WO2023066543A1

WO2023066543A1 - Methods, transmitter device, receiver device, and system for quantum key distribution

Info

Publication number: WO2023066543A1
Application number: PCT/EP2022/072655
Authority: WO
Inventors: Fred Chi Hang FUNG
Original assignee: Huawei Technologies Duesseldorf Gmbh
Priority date: 2021-10-18
Filing date: 2022-08-12
Publication date: 2023-04-27

Abstract

A Quantum Key Distribution (QKD) method is disclosed. The QKD method comprises providing a transmitter device (Tx) and a receiver device (Rx), and operating the Tx and the Rx to generate a first transmitter-side sequence of symbols and a first receiver-side sequence of symbols. Moreover, the operating of the Tx and the Rx comprises providing cryptographic keysto the Tx and the Rx, determining a first transmitter-side symbol, determining a first receiver-side symbol, encrypting a message indicating first association information, with a provided cryptographic key, sending the encrypted message over a classical communication channel, receiving the encrypted message over the classical communication channel, decrypting the encrypted message with a provided cryptographic key, including the first transmitter-side symbol to the first transmitter-side sequence of symbols based on the first association information, and including the first receiver-side symbol to the first receiver-side sequence of symbols based on the first association information.

Description

METHODS, TRANSMITTER DEVICE, RECEIVER DEVICE, AND SYSTEM FOR QUANTUM KEY DISTRIBUTION

TECHNICAL FIELD

The present disclosure generally relates to the field of Quantum Key Distribution (QKD). Specifically, the present disclosure relates to a QKD method, a method of operating a QKD system, a method of operating a transmitter device (Tx) in a QKD system, a method of operating a receiver device (Rx) in a QKD system, a transmitter device (Tx) for operating in a QKD system, a receiver device (Rx) for operating in a QKD system, and a QKD system. For example, the present disclosure relates to a QKD protocol for operating a QKD system in order to generate a secret key based on quantum physics.

BACKGROUND

Generally, QKD protocols are the foundation for generating secret keys based on quantum physics. The generated secret keys are information-theoretically secure, in contrast to computational security offered by conventional cryptographic methods. Furthermore, there are currently two conventional types of QKD protocols available including a discrete-variable (DV)-QKD based protocol and a continuous-variable (CV)-QKD based protocol. In the DV- QKD based protocol, the secure bits are derived from information carried in single photons. In the CV-QKD based protocol, the secure bits are derived from information carried in the quadratures of the quantized electromagnetic wave. Generally, DV-QKD and CV-QKD systems rely on different detection technologies for implementation.

A conventional CV-QKD scheme comprises a Gaussian protocol, with which long distances of key generation can be achieved. However, an issue of the conventional Gaussian protocol is that it might involve error correction codes at low Signal to Noise ratio (SNR) values, since it operates only with a transmit power up to a certain level for a given distance. Another issue of the conventional Gaussian protocol is that it may be sensitive to phase noise in the received signals (which may be caused by imperfect phase noise reduction and imperfect laser sources). Furthermore, the present of phase noise may degrade the achievable distance of the protocol.

Moreover, another issue of conventional QKD protocols is that they are typically limited to certain operational distances. For example, typically, a QKD protocol and its security proof are constructed to provide a security called information theoretic security. This means that a security of a QKD protocol is achieved by quantum mechanics. However, such a security may be limited to a distance which QKD can provide secure keys.

SUMMARY

In view of the above, the present disclosure aims to improve conventional QKD methods, operating methods of transmitter devices in QKD systems, operating methods of receiver devices in QKD system, and operating methods of QKD systems.

An objective is to provide a QKD protocol that may facilitate performing QKD in practical settings. Another objective is to provide a practical and robust QKD method that may be used for long distances. Another objective is to provide a QKD method that may be used for generating longer secret keys over a standard protocol.

These and other objectives are achieved by the solutions described in the enclosed independent claims. Advantageous implementations are further defined in the dependent claims.

A first aspect of the present disclosure provides a Quantum Key Distribution (QKD) method that comprises providing a transmitter device (Tx) and a receiver device (Rx) connected to each other via an optical channel having an optical mode, the optical mode having a two-dimensional (2D) phase space, and operating the Tx and the Rx to generate a first transmitter-side sequence of symbols and a first receiver-side sequence of symbols. Moreover, the operating of the Tx and the Rx comprises providing a cryptographic key to the Tx and a cryptographic key to the Rx, operating the Tx to drive the optical mode to a quantum coherent state in accordance with a probability distribution in the 2D phase space, the quantum coherent state having a maximum amplitude at or near a first point in the 2D phase space, operating the Tx to determine a first transmitter-side symbol based on the first point, operating the Rx to determine a second point in the 2D phase space by performing a measurement on the optical mode, operating the Rx to determine a first receiver-side symbol based on the second point, encrypting a message with a provided cryptographic key, the message indicating first association information, sending the encrypted message to at least one of the Rx and the Tx over a classical communication channel, receiving the encrypted message over the classical communication channel, decrypting the encrypted message with a provided cryptographic key, for obtaining the first association information, operating the Tx to include the first transmitter-side symbol to the first transmitter- side sequence of symbols based on the first association information, and operating the Rx to include the first receiver-side symbol to the first receiver-side sequence of symbols based on the first association information.

Hereinafter, the terms “transmitter device” and “Alice” are used interchangeably. For the ease of description, it is assumed that Alice is a user operating the transmitter device. Moreover, the terms “receiver device” and “Bob” are also used interchangeably. For the ease of description, it is assumed that Bob is a user operating the receive device, without limiting the present disclosure to a specific nomenclature.

For example, a QKD system comprising the Tx and the Rx may be provided. The QKD system may be a CV-QKD system or a DV-QKD system.

The Tx may be any known transmitter device that may operate in a QKD system. For example, the Tx may comprise a circuitry and an optical unit. The circuitry may comprise hardware and software. The hardware may comprise analog or digital circuitry, or both analog and digital circuitry. For example, the circuitry may comprise one or more processors and a non-volatile memory connected to the one or more processors. The non-volatile memory may carry executable program code which, when executed by the one or more processors, causes the Tx to perform the operations or one or more steps of the methods described herein. The optical unit of the Tx may comprise a laser diode, a local oscillator, a coupler, a polarizer, an amplitude modulator, a pulse modulator, a photodiode, a polarization beam splitters, an attenuator, etc., as it is generally known.

The Rx may be any known receiver device that may operate in a QKD system. For example, the Rx may comprise a circuitry and an optical unit. The circuitry may comprise hardware and software. The hardware may comprise analog or digital circuitry, or both analog and digital circuitry. For example, the circuitry may comprise one or more processors and a non-volatile memory connected to the one or more processors. The non-volatile memory may carry executable program code which, when executed by the one or more processors, causes the Rx to perform the operations or one or more steps of the methods described herein. The optical unit of the Rx may comprise a detector (e.g., a homodyne detector, a heterodyne detector, or the like), a polarization controller, a polarization beam splitters, one or more mirrors, a local oscillator, a coupler, an amplitude modulator, a pulse modulator, etc., as it is generally known. Moreover, the Tx and the Rx may be connected to each other via the optical channel having the optical mode. The optical channel may be any kind of physical space that allows light to propagate from a first location (i.e., the Tx location) to a second location (i.e., the Rx location). For instance, the optical channel may be air, vacuum, an optical fibre, or the like. Moreover, the optical mode has the 2D phase space. For instance, the 2D phase space may be the X-P phase space having two axes of X and P which are the quadratures of the quantized electromagnetic field.

Furthermore, a cryptographic key may be provided to the Tx and a cryptographic key may be provided to the Rx. For example, the cryptographic keys may be based on a symmetric cryptography, asymmetric cryptography, a QKD key such as a QKD key from a previous measurement, or the like.

The cryptographic keys may be any key such as a string of character that may be used, e.g., in a cryptographic function for encryption and decryption of the message indicating the first association information. For example, the cryptographic key provided to the Tx and the cryptographic key provided to the Rx may be based on symmetric cryptography, i.e., the same key may be used for both encryption and decryption of the message indicating the first association information. Furthermore, the cryptographic key provided to the Tx and the cryptographic key provided to the Rx may be identical or they may be two different keys.

Moreover, the cryptographic key provided to the Tx and the cryptographic key provided to the Rx may be based on asymmetric cryptography. For example, a public key and a private key may be provided to the Tx. Moreover, a public key and a private key may be provided to the Rx.

Furthermore, Alice may use the provided public key for encrypting the message indicating the first association information and/or use the private key for decrypting the encrypted message. Similarly, Bob may use the provided public key for encrypting the message indicating first association information and/or use the private key for decrypting the encrypted message. Moreover, the provided cryptographic keys may be a QKD key such as a secret key generated in a previous round of measurement. The first transmitter-side sequence of symbols may comprise a plurality of transmitter-side symbols. A transmitter-side symbol may be a symbol determined by operating the Tx. Moreover, the transmitter-side symbol may comprise a bit string and soft information. The soft information may represent a probability that the transmitter-side symbol is correct. Moreover, the first receiver-side sequence of symbol may comprise a plurality of receiver-side symbols. A receiver-side symbol may be a symbol that is determined by operating the Rx. Further, the receiver-side symbol may comprise a bit string and soft information. The soft information may represent a probability that the receiver-side symbol is correct.

Furthermore, the QKD method may comprise operating the Tx (Alice operates the Tx) to drive the optical mode to a quantum coherent state according to a probability distribution, e.g., a Gaussian distribution in the 2D phase space. Moreover, the quantum coherent state may have a maximum amplitude at or near the first point in the 2D phase space. The first point may be obtained by randomly driving a laser of the Tx. The Tx may further be operated to store the first point. For example, the first point may be selected such that it has a selected X value and a selected P value in the 2D X-P phase space. An example of the first point is (XI, Pl), wherein the values of the XI and Pl are selected. Moreover, the Tx may further be operated to determine the first-transmitter-symbol based on the first point.

