Simplified intensity- and phase-modulated transmitter for modulator-free decoy-state quantum key distribution

Quantum key distribution (QKD) allows secret key exchange between two users with unconditional security. For QKD to be widely deployed, low cost and compactness are crucial requirements alongside high performance. Currently, the majority of QKD systems demonstrated rely on bulk intensity and phase modulators to generate optical pulses with precisely defined amplitude and relative phase difference i.e., to encode information as signal states and decoy states. However, these modulators are expensive and bulky, thereby limiting the compactness of QKD systems. Here, we present and experimentally demonstrate a novel optical transmitter design to overcome this disadvantage by generating intensity- and phase-tunable pulses at GHz clock speeds. Our design removes the need for bulk modulators by employing directly modulated lasers in combination with optical injection locking and coherent interference. This scheme is, therefore, well suited to miniaturization and photonic integration, and we implement a proof-of-principle QKD demonstration to highlight potential applications.

In QKD protocols, time-bin encoding is commonly used [15][16][17][18] where the temporal modes of a time-bin qubit (early and late time bins) and the phase between them are used to encode the key bits.As practical single photon sources are not yet widely available, QKD systems typically employ lasers to generate weak coherent states to approximate the time-bin qubits.Since the photon number statistics of laser emission follows a Poisson distribution, the emitted pulses have a nonnegligible probability of containing more than one photon, making laser-based QKD systems susceptible to a photon-number-splitting (PNS) attack [19].Although it is still possible to obtain unconditional security, the signal flux has to be heavily attenuated in order to suppress multi-photon emission, thus giving a poor scaling of the secure key rate with transmission distance [20].Fortunately, this problem can be overcome by employing the decoy state method [21,22]: in addition to sending signal states, one also randomly sends a small number of states with reduced intensity, known as decoy states.A potential eavesdropper cannot distinguish between signal states and decoy states, thus any attempt to perform photon-number-dependent attacks can be detected from the measured photon statistics.As a result, with the de-coy state method, single-photon bounds can be reliably estimated and therefore improve the scaling of secure key rate with distance significantly.
Implementing a decoy-state QKD transmitter requires the ability to on-off modulate each time bin within a state, modulate the phase between time bins, as well as vary the intensity level to generate decoy states.To date, this has been achieved by placing intensity modulators after a light source to control the output intensity and phase modulators are also required in order to encode the phase information.Conventional intensity and phase modulators are based on LiNbO 3 crystals.While these modulators are widely available and offer high performance, they are expensive, bulky (centimeter-scale) and require high driving voltage (typically > 4V) which often necessitates the addition of amplifiers.It is therefore highly beneficial to develop an alternative approach that can replace such modulators as it would significantly reduce the overall complexity, making QKD systems more compact and cost-effective.
Recently, Yuan et al demonstrated an efficient scheme to perform direct phase modulation without the need for phase modulators [23].Precise phase control is enabled by exploiting optical injection locking (OIL) and gainswitching techniques.Following this work, direct phase modulated laser transmitters for QKD have been studied more widely [24], bringing the benefits of compact lowdrive-voltage phase modulation for chip-based QKD [9] as well as other emerging protocol such as measurementdevice-independent QKD [25].More recently, the theoretical aspect of the direct phase modulation scheme has also been studied, verifying its favourable features in practical usage [26].While this scheme allows phase information to be directly encoded, it cannot be used APL Photonics 8, 036111 (2023); https://doi.org/10.1063/5.0128445arXiv:2304.00574v1[quant-ph] 2 Apr 2023 to control the intensity of pulses for decoy state generation.Since a direct intensity modulation scheme is still missing, the use of bulk intensity modulators has been unavoidable.
In this work, we present a novel approach that can directly generate intensity and phase modulated optical pulses.Our scheme only requires two laser diodes and a passive asymmetric Mach-Zehnder interferometer (AMZI).Such pulse source can generate all encoding states required for decoy-state QKD, thereby eliminating the need for external modulators and opening a new route for the development of compact, cost-effective and high-performance QKD systems.

