Analysis of quantum key distribution based on unified model of sequential state discrimination strategy

Abstract

The quantum key distribution for multiparty is one of the essential subjects of study. Especially, without using entangled states, performing the quantum key distribution for multiparty is a critical area of research. For this purpose, sequential state discrimination, which provides multiparty quantum communication and quantum key distribution for multiple receivers, has recently been introduced. Moreover, the sequential state discrimination is applicable for the security analysis against an eavesdropper’s attack. In this work, we provide the security analysis of quantum key distribution by proposing a unified model of sequential state discrimination including an eavesdropper. In this model, the success probability of eavesdropping is used as a figure of merit for the security analysis. Moreover, we obtain a non-zero secret key rate between the sender and receiver, which implies that the sender and receiver can share a secret key despite the eavesdropper’s scheme that optimizing the success probability of eavesdropping. Further, we propose an experimental methodology for the proposed model, which is implementable with linear optics. We observe that the secret key between the sender and receiver can be non-zero, even with imperfections.

Introduction

Quantum physics restricts perfect detection of a physical system’s state, which contradicts the argument of classical physics^1–4. This fact takes a major role of quantum state discrimination in quantum information processing. According to the optimal strategy of the quantum state discrimination required in terms of the figure of merit, there exist well-known strategies such as minimum error discrimination^5–14, unambiguous discrimination^15–23, maximal confidence²⁴, and a fixed rate of inconclusive results^25–33, which can be applied to two-party quantum communication.

There can be many receivers in quantum communication, and the strategy of the quantum state discrimination between two parties needs to be extended to multiple parties. In 2013, Bergou et al.³⁴ proposed sequential state discrimination in which many parties can participate as receivers. The sequential state discrimination is process in which the post-measurement state of a receiver is passed to the next receiver. The fact that the probability for every receiver to succeed in discriminating the given quantum states is nonzero implies that all these receivers can obtain the information of the quantum state of the sender, from the post-measurement state of the preceding receiver^35–40. It was shown that sequential state discrimination can provide multiparty B92 protocol⁴¹, which was implemented using quantum optical experiment^42,43. this gives us that the sequential state discrimination can be exploited to construct a general quantum key distribution scenario and to analyze the security thereof.

Figure 1.

Type-I structure of Eve’s scheme for eavesdropping Bob’s measurement result. In this scheme, Eve uses a quantum machine that deterministically transforms Alice’s state $|{\psi }_a⟩$ to a composite system $|{\mathrm{\Gamma }}_a⟩$ written in Eq. (3) such that ${\text{Tr}}_E\left(|,{\mathrm{\Gamma }}_a,⟩⟨,{\mathrm{\Gamma }}_a,|\right)$ $={\mathrm{\Lambda }}^{(A\to B)}(|{\psi }_a⟩⟨{\psi }_a|)$. Then, she measures her subsystem to obtain information about Bob’s measurement result. If Eve is unnoticed by Alice and Bob, then the quantum channel between Alice and Bob is described as a depolarizing channel ${\mathrm{\Lambda }}^{(A\to B)}$ in Eq. (2)

When sequential state discrimination is performed, one can assume that an eavesdropper may exist. Suppose that Alice and Bob performs quantum communication and Eve tries to eavesdrop messages between them. The eavesdropper can have two ways for eavesdropping. The first situation is the case where Eve tries to eavesdrop on Alice’s quantum state, which was analyzed in⁴⁰. The second situation is where Eve tries to eavesdrop on the result of Bob. Even though the second situation as well as the first one is a major threat to secure communication, the security analysis to this case has not been done yet. We further note that lots of prepare-and-measure QKD scenarios have been proposed by numerous researchers^44–48, which includes not only high-dimensional DV-QKD protocols⁴⁹ but also CV-QKD ones^50,51, and the concern about the threat is reasonable in these scenarios. The prepare-and-measure QKD scenarios are considered to be practical since it does not require an entanglement between a sender and a receiver such as E92 and BBM92 protocols^52,53.

In this paper, we focus on the second case, in which an intruder tries to eavesdrop on the result of a receiver. We provide a systematic security analysis from a unified model of sequential state discrimination including an eavesdropper. In this proposed model, the success probability of eavesdropping and the secret key rate⁵⁴ can be considered as a figure of merit for the security analysis. Specifically, the figure of merit for Eve is the success probability of eavesdropping, but the figure of merit for Alice and Bob is the secret key rate. Our study shows that although Eve performs an optimal measurement for the success probability of eavesdropping, the secret key rate between Alice and Bob is not zero.

In addition, we propose an experimental scheme that implements a new sequential state discrimination method composed of Alice–Eve–Bob. This scheme consists of a linear optical system similar to a Sagnac interferometer^42,55. The experimental setup can realize optimal success probability of eavesdropping for Eve, as well as non-zero secret key rate between Alice and Bob against the Eve. In other words, the protection of quantum communication between two receiters against an eavesdropper’s optimal scheme is possible with experimentally feasible setup. Further, we provide the success probability of eavesdropping and the secret key rate, considering the imperfections that can occur in the source, channel, and detector. White noise and colored noise are considered imperfections of the source⁵⁶. The dark count rate and detection efficiency are considered imperfections of the detector⁵⁷. We further propose that, despite these imperfections, the non-zero secret key rate between Alice and Bob is possible.

Results

Eavesdropper’s strategies

For an intruder, there are two ways of eavesdropping. The first is to eavesdrop on the quantum state of sender Alice and the other is to eavesdrop on the result of receiver Bob. When the intruder Eve, eavesdrops on the quantum state of sender Alice, she can do it using unambiguous discrimination, without an error. However, from the argument of sequential state discrimination, this process can be observed by Alice and Bob⁴⁰. Therefore, the sender and receiver can recognize the presence of an eavesdropper.

When Eve wants to eavesdrop on the result of receiver Bob, she should be in a quantum entangled state with Bob. Assuming that the existence of an eavesdropper is unnoticed, the eavesdropping can be described as a noisy quantum channel to of Alice and Bob as Fig. 1a. When Alice prepares $|{\psi }_a⟩$ ($a\in \{0,1\}$)

$$\begin{array}{c}\hfill |{\psi }_a⟩=\sqrt{\frac{1+s}{2}}|1⟩+{(-1)}^a\sqrt{\frac{1-s}{2}}|2⟩,\end{array}$$ 1

with prior probability $q_a$, the noisy quantum channel between Alice and Bob can be described as follows:

$$\begin{array}{c}\hfill {\mathrm{\Lambda }}^{(A\to B)}(|{\psi }_a⟩{⟨{\psi }_a|)}_A={\eta }_{\mathit{AB}}|{\psi }_a⟩⟨{\psi }_a{|}_B+(1-{\eta }_{\mathit{AB}})\frac{{\mathbb{I}}_B}{2}.\end{array}$$ 2

Here, the lower indices A and B denote the systems of Alice and Bob. ${\mathbb{I}}_B=|1⟩⟨1|+|2⟩⟨2|$ is an identity operator defined in the system of Bob, which consists of an orthonormal basis $\{|1⟩,|2⟩\}$. In Eq. (2), ${\eta }_{\mathit{AB}}\in [0,1]$ denotes the channel efficiency between Alice and Bob.