The Tx may be operated to determine a plurality of transmitter-side symbol. For example, Alice may operate the Tx and may determine the plurality of transmitter-side symbols, each transmitter-symbol may be determined as it is discussed above.

Furthermore, the Rx may be operated (Bob may operates the Rx) to determine the second point (a detected signal) in the 2D phase space or the X-P plane by performing a measurement on the optical mode. For example, the second point may be obtained such that it has a selected X value and a selected P value in the 2D X-P phase space. An example of the second point is (X2, P2), wherein the values of the X2 and P2 are selected.

The Rx may be operated to determine a plurality of receiver-side symbol. For example, Bob may operate the Rx and may determine the plurality of receiver-side symbols, e.g., each receiver-side symbol may be determined, as it is discussed above. The QKD method further comprises encrypting the message with a provided cryptographic key. The message may indicate the first association information. For example, the first association information may be information representing including, keeping, maintaining, allocating, adding, etc.

For example, the first association information may be including a determined first transmitterside symbol to the (e.g., newly generated) transmitter-side sequence of symbols, or adding a determined first transmitter-side symbol to the transmitter-side sequence of symbols that already has other transmitter-side symbols, or the like. Similarly, the first association information may be including a determined first receiver-side symbol to the (e.g., newly generated) receiver-side sequence of symbols, or adding a determined first receiver-side symbol to the receiver-side sequence of symbols that already has other receiver-side symbols, or the like.

The Tx and/or the Rx may further perform operations to determine the first association information. For example, the message may indicate information such as a parameter related to the 2D phase space that may be used and the first association information may be determined.

Furthermore, Alice, Bob, or another entity may encrypt the message indicating the first association information. For example, in some embodiments, Alice may encrypt the message with the cryptographic key provided to her, and may further send the encrypted message to Bob over the classical communication channel. Moreover, Bob may receive the encrypted message and may use the cryptographic key provided to him to decrypt the message. Furthermore, Bob may obtain the first association information.

In some embodiments, Bob may encrypt the message with the cryptographic key provided to him, and may further send the encrypted message to Alice over the classical communication channel. Moreover, Alice may receive the encrypted message and may use the cryptographic key provided to her to decrypt the message. Furthermore, Alice may obtain the first association information.

In some embodiments, an entity (for example, a server computer, a device operating in the QKD system, or the like) may encrypt the message with a cryptographic key. For instance, the entity may have at least one of the provided cryptographic keys, e.g., the entity may be a server computer providing both cryptographic keys to the Tx and the Rx. Moreover, the entity may encrypt the message and may further send the encrypted message to Alice and/or Bob, over the classical communication channel. Moreover, Alice and/or Bob may receive the encrypted message, decrypt the encrypted message with a corresponding provided cryptographic key, and may further obtain the first association information.

Next, a hypothetical example is presented for the ease of description and without limiting the present disclosure to this hypothetical example. In this hypothetical example, Alice measures the transmitter-side symbols Xu, X12, X13, X14, . . ., X_n. Bob measures the receiver-side symbols Yu, Y12, Y13, Y14, . . ., Y_n. Xu is the 11^th measured symbol (first transmitter-side symbol) which has first association information of “keep”. Yu is the 11^th measured symbol (first receiver-side symbol) which has first association information of “keep”. Alice encrypts a message and sends the encrypted message to Bob. The message indicate that the 11^th measured symbol has the first association information of “keep”. Afterwards, Alice includes the Xu to the first transmitterside sequence of symbols. Moreover, Bob receives the encrypted message over the classical communication channel. Bob further decrypts the encrypted message and obtains the first association information of “keep” for the Yu. Bob further incudes the Yu to the first receiverside sequence of symbols since the Yu has the first association information of “keep”.

The QKD method of the first aspect may be used for operating the QKD system and it is possible to improve a signal quality obtained from the symbols. For example, Alice may transmit a plurality of signal to Bob, each signal has a specific intensity. Moreover, Alice may determine a transmitter-side symbol for each transmitted signal. Further, Alice may decide to keep or include the symbols that are determined based on transmitted signals that have a higher intensity or their intensity is larger than a threshold intensity.

Therefore, Alice may select these signals that have a higher intensity. Afterwards, Alice may associate the first association information of “keep” to the transmitter-side symbols that are determined based on the selected signals (i.e., the signals that have the higher intensity, or their intensities are larger than the threshold intensity).

Furthermore, Alice may encrypt the message indicating the first association information and may send the message to Bob. Hence, it is possible for Alice and Bob to generate the first transmitter-side sequence of symbols and the first receiver-side sequence of symbols based on the signals that have the higher intensity or their intensity is larger than the threshold intensity. Therefore, it may be possible to increase signal-to-noise ratio between different sequences of symbols.

Moreover, it is also possible that Bob may decide keeping the symbols. For example, Bob may measure a plurality of signal, each signal has a specific intensity. Moreover, Bob may determine a receiver-side symbol for each measured signal. Further, Bob may decide to keep or include the symbols that are determined based on signals that have a higher intensity or their intensity is larger than a threshold intensity. Therefore, Bob may select these signals that have a higher intensity. Afterwards, Bob may associate the first association information of keep to the receiver-side symbols that are determined based on the selected signals (i.e., the signals that have the higher intensity, or their intensities are larger than the threshold intensity).

Furthermore, Bob may encrypt the message indicating the first association information and may send the message to Alice. Hence, it is possible for Alice and Bob to generate the first transmitter-side sequence of symbols and the first receiver-side sequence of symbols based on the signals that have the higher intensity or their intensity is larger than the threshold intensity. Therefore, it may be possible to increase signal-to-noise ratio between different sequences of symbols.

The QKD method of the first aspect may be used for operating the QKD system and it may be possible to enhance a design of an error correcting code. Further, the signal quality may be improved and a requirement on an error correcting capability of the error correcting code may be relaxed. For example, by increasing the SNR or the signal quality, it may be possible to enhance an efficiency of an error correcting information, and therefore, error in the QKD method may be efficiently corrected.

The QKD method of the first aspect may be used for operating the QKD system and it may be possible to increase a security of a generated secret key, e.g., since any eavesdropper may not be aware of the first association information that is encrypted. For example, Alice and Bob may exchange encrypted message indicating the first association information. Further, since the first association information is encrypted and is unknown to any eavesdropper, therefore, the eavesdropper’s information on the transmitter-side sequence of symbols and/or the receiver- side sequence of symbols may be reduced, and thus, a higher key length or a longer distance may be achieved.

The QKD method of the first aspect may be used for operating the QKD system and it may be possible to increase a length of a generated secret key and/or a distance over which a secret key is generated, since any eavesdropper may not be aware of the first association information that is encrypted.

In an implementation form of the first aspect, the message further indicates second association information, and wherein the method further comprises operating the Tx and the Rx to generate a second transmitter-side sequence of symbols and a second receiver-side sequence of symbols, wherein the operating of the Tx and the Rx to generate the second transmitter- side sequence of symbols and the second receiver-side sequence of symbols comprises operating the Tx to drive the optical mode to a further quantum coherent state in accordance with a further probability distribution in the 2D phase space, the further quantum coherent state having a maximum amplitude at or near a third point in the 2D phase space, operating the Tx to determine a second transmitter-side symbol based on the third point, operating the Rx to determine a fourth point in the 2D phase space by performing a further measurement on the optical mode, operating the Rx to determine a second receiver-side symbol based on the fourth point, operating the Tx to include the second transmitter-side symbol to the second transmitter-side sequence of symbols based on the second association information, and operating the Rx to include the second receiver-side symbol to the second receiver-side sequence of symbols based on the second association information.

In a further implementation form of the first aspect, the QKD method comprises operating the Tx and the Rx to generate a first transmitter-side sequence of symbols, a second transmitterside sequence of symbols, a first receiver-side sequence of symbols, and a second receiver-side sequence of symbol. Moreover, the operating of the Tx and the Rx comprises providing a cryptographic key to the Tx and a cryptographic key to the Rx, operating the Tx to drive the optical mode to a quantum coherent state in accordance with a probability distribution in the 2D phase space, the quantum coherent state having a maximum amplitude at or near a first point in the 2D phase space, operating the Tx to determine a first transmitter-side symbol based on the first point, operating the Rx to determine a second point in the 2D phase space by performing a measurement on the optical mode, operating the Rx to determine a first receiver-side symbol based on the second point, operating the Tx to drive the optical mode to a further quantum coherent state in accordance with a further probability distribution in the 2D phase space, the further quantum coherent state having a maximum amplitude at or near a third point in the 2D phase space, operating the Tx to determine a second transmitter-side symbol based on the third point, operating the Rx to determine a fourth point in the 2D phase space by performing a further measurement on the optical mode, operating the Rx to determine a second receiver-side symbol based on the fourth point, encrypting a message with a provided cryptographic key, the message indicating first association information and second association information, sending the encrypted message to at least one of the Rx and the Tx over a classical communication channel, receiving the encrypted message over the classical communication channel, decrypting the encrypted message with a provided cryptographic key, for obtaining the first association information and the second association information, operating the Tx to include the first transmitter-side symbol to the first transmitter-side sequence of symbols based on the first association information, and further include the second transmitter-side symbol to the second transmitter-side sequence of symbols based on the second association information, operating the Rx to include the first receiver-side symbol to the first receiver-side sequence of symbols based on the first association information, and further include the second receiver-side symbol to the second receiver-side sequence of symbols based on the second association information.

