1 Introduction

Quantum key distribution (QKD), which provides a secret key to two distant parties for encrypting and decrypting a message with security guaranteed by quantum mechanics, has been studied and developed [1]. It is basically used for one-to-one communication in which one party sends a message to another. However, there can be situations in which one party wants to simultaneously send a message to more than two parties. One scheme for securely achieving such communication requires the sender to pre-share a secret key individually with each receiver using QKD and send a common secret key to be used to encrypt a message to each receiver using the individually pre-shared secret key. However, several processes must be performed in such a scheme, making the key distribution task time consuming. To avoid this limitation, quantum communication systems that simultaneously provide a secret key to multiple parties have been studied. These systems are called multiparty QKD or quantum conference key agreements (QCKA) [2].

Several QCKA protocols have been proposed, most of which utilize a multipartite quantum entanglement state such as a Greenberger–Horne–Zeilinger (GHZ) state [2,3,4,5,6,7,8]. The central node generates a multipartite entangled state and sends one photon in the entangled state to each party. The receivers then measure the transmitted photons, from which the bits are created. Owing to the quantum correlation between photons in an entanglement state, the created bits are identical between receivers, which can form a common secret key. In this scheme, multiple parties share a secret key at the same time. However, its implementation is difficult in practice because of the difficulty in generating a multipartite entanglement state. In fact, although a QCKA experiment using four-photon polarization-entangled GHZ states has been demonstrated [9], its key creation performance was low at a key creation rate of 1 bit/s when the transmission lengths from the central node to receivers were 0, 20, 10, and 20 km, respectively, even using high-performance nanowire single-photon detectors.

To avoid the use of a multipartite entanglement state, others QCKA protocols have been also proposed, which are based on measurement-device-independent QKD or twin-field QKD [10,11,12,13,14,15,16]. In these protocols, multiple parties send quantum states to a central node, which then performs a joint measurement on the incoming states. The multi-parties can share a common secret key without using a multipartite entanglement state. However, the transmission phases, the polarization states, and the time positions should be precisely and stably adjusted in practical implementation, which makes the transmission system complicated. When a decoy method of varying the signal intensity is employed to beat the photon number splitting attack, the creation rate of a common key becomes low because the pulse intensity coming from all senders should be matched for the key creation. In addition, some protocols are restricted to three-party systems.

Another QCKA protocol that seems the most practical is one in which one sender sends identical quantum states of {|0 > , |1 >} and {|+ >  = (|0 > +|1 >)/\(\sqrt {2}\), |– >  = (|0 > – |1 >)/\(\sqrt {2}\)}, i.e., states used in BB84-QKD, to multiple recipients simultaneously, from which the recipients create key bits [17]. The sender and receivers can share a common secret key with one quantum transmission from the sender to recipients, and no additional QKD transmission is required in this protocol. This QCKA scheme is a simple extension of BB84-QKD, which has been intensively studied and developed and is the most practical quantum communication system.

Following the idea of the above BB84-based QCKA scheme, this study presents a QCKA protocol based on differential-phase-shift (DPS) QKD [18]. One party broadcasts a weak coherent pulse train with a phase of 0 or π for each pulse to multiple receivers, who then individually measure the phase differences of adjacent pulses using a delay interferometer followed by photon detectors. Subsequently, the sender and receivers create common key bits from the coincident counts in the receivers. Its setup and operation are simple compared with entanglement-based QCKA. Compared to the BB84-based scheme, the key creation efficiency of the proposed protocol is expected to be higher because key bits are created from basis-matched detection events in the BB84 scheme, while all coincident counts contribute to key creation in the proposed scheme. We formalize the key creation performance of the proposed scheme considering the eavesdropping probability and perform calculations. The results indicate that a key creation rate of 10–7 bit/pulse, corresponding to 100 bit/s for a pulse repetition rate of 1 GHz, is achievable in a four-party system with a 40-km distance for each receiver even when APD-based photon detectors are used.

2 Setup and operation

The setup of the proposed DPS-QCKA is illustrated in Fig. 1. A transmitter (Alice) broadcasts a weak coherent pulse train to receivers (Bobs), in which each pulse is phase-modulated by 0 or π and has a mean photon number of less than one. Bobs detect the transmitted signal using a delay Mach–Zehnder interferometer with a delay time equal to the pulse interval, at the output of which threshold single-photon detectors are placed. Using this apparatus, Bobs measure the phase differences between adjacent pulses, which are 0 or π. Here, measurement results are obtained occasionally and randomly in time owing the small photon number of the incoming pulses. When the measured phase difference is 0 (or π), they create bit 0 (or 1) while recording the clicking time slot and created bit.

