The 2015 ultrabroadband quantum-secured communication proposal (Zhuang, Zhang, Dove, Wong, Shapiro, arXiv:1508.01471) showed that a two-way protocol using an amplified-spontaneous-emission source, binary phase-shift keying, and optical amplification could in principle support Gbit/s quantum-secured direct communication and quantum key distribution at metropolitan range, and it posed three open issues: attainability of the two-way bits-per-mode bound 2log⁡2((1+κS)/(1−κS))2\log_2((1+\kappa_S)/(1-\kappa_S)), a wideband long-lived quantum memory needed for direct communication under active eavesdropping, and a general proof of optimality of the eavesdropper's active attack; the follow-up floodlight-QKD security-framework paper (Phys. Rev. A 98, 032332 (2018)) then identified the remaining security-analysis gap as a general composite (composable), finite-key treatment of Eve's coherent attack, including implementation security. The first issue is settled: the bound is not attainable, since the exact repeaterless secret-key capacity −log⁡2(1−κS)-\log_2(1-\kappa_S) per channel use was proved by Pirandola et al. in 2017. The attack-optimality issue is settled only within the asymptotic collective-attack and coherent-to-collective reduction framework of the follow-up floodlight-QKD papers, so its general (coherent-attack) form remains open. A precise open core survives: a composable, finite-key security proof against general coherent active attacks for this protocol family including implementation imperfections, the general active-attack optimality underlying such a proof, and the wideband optical quantum memory required for quantum-secured direct communication operation.

Background

In quantum key distribution (QKD), two parties (Alice and Bob) share a quantum channel and an authenticated classical channel and distill a secret key, typically used as a one-time pad — an encryption scheme whose key is as long as the message and used once, which is information-theoretically secure. Quantum-secured direct communication (QSDC) is a stronger operational mode: the secret message itself is sent directly over the quantum channel, in blocks, with eavesdropping detected by channel monitoring before the information-bearing portion is decoded, so that no prior key is needed. Zhuang et al. (arXiv:1508.01471) proposed a two-way protocol in which Alice transmits light from an amplified-spontaneous-emission (ASE) source — a broadband, noisy, thermal-like optical source — through single-mode fiber of one-way transmissivity κS\kappa_S; Bob applies binary phase-shift keying (BPSK, encoding a bit in a 0-or-π\pi phase shift of the light), amplifies the return field optically, and sends it back, and Alice reads it by homodyne detection (measurement of one field quadrature against a strong local oscillator). Each transmitted symbol is spread over many temporal modes of the ASE/SPDC phase-matching bandwidth W∼W\sim THz, which is what gives Gbit/s-class secure rates at 50 km despite channel loss. Security against a passive eavesdropper (Eve), who collects all light lost from the fibers, rests on her inability to clone the low-brightness (NS≪1N_S\ll1 photons per mode) multimode thermal field; against an active eavesdropper, who injects her own light, Alice and Bob use coincidence-based channel monitors to estimate an intrusion fraction fEf_E (the fraction of light entering Bob's terminal attributable to Eve). A spontaneous parametric downconverter (SPDC, a source based on the second-order optical nonlinearity χ(2)\chi^{(2)} that produces correlated signal-idler photon pairs) driven by Eve and coupled in through a beam splitter is her natural active attack, since retaining the idler gives her a quantum reference for her injected signal. The paper's security analysis bounds Eve's Holevo information (an upper bound on her accessible information about the key) for collective attacks, in which Eve couples an independent identically-prepared ancilla to each transmitted mode and measures all ancillas jointly at the end; coherent attacks, in which she acts jointly on all modes with an arbitrary adaptive strategy, are strictly stronger, and composable security — a proof that the protocol yields a key usable in arbitrary later applications except with probability ϵ\epsilon, with explicit finite-key (finite block length) corrections — is the accepted standard for deployed QKD. On fundamental limits, Takeoka, Guha, and Wilde (Nat. Commun. 5, 5235 (2014)) used squashed-entanglement methods (an entanglement measure in which the environment's correlations are squashed by a local channel) to upper-bound the secret-key rate of any QKD protocol over a pure-loss channel of transmissivity η\eta by log⁡2((1+η)/(1−η))\log_2((1+\eta)/(1-\eta)) bits per mode, and by twice that, 2log⁡2((1+η)/(1−η))2\log_2((1+\eta)/(1-\eta)), for two-way protocols using the channel in both directions — the bound quoted by Zhuang et al. In 2017, Pirandola, Laurenza, Ottaviani, and Banchi established the exact two-way-assisted secret-key capacity of the pure-loss channel, −log⁡2(1−η)-\log_2(1-\eta) bits per mode, via the relative entropy of entanglement and teleportation stretching, superseding the Takeoka-Guha-Wilde bound; the rate −log⁡2(1−η)-\log_2(1-\eta) is achievable in the ideal limit by reverse-reconciliation continuous-variable QKD (Pirandola et al., PRL 102, 050503 (2009); García-Patrón et al., PRL 102, 210501 (2009)). The protocol family was subsequently developed as floodlight QKD (FL-QKD): its theory (Phys. Rev. A 94, 012322 (2016)), a demonstration framework (Phys. Rev. A 95, 012332 (2017), DOI: 10.1103/PhysRevA.95.012332), and an experiment reaching 1.3 Gbit/s secret-key rate over 10 dB channel loss (Quantum Sci. Technol. 3, 025007 (2018)), with security proven only against frequency-domain collective attacks in the asymptotic regime. For QSDC operation, Bob must store his modulated, amplified return light for a monitoring time TMT_M — about 1 s at 50 km in the source analysis — while Alice and Bob verify from singles and coincidence rates that no active intrusion violates a set bound, which is far beyond current optical quantum memories (rare-earth-ion crystals offer long storage but narrow bandwidths; atomic-vapor Raman memories offer GHz bandwidths but only short storage).

