^{2}}{2(1+2\eta-\eta^{2})}\log\frac{1-\eta+\eta^{2}}{2(1+2\eta-\eta^{2})}\\\
\hskip
51.21495pt+2\cdot\frac{3\eta-2\eta^{2}}{2(1+2\eta-\eta^{2})}\log\frac{3\eta-2\eta^{2}}{2(1+2\eta-\eta^{2})},\end{array}$
(42)

Then the secret fraction is

$\begin{array}[]{ll}r_{\infty}^{ii}=I(A;B)-\min(I_{EA}^{ii},I_{EB}^{ii}),\end{array}$
(43)

where $\frac{1}{2}\leq\eta\leq 1$.

For simpleness, we set $R=T=\frac{1}{2}$. Then secret key rate is

$\begin{array}[]{ll}R_{QKD}=R_{raw}\cdot r_{\infty}^{ii}\\\ \hskip
31.29802pt=\frac{1+2\eta-\eta^{2}}{8}\cdot r_{\infty}^{ii}\cdot
R_{single},\end{array}$ (44)

where $\frac{1}{2}\leq\eta\leq 1$.

###  5.3 Discuss of the secret key rate

Figure 3: (color online). $I(A;B)$ is Alice’s and Bob’s mutual information.
$min(I(E;A),I(E;B))$ is the minimum of Eve’s and Alice’s, Eve’s and Bob’s
mutual information. $r_{\infty}$ is the secret fraction. They are given
compared to loss rate $\eta$. The left figure is the whole show of them. In
the right figure, the ordinate scale is magnified. Figure 4: (color online).
The raw key rate $R_{raw}$ and the secret key rate $R_{QKD}$ compared to loss
rate $\eta$. Here the key rate is the key bit rate generated by one single
photon, and we set $T=R=1/2$. The left figure is the whole show of them. In
the right figure, the ordinate scale is magnified.

Fig.3 shows Alice and Bob’s mutual information $I(A;B)$, the minimum of Eve’s
and Alice’s, Eve’s and Bob’s mutual information $min(I(E;A),I(E;B))$ when Eve
uses the cheat strategies _(I)_ and _(II)_ , and the secret fraction
$r_{\infty}$($=I(A;B)-min(I(E;A),I(E;B))$) compared to the loss rate $\eta$.
It indicates that $r_{\infty}=0$ when $\frac{1}{2}\leq\eta\leq 1$ under the
cheat strategies.

We explain something about the data. When $\frac{1}{2}\leq\eta\leq 1$,
$min(I(E;A),I(E;B))=I(E;A)$, which is monotonic. But when
$0\leq\eta<\frac{1}{2}$, it will be $min(I(E;A),I(E;B))=I(E;B)$, which is not
monotonic. Specially, when $\eta=\frac{1}{3}$, minimal value $I(E;B)=0$ is
here with $P_{raw}^{EB\\_same}=P_{raw}^{EB\\_diff}$. The reason is that
information entropy is non-negative. With the increasing of disparity between
$\eta$ and the special value $\frac{1}{3}$, the disparity between
$P_{raw}^{EB\\_same}$ and $P_{raw}^{EB\\_diff}$ increases, consequently,
$I(E;B)$ increases. (Also see [22])

Fig.4 shows the counterfactual QKD’s raw key rate $R_{raw}$ and the secret key
rate $R_{QKD}$ compared to the loss rate $\eta$. It indicates that $R_{raw}$
increases with the increasing of $\eta$, $R_{QKD}$ decreases with the
increasing of $\eta$. Specially, $R_{QKD}$ will be equal to $0$ when
$\frac{1}{2}\leq\eta\leq 1$ under the cheat strategies, which means the
protocol is insecure.

As QKD applications, they usually need to distribute secret information over
long distance, so the high loss rate of channel is inevitable. For instance,
let us assume that the transmission line is a fiber-based channel, which is
always slightly lossy (about $0.2$ dB/km). If we want to use the cryptographic
system over reasonable distances, say up to $15$ km, transmission losses will
be as high as $3$dB, or about $50\%$. Then Eve could cheat all the secret
information using the cheat strategies proposed without leaving any clues.

##  6 Conclusion

In conclusion, we pointed out that counterfactual cryptography[11] is insecure
in practical high lossy channel. We proposed a polarization-splitting-
measurement attack and analyzed the secret key rate in lossy channel. The
analysis indicates that the protocol is insecure when the loss rate of the
channel from Alice to Bob is up to $50\%$. Since the attack’s effect just
likes a loss channel, it is invisible to the protocol’s participants. Maybe
the security flaw could be overcome by using nonorthogonal states as BB84
QKD[1], but the protocol will be more complex and lower efficient.

We are very grateful to Professor Horace P. Yuen for encouragement. This work
is supported by NSFC (Grant Nos. 61300181, 61272057, 61202434, 61170270,
61100203, 61121061, 61370188, and 61103210), Beijing Natural Science
Foundation (Grant No. 4122054), Beijing Higher Education Young Elite Teacher
Project, China scholarship council.

