1 Introduction

Quantum key distribution (QKD) [1–7] ensures secure key distribution using the principles of quantum mechanics. An active research frontier in practical quantum cryptography is exploring the distribution distance achievable with the present technology. The main challenge in extending the distribution distance of QKD is the channel loss that occurs when transmitting single-photon level quantum signals. Unlike classical communication, quantum signals cannot be amplified, posing a significant hurdle [8]. The exponentially decreased transmission of the optical fibre channel results in a vanishing secure key rate at long distances. Importantly, the limited number of detected signals over long distances also constrains the secure key rate due to the finite-key effect.

In the quest for achieving long-distance QKD, twin-field QKD (TF-QKD) is proposed [9] recently. TF-QKD may achieve a secure key rate in spirit similar to that of a single-repeater QKD scenario, significantly increasing the ultimate distance. Within a few years, TF-QKD has already been experimentally demonstrated in lab [10–21] through up to 1002 km spooled fibre [21], and in the field test over 511 km deployed fibre across metropolitans [17]. However, the previous 1002 km distribution distance [21] was achieved under an asymptotic assumption. The longest distribution distance considering the finite size effect was reported to be 952 km [21]. The finite-size effect has to be taken into account in a practical QKD system since there are only a finite number of pulses. This consideration allows us to quantify the security level, i.e., the security coefficient; and apply the composable security framework.

In this work, we demonstrate TF-QKD over 1002 km fibre channel considering the finite size effect. We adopt the sending-or-not-sending (SNS) protocol [22] with advanced 3-intensity decoy-state method [23] and the actively-odd-parity-pairing (AOPP) [24, 25] to improve the distribution distance. The ultra-low-noise superconducting nanowire single-photon detectors (SNSPDs) and dual-band phase estimation method are developed to suppress the system noise, thus achieving long distribution distance. Furthermore, the system is optimized for the normal distance between major cities of a fibre distance of 202 km. A secure key rate of 111.74 kbps is achieved at this distance, better than any reported results to our best knowledge.

2 Results and discussion

2.1 Protocol

In this work, we adopt the 3-intensity SNS protocol developed by Wang et al. [22]. By placing the error correction process ahead of the decoy-state analysis process [23], we can utilize all the heralded time windows for decoy-state analysis, resulting in an enhanced key rate. Furthermore, we also apply the AOPP [24] method to reduce the bit-flip error rate. The source parameters are symmetric for Alice and Bob: there are three sources on each side which are the vacuum source v, the decoy source x, and the signal source y with intensities \(\mu _{v}=0\), \(\mu _{x}\), \(\mu _{y}\) and probabilities \(p_{0}\), \(p_{x}\), \(p_{y}\) respectively. In each time window, Alice (Bob) randomly prepares and sends out a pulse from the three candidate sources to Charlie who is assumed to measure the interference result of the incoming pulse pair and announce the measurement results to Alice and Bob. In this work, the raw keys in the time windows, while Alice and Bob choose the sources v or y, are used to extract the secure keys. After Alice and Bob send N pulse pairs to Charlie, and Charlie announces all measurement results, Alice and Bob distill the secure keys according to the following formula [23, 25, 26]:

$$ R=\frac{1}{N}\bigl\{ n_{1}\bigl[1-H\bigl(e_{1}^{ph} \bigr)\bigr]-fn_{t} H(E_{t})\bigr\} -R_{ \text{tail}}, $$
(1)

where R is the key rate of per sending-out pulse pair; \(n_{1}\) is the lower bound of the number of survived untagged bits after AOPP and \(e_{1}^{ph}\) is the upper bound of the phase-flip error rate of those survived untagged bits after AOPP; \(n_{t}\) is the number of survived bits after AOPP and \(E_{t}\) is the corresponding bit-flip error rate in those survived bits; f is the error correction inefficiency which is set to \(f=1.16\); \(H(x)=-x\log _{2}x-(1-x)\log _{2}(1-x)\) is the Shannon entropy. And \(R_{\text{tail}}\) is

$$ \begin{aligned} R_{\text{tail}}={}&\frac{1}{N} \biggl[2\log _{2}{ \frac{2}{\varepsilon _{\mathrm{cor}}}}+4\log _{2}{ \frac{1}{\sqrt{2}\varepsilon _{PA}\hat{\varepsilon}}} \\ &{}+2\log _{2}(n_{vy}+n_{yv})\biggr], \end{aligned} $$
(2)

where \(\varepsilon _{\mathrm{cor}}\) is the failure probability of error correction, \(\varepsilon _{PA}\) is the failure probability of privacy amplification, ε̂ is the coefficient while using the chain rules of smooth min- and max- entropy [27], and \(2\log _{2}(n_{vy}+n_{yv})\) is the extra cost of the advanced decoy state analysis [23] (\(n_{vy}\) is the number of raw keys while Alice chooses the source v and Bob chooses the source y, and the definition of \(n_{yv}\) is similar with that of \(n_{vy}\)).