Problem Statement

For the ultrabroadband two-way quantum-secured communication protocol family introduced by Zhuang et al. (arXiv:1508.01471) and developed as floodlight QKD — Alice's amplified-spontaneous-emission source, Bob's binary phase-shift keying and optical amplifier, Alice's homodyne receiver, multimode encoding over a THz-class bandwidth WW, and coincidence-based channel monitoring with estimated intrusion fraction fEf_E over links of one-way transmissivity κS\kappa_S — the open problem is to complete its security theory against an unrestricted eavesdropper and to supply the missing capability for its direct-communication mode. Concretely: (1) establish a composable, finite-key security proof for this protocol family against general coherent attacks, in which Eve applies an arbitrary adaptive strategy acting jointly on all modes of both propagation directions and may inject her own light, with explicit finite-block-length key-rate expressions, and with implementation imperfections (amplifier noise, detector inefficiencies, side channels) included in the security model; (2) determine, in the same setting, whether Eve's optimal active attack is the spontaneous-parametric-downconversion (SPDC) beam-splitter injection characterized in the asymptotic collective-attack analyses — a general optimality proof, or an explicit strictly stronger attack strategy; and (3) provide the enabling experimental capability for quantum-secured direct communication under active eavesdropping: an optical quantum memory that stores modes of THz-class bandwidth for the channel-monitoring time TMT_M (about 1 s at 50 km in the source analysis), so that Bob can return his modulated, amplified light only after the channel has been verified safe. These three components serve one objective: making Gbit/s-class ultrabroadband two-way quantum-secured communication, in both its key-distribution and direct-communication modes, secure against arbitrary eavesdroppers. The task is complete only when all three components are resolved; a resolution of any one of them is a reportable partial result, and each may be attacked and reported separately. For (3), the required capability is a concrete quantum-memory design (or demonstrated device) that stores modes of THz-class bandwidth for at least the channel-monitoring time TMT_M and releases them on demand with a retrieval efficiency and fidelity high enough to keep the returned light usable for the direct-communication protocol, not merely nonzero or nominal; the design must report the achieved retrieval efficiency and fidelity together with its operating bandwidth, storage time, and temperature. A qualitative feasibility sketch, or a design whose retrieval efficiency or fidelity is too low for the returned light to be usable, does not resolve it. The source's attainability issue — whether the two-way bits-per-mode bound 2log⁡2((1+κS)/(1−κS))2\log_2((1+\kappa_S)/(1-\kappa_S)) is attainable by any protocol — is resolved and excluded from the open problem: the bound is not attainable, because the exact two-way-assisted secret-key capacity of the pure-loss channel is −log⁡2(1−κS)-\log_2(1-\kappa_S) per mode (Pirandola et al. 2017), giving −2log⁡2(1−κS)-2\log_2(1-\kappa_S) per bidirectional mode pair as the true ultimate rate.