## References

  * [1] Bennett C H and Brassard G 1984 Proc. IEEE Int. Conf. on Computers, Systems and Signal Processing (Bangalore, India) p 175
  * [2] Bennett C H 1992 Phys. Rev. Lett. 68 3121
  * [3] Yuen H P 2001 in Proceedings of QCMC 00, Capri, edited by P. Tombesi and O. Hirota (Plenum Press, New York)
  * [4] Lo H K and Chau H F 1999 Science 283 2050
  * [5] Brassard G, Lütkenhaus N, Mor T, and Sanders B C 2000 Phys. Rev. Lett. 85 1330
  * [6] Huttner B, Imoto N, Gisin N, and Mor T 1995 Phys. Rev. A 51 1863
  * [7] Gisin N, Fasel S, Kraus B, Zbinden H, and Ribordy G 2006 Phys. Rev. A 73 022320
  * [8] Makarov V, Anisimov A, and Skaar J 2006 Phys. Rev. A 74 022313
  * [9] Hwang W Y 2003 Phys. Rev. Lett. 91 057901
  * [10] Lo H K, Curty M, and Qi B 2012 Phys. Rev. Lett. 108 130503
  * [11] Noh T G 2009 Phys. Rev. Lett. 103 230501
  * [12] Yin Z Q, Li H W, Chen W, Han Z F, and Guo G C 2010 Phy. Rev. A 82 042335
  * [13] Sun Y, and Wen Q Y 2010 Phys. Rev. A 82 052318
  * [14] Ren M, Wu G, Wu E, and Zeng H 2011 Laser Phys. 21 755
  * [15] Zhang S, Wang J , and Tang C J 2012 Chin. Phys. B 21 060303
  * [16] Brida G, Cavanna A, Degiovanni I P, Genovese M, and Traina P 2012 Laser Phys. Lett. 9 247
  * [17] Yin Z Q, Li H W, Yao Y, Zhang C M, Wang S, Chen W, Guo G C, and Han Z F 2012 Phys. Rev. A 86 022313
  * [18] Liu Y, Ju L, Liang X L, Tang S B, Shen Tu G L., Zhou L, Peng C Z, Chen K, Chen T Y, Chen Z B, and Pan J W 2012 Phys. Rev. Lett. 109 030501
  * [19] Scarani V, Bechmann-Pasquinucci H, Cerf N J, Dušek M, Lütkenhaus N , and Peev M 2009 Reviews of Modern Physics 81 1202
  * [20] Abruzzo S, Bratzik S, Bernardes N K, Kampermann H, vanLoock P , and BrußD 2013 Phys. Rev. A 87 052315
  * [21] It will be $I_{EB}<I_{EA}$ (or $I_{EB}>I_{EA}$) when $\eta$’s value is in some ranges. It means that in the counterfactual QKD, Bob’s (or Alice’s) raw key should be chosen as a reference raw key followed by classical postprocessing for more secure against Eve’s attack. So the mutual information Eve obtained is $I_{EB}$ (or $I_{EA}$), i.e., $\min(I_{EA},I_{EB})$.
  * [22] It will be $R_{raw}^{EA\\_same}<R_{raw}^{EA\\_diff}$ ($R_{raw}^{EB\\_same}<R_{raw}^{EB\\_diff}$) when $\eta$’s value is in some ranges. In practical attack, Eve should reverse all her cheated bits for decreasing the error rate to less than $50\%$ based on the value of $\eta$. Then the information she obtained is corresponding to the result calculated from information theory. And what she did will not affect the calculation in information theory, so we have not emphasized this in the rest of this paper.


# Self-Referenced Terahertz Semiconductor Dual-Comb Sources

###### Abstract

Employing two frequency combs with a slight difference in repetition
frequencies, the dual-comb source shows unique advantages in high precision
spectroscopy, imaging, ranging, communications, etc. In the terahertz (THz)
frequency range, the electrically pumped quantum cascade laser (QCL) offers
the possibility of realizing the compact dual-comb source due to its
semiconductor-based chip-scale configuration. Although the active
stabilization of a THz QCL dual-comb source was demonstrated by phase locking
one of the dual-comb lines, the full stabilization of all dual-comb lines is
still challenging. Here, we propose a self-reference method to obtain a fully
stabilized dual-comb signal on a pure THz QCL platform. Without using any
external locking components, we filter out one dual-comb line and beat it with
the whole dual-comb signal, which eliminates the common carrier offset
frequency noise and reduces the dual-comb repetition frequency noise. It is
experimentally demonstrated that the self-reference technique can
significantly improve the long-term stability of the dual-comb signal. A
record of the “maxhold” linewidth of 14.8 kHz (60 s time duration) is obtained
by implementing the self-reference technique, while without the self-reference
the dual-comb lines show a “maxhold” linewidth of 2 MHz (15 s time duration).
The method provides the simplest way to improve the long-term stability of THz
QCL dual-comb sources, which can be further adopted for high precision
measurements.

###### keywords:

terahertz, quantum cascade laser, dual-comb, self-reference

Ziping Li Xuhong Ma Kang Zhou Chenjie Wang Xiaoyu Liao Wen Guan Shumin Wu Han
Liu Zhenzhen Zhang J. C. Cao* Min Li Ming Yan Heping Zeng* Hua Li*

Dr. Z. Li, X. Ma, K. Zhou, C. Wang, X. Liao, W. Guan, S. Wu, H. Liu, Z. Zhang,
Prof. J. C. Cao, Prof. H. Li
Key Laboratory of Terahertz Solid State Technology
Shanghai Institute of Microsystem and Information Technology
Chinese Academy of Sciences
865 Changning road, Shanghai 200050, China
E-mail<EMAIL_ADDRESS><EMAIL_ADDRESS>
X. Ma, K. Zhou, C. Wang, X. Liao, S. Wu, H. Liu, Prof. J. C. Cao, Prof. H. Li
Center of Materials Science and Optoelectronics Engineering
University of Chinese Academy of Sciences
Beijing 100049, China

W. Guan
School of Information Science and Technology
ShanghaiTech University
393 Middle Huaxia Road, Shanghai 201210, China

Prof. M. Li
School of Optical Electrical and Computer Engineering
University of Shanghai for Science and Technology
Shanghai 200093, China

Prof. M. Yan, Prof. H. Zeng
State Key Laboratory of Precision Spectroscopy
East China Normal University
Shanghai 200241, China
E-mail<EMAIL_ADDRESS>
Prof. H. Zeng
Chongqing Key Laboratory of Precision Optics
Chongqing Institute of East China Normal University
Chongqing 401120, China

##  1 Introduction

The dual-comb spectroscopy employing two optical frequency combs with slightly
different repetition frequencies has revolutionized the conventional
spectroscopic techniques due to its unique features in the high spectral
resolution and fast data acquisition[1, 2, 3, 4, 5, 6]. Utilizing the slight
difference in the repetition frequencies, an equivalent sampling of one
frequency comb against the other one can be achieved, which can map the
optical spectral data to the microwave frequency range. This time-delayed
operation without mechanical scanning gives the dual-comb a natural potential
for real-time and high precision spectroscopy[7, 8, 9, 10].