2.2 Experiment

The experimental setup is shown in Fig. 1. The seed lasers (\(\lambda _{1}=1548.51\) nm and \(\lambda _{2}=1550.12\) nm) are frequency stabilized using the Pound-Drever-Hall (PDH) technique [28–30] with an ultra-stable cavity serving as the reference. The light is then sent to Alice’s and Bob’s stations through 450 km single-mode fibres respectively, incorporating 4 erbium-doped fibre amplifiers (EDFAs) in each path to stabilize the intensity. At Alice’s (Bob’s) station, the \(\lambda _{1}\) light from Charlie is modulated to a 400 ns pulse in each 1 μs period, functioning as the “strong phase reference”. The \(\lambda _{2}\) light serves as the frequency reference for the optical phase-locked loop (OPLL). The locally produced \(\lambda _{2}\) laser is locked to the frequency reference from Charlie, and then modulated to “dim phase reference” and “quantum signals”. As shown in Fig. 2, the intensity of the 40 ms “dim phase reference” is generally higher than the 60 ms “quantum signals” light. In each 1 μs period, the pulse train is modulated to the same random pattern in the first 400 ns for Alice and Bob, serving as the “dim phase reference”. In the remaining 600 ns, the pulse train is modulated to generate random quantum signals based on their respective local random numbers. Note that only the detections occurring within the first 400 ns in each 1 μs period, and within the first 40 ms in the 100 ms period, are utilized as the “dim phase reference”. Similarly, the detections in the last 600 ns of each 1 μs period, and the last 60 ms of the 100 ms period, are used as the “quantum signals”. For both the “strong phase reference” and “dim phase reference”, the relative phases between Alice and Bob are set to four relative phases \(\delta_{AB}=\{0, \pi/2, \pi, 3\pi/2\}\) within a 1 μs period.

Figure 1
figure 1

Experimental setup. The seed lasers (\(\lambda _{1}=1548.51\) nm and \(\lambda _{2}=1550.12\) nm) for the phase reference and quantum signal are distributed from Charlie to Alice and Bob through 900 km single mode fibre spools. The locally generated \(\lambda _{2}\) light is frequency locked to the seed laser with an optical phase-locked loop (OPLL), and modulated to quantum signals. The “dim phase reference” is generated by time-multiplexing with the quantum signal. The \(\lambda _{1}\) light is modulated to “strong phase reference”, and then combined with the quantum signals by wavelength-multiplexing. The quantum signals are transmitted through the quantum channel and interfered at Charlie. The interference results are detected with SNSPDs. The local intensity monitors at Alice and Bob, the polarization and the relative delay at Charlie, and the “strong phase reference” signals are also detected with SNSPDs. BS, beam splitter; PBS, polarization beam splitters; IM, intensity modulator, PM, phase modulator; ATT, attenuator; DWDM, dense wavelength division multiplexing; CIR, optical circulator; EDFA, erbium-doped fibre amplifier; DCM, dispersion compensation module; EPC, electronic polarization controller

Full size image
Figure 2
figure 2

Time sequence of the quantum signals and the reference signals: (a) The \(\lambda_{2}\) light is modulated to a 100 ms period, including 40 ms “dim phase reference”, and 60 ms “quantum signals”. (b) The \(\lambda_{2}\) light is modulated to a 1 GHz pulse train in each 1 μs period: in the first 400 ns, Alice and Bob modulate the pulses to the same intensity pattern, with four relative phases between them, as the “dim phase reference”; in the remaining 600 ns, they modulate random “quantum signals” based on Alice’s/Bob’s random numbers, respectively. (c) The \(\lambda_{1}\) “strong phase reference” light is modulated to a 400 ns pulse in each 1 μs period, with four relative phases between Alice and Bob

Full size image

We implemented the 3-intensity SNS-TF-QKD protocol in the experiment. The \(\lambda _{2}\) quantum signals are modulated to 3 intensities with 16 different phases using intensity modulators (IMs) and phase modulators. The IMs are stabilized at Alice’s (Bob’s) station to ensure the quantum signals’ intensities are stable. The \(\lambda _{1}\) “strong phase reference” is then filtered and combined with the quantum signals. An electronic polarization controller is installed within the secure zone to control the polarization drift. A dispersion compensation module is employed to pre-compensate for the chromatic dispersion of the fibre channel. The signals are then attenuated to the predetermined intensities and subsequently transmitted to Charlie via the quantum channels.