References

  1. Q. Zhuang, Z. Zhang, J. Dove, F. N. C. Wong, J. H. Shapiro, 'Ultrabroadband Quantum-Secured Communication,' arXiv:1508.01471 (2015). https://arxiv.org/abs/1508.01471
  2. M. Takeoka, S. Guha, M. M. Wilde, 'Fundamental rate-loss tradeoff for optical quantum key distribution,' Nature Communications 5, 5235 (2014). DOI: 10.1038/ncomms6235. https://doi.org/10.1038/ncomms6235
  3. S. Pirandola, R. Laurenza, C. Ottaviani, L. Banchi, 'Fundamental limits of repeaterless quantum communications,' Nature Communications 8, 15043 (2017). DOI: 10.1038/ncomms15043, arXiv:1510.08863. https://arxiv.org/abs/1510.08863
  4. S. Pirandola, R. García-Patrón, S. L. Braunstein, S. Lloyd, 'Direct and Reverse Secret-Key Capacities of a Quantum Channel,' Physical Review Letters 102, 050503 (2009). DOI: 10.1103/PhysRevLett.102.050503. https://doi.org/10.1103/PhysRevLett.102.050503
  5. R. García-Patrón, S. Pirandola, S. Lloyd, J. H. Shapiro, 'Reverse Coherent Information,' Physical Review Letters 102, 210501 (2009). DOI: 10.1103/PhysRevLett.102.210501. https://doi.org/10.1103/PhysRevLett.102.210501
  6. Q. Zhuang, Z. Zhang, J. Dove, F. N. C. Wong, J. H. Shapiro, 'Floodlight quantum key distribution: A practical route to gigabit-per-second secret-key rates,' Physical Review A 94, 012322 (2016). DOI: 10.1103/PhysRevA.94.012322, arXiv:1510.08737. https://arxiv.org/abs/1510.08737
  7. Z. Zhang, C. Chen, Q. Zhuang, F. N. C. Wong, J. H. Shapiro, 'Experimental quantum key distribution at 1.3 gigabit-per-second secret-key rate over a 10 dB loss channel,' Quantum Science and Technology 3, 025007 (2018). DOI: 10.1088/2058-9565/aab623. https://doi.org/10.1088/2058-9565/aab623
  8. Q. Zhuang, Z. Zhang, N. Lütkenhaus, J. H. Shapiro, 'Security-proof framework for two-way Gaussian quantum-key-distribution protocols,' Physical Review A 98, 032332 (2018). DOI: 10.1103/PhysRevA.98.032332, arXiv:1805.10314. https://arxiv.org/abs/1805.10314
  9. S. Ghorai, E. Diamanti, A. Leverrier, 'Composable security of two-way continuous-variable quantum key distribution without active symmetrization,' Physical Review A 99, 012311 (2019). DOI: 10.1103/PhysRevA.99.012311, arXiv:1806.11356. https://arxiv.org/abs/1806.11356
  10. D. Pan, G.-L. Long, L. Yin, Y.-B. Sheng, D. Ruan, S. X. Ng, J. Lu, L. Hanzo, 'The Evolution of Quantum Secure Direct Communication: On the Road to the Qinternet,' IEEE Communications Surveys & Tutorials 26(3), 1898-1949 (2024). DOI: 10.1109/COMST.2024.3367535, arXiv:2311.13974. https://arxiv.org/abs/2311.13974