Since the first demonstration of dual-comb sources working in near-infrared
and visible wavelengths, the dual-comb operation frequency range has been
extended to other frequencies[8, 11, 12, 13]. In the terahertz (THz) frequency
range, the electrically pumped quantum cascade laser (QCL) is an ideal
candidate source for dual-comb operation[2, 14, 15, 16] due to the large
output power[17], broad spectral coverage[18, 19], and fast self-detection
capability[10, 20, 21]. The latter results from the ultrafast carrier dynamics
behavior in QCLs without a relaxation oscillation, while offering the unique
possibility of on-chip dual-comb and compact dual-comb configurations[10, 21,
22]. Although the frequency comb and dual-comb operation have been observed in
free-running THz QCLs[15, 23, 24], the improved stability or reduced phase
noise by using various locking techniques and/or dispersion engineering are
still much in demand. All efforts to improve the comb performance are to
control two frequencies of a comb laser, i.e., the repetition frequency
$f_{\rm{rep}}$ and carrier offset frequency $f_{\rm{ceo}}$. Once the two
frequencies are known, the frequency of each comb line can be fully defined by
$f_{N}$=$f_{\rm{ceo}}$+$Nf_{\rm{rep}}$ with $N$ being the $N$-th order of the
frequency comb. For the control of $f_{\rm{rep}}$, the microwave injection
locking[25, 26] and passive saturable absorption[27] were successfully
implemented to achieve broadband and stable combs. The control of
$f_{\rm{ceo}}$ is more challenging. The traditional $f$-$2f$ method[28] cannot
be used to assess $f_{\rm{ceo}}$ of THz QCL combs due to the limited emission
bandwidth. Recent endeavors by employing the coherent sampling and phase
seeding techniques with an assistance of femto-second lasers have been
successfully demonstrated to lock $f_{\rm{ceo}}$ of a single THz QCL comb[29,
30].

Regarding the control of THz QCL dual-comb sources, it is more difficult
because the full lock of a dual-comb source is associated with four
frequencies, i.e, two repetition frequencies and two carrier offset
frequencies. Each noise component of a single comb is directly transferred to
the dual-comb lines through the multi-heterodyne beating process. Therefore,
the simultaneous locking of four frequencies is extremely hard to be
implemented experimentally due to the involved complex locking electronics and
facilities. Alternatively, instead of controlling $f_{\rm{ceo}}$ and
$f_{\rm{rep}}$ of individual comb lasers, it is more executable to stabilize
the dual-comb signal as a whole. This means that it is more feasible to lock
the dual-comb carrier offset frequency
($f_{\rm{ceo,dc}}$=$f_{\rm{ceo1}}$-$f_{\rm{ceo2}}$) and the dual-comb
repetition frequency ($f_{\rm{rep,dc}}$=$f_{\rm{rep1}}$-$f_{\rm{rep2}}$)
because the entire dual-comb signal can be precisely obtained through the
multiheterodyne beating. Recently, we have achieved the active stabilization
of a THz QCL dual-comb source by phase locking one dual-comb line to a
microwave local oscillator employing a traditional phase-locked loop[31].
Although the stability of the dual-comb lines was improved, we observed that
the noise of the dual-comb lines that were located far away from the locked
line (carrier) increased with the increase of the frequency difference.
Furthermore, the active stabilization of the dual-comb source involves complex
locking “hardwares”. Therefore, it is promising to implement a stabilization
or locking of a dual-comb source without using any external locking facilities
or components. This “software”-based stabilization can be achieved by using

computational[32] and adaptive approaches[33]. In ref. [32], it has been shown
that the computational approach allows for extracting the phase and timing
signals of a multiheterodyne spectrum without any extra measurements or
optical elements. And the other approach, i.e., adaptive dual-comb, is based
on the automatically triggering data acquisition with a filtered dual-comb
line as a sampling clock. In the visible and infrared regions, the adaptive
sampling method has been maturely developed for Doppler precision
spectroscopic measurements[7, 12]. Actually, one can note that each dual-comb
line shares the same dual-comb carrier and its noise doesn’t change the
intrinsic dual-comb behaviour. If the common carrier noise is cancelled, the
stability of each dual-comb line can be significantly improved. This common-
mode-noise-free dual-comb was recently demonstrated in a hybrid dual-comb
system which consisted of a QCL comb and an optically rectified (OR) comb with
a femto-second laser pump[34]. Since the amplitudes and phases of the OR comb
can be taken as a reference, the common-mode-noise-free technique reported in
ref. [34] allows for retrieving the phases of the sample comb (QCL comb).

In this work, based on a pure two-QCL system, we propose a self-reference
method to obtain a fully stabilized THz dual-comb source. Different from the
previously reported active stabilization which strongly relies on the complex
phase locking electronics, in this work, without using any external locking
components, we filter out one dual-comb line and beat it with the whole dual-
comb signal, which finally cancels out the carrier-offset frequency of the
dual-comb signal, as well as the noise. It is demonstrated that the self-
reference technique can significantly improve the long-term stability of the
dual-comb signal, i.e., a narrow “maxhold” linewidth of $\sim$15 kHz for a
time duration of 60 s is obtained, which is more than 130 times smaller than
the “maxhold” linewidth measured from the dual-comb source without a self-
reference stabilization.

##  2 Experimental setup

Figure 1a schematically depicts the experimental setup of the proposed self-
referenced THz QCL dual-comb. The two THz QCLs (Comb1 and Comb2) with an
identical nominal cavity length of 6 mm are mounted on a Y-shape cold finger,
same as the geometry reported in ref.[10]. No optics are used for the optical
coupling between the two lasers. A detailed description of the THz QCLs used
in this work can be found in the Experimental Section. The top right panel
outlined by a dashed rectangle shows the radio frequency (RF) injection
locking setup[26, 35] which is used to improve the $f_{\rm{rep}}$ stability of
Comb2 by modulating its drive current at the repetition frequency of Comb2.
Note that here we only implement the injection locking for Comb2 because the
laser Comb2 shows much worse $f_{\rm{rep}}$ stability than Comb1 (see figure
2a). To improve the dual-comb signal quality, the RF injection locking is only
applied onto Comb2. In principle, if the two laser combs show comparable
stability, the injection locking can be removed for simplicity. In this
experiment, Comb1 is used as a fast THz detector to measure the multi-
heterodyne beating signals employing the laser self-detection mechanism. The
multi-heterodyne dual-comb and the inter-mode beatnote signals are extracted
from the AC port of the bias-T for the self-reference experiment which is
schematically shown in the bottom rectangular box of figure 1a. The extracted
dual-comb signal in the gigahertz (GHz) frequency range is first amplified and
then sent to a mixer to be down-converted to the megahertz (MHz) frequency
range. After that, a microwave coupler is used to split the down-converted
dual-comb signal into two, one of which is sent to a bandpass filter to filter
only one tooth of the lines. Finally, the two signals are amplified again and
then sent to a mixer to obtain the self-referenced dual-comb signal which is
registered on a spectrum analyser. Note that for the frequency mixing, the
filtered signal is acting as a local oscillator (LO).