DIRECT GENERATION OF ENCODING STATES
Our scheme further extends direct phase modulation techniques [23] by generating and interfering three intermediate pulses with carefully crafted relative phases, in order to accurately control both the relative phase and intensity of the final output pulses.The experimental setup is shown in Fig. 1a.The two laser diodes (referred to as 'master' and 'slave', following standard nomenclature) are connected in an OIL configuration.The master laser is gain-switched such that the laser produces long pulses (i.e. with high duty cycle) when it is driven above the threshold and switched off between the pulses.As a result, each pulse is produced with a random phase as they are seeded by spontaneous emission photons [27].Subsequently, these pulses are injected through a circulator into the slave laser, which is gain-switched to produce three short pulses within each long master pulse [see Fig 1b (i)-(ii)].Because the stimulated emission of the slave laser is seeded by the injected photons, the three slave pulses inherit the phase of the corresponding injected master pulse.The relative phases between these pulses are well defined as they are seeded by the same master pulse, however, collectively their global phase is random.
In order to prepare the slave pulses for interference to achieve the desired outputs, their relative phases need to be carefully controlled.This is achieved by manipulating the phase evolution of the master pulse which can be realised by introducing an amplitude perturbation to the electrical driving signal of the master laser [23] [Fig. 1b (i)].This electrical modulation, with a temporal width of ∆t m , changes the carrier density in the laser cavity, which in turn alters the cavity refractive index and causes a temporary optical frequency shift of ∆ν, thus the photons produced after the modulation experience a phase shift of ∆φ = 2π∆ν∆t m [23].By locating the modulation in the interval between the onsets of two slave pulses, this phase difference can be transferred on to the slave pulses.As shown in Fig. 1b, the relative phases between the three slave pulses, φ 12 and φ 23 , can be implemented independently by adding two small electrical perturbations to the master laser.
The prepared slave pulses then pass through an AMZI with one of its arms having a delay line that matches with the temporal separation of the slave pulses, resulting in interferences between consecutive slave pulses.As shown in Fig. 1b (iv), at the outputs of the AMZI, three pulses are formed within a single logical bit: two of them with their intensities and the relative phase completely determined by φ 12 and φ 23 , whereas the third pulse has a random intensity due to the interference of two slave pulses originating from different master pulses with random phase relation (indicated in grey shading).As a result, the first two pulses could be used to represent the early and late bin for time-bin encoding.
To express the relative phase between the early and late time bins and their intensities in terms of φ 12 and φ 23 , we consider the pulses generated by the slave laser as three coherent states |α 1 , |α 2 and |α 3 , with amplitude A: where the phase of the first coherent state, φ 1 , is uniformly distributed over [0, 2π).
In the AMZI, the interference between |α 1 and |α 2 ( |α 2 and |α 3 ) gives rise to the early (late) time bin |α E ( |α L ), which can be expressed as: and their corresponding intensities and phases are given by respectively.The relative phase between the early and late time bins φ EL and their intensities are simulated based on Eqn. 3 and shown in Fig. 2.This scheme could therefore be applied to time-bin based BB84 decoystate QKD with Z and Y basis encoding.For Z-basis encoding, a pulse is located in either the early time bin (representing bit 0) or the late time bin (representing bit 1).To encode bit 0, φ 12 is set to 0 to produce a pulse with maximum intensity in the early time bin and φ 23 is set A decoy state in the Z basis can be generated in a similar way as described above.Instead of using zero relative phase which results in a pulse with maximum intensity, a decoy state with a lower intensity can be generated by choosing a relative phase close to π, according to Fig. 2a.For example, a decoy bit-0 state with an intensity of 0.1 can be generated by choosing φ 12 = 0.9π and φ 23 = π.Therefore, the flexibility to adjust the intensity level of the decoy state is enabled simply by implementing the appropriate relative phases, which itself is controlled by simple modulation of the electrical drive signal applied to the master laser.
In the Y-basis, a single bit comprises both the early and late time bins with a relative phase of π/2 (bit 0) or 3π/2 (bit 1).Each time bin has half the intensity of the signal state in the Z basis.From Eqn. 2, the relative phase between the early and late time bins is simply φ EL = (φ 12 + φ 23 )/2.Since the intensities of the early and late time bins must be equal, it is necessary that φ 12 = φ 23 .As a result, to encode bit 0 with φ EL = π/2, φ 12 = φ 23 = π/2.Similarly, to encode bit 1 with φ EL = 3π/2, φ 12 = φ 23 = 3π/2.A summary of the phase settings for various potential encoding states including an example of decoy state is illustrated in Fig. 3. FIG.3: Direct generation of possible QKD states with the corresponding phase settings on the master laser.