Type-I structure of eavesdropper’s scheme

Let us consider the eavesdropper’s scheme illustrated as Fig. 1b. If quantum systems of Bob and Eve are considered, Eve uses a quantum machine to deterministically transform the Alice’s state $|{\psi }_a⟩$ to a composite state between Bob and Eve:

$$\begin{array}{c}\hfill |{\mathrm{\Gamma }}_a{⟩}_{\mathit{BE}}=\sqrt{{\eta }_{\mathit{AB}}}|{\psi }_a{⟩}_B\otimes {|0⟩}_E+\sqrt{1-{\eta }_{\mathit{AB}}}{|{\varphi }_{+}⟩}_{\mathit{BE}},\end{array}$$ 3

with an entangled state

$$\begin{array}{c}\hfill |{\varphi }_{+}{⟩}_{\mathit{BE}}=\frac{1}{\sqrt{2}}(|11⟩+{|22⟩)}_{\mathit{BE}},\end{array}$$ 4

where is the entangled state between Bob and Eve. Then, Eve performs a quantum measurement on her system to discriminate Bob’s measurement result. If ${\eta }_{\mathit{AB}}$ is equal to one, then the composite state in Eq. (3) is a product state. Thus, Eve cannot obtain information by measuring her subsystem. Otherwise, Eve can obtain the information about Bob’s measurement result. We note that the partial state of Bob is equal to Eq. (2).

Type-II structure of eavesdropper’s scheme

The drawback of the eavesdropping scheme introduced above is that it requires a quantum machine deterministically producing $|{\mathrm{\Gamma }}_a⟩$. Since designing the quantum machine can be difficult, we further propose an alternative eavesdropping scheme. In this scheme, we can consider a composite state between Bob and Eve as follows:

$$\begin{array}{c}\hfill {\sigma }_{a,BE}={\eta }_{\mathit{AB}}|{\psi }_a⟩⟨{\psi }_a{|}_B\otimes {|0⟩⟨0|}_E+(1-{\eta }_{\mathit{AB}})|{\varphi }_{+}⟩⟨{\varphi }_{+}{|}_{\mathit{BE}},\end{array}$$ 5

which satisfies ${\text{Tr}}_E{\sigma }_{a,BE}={\mathrm{\Lambda }}^{(A\to B)}(|{\psi }_a⟩⟨{\psi }_a|)$. The procedure for producing the composite state in Eq. (5) is illustrated in Fig. 2. In this figure, Eve lets Alice’s state be transmitted to Bob with a probability ${\eta }_{\mathit{AB}}$, or discard Alice’s state and share $|{\varphi }_{+}⟩$ with Bob with a probability $1-{\eta }_{\mathit{AB}}$. Let us suppose that $|{\varphi }_{+}⟩⟨{\varphi }_{+}|$ is replaced to $\frac{1}{2}|11⟩⟨11|+\frac{1}{2}|22⟩⟨22|$ in Eq. (5), which means that Bob and Eve eventually shares a fully separable state. In this case, each Kraus operator of Bob transforms $\frac{1}{2}|11⟩⟨11|+\frac{1}{2}|22⟩⟨22|$ to another rank-2 state. It leads us to that Eve fails to design a quantum measurement used in type-I and -II eavesdropping schemes. Thus, Eve needs entanglement between herself and Bob in order to obtain meaningful information about his outcome.

Figure 2.

Type-II structure of Eve’s scheme. In this scheme, Eve discards Alice’s state $|{\psi }_a⟩$ and shares a maximally entangled state $|{\varphi }_{+}⟩$ with Bob with a probability $1-{\eta }_{\mathit{AB}}$ as illustrated in the above figure, and lets the Alice’s state be transmitted to Bob with a probability ${\eta }_{\mathit{AB}}$.

These two types can provide same security. That is because the joint measurement probability between Bob and Eve in the type-I structure is equal to that in the type-II structure. Particularly, the type-II structure can be easily reproduced in an experimental setup.

Sequential state discrimination including eavesdropper

For the security analysis, we propose the new sequential state discrimination for describing the two eavesdropper’s schemes. We first explain the structure of sequential state discrimination, and propose the optimal success probability of eavesdropping. We further investigate the amount of the secret key rate in frame of the sequential state discrimination scenario.

Structure of sequential state discrimination

Let us first explain how each of the eavesdropping scheme introduced in the previous section is described as a sequential state discrimination problem. It is noted that the unambiguous discrimination can be applied to the B92 protocol^3,58. For this reason, we consider that Bob has a quantum measurement which can unambiguously discriminates Alice’s states $|{\psi }_0⟩$ and $|{\psi }_1⟩$.

We first consider the type-I structure. We note in advance that our argument in here can also be applied to the type-II structure. Suppose that positive-operator valued measure (POVM) $\{M_0^{(B)},M_1^{(B)},M_{?}^{(B)}\}$ denotes the measurements of Bob. Then, the Kraus operator $K_b^{(B)}$ corresponding to the POVM element $M_b^{(B)}$ ($b\in \{0,1,?\}$) is given by^34,39,40:

$$\begin{array}{cc}\hfill & K_0^{(B)}=\sqrt{{\alpha }_0}|{\varphi }_0^{(B)}⟩⟨{\alpha }_0|,K_1^{(B)}=\sqrt{{\alpha }_1}|{\varphi }_1^{(B)}⟩⟨{\alpha }_1|,\hfill \\ \hfill & K_{?}^{(B)}=\sqrt{1-{\alpha }_0}|{\varphi }_0^{(B)}⟩⟨{\alpha }_0|+\sqrt{1-{\alpha }_1}|{\varphi }_1^{(B)}⟩⟨{\alpha }_1|.\hfill \end{array}$$ 6

Here, ${\alpha }_0$ and ${\alpha }_1$ are non-negative parameters⁴⁰, and $|{\alpha }_0⟩$ and $|{\alpha }_1⟩$ are corresponding vectors:

$$\begin{array}{cc}\hfill |{\alpha }_0⟩=& \frac{1}{\sqrt{2(1+s)}}|1⟩+\frac{1}{\sqrt{2(1-s)}}|2⟩,\hfill \\ \hfill |{\alpha }_1⟩=& \frac{1}{\sqrt{2(1+s)}}|1⟩-\frac{1}{\sqrt{2(1-s)}}|2⟩.\hfill \end{array}$$ 7

For $a\ne b$, the inner product between $|{\alpha }_b⟩$ and $|{\psi }_a⟩$ is equal to zero. It guides us to the fact that the measurement described in terms of the Kraus operators in Eq. (6) can perform the unambiguous discrimination. When Bob obtains a conclusive result $b\in \{0,1\}$, the Kraus operator $K_b^{(B)}$ probabilistically changes the bipartite state of Eq. (3) into the following form:

$$\begin{array}{cc}\hfill K_0^{(B)}\otimes {\mathbb{I}}_E{|{\mathrm{\Gamma }}_0⟩}_{\mathit{BE}}=& |{\varphi }_0^{(B)}{⟩}_B\otimes |{\gamma }_{00}⟩,\hfill \\ \hfill K_1^{(B)}\otimes {\mathbb{I}}_E{|{\mathrm{\Gamma }}_0⟩}_{\mathit{BE}}=& |{\varphi }_1^{(B)}{⟩}_B\otimes |{\gamma }_{01}⟩,\hfill \\ \hfill K_0^{(B)}\otimes {\mathbb{I}}_E{|{\mathrm{\Gamma }}_1⟩}_{\mathit{BE}}=& |{\varphi }_0^{(B)}{⟩}_B\otimes |{\gamma }_{10}⟩,\hfill \\ \hfill K_1^{(B)}\otimes {\mathbb{I}}_E{|{\mathrm{\Gamma }}_1⟩}_{\mathit{BE}}=& |{\varphi }_1^{(B)}{⟩}_B\otimes |{\gamma }_{11}⟩,\hfill \\ \hfill \end{array}$$ 8