Figure 1:  a) Experimental setup of the self-referenced dual-comb source. The
top left, top right, and bottom panels schematically show the THz QCL dual-
comb geometry, RF injection locking, and self-reference process, respectively.
Comb1 and Comb2 are THz QCLs with a cavity length of 6 mm, which are mounted
on a “Y-shape” cold finger of a continuous-flow helium cryostat. RF generator1
is used to injection lock Comb2 by modulating the laser current at its
repetition frequency. RF generator2 acts as a local oscillator (LO) and down-
converts the dual-comb signal from the GHz range to MHz range with an
assistance of Mixer1. Mixer2 is used to performs self-reference mixing and its
intermediate frequency (IF) signal outputs the self-referenced dual-comb. The
inset is a photo of the THz QCL dual-comb source mounted on a “Y-shape” cold
finger. b) Frequency synthesis of the proposed self-reference process.
$f_{\rm{rep1}}$ and $f_{\rm{rep2}}$ are the repetition frequencies of Comb1
and Comb2, respectively. $f_{\rm{rep2}}$ is locked to $f_{\rm{RF}}$. In the
middle panel, the curves with different colors represent the down-covered
dual-comb lines in the MHz range and the line selected by a bandpass filter is
outlined by a dashed rectangle. The blue lines in the rightmost panel shows
the obtained self-referenced dual-comb signal with the common carrier
frequency eliminated.

Figure 1b shows the frequency synthesis and conversion of the self-referenced
dual-comb experiment. The red and blue curves illustrate the emission lines of
Comb1 and Comb2 in the THz band, respectively, which shows two different
repetition frequencies, i.e., $f_{\rm{rep1}}$ and $f_{\rm{rep2}}$. As
mentioned before, $f_{\rm{rep2}}$ is firmly locked by the RF injection locking
to improve the comb coherence. The dual-comb signal located in the GHz
frequency range is obtained from the multi-heterodyne beating between the two
comb lines. To perform the self-reference measurement, the dual-comb signal
has to be down-converted to the MHz frequency range due to the restraints of
the bandpass filter which is used to filter out one tooth of the dual-comb
lines. As shown in the middle panel of Figure 1b, the upper curve is the down-
converted dual-comb spectrum in the MHz range, while the lower curve is the
tooth that is selected by the bandpass filter. Then, the self-reference
measurement enables the mixing between the selected tooth and the entire down-
converted dual-comb signal, which results in a cancellation of the dual-comb
$f_{\rm{ceo}}$ and stability improvement of the dual-comb signal. As shown in
the right panel of Figure 1b, the obtained self-referenced dual-comb signal
consists of lines starting from the line at $f_{\rm{rep}}$ followed by lines
at 2$f_{\rm{rep}}$, 3$f_{\rm{rep}}$, 4$f_{\rm{rep}}$, and so on. Due to
removal of the dual-comb carrier noise, the whole self-referenced dual-comb
signal shows improved stability and coherence, while the intrinsic spectral
information is kept.

##  3 Results

###  3.1 Frequency comb and dual-comb performance

The two laser combs used in this work are 6-mm-long THz QCLs with a single
plasmon waveguide geometry. The light-current-voltage characteristics of the
two lasers are shown in Supplementary Figure S1. At a heat sink temperature of
30 K, both lasers are able to work in continuous wave (cw) mode. The inter-
mode beatnote measurement is an efficient and indirect technique to
characterize the comb behaviour of QCLs. Benefiting from the ultrafast carrier
relaxation in a QCL, the inter-mode beatnote signal can be measured
electrically using the QCL itself as a detector. The inter-mode beatnote maps
of the two QCL combs with different drive currents are reported in
Supplementary figure S2. It can be seen that when the drive current is higher
than 850 mA for Comb1 or 830 mA for Comb2, at most currents in the dynamic
range, the frequency comb operation can be obtained. For the comb and dual-
comb measurements, we operate both lasers at a drive current of 920 mA and the
cw output power for each laser is around 1 mW.

In Figure 2a, we show the measured inter-mode beatnotes of Comb1 and Comb2 in
single shot (black solid curve) and “maxhold” modes (grey dashed curve). From
the “maxhold” measurement, we can see that Comb2 shows a higher instability of
$f_{\rm{rep}}$: during a time duration of 10 s, the frequency drift is
measured to be 1 MHz, while Comb1 shows a drift of 0.2 MHz. When we compare
the “maxhold” spectrum with the single shot one, we can further see that Comb1
is much more stable than Comb2, which is indicated by the measured frequency
difference between the center frequency of the “maxhold” peak and the single
shot frequency, i.e., 2.35 MHz for Comb2 and 0.3 MHz for Comb1. It is worth
noting that although the nominal design and dimensions for both lasers are
identical, the two laser combs show much different comb stability in free-
running because all conditions for the two lasers cannot be exactly same. In
view of this, to obtain an acceptable dual-comb signal for further self-
reference measurements, we implement the microwave injection on Comb2 to
stabilize its repetition frequency as shown in Figure 1a.

Figure 2: a) Measured inter-mode beatnotes of Comb1 (yellow background) and
Comb2 (blue background). The solid and dashed lines are the single shot and
“maxhold” (10 s time duration) traces, respectively. The RBW and VBW
parameters are set to 20 kHz and 200 Hz, respectively. b) Dual-comb spectrum
(red curve) with the corresponding inter-mode beatnotes (blue curve) measured
from the dual-comb source. Comb1 is operated in free-running and Comb2 is
locked by the RF injection locking at a frequency of 6.04761539 GHz. The line
spacing of the dual-comb signal is equal to the frequency difference of the
inter-mode beatnotes. For all measurements, the temperature is stabilized at
29.5 K with a temperature deviation smaller than 50 mK and the drive current
is set to 920 mA for both laser combs.

Figure 2b shows the measured multiheterodyne dual-comb spectrum when Comb1 is
operated in free-running and Comb2 is stabilized by a microwave injection at a
round-trip frequency of 6.04761539 GHz with a RF power of -4 dBm. Note that
here a relatively low RF power is used to avoid high phase noise introduced by
the RF synthesizer[21]. Equally-spaced dual-comb lines with a spacing of 14.5
MHz can be clearly observed in figure 2b and the dual-comb spacing is equal to
the difference between the two comb repetition frequencies, $f_{\rm{rep1}}$
and $f_{\rm{rep2}}$.

