An integrated quantum repeater at telecom wavelength with single atoms in optical fiber cavities

Abstract

Quantum repeaters promise to enable quantum networks over global distances by circumventing the exponential decrease in success probability inherent in direct photon transmission. We propose a realistic, functionally integrated quantum-repeater implementation based on single atoms in optical cavities. Entanglement is directly generated between the single-atom quantum memory and a photon at telecom wavelength. The latter is collected with high efficiency and adjustable temporal and spectral properties into a spatially well-defined cavity mode. It is heralded by a near-infrared photon emitted from a second, orthogonal cavity. Entanglement between two remote quantum memories can be generated via an optical Bell-state measurement, while we propose entanglement swapping based on a highly efficient, cavity-assisted atom-atom gate. Our quantum-repeater scheme eliminates any requirement for wavelength conversion such that only a single system is needed at each node. We investigate a particular implementation with rubidium and realistic parameters for Fabry–Perot cavities based on $\hbox {CO}_2$ laser-machined optical fibers. We show that the scheme enables the implementation of a rather simple quantum repeater that outperforms direct entanglement generation over large distances and does not require any improvements in technology beyond the state of the art.

1 Introduction

Heralded entanglement between particles separated by large distances is a valuable resource in quantum communication. The applications range from fundamental tests of quantum physics like loophole-free Bell tests [1, 2] to device-independent quantum key distribution (QKD) [3, 4]. The distribution of entanglement via the direct transmission of photons via fiber optics is practically impossible for large distances, because the inevitable losses in optical fibers cause an exponential decrease of the success rate with distance. This can be overcome by dividing the distance into smaller segments with quantum-repeater nodes in between [5].

The performance of quantum repeaters can be characterized by the rate at which pairs of quantum memories separated by a given distance can be entangled with high fidelity. The obvious benchmark for a quantum repeater to beat is the rate achievable via direct transmission. The critical parameter in the latter case is the attenuation length of the optical fiber, which is maximal at telecom wavelengths around 1.3 and 1.5 μm, where the absorption in optical fibers is low [6, 7]. In order to keep the technological overhead minimal, it is therefore essential to operate a quantum repeater at a telecom wavelength. Additional requirements for an efficient quantum repeater are quantum memories with coherence times by far exceeding the average time required for the protocol to succeed and high-efficiency and high-fidelity implementations of all subparts of the protocol. These include entanglement generation and entanglement distribution via photons as well as entanglement swapping using single-qubit operations, two-qubit operations and state readout. Against this backdrop, various systems have been proposed for the implementation of a quantum repeater, e.g., atomic ensembles [8], single neutral atoms and ions [9], nitrogen vacancy centers [10], quantum dots [9] and ion-doped solids [11].

Single atoms in optical cavities are especially promising [12], because they can be isolated from the environment to provide long coherence times [13] and have been shown to be an efficient light-matter interface [14]. Several subparts of a quantum-repeater protocol have been successfully implemented with these systems at near-infrared wavelengths, e.g., the generation of atom-photon entanglement [15], an atom-photon quantum gate [16] and the heralded storage of a photonic quantum bit [17]. Demonstrations of a quantum repeater that go beyond proof of concept will have to find a way to combine these operations with telecom-wavelength photons. This has recently sparked very active research in external devices that convert photonic qubits at wavelengths in the near-infrared to telecom wavelengths [18, 19]. An alternative route being pursued is the generation of an entangled photon pair via spontaneous parametric down-conversion, with one photon at telecom wavelength and the other in the near-infrared, followed by storage of the near-infrared photon in a quantum memory [20, 21]. While these strategies seem straightforward, they come at the price of a large technological overhead and reduced efficiency.

Here, we therefore propose to perform the required operations directly at telecom wavelengths, thereby avoiding any issues that arise from combining the different technologies. We describe a realistic scheme for a simple quantum repeater that can be implemented using current technology and show that it is capable of outperforming schemes based on direct transmission. The basic unit is illustrated in Fig. 1. Heralded entanglement between a single atom in a crossed-cavity setup and a photon at telecom wavelength is created. The telecom photons from two remote atoms are sent to a photonic Bell-state analyzer to create heralded remote entanglement. Once the two atoms at the central node are each entangled with a different remote node, an atomic Bell-state measurement (BSM) is performed for entanglement swapping. The scheme can be implemented with current technology and provides a clear path to an experimental demonstration of a quantum repeater.

Fig. 1

Basic quantum-repeater scheme featuring single atoms in optical cavities and telecom photons. A single repeater node consists of a heralding cavity (blue, horizontal cavity mode axis) and two telecom-wavelength entangling cavities (red, vertical mode axis). The atoms (black dots) are individually controlled by laser beams perpendicular to the image plane (indicated by green circles around the atoms). Two nodes separated by distance L/2 are entangled by first creating atom-photon entanglement locally at each of the nodes and then performing an optical BSM at a distance L/4 from each node. Entanglement swapping between pairs of nodes is implemented at the central node. A cavity-assisted quantum gate is performed on the two atoms via reflection of a single photon originating from a cavity-based single-photon source (SPS). Subsequent detection of the atomic quantum states in suitable bases allows for an unambiguous determination of the two-particle Bell state. This results in an entangled state between the two outermost nodes separated by a distance L. This basic unit can be extended to a larger number of swap levels by appending further quantum-repeater nodes at the ends of the quantum-repeater link (cf. the additional entangling cavities in gray)

In the following, we describe the implementation of the individual parts of the scheme. In Sect. 2 we propose a way to directly generate entanglement between single atoms and a telecom-wavelength photon using a cascaded scheme. We will estimate the performance of a particular implementation using $^{87}$Rb and realistic cavity parameters. In Sect. 3 we investigate the indistinguishability of the telecom photons created in this way and show that they are well suited for a photonic BSM that entangles the two remote single-atom quantum memories. Entanglement swapping by atomic BSM will be the topic of Sect. 4. In Sect. 5 we analyze the performance of the full repeater scheme and show that it can outperform entanglement generation based on direct transmission. We furthermore discuss the prospects of integrating entanglement purification in our scheme. While all required components can be implemented in our cavity-based approach, we show that under the assumption of realistic fidelities, entanglement purification is of little use for a quantum repeater over moderate distances with a small number of swap levels.

2 Heralded atom-photon entanglement at telecom wavelength

Direct coupling of an atom to single photons requires an atomic transition at the desired wavelength. Unfortunately, the atomic species that can be easily laser-cooled show no suitable transitions from the ground states at telecom wavelengths. However, there are suitable transitions from excited states, which have already been used for wavelength conversion [18] and entanglement generation using cascade transitions [22] in atomic ensembles. Here, we present a related cascaded scheme that uses these transitions to generate entanglement between an atom and a telecom-wavelength photon without wavelength conversion. We propose to use a single atom trapped at the intersection of two high-finesse cavities (see Fig. 2a) such that it is coupled to two different, spatially and spectrally well-defined modes. This enables efficient emission of single photons at telecom wavelength entangled with the atom via one of the cavities and herald photons at near-infrared wavelength via the other. The herald photons signal the successful creation of entanglement.