where $|{\gamma }_{\mathit{ab}}⟩$ are written as

$$\begin{array}{cc}\hfill |{\gamma }_{00}⟩=& \mathcal{N}\left\{\sqrt{{\eta }_{\mathit{AB}}{\alpha }_0},{|0⟩}_E,+,\sqrt{\frac{(1-{\eta }_{\mathit{AB}}){\alpha }_0}{2(1-s^2)}},{|{\tilde{\psi }}_0⟩}_E\right\},\hfill \\ \hfill |{\gamma }_{01}⟩=& |{\tilde{\psi }}_1{⟩}_E,\hfill \\ \hfill |{\gamma }_{10}⟩=& |{\tilde{\psi }}_0{⟩}_E,\hfill \\ \hfill |{\gamma }_{11}⟩=& \mathcal{N}\left\{\sqrt{{\eta }_{\mathit{AB}}{\alpha }_1},{|0⟩}_E,+,\sqrt{\frac{(1-{\eta }_{\mathit{AB}}){\alpha }_1}{2(1-s^2)}},{|{\tilde{\psi }}_1⟩}_E\right\}.\hfill \end{array}$$ 9

Here, $\mathcal{N}$ is the normalization constant and

$$\begin{array}{c}\hfill |{\tilde{\psi }}_b⟩=\sqrt{1-s^2}|{\alpha }_b⟩\end{array}$$ 10

is a pure state spanned by $\{|1⟩,|2⟩\}$. According to Eq. (10), $|{\tilde{\psi }}_b⟩$ is orthogonal to $|0⟩$. Moreover, the label of $|{\tilde{\psi }}_b⟩$ in Eq. (8) is equal to the measurement result of Bob. Therefore, Eve can eavesdrop the measurement result of Bob by discriminating $|{\tilde{\psi }}_0⟩$ and $|{\tilde{\psi }}_1⟩$ with her measurement described as the POVM $\{M_0^{(E)},M_1^{(E)},M_{?}^{(E)}\}$ on the subspace spanned by $\{|1⟩,|2⟩\}$,

$$\begin{array}{cc}\hfill M_0^{(E)}=& u_0|u_0⟩⟨u_0|,\hfill \\ \hfill M_1^{(E)}=& u_1|u_1⟩⟨u_1|,\hfill \\ \hfill M_{?}^{(E)}=& {\mathbb{I}}_E-M_0^{(E)}-M_1^{(E)},\hfill \end{array}$$ 11

where $M_e^{(E)}$ is the POVM element corresponding to the measurement result e. In Eq. (11), ${\mathbb{I}}_E$ is the identity operator on Eve’s system, $u_e$ is the non-negative real number, and $|u_e⟩$ is the vector in the subspace $\{|1⟩,|2⟩\}$ satisfying $⟨{\tilde{\psi }}_b|u_e⟩={\delta }_{\mathit{be}}$. We note that $|u_e⟩$ can be constructed in the same way as Eq. (7)⁴⁰.

In the aspect of the quantum state discrimination task, the finite (but nonzero) success probability implies that a receiver can obtain an information about sender’s state³. Thus, one of the probable figures of merit is “the success probability of eavesdropping” in case of type-I structure, which is described as (the detailed evaluation is presented in Methods)

$$\begin{array}{c}\hfill P_{s,\mathrm{type}-\mathrm{I}}^{(E)}=\sum _{a,b\in \{0,1\}}{q}_a⟨{\mathrm{\Gamma }}_a|K_b^{(B)†}{K}_b^{(B)}\otimes {\mathbb{I}}_E|{\mathrm{\Gamma }}_a⟩⟨{\gamma }_{\mathit{ab}}|M_b^{(E)}|{\gamma }_{\mathit{ab}}⟩.\end{array}$$ 12

Assume that Bob performs optimal unambiguous discrimination on Alice’s state. Then, $P_{s,opt}^{(E)}$, which is the optimum success probability of eavesdropping, can have a simple expression such as $P_{s,opt1}^{(E)}$ or $P_{s,opt2}^{(E)}$,

$$\begin{array}{cc}\hfill P_{s,opt}^{(E)}=& \frac{1-{\eta }_{\mathit{AB}}}{2(1-s^2)}({\alpha }_0+{\alpha }_1-2\sqrt{{\alpha }_0{\alpha }_1}s),\text{if}{f}_0(s)>0\text{and}{f}_1(s)>0,\hfill \\ \hfill P_{s,opt}^{(E)}=& \frac{1-{\eta }_{\mathit{AB}}}{2}max\{{\alpha }_0,{\alpha }_1\},\text{if}{f}_0(s)\le 0\text{or}{f}_1(s)\le 0,\hfill \end{array}$$ 13

with $s:=|⟨{\psi }_1|{\psi }_2⟩|$ and

$$\begin{array}{cc}\hfill & f_0(s):=q_1{s}^3-\sqrt{q_0{q}_1}{s}^2-q_{0}s+\sqrt{q_0{q}_1},\hfill \\ \hfill & f_1(s):=q_0{s}^3-\sqrt{q_0{q}_1}{s}^2-q_{1}s+\sqrt{q_0{q}_1}.\hfill \end{array}$$ 14

The detailed evaluation of the optimization is presented in Methods. If $s\in [0,\sqrt{q_1/q_2}]$, we get ${\alpha }_0=1-\sqrt{\frac{q_1}{q_0}}s$ and ${\alpha }_1=1-\sqrt{\frac{q_0}{q_1}}s$ from Bob’s optimal POVM condition¹⁸.

Figure 3a illustrates the optimum success probability of eavesdropping($P_{s,opt}^{(E)}$) in Eq. (13). Here, we have used $q_0=0.4(q_1=0.6)$ and ${\eta }_{\mathit{AB}}=0.5$. In Fig. 3a, the solid black line(dashed black line) indicates $P_{s,opt1}^{(E)}$ ($P_{s,opt2}^{(E)}$). According to Fig. 3a, in the region of $s<0.6538$, $P_{s,opt1}^{(E)}$ (solid black line) is optimum. That is because, as illustrated in Fig. 3b, both $f_0(s)$ and $f_1(s)$ in Eq. (14) are non-negative in this region. Meanwhile, $P_{s,opt2}^{(E)}$ (dashed black line) is optimum in the region of $s>0.6538$, since one of $f_1(s)$ is negative. Thus, the optimum success probability of eavesdropping is indicated by the solid red line.

Figure 3.

(a) Success probability of eavesdropping with respect to overlap $s=|⟨{\psi }_0|{\psi }_1⟩|$ between two Alice’s states. Solid black line and dashed black line are success probabilities of eavesdropping $P_{s,opt1}^{(E)}$ and $P_{s,opt2}^{(E)}$ in Eq. (13), respectively, and solid red line is the optimal success probability of eavesdropping. In (b), $f_0(s)$ and $f_1(s)$ in Eq. (14) are depicted, where these functions are used for deciding which value between $P_{s,opt1}^{(E)}$ and $P_{s,opt2}^{(E)}$ is indeed optimal, on the basis of the condition written in Eq. (13).