For example, it may be possible to determine at least two transmitter-side sequences of symbols and at least two receiver-side sequences of symbols. For instance, two or more groups of quantum signals may be defined having different characteristics. Alice may transmit the quantum signals in one of the two groups. Bob may detect the incoming quantum signals using a coherent receiver independent of their association information. Bob might be informed about the association information after detecting all of the signals. Furthermore, an Eve dropper (Eve) might not know about the association information, since the association information is exchanged using the encrypted message. Hence, it may be possible to increase a security of a secret key generated based on the transmitter-side sequence of symbols and the receiver-side sequence of symbols.

By separating the measured symbols into two or more sequences, it is possible to perform different operations on the symbols. The association information for different symbols may be decided by Alice and/or Bob. The sequence definition may be known by Eve, However, information related to which sequence a signal belongs to, may be unknown to Eve, at least for the duration of concern (allowing computationally secure encryption to be used). The two (or more) sequences may have different characteristics (such as different Eve’s states and SNR/BER). This may allow a differential treatment of the data of the two (or more) sequences by Alice and Bob.

In a further implementation form of the first aspect, the first association information indicates information to maintain the first transmitter-side symbol.

For example, the first association information may be information to keep or maintain the first transmitter-side symbol. The first association information may be information to include the first transmitter-side symbol to the first transmitter-side sequence of symbols.

By keeping or including the symbols that are determined based on a higher intensity signals, it may be possible to increase a SNR of symbols, increase a security of a generated secret key, or the like.

In a further implementation form of the first aspect, the first point is associated with a first parameter, and wherein the first association information comprises a radius of a predefined circle in the 2D phase space. The first association information may be information that the transmitted signals is a signal outside a predefined circle in the 2D phase space.

For example, the transmitted signals may be selected according to the 2D phase space. Moreover, each signal may have a specific intensity. For instance, the signals that are selected according to a point that is outside the predefined circle may have an intensity that is larger than the threshold intensity, and the signals that are selected according to a point that is inside the circle may have an intensity that is smaller than the threshold intensity.

For example, the first parameter may be |oc| and the radius of the predefined circle may be r. Further, if a value of the first parameter a is larger than r, i.e., |ot|>r, Alice may decide to keep the determined transmitter-side symbol, and may include the determined transmitter-side symbol to the first transmitter-side sequence of symbols. Otherwise, if a value of the first parameter a is smaller than r, i.e., |ot|<r, Alice may decide to discard the determined transmitter- side symbol and may include the determined transmitter-side symbol to the second transmitterside sequence of symbols.

Moreover, in some embodiments, Bob may decide the symbols to be included in the first receiver-side sequence of symbols or the second receiver-side sequence of symbols. Therefore, Bob may encrypt the message and send it to Alice.

In a further implementation form of the first aspect, the second association information indicates information to discard the second transmitter-side symbol.

In a further implementation form of the first aspect, the operating of the Tx to determine the second transmitter-side symbol based on the third point comprise generating randomly the second transmitter-side symbol, and/or the operating of the Rx to determine the second receiverside symbol based on the fourth point comprises generating randomly the second receiver-side symbol.

For example, the second association information may be to discard a measured symbol. Moreover, Alice and/or Bob may discard the measured symbol and instead using a random number generator to randomly generate the second transmitter- side symbol and/or the second receiver-side symbol. By randomly generating the second transmitter-side symbol and/or the second receiver-side symbol, it may be possible to increase the security of a raw key obtained.

A second aspect of the disclosure provides a transmitter device (Tx) for operating in a Quantum Key Distribution (QKD) system, the Tx being connectable to a receiver device (Rx) via an optical channel having an optical mode, the optical mode having a two-dimensional (2D) phase space, the Tx being configured to drive the optical mode to a quantum coherent state in accordance with a probability distribution in the 2D phase space, the quantum coherent state having a maximum amplitude at or near a first point in the 2D phase space, determine a first transmitter-side symbol based on the first point, and include the first transmitter-side symbol to the first transmitter-side sequence of symbols based on first association information.

The transmitter device of the second aspect may be a transmitter device for operating in a CV- QKD system or a DV-QKD system, as it is described above. The transmitter device may facilitate improving a design of an error correcting code. For example, by encrypting the message indicating the first association information, it is possible to improve the signal quality, and a requirement on the error correcting capability of the code may be relaxed.

The transmitter device may facilitate increasing a security of a generated secret key. For example, since the message indicating the first association information is encrypted and is unknown to any eavesdropper, therefore, the eavesdropper’s information on the symbols may be reduced, and thus, a security of the generated secret key may be increased.

The transmitter device may facilitate increasing a length of a generated secret key and/or a distance over which a secret key is generated. For example, since the message indicating the first association information is encrypted and is unknown to any eavesdropper, therefore, the eavesdropper’s information on the symbols may be reduced, and thus, a higher key length or a longer distance may be achieved.

In a further implementation form of the second aspect, the Tx is further configured to send or receive an encrypted message to or from the Rx, over a classical communication channel, the encrypted message indicating first association information.

In a further implementation form of the second aspect, the Tx is further configured to receive a cryptographic key, encrypt a message with the cryptographic key, the message indicating first association information, and send the encrypted message to the Rx, over the classical communication channel.

In a further implementation form of the second aspect, the Tx is further configured to receive an encrypted message over the classical communication channel, the message indicating first association information, and decrypt the message with the cryptographic key, for obtaining first association information.

In an implementation form of the second aspect, the first association information indicates information to maintain the first transmitter-side symbol. In a further implementation form of the second aspect, the first point is associated with a first parameter, and wherein the first association information comprises a radius of a predefined circle in the 2D phase space.

In a further implementation form of the second aspect, the including of the first transmitter-side symbol to the first transmitter-side sequence of symbols comprises determining, based on the first parameter and the first association information, whether a value of the first parameter is greater than a value of the radius of the predefined circle, and including the first transmitterside symbol to the first transmitter-side sequence of symbols, when it is determined that the value of the first parameter is greater than the value of the radius of the predefined circle.

In a further implementation form of the second aspect, the transmitter device is further configured to determine the radius of the predefined circle based on a Signal-to-Noise Ratio (SNR) to a Bit Error Rate (BER) of the first transmitter-side symbol.

In a further implementation form of the second aspect, the transmitter device is further configured to generate a second transmitter-side sequence of symbols, wherein the generating of the second transmitter-side sequence of symbols comprises driving the optical mode to a further quantum coherent state in accordance with a further probability distribution in the 2D phase space, the further quantum coherent state having a maximum amplitude at or near a second point in the 2D phase space, determining a second transmitter-side symbol based on the second point, and including the second transmitter-side symbol to the second transmitter-side sequence of symbols based on second association information.

In a further implementation form of the second aspect, the second association information indicates information to discard the second transmitter-side symbol.

In a further implementation form of the second aspect, the second point is associated with a second parameter, and wherein the second association information comprises the radius of the predefined circle in the 2D phase space.

In a further implementation form of the second aspect, the transmitter device is further configured to the including of the second transmitter-side symbol to the second transmitter-side sequence of symbols comprises determining, based on the second parameter and the second association information, whether a value of the second parameter is smaller than the value of the radius of the predefined circle, and including the second transmitter-side symbol to the second transmitter-side sequence of symbols, when it is determined that the value of the second parameter is smaller than the value of the radius of the predefined circle.

In a further implementation form of the second aspect, the determining of the second transmitter-side symbol based on the second point comprises generating randomly the second transmitter-side symbol.

In a further implementation form of the second aspect, the transmitter device is further configured to cooperate with the Rx to compute a first error-free sequence of symbols based on information derived from the first transmitter-side sequence of symbols and information derived from a first receiver-side sequence of symbols, and cooperate with the Rx to generate a first secret key based on the first error-free sequence of symbols by performing a privacy amplification procedure.

In a further implementation form of the second aspect, the transmitter device is further configured to cooperate with the Rx to compute a second error-free sequence of symbols based on information derived from the second transmitter-side sequence of symbols and information derived from a second receiver-side sequence of symbols, and cooperate with the Rx to generate a second secret key based on the second error-free sequence of symbols by performing a privacy amplification procedure.

A third aspect of the disclosure provides a receiver device (Rx) for operating in a Quantum Key Distribution (QKD) system, the Rx being connectable to a transmitter device (Tx) via an optical channel having an optical mode, the optical mode having a two-dimensional (2D) phase space, the Rx being configured to determine a first point in the 2D phase space by performing a measurement on the optical mode, determine a first receiver-side symbol based on the first point, and include the first receiver-side symbol to the first receiver-side sequence of symbols based on first association information.

The Rx may be a receiver device for operating in a CV-QKD system or a DV-QKD system, as it described above. The receiver device may facilitate improving a design of an error correcting code. For example, by encrypting the message indicating the first association information, it is possible to improve the signal quality, and a requirement on the error correcting capability of the code may be relaxed.

The receiver device may facilitate increasing a security of a generated secret key. For example, since the message indicating the first association information is encrypted and is unknown to any eavesdropper, therefore, the eavesdropper’s information on the symbols may be reduced, and thus, a security of the generated secret key may be increased.

The receiver device may facilitate increasing a length of a generated secret key and/or a distance over which a secret key is generated. For example, since the message indicating the first association information is encrypted and is unknown to any eavesdropper, therefore, the eavesdropper’s information on the symbols may be reduced, and thus, a higher key length or a longer distance may be achieved.

In a further implementation form of the third aspect, the Rx is further configured to send or receive an encrypted message to or from the Tx, over a classical communication channel, the encrypted message indicating first association information.

In a further implementation form of the third aspect, the Rx is further configured to receive a cryptographic key, encrypt a message with the cryptographic key, the message indicating first association information, and send the encrypted message to the Tx, over the classical communication channel.

In a further implementation form of the third aspect, the Rx is further configured to receive an encrypted message over the classical communication channel, the message indicating first association information, and decrypt the message with the cryptographic key, for obtaining first association information.