Fig. 2

a Experimental setup for creating entanglement between a single atom and a telecom-wavelength photon. A single atom is placed at the intersection of the modes of a heralding cavity at $\lambda _{\text{h}}$ and an entangling cavity at $\lambda _{\text{t}}$. The cavities are single-sided, such that intracavity photons leave through the respective output-coupling mirror (lighter color) with high probability. The atom is driven on a two-photon transition via control beams impinging perpendicular to the image plane. b Atomic energy level scheme. The required states are labeled and drawn in black. Unwanted decay paths at $\lambda _{\text{h}}$ are indicated by the gray dashed arrows. The relative transition amplitudes are indicated by the letters $a^{(\prime )} - c^{(\prime )}$. c A particular implementation with $^{87}$Rb. Zeeman states of hyperfine levels not relevant for the scheme have been omitted for clarity. The level spacings are not to scale

2.1 Cascaded entanglement scheme

We assume an atom with a level scheme compatible with the one depicted in Fig. 2b, which resembles the levels of bosonic alkali atoms. Essential for the protocol are two degenerate, long-lived states $\vert {\pm 1}\rangle _f$, which are Zeeman sublevels with $m_F=\pm 1$ and will be used to store the atomic qubit. These states are each coupled via a $\pi$-transition at wavelength $\lambda _{\text{h}}$ to one of the two short-lived, intermediate states $\vert {\pm 1}\rangle _i$, which also feature $m_F=\pm 1$. The excited state $\vert {e}\rangle$, with $m_F=0$, can decay to $\vert {\pm 1}\rangle _i$ at wavelength $\lambda _{\text{t}}$. The atom is initialized in a third ground state $\vert {g}\rangle$ with $m_F=0$ and can be coupled to $\vert {e}\rangle$ via a two-photon transition far detuned from an intermediate state $\vert {k}\rangle$, which may be identical to $\vert {i}\rangle$. The atom is placed at the intersection of two perpendicular cavity modes. The cavities are named heralding and entangling cavity and are resonant at $\lambda _{\text{h}}$ and $\lambda _{\text{t}}$, respectively. To describe the system, we choose the quantization axis to coincide with the axis of the entangling cavity. This way, the entangling cavity supports $\sigma ^-$- and $\sigma ^+$-polarization and the heralding cavity supports linear polarization modes, one of which needs to be aligned with $\pi$-polarization.

To create atom-photon entanglement, the atom is first initialized in state $\vert {g}\rangle$ by optical pumping and then coupled to the state $\vert {e}\rangle$ by a two-photon control pulse. Due to the presence of the resonant entangling cavity, this state couples cavity-enhanced to the states $\vert {-1}\rangle _i$ and $\vert {+1}\rangle _i$ and emits a photon in a superposition of the polarization states $\vert {\sigma ^{+}}\rangle _t$ and $\vert {\sigma ^{-}}\rangle _t$ into the entangling cavity. This controlled photon production is similar to entanglement generation schemes at near-infrared wavelengths [15]. By varying the shape of the control pulse, the envelope of the generated photon can be controlled. If the process succeeds, the atomic state and the polarization of the photon leaving the entangling cavity are entangled:

$$\vert {\varPsi _1}\rangle = {\frac{1}{\sqrt{2}}}\left( \vert {-1}\rangle _i \vert {\sigma ^{+}}\rangle _t + {\text{e}}^{\text{i} \theta} \vert {+1}\rangle _i \vert {\sigma ^{-}}\rangle _t\right).$$

(1)

The relative phase $\theta$ can take the values 0 and $\pi$ and depends on the relative sign of the transition dipole matrix elements and thus on the particular transition chosen.

$\vert {\varPsi _1}\rangle$ is already an entangled state between the atom and a photon at the wavelength $\lambda _{\text{t}}$, but it is short lived, because the states $\vert {\pm 1}\rangle _i$ quickly decay. If the decay leads to emission of a $\pi$-polarized photon, the entangled atom-photon state is transferred to the long-lived, final state

$$\vert {\varPsi _2}\rangle = {\frac{1}{\sqrt{2}}}\left( \vert {-1}\rangle _f \vert {\sigma ^{+}}\rangle _t + {\text{e}}^{\text{i} \tilde{\theta}} \vert {+1}\rangle _f \vert {\sigma ^{-}}\rangle _t\right).$$

(2)

Again, the relative phase $\tilde{\theta }$ can take values of 0 and $\pi$. Detection of a $\pi$-polarized photon at $\lambda _{\text{h}}$ thus heralds the successful creation of the desired entangled state. To achieve the high success probabilities required for quantum repeaters, this decay path should dominate and the herald photons need to be efficiently collected. Both requirements are accomplished by the heralding cavity.

The proposed scheme is suitable for all bosonic isotopes of alkali atoms. Implementations with rubidium, cesium and francium are particularly interesting, because these elements have suitable transitions at wavelengths in telecom bands.

2.2 Implementation with $^{87}$Rb

To evaluate the performance of the proposed scheme with current technology, we investigate a particular implementation with $^{87}$Rb (Fig. 2c) more closely. We choose the hyperfine states $\vert {F=1;m_F=0}\rangle$, $\vert {F=2; m_F=-1}\rangle$ and $\vert {F=2; m_F=+1}\rangle$ of the $5^2S_{1/2}$ state as $\vert {g}\rangle$, $\vert {-1}\rangle _f$, and $\vert {+1}\rangle _f$, respectively. As intermediate states $\vert {\pm 1}\rangle _i$ the $\vert {F'=1;m_F=\pm 1}\rangle$ substates of the $5^2P_{1/2}$ manifold are used and the $4^2D_{3/2}\vert {F''=1; m_F=0}\rangle$ state serves as the excited state $\vert {e}\rangle$. The $5^2P_{3/2}$ state can be employed as the intermediate state $\vert {k}\rangle$ for the two-photon control. This requires a heralding cavity resonant at $\lambda _{\text{h}}=795\,\hbox {nm}$ and will generate entangled photons at $\lambda _{\text{t}}=1476\,\hbox {nm}$, which is in the S-band of optical fiber communication.

The proposed scheme requires two cavities with small mode volumes and intersecting modes. We propose to use a Fabry–Perot cavity based on $\hbox {CO}_2$ laser-machined optical fibers [23] as the entangling cavity, because this type of cavity combines low mode volumes, high finesse and excellent optical access due to small external dimensions. Using telecom fibers as substrates also provides direct fiber integration, which facilitates long-distance communication. Fiber cavities can support degenerate polarization eigenmodes [24]. This is assumed for the entangling cavity, such that the atomic state gets entangled with the polarization of the emitted telecom photon, but not with its frequency. Starting from realistic cavity parameters (see “Appendix 1” for details), we calculate an atom-light coupling rate of $g_{\text{t}}=2\pi \times 70\,{\text{MHz}}$, a cavity field decay rate through the outcoupling mirror of $\kappa _{\text{t}}^{\text{oc}}=2\pi \times 95\,{\text{MHz}}$, and an additional cavity decay caused by other losses of $\kappa _{\text{t}}^{\text{l}}=2\pi \times 8\,{\text{MHz}}$ for the entangling cavity. Photons leaving this cavity through the output coupler couple to the mode of a standard single-mode telecom fiber with an efficiency of 0.96.

For the heralding cavity, fiber integration is not necessary, and we therefore propose to use $\hbox {CO}_2$ laser-machined glass plates as mirror substrates [25]. Degeneracy of its polarization eigenmodes is undesirable, because the mode with polarization orthogonal to $\pi$ can enhance wrong decay paths (shown as dashed arrows in Fig. 2). This is detectable, because it does not result in a $\pi$-polarized herald photon. Consequently, the failed entangling attempt is discarded, thereby reducing the efficiency. To avoid this problem, we suggest to employ a heralding cavity with a large frequency splitting of the polarization eigenmodes [26], such that the mode orthogonal to $\pi$-polarization is far detuned from the atomic transition. We assume the heralding-cavity parameters to be $\{ g_{{\text{h}}} ,\kappa _{{\text{h}}} ^{{{\text{oc}}}} ,\kappa _{{\text{h}}}^{{\text{l}}} \} = 2\pi \times \{ 16.3,11.9,1.5\} {\mkern 1mu} {\text{MHz}}$. The total cavity decay rates are given by $\kappa _{\text{t}}=\kappa _{\text{t}}^{\text{oc}}+\kappa _{\text{t}}^{\text{l}}$ and $\kappa _{\text{h}}=\kappa _{\text{h}}^{\text{oc}}+\kappa _{\text{h}}^{\text{l}}$. The cooperativity of the atom-cavity system is $C_{\text{t(h)}} = g_{\text{t(h)}}^2 / \left( \kappa _{\text{t(h)}} \varGamma _{\text{t(h)}}\right) = 25~(3.4)$ for the entangling (heralding) atom-cavity system. Here, $\varGamma _{\text{t}} = 2\pi \times 1.92\,{\text{MHz}}\,(\varGamma _{\text{h}}=2\pi \times 5.75\,{\text{MHz}})$ is the decay rate of the $4^2D_{3/2}$ $(5^2P_{1/2})$ state of $^{87}$Rb.