###  3.2 Self-referenced dual-comb

After the dual-comb signal is obtained, we can further implement the self-
reference method to improve the dual-comb stability. As we explained
previously, we select one dual-comb line and mix it with the whole original
dual-comb lines to cancel the common carrier frequency noise. To explain the
self-reference process in detail, we start from the THz frequencies. If the
$N$-th order of modes of the two QCL combs are considered for the generation
of the corresponding dual-comb line, the frequencies of the two THz modes from
Comb1 and Comb2, respectively, can be written as,

$f_{1}=f_{\rm{ceo1}}+Nf_{\rm{rep1}}$; $f_{2}=f_{\rm{ceo2}}+Nf_{\rm{rep2}}$,
(1)

where _f_ ceo1 and _f_ ceo2 are the carrier offset frequencies of Comb1 and
Comb2, respectively, and $N$ is an integer. Hence, the frequency of the dual-
comb line that is resulted from the beating of $f_{1}$ and $f_{2}$ can be
written as,

$f=f_{1}-f_{2}=f_{\rm{ceo1}}-f_{\rm{ceo2}}+N(f_{\rm{rep1}}-f_{\rm{rep2}})$.
(2)

Alternatively, we can rewrite it in the similar form as optical frequency
combs,

$f=f_{\rm{ceo,dc}}+Nf_{\rm{rep,dc}}$, (3)

where $f_{\rm{ceo,dc}}$=$f_{\rm{ceo1}}$-$f_{\rm{ceo2}}$ and
$f_{\rm{rep,dc}}$=$f_{\rm{rep1}}$-$f_{\rm{rep2}}$ are the carrier offset
frequency and repetition frequency of a dual-comb signal, respectively. From
equations 2 and 3, we can say that the noise of a dual-comb signal is from its
carrier offset frequency and repetition frequency noises, which is actually
equivalent to the carrier offset noise and repetition frequency noise of Comb1
against those of Comb2. Considering jitters for carrier offset and repetition
frequencies, noise terms can be added to the steady terms as follows,

$f=f_{\rm{ceo,dc}}+\delta f_{\rm{ceo,dc}}+N(f_{\rm{rep,dc}}+\delta
f_{\rm{rep,dc}})$, (4)

where $\delta f_{\rm{ceo,dc}}$ and $\delta f_{\rm{rep,dc}}$ are the noise
terms (fluctuations) of $f_{\rm{ceo,dc}}$ and $f_{\rm{rep,dc}}$, respectively.
The frequency of each dual-comb line can be obtained from equation 4 by
varying the integer $N$. Note that all dual-comb lines share the common noise
terms of $\delta f_{\rm{ceo,dc}}$ and accumulated $\delta f_{\rm{rep,dc}}$. To
implement the self-reference measurement, one dual-comb line is chosen, for
example, the $M$-th order line ($f_{M}$), which can be written as,

$f_{M}=f_{\rm{ceo,dc}}+\delta f_{\rm{ceo,dc}}+M(f_{\rm{rep,dc}}+\delta
f_{\rm{rep,dc}})$. (5)

Consequently, the beating between $f_{M}$ and each $f$ results in the self-
referenced dual-comb signal. The newly generated frequency ($f_{\rm{sr}}$) can
be expressed,

$f_{\rm{sr}}=f-f_{M}=(N-M)(f_{\rm{rep,dc}}+\delta
f_{\rm{rep,dc}})=(N-M)f_{\rm{rep,dc}}+(N-M)\delta f_{\rm{rep,dc}}$. (6)

Note that in equation 6, $M$ is a constant integer and $N$ is a variable
integer. From equation 6, we can find that the common noise of $\delta
f_{\rm{ceo,dc}}$ is completely eliminated during the self-mixing process.
Furthermore, the coefficient of the noise term of $\delta f_{\rm{rep,dc}}$ is
also reduced from $N$ to $N-M$ after the self-reference process. It has to be
clarified that for a frequency comb, $f_{\rm{ceo}}$ is normally small (close
to DC) and $N$ is very big. Therefore, in free running, the noise of different
comb lines are comparable without sizable differences. However, once the self-
reference is implemented, we can see that the noise terms of $f_{\rm{ceo,dc}}$
and $f_{\rm{rep,dc}}$ are either removed or significantly suppressed.

Figure 3: Down-converted and self-referenced dual-comb spectra. a) Down-
converted dual-comb spectrum measured with a RBW of 30 kHz and a VBW of 300
Hz. The dual-comb line spacing is 17.7 MHz. The tooth that is selected by a
bandpass filter for the self-reference mixing is marked by a red star. Two
lines at high frequencies marked by red circles with a lower power level don’t
participate in the self-reference mixing with the line marked by the red star.
The inset shows the typical spectrum of the filtered dual-comb tooth measured
with the same RBW and VBW parameters. b) Self-referenced dual-comb spectrum
measured with a RBW of 500 Hz and a VBW of 50 Hz. 5 lines marked by [0]-[4]
are equally spaced by 17.6 MHz which is consistent with the line spacing shown
in a.

The experimental results of the self-referenced dual-comb are shown in Figure
3. To perform the self-reference mixing, we have to first down-convert the
dual-comb signal as shown in figure 2b to lower frequencies around 200 MHz.
This frequency down-conversion is necessary because the bandpass filter that
is used to filter out one of the dual-comb lines is only working at lower
frequencies. A RF signal at 5.35176 GHz with a power of 7 dBm is used to mix
with the dual-comb signal in GHz range and bring it down to MHz range. Figure
3a shows the down-converted dual-comb spectrum with 11 lines and the line
spacing is 17.7 MHz measured with a resolution bandwidth (RBW) of 30 kHz and a
video bandwidth (VBW) of 300 Hz. The inset of figure 3a is the spectrum of the
selected line at 195.7 MHz by using a tunable bandpass filter with a bandwidth
of 8 MHz (around 5% of the selected center frequency). It can be seen that the
frequency of the selected line doesn’t perfectly match with any line shown in
figure 3a. This is because that the two spectra were taken at different times
and the addition of a bandpass filter in the electrical circuit can change the
absolute frequency positions of the lines. However, the frequency mismatch
between the two spectra is not a problem for the self-reference measurement
because for the self-reference mixing the instantaneous frequency of the
selected line can always find its original one from the down-converted dual-
comb spectrum and at each time the two frequencies are exactly same.
Therefore, the proposed self-reference measurement is featured by the immunity
of long-term noises in the dual-comb system.