In an implementation form of the third aspect, the first association information indicates information to maintain the first receiver-side symbol. In a further implementation form of the third aspect, the first point is associated with a first parameter, and wherein the first association information comprises a radius of a predefined circle in the 2D phase space.

In a further implementation form of the third aspect, the including of the first receiver-side symbol to the first receiver-side sequence of symbols comprises determining, based on the first parameter and the first association information, whether a value of the first parameter is greater than a value of the radius of the predefined circle, and including the first receiver-side symbol to the first transmitter-side sequence of symbols, when it is determined that the value of the first parameter is greater than the value of the radius of the predefined circle.

In a further implementation form of the third aspect, the receiver device is further configured to determine the radius of the predefined circle based on a Signal-to-Noise Ratio (SNR) to a Bit Error Rate (BER) of the first receiver-side symbol.

In a further implementation form of the third aspect, the receiver device is further configured to generate a second receiver-side sequence of symbols, wherein the generating of the second receiver -side sequence of symbols comprises determining a second point in the 2D phase space by performing a further measurement on the optical mode, determining a second receiver-side symbol based on the second point, and including the second receiver-side symbol to the second receiver-side sequence of symbols based on second association information.

In a further implementation form of the third aspect, the second association information indicates information to discard the second receiver-side symbol.

In a further implementation form of the third aspect, the second point is associated with a second parameter, and wherein the second association information comprises the radius of the predefined circle in the 2D phase space.

In a further implementation form of the third aspect, the including of the second receiver-side symbol to the second receiver-side sequence of symbols comprises determining, based on the second parameter and the second association information, whether a value of the second parameter is smaller than the value of the radius of the predefined circle, and including the second receiver-side symbol to the second receiver-side sequence of symbols, when it is determined that the value of the second parameter is smaller than the value of the radius of the predefined circle.

In a further implementation form of the third aspect, the determining of the second receiverside symbol based on the second point comprise generating randomly the second receiver-side symbol.

In a further implementation form of the third aspect, the receiver device is further configured to cooperate with the Tx to compute a first error-free sequence of symbols based on information derived from a first transmitter-side sequence of symbols and information derived from the first receiver-side sequence of symbols, and cooperate with the Tx to generate a first secret key based on the first error-free sequence of symbols by performing a privacy amplification procedure.

For example, the information derived from the transmitter-side sequence of symbols may comprise soft information. Moreover, the information derived from the receiver-side sequence of symbols may comprise soft information.

For example, the Rx may determine the receiver-side sequence of symbols based on the receiver-side symbols. Moreover, the Rx may cooperate with the Tx to perform an information reconciliation procedure comprising computing the error-free sequence of symbols. For example, the error-free sequence of symbols may be computed based on information derived from the transmitter-side sequence of symbols, the soft information, information derived from the receiver-side sequence of symbols, and the soft information. Furthermore, the Rx may cooperate with Tx to perform a privacy amplification procedure and generating the secret key.

In a further implementation form of the third aspect, the receiver device is further configured to cooperate with the Tx to compute a second error-free sequence of symbols based on information derived from a second transmitter-side sequence of symbols and information derived from the second receiver-side sequence of symbols, and cooperate with the Tx to generate a second secret key based on the second error-free sequence of symbols by performing a privacy amplification procedure. A fourth aspect of the disclosure provides a QKD system, configured to perform the steps of the method first aspect or any of its implementation forms.

The QKD system of the fourth aspect achieves the advantages and effects described for the QKD method of the first aspect.

A fifth aspect of the disclosure provides a method of operating a transmitter device (Tx) in a Quantum Key Distribution (QKD) system, the Tx being connected to a receiver device (Rx) via an optical channel having an optical mode, the optical mode having a two-dimensional (2D) phase space, the method comprising driving the optical mode to a quantum coherent state in accordance with a probability distribution in the 2D phase space, the quantum coherent state having a maximum amplitude at or near a first point in the 2D phase space, determining a first transmitter-side symbol based on the first point, and including the first transmitter-side symbol to the first transmitter-side sequence of symbols based on first association information.

In a further implementation form of the fifth aspect, the method further comprises sending or receiving an encrypted message to or from the Rx, over a classical communication channel, the encrypted message indicating first association information.

In a further implementation form of the fifth aspect, the method further comprises receiving a cryptographic key, encrypting a message with the cryptographic key, the message indicating first association information, and sending the encrypted message to the Rx, over the classical communication channel.

In a further implementation form of the fifth aspect, the method further comprises receiving an encrypted message over the classical communication channel, the message indicating first association information, and decrypting the message with the cryptographic key, for obtaining first association information.

In an implementation form of the fifth aspect, the first association information indicates information to maintain the first transmitter-side symbol. In a further implementation form of the fifth aspect, the first point is associated with a first parameter, and wherein the first association information comprises a radius of a predefined circle in the 2D phase space.

In a further implementation form of the fifth aspect, the method further comprises determining, based on the first parameter and the first association information, whether a value of the first parameter is greater than a value of the radius of the predefined circle, and including the first transmitter-side symbol to the first transmitter-side sequence of symbols, when it is determined that the value of the first parameter is greater than the value of the radius of the predefined circle.

In a further implementation form of the fifth aspect, the method further comprises determining the radius of the predefined circle based on a Signal-to-Noise Ratio (SNR) to a Bit Error Rate (BER) of the first transmitter-side symbol.

In a further implementation form of the fifth aspect, the method further comprises generating a second transmitter-side sequence of symbols, wherein the generating of the second transmitterside sequence of symbols comprises driving the optical mode to a further quantum coherent state in accordance with a further probability distribution in the 2D phase space, the further quantum coherent state having a maximum amplitude at or near a second point in the 2D phase space, determining a second transmitter-side symbol based on the second point, and including the second transmitter-side symbol to the second transmitter-side sequence of symbols based on second association information.

In a further implementation form of the fifth aspect, the second point is associated with a second parameter, and wherein the second association information comprises the radius of the predefined circle in the 2D phase space.

In a further implementation form of the fifth aspect, the method further comprises determining, based on the second parameter and the second association information, whether a value of the second parameter is smaller than the value of the radius of the predefined circle, and including the second transmitter-side symbol to the second transmitter-side sequence of symbols, when it is determined that the value of the second parameter is smaller than the value of the radius of the predefined circle.

In a further implementation form of the fifth aspect, the method further comprises generating randomly the second transmitter-side symbol.

In a further implementation form of the fifth aspect, the method further comprises cooperating with the Rx to compute a first error-free sequence of symbols based on information derived from the first transmitter-side sequence of symbols and information derived from a first receiver-side sequence of symbols, and cooperating with the Rx to generate a first secret key based on the first error-free sequence of symbols by performing a privacy amplification procedure.

In a further implementation form of the fifth aspect, the method further comprises cooperating with the Rx to compute a second error-free sequence of symbols based on information derived from the second transmitter-side sequence of symbols and information derived from a second receiver-side sequence of symbols, and cooperating with the Rx to generate a second secret key based on the second error-free sequence of symbols by performing a privacy amplification procedure.

The method of the fifth aspect achieves the advantages and effects described for the transmitter device of the second aspect.

A sixth aspect of the disclosure provides a method of operating a receiver device (Rx) in a Quantum Key Distribution (QKD) system, the Rx being connected to a transmitter device (Tx) via an optical channel having an optical mode, the optical mode having a two-dimensional (2D) phase space, the method comprising determining a first point in the 2D phase space by performing a measurement on the optical mode, determining a first receiver-side symbol based on the first point, and including the first receiver-side symbol to the first receiver-side sequence of symbols based on first association information. In a further implementation form of the sixth aspect, the method further comprises sending or receiving an encrypted message to or from the Tx, over a classical communication channel, the encrypted message indicating first association information.

In a further implementation form of the sixth aspect, the method further comprises receiving a cryptographic key, encrypting a message with the cryptographic key, the message indicating first association information, and sending the encrypted message to the Tx, over the classical communication channel.

In a further implementation form of the sixth aspect, the method further comprises receiving an encrypted message over the classical communication channel, the message indicating first association information, and decrypting the message with the cryptographic key, for obtaining first association information.

In an implementation form of the sixth aspect, the first association information indicates information to maintain the first receiver-side symbol.

In a further implementation form of the sixth aspect, the first point is associated with a first parameter, and wherein the first association information comprises a radius of a predefined circle in the 2D phase space.

In a further implementation form of the sixth aspect, the method further comprises determining, based on the first parameter and the first association information, whether a value of the first parameter is greater than a value of the radius of the predefined circle, and including the first receiver-side symbol to the first transmitter-side sequence of symbols, when it is determined that the value of the first parameter is greater than the value of the radius of the predefined circle.

In a further implementation form of the sixth aspect, the method further comprises determining the radius of the predefined circle based on a Signal-to-Noise Ratio (SNR) to a Bit Error Rate (BER) of the first receiver -side symbol.

In a further implementation form of the sixth aspect, the method further comprises generating a second receiver-side sequence of symbols, wherein the generating of the second receiver - side sequence of symbols comprises determining a second point in the 2D phase space by performing a further measurement on the optical mode, determining a second receiver-side symbol based on the second point, and including the second receiver-side symbol to the second receiver-side sequence of symbols based on second association information.

In a further implementation form of the sixth aspect, the second association information indicates information to discard the second receiver-side symbol.

In a further implementation form of the sixth aspect, the second point is associated with a second parameter, and wherein the second association information comprises the radius of the predefined circle in the 2D phase space.

In a further implementation form of the sixth aspect, the method further comprises determining, based on the second parameter and the second association information, whether a value of the second parameter is smaller than the value of the radius of the predefined circle, and including the second receiver-side symbol to the second receiver-side sequence of symbols, when it is determined that the value of the second parameter is smaller than the value of the radius of the predefined circle.