The polarization of different wavelengths may evolute differently. At Charlie’s measurement station, a polarization feedback algorithm is utilized to optimize the \(\lambda _{1}\) detections to between 75 kHz and 300 kHz, while minimizing the \(\lambda _{2}\). The relative delay between Alice’s and Bob’s signals is monitored and compensated using the rising edges of the \(\lambda _{1}\) pulses. The light from Alice and Bob is interfered at the beam splitter and subsequently demultiplexed to \(\lambda _{1}\) and \(\lambda _{2}\) wavelengths. This light is then filtered by DWDMs, measured with SNSPDs, and recorded with a Time Tagger. The recorded signals are categorized into the “strong phase reference”, “dim phase reference” and the quantum signal for subsequent data processing.

The ultra-low loss fibre is utilized to minimize channel loss. The fibre is manufactured with “pure silica core” technology to reduce the doped Ge in the core and with decreased fictive temperature. The average attenuation of the fibres is measured to be less than 0.157 dB/km.

The ultra-low dark count SNSPDs are developed to reduce detection-related noise. The noise suppression includes stages of filtering. The long-wavelength (>2 μm) filtering is achieved using the 28 mm diameter fibre coils at the 40 K cold plate. Narrowband wavelength filtering is carried out utilizing a cryogenic bandpass filter (BPF) with a 5 nm bandwidth and an 85% transmittance at 2.2 K cold plate [31]. The dark count rate is measured to be as low as 0.02 Hz. Additionally, the detection efficiency is optimized to be around 60% with a distributed Bragg reflector (DBR) based optical cavity [32].

The time-multiplexed dual-band stabilization method is employed to reduce the re-Rayleigh scattering noise induced in previously reported time-multiplexed phase estimation procedures. With dual-band stabilization, the wavelength of the “strong phase reference” of \(\lambda _{1}\) is different from the quantum signal of \(\lambda _{2}\). The induced re-Rayleigh scattering is filtered with DWDMs. Furthermore, circulators are implemented in Charlie to eliminate noise resulting from the SNSPDs. Additionally, the \(\lambda _{1}\) “strong phase reference” is time-multiplexed with the quantum signal, effectively mitigating disturbance caused by spontaneous Raman scattering noise induced by the strong phase reference light. The combination of wavelength- and time-multiplexing ensures that the noise introduced by the strong phase reference signal is less than 0.01 Hz. Moreover, the intensity of the weak “dim phase reference” signal, which is also time-multiplexed with the quantum signal, remains low enough to not generate perceptible noise.

The data post-processing-based phase estimation method [21] is adopted. First, the phase drift of the \(\lambda _{1}\) wavelength is estimated using the “strong phase reference”. Then, the wavelength difference is taken into account to estimate the phase of the \(\lambda _{2}\) light, with the accumulated phase drift of the “strong phase reference”. Lastly, the initial phase difference \(\phi _{s}(0)-\phi _{r}(0)\) is computed using the phase difference between the “dim phase reference” and the “strong phase reference”. In the experiment, this phase difference is computed and refreshed every 500 ms, to circumvent any accumulation of errors stemming from inaccurate wavelength settings, high-order residual phase errors, and errors in phase estimation.

Result

We first test the performance of 1002 km fibres (the “+”-shape points in Fig. 3). The fibre distances between Alice-Charlie and Bob-Charlie are measured to be 500 km and 502 km. The decoy intensities are optimized as \(\mu _{x}=0.08\), \(\mu _{y}=0.445\), with the time ratios \(p_{\mathrm{vac}}=0.52\), \(p_{x}=0.28\), \(p_{y}=0.20\) (Parameter #1). The finite size effect [26] is taken into consideration for all the experimental tests, considering composable security under any coherent attack [26, 33]. The error correction inefficiency is set to \(f=1.16\) in the calculation; the failure probability of Chernoff bound in finite-size estimation is set to \(\varepsilon =10^{-10}\); the failure probability of the error correction, and the privacy amplification is set to \(\varepsilon _{\mathrm{cor}}=\varepsilon _{PA}=10^{-10}\); the coefficient of the chain rules of smooth min- and max- entropies is set to \(\hat{\varepsilon}=10^{-10}\).