We further evaluate the success probability of eavesdropping in type-II structure as

$$\begin{array}{c}\hfill P_{s,\mathrm{type}-\mathrm{II}}^{(E)}=\sum _{a,b\in \{0,1\}}{q}_a\text{tr}\left[K_b^{(B)},\otimes ,{\mathbb{I}}_E,{\sigma }_{a,BE},K_b^{(B)†},\otimes ,{\mathbb{I}}_E\right]\text{tr}\left[{\tau }_{ab,E},M_b^{(E)}\right],\end{array}$$ 15

where ${\tau }_{ab,E}$ are defined as

$$\begin{array}{cc}\hfill & {\tau }_{00,E}=\frac{{\eta }_{\mathit{AB}}}{{\eta }_{\mathit{AB}}+\frac{1-{\eta }_{\mathit{AB}}}{2(1-s^2)}}{|0⟩⟨0|}_E+\frac{\frac{1-{\eta }_{\mathit{AB}}}{2(1-s^2)}}{{\eta }_{\mathit{AB}}+\frac{1-{\eta }_{\mathit{AB}}}{2(1-s^2)}}|{\tilde{\psi }}_0⟩⟨{\tilde{\psi }}_0{|}_E,\hfill \\ \hfill & {\tau }_{01,E}=|{\tilde{\psi }}_1⟩⟨{\tilde{\psi }}_1{|}_E,\hfill \\ \hfill & {\tau }_{10,E}=|{\tilde{\psi }}_0⟩⟨{\tilde{\psi }}_0{|}_E,\hfill \\ \hfill & {\tau }_{11,E}=\frac{{\eta }_{\mathit{AB}}}{{\eta }_{\mathit{AB}}+\frac{1-{\eta }_{\mathit{AB}}}{2(1-s^2)}}{|0⟩⟨0|}_E+\frac{\frac{1-{\eta }_{\mathit{AB}}}{2(1-s^2)}}{{\eta }_{\mathit{AB}}+\frac{1-{\eta }_{\mathit{AB}}}{2(1-s^2)}}|{\tilde{\psi }}_1⟩⟨{\tilde{\psi }}_1{|}_E.\hfill \end{array}$$ 16

From the straightforward calculation, the success probability of eavesdropping in Eq. (15) is equal to Eq. (12). The proof is presented in Methods. Thus, the optimal success probability of eavesdropping in type-II structure is also analytically derived as Eq. (13).

Secret key rate

In sequential state discrimination scenario among Alice, Bob, and Eve, Alice and Bob can obtain secret key as follows. Let us suppose that Eve performs the eavesdropping scheme discussed in the previous section with optimal success probability of the eavesdropping. Then, due to Eve’s measurement which extracts information of Bob’s measurement outcome, an event that Alice’s prepared bit and Bob’s outcome are not equal happens with nonzero probability. By this discrepancy between Alice and Bob, they notice the presence of Eve. This means that Alice and Bob can share the secret key even though Eve performs most efficient eavesdropping scheme. Note that Bob performs optimal unambiguous discrimination on Alice’s states, he is not supposed to get error outcomes if Eve does not exist between Alice and Bob.

According to Csiszar and Korner⁵⁴, when the amount of information between a receiver and a sender is larger than that between a receiver and eavesdropper, a secret key can exist as an amount equal to the difference of information. The secret key rate is defined as

$$\begin{array}{cc}\hfill K_{AB:E}=& max\{0,I(B:A)-I(B:E)\}\hfill \\ \hfill =& max\{0,H(A)-H(B,A)-H(E)+H(B,E)\}.\hfill \end{array}$$ 17

Here, $I(X:Y)=H(X)+H(Y)-H(X,Y)$ is Shannon mutual information. H(X) denotes Shannon entropy and H(X, Y) is Shannon joint entropy. If $K_{AB:E}>0$, sender Alice and receiver Bob can share the secret key⁵⁴.

As illustrated in Fig. 4, Bob and Eve can perform the following post-processing. In case that Bob performs optimal unambiguous discrimination, he can discard the measurement result when he obtains an inconclusive result. This post-processing can enhance the amount of information shared between Alice and Bob⁵⁹. In this way, the joint probability between Alice and Bob is

$$\begin{array}{c}\hfill {\tilde{P}}_{\mathit{AB}}(a,b)=\frac{P_{\mathit{AB}}(a,b)}{{\sum }_{a,b\in \{0,1\}}{P}_{\mathit{AB}}(a,b)},\end{array}$$ 18

which constitutes the Shannon mutual information in Eq. (17). Here. $a,b\in \{0,1,?\}$ are the measurement results for Alice and Bob, respectively. Similarly, when Eve obtains an inconclusive result, she discards the measurement result. Thus, it seems that Eve can successfully obtain information about Bob. However, Bob and Eve are separated in space and the information leakage discussed above is not permitted. In other words, Eve cannot discard her measurement result based on whether Bob obtained an inconclusive result or not. Therefore, the joint probability between Bob and Eve should be changed as follows:

$$\begin{array}{c}\hfill {\tilde{P}}_{\mathit{BE}}(b,e)=\frac{P_{\mathit{BE}}(b,e)}{{\sum }_{b\in \{0,1,?\}}{\sum }_{e\in \{0,1\}}{P}_{\mathit{BE}}(b,e)},\end{array}$$ 19

where $b,e\in \{0,1,?\}$ are the measurement results for Bob and Eve, respectively.

Figure 4.

Post-processing performed by Bob and Eve. Let us suppose that Bob has 10 measurement results $b_1,\cdots ,b_{10}$, and Eve has measurement results $e_1,\cdots ,e_{10}$. Bob can discard the inconclusive results $b_4,b_5,b_{10}$, and Eve can also discard $e_2$ and $e_8$. We note that there may no classical communication between Bob and Eve. In other words, Eve does not have ability to discard her messages by presuming Bob’s inconclusive results. This supports the reason that the joint probability needs to be considered as Eq. (19).

Figure 5 shows the secret key rate $K_{AB:E}$ written in Eq. (17), considering the marginal probability between Bob and Eve which is updated from Eq. (19). Here, $P_{\mathit{AB}}(a,b)$ and $P_{\mathit{BE}}(b,e)$ in Eqs. (18) and (19) are evaluated by considering Bob’s POVM optimizing optimal unambiguous discrimination and Eve’s POVM maximizing success probability of eavesdropping (For the details, see “Secret key rate” in Methods). We note that the both two types of eavesdropper’s scheme provides same secret key rate (for detail, see Methods). Here, the channel efficiency is considered as ${\eta }_{\mathit{AB}}=0.9$(solid red line), ${\eta }_{\mathit{AB}}=0.8$(solid blue line), ${\eta }_{\mathit{AB}}=0.7$(solid black line), and ${\eta }_{\mathit{AB}}=0.6$(solid purple line). As shown in Fig. 5, as the overlap s increases, $K_{AB:E}$ also increases. However, from a specific overlap $K_{AB:E}$ decreases. For example, for ${\eta }_{\mathit{AB}}=0.9$, in the region of $s<0.4585$, $K_{AB:E}$ increases but in the region of $s>0.4585$, $K_{AB:E}$ decreases.

Figure 5.

Secret key rate $K_{AB:E}$: red, blue, black, and purple lines correspond to ${\eta }_{\mathit{AB}}=0.9$, ${\eta }_{\mathit{AB}}=0.8$, ${\eta }_{\mathit{AB}}=0.7$, and ${\eta }_{\mathit{AB}}=0.6$, respectively. Here, s is the overlap between two Alice’s states.