In a further implementation form of the sixth aspect, the determining of the second receiverside symbol based on the second point comprise generating randomly the second receiver-side symbol.

In a further implementation form of the sixth aspect, the method further comprises cooperating with the Tx to compute a first error-free sequence of symbols based on information derived from a first transmitter-side sequence of symbols and information derived from the first receiver-side sequence of symbols, and cooperating with the Tx to generate a first secret key based on the first error-free sequence of symbols by performing a privacy amplification procedure.

In a further implementation form of the sixth aspect, the method further comprises cooperating with the Tx to compute a second error-free sequence of symbols based on information derived from a second transmitter-side sequence of symbols and information derived from the second receiver-side sequence of symbols, and cooperating with the Tx to generate a second secret key based on the second error-free sequence of symbols by performing a privacy amplification procedure.

The method of the sixth aspect achieves the advantages and effects described for the receiver device of the third aspect.

A seventh aspect of the present disclosure provides a computer program comprising a program code for performing one or more steps of the method according to the fifth aspect or sixth aspect or any of their implementation forms.

An eighth aspect of the present disclosure provides a non-transitory storage medium storing executable program code which, when executed by a processor, causes one or more steps of the method according to the fifth aspect or sixth aspect or any of their implementation forms to be performed.

It has to be noted that the devices, elements, units and means described in the present application could be implemented in software or hardware elements or any kind of combination thereof. The steps which are performed by the various entities described in the present application, as well as the functionalities described to be performed by the various entities, are intended to mean that the respective entity is adapted to or configured to perform the respective steps and functionalities. Even if, in the following description of specific embodiments, a specific functionality or step to be performed by external entities is not reflected in the description of a specific detailed element of that entity which performs that specific step or functionality, it should be clear for a skilled person that these methods and functionalities can be implemented in respective software or hardware elements, or any kind of combination thereof.

BRIEF DESCRIPTION OF DRAWINGS

The above described aspects and implementation forms will be explained in the following description of specific embodiments in relation to the enclosed drawings, in which

FIG. 1 depicts a flowchart of a QKD method for generating a first transmitter-side sequence of symbols and a first receiver-side sequence of symbols, according to an embodiment of the disclosure; FIG. 2 depicts a schematic view of a Tx for generating a first transmitter-side sequence of symbols, according to an embodiment of the disclosure;

FIG. 3 depicts a schematic view of an Rx for generating a first receiver-side sequence of symbols, according to an embodiment of the disclosure;

FIG. 4 depicts a schematic view of a QKD system for generating a first transmitter-side sequence of symbols and a first receiver-side sequence of symbols, according to an embodiment of the disclosure;

FIGs. 5 A and 5B depict diagrams illustrating an exemplary constellation of Tx signals in a 2D phase space (FIG. 5 A) and an exemplary received signal at the Rx according to a 2D phase space (FIG. 5B);

FIG. 6A depicts a diagram illustrating a radius of a circle in the 2D phase space at the Tx;

FIG. 6B depicts a diagram illustrating adding a first-receiver side symbol in a first receiver-side sequence of symbols based on the radius of the circle;

FIG. 7A depicts a diagram illustrating a radius of a circle in the 2D phase space at the Tx;

FIG. 7B depicts a diagram illustrating generating randomly a second receiver-side symbol;

FIG. 8A depicts a diagram illustrating an exemplary constellation of Tx signals in a 2D phase space;

FIG. 8B depicts a diagram illustrating determining first receiver-side sequence of symbols and a second receiver-side sequence of symbols;

FIG. 9 depicts a flowchart of a method for generating a first and a second transmitterside sequences of symbols and a first and a second receiver-side sequences of symbols;

FIG. 10 depicts a flowchart of a method of operating a Tx in a QKD system for generating a first transmitter-side sequences of symbols; and

FIG. 11 depicts a flowchart of a method of operating an Rx in a QKD system for generating a first receiver-side sequences of symbols.

DETAILED DESCRIPTION OF EMBODIMENTS

FIG. 1 shows a flowchart of a QKD method 100 for generating a first transmitter-side sequence of symbols and a first receiver-side sequence of symbols, according to an embodiment of the disclosure. The QKD method 100 may be a method of providing a QKD system 1 (such as the QKD system 1 of FIG. 4) and further operating the QKD system 1.

The QKD method 100 comprises a step 101 of providing a Tx 200 and an Rx 300 connected to each other via an optical channel 30 having an optical mode, the optical mode having a 2D phase space 500.

For example, the QKD method 100 may include providing a QKD system 1 comprising the Tx 200 and the Rx 300. The QKD system 1 may be a CV-QKD system or a DV-QKD system.

The QKD method 100 further comprises a step 102 of operating the Tx 200 and the Rx 300 to generate a first transmitter-side sequence of symbols 210 and a first receiver-side sequence of symbols 310.

Moreover, the operating 102 of the Tx 200 and the Rx 300 comprises a step 103 of providing a cryptographic key to the Tx 200 and a cryptographic key to the Rx 300, and a step 104 of operating the Tx 200 to drive the optical mode to a quantum coherent state in accordance with a probability distribution in the 2D phase space 500, the quantum coherent state having a maximum amplitude at or near a first point 511 in the 2D phase space 500, and a step 105 of operating the Tx 200 to determine a first transmitter-side symbol 201 based on the first point 511.

The operating 102 of the Tx 200 and the Rx 300 further comprises a step 106 of operating the Rx 300 to determine a second point 512 in the 2D phase space 500 by performing a measurement on the optical mode, and a step 107 of operating the Rx 300 to determine a first receiver-side symbol 301 based on the second point 512.

The operating 102 of the Tx 200 and the Rx 300 further comprises a step 108 of encrypting a message 21 with a provided cryptographic key, the message 21 indicating first association information, and a step 109 of sending the encrypted message 21 to at least one of the Rx 300 and the Tx 200 over a classical communication channel.

Furthermore, the operating 102 of the Tx 200 and the Rx 300 comprises a step 110 of receiving the encrypted message 21 over the classical communication channel 40, and a step 111 of decrypting the encrypted message 21 with a provided cryptographic key, for obtaining the first association information.

In addition, the operating 102 of the Tx 200 and the Rx 300 comprises a step 112 of operating the Tx 200 to include the first transmitter- si de symbol 201 to the first transmitter-side sequence of symbols 210 based on the first association information, and a step 113 of operating the Rx 300 to include the first receiver-side symbol 301 to the first receiver-side sequence of symbols 310 based on the first association information.

FIG. 2 shows a schematic view of a Tx 200 for generating a first transmitter-side sequence of symbols 210, according to an embodiment of the disclosure.

The Tx 200 is connectable to the Rx 300 via an optical channel 30 having an optical mode, the optical mode having a 2D phase space 500.

The Tx 200 is configured to drive the optical mode to a quantum coherent state in accordance with a probability distribution in the 2D phase space 500, the quantum coherent state having a maximum amplitude at or near a first point 511 in the 2D phase space 500.

The Tx 200 is further configured to determine a first transmitter-side symbol 201 based on the first point 511.

The Tx 200 is further configured to include the first transmitter-side symbol 201 to the first transmitter-side sequence of symbols 220 based on first association information.

In some embodiments, the Tx 200 may further determine a second transmitter-side symbol 202 based on the third point point 513, and include the second transmitter-side symbol 202 to the second transmitter-side sequence of symbols 220 based on second association information.

For instance, one or more cryptographic keys may be provided to the Tx 200. Furthermore, the Tx 200 may be configured to send or receive an encrypted message 21 to or from the Rx 300, over a classical communication channel 40. The encrypted message 21 may indicate first association information and second association information. Alice may use the provided public key for encrypting the message 21 and/or use the private key for decrypting the encrypted message 21.

The Tx 200 may comprise a circuitry and an optical unit. The circuitry may comprise hardware and software. The hardware may comprise analog or digital circuitry, or both analog and digital circuitry. In some embodiments, the circuitry comprises one or more processors and a nonvolatile memory connected to the one or more processors. The non-volatile memory may carry executable program code which, when executed by the one or more processors, causes the Tx 200 to perform the operations or one or more steps of the methods described herein. The optical unit of the Tx 200 may comprise a laser diode, a local oscillator, a coupler, a polarizer, an amplitude modulator, a pulse modulator, a photodiode, a polarization beam splitters, an attenuator, etc., as it is generally known.

FIG. 3 depicts a schematic view of an Rx 300 for generating a first receiver-side sequence of symbols 310, according to an embodiment of the disclosure.

The Rx 300 may operate in a QKD system 1. The Rx 300 is connectable to a Tx 200 via an optical channel 30 having an optical mode, the optical mode having a 2D phase space 500. The Rx 300 is configured to determine a first point 512 in the 2D phase space 500 by performing a measurement on the optical mode.

The Rx 300 is further configured to determine a first receiver-side symbol 301 based on the first point 512.

The Rx 300 is configured to determine a first point 512 in the 2D phase space by performing a measurement on the optical mode.

The Rx 300 is further configured to include the first receiver-side symbol 301 to the first receiver-side sequence of symbols 310 based on first association information.

In some embodiments, the Rx 300 may further determine a second receiver-side symbol 302 based on the fourth point, and include the second receiver-side symbol 302 to the second receiver-side sequence of symbols 320 based on second association information. For instance, one or more cryptographic keys may be provided to the Rx 300. Furthermore, the Rx 300 may be configured to send or receive an encrypted message 21 to or from the Tx 200, over a classical communication channel 40. The encrypted message 21 may indicate first association information and second association information. Bob may use provided public key for encrypting the message 21 and/or use the private key for decrypting the encrypted message 21.