We perform numerical simulations on this system using two methods. The first one is integration of the corresponding Lindblad master equation, from which we extract the independent expectation values for the heralding- and entangling-cavity output. In the situation depicted in Fig. 3, the control pulse is long enough to result in a near-Gaussian shape of the telecom photons, but short enough that the bandwidth of the telecom and herald photons is limited by the respective coupling and cavity decay rates. Because the timescale for the decay of the heralding cavity is different from that of the entangling cavity, the arrival time of the herald photons is determined by the properties of the heralding cavity and only weakly correlated with the arrival time of the telecom photon. This enables the emission of near-indistinguishable telecom photons (inset of Fig. 4).

Fig. 3

Expectation value of the entangling-cavity output (blue solid line) and the heralding-cavity output (green dashed line) for the parameters given in the main text and a Gaussian control pulse (red dotted line) with a full width at half maximum (FWHM) of 5.9 ns. Because the control pulse is short, the bandwidth of the photons is limited by the coupling strengths and the bandwidths of the cavities. Correlations of spectral and temporal properties between herald and telecom photons are therefore suppressed. At times beyond the 45 ns plotted here, there is a small revival of the heralding-cavity output, which, however, contains less than 3 % of the total output

Fig. 4

Overall success probability (blue dots and solid line, left axis) and estimated contrast (green crosses and dashed line, right axis, see Sect. 3.1) for Gaussian control pulses of different widths. The amplitude of the control pulses has been set to the minimum value that leaves less than 1 % population in the initial state. Dots and crosses are the results of the numerical simulations, which have been connected by lines to guide the eye. The inset shows the expectation value of the entangling-cavity output as a function of time, conditioned on a photon leaving the heralding cavity after 15 ns (i.e., early, blue dashed line), 22 ns (green solid line) and 35 ns (i.e., late, red dotted line) for a control pulse with a FWHM of 5.9 ns (as in Fig. 3). There is a weak correlation between the arrival time of the herald photon and the telecom-photon envelopes, leading to a slightly reduced contrast

The second method is a Monte Carlo wave-function approach [27–29], which yields information about correlations between the cavity outputs. From the latter, we calculate the overall success probability $p_{\text{ht}}$, i.e., the probability to obtain a telecom photon in the optical fiber and a herald photon leaving the heralding cavity through the output coupler. For the parameters chosen here, we find $p_{\text{ht}}=0.57$, basically independent of the length of the control pulse (see Fig. 4). The exception are very short control pulses, for which we calculate lower success probabilities, because the control pulse gets spectrally broad enough to excite the $4^2D_{3/2}\vert {F''=3; m_F=0}\rangle$ state. The main loss channels are spontaneous decay of the $5^2P_{1/2}$ state (probability 0.24) and parasitic losses in the entangling and heralding cavity (probability 0.08 and 0.07, respectively). By increasing the coupling between atom and heralding cavity and decreasing the parasitic losses in both cavities, these loss channels could be minimized. Thus, with improvements in technology, the scheme could be performed almost deterministically.

2.3 Fidelity

At the start of the protocol the atom needs to be initialized in $\vert {g}\rangle$. This can be achieved by optical pumping, which is susceptible to experimental imperfections. Because there is no fundamental limit and various strategies are possible, we assume that the atom is initialized in $\vert {g}\rangle$ with unit efficiency and the control pulse addresses the state $\vert {e}\rangle$ without exciting any other state. Under these conditions, the fidelity of the intermediate atom-photon state with the ideal state $\vert {\varPsi _1}\rangle$ is determined solely by the geometry of the system and we assume any photon leaving the entangling cavity to be in the correct entangled state. This is a very good approximation if the $5^2P_{1/2}$ state of $^{87}$Rb is used as the intermediate state, because undesired processes are far off-resonant. The transition from the intermediate to the final state is unambiguously heralded by a photon with the correct polarization at wavelength $\lambda _{\text{h}}$. Therefore, conditioned on the detection of a herald photon, high-fidelity entanglement generation should be possible. In the following, we study two potentially detrimental effects and demonstrate that their influence on the fidelity of the entangled state is marginal for the particular implementation and parameters chosen here.

2.3.1 Second polarization mode of the heralding cavity

Degenerate polarization eigenmodes of the heralding cavity reduce the efficiency of the protocol. Besides this obvious effect, the unwanted resonant mode of the herald cavity also has a subtle but detrimental impact on the fidelity, because it leads to a state-dependent probability for herald generation (cf. “Appendix 2”).

To see this, we rewrite $\vert {\varPsi _1}\rangle$ in a linear polarization basis for the telecom photon:

$$\begin{aligned} \vert {\varPsi _1}\rangle&= {} {\frac{1}{2}} \left[ \vert {H}\rangle _t \left( \vert {-1}\rangle _i + {\text{e}}^{{\text{i}} \theta } \vert {+1}\rangle _i \right) \right. \\&+ \left. \vert {V}\rangle _t \left( \vert {-1}\rangle _i - {\text{e}}^{{\text{i}} \theta } \vert {+1}\rangle _i\right) \right] . \end{aligned}$$

(3)

The two atomic states correlated with a horizontally or vertically polarized photon, respectively, are coupled differently to the $m_F=0$ sublevel of the final state $\vert {f}\rangle$ by the second mode of the heralding cavity. The transition amplitudes from one of the two superpositions $(\vert {-1}\rangle _i\pm \vert {+1}\rangle _i)/ {\sqrt{2}}$ will interfere destructively, while the other interferes constructively. If the second mode of the heralding cavity with a polarization orthogonal to $\pi$-polarization is resonant as is the case for a cavity with degenerate polarization eigenmodes, these superpositions have different probabilities to emit a $\pi$-polarized photon, because one of these cannot decay to the state with $m_F=0$ via the herald cavity, while the other one can. Therefore, the final state, postselected on a correctly polarized herald photon, is not exactly $\vert {\varPsi _2}\rangle$, but has unequal amplitudes and is consequently not a maximally entangled state. To prevent that and thereby maximize the fidelity, the atom should not couple to the second mode.

In the implementation with $^{87}$Rb (Sect. 2.2), the effect is small, because the unwanted mode of the heralding cavity couples only weakly to the state with $m_F=0$ compared to the coupling to the states with $m_F\ne 0$. This is due to the specific branching ratios of the states involved. Even if the orthogonal polarization mode is degenerate with the $\pi$-polarized heralding mode, the reduction in fidelity is only 0.15 % (see “Appendix 2”). The effect is minimized if there is a large frequency splitting between the polarization eigenmodes, as also required to maximize the efficiency.

2.3.2 Free-space decay

If the atom decays via free-space emission, a state different from the desired one might be created. If no herald photon is emitted, the resulting state can be discarded. This results in a reduced efficiency but leaves the process fidelity unaffected. But, if the intermediate states $\vert {\pm 1}\rangle _i$ can decay back to the initial state $\vert {g}\rangle$ or any other state that can be excited by the control, there is a chance for multi-photon events. Reexcitation of $\vert {e}\rangle$ can result in a second telecom photon, which leaves the system in an undesired entangled state, but can still result in the generation of a herald. There are two ways to minimize the generation of multiple telecom photons. The first one is to choose the intermediate states in such a way that spontaneous decay preferably puts the atom in states that are not excited by the control laser. The second one is to execute the scheme quickly on the time scale of atomic decay. In the limit of fast excitation [30], for example with a picosecond laser, the detrimental effect would be eliminated. However, this would remove the ability to influence the shape of the photonic wave packet with the control lasers and a broadband pulse might excite other states, which do not couple to the entangling cavity and thus reduce the efficiency.