The secret key rate $K_{AB:E}$ exhibits interesting behavior. When the overlap s is large, it is difficult for Bob and Eve to efficiently implement the quantum state discrimination. In this case, the mutual information between Alice and Bob, and Bob and Eve becomes small. However, when s is small, Bob and Eve can easily and efficiently implement the quantum state discrimination. In this case, the mutual information between Alice and Bob, and Bob and Eve becomes large.

Method for experimental implementation

Let us propose an experimental method for a unified model of sequential state discrimination including an eavesdropper with quantum optics. Even though the type-I structure was used previously, we will use type-II structure, because it can be easily implemented in an experimental setup. In the type-II structure, Alice prepares a quantum state

$$\begin{array}{c}\hfill |{\psi }_a⟩=\sqrt{\frac{1+s}{2}}|h⟩+{(-1)}^a\sqrt{\frac{1-s}{2}}|v⟩,\end{array}$$ 20

where $|h⟩$ and $|v⟩$ represent horizontal and vertical directions, respectively. Eve, who controls channel efficiency ${\eta }_{\mathit{AB}}$, can eavesdrop as follows: (i) With a probability of ${\eta }_{\mathit{AB}}$, Eve does not eavesdrop on the quantum state of Alice. (ii) With a probability of $1-{\eta }_{\mathit{AB}}$, Eve eliminates the quantum state of Alice and shares a maximally entangled state with Bob. (iii) After Bob’s measurement, Eve performs measurement on her subsystem.

In Fig. 6 of the next page, we illustrate the experimental setup(for details about the description, see Supplementary information). Here, the experimental setup of Bob and Eve is based on a Sagnac-like interferometer⁵⁵. The setup consists of a half-wave plate(HWP), polarized beam splitter(PBS), and single-photon detector(SPD). In step (ii), Eve generates a maximally entangled two-photon polarization state $|{\varphi }_{+}⟩=\frac{1}{\sqrt{2}}(|hh⟩+|vv⟩)$, using a type-II spontaneous parametric down conversion(SPDC)⁶⁰. Type-II SPDC includes beta-barium borate(BBO) crystals, two birefringent crystals, HWP, and quarter-wave plate(QWP). HWP and QWP transform the entangled pure state, generated by the BBO and birefringent crystals, into one of the four Bell-states. Note that the maximally entangled two-photon polarization state is also efficiently generated by the Sagnac interferometer in which a periodically-poled KTP crystal is equipped.

Figure 6.

Experimental setting for implementing type-II structure of eavesdropping. Here, with probability $1-{\eta }_{\mathit{AB}}$, Eve discards Alice’s state and prepares maximally entangled state $|{\varphi }_{+}⟩=\frac{1}{\sqrt{2}}(|hh⟩+|vv⟩)$ between Eve and Bob. HWP: half-wave plate, PBS: polarized beam splitter, SPD: single-photon detector, and Ent. Gen.: entanglement generator⁶⁰.

According to the type-II structure, if Eve generates $|{\varphi }_{+}⟩$ with a probability of $1-{\eta }_{\mathit{AB}}$, Eve can eavesdrop on the result of Bob, based on the selection of the path of a single photon and the measurement result of two SPDs. Ideally, Bob performs an unambiguous discrimination based on a Sagnac-like interferometer, and Eve can eavesdrop with the optimum success probability of eavesdropping by constructing a Sagnac-like interferometer. It should be emphasized that despite the attack by Eve, Alice and Bob can obtain the secret key rate.

In reality, one should consider imperfections occurring in the photon state and in SPD. We consider the dark count rate($\nu >0$) and detection efficiency($0<\eta <1$) for the SPD. The photon state in the setup consists of two types: a single-photon polarization state that Alice sends to Bob, and the single photon state of maximally entangled state generated by Eve. Different types of photon states suffer from different types of noises. For example, the single-photon polarization state may disappear under a noisy channel, which is called “amplitude damping”^61,62. We assume that amplitude damping can occur between Alice and Bob and between Bob and Eve. In addition, white or colored noise can occur when Eve generates a maximally entangled quantum state⁵⁶. Particularly, colored noise which occurs because of imperfections in experimental entangling operations is more frequent than white noise⁵⁶. By including all the imperfections discussed above, Bob and Eve eventually shares the following quantum state:

$$\begin{array}{c}\hfill {\zeta }_a={\eta }_{\mathit{AB}}{\mathrm{\Lambda }}_{D_0}^{(ad)}(|{\psi }_a⟩{⟨{\psi }_a|)}_B\otimes {|0⟩⟨0|}_E+(1-{\eta }_{\mathit{AB}})\left({\mathrm{\Lambda }}_{D_e}^{(ad)},\otimes ,{\mathrm{\Lambda }}_{D_e}^{(ad)}\right)({\varrho }_{\mathit{ent}}),\end{array}$$ 21

for given Alice’s bit $a\in \{0,1\}$. Here, ${\eta }_{\mathit{AB}}$ is the channel efficiency between Alice and Bob, ${\mathrm{\Lambda }}_{D_0}^{(ad)}$ is an amplitude damping channel between Alice and Bob with damping ratio $D_0$, and ${\mathrm{\Lambda }}_D^{(ad)}$ is the amplitude damping channel between Eve and Bob with the damping ratio $D_e$. ${\varrho }_{\mathit{ent}}$ is a noisy entangled state generated by Eve. If Eve’s entangled state is exposed to white noise, then the noisy entangled state is written as⁵⁶

$$\begin{array}{c}\hfill {\rho }_{\mathit{ent}}^{(wh)}={\eta }_{\text{ent}}|{\varphi }_{+}⟩⟨{\varphi }_{+}|+(1-{\eta }_{\text{ent}})\frac{1}{4}(|h⟩⟨h|+|v⟩⟨v|)\otimes (|h⟩⟨h|+|v⟩⟨v|),\end{array}$$ 22

and if it is exposed to color noise, then⁵⁶

$${\rho }_{\mathit{ent}}^{(cl)}={\eta }_{\mathit{ent}}|{\varphi }_{+}⟩⟨{\varphi }_{+}|+(1-{\eta }_{\text{ent}})\frac{1}{2}(|hh⟩⟨hh|+|vv⟩⟨vv|),$$ 23

with the efficiency of entanglement ${\eta }_{\mathit{ent}}$, where $|{\varphi }_{+}⟩=(|hh⟩+|vv⟩)/\sqrt{2}$ is a maximally entangled state composed of horizontal and vertical states $|h⟩$ and $|v⟩$.

The success probability of eavesdropping under imperfections described as Eqs. (21)–(23) is displayed in Fig. 7a (for detail, see Supplementary information). In Fig. 7a, the value of ${\eta }_{\mathit{AB}}=0.5$, ${\eta }_{\mathit{ent}}=0.5$, and $\eta =0.8$ are considered, where the detection efficiency $\eta =0.8$ is the value of a commercialized superconducting nanowire single-photon detector(SNSPD) whose dark count rate is nearly zero⁶³. In Fig. 7a, the solid line, dashed line, and dash-dot line correspond to the cases of decoherence parameter, $D=0.1$, $D=0.2$, and $D=0.3$, respectively(a large D implies that the decoherence rate is high). Here, we assume that $D_0=D_e=D$ for considering the relation between the secret key rate and a single decoherence parameter. The black and blue lines show the cases of white and colored noise, respectively.

Figure 7.