Fig. 1
figure 1

Setup of DPS-QCKA. PM phase modulator, D photon detector

Full size image

After signal transmission, Alice and Bobs create a secret key as follows: (1) Bobs announce the time slots in which the bits were created. (2) Bobs extract bits that are created from time slots identical to all Bobs, and discard the other bits. (3) Alice creates bits from the phase modulation data corresponding to the time slots from which all Bobs created their bits. (4) Alice and each Bob exchange a portion of their bits and estimate the bit error rate (BER) in them. Subsequently, they discard the bits used for the BER estimation, and hold the remaining bits as a raw key. (5) Based on the estimated BER, error correction is performed between Alice and Bob, such that Alice conveys error correction information (i.e., syndrome) to Bob, who then corrects his bits to match Alice’s bits. (6) Privacy amplification is applied to the raw key, and a common secure key is shared between Alice and Bobs.

3 Key creation performance

In this section, we evaluate the key creation performance of DPS-QCKA. Specific eavesdropping is assumed in the evaluation rather than general or conceptional eavesdropping using sophisticated quantum mechanical means. This is because a weak coherent pulse train, in which a number of bits is embedded, is transmitted instead of qubits in the traditional QKD in the present protocol, against which conventional general attacks cannot be applied (Appendix).

In the present system, error correction is performed such that all Bobs correct their bits to match Alice’s bits. For such systems, the creation rate of a common key bit R can be evaluated using mutual information as follows:

$$ R = R_{\text{r}} (I_{{\text{AB}}} - I_{{\text{AE}}} ) $$
(1)

with.

$$ I_{{\text{AB}}} = 1 + e_{{\text{AB}}} \log_2 e_{{\text{AB}}} + (1 - e_{{\text{AB}}} )\log_2 (1 - e_{{\text{AB}}} ) $$
(2)
$$ I_{{\text{AE}}} = 1 + e_{{\text{AE}}} \log_2 e_{{\text{AE}}} + (1 - e_{{\text{AE}}} )\log_2 (1 - e_{{\text{AE}}} ) $$
(3)

where Rr denotes the raw-key rate; IAB and IAE denote the mutual information between Alice and each Bob and that between Alice and an eavesdropper (Eve), respectively; and eAB and eAE refer to the bit mismatch ratios between Alice and each Bob and that between Alice and Eve, respectively. In DPS-QCKA systems with N Bobs, the raw-key rate Rr is given by.

$$ R_{\text{r}} = (\kappa T\mu_0 )^N $$
(4)

where μ0 denotes the mean photon number per pulse sent from Alice, T denotes the transmittance from Alice to each Bob, which is assumed to be identical for all Bobs, and κ signifies Bob’s detection efficiency.

The bit mismatch between Alice and each Bob results from imperfections in their signal transmission apparatus. Here, we assume that the dark count of Bob’s photon detectors and imperfect visibility in Bob’s interferometer are the causes of the bit mismatch. The bit mismatch ratio resulting from these causes is expressed as

$$ e_{{\text{AB}}} = \frac{2d}{{\kappa T\mu_0 + 2d}} + e_{{\text{MZ}}} $$
(5)

where d indicates the dark count rate of the photon detector per time slot and eMZ denotes the bit mismatch ratio owing to imperfect interference.

Meanwhile, the bit mismatch ratio between Alice and Eve is given by eAE = (1–η)/2, with η being Eve’s eavesdropping probability on Alice’s raw-key. In this study, Eve is assumed to perform beam splitting (BS) and intercept-and-resend (IR) attacks against a DPS-QCKA system, as illustrated in Fig. 2. Eve performs a BS attack on the transmission line to each Bob, where she splits and stores a portion of Alice’s signals. The remaining signal is sent to each Bob via a lossless transmission medium to unchange the number of photons detected by each Bob. Subsequently, after all Bobs announce the time slots at which photons are detected, Eve extracts pulses clicking Bobs’ detectors from the stored signals and makes them interfere with each other, the result of which gives her the phase difference of the mutually interfering pulses, that is Alice’s bit. The eavesdropping probability of this BS attack is ηBS = 2μ0 (1–T) × N.