RESULTS
A key element to implement our proposed scheme is precise control of the relative phases between slave laser pulses, φ 12 and φ 23 , as they completely determine the final output states.This can be achieved by carefully adjusting the amplitude of the modulation applied to the master laser's electrical signal.The master laser is operated at 667 MHz and the slave laser at 2 GHz so that every master pulse is long enough to seed three slave pulses.A modulation with a fixed temporal width of 150 ps is applied to the electrical signal between the onsets of two slave pulses and its voltage amplitude is varied.The amplitude of the pulse at the output of the AMZI is measured as a function of modulation voltage, as shown in Fig. 4a, confirming the ability to continuously tune the transmitter output pulse intensity.Fig. 4b shows that the half-wave voltage, V π is around 0.8 V, which is significantly lower than that of common LiNbO 3 phase modulators.The minor deviation from the theoretical values can be attributed to the imperfections in experimental equipment (e.g.phase noise in lasers).
To demonstrate the potential of our scheme for QKD, we implement a BB84 protocol with two decoy states [28].The experimental setup is shown in Fig. 5.The outputs of Alice (transmitter) (Fig. 6) consist of a random mixture of the signal states with intensity µ prepared in the Z and Y bases and the decoy states with intensities ν and ω prepared in the Z basis, where µ > ν > ω.The intensity levels of the decoy states can be accurately adjusted to maximise the key rate performance.A variable optical attenuator is placed before the output of Alice in order to attenuate the signals to the desired mean photon number level.Bob (receiver) adopts passive basis choice using a beamsplitter.In the Z basis, the photons are directly detected by a single-photon detector (SPD) where the bit value can be retrieved from their arrival time using a time-tagger.In the Y basis, the photons pass through an AMZI which results in three interfering pulses within a bit.Only the first interfering pulse is measured as it is originated from the interference between the early and late time bins.The phase basis of the AMZI is adjusted such that bits 0 and 1 correspond to the detections in different detectors.The other two interfering pulses involve the interference of photons with no deterministic phase difference and they are not processed to use for key generation (similar to the traditional processing scheme for detecting phase-encoded time bins using an AMZI at Bob [23]).Very slight variation in pulse heights in Fig. 6 is related to the finite bandwidth of real-world high-speed components.This has been observed in other QKD transmitter designs too, not related to our new approach introduced here.The study of such real-world encoding imperfections is a topic in its own right and various solutions have been proposed including variations to the security proofs and post-processing [29,30].
In our proof-of-principle QKD experiment, we implement a standard, asymptotic, decoy-state BB84 analysis [28] which does not explicitly consider the presence of the extra pulses inherent to our modulation scheme.A full Intensity (a.u.) security proof is beyond the scope of this work, but we provide some arguments as to why this should not represent an issue in the discussion section.The quantum bit error rate (QBER) is measured and used to compute the secure key rate (SKR), as shown in Fig. 7. Positive key rates can extend up to a channel loss of 48 dB (equivalent to 240 km of standard fiber with an attenuation of 0.2 dB/km).A secure key rate of 2.21 Mbps is measured at dB (75 km), demonstrating the suitability of our system for metro-scale QKD networks.The QBER can be maintained at a base level of 3.3% before the detector noise becomes comparable to the signal counts at high channel losses.This is comparable to the performance achieved by QKD systems using conventional phase and intensity modulators [16,31].

DISCUSSION
We have demonstrated a simple scheme to generate phase-and intensity-tunable pulses at GHz clock speeds, which can implement the BB84 protocol without the need for any phase or intensity modulators.As shown above, the performance of QKD based on our scheme approaches that of conventional LiNbO 3 modulators.We attribute this feature to the adoption of OIL which reduces the timing jitter and the frequency chirp in the output pulse significantly [27,32], whilst maintaining a coherent phase transfer from the master to the slave laser.
The presence of the additional pulses in this modulation method means it is not completely trivial to apply the security proof for a standard scheme [28].The concern would be that Eve could somehow break the security by attacking these extra pulses.However, this is unlikely to be true as the state in these extra time bins is essentially obfuscated by the phase randomisation procedure.Additionally, well known uncertainty relations between phase and photon number further constrain Eve's ability to extract relevant information.In Appendix A we describe these arguments in more detail and provide a sketch for how a fully general security proof could be carried out.
Compared to the common approach where dedicated phase and intensity modulators are required in the transmitter to generate the encoding states and the decoy states, our scheme allows all such states to be generated directly from two lasers and an AMZI by exploiting direct phase modulation technique [23] and coherent interference.In this way, not only do we remove the modulators but also the high-speed RF signals and power supplies necessary to drive the modulators, thereby reducing the complexity and the cost of a QKD system significantly.
As our transmitter only has two active components (i.e. the lasers), the power consumption is expected to be low.Together with the low V π , the design is well-suited for on-chip integration [9], offering a route to compact, low cost and power efficient quantum transmitters.Beyond QKD, this simple approach to generating intensityand phase-variable pulses could find other applications in classical optical communications, where the ability to precisely manipulate intensity and phase enables novel high-density encoding schemes for pushing communication bit rates.
In conclusion, we have demonstrated a scheme to directly generate phase-and intensity-tunable pulses at high speed, using two gain-switching lasers in an OIL configuration with an AMZI.By applying appropriate electrical driving signals to the lasers, the intensity and phase of the pulses can be simply varied.The design is shown to have strong potential as a QKD transmitter for decoy-state QKD, where all required encoding and decoy states for a BB84 protocol can be directly generated without any bulk modulators.Thus, our scheme offer a new possibility to perform QKD using compact, lowcost, yet high-performance devices, advancing the development of quantum communications towards larger scale deployments.