We employ the Monte Carlo wave-function approach to calculate an upper bound for multi-photon events for the parameters of Sect. 2.2 and a short Gaussian control pulse of 5.9 ns FWHM. We assume the worst case, namely that all decays to states outside the simulated system will result in a decay to the initial state, from which the atom can be efficiently excited again by the control laser. We compare the number of calculated quantum trajectories which result in multiple photons being generated to the number of desired trajectories and find that less than 0.4 % of the herald photons are accompanied by more than one telecom photon. More realistically, the atom will also decay to other states, which might not be excited as efficiently as the initial state, such that the number of multi-photon events should be lower than this upper bound.

3 Remote entanglement of two systems

The creation of remote entanglement between two of the quantum-repeater nodes described in the previous section can be achieved by an optical BSM [31, 32] on the polarization of the two telecom-wavelength photons that are entangled with the atom at their respective repeater node. The BSM is based on two-photon interference and therefore requires the telecom photons to be indistinguishable in their temporal, spectral and spatial properties, despite their remote origins. Single atoms in optical cavities can be controlled to exactly defined conditions, enabling indistinguishable photon-generation processes at remote locations [33]. However, possible temporal correlations of the telecom photon with the herald photon have to be considered. Emission via a two-photon cascade in free space shows a clear order of the photons. Emission of a first photon from the upper part of the cascade is followed by an exponential decay of the photon belonging to the lower part. Conditioned on the arrival time of the second photon, the first photon will have an exponentially rising envelope, with a sharp drop to zero at the detection time of the second photon [34]. Telecom photons corresponding to herald photons detected at different times will thus have different arrival-time distributions, which renders the photons distinguishable. Postselecting on events where the herald photons were detected with the same delay relative to the control pulse would reestablish indistinguishability, but also severely limit the efficiency.

The cavity for the herald photon offers a way out: If the lifetime of the heralding cavity is very long compared to the wave-packet envelope of the generated telecom photon, the former will determine the wave packet and therefore the detection-time distribution of the herald photon. Consequently, the correlations between the detection time of the herald photon and the wave-packet shape of the telecom photon will be erased by the heralding cavity, thereby restoring indistinguishability between telecom photons of different origin. The ideal implementation requires an entangling cavity with large coupling between atom and telecom photon and large cavity decay rate. The heralding cavity should have a smaller decay rate, and a smaller coupling between atom and herald photon can be tolerated.

3.1 Numerical calculation of the photon indistinguishability

In order to quantify the indistinguishability of the telecom photons, we use the Monte Carlo wave-function approach to generate arrival-time pairs of telecom and herald photons. These pairs are used as input to a kernel density estimator in order to estimate the probability distribution of telecom photons conditioned on a photon leaving the heralding cavity at a specific time. As the kernel, we use a two-dimensional Gaussian function with the bandwidth along the two axes set to $6\kappa _{\text{t}}$ and $6\kappa _{\text{h}}$, respectively. This bandwidth should be larger than the bandwidths of the processes occurring in the cavities, so the resulting probability distribution is likely undersmoothed. The resulting telecom-photon probability, conditioned on the detection time of the herald photon, is shown in the inset of Fig. 4 for the same parameters used in the simulation depicted in Fig. 3. Under the assumption that the processes at remote locations are identical in all other aspects, we calculate the interference contrasts expected in a Hong–Ou–Mandel experiment [33, 35] for the telecom photons conditioned on photons leaving the heralding cavity at different times. Weighting the resulting contrasts with the probability distribution for the herald photons yields the average contrast C, which is 0.97 in this case. This two-photon interference contrast can be converted into a remote-entanglement fidelity $F= {\frac{1}{2}}(1 + C)$ under the assumption that all other processes are perfect [36]. Thus, a fidelity of close to 0.99 should be achievable with our model parameters.

We repeat the calculation for Gaussian control pulses of different width (Fig. 4). For long control pulses, the emission time of the herald photon is correlated with the emission time of the telecom photon, which reduces the indistinguishability and thus the interference contrast of the telecom photons. For very short control pulses, there is little correlation and the interference contrast is therefore high; the success probability, however, is not maximal. Both the success probability and the interference contrast are near their respective maximum for control pulses with a FWHM between 5 ns and 10 ns. This is therefore an ideal point of operation, with minimal sacrifices in the tradeoff between efficiency and fidelity. Because of the use of undersmoothed probability distributions, the values for the contrast are limited by the variance of the Monte Carlo method and therefore present a lower limit to the theoretically achievable contrast.

The width of the envelope of telecom and herald photons is well above the timing resolution of commercially available single-photon counters. It is therefore possible to postselect events using the arrival times of telecom and herald photons. This enhances the interference contrast and thereby the entanglement fidelity, however at the cost of a reduced total success probability. In the limit of identical detection time of the herald photons and in the absence of any other effect that makes the telecom photons distinguishable, an interference contrast of unity is reached.

4 Entanglement swapping

To connect separate repeater links, entanglement swapping has to be performed. This requires a BSM on two quantum memories, each of which is entangled with a remote node. The small size of the fiber-based entangling cavities enables the placement of two of them in one and the same heralding cavity (Fig. 1). The heralding cavity can then be used for the collection of herald photons from both entangling cavities. To this end, the creation of atom-photon entanglement has to be alternated between the two atoms, which is possible by addressing the atoms with individual control beams and selective detuning, e.g., via a local light shift. The remote-entanglement procedure described in the previous section can thus be repeated individually for each atom until it has succeeded for both.

A quantum repeater requires quantum memories with long coherence times. The coherence between the Zeeman states $\vert {-1}\rangle _f$ and $\vert {+1}\rangle _f$ is limited by fluctuations of the effective magnetic field [37]. States with spin-orbit angular momentum $J=1/2$, different hyperfine quantum number and the same magnitude but opposite sign of the magnetic quantum number feature a reduced differential Zeeman shift. Consequently, coherent superpositions of these states have a strongly reduced sensitivity to magnetic field fluctuations [38]. We therefore propose to use a microwave pulse to state-selectively transfer one of the Zeeman states (e.g., $\vert {-1}\rangle _f$) to the other hyperfine ground state with the same $m_F$ with high fidelity. The corresponding final qubit states of $^{87}$Rb are $\vert {F=1;m_F=-1}\rangle$ and $\vert {F=2;m_F=+1}\rangle$. At a moderate magnetic field of about 3.23 G, the two atomic states experience the same first-order Zeeman shift and a coherence time of several seconds has been observed [13, 39].

As the heralding cavity can couple to both atoms, it is a natural choice for the implementation of an interaction mechanism for entanglement swapping [40–42]. We propose to use a quantum gate between the two atoms based on the reflection of a resonant single photon from the cavity [16, 41]. As only one of the two hyperfine ground states couples to the heralding cavity, this results in a state-dependent phase shift of $\pi$ on the two-atom state, equivalent to a controlled-Z quantum gate [43].

To perform entanglement swapping, we start with a Hadamard single-qubit rotation on one of the atoms and then apply the controlled-Z gate and subsequently a Hadamard gate on each of the two atoms. This maps the four atomic Bell states unambiguously onto four separable atomic states. These can be detected with unity efficiency and high fidelity by performing cavity-assisted hyperfine state detection [44, 45] on each of the atoms. This entanglement swapping projects the remote nodes into one of the four Bell states. The measurement result identifies the created Bell state. Therefore, conditional single-qubit operations at the remote nodes might then be used to rotate the entangled state into a specific target state. Although realistic implementations of reflection-based gates have a failure probability, the success of the gate is heralded by the detection of the reflected photon. The method requires a single-sided cavity and equal reflectivities of the empty cavity and the coupled atom-cavity system. These requirements are compatible with the design criteria of the heralding cavity posed by the entanglement scheme presented in Sect. 2.

5 Quantum-repeater performance

The techniques described in the previous sections can be used to implement a quantum repeater protocol with entanglement generation, entanglement distribution and entanglement swapping. To assess the performance of such a repeater, we consider two atoms trapped in remote cavities separated by the total distance L, which are to be entangled. We calculate the rate at which heralded entangled pairs are produced at these end points with the help of repeater nodes separated by the distance $L_0$ and compare it to the rate achievable without repeater nodes. If all processes succeed with high fidelity, fidelity differences between the protocols are marginal and the entangled pair rates can be compared directly. In the case of experimental imperfections, the reduced fidelity has to be compensated by a higher entangled-pair rate, e.g., to generate a secret key of the same length (see Sect. 5.3).