(a) Success probability of eavesdropping under imperfect quantum channel, entangled state, and single-photon detector. (b) Secret key rate between Alice and Bob. Here, ${\eta }_{\mathit{AB}}$, ${\eta }_{\mathit{ent}}$, and $\eta$ in Eq. (21) are ${\eta }_{\mathit{AB}}=0.5$, ${\eta }_{\mathit{ent}}=0.5$, and $\eta =0.8$, respectively. Blue(black) line corresponds to color(white) noise. Solid, dashed, and dash-dot lines correspond to $D=0.1$, $D=0.2$, and $D=0.3$, respectively. Here, we assume that $D_0=D_e=D$ for considering the relation between the secret key rate and a single decoherence parameter. Secret key rate under imperfect quantum channel, entangled state, and single-photon detector. Here, ${\eta }_{\mathit{AB}}=0.5$, ${\eta }_{\mathit{ent}}=0.5$, and $\eta =0.8$ are considered. Blue(black) line corresponds to color(white) noise. Solid(dashed) line corresponds to $D_0=0.1$($D_0=0.2$). In every case, $D_e=0.4$ is considered.

In Fig. 7b, the secret key rate between Alice and Bob with the imperfections in Eqs. (21)–(23) is displayed, considering various imperfections (for detail, see Supplementary information). Here, ${\eta }_{\mathit{AB}}=0.5$, ${\eta }_{\mathit{ent}}=0.5$, and $\eta =0.8$ are considered. The blue(black) line corresponds to colored(white) noise. The solid(dashed) line corresponds to $D_0=0.1$($D_0=0.2$). In every case, $D_e$ is taken as 0.4. It should be noted that the secret key rate does not change when $D_0=D_e$ owing to the post-processing expressed in Eq. (19). As shown in Fig. 7b, the graph of the secret key rate has one global maximum. This implies that (i) if s tends to be smaller, then the secret key rate decreases because the tendency of s makes Eve as well as Bob to easily discriminate the quantum states, and (ii) if s tends to be larger, then the secret key rate decreases because the tendency of s makes discrimination performed by Bob and Eve difficult.

Conclusion

In this paper, we have proposed a unified model of sequential state discrimination including an eavesdropper. We have shown that even though Eve uses an entanglement to eavesdrop on Bob’s measurement result, Alice and Bob can have a non-zero secret key rate. Furthermore, we have proposed an experimental model for eavesdropping. Because our experimental method consists of linear optical technologies, the implementation of our method is practical. Ideally, our experiment can achieve optimum success probability of eavesdropping. Beyond the ideal case, we have investigated possible imperfections including quantum channels between Alice and Bob, entanglement between Bob and Eve, and the inefficiency of Bob’s SPD. It is interesting that the non-zero secret key rate is possible even under such the imperfections.

In this paper, we have focused on security analysis of the B92 protocol in view of the sequential state discrimination scheme. That is because the security analysis can be performed with the simple mathematical structure of the unambiguous discrimination^22,40. We emphasize that our methodology based on the sequential state discrimination can be applied to the various kinds of quantum communication⁶⁴ as well as quantum key distribution^45,65 designed in prepare-and-measure way. Moreover, our scheme can be applied to quantum communication or key distribution task utilizing the continuous variable quantum systems^57,66. We further emphasize that our research propose a novel theoretical way to unify the secure quantum communication tasks in terms of the quantum state discrimination.

It also should be noted that our sequential state discrimination model can be extended to the case of unambiguously discriminating N pure states^1,22. This extension is important since large N guarantees large amount of transmitted bits per a signal pulse. Moreover, our experimental idea can also be applied to the continuous variable version. That is because sequential measurement that unambiguously discriminates two coherent states can be designed with linear optics⁴¹.

Methods

Success probability of eavesdropping

In this section, we derive and optimize the success probability of eavesdropping by considering both types of eavesdropping strategies.

Describing type-I structure of eavesdropper

In this structure, the following entangled state between Bob and Eve is considered:

$$\begin{array}{c}\hfill |{\mathrm{\Gamma }}_a{⟩}_{\mathit{BE}}=\sqrt{{\eta }_{\mathit{AB}}}|{\psi }_a{⟩}_B\otimes {|0⟩}_E+\sqrt{\frac{1-{\eta }_{\mathit{AB}}}{2}}(|11⟩+{|22⟩)}_{\mathit{BE}}.\end{array}$$ 24

Then, each $K_b^{(B)}\otimes {\mathbb{I}}_E|{\mathrm{\Gamma }}_a⟩$ are obtained by

$$\begin{array}{cc}\hfill K_0^{(B)}\otimes {\mathbb{I}}_E|{\mathrm{\Gamma }}_0⟩=& \sqrt{{\eta }_{\mathit{AB}}{\alpha }_0}|{\varphi }_0^{(B)}{⟩}_B\otimes {|0⟩}_E+\sqrt{\frac{(1-{\eta }_{\mathit{AB}}){\alpha }_0}{2}}{\left\{(|{\varphi }_0^{(B)}⟩,⟨{\alpha }_0|\otimes {\mathbb{I}}_E),|11⟩,+,(|{\varphi }_0^{(B)}⟩,⟨{\alpha }_0|\otimes {\mathbb{I}}_E),|22⟩\right\}}_{\mathit{BE}},\hfill \\ \hfill K_1^{(B)}\otimes {\mathbb{I}}_E|{\mathrm{\Gamma }}_0⟩=& \sqrt{\frac{(1-{\eta }_{\mathit{AB}}){\alpha }_1}{2}}{\left\{(|{\varphi }_1^{(B)}⟩,⟨{\alpha }_1|\otimes {\mathbb{I}}_E),|11⟩,+,(|{\varphi }_1^{(B)}⟩,⟨{\alpha }_1|\otimes {\mathbb{I}}_E),|22⟩\right\}}_{\mathit{BE}},\hfill \\ \hfill K_0^{(B)}\otimes {\mathbb{I}}_E|{\mathrm{\Gamma }}_1⟩=& \sqrt{\frac{(1-{\eta }_{\mathit{AB}}){\alpha }_0}{2}}{\left\{(|{\varphi }_0^{(B)}⟩,⟨{\alpha }_0|\otimes {\mathbb{I}}_E),|11⟩,+,(|{\varphi }_0^{(B)}⟩,⟨{\alpha }_0|\otimes {\mathbb{I}}_E),|22⟩\right\}}_{\mathit{BE}},\hfill \\ \hfill K_1^{(B)}\otimes {\mathbb{I}}_E|{\mathrm{\Gamma }}_1⟩=& \sqrt{{\eta }_{\mathit{AB}}{\alpha }_1}|{\varphi }_1^{(B)}{⟩}_B\otimes {|0⟩}_E+\sqrt{\frac{(1-{\eta }_{\mathit{AB}}){\alpha }_1}{2}}{\left\{(|{\varphi }_1^{(B)}⟩,⟨{\alpha }_1|\otimes {\mathbb{I}}_E),|11⟩,+,(|{\varphi }_1^{(B)}⟩,⟨{\alpha }_1|\otimes {\mathbb{I}}_E),|22⟩\right\}}_{\mathit{BE}}.\hfill \end{array}$$ 25