The Rx 300 may comprise a circuitry and an optical unit. The circuitry may comprise hardware and software. The hardware may comprise analog or digital circuitry, or both analog and digital circuitry. In some embodiments, the circuitry comprises one or more processors and a nonvolatile memory connected to the one or more processors. The non-volatile memory may carry executable program code which, when executed by the one or more processors, causes the Rx 300 to perform the operations or one or more steps of the methods described herein. The optical unit of the Rx 300 may comprise a laser diode, a local oscillator, a coupler, a polarizer, an amplitude modulator, a pulse modulator, a photodiode, a polarization beam splitters, an attenuator, etc., as it is generally known.

FIG. 4 depicts a schematic view of a QKD system 1 for generating a first transmitter-side sequence of symbols 210 and a first receiver-side sequence of symbols 310, according to an embodiment of the disclosure.

The QKD system 1 may be a CV-QKD system or a DV-QKD system.

The Tx 200 and the Rx 300 are connectable to each other via an optical channel 30 having an optical mode, the optical mode having a 2D phase space 500.

The Rx 300 is configured to determine a second point 512 in the 2D phase space by performing a measurement on the optical mode. The Tx 200 is further configured to determine a first transmitter-side symbol 201 based on the first point 511.

The Rx 300 is further configured to determine a first receiver-side symbol 301 based on the second point 512.

In some embodiments, the Tx 200 may further determine a second transmitter-side symbol 202 based on the third point point 513, and include the second transmitter-side symbol 202 to the second transmitter-side sequence of symbols 220 based on second association information. Moreover, in some embodiments, the Rx 300 may further determine a second receiver-side symbol 302 based on fourth point, and include the second receiver-side symbol 302 to the second receiver-side sequence of symbols 320 based on second association information.

For instance, one or more cryptographic keys may be provided to the Tx 200 and the Rx 300. Furthermore, the Tx 200 and the Rx 300 may be configured to exchange (e.g., send or receive) an encrypted message 21 over the classical communication channel 40. The encrypted message 21 may indicate first association information and second association information. Alice and Bob may use the provided cryptographic keys to encrypt the message 21 and/or to decrypt the message 21. Furthermore, Alice and Bob may obtain first association information, second association information, etc., and may further determine their corresponding sequences of symbols.

FIG. 5A depict a diagram illustrating an exemplary constellation of Tx signals in a 2D phase space 500.

The constellation of transmitted signals is exemplary shown the 2D phase space 500. The signals may be randomly distributed in the 2D phase space 500. For example the signals may be distributed such that a circularly symmetric Gaussian distribution with mean zero is obtained. The distribution may have a specific variance similar to a normal Gaussian distribution of a CV-QKD system.

Alice selects one of the points in the 2D phase space, for each transmission slot in the quantum state transmission step, and transmit the signal to Bob over the optical channel 30. In practice, each of the signals may be precisely determined, however, in the 2D phase space 500 of FIG. 5, the signals are illustrated having a form of circle merely for illustration purpose.

The circle 514 having a radius of r is exemplary shown to indicate a threshold for classifying whether a selected signal point is inside or outside the circle. For example, the first point 511 is a point that is outside the circle and its transmitted signal has a higher intensity. Moreover, the third point 513 is a point that is inside the circle 514 and its transmitted signal has a lower intensity.

FIG. 5B shows an exemplary received signal at the Rx 300 according to a 2D phase space. For example, Bob may use a coherent receiver to detect the second point 512. The signal suffers from the shot noise (and may suffer additionally from other technical noises which is not shown in FIG. 5B). Furthermore, due to the different noises, the signal is illustrated in a form of a circle representing a probability distribution of the second point 512 in the 2D phase space 500.

In some embodiments, each point may be associated with a parameter. For example, the parameter may be information that the signal is inside the circle 514 or outside the circle 514.

An example of an associated parameter is i in which

is the signal number and it may be unknown to Eve (for example, i may be kept secret from Eve). For instance, Alice and Bob may exchange the encrypted message indicating first association information so that Eve does not know the i).

Bob may detect the incoming signal independent of their parameter i. Since, this example is a coherent detection, the detected signal point can be anywhere in the 2D phase space 500 for any coherent- state signal transmitted by Alice. However, some detected signal points in the 2D phase space are more likely to occur than the others. After that Bob has detected a block of signals transmitted by Alice, Bob may notify Alice. Further, Alice may use the cryptographic key provided to her for encrypting the message 21. For example, Alice may add the associated parameter i for each signal

Alice may send the encrypted message 21 indicating the associated parameter i for all of the signals, over the classical communication channel. Therefore, Eve may not know the associated parameter i of the signals.

Alice and Bob may generate two respective sequences of symbols, depending on whether Alice’s signal is inside or outside the threshold. For example, Alice may generate the first transmitter-side sequence of symbols 210 for the signals that are outside the circle, and may further generate the second transmitter-side sequence of symbols 220 for the signals that are inside the circle. Moreover, Bob may generate the first receiver-side sequence of symbols 310 for the signals that are outside the circle, and may further generate the second receiver-side sequence of symbols 320 for the signals that are inside the circle.

Alice and Bob may further continue with the information reconciliation on each of the two groups of signals. Note that the inner signal group has a lower SNR than the outer signal group, and therefore, Alice and Bob may utilize different error correcting schemes that are more suitable to each group.

Alice may cooperate with the Bob to compute a first error-free sequence of symbols based on information derived from the first transmitter-side sequence of symbols 210 and information derived from a first receiver-side sequence of symbols 310. In addition, Alice may cooperate with Bob to compute a second error-free sequence of symbols based on information derived from the second transmitter-side sequence of symbols 220 and information derived from a second receiver-side sequence of symbols 320.

Note that, the information communicated over the classical communication channel may not reveal information about whether a signal is inside or outside the circle (i.e. i). In some embodiments, this may further be done by encrypting the error correction information (usually the syndromes) transmitted by Bob for the first and the second sequences of symbols. In some embodiments, this encryption may be done with QKD secret keys generated in a previous round of measurement. In some embodiments, this encryption may be done with cryptographic keys generated with non-QKD methods such as the Diffie-Hellman key exchange. In addition, Alice may cooperate with Bob to generate a first secret key based on the first error- free sequence of symbols by performing a privacy amplification procedure. Furthermore, Alice may cooperate with Bob to generate a second secret key based on the second error-free sequence of symbols by performing a privacy amplification procedure.

For example, for the privacy amplification, Alice and Bob may calculate Eve’s information on Bob’s data and by using the quantum states corresponding to the two sequences of signals and consider Eve’s information that Eve does not know i. This is Eve’s information over all signals and it is the amount reduced by privacy amplification from the original number of signals including both groups.

Note that, since the signals in the first and the second sequences are different, Eve’s information about them would be different if Eve would know about the association information, or the parameter (i.e., i). However, since Eve does not know about the association information, some kind of averaging effect is manifested and her information about the two groups of signals can be regarded to be the same.

Generally, Eve’s information is often lower in the case that Eve does not know about this association information compared to the case in which there is only sequence of symbol and Eve knows it. Therefore, with such a lower information of Eve and the group-specific error correction, the overall key length can be increased. Another benefit of determining the first and the second sequences of symbols is that a higher key rates (or key lengths) can be generated and higher reach can be supported.

FIG. 6A shows a diagram illustrating a radius of a circle in the 2D phase space at the Tx 200, and FIG. 6B shows a diagram illustrating adding a first-receiver side symbol 301 in a first receiver-side sequence of symbols 310 based on the radius of the circle. As discussed, the points that are selected to be inside the circle may have a lower intensity than the points that are outside the circle.

Alice may select the first point 511 that is outside the circle and transmit the quantum coherent state corresponding to the first point 511 to Bob over the quantum channel. Bob uses the coherent receiver 601 and may detect the second point 512. Bob may further determine the first receiver-side symbol 301 based on the second point 512. Moreover, Alice may send the encrypted message 21 indicating the i for the first point 511 which mentions that the first point 511 is outside the radius of the circle 514. Bob may further add the determined first receiverside symbol 301 to the first receiver-side sequence of symbols based on the i and its relation with the radius of the circle.

FIG. 7A depicts a diagram illustrating a radius of a circle in the 2D phase space at the Tx 200 and FIG. 7B depicts a diagram illustrating generating randomly a second receiver-side symbol 302.

In FIG. 7A the area inside the circle is dashed in order to emphasize that the selected point is the second point 512 which is located inside the circle.

Alice may select the second point 512 that is inside the circle and may further transmit the quantum coherent state corresponding to the second point 512 to Bob over the quantum channel 30. As discussed, the points that are selected to be inside the circle may have a lower intensity than the points that are outside the circle. Bob uses the coherent receiver and detects a low intensity signal. Moreover, Alice may send the encrypted message 21 indicating the i for the second point 512. The i for the second point 512 indicates that the second point 512 is inside the radius of the circle 514. Bob uses the cryptographic key provided to him and decrypts the message 21 and may further obtain the second association information. Furthermore, Bob discard the measured signal and uses the randomness generator 701 and randomly generate the second receiver-side symbol.

Bob may further add the second receiver-side symbol 302 (which is a randomly generated symbol) to the second receiver-side sequence of symbols 320.

FIG. 8A shows a diagram illustrating an exemplary constellation of Tx signals in a 2D phase space 500 and FIG. 8B depicts a diagram illustrating determining first receiver-side sequence of symbols 310 and generating a second receiver-side sequence of symbols 320.

The first and the second sequences of symbols may also be generated based on a choice of Bob for each signal he receives. For example, Alice may transmit a plurality of signals according to the 2D phase space 500 of FIG. 8A. Moreover, Bob may use the coherent receiver 601 for detecting the signals. Bob may also use the randomness generator 701 for randomly generating the second receiver-side symbols.