5.1 Entangled-pair rate

The probability to successfully generate remote entanglement in a single attempt between two adjacent nodes separated by distance $L_0$ is

$$p_{\text{e}}(L_0) = {\frac{1}{2}}(p_{\text{ht}} \eta _{\text{h}} \eta _{\text{t}} )^2 \exp (-L_0/L_{\text{a}}),$$

(4)

where $p_{\text{ht}}$ is the success probability of the entanglement generation, $\eta _{\text{h}}$ and $\eta _{\text{t}}$ are the detector efficiencies at herald and telecom wavelength, respectively, and $L_{\text{a}}$ is the attenuation length of the fiber. The factor 1/2 results from the fact that with a photonic BSM, only two of the four Bell states can unambiguously be identified. The average number of attempts required for N parallel processes with individual success probability p to have each succeeded once is [46]

$$Z_{\text{N}}(p) = \sum _{j=1}^{N}{N\atopwithdelims (){j}}{\frac{(-1)^{j+1}}{1-(1-p)^j}}.$$

(5)

It thus on average takes $Z_{\text{N}}(p_{\text{e}}(L_0))$ attempts to generate N entangled pairs. The atomic BSM is not completely deterministic, but succeeds with probability $p_{\text{es}} = R p_{\text{p}} \eta _{\text{h}}$, where R is the reflectivity of the herald cavity and $p_{\text{p}}$ is the efficiency of the SPS that generates the photon to be reflected. Therefore, we consider two different strategies for entanglement swapping. The first one is to swap all entangled pairs at once and restart the whole protocol when one entanglement swapping attempt fails (with probability $1-p_{\text{es}}$). In that case, the average number of attempts $\langle n(N) \rangle$ until the protocol has succeeded over the distance $L=N L_0$ is

$$\langle n(N) \rangle = {\frac{Z_{\text{N}}(p_{\text{e}}(L_0))}{p_{\text{es}}^{N-1}}}.$$

(6)

The second strategy is to swap entangled pairs as soon as possible. Upon failure, all entangled pairs that were not part of the failed entanglement-swapping attempt are kept and entanglement between the others is reestablished. Obviously, for $N>2$ this results in a higher rate of entangled pairs, but the memories also need to store the entangled states for a longer time, leading to increased decoherence. To calculate $\langle n\left( N\right) \rangle$ for this strategy, we perform a Monte Carlo simulation with $10^6$ runs per calculated point.

The total time $\langle T \rangle$ that is on average required to entangle the endpoints can be immediately calculated:

$$\langle T \rangle = \langle n(N) \rangle \left( {\frac{L_0}{c_{\text{f}}}} + \tau \right).$$

(7)

Here, $c_{\text{f}}$ is the speed of light in the optical fiber and $\tau$ is the minimum latency between two attempts, which is expected to be dominated by the time required for cooling and optical pumping of the atom.

To be quantitative, we take $p_{\text{ht}}$ as calculated in Sect. 2.2 for a control pulse with 5.9 ns FWHM, which combines high efficiency with high indistinguishability as estimated in Sect. 3.1. Correcting this value for the slightly reduced coupling of atoms not in the center of the herald cavity yields $p_{\text{ht}} = 0.53$ (see “Appendix 1”), which is the value we use throughout this section. $L_{\text{a}} = 22\,{\text{km}}$ and $c_{\text{f}} = 2 \times 10^5\,{\text{km\slash s}}$ are typical parameters for commercial telecom optical fibers. We assume detectors with an efficiency of $\eta _{\text{t}} = \eta _{\text{h}} = 0.8$ which is within range of current technology [47]. The reflectivity of the cavity is $R=0.61$ for the considered heralding cavity (“Appendix 1”). Single atoms trapped in optical cavities have been shown to be highly efficient SPSs [48], and with state-of-the-art cavity parameters they could certainly achieve an efficiency of $p_{\text{p}}=0.8$, which is the value we assume for the SPS used in the atomic BSM. We further consider a conservative cycle time of $\tau = 100\,\upmu$s. This would result in a repetition rate of 10 kHz over very short distances. For larger separations, the finite $c_{\text{f}}$ and the resulting communication time have to be accounted for, which reduces the repetition rate. For example, at $L_0=80$ km the repetition rate drops to 2 kHz, dominated by the communication time.

Using the above-mentioned parameters, we calculate the rate $1/\langle T \rangle$ for the generation of remote heralded entangled pairs, without repeater ($N=1$), for the most basic repeater ($N=2$), and for the extension to the second swap level ($N=4$). This entangled-pair rate is plotted as a function of the total length of the repeater link in Fig. 5. For $N=4$ we also compare the two different entanglement swapping strategies explained above. At short distances, direct entanglement is superior because of the reduced overhead compared to the repeater protocol. The break-even with one repeater node is reached after 41 km, and after 100 km, the repeater-assisted entanglement generation is approximately four times faster. A system with three repeater nodes with restart from the beginning outperforms the single-repeater-node system beyond 150 km and is 14 times faster than direct entanglement at this distance. By keeping entangled pairs, another factor of approximately 2.4 can be gained and the break-even with the single-repeater-node system is already reached at 82 km separation.

Fig. 5

Semilogarithmic plot of the expected average rate of heralded entangled pairs between two end points separated by the total distance L with one elementary link (i.e., no repeater, blue dotted line), two links (green solid line), four links with restart from beginning (red dashed line) and four links keeping already entangled pairs (brown dash-dotted line). Because of the lower overhead, the scenario with no repeater node yields the highest rates at short distances, but scales worse with L. For $L \ge 100$ km the quantum-repeater protocols are clearly superior. See the main text for the parameters used in the calculations

5.2 Required storage time

To prevent significant degradation of the entanglement, the coherence time of the employed quantum memories has to be much longer than the time the atomic state has to be stored. We calculate the average time interval between the first successful creation of entanglement and success of the protocol, which is the time the entanglement has to be stored (Fig. 6 and “Appendix 3”). More repeater nodes result in better scaling with distance but have a larger overhead. Keeping unaffected entangled pairs after a failed entanglement-swapping attempt requires 2.4 times longer storage times. At distance $L=100\,\hbox {km}$ ($L=200\,\hbox {km}$) the single-repeater-node protocol requires a storage time of 59 ms (980 ms). Using three repeater nodes, this value drops to 53 ms (260 ms). By restarting the protocol from the beginning, once an entanglement swapping attempt fails, the required storage time for three repeater nodes can be further reduced to 22 ms (110 ms). Aborting long-running attempts can thus be used to extend the maximum distance of a repeater system under the constraint of a limited coherence time, however at the cost of a constant factor in the entangled-pair rate. If memory time is a strong limitation, it can make sense to add more repeater nodes than Fig. 5 suggests to be optimal. Coherence times of several seconds have been demonstrated for the suggested qubit implementation in $^{87}$Rb and could be further improved by reducing magnetic field fluctuations [13, 39]. The degradation of the fidelity of the entangled pairs will, however, be a relevant limitation for the fidelity of the final state and therefore poses a challenge for any experimental implementations.