APPENDIX A Experimental setup
The transmitter consists of two independent DFB lasers with a 10 GHz modulation bandwidth and an integrated thermoelectric cooler, operating at 1550 nm.The two lasers are connected through a circulator, allowing light to be injected from the master to the slave laser.A variable optical attenuator is used to adjust the injection power.Each laser is driven by an arbitrary waveform generator with a sampling rate of 24 GS/s and 10-bit vertical resolution.The RF driving signal is amplified by an RF amplifier and then combined with a DC bias via a bias-tee.The two modulations on the master RF signals have a temporal width of 150 ps and a separation of 450 ps from each other.The modulation level depends on the desired outputs.The delay between the RF signals of the two lasers are temporally aligned with picosecond resolution to ensure that the slave pulses are coherently seeded by the correct master pulses.The master (slave) laser is driven at a clock rate of 667 MHz with a on-time of 1.4 ns (2 GHz with an on-time of 300 ps).The AMZIs placed in the transmitter and the receiver are chip-based interferometers.Each of them has a delay line of 500 ps and an integrated heater which can be controlled electronically in one of its arms.The heater acts as a phase shifter which is used to tune the phase delay between the two arms and align the phase basis between the transmitter and the receiver.An optical filter is also used in the transmitter to reduce the noise and enhance the phase coherence.The channel loss is emulated using a variable optical attenuator.A superconducting nanowire single photon detector with ∼70% efficiency and 50 Hz dark counts is used in the receiver.The detection events are measured with a 100 ps resolution time tagger.A central window of 300 ps of the time bin is selected in order to suppress the errors due to timing jitter.

QKD protocol
We implement the two-decoy-state BB84 protocol in the asymptotic case [28] with imbalanced basis choice where the Y (Z) basis is selected with a probability of 90% (10%), i.e.Y (Z) basis is the majority (minority) basis.The average photon numbers of the signal (µ), decoy (ν) and vacuum (ω) states are 0.4, 0.16 and 0.015, respectively.Alice randomly prepares µ, ν and ω in the Z basis but only prepare the µ in the Y basis.To match with Alice's basis-sending probability, Bob uses a beamsplitter with a splitting ratio of 90:10 to implement passive basis choice where Z basis is chosen with a probability 10% and Y basis is chosen with a probability of 90%.The key bits are extracted from the Y basis only whereas the Z basis is used to estimate the information leakage.The gain and QBER for each state are measured to estimate the final secure key rate analytically [28].

Security discussion
Here we provide some more details about the additional security considerations that may arise due to the additional pulse that arises in our modulation scheme and sketch how the standard decoy-state BB84 security proof could be modified to account for these.The two issues to keep in mind are i) whether any information about the encoded bits is leaked directly or ii) whether the global phase randomisation (and hence the decoy-state analysis) is compromised, potentially overestimating the secret key rate.where the key is encoded in the phase difference between the pulses in the first two time bins, labelled early (E) and late (L), followed by a unused, randomised pulse in the so-called random (R) bin.To fully capture all the potentially relevant correlations we need to also consider the pulses either side of a given encoding (i.e. last pulse of the preceding triplet, |α P 3 , and the first pulse of the following triplet, |α F 1 ).The action of the AMZI is to mix each pulse with a vacuum state at the input beamsplitter and then delay the upper (U) arm to be recombined with the subsequent pulse at the final beamsplitter.This means that, before the AMZI, the first pulse of a given encoding triplet occupies the time bin associated with the random pulse of the preceding triplet.In other words the states in the various time bins before the AMZI are given by (see also Fig. 8) where A ∈ R is the input intensity of each pulse and φ 12 and φ 23 are the relative phases that are chosen to encode one of the four BB84 states.Note that φ 1 must be uniformly distributed over [0, 2π) in order to make the output ensemble phase randomised.The preceding and following triplets also have a randomised phase, which for brevity we here write relative to the first triplets phases via the variables φ F R , φ P R , which is therefore also uniformly distributed over [0, 2π).These states can be propagated through the initial beamsplitter, time delay and final beamsplitter to derive the following output states, The complex amplitude describing a coherent state can be expressed as a phase and an intensity, |α = |re iφ , where which gives, From this we can immediately verify the claims in the main text that the intensity of the E and L bins are controlled by φ 12 and φ 23 and that the phase difference between the E and L bins is given by φ EL = (φ 12 + φ 23 )/2, which allows the following encoding pattern for all four BB84 states