Fig. 2
figure 2

Eavesdropping against DPS-QCKA. BSA beam splitting attack, IRA intercept-and-resend attack, q.m. quantum memory, SW optical switch, and Tx transmitter. Dashed boxes overlapped onto transmission lines indicate lossless media

Full size image

In addition to the BS attack, Eve conducts an IR attack. She directly measures Alice’s signal using the same apparatus as Bob’s, in which Eve successfully measures the phase differences occasionally and randomly because of the small number of photons. When she succeeds in the measurement, she resends two pulses of one photon with the measured phase difference to the target Bob via a lossless transmission line. From these double pulses, the Bob detects the photon possibility in three time slots at the delay interferometer outputs. Detection in the middle slot occurs according to the phase difference of the double pulses, whereas detection in the first or third slot occurs randomly because there is no interference. Subsequently, a bit mismatch can be induced between Alice’s and Bob’s bits created from the detection in the first or third time slot, with a probability of (1/4 + 1/4) × 1/2 = 1/4, from which eavesdropping is revealed. Therefore, Eve partially conducts the IR attack, using optical switches, as illustrated in Fig. 2, such that the eavesdropping-induced bit errors are confused with the original system errors caused by imperfections of the transmission apparatuses. The upper bound of the IR attack ratio rIR is given by \(r_{{\text{IR}}} /4 \le e_{{\text{AB}}}\), where eAB denotes the bit error rate between Alice and the target Bob, given by Eq. (5).

When the IR attack is conducted, the target Bob detects a photon, possibly in three time slots, as described above. The Bob announces the clicking slot and Alice creates her bit by referring to the phase difference of the pulses that have clicked Bob’s detector. Here, Eve knows Alice’s bit that is created from the photon detection in the middle time slot, but does not that created from the detection in the first or third slot. The probability of detection in the middle slot is 1/2, and thus the probability of Eve obtaining Alice’s bit through the IR attack on the transmission line to the target Bob is 1/2. This eavesdropping probability of 1/2 is for the conventional DPS-QKD. In DPS-QCKA, Eve performs the IR attack against multiple Bobs, as illustrated in Fig. 2, for which further consideration is necessary. In the following, we consider the probability of eavesdropping through the IR attack in DPS-QCKA.

As described above, the IR attack is performed partially such that the eavesdropping-induced bit error rate is confused with the original bit error rate. The timing of the partial attack should be synchronized on the transmission lines to all Bobs, because key bits are created from coincident counts at all Bobs. Thus, Eve wants to know Alice’s phase differences that cause the coincident counts. Here, we consider the probability of Eve obtaining Alice’s phase difference that induces Bobs’ coincident counts at a given time slot, hereafter denoted as slot#i, through the synchronous IR attack. Three double-pulse patterns resent from Eve can click each Bob’s detector in slot#i, which are illustrated and labeled A, B, and C in Fig. 3. In the figure, the pulse positions at the delay interferometer output are depicted on the right side of Bob. In pattern A, an incident pulse at slot (b) passes through the long path of the interferometer, and clicks the detector at slot#i. In pattern B, an incident pulse at (c) passing through the short path and that at (b) passing through the long path cause a click at slot#i. In pattern C, an incident pulse at (c) passes through the long path, and clicks the detector at slot#i. Eve obtains Alice’s bit when one Bob counts a photon at slot#i in pattern B, but not in patterns A and C. The probability of a click at slot#i, conditioned such that one Bob receives one photon super-positioned over double pulses, is 1/4 in pattern A, 1/2 in pattern B, and 1/4 in pattern C.

Fig. 3
figure 3

Pulse patterns when IR attack is conducted. IRA denotes intercept-and-resend attack, and S.P. and L.P. stand for the short and long paths, respectively

Full size image

In DPS-QCKA, Eve conducts the IR attack against the broadcast signal, as illustrated in Fig. 2, through which she obtains Alice’s bit created from the click at slot#i when at least one Bob counts a photon from pattern B. Here, we evaluate the probability of Eve obtaining Alice’s bit, assuming a two-Bob system as an example. In a system with two Bobs, the number of combinations of pulse patterns that causes a click at slot#i is 32 = 9, as listed in Table 1, where the probability of each combination is also given. Eve obtains Alice’s bit when at least one Bob counts a photon from pattern B, which are combinations of (2), (4), (5), (6), and (8). Therefore, the probability of Eve obtaining Alice’s bit, provided that the IR attack is conducted, is given by the sum of their probabilities as 1/8 × 4 + 1/4 = 3/4. Subsequently, the upper bound of the eavesdropping probability through the IR attack is ηIR = rIR × (3/4) \(\le 3e_{{\text{AB}}}\) in a two-Bob system, where \(r_{{\text{IR}}} \le 4e_{{\text{AB}}}\) is substituted. The eavesdropping probability of the IR attack against other DPS-QCKA systems with more than two Bobs can be similarly evaluated. This is ηIR = rIR × (10/11) in a three-Bob system and ηIR = rIR × (15/16) in a four-Bob system, although the details of the evaluation processes are not presented here to avoid redundancy. The eavesdropping probability conditioned by the IR attack approaches one as the number of Bobs increases.