Bob may randomly assigns a group label (i.e., association information) to each signal. If the signal is in group 1, the detected information of the signal will be kept and will be used later in the post-processing. For example, Bob may keep the first receiver-side symbol 301 having association information of group 1. Therefore, Bob may include the first receiver-side symbols 301 that has the first association information of “group 1” to the first receiver-side sequence of symbols 310.

If it is in group 2, Bob randomly generates some data to be used later during the post-processing procedure. Furthermore, Bob discards the measured signal, uses the randomness generator 701 and randomly generates the second receiver-side symbol 302. During the information reconciliation step, Bob passes this completely random raw key to Alice. Moreover, when computing the amount of reduction for the privacy amplification, Bob and Alice may take into account Eve’s knowledge about the first sequence of symbols 310 and the second sequence of symbols 320.

FIG. 9 depicts a flowchart of a method 900 for generating a first and a second transmitter-side sequences of symbols 210, 220 and a first and a second receiver-side sequences of symbols 310, 320.

At 910, Alice operates the Tx 200, for example, Alice uses the random number generator 911 to generate corresponding quantum states. Alice further transmits the quantum states to Bob over the optical channel 30. For example, Alice uses the random number generator 911 and generates a plurality of M random numbers of o=( oi, 02, . . . , XOM). Alice further uses the plurality of M random numbers and generates M corresponding quantum states including i, P2, ... , PM.

At 920, Bob may perform measurements on the optical mode and may determine the points in the 2D phase space 500. Bob may measure M points in the 2D phase space quantum states including o=(yoi, jo2, ... , JOM). At 912 Alice may perform a QKD post processing, and at 930 Bob may perform a QKD post processing. For example, Alice performs a random sampling procedure and randomly obtains M-n number of samples having selected p values such as pi, p2, ... , pM-n.

At 913, Alice may perform a random sampling, for example, Alice may determine the position of each point in the 2D phase space 500 and may further determine the values for each point. For example, Alice obtains a selected p value and a selected x value for each sample from the M-n samples, and obtains (pi, x_pi), . . . , (pM-n, XpM-n).

At 914, Alice may extract the values for each point.

At 931, Bob may perform a parameter estimation step, as it is generally known. Moreover, Bob may estimate BER, loss, and noise for the receiver-side symbols 301, 302.

At 915, Alice may determine the first transmitter-side sequence of symbols 210 and the second transmitter-side sequence of symbols 220. Moreover, Alice may encrypt a message indicating first and second association information. Furthermore, Alice may send the encrypted message 21 to Bob over the classical communication channel 40. For example, Alice determines the i=(xn, xn, ... , XIM) as the first transmitter-side sequence of symbols 210. Moreover, Alice determines the X2=(x2i, X22, . . . , X2n) as the second transmitter-side sequence of symbols 220.

At 932, Bob may determine the first receiver-side sequence of symbols 310 and the second receiver-side sequence of symbols 320. For example, Bob may receive the encrypted message, decrypt the encrypted message and obtain the first and second association information. Moreover, Bob determines the yi=(yn, y , , JIM) as the first receiver-side sequence of symbols 310. Moreover, Bob determines the 2=( 2i, J22, ... , J’2n) as the second receiver-side sequence of symbols 320.

The step 915 and 932 may represent including of different symbols to their corresponding sequences.

At 916, Alice may perform a bit mapping operation on the first and second transmitter side sequences of symbols 210, 220 and may obtain X3=(xsi, X32, ... , X3n). At 932, Bob may perform a bit mapping operation on the first and second receiver-side sequences of symbols 310, 320 and may obtain 3=(y3i, 32, , 3n).

At 917, Alice may perform an information reconciliation procedure and at 932, Bob may perform an information reconciliation procedure. For example, Alice and Bob may use a reverse information reconciliation scheme and may obtain identical symbols of 4=(y4i, 42, ... , 4n).

At 918 and 935, Alice and Bob may cooperate and may perform a privacy amplification procedure.

For example the first and the second association information, the statistics (such as those of the loss and noise) collected in the parameter estimation step, may be supplied to other steps (such as bit mapping, information reconciliation and privacy amplification) for sequence-specific operations. As mentioned above, when Alice and Bob know about the association information, while Eve does not, a longer key length may be generated. Note that even though an indication of the supply of the association information and the statistics are shown for the receiver Bob, the same can be supplied for the transmitter Alice. Note that the order of the steps might be changed. For example, the grouping step might precede the parameter estimation step.

At 919, and at 936, Alice and Bob may cooperate and may further generate a first secret key and a second secret key. An example of an obtained secret key is 5=(^5i, ^52, ... , fek).

In some embodiments, for the signals that are outside the circle, Bob may perform a usual detection and data usage procedure. Bob may use a coherent receiver 601 to generate Bob’s data from the incoming quantum signals. Further, for the signals that are inside the circle, Bob may disregard the incoming quantum signals (in practice they are anyway detected but the detection results are dropped) and generate data using a random number generator 701. Essentially, a fresh raw key is generated by Bob for this group. In the information reconciliation step, Alice and Bob may perform a fake error correction for this group in which Bob may simply inform Alice the raw key. This classical information exchange is encrypted as described before.

In some embodiments, when computing the amount of reduction for privacy amplification, Alice and Bob may take into account the information leaked to Eve’s the first sequence of symbols and the second sequence of symbols. For example, for the second sequence of symbols, because Bob randomly generates his data, Eve’s states corresponding to any of Bob’s raw key value are identical. Using these states, Alice and Bob may compute the average states of Eve for the two sequences of symbols. Note that, Eve’s information about Bob’s data is considered, since reverse reconciliation is assumed in which the key is derived from Bob’s data. In general, Eve’s information is often smaller and because of this and the group-specific error correction by Alice and Bob, a longer key may be generated.

FIG. 10 depicts a flowchart of a method of operating a Tx 200 in a QKD system 1 for generating a first transmitter- side sequences of symbols 210. The Tx 200 is connected to an Rx 300 via an optical channel 30 having an optical mode, the optical mode having a 2D phase space 500.

The method 1000 comprises a step 1001 of driving the optical mode to a quantum coherent state in accordance with a probability distribution in the 2D phase space 500, the quantum coherent state having a maximum amplitude at or near a first point 511 in the 2D phase space 500.

The method 1000 further comprises a step 1002 of determining a first transmitter-side symbol 201 based on the first point 511.

The method 1000 further comprises a step 1003 of including the first transmitter-side symbol 201 to the first transmitter-side sequence of symbols 210 based on first association information.

FIG. 11 depicts a flowchart of a method 1100 of operating an Rx 300 in a QKD system 1 for generating a first receiver-side sequences of symbols 310. The Rx 300 is connected to a Tx 200 via an optical channel 30 having an optical mode, the optical mode having a 2D phase space 500.

The method 1100 comprises a step 1101 of determining 1101 a first point 512 in the 2D phase space 500 by performing a measurement on the optical mode.

The method 1100 further comprises a step 1102 of determining a first receiver-side symbol 301 based on the first point 512. The method 1100 further comprises a step 1103 of including the first receiver-side symbol 301 to the first receiver-side sequence of symbols 310 based on first association information.

The present disclosure has been described in conjunction with various embodiments as examples as well as implementations. However, other variations can be understood and effected by those persons skilled in the art and practicing the claimed disclosure, from the studies of the drawings, this disclosure and the independent claims. In the claims, as well as in the description, the word “comprising” does not exclude other elements or steps and the indefinite article “a” or “an” does not exclude a plurality. A single element or other unit may fulfill the functions of several entities or items recited in the claims. The mere fact that certain measures are recited in the mutual different dependent claims does not indicate that a combination of these measures cannot be used in an advantageous implementation.

Claims

1. A Quantum Key Distribution, QKD, method (100, 800) that comprises: providing (101) a transmitter device, Tx, (200) and a receiver device, Rx, (300) connected to each other via an optical channel (30) having an optical mode, the optical mode having a two-dimensional, 2D, phase space (500); and operating (102) the Tx (200) and the Rx (300) to generate a first transmitter-side sequence of symbols (210) and a first receiver-side sequence of symbols (310); wherein the operating (102) of the Tx (200) and the Rx (300) comprises: providing (103) a cryptographic key to the Tx (200) and a cryptographic key to the Rx (300); operating (104) the Tx (200) to drive the optical mode to a quantum coherent state in accordance with a probability distribution in the 2D phase space (500), the quantum coherent state having a maximum amplitude at or near a first point (51 Qin the 2D phase space (500); operating (105) the Tx (200) to determine a first transmitter-side symbol (201) based on the first point (511); operating (106) the Rx (300) to determine a second point (512) in the 2D phase space (500) by performing a measurement on the optical mode; operating (107) the Rx (300) to determine a first receiver-side symbol (301) based on the second point (512); encrypting (108) a message with a provided cryptographic key, the message (21) indicating first association information; sending (109) the encrypted message (21) to at least one of the Rx (300) and the Tx (200) over a classical communication channel; receiving (110) the encrypted message (21) over the classical communication channel (40); decrypting (111) the encrypted message (21) with a provided cryptographic key, for obtaining the first association information; operating (112) the Tx (200) to include the first transmitter-side symbol (201) to the first transmitter-side sequence of symbols (210) based on the first association information; and operating (113) the Rx (300) to include the first receiver-side symbol (301) to the first receiver-side sequence of symbols (310) based on the first association information.