Figure 3b shows the self-referenced dual-comb spectrum measured with a RBW of
500 Hz and a VBW of 50 Hz. Since the selected line (inset of figure 3a) is
from the central region of the dual-comb signal (indicated by a red star in
figure 3a), in the self-referenced dual-comb spectrum we only observe 5 lines
which are equally spaced by 17.6 MHz. Here, the 5 lines actually correspond to
9 dual-comb lines in figure 3a: the first line at 0 Hz corresponds to beating
of the selected line and itself in the dual-comb signal ($N$=$M$, see equation
6); the other lines in figure 3b are resulted from two beatings of the
selected line with its right and left neighbouring lines in the dual-comb
spectra ($N{\neq}M$, see equation 6). Note that the self-referenced signal
doesn’t include the information of the two dual-comb lines with highest
frequencies (marked by circles in figure 3b), probably due to the higher noise
as the frequency is greater than 86 MHz or the low power level of the two
lines. One can also find that the measured line spacing of the self-referenced
dual-comb (figure 3b) is slightly different from the down-converted dual-comb
(figure 3a), which is due to the instability of $f_{\rm{rep,dc}}$ originally
from the instability of $f_{\rm{rep}}$ of the two QCL combs. It is worth
mentioning that in figure 3b in the vicinity of lines marked by [0], [1], and
[2], several redundant lines can be clearly observed. We measured the line
spacing of these lines and found that they were not equally separated.
Therefore, we assume the low frequency disordered lines are generated by the
microwave amplifiers in the electrical circuit of the measurement system
rather than from the laser combs because the disordered lines are absent in
Figs. 2b and 3a.

Figure 4: “Maxhold” measurement for the dual-comb spectra with and without the
self-reference technique. a) Original dual-comb spectrum without the self-
reference method measured with a “maxhold“ duration time of 15 seconds. The
line with an index ’0’ marked by a red star is the selected tooth for the
self-reference mixing. b) Self-referenced dual-comb spectrum measured a
“maxhold” duration time of 60 seconds. For both measurements, RBW and VBW
parameters are set to 500 Hz and 50 Hz, respectively. c) “Maxhold” linewidths
of the original (blue) and self-referenced (red) dual-comb lines extracted
from a) and b). d) Linewidth increment as a function of line index for the
self-referenced dual-comb lines extracted from c). The diamonds show the
measured results and the red curve is a quadratic fit.

In figure 3, we show that the self-referenced dual-comb signal can be obtained
as expected by following the experimental setup shown in figure 1. To further
demonstrate how stable the self-referenced dual-comb signal is, we perform the
“maxhold” measurement for the dual-comb signals with and without the self-
reference technique. The main results are shown in figure 4. Here, when the
“maxhold” function of the spectrum analyser is switched on, the maxima of the
spectral peaks can be stored during the measurement. Therefore, the “maxhold”
spectra can visually show the long-term stability of a signal. Figure 4a shows
the “maxhold” dual-comb spectrum without the self-reference in GHz range for a
time duration of 15 s. It can be seen that for all 11 lines, the frequency
drifts during 15 s are comparable and lie in a level of 2 MHz (see figure 4c)
which show a good agreement with the “maxhold” linewidths measured from
another QCL dual-comb system with a laser cavity of 5.5 mm[31].

In figure 4b, we show the “maxhold” trace of the self-referenced dual-comb
signal measured for a time duration of 60 s. For the self-reference process,
the line with an index of 0 marked by a red star in figure 4a is selected to
mix with the entire dual-comb signal. A significant stability improvement can
be clearly observed from figure 4b: for 60 s that is four times longer than
the time duration used for the original dual-comb measurement, a “maxhold”
linewidth narrowing for all lines marked by [0], [1], [2], [3], and [4] can be
seen by the naked eyes. The measured linewidths for both traces in Figs. 4a
and 4b are summarized in figure 4c. One can see a monotonous increase of the
“maxhold” linewidth with line index for the self-referenced dual-comb, while
the original dual-comb shows similar linewidths around 2 MHz. Note that the
narrowest “maxhold” linewidths for line [0] and [1] are 14.8 kHz and 28.5 kHz,
respectively. As we explained, the reason for the significant reduction of the
linewidth of the self-referenced dual-comb signal is the cancellation of the
carrier frequency and reduced repetition frequency noise of the dual-comb
signal. To further show the “maxhold” linewidth comparison between the self-
referenced dual-comb and original dual-comb spectra, more experimental data
were measured with different time durations as shown in Supplementary Figs. S3
and S4. To clearly show the dependence of the “maxhold” linewidth on the line
index, we plot the linewidth increment as a function of line index in figure
4d. The diamonds are measured results and the red line shows a quadratic
fit[31] to the experimental data. For the given 4 experimental points, we can
see the measured linewidth increments fairly follow a quadratic dependence on
line index.

##  4 Discussion

The results shown in Figs. 3 and 4 experimentally prove that the self-
reference method can be successfully implemented onto a QCL dual-comb system
to significantly improve the dual-comb stability. It has to be noted that the
proposed self-reference technique doesn’t use traditional locking hardwares to
control the carrier offset and repetition frequencies of the two QCLs.
Therefore, the laser combs are still running with large noises, see Figs. 2a
and 4a. Although it is not a physical locking technique, the self-reference
method can largely improve the dual-comb signal stability due to its noise
cancellation ability as we elaborated in the main text. This is important for
reliably reading the experimental data for some spectroscopic applications,
especially when the absorption linewidth of a sample is wider than the long-
term frequency drift of the THz modes (which is around 2 MHz as shown in Figs.
4a and 4c). Generally, this can be satisfied for most of cases. Furthermore,
the self-reference method is able to maximally simplify the experimental setup
for compact applications.

In the current self-reference experiment, to obtain a higher signal to noise
ratio, we select a dual-comb line with a high power located in the central
range of the spectra for self-mixing. Therefore, each self-referenced dual-
comb line except the line marked by an index [0] are resulted from two
different beating processes. So, the mode aliasing exists in the self-
referenced dual-comb spectrum. This is the reason that the number of the self-
referenced dual-comb lines is less than that of the original dual-comb lines
(see Figs. 3 and 4). In this situation, the one-to-one correspondence cannot
be obtained between the referenced dual-comb and original dual-comb spectra.
In this work, the main objective is to demonstrate the operation principle and
feasibility of the self-reference method rather than spectroscopic
applications. For a practical spectroscopic application, the mode aliasing can
be avoided with more effort. For example, we can further amplify the original
dual-comb signal and select the leftmost or rightmost line to perform the
self-mixing experiment. Then, the self-referenced dual-comb spectra with a
precise one-to-one correspondence can be obtained.

From figure 4, we can see that by implementing the self-reference technique
the dual-comb signal is significantly improved. However, the dual-comb
repetition frequency noise is still present and its quadratic increase with
the line index can be clearly observed. Actually, the dual-comb repetition
frequency noise can be further suppressed. For example, a microwave double-
injection[21] can be applied onto the two laser combs to lock the two
repetition frequencies simultaneously. In this case, the repetition frequency
noises of the two laser combs are completely removed. Consequently, the dual-
comb repetition frequency noise is accordingly removed.