Table 1 Combination of pulse patters causing a click at a given time slot in a two-Bob system
Full size table

Using the eavesdropping probabilities through the BS and IR attacks evaluated above, that is, ηBS and ηIR, the bit mismatch ratio between Alice’s and Eve’s bits is expressed as.

$$ e_{{\text{AE}}} = \frac{{1 - (\eta_{{\text{BS}}} + \eta_{{\text{IR}}} {)}}}{2} $$
(6)

The mutual information between Alice and Eve IAE can be evaluated by substituting this expression into Eq. (3), and the key creation rate R in DPS-QCKA system is evaluated by using Eq. (1) with Eqs. (2–5).

4 Calculation

Based on the previous section where the creation rate of systems suffering from the beam split attack and the intercept-and-resend attack is analyzed, we calculated the key creation rate R in DPS-QCKA systems. The results are shown in Fig. 4, where the number of Bobs is assumed to be N = 2, 3, or 4. The key creation rate drastically decreases with the transmission distance because the raw-key rate is proportional to TN, as shown in Eq. (4). It is also notably lower in systems with a larger number of Bobs because the eavesdropping probability increases in addition to the raw-key rate being proportional to (κTμ0)N. Even though the key creation rate is drastically reduced for a long distance and a large number of Bobs, it is still 10–7 bit/pulse, corresponding to 100 bits/s at a 1-GHz pulse repetition rate, which is achievable in a four-party system (N = 3) with a transmission distance of 40 km for each Bob using APD-based photon detectors. This value would be one order of magnitude higher if high-performance superconducting nanowire single-photon detectors are assumed, which is much higher than that in a QCKA experiment that employs a protocol based on a four-photon GHZ state [9].

Fig. 4
figure 4

Key creation rate R in DPS-QCKA systems with two, three, or four Bobs. The parameter values assumed are as follows: dark count rate: d = 10–7, detection efficiency: κ = 0.25, fiber attenuation: 0.2 dB/km, and interference error rate: eMZ = 0.01. The mean photon number sent from Alice is optimized for the key creation rate to be maximum at each distance

Full size image

In the last of this section, we briefly discuss the system performance of QCKA broadcasting BB84 signals instead of DPS signals. The present idea of broadcasting weak coherent lights to all recipients simultaneously can be also employed in BB84-based QCKA [17], such as weak coherent states as quasi single photons of {|0 > , |1 >} and {|+ >  = (|0 > +|1 >)/\(\sqrt {2}\), |– >  = (|0 > –|1 >)/\(\sqrt {2}\)} are broadcast to all recipients. A common secret key can be shared between multiple parties with one quantum transmission, similarly to the present scheme. However, the key creation rate in BB84-based systems would be lower than that in the present one. Provided that the eavesdropping probability is the same, the key creation rate in QCKA broadcasting phase-encoded BB84 signals, that is, |0 >  = (|t1 > +|t2 >)/\(\sqrt {2}\), |0 >  = (|t1 > –|t2 >)/\(\sqrt {2}\), |+ >  = (|t1 >  + i|t2 >)/\(\sqrt {2}\), and |– >  = (|t1 > –i|t2 >)/\(\sqrt {2}\) where |t1,2 > represents the single-photon state at time-bin t1,2, would be 1/3 × (1/2)N of that broadcasting DPS signals (where N is the number of recipients). The factor (1/2)N arises from the fact that the measurement basis is randomly selected and it must be matched in all participants in BB84-based schemes while there is no such basis selection in the present scheme. Besides, the factor 1/3 arises from the fact that isolated two pulses convey one bit information in phase-encoded signal suitable for fiber transmission, and three time slots are necessary for a recipient to create one bit, whereas each time slot serves to provide one bit in the DPS scheme.

5 Summary

This study presented a QCKA scheme based on DPS-QKD. One party broadcasts a weak coherent pulse train, as in DPS-QKD, to multiple parties, that measure their relative phases. Subsequently, the transmitter and receivers share a secret key based on the receivers’ coincident counts. Its setup and operation are simpler than those of conventional QCKA schemes that utilize a multipartite entanglement state. The key creation performance was evaluated by considering the eavesdropping probability, and calculations were conducted accordingly. The results indicate that a higher key creation performance than that of conventional entanglement-based QCKA is expected.