2. The QKD method (100, 800) of claim 1, wherein the message (21) further indicates second association information, and wherein the method (100, 800) further comprises: operating the Tx (200) and the Rx (300) to generate a second transmitter-side sequence of symbols (220) and a second receiver-side sequence of symbols (320), wherein: the operating of the Tx (200) and the Rx (300) to generate the second transmitter-side sequence of symbols (220) and the second receiver-side sequence of symbols (320) comprises: operating the Tx (200) to drive the optical mode to a further quantum coherent state in accordance with a further probability distribution in the 2D phase space (500), the further quantum coherent state having a maximum amplitude at or near a third point (513) in the 2D phase space (500); operating the Tx (200) to determine a second transmitter-side symbol (202) based on the third point (513); operating the Rx (300) to determine a fourth point in the 2D phase space (500) by performing a further measurement on the optical mode; operating the Rx (300)to determine a second receiver-side symbol (302) based on the fourth point; operating the Tx (200) to include the second transmitter-side symbol (202) to the second transmitter-side sequence of symbols (220) based on the second association information; and operating the Rx (300) to include the second receiver-side symbol (302) to the second receiver-side sequence of symbols (320) based on the second association information.

3. The QKD method (100, 800) of claim 1 or 2, wherein: the operating of the Tx (200) to determine the second transmitter-side symbol (202) based on the third point (513) comprise generating randomly the second transmitter-side symbol (202), and/or the operating of the Rx (300) to determine the second receiver-side symbol (302) based on the fourth point comprises generating randomly the second receiver-side symbol (320).

4. A transmitter device, Tx, (200) for operating in a Quantum Key Distribution, QKD, system (1), the Tx (200) being connectable to a receiver device, Rx, (300) via an optical channel (30) having an optical mode, the optical mode having a two-dimensional, 2D, phase space (500), the Tx (200) being configured to: drive the optical mode to a quantum coherent state in accordance with a probability distribution in the 2D phase space (500), the quantum coherent state having a maximum amplitude at or near a first point (511) in the 2D phase space (500); determine a first transmitter-side symbol (201) based on the first point (511); and include the first transmitter-side symbol (201) to the first transmitter-side sequence of symbols (210) based on first association information.

5. The transmitter device (200) of claim 4, wherein: the first association information indicates information to maintain the first transmitterside symbol (201).

6 The transmitter device (200) of claim 4, wherein: the first point (511) is associated with a first parameter, and wherein the first association information comprises a radius of a predefined circle (514) in the 2D phase space (500).

7. The transmitter device (200) of claim 6, wherein: the including of the first transmitter-side symbol (201) to the first transmitter-side sequence of symbols (210) comprises: determining, based on the first parameter and the first association information, whether a value of the first parameter is greater than a value of the radius of the predefined circle (514), and including the first transmitter-side symbol (201) to the first transmitter-side sequence of symbols (210), when it is determined that the value of the first parameter is greater than the value of the radius of the predefined circle (514).

8. The transmitter device (200) of claim 6 or 7, further configured to: determine the radius of the predefined circle (514) based on a Signal-to-Noise Ratio, SNR, to a Bit Error Rate, BER, of the first transmitter-side symbol (201).

9. The transmitter device (200) of any one of claims 4 to 8, further configured to: generate a second transmitter-side sequence of symbols (220), wherein: the generating of the second transmitter-side sequence of symbols (220) comprises: driving the optical mode to a further quantum coherent state in accordance with a further probability distribution in the 2D phase space (500), the further quantum coherent state having a maximum amplitude at or near a second point (513) in the 2D phase space (500); determining a second transmitter-side symbol (202) based on the second point (512); and including the second transmitter-side symbol (202) to the second transmitter-side sequence of symbols (220) based on second association information.

10. The transmitter device (200) of claim 9, wherein: the second association information indicates information to discard the second transmitter-side symbol (202).

11. The transmitter device (200) of claim 9, wherein: the second point (512) is associated with a second parameter, and wherein the second association information comprises the radius of the predefined circle (514) in the 2D phase space (500).

12. The transmitter device (200) of claim 11, wherein: the including of the second transmitter-side symbol (202) to the second transmitter-side sequence of symbols (220) comprises: determining, based on the second parameter and the second association information, whether a value of the second parameter is smaller than the value of the radius of the predefined circle (514), and including the second transmitter-side symbol (202) to the second transmitter-side sequence of symbols (220), when it is determined that the value of the second parameter is smaller than the value of the radius of the predefined circle (514).

13. The transmitter device (200) of any one of claims 9 to 12, wherein: the determining of the second transmitter-side symbol (202) based on the second point (513) comprises generating randomly the second transmitter-side symbol (202).

14. The transmitter device (200) of any one of claims 4 to 13, further configured to: cooperate with the Rx (300) to compute a first error-free sequence of symbols based on information derived from the first transmitter-side sequence of symbols (210) and information derived from a first receiver-side sequence of symbols (310); and cooperate with the Rx (300) to generate a first secret key based on the first error-free sequence of symbols by performing a privacy amplification procedure.

15. The transmitter device (200) of any one of claims 9 to 14, further configured to: cooperate with the Rx (300) to compute a second error-free sequence of symbols based on information derived from the second transmitter-side sequence of symbols (220) and information derived from a second receiver-side sequence of symbols (320); and cooperate with the Rx (300) to generate a second secret key based on the second error- free sequence of symbols by performing a privacy amplification procedure.

16. A receiver device, Rx, (300) for operating in a Quantum Key Distribution, QKD, system, (1) the Rx (300) being connectable to a transmitter device, Tx, (200) via an optical channel (30) having an optical mode, the optical mode having a two-dimensional, 2D, phase space (500), the Rx (300) being configured to: determine a first point (512) in the 2D phase space (500) by performing a measurement on the optical mode; determine a first receiver-side symbol (301) based on the first point (512); and include the first receiver-side symbol (301) to the first receiver-side sequence of symbols (310) based on first association information.

17. The receiver device (300) of claim 16, wherein: the first association information indicates information to maintain the first receiver-side symbol (301).

18. The receiver device (300) of claim 16, wherein: the first point (301) is associated with a first parameter, and wherein the first association information comprises a radius of a predefined circle (514) in the 2D phase space (500).

19. The receiver device (300) of claim 18, wherein: the including of the first receiver-side symbol (301) to the first receiver-side sequence of symbols (310) comprises: determining, based on the first parameter and the first association information, whether a value of the first parameter is greater than a value of the radius of the predefined circle, and including the first receiver-side symbol (301) to the first transmitter-side sequence of symbols (310), when it is determined that the value of the first parameter is greater than the value of the radius of the predefined circle (514).

20. The receiver device (300) of claim 18 or 19, further configured to: determine the radius of the predefined circle (514) based on a Signal-to-Noise Ratio, SNR, to a Bit Error Rate, BER, of the first receiver -side symbol.

21. The receiver device (300) of any one of claims 16 to 20, further configured to: generate a second receiver-side sequence of symbols (320), wherein: the generating of the second receiver -side sequence of symbols (320) comprises: determining a second point in the 2D phase space (500) by performing a further measurement on the optical mode; determining a second receiver-side symbol (302) based on the second point; and including the second receiver-side symbol (302) to the second receiver-side sequence of symbols (320) based on second association information.

22. The receiver device (300) of claim 21, wherein: the second association information indicates information to discard the second receiverside symbol.

23. The receiver device (300) of claim 21, wherein: the second point is associated with a second parameter, and wherein the second association information comprises the radius of the predefined circle in the 2D phase space (500).

24. The receiver device (300) of claim 23, wherein: the including of the second receiver-side symbol (302) to the second receiver-side sequence of symbols (320) comprises: determining, based on the second parameter and the second association information, whether a value of the second parameter is smaller than the value of the radius of the predefined circle, and including the second receiver-side symbol (302) to the second receiver-side sequence of symbols (320), when it is determined that the value of the second parameter is smaller than the value of the radius of the predefined circle.

25. The receiver device (300) of any one of claims 21 to 24, wherein: the determining of the second receiver-side symbol (302) based on the second point comprise generating randomly the second receiver-side symbol (302).

26. The receiver device (300) of any one of claims 16 to 25, further configured to: cooperate with the Tx (200) to compute a first error-free sequence of symbols based on information derived from a first transmitter-side sequence of symbols (210) and information derived from the first receiver-side sequence of symbols (310); and cooperate with the Tx (200) to generate a first secret key based on the first error-free sequence of symbols by performing a privacy amplification procedure.

27. The receiver device (300) of any one of claims 21 to 26, further configured to: cooperate with the Tx (200) to compute a second error-free sequence of symbols based on information derived from a second transmitter-side sequence of symbols (220) and information derived from the second receiver-side sequence of symbols (320); and cooperate with the Tx (200) to generate a second secret key based on the second error- free sequence of symbols by performing a privacy amplification procedure.

28. A Quantum Key Distribution, QKD, system, (1) configured to perform the steps of the method of any one of claims 1 to 3.

29. A method (1000) of operating a transmitter device, Tx, (200) in a Quantum Key Distribution, QKD, system (1), the Tx (200) being connected to a receiver device, Rx, (300) via an optical channel (30) having an optical mode, the optical mode having a two-dimensional, 2D, phase space (500), the method (1000) comprising: driving (1001) the optical mode to a quantum coherent state in accordance with a probability distribution in the 2D phase space (500), the quantum coherent state having a maximum amplitude at or near a first point (511) in the 2D phase space (500); determining (1002) a first transmitter-side symbol (201) based on the first point (511); and including (1003) the first transmitter-side symbol (201) to the first transmitter-side sequence of symbols (210) based on first association information.

30. A method (1100) of operating a receiver device, Rx, (300) in a Quantum Key Distribution, QKD, system (1), the Rx (300) being connected to a transmitter device, Tx, (200) via an optical channel (30) having an optical mode, the optical mode having a two-dimensional, 2D, phase space (500), the method (1100) comprising: determining (1101) a first point (512) in the 2D phase space (500) by performing a measurement on the optical mode; determining (1102) a first receiver-side symbol (301) based on the first point (512); and including (1103) the first receiver-side symbol (301) to the first receiver-side sequence of symbols (310) based on first association information.

31. A computer program comprising instructions, which, when the program is executed by a computer, cause the computer to carry out the steps of the method (1000, 1100) of claim 29 or 30.