Fig. 6

Average storage time required for the nodes which have to retain entanglement the longest to entangle two end points separated by the total distance L. The coherence time of the nodes needs to greatly exceed this time to prevent degradation of the entanglement. The line styles are the same as in Fig. 5. Repeaters with more nodes show a better scaling of the required storage time with distance, but have larger overhead. With four links, restarting from the beginning significantly relaxes the required storage time

5.3 Secret-key rate

An especially important application of a quantum repeater is QKD. Device-independent QKD is enabled by heralded entanglement between remote nodes. The raw key extracted from an imperfect entangled state can be converted into an unconditionally secret key by classical postprocessing. In the limit of infinitely long keys, the secret-key rate can be obtained by multiplying the entangled pair rate with the secret fraction of the final state [49]. The latter can be calculated from the indistinguishability of the telecom photons characterized by their interference contrast and the fidelity of an entangled state produced by the atomic BSM with perfect input states (see “Appendix 4”). We assume that the coherence time of the memories is so long that we can neglect degradation due to decoherence. For an interference contrast of $C=0.97$, the BSM fidelity needs to be 95 % (89 %) to yield a secret fraction of 0.5 (0.25). As long as the fidelity is above 83 %, a secret key can be extracted. The secret fraction decreases if additional elementary links are inserted. With four elementary links and $C=0.97$ interference contrast, the BSM fidelity needs to be 99 % (97 %) to retain a secret fraction of 0.5 (0.25). In this case, the fidelity needs to be above 95 % for a nonzero secret fraction.

5.4 Entanglement purification

Imperfections in the substeps required for the operation of a quantum repeater lead to an error in the final state that scales exponentially with the number of nodes. This can be overcome via entanglement purification [5], which uses multiple states that are not maximally entangled to generate a single entangled state with higher fidelity. The purification protocol described by Deutsch et al. [50] could be implemented in the repeater architecture proposed here by employing the single-qubit rotations, the atom-atom gate mechanism, and atomic state detection procedures proposed for entanglement swapping (see Sect. 4). The quantum gates between two atoms in the same herald cavity would be complemented by a remote gate between two atoms in spatially separated herald cavities, also mediated by the reflection of a single photon [43], thereby enabling multiple rounds of entanglement purification using several instances of the proposed repeater node.

Entanglement purification can only increase the fidelity of the final state if the errors introduced by the required operations are significantly smaller than the errors present in the initial states. If entanglement purification and entanglement swapping build on the same gate mechanism, they will suffer from similar imperfections. For the very few entanglement swapping gates necessary for two and four elementary links, entanglement purification can therefore only lead to an increase in fidelity if considerable errors are introduced by other parts of the repeater protocol. An important source of error is loss of interference contrast C in the entanglement distribution process, caused by either the generation of partially distinguishable photons or errors introduced during fiber transmission. Taking an interference contrast of $C=0.97$ (see Sect. 3.1) as an example and applying the error models described in “Appendix 4,” we find that the entanglement purification protocol described by Deutsch et al. [50] increases the fidelity of the final state only if the atom-atom gate error is less than 4 % for two elementary links ($N=2$) and less than 7 % for four elementary links ($N=4$).

In the case of perfect gates, any target fidelity below unity can in principle be reached. This comes, however, at the cost of a significant additional overhead, because more quantum memories are required, and the final entangled pairs are produced at a lower rate. For applications in QKD, the secret-key rate is a convenient measure that allows comparing repeater strategies with and without entanglement purification. Employing the methods described in “Appendix 4,” we calculate that even with perfect gate operations, i.e., efficiency and fidelity of unity, entanglement purification is beneficial only if the interference contrast is very low, namely $C\le 0.55$ in case of $N=2$ and $C\le 0.83$ in case of $N=4$. This has to be compared to our expected interference contrast of $C=0.97$ (see Sect. 3.1) and the fact that high-fidelity transport of polarization qubits in optical fibers over the distances considered here is possible [6].

We therefore conclude that for a realistic repeater implementation over a few hundred kilometers, entanglement purification is unlikely to be beneficial and the best strategy is to focus on high-fidelity implementations without entanglement purification [51, 52].

6 Conclusion

Past experiments with single atoms in optical cavities have underlined their excellent prospects for applications in quantum communication [14, 16, 33]. The distances that can be bridged by direct photon transmission at near-infrared or visible wavelengths is, however, limited. We have shown how this limit could be overcome by employing, first, operation at telecom wavelength and, second, a realistic, efficient, and highly-integrated quantum-repeater concept.

Operation at telecom wavelength is essential for long-distance fiber-optic communication without the need for wavelength conversion. Our simulations show that creation of entanglement between single atoms and telecom-wavelength photons with an efficiency of 0.57 is possible with $^{87}$Rb atoms and current cavity technology. The designated S-band transition enables integration into existing fiber-optic networks. Remote entanglement can be established by a photonic BSM with a state fidelity of 99 %, because the generated photons are highly indistinguishable. Very efficient entanglement swapping can be achieved by a two-atom quantum gate employing the heralding cavity. Thus entanglement generation, quantum memories and entanglement swapping can be realized with single atoms in optical cavities, and all additional components necessary to complete a simple quantum repeater are commercially available. The highly efficient, yet heralded operations enable the generation of remote entanglement four times faster than direct transmission at a distance of 100 km. This simple quantum repeater can be extended by inserting two more nodes, providing a speedup of 82 over 200 km distance, compared to a system without repeater. The proposed scheme does not rely on assumptions about future technology and thus provides a clear and realistic path toward the experimental demonstration of such a quantum repeater.

Appendices

Appendix 1: Parameters used for the simulations

We assume a heralding cavity of $400\,\upmu$m length. This leaves enough space to put two fiber-based entangling cavities, laterally separated by $200\,\upmu$m, between the mirrors, with the fibers having a diameter of $125\,\upmu$m. Identical radii of curvature of $500\,\upmu$m for the two mirrors of the heralding cavity result in a mode waist of $7.9\,\upmu$m at a wavelength of 795 nm. Using these parameters, the decay rate of $2\pi \times 5.75\,\hbox {MHz}$ for the rubidium D$_1$ line and the relative transition strength of 1/4 for the decay from $5^2P_{1/2} \vert {F'=1;m_F=\pm 1}\rangle$ to $5^2S_{1/2} \vert {F=2;m_F=\pm 1}\rangle$, we calculate an atom-cavity coupling strength of $g_{\text{h}}=2\pi \times 16.3\,\hbox {MHz}$. To implement the scheme with high efficiency, we require mirrors of different transmission: one high reflector and one mirror with higher transmission (called the output coupler) that is the dominant loss channel of the cavity. For the high reflector, we assume a transmission of 10 ppm and our tests with laser-machined substrates indicate that 20 ppm parasitic losses per mirror can be achieved for the proposed cavity geometry. In total, this adds up to 50 ppm losses and a corresponding field decay rate of $\kappa _{\text{h}}^{\text{l}} = 2\pi \times 1.5\,\hbox {MHz}$. As a compromise between the directionality of the cavity decay and high cooperativity, we choose a transmission of 400 ppm for the output coupler, which results in $\kappa _{\text{h}}^{\text{oc}} = 2\pi \times 11.9\,\hbox {MHz}$.

An entangling-cavity length of $75\,\upmu$m ensures a small mode volume, but also avoids any significant clipping losses of the heralding mode, because even accounting for the curvature of the mirrors, there is still $65\,\upmu$m of space between them. We choose asymmetric radii of curvature of $100\,\upmu$m for the high reflector and $200\,\upmu$m for the output coupler resulting in a mode waist of $4.8\,\upmu$m at $\lambda _{\text{t}}=1476\,\hbox {nm}$. This optimizes the transverse overlap [23, 53] between the cavity mode at the output coupler and the mode of a telecom single-mode fiber ($10\,\upmu$m mode-field diameter) to 0.96. Due to the asymmetric radii of curvature, the mode radius at the position of an atom trapped in the center of the cavity is $5.3\,\upmu$m. The decay rate of the $4^2D_{3/2}$ state to the $5^2P_{1/2}$ state ($5^2P_{3/2}$ state) is $2\pi \times 1.62\,\hbox {MHz}$ ($2\pi \times 0.30\,\hbox {MHz}$) [54] and decay from $\vert {F''=1;m_F=0}\rangle$ ends up in $\vert {F'=1;m_F=\pm 1}\rangle$ with 5/12 probability each. The coupling rate of an atom at the center of the described cavity at this transition is thus $g_{\text{t}} = 2\pi \times 70\,\hbox {MHz}$. We expect dielectric coatings at telecom wavelengths to have similar performance as coatings for the near-infrared and thus assume 20 ppm parasitic losses per mirror for the entangling cavity as well. In combination with 10 ppm transmission for the high reflector, this results in $\kappa _{\text{t}}^{\text{l}} = 2\pi \times 8\,\hbox {MHz}$. We set the transmission of the output coupler to 600 ppm, resulting in $\kappa _{\text{t}}^{\text{oc}} = 2\pi \times 95\,\hbox {MHz}$.