Finally, it is worth mentioning that the proposed self-reference method is
currently implemented onto a THz QCL dual-comb source. However, the general
method can be also adopted for other dual-comb sources or even for a single
QCL frequency comb. In principle, for a single THz QCL comb, if a narrow band
filter and a broadband mixer working in the terahertz range are available, the
self-mixing between the selected comb line and the entire frequency comb
signal can significantly improve the long-term stability of the frequency
comb.

##  5 Conclusion

In summary, we have demonstrated, at the first time as far as we know, a self-
reference method for a pure QCL dual-comb system working around 4.2 THz.
Without physical locking hardwares, the proposed self-reference technique can
significantly improve the dual-comb signal stability by eliminating the dual-
comb carrier offset frequency and reducing the dual-comb repetition frequency
noise. Experimental results revealed that all self-referenced dual-comb lines
showed much improved long-term stability than the original dual-comb lines.
The measured narrowest “maxhold” linewidth of the self-referenced signal is
14.8 kHz (60 s time duration), which is 130 times smaller than that measured
from the original dual-comb signal (15 s time duration). The simplified self-
reference technique can be further employed for the fast THz dual-comb
spectroscopy especially when the absorption linewidth of a sample is wider
than the long-term frequency drift of the THz modes. In principle, the self-
reference method can be also implemented in other laser systems to improve the
system stability for various applications, such as, spectroscopy, imaging,
communications, etc.

##  6 Experimental Section

THz QCLs and characterizations The THz QCLs used in this work is based on a
GaAs/AlGaAs hybrid active region structure in which the bound-to-continuum
transitions are employed for the THz photon emission and resonant-phonon
scatterings are designed for the depopulation of the lower laser state. The
detailed layer thickness and doping profiles can be found in ref.[36]. The
entire active region of the QCL was grown on a semi-insulating GaAs(100)
substrate by a molecular beam epitaxy (MBE) system. Then, the grown wafer was
processed into single plasmon waveguide laser ridges with a ridge width of 150
$\mu$m. Finally, 6-mm-long laser ridges were cleaved and indium-bonded onto
copper heat sinks for the wire bonding.

For electrical and optical characterizations, the QCL devices were mounted
onto a cold finger of a cryostat. The average power of the lasers was measured
using a power meter (Ophir, 3A-P THz) with a pair of parabolic mirrors for
light collection and collimation. The inter-mode beatnote of the QCL comb, as
well as the multiheterodyne dual-comb signals, was measured using the device
itself as a detector and the microwave spectra can be directly registered on a
spectrum analyser (Rohde & Schwarz, FSW26).
Multiheterodyne self-detection In the work, the main THz detection mechanism
is the multiheterodyne self-detection. As shown in figure 1, when the light of
Comb2 is incident to Comb1, the frequency of Comb1 will be modulated by Comb2.
In our experimental setup, the modulation of frequency multiheterodyne will be
visually shown by the modulation of the drive current of Comb1. The ultra-fast
carrier relaxation time in picoseconds level of THz QCLs gives them the
ability to act as a fast THz detector[35] for multiheterodyne measurements.
Therefore, by probing the current of Comb1, we are able to extract the
multiheterodyne information of the two lasers. Note that, the two lasers,
Comb1 and Comb2, have the equivalent function of light emission and detection.
Therefore, either laser can be used as a fast detector[21, 10]. In this work,
Comb1 is operated as a fast detector for the multiheterodyne detection. The AC
port of a Bias-T (Marki, BT2-0026) that is directly connected to Comb1 can
extract the high frequency inter-mode beatnote and dual-comb signals.

Self-reference As explained in the main paper, the proposed self-reference
method is implemented by selecting one of the dual-comb lines and beating it
with the entire dual-comb lines to eliminate the common carrier offset
frequencies and reducing the dual-comb repetition frequency noise. Without
using any external locking facilities, the self-reference technique can
significantly improve the observed dual-comb signal stability. As shown in
figure 1, the original dual-comb signal in the GHz range is first measured via
the AC port of a Bias-T (Marki, BT2-0026) that is connected to Comb1
(detector). Before it is sent to a mixer (Mini-Circuit, ZX05-73L-S+) for the
frequency down-conversion to the MHz range, the dual-comb signal is amplified
using a microwave amplifier (CONNPHY, CLN-1G18G-4030-S) with a gain of 40 dB.
Then, the down-converted dual-comb signal in the MHz range is split into two
using a microwave coupler for the self-reference mixing. One of the splitted
signals is sent to a tunable bandpass filter (K&L Microwave, 5BT-95/190-5-N/N)
for the one line selection. Before the self-reference frequency mixing, the
two signals are amplified again. Finally, the filtered signal (LO) and entire
dual-comb signal (RF) are mixed in a microwave mixer (Mini-Circuit,
ZX05-1L-S+) which then generates the carrier-frequency-free dual-comb spectrum
with a significant noise suppression.

Supporting Information

Supporting Information is available from the author.

Acknowledgements

Z.L. and X.M. contributed equally to this work. This work is supported by the
National Natural Science Foundation of China (61875220, 61927813, 62035005,
61991430, 62105351), the “From 0 to 1” Innovation Program of the Chinese
Academy of Sciences (ZDBS-LY-JSC009), the Scientific Instrument and Equipment
Development Project of the Chinese Academy of Sciences (Grant No.
YJKYYQ20200032), the National Science Fund for Excellent Young Scholars
(62022084), Shanghai Outstanding Academic Leaders Plan (20XD1424700), and
Shanghai Youth Top Talent Support Program.