Without loss of generality, we write pure states $|{\psi }_a⟩$ as

$$\begin{array}{cc}\hfill |{\psi }_0{⟩}_E=& \sqrt{\frac{1+s}{2}}{|1⟩}_E+\sqrt{\frac{1-s}{2}}{|2⟩}_E,\hfill \\ \hfill |{\psi }_1{⟩}_E=& \sqrt{\frac{1+s}{2}}{|1⟩}_E-\sqrt{\frac{1-s}{2}}{|2⟩}_E,\hfill \end{array}$$ 26

and vectors $|{\alpha }_b⟩$ in the Kraus operators as

$$\begin{array}{cc}\hfill |{\alpha }_0{⟩}_E=& \frac{1}{\sqrt{2(1+s)}}{|1⟩}_E+\frac{1}{\sqrt{2(1-s)}}{|2⟩}_E,\hfill \\ \hfill |{\alpha }_1{⟩}_E=& \frac{1}{\sqrt{2(1+s)}}{|1⟩}_E-\frac{1}{\sqrt{2(1-s)}}{|2⟩}_E,\hfill \end{array}$$ 27

such that $⟨{\psi }_a|{\alpha }_b⟩={\delta }_{\mathit{ab}}$ for every $a,b\in \{0,1\}$. Substituting Eqs. (26) and (27) into Eq. (25), we obtain

$$\begin{array}{cc}\hfill K_0^{(B)}\otimes {\mathbb{I}}_E|{\mathrm{\Gamma }}_0⟩=& \sqrt{{\eta }_{\mathit{AB}}{\alpha }_0}|{\varphi }_0^{(B)}{⟩}_B\otimes {|0⟩}_E+\sqrt{\frac{(1-{\eta }_{\mathit{AB}}){\alpha }_0}{2}}|{\varphi }_0^{(B)}{⟩}_B\otimes {|{\alpha }_0⟩}_E,\hfill \\ \hfill K_1^{(B)}\otimes {\mathbb{I}}_E|{\mathrm{\Gamma }}_0⟩=& \sqrt{\frac{(1-{\eta }_{\mathit{AB}}){\alpha }_1}{2}}|{\varphi }_1^{(B)}{⟩}_B\otimes {|{\alpha }_1⟩}_E,\hfill \\ \hfill K_0^{(B)}\otimes {\mathbb{I}}_E|{\mathrm{\Gamma }}_1⟩=& \sqrt{\frac{(1-{\eta }_{\mathit{AB}}){\alpha }_0}{2}}|{\varphi }_0^{(B)}{⟩}_B\otimes {|{\alpha }_0⟩}_E,\hfill \\ \hfill K_1^{(B)}\otimes {\mathbb{I}}_E|{\mathrm{\Gamma }}_1⟩=& \sqrt{{\eta }_{\mathit{AB}}{\alpha }_1}|{\varphi }_1^{(B)}{⟩}_B\otimes {|0⟩}_E+\sqrt{\frac{(1-{\eta }_{\mathit{AB}}){\alpha }_1}{2}}|{\varphi }_1^{(B)}{⟩}_B\otimes {|{\alpha }_1⟩}_E.\hfill \end{array}$$ 28

We define (normalized) pure states by

$$\begin{array}{c}\hfill |{\tilde{\psi }}_a{⟩}_E=\sqrt{1-s^2}{|{\alpha }_a⟩}_E.\end{array}$$ 29

Substituting Eq. (29) into Eq. (28), we obtain the representation of Eq. (6) in the letter with $|{\gamma }_{\mathit{ab}}⟩$ defined by

$$\begin{array}{cc}\hfill |{\gamma }_{00}{⟩}_E=& \frac{1}{\sqrt{{\eta }_{\mathit{AB}}+\frac{(1-{\eta }_{\mathit{AB}})}{2(1-s^2)}}}{\left\{\sqrt{{\eta }_{\mathit{AB}}},|0⟩,+,\sqrt{\frac{(1-{\eta }_{\mathit{AB}})}{2(1-s^2)}},|{\tilde{\psi }}_0⟩\right\}}_E,\hfill \\ \hfill |{\gamma }_{01}{⟩}_E=& |{\tilde{\psi }}_1{⟩}_E,\hfill \\ \hfill |{\gamma }_{10}{⟩}_E=& |{\tilde{\psi }}_0{⟩}_E,\hfill \\ \hfill |{\gamma }_{11}{⟩}_E=& \frac{1}{\sqrt{{\eta }_{\mathit{AB}}+\frac{(1-{\eta }_{\mathit{AB}})}{2(1-s^2)}}}{\left\{\sqrt{{\eta }_{\mathit{AB}}},|0⟩,+,\sqrt{\frac{(1-{\eta }_{\mathit{AB}})}{2(1-s^2)}},|{\tilde{\psi }}_1⟩\right\}}_E.\hfill \end{array}$$ 30

Consider Eve’s POVM as $\{M_0^{(E)},M_1^{(E)},M_{?}^{(E)}\}$ where each POVM element is given by

$$\begin{array}{c}\hfill M_0^{(E)}=u_0|u_0⟩⟨u_0|,M_1^{(E)}=u_1|u_1⟩⟨u_1|,M_{?}^{(E)}={\mathbb{I}}_E-M_0^{(E)}-M_1^{(E)},\end{array}$$ 31

where $u_0$ and $u_1$ are non-negative real numbers, and $|u_0⟩$ and $|u_1⟩$ are vectors orthogonal to ${|0⟩}_E$ and satisfying $⟨u_b|{\tilde{\psi }}_a⟩={\delta }_{\mathit{ab}}$ for every $a,b\in \{0,1\}$.

From Eqs. (28)–(31), the success probability of eavesdropping is obtained by

$$\begin{array}{c}\hfill P_s^{(E)}=\frac{1-{\eta }_{\mathit{AB}}}{2(1-s^2)}({\alpha }_0{u}_0+{\alpha }_1{u}_1).\end{array}$$ 32

Optimization

According to Eq. (29), inner product $⟨{\tilde{\psi }}_0|{\tilde{\psi }}_1⟩$ is obtained by

$$\begin{array}{c}\hfill ⟨{\tilde{\psi }}_0|{\tilde{\psi }}_1⟩=-s.\end{array}$$ 33

Since $|u_0{⟩\perp |0⟩}_E$ and $|u_1{⟩\perp |0⟩}_E$, supports of $M_0^{(E)}$ and $M_1^{(E)}$ are also orthogonal to ${|0⟩}_E$. This implies that Eve’s POVM is designed to discriminate $|{\tilde{\psi }}_0⟩$ and $|{\tilde{\psi }}_1⟩$. Therefore, the constraint of Eve’s POVM is given by³⁹

$$\begin{array}{c}\hfill (1-u_0)(1-u_1)\ge s^2.\end{array}$$ 34

Therefore, we obtain the following optimization problem:

$$\begin{array}{cc}\hfill \text{maximize}& P_s^{(E)}=\frac{1-{\eta }_{\mathit{AB}}}{2(1-s^2)}({\alpha }_0{u}_0+{\alpha }_1{u}_1),\hfill \\ \hfill \mathrm{subject}\mathrm{to}& (1-u_0)(1-u_1)\ge s^2.\hfill \end{array}$$ 35