Figure 3
figure 3

Simulations and experimental results of the secure key rates. The “+”-shape points are experimental results using the long-distance optimized parameter (Parameter #1), and the “×”-shape points are experimental results using the short-distance optimized parameter (Parameter #2). The solid curve is the simulation results with Parameter #1. The red dashed curve is the simulation result with Parameter #2. All simulations and experimental results considered the finite size effect. The circle markers indicates the state-of-the-art TF-QKD results reported in Ref. [17–21]. The blue dashed line shows the secret key capacity, i.e., the PLOB bound. Insert: the secure key rate per second in short distances

Full size image

The system frequency is set to 1 GHz, with the signal pulse width set to 120 ps. The quantum signals are sent in the last 600 ns of the 1 μs period where the “strong phase reference” is switched off. The quantum signals are time-multiplexed with the “dim phase reference” in the last 60 ms of the 100 ms period. The detections near the strong light are also dropped to avoid potential noises. As a result, the effective signal frequency is 351 MHz for the long-distance scenario.

The total noises in the \(\lambda _{2}\) are measured to be 0.019 Hz and 0.035 Hz in the working conditions. We attribute the noise mainly contributed by the SNSPD dark count and the spontaneous Raman scattering noise induced by the \(\lambda _{1}\) light. The SNSPD detection efficiencies are measured to be 60% and 55%. The additional optical losses in Charlie are measured to be around 1.4 dB. In data processing, a 200 ps window is defined to filter out noises, with an efficiency of about 65%.

Owing to the significant optical attenuation experienced over long-distance fibre, it is necessary to send a larger number of quantum signals in order to generate secure keys considering the finite size effect. A total of \(1.00\times 10^{15}\) quantum signal pulses are dispatched, resulting in \(9.81\times 10^{5}\) valid detections that fall within the effective window. The quantum bit error rate (QBER) in Z basis is measured to be \(9.44\times 10^{-3}\) after AOPP; the QBER in X basis is measured to be 4.20%. The final secure key is \(3.11\times 10^{-12}\), which equates to 0.0011 bps considering the effective signal frequency. A total of 3112 bits of final secure keys are accumulated during the test. The detailed experimental results are summarized in Table 1 and Fig. 3. See Additional file 1 for the full experimental results.

Table 1 Experimental results for fibre lengths between 202 km and 1002 km. L: total fibre distance, η: total fibre transmittance, N: total signal pulses Alice and Bob sent, \(n_{1}\): untagged bits after AOPP, \(e_{1}^{ph}\): phase-flip error rate after AOPP, \(n_{t}\): survived bits after AOPP, \(E_{t}\): bit-flip error rate after AOPP, \(E_{x}\): X-basis QBER of the raw bits, R: secure key rate per pulse, R (bps): secure key rate per second
Full size table

Next, we test the performance of fibre distances between 202 km and 505 km (the “×”-shape points in Fig. 3). The intensities of the decoy states are optimized for short distances as \(\mu _{x}=0.05\), \(\mu _{y}=0.482\), with the time ratios \(p_{\mathrm{vac}}=0.68\), \(p_{x}=0.04\), \(p_{y}=0.28\) (Parameter #2). The “strong phase reference” period is reduced to 100 ns in the 1 μs signal period; the intensity of the “dim phase reference” is set to the same as the quantum signal through the 100 ms period. As a result, the effective signal frequency is increased to 900 MHz. Besides, we used SNSPDs with >80% detection efficiency and a relatively higher dark count rate of about 10 Hz. The time window in data processing is set to 500 ps, yielding an almost unity efficiency.

A total of \(3.24\times 10^{12}\) quantum signal pulses are sent for each distance, which equals to one hour of experimental time. The secure key rate is measured to be \(1.24\times 10^{-4}\), \(2.60\times 10^{-5}\), \(3.11\times 10^{-6}\), and \(3.76\times 10^{-7}\) which corresponds to 111.74 kbps, 23.44 kbps, 2.80 kbps, and 338 bps for the 202 km, 303 km, 404 km, and 505 km fibre distances, respectively. The secure key rates exceed the absolute PLOB bound [34] for the tests with the fibre distances equal to or longer than 404 km, where the PLOB bound is calculated as \(-\log _{2}(1-\eta )\) with the optical and detection efficiency in Charlie set to \(\eta _{\mathrm{opt}}=100\%\).

3 Conclusion

In conclusion, we have demonstrated the first experiment of SNS-TF-QKD over a remarkable distance of 1002 km, while considering the finite size effect. The result has been made possible by employing several key components, including the ultra-low-loss fiber, ultra-low-noise SNSPD, dual-band phase stabilization method, and moderate data size. The achieved secure key rates over fiber distances ranging from 202 km to 505 km were highly practical, indicating the potential for supporting a wide range of applications. In addition to improving the performance, TF-QKD is also expected to be implemented in chip-scale systems in the future, based on recent advancements in chip-scale systems implementing BB84 and MDI-QKD protocols [35–38].