## References

  * [1] B. Bernhardt, A. Ozawa, P. Jacquet, M. Jacquey, Y. Kobayashi, T. Udem, R. Holzwarth, G. Guelachvili, T. W. Hänsch, N. Picqué,  _Nature Photonics_ 2010, _4_ , 1 55.
  * [2] G. Villares, A. Hugi, S. Blaser, J. Faist,  _Nature Communications_ 2014, _5_ , 1 5192.
  * [3] I. Coddington, N. Newbury, W. Swann,  _Optica_ 2016, _3_ , 4 414.
  * [4] A. Dutt, C. Joshi, X. Ji, J. Cardenas, Y. Okawachi, K. Luke, A. L. Gaeta, M. Lipson,  _Science Advances_ 2018, _4_ , 3 e1701858.
  * [5] N. Picqué, T. W. Hänsch,  _Nature Photonics_ 2019, _13_ , 3 146.
  * [6] Y. Yang, D. Burghoff, D. J. Hayton, J.-R. Gao, J. L. Reno, Q. Hu,  _Optica_ 2016, _3_ , 5 499.
  * [7] T. Ideguchi, A. Poisson, G. Guelachvili, N. Picqué, T. W. Hänsch,  _Nature Communications_ 2014, _5_ , 1 3375.
  * [8] G. Millot, S. Pitois, M. Yan, T. Hovhannisyan, A. Bendahmane, T. W. Hänsch, N. Picqué,  _Nature Photonics_ 2016, _10_ , 1 27.
  * [9] X. Zhao, G. Hu, B. Zhao, C. Li, Y. Pan, Y. Liu, T. Yasui, Z. Zheng,  _Optics Express_ 2016, _24_ , 19 21833.
  * [10] H. Li, Z. Li, W. Wan, K. Zhou, X. Liao, S. Yang, C. Wang, J. C. Cao, H. Zeng,  _ACS Photonics_ 2020, _7_ , 1 49.
  * [11] S. M. Link, D. Maas, D. Waldburger, U. Keller,  _Science_ 2017, _356_ , 6343 1164.
  * [12] T. Ideguchi, A. Poisson, G. Guelachvili, T. W. Hänsch, N. Picqué,  _Optics Letters_ 2012, _37_ , 23 4847.
  * [13] M. Yan, P.-L. Luo, K. Iwakuni, G. Millot, T. W. Hänsch, N. Picqué,  _Light: Science & Applications_ 2017, _6_ , 10 e17076.
  * [14] R. Köhler, A. Tredicucci, F. Beltram, H. E. Beere, E. H. Linfield, A. G. Davies, D. A. Ritchie, R. C. Iotti, F. Rossi,  _Nature_ 2002, _417_ , 6885 156.
  * [15] D. Burghoff, T.-Y. Kao, N. Han, C. W. I. Chan, X. Cai, Y. Yang, D. J. Hayton, J.-R. Gao, J. L. Reno, Q. Hu,  _Nature Photonics_ 2014, _8_ , 6 462.
  * [16] A. Hugi, G. Villares, S. Blaser, H. Liu, J. Faist,  _Nature_ 2012, _492_ , 7428 229.
  * [17] L. H. Li, L. Chen, J. R. Freeman, M. Salih, P. Dean, A. G. Davies, E. H. Linfield,  _Electronics Letters_ 2017, _53_ , 12 799.
  * [18] M. Rösch, M. Beck, M. J. Süess, D. Bachmann, K. Unterrainer, J. Faist, G. Scalari,  _Nanophotonics_ 2018, _7_ , 1 237.
  * [19] C. W. I. Chan, Q. Hu, J. L. Reno,  _Applied Physics Letters_ 2012, _101_ , 15 151108.
  * [20] M. Rösch, G. Scalari, G. Villares, L. Bosco, M. Beck, J. Faist,  _Applied Physics Letters_ 2016, _108_ , 17 171104.
  * [21] Z. Li, W. Wan, K. Zhou, X. Liao, S. Yang, Z. Fu, J. Cao, H. Li,  _Physical Review Applied_ 2019, _12_ , 4 044068.
  * [22] G. Villares, J. Wolf, D. Kazakov, M. J. Süess, A. Hugi, M. Beck, J. Faist,  _Applied Physics Letters_ 2015, _107_ , 25 251104.
  * [23] K. Zhou, H. Li, W. Wan, Z. Li, X. Liao, J. Cao,  _Applied Physics Letters_ 2019, _114_ , 19 191106.
  * [24] G. Villares, S. Riedi, J. Wolf, D. Kazakov, M. J. Süess, P. Jouy, M. Beck, J. Faist,  _Optica_ 2016, _3_ , 3 252.
  * [25] S. Barbieri, W. Maineult, S. S. Dhillon, C. Sirtori, J. Alton, N. Breuil, H. E. Beere, D. A. Ritchie,  _Applied Physics Letters_ 2007, _91_ , 14 143510.
  * [26] P. Gellie, S. Barbieri, J. F. Lampin, P. Filloux, C. Manquest, C. Sirtori, I. Sagnes, S. P. Khanna, E. H. Linfield, A. G. Davies, et al.,  _Optics Express_ 2010, _18_ , 20 20799.
  * [27] H. Li, M. Yan, W. Wan, T. Zhou, K. Zhou, Z. Li, J. Cao, Q. Yu, K. Zhang, M. Li, et al.,  _Advanced Science_ 2019, _6_ , 20 1900460.
  * [28] R. Holzwarth, T. Udem, T. W. Hänsch, J. Knight, W. Wadsworth, P. S. J. Russell,  _Physical Review Letters_ 2000, _85_ , 11 2264.
  * [29] S. Barbieri, P. Gellie, G. Santarelli, L. Ding, W. Maineult, C. Sirtori, R. Colombelli, H. Beere, D. Ritchie,  _Nature Photonics_ 2010, _4_ , 9 636.
  * [30] D. Oustinov, N. Jukam, R. Rungsawang, J. Madéo, S. Barbieri, P. Filloux, C. Sirtori, X. Marcadet, J. Tignon, S. Dhillon,  _Nature Communications_ 2010, _1_ , 1 69.
  * [31] Y. Zhao, Z. Li, K. Zhou, X. Liao, W. Guan, W. Wan, S. Yang, J. Cao, D. Xu, S. Barbieri, et al.,  _Laser & Photonics Reviews_ 2021, _15_ , 4 2000498\.
  * [32] D. Burghoff, Y. Yang, Q. Hu,  _Science Advances_ 2016, _2_ , 11 e1601227.
  * [33] J. Chen, K. Nitta, X. Zhao, T. Mizuno, T. Minamikawa, F. Hindle, Z. Zheng, T. Yasui,  _Advanced Photonics_ 2020, _2_ , 3 036004.
  * [34] F. Cappelli, L. Consolino, G. Campo, I. Galli, D. Mazzotti, A. Campa, M. Siciliani de Cumis, P. Cancio Pastor, R. Eramo, M. Rösch, et al.,  _Nature Photonics_ 2019, _13_ , 8 562.
  * [35] H. Li, P. Laffaille, D. Gacemi, M. Apfel, C. Sirtori, J. Leonardon, G. Santarelli, M. Rösch, G. Scalari, M. Beck, J. Faist, W. Hänsel, R. Holzwarth, S. Barbieri,  _Optics Express_ 2015, _23_ , 26 33270.
  * [36] W. Wan, H. Li, T. Zhou, J. Cao,  _Scientific Reports_ 2017, _7_ 44109\.