Security considerations
Turning to the security implications of the the 'random' pulses, straightforward substitution of Eq.A5 into Eq.A2 shows that the coherent amplitude of both the R and R P bins is identical for all encoding choices (this is because for all settings in Eq.A5 it holds that φ 12 + φ 23 = π mod 2π.This might seem initially sufficient to argue that there is no additional information leakage due to the extra pulses.However, one should also consider the possibility that Eve could choose to combine different pulses in her attack.For instance the relative phases between the early at late bins and their adjoining randomised pulses are, By themselves, the values of φ LR and φ ER P leak no information because the phases that determine the secret key, φ 12 and φ 23 , are effectively one-time padded by the uniformly distributed variables, φ P R and φ F R .However, by considering Eq.A4 we can see information about φ P R and φ F R could in turn be obtained by measuring the intensity of the random pulses (r R P and r R ).Nevertheless, security can still be maintained provided it is impossible for Eve to simultaneously learn the relative phases of any two pulses and the corresponding intensities, which is the case due to the conjugate nature of the number and phase operators.A measurement that perfectly revealed that photon number in either the R or R P bins would totally randomise the phase.Moreover, even if Eve chooses to maximise her information about relative phases in Eq.A4 this will tell her nothing about the absolute phase of each encoding triplet (φ 1 , φ P 1 etc) since learning the difference between two uniformly random variables leaks no information about either variable.Thus the phase randomisation condition required for a decoy state analysis is not compromised.
Although a full security proof is beyond the scope of this work, we provide a sketch of how one could proceed.Firstly, one would adapt the standard decoy argument to show that, from Eve's perspective at the ensemble level, the experimental scheme is indistinguishable from a scheme in which Alice and Bob prepare true single photon qubits in the E and L bins along with extra coherent states in the random bins.Then, construct a complete entanglement based version of this modulation scheme, including a fictitious measurement on a suitably prepared entangled state that determines the randomised phase of each encoding triplet and projectively prepares the appropriate coherent state in each random bin.The total system would then be described by a pure state |X A BER A R where R describes the extra coherent pulses and R A is a Alice's register of the randomised phase values (these are never used in the protocol so there is no actual need for Alice to possess this register, it is only necessary that Eve does not posses it).Then, in the worst case one would simply assume that Eve is given the entire R system and one would then bound Eve's conditional entropy about the Alice's key generation measurements, S(Z A |ER).Note that this approach means no extra monitoring of the random bins is required.The previous arguments regarding the impossibility of learning the key from the R register could be made quantitative by utilising tools such as entropic uncertainty relations for phase and photon number (e.g.[33,34]).Some of these results require an upper bound on the energy, but this is simply given by the maximum encoding amplitude, A. These would be combined with the standard security arguments for the information leaked through Eve's purification of the channel describing the measured time bins [28] would be sufficient to determine the secret key rate.

FIG. 1 :FIG. 2 :
FIG. 1: Directly intensity and phase modulated transmitter scheme: (a) The design of the transmitter based on two directly modulated lasers in optical injection locking setup and an AMZI.(b) Schematic illustration of operating principle.

23 FIG. 4 :
FIG. 4: Experimental characterisation of the pulse generated at the outputs of the AMZI.Intensity of an individual pulse (top) and the relative phase between a pulse pair (bottom) as a function of modulation voltage applied to the master laser.A cosine (linear) fit is applied to the top (bottom) plot.

FIG. 6 :
FIG.6: Time-averaged pulse pattern generated with direct modulation scheme.The corresponding flux and bit value for each bit are indicated at the top of the figure.The red pulses are used for QKD operation whereas the grey pulses are phase-randomised pulses.Signal states (µ) and decoy states (ν and ω) can be readily generated without any external modulator.

FIG. 7 :
FIG.7: Key rates and QBER performance of the BB84 protocol carried out by our directly modulated transmitter scheme.The experimental data (dots) are consistent with simulated rates (lines).

FIG. 8 :
FIG. 8: Schematic of direct phase and intensity modulation technique.The incoming pulse train of five time bins shows a complete triplet α 1,2,3 along with the first pulse of the following triplet α F 1 and the last pulse of the preceding triplet α P 3 .A delay in the top arm of the AMZI causes interference between successive pulses, which facilitates modulation of the relative phase and intensity of the output state in the early (E) and late (L) time bins.