We assume degenerate polarization eigenmodes for the entangling cavity and consider a heralding cavity that only supports a $\pi$-polarized mode, which could effectively be realized by inducing a large frequency splitting between the polarization eigenmodes of the heralding cavity [26].

For two atoms in one heralding cavity, as required for a full quantum-repeater node (Fig. 1), the two atoms cannot both be positioned exactly at the center of the heralding cavity. We propose to place the atoms on the axis of the heralding cavity, $\pm 100\,\upmu$m from the center. This leaves enough space for the entangling cavities and results in a small reduction of the coupling to the heralding cavity to $g_{\text{h}} = 2\pi \times 15.1\,\hbox {MHz}$. This results in only a slight reduction of 1 % of the total success probability, which we nevertheless account for in the calculations of the quantum-repeater performance in Sect. 5.

All parameters mentioned above are consistent with results of ongoing work with optical fiber cavities in our laboratory [26].

Appendix 2: State-dependant probability for herald generation

To see the effect of degenerate polarization eigenmodes, we start with the intermediate entangled state $\vert {\varPsi _1}\rangle$ in the linear polarization basis for the telecom photon [cf. Eq. (3)]

$$\vert {\varPsi _1}\rangle = {\frac{1}{\sqrt{2}}} \left( \vert {\varPsi _{\text{1,H}}}\rangle + \vert {\varPsi _{\text{1,V}}}\rangle \right)$$

(8)

with

$$\begin{aligned} \vert {\varPsi _{\text{1,H}}}\rangle= & {} {\frac{1}{\sqrt{2}}} \vert {H}\rangle _t \left( \vert {-1}\rangle _i - \vert {+1}\rangle _i\right) \\ \vert {\varPsi _{\text{1,V}}}\rangle= & {} {\frac{1}{\sqrt{2}}} \vert {V}\rangle _t \left( \vert {-1}\rangle _i + \vert {+1}\rangle _i\right) . \end{aligned}$$

(9)

Here, we have assumed $\theta = \pi$ for clarity. In case of $\theta = 0$ the calculation is analogous with similar results.

We assume the polarization eigenmodes of the herald cavity to be $\pi$-polarized and V-polarized. H-polarization is then parallel to the herald cavity axis and would require a longitudinal field which is not supported by the herald cavity. In the worst case, the polarization eigenmodes $\pi$ and V are exactly degenerate, such that the herald cavity enhances decay to states with the same hyperfine quantum number by the same factor. In that case, the final state after emission of a photon into the herald cavity is determined just by the amplitudes of the transitions involved. We assume that free-space decay can be neglected, which is the worst case, because free-space decay is isotropic and cannot lead to a state-dependent probability for herald generation. Under these assumptions, the state $\vert {\varPsi _{\text{1,H}}}\rangle$ decays to

$$\begin{aligned} \vert {\varPsi _{\text{3,H}}}\rangle&= {} {\frac{1}{\sqrt{\frac{\left| a+a'\right| ^2}{2} + \left| b\right| ^2 + \left| b'\right| ^2 + \frac{\left| c\right| ^2+\left| c'\right| ^2}{2}}}} \vert {H}\rangle _t \\&\times \, \left[ \vert {\pi }\rangle _h\left( b \vert {-1}\rangle _f - b' \vert {+1}\rangle _f\right) \right. \\&+ \, {\frac{1}{\sqrt{2}}} \vert {V}\rangle _h\left( c \vert {m_F = - 2}\rangle + c' \vert {m_F = +2}\rangle \right) \\&+ \, {\frac{1}{\sqrt{2}}}\left. \vert {V}\rangle _h(a + a') \vert {m_F = 0}\rangle \right] , \end{aligned}$$

(10)

where $\vert {m_F=0}\rangle$ and $\vert {m_F=\pm 2}\rangle$ have the same hyperfine quantum number as $\vert {\pm 1}\rangle _f$. a, b, and c are the transition amplitudes from $\vert {-1}\rangle _i$ to $\vert {m_F=0}\rangle$, $\vert {-1}\rangle _f$, and $\vert {m_F=-2}\rangle$, respectively, and $a'$, $b'$, and $c'$ are the transition amplitudes from $\vert {+1}\rangle _i$ to $\vert {m_F=0}\rangle$, $\vert {+1}\rangle _f$, and $\vert {m_F=+2}\rangle$ (cf. Fig. 2). Similarly, the state $\vert {\varPsi _{\text{1,V}}}\rangle$ decays to

$$\begin{aligned} \vert {\varPsi _{\text{3,V}}}\rangle&= {} {\frac{1}{\sqrt{\frac{\left| a-a'\right| ^2}{2} + \left| b\right| ^2 + \left| b'\right| ^2 + \frac{\left| c\right| ^2+\left| c'\right| ^2}{2}}}} \vert {V}\rangle _t \\&\times \, \left[ \vert {\pi }\rangle _h\left( b \vert {-1}\rangle _f + b' \vert {+1}\rangle _f\right) \right. \\&+ \, {\frac{1}{\sqrt{2}}}\vert {V}\rangle _h\left( c \vert {m_F = - 2}\rangle - c' \vert {m_F = +2}\rangle \right) \\&+ \, {\frac{1}{\sqrt{2}}}\left. \vert {V}\rangle _h(a - a') \vert {m_F = 0}\rangle \right] . \end{aligned}$$

(11)

For symmetry reasons, $a'=\pm a$, $b' = \pm b$ and $c'=\pm c$ and the basis states are chosen in such a way that all transition amplitudes are real. Therefore, either $a+a'=0$ and $\vert {\varPsi _{\text{1,H}}}\rangle$ does not decay to $\vert {m_F=0}\rangle$, or $a-a'=0$ and $\vert {\varPsi _{\text{1,V}}}\rangle$ does not decay to $\vert {m_F=0}\rangle$, because of destructive interference. In either case, the probability to emit a $\pi$-polarized photon is different for these two states, because the normalization factor is different. Therefore, selection on events in which a $\pi$-polarized photon was detected does not yield a state with equal amplitudes, which would be required for a maximally entangled state. Instead, a state with less entanglement is created, depending on the value of |a| compared to |b| and |c|.

To calculate the fidelity of this state, we set $a'=a$, $b'=b$ and $c'=c$ for simplicity. All other cases are analogous. If a $\pi$-polarized photon is detected, the normalized final state $\vert {\varPsi _3}\rangle$ is

$$\begin{aligned} \vert {\varPsi _3}\rangle&= {} {\frac{1}{\sqrt{\tilde{{\mathcal{N}}}}}} \langle {\pi }\vert _h \left( \vert {\varPsi _{\text{3,H}}}\rangle + \vert {\varPsi _{\text{3,V}}}\rangle \right) \\&= {} {\frac{1}{\sqrt{{{\mathcal{N}}}}}} \left[ {\sqrt{2b^2+c^2}}\vert {H}\rangle _t \left( \vert {-1}\rangle _f - \vert {+1}\rangle _f\right) \right. \\&+ \left. {\sqrt{2a^2+2b^2+c^2}}\vert {V}\rangle _t \left( \vert {-1}\rangle _f + \vert {+1}\rangle _f\right) \right] , \end{aligned}$$

(12)

with the normalization constants $\tilde{\mathcal{N}}$ and ${\mathcal{N}}=4\left( a^2 + 2b^2+c^2\right)$. If $a\ne 0$, this is not a maximally entangled state. Its fidelity with the ideal final state $\vert {\varPsi _2}\rangle$ ($\tilde{\theta }= \pi$) is

$$F = \left| \langle {\varPsi _2|\varPsi _3}\rangle \right| ^2 = {\frac{1}{2}} + {\frac{1}{2}} {\frac{\sqrt{(2a^2+2b^2+c^2)(2b^2+c^2)}}{a^2+2b^2+c^2}}.$$

(13)

For the transition from $5^2P_{1/2} \vert {F'=1}\rangle$ to $5^2S_{1/2} \vert {F=2}\rangle$ in $^{87}$Rb the relative transition amplitudes are $a=a'=-1$, $b=b'={\sqrt{3}}$, and $c=c'=-{\sqrt{6}}$, which results in a slight fidelity reduction of $1-F = 0.15\,\%$, even if the polarization eigenmodes of the herald cavity are degenerate. However, for different transitions with a larger a relative to b and c, the effect can be much worse. E.g., for the transition from $5^2P_{1/2} \vert {F'=1}\rangle$ to $5^2S_{1/2} \vert {F=1}\rangle$ in $^{87}$Rb, the transition amplitudes are $a=-a'=-1$, $b=-b'=1$, and $c=c'=0$, which reduces the fidelity by $1-F=2.9\,\%$. As the relative transition amplitudes depend just on the coupling of electron angular momentum, electron spin, and nuclear spin, the effect is the same across different atomic species with the same values for these properties.

Appendix 3: Required storage times

To estimate the required coherence time of the memories, we study the protocol in more detail. We calculate the time between the first successful creation of entanglement that is still used at the end of the protocol, i.e., is not discarded due to a failed entanglement-swapping attempt, and the end of the protocol. We neglect the possibility of two pairs becoming entangled during the same cycle, which is justified if the entanglement probability $p_{\text{e}}$ is small. We assume a simple, synchronous temporal operation of the protocol such that the time interval between two attempts has a fixed length of $L_0/c_{\text{f}} + \tau$. We assume all memories to decohere equally and it is therefore irrelevant whether the entanglement is transferred to another memory via entanglement swapping.

We first study the protocol that is restarted from the beginning whenever an entanglement-swapping attempt fails. In this case, the expected number $\langle m \rangle$ of cycles the entanglement has to be stored is simply the expected number of attempts required to entangle $N-1$ pairs plus one to account for the trial it takes to entangle the memory itself:

$$\langle m \rangle = Z_{{\text{N}}-1}\left( p_{\text{e}}\right) + 1.$$

(14)

If the entanglement is kept in case of a failed, unrelated entanglement-swapping attempt, the explicit probability distribution for succeeding in a particular trial is difficult to write down. However, we can extract the maximum number of trials a memory has to store entanglement using the Monte Carlo simulation as in the calculation of the entangled-pair rate. We take $\langle m \rangle$ to be the average over $10^6$ runs. Using a bootstrap on the values gathered from these runs, we estimate the 95 % confidence interval to be smaller than $\pm$0.2 % for all values.

Appendix 4: Secret fraction

To calculate the unconditional secret fraction of a key, which has been generated by a QKD protocol, the density matrix of the imperfect final state has to be known. We assume perfect input states and start with the entangled state after a photonic BSM with contrast C. The latter is the probability that the photons interfere and produce the correct entangled state. If they do not interfere, the result of the measurement is a classically correlated state. If the result of the photonic BSM indicates, e.g., an entangled state $\vert {\varPsi ^+}\rangle =(\vert {10}\rangle +\vert {01}\rangle )/{\sqrt{2}}$ between two atoms, the density matrix for the resulting mixed state is

$$\rho _{\text{1}} = C \vert {\varPsi ^+}\rangle \langle {\varPsi ^+}\vert + {\frac{1}{2}} \left( 1-C\right) \left( \vert {10}\rangle \langle {10}\vert + \vert {01}\rangle \langle {01}\vert \right).$$

(15)

We neglect degradation of the entangled state due to decoherence of the atom. If this is not given in an experimental implementation, calculation of its detrimental effect on the secret fraction requires detailed knowledge of the decoherence mechanisms. Entanglement swapping using an atomic BSM can be performed by applying a CNOT gate followed by a Hadamard gate, measuring the two atoms and performing single-qubit state rotations at the remote target atoms depending on the result of that measurement. For perfect input states, this procedure is assumed to produce the maximally mixed state $\rho^{\text{m}} = \mathbbm{1}/4$ with probability $(1-P)$, such that the fidelity of the entangled state is given by $(1+3P)/4$. Applying this procedure to a tensor product of $\rho _1$ and the same entangled state between two different atoms yields the density matrix after entanglement swapping

$$\begin{aligned} \rho _2&= {} P C^2 \vert {\varPsi ^+}\rangle \langle {\varPsi ^+}\vert + {\frac{1}{4}} (1-P) {\mathbbm{1}} \\&+ P C(1-C)\left( \vert {10}\rangle \langle {10}\vert + \vert {01}\rangle \langle {01}\vert \right) \\&+ {\frac{1}{2}} (1-C)^2 P \left( \vert {10}\rangle \langle {10}\vert + \vert {01}\rangle \langle {01}\vert \right) . \end{aligned}$$

(16)

Using the identity $\vert {10}\rangle \langle {10}\vert + \vert {01}\rangle \langle {01}\vert = \vert {\varPsi ^+}\rangle \langle {\varPsi ^+}\vert + \vert {\varPsi ^-}\rangle \langle {\varPsi ^-}\vert$, $\rho _{2}$ can be rewritten in the Bell-state basis

$$\begin{aligned} \rho _{2}&= {} \lambda _1 \vert {\varPsi ^+}\rangle \langle {\varPsi ^+}\vert + \lambda _2 \vert {\varPsi ^-}\rangle \langle {\varPsi ^-}\vert \\&+\lambda _3 \vert {\varPhi ^+}\rangle \langle {\varPhi ^+}\vert + \lambda _4 \vert {\varPhi ^-}\rangle \langle {\varPhi ^-}\vert \end{aligned}$$

(17)

with

$$\begin{aligned} \lambda _1&= {} {\frac{1}{4}} (1 + P + 2 PC^2) \quad \lambda _3 = {\frac{1}{4}} (1 - P) \\ \lambda _2& = {} {\frac{1}{4}} (1 + P - 2 PC^2) \quad \lambda _4 = {\frac{1}{4}} (1 - P). \end{aligned}$$

(18)

Following the calculation described in Ref. [49], we calculate the secret fraction for entanglement-based QKD. The error rates $\epsilon _x$, $\epsilon _y$, $\epsilon _z$ for the three bases are

$$\begin{aligned} \epsilon _x&= {} \lambda _2 + \lambda _4 = {\frac{1}{2}} \left( 1 - PC^2\right) , \\ \epsilon _y&= {} \lambda _2 + \lambda _3 = {\frac{1}{2}} \left( 1 - PC^2\right) , \\ \epsilon _z&= {} \lambda _3 + \lambda _4 = {\frac{1}{2}} \left( 1 - P\right) , \end{aligned}$$

(19)

and the unconditional secret key fraction is

$$\begin{aligned} r&= {} 1- h(Q) - \epsilon _z h\left( {\frac{1 + \left( \epsilon _x - \epsilon _y\right)/\epsilon _z}{2}}\right) \\&- \left( 1-\epsilon _z\right) h \left( {\frac{1-\left( \epsilon _x + \epsilon _y + \epsilon _z\right)/2}{1-\epsilon _z}}\right) , \end{aligned}$$

(20)

with the quantum bit error rate $Q=\epsilon _z$ and the binary entropy $h(p) = -p \log _2(p) - (1-p) \log _2(1-p)$.

The error rates for the next swap level, i.e., four elementary links, can be calculated by using $\rho _{2}$ instead of $\rho _{1}$ as the initial state and applying the same procedure:

$$\begin{aligned} \epsilon _x^{(N=4)}= & {} {\frac{1}{2}} \left( 1 - P^3C^4\right), \\ \epsilon _y^{(N=4)}= & {} {\frac{1}{2}} \left( 1 - P^3C^4\right) , \\ \epsilon _z^{(N=4)}= & {} {\frac{1}{2}} \left( 1 - P^3\right) = Q^{(N=4)}. \end{aligned}$$

(21)