For fixed parameters ${\alpha }_0$ and ${\alpha }_1$, an optimal point $(u_0,u_1)$ satisfies

$$\begin{array}{c}\hfill (1-u_0)(1-u_1)=s^2.\end{array}$$ 36

Also, for the optimal point, there exists a non-zero real number $\lambda$ satisfying

$$\begin{array}{c}\hfill \overrightarrow{\mathrm{\nabla }}{P}_s^{(E)}=\lambda \overrightarrow{\mathrm{\nabla }}\left\{(1-u_0),(1-u_1),-,s^2\right\},\end{array}$$ 37

where $\overrightarrow{\mathrm{\nabla }}$ is a gradient such that $\overrightarrow{\mathrm{\nabla }}f=\left(\frac{\partial f}{\partial u_0},,,\frac{\partial f}{\partial u_1}\right)$. We note that Eq. (37) is equivalent to³⁹

$$\begin{array}{c}\hfill \frac{\partial P_s^{(E)}/\partial u_0}{\partial P_s^{(E)}/\partial u_1}=\frac{\partial \left\{(1-u_0),(1-u_1),-,s^2\right\}/\partial u_0}{\partial \left\{(1-u_0),(1-u_1),-,s^2\right\}/\partial u_1}.\end{array}$$ 38

Combining Eqs. (36) and (38), we obtain the optimal point by

$$\begin{array}{c}\hfill u_0=1-\sqrt{\frac{{\alpha }_1}{{\alpha }_0}}s,u_1=1-\sqrt{\frac{{\alpha }_0}{{\alpha }_1}}s.\end{array}$$ 39

Since the optimal point $(u_0,u_1)$ is on the surface of Eq. (34), both $u_0$ and $u_1$ in Eq. (39) should be non-negative. For this reason, the overlap s also should be

$$\begin{array}{c}\hfill s<\sqrt{\frac{{\alpha }_0}{{\alpha }_1}}\wedge s<\sqrt{\frac{{\alpha }_1}{{\alpha }_0}}.\end{array}$$ 40

Considering s in the region of Eq. (40), the optimal success probability of eavesdropping is analytically given by

$$\begin{array}{c}\hfill P_{s,opt1}^{(E)}=\frac{1-{\eta }_{\mathit{AB}}}{2(1-s^2)}({\alpha }_0+{\alpha }_1-2\sqrt{{\alpha }_0{\alpha }_1}s).\end{array}$$ 41

Suppose that Bob performs optimal unambiguous discrimination between two pure states $|{\psi }_0⟩$ and $|{\psi }_1⟩$. Then, ${\alpha }_0$ and ${\alpha }_1$ are given by¹⁸

$$\begin{array}{c}\hfill {\alpha }_0=1-\sqrt{\frac{q_1}{q_0}}s,{\alpha }_1=1-\sqrt{\frac{q_0}{q_1}}s,\end{array}$$ 42

if

$$\begin{array}{c}\hfill s<\sqrt{\frac{q_1}{q_0}}\wedge s<\sqrt{\frac{q_0}{q_1}}.\end{array}$$ 43

Substituting Eq. (42) with ${\alpha }_0$ and ${\alpha }_1$ in Eq. (40), we obtain

$$\begin{array}{cc}\hfill & f_0(s):=q_1{s}^3-\sqrt{q_0{q}_1}{s}^2-q_{0}s+\sqrt{q_0{q}_1}>0,\hfill \\ \hfill & f_1(s):=q_0{s}^3-\sqrt{q_0{q}_1}{s}^2-q_{1}s+\sqrt{q_0{q}_1}>0.\hfill \end{array}$$ 44

We note that if one of inequalities in Eq. (44) does not hold, then the optimal point $(u_0,u_1)$ is given by

$$\begin{array}{c}\hfill (u_0,u_1)\in \{(1,0),(0,1)\}.\end{array}$$ 45

Substituting this optimal point into Eq. (32), we obtain the optimal success probability of eavesdropping:

$$\begin{array}{c}\hfill P_{s,opt2}^{(E)}=\frac{1-{\eta }_{\mathit{AB}}}{2}max\{{\alpha }_0,{\alpha }_1\}.\end{array}$$ 46

Describing type-II structure of eavesdropper’s scheme

In this structure, the following bipartite state between Bob and Eve is considered:

$$\begin{array}{c}\hfill {\sigma }_{a,BE}={\eta }_{\mathit{AB}}|{\psi }_a⟩⟨{\psi }_a{|}_B\otimes {|0⟩⟨0|}_E+(1-{\eta }_{\mathit{AB}})|{\varphi }_{+}⟩⟨{\varphi }_{+}{|}_{\mathit{BE}}.\end{array}$$ 47

Then, each $K_b^{(B)}\otimes {\mathbb{I}}_E{\sigma }_{a,AB}{K}_b^{(B)†}\otimes {\mathbb{I}}_E$ is obtained by

$$\begin{array}{cc}\hfill K_0\otimes {\mathbb{I}}_E{\sigma }_{0,BE}{K}_0^{†}\otimes {\mathbb{I}}_E=& {\eta }_{\mathit{AB}}{\alpha }_0|{\varphi }_0^{(B)}⟩⟨{\varphi }_0^{(B)}{|\otimes |0⟩⟨0|}_E+\frac{(1-{\eta }_{\mathit{AB}}){\alpha }_0}{2(1-s^2)}|{\varphi }_0^{(B)}⟩⟨{\varphi }_0^{(B)}|\otimes |{\tilde{\psi }}_0⟩⟨{\tilde{\psi }}_0{|}_E,\hfill \\ \hfill K_1\otimes {\mathbb{I}}_E{\sigma }_{0,BE}{K}_1^{†}\otimes {\mathbb{I}}_E=& \frac{(1-{\eta }_{\mathit{AB}}){\alpha }_1}{2(1-s^2)}|{\varphi }_1^{(B)}⟩⟨{\varphi }_1^{(B)}|\otimes |{\tilde{\psi }}_1⟩⟨{\tilde{\psi }}_1{|}_E,\hfill \\ \hfill K_0\otimes {\mathbb{I}}_E{\sigma }_{1,BE}{K}_0^{†}\otimes {\mathbb{I}}_E=& \frac{(1-{\eta }_{\mathit{AB}}){\alpha }_0}{2(1-s^2)}|{\varphi }_0^{(B)}⟩⟨{\varphi }_0^{(B)}|\otimes |{\tilde{\psi }}_0⟩⟨{\tilde{\psi }}_0{|}_E,\hfill \\ \hfill K_1\otimes {\mathbb{I}}_E{\sigma }_{1,BE}{K}_1^{†}\otimes {\mathbb{I}}_E=& {\eta }_{\mathit{AB}}{\alpha }_1|{\varphi }_1^{(B)}⟩⟨{\varphi }_1^{(B)}{|\otimes |0⟩⟨0|}_E+\frac{(1-{\eta }_{\mathit{AB}}){\alpha }_1}{2(1-s^2)}|{\varphi }_1^{(B)}⟩⟨{\varphi }_1^{(B)}|\otimes |{\tilde{\psi }}_1⟩⟨{\tilde{\psi }}_1{|}_E.\hfill \end{array}$$ 48

We derive the success probability of eavesdropping as

$$\begin{array}{c}\hfill P_s^{(E)}=\sum _{a,b\in \{0,1\}}{q}_a\text{tr}\left[K_b^{(B)},\otimes ,{\mathbb{I}}_E,{\sigma }_{a,BE},K_b^{(B)†},\otimes ,{\mathbb{I}}_E\right]\text{tr}\left[{\tau }_{ab,E},M_b^{(E)}\right],\end{array}$$ 49

where ${\tau }_{ab,E}$ are defined as

$$\begin{array}{cc}\hfill & {\tau }_{00,E}=\frac{{\eta }_{\mathit{AB}}}{{\eta }_{\mathit{AB}}+\frac{1-{\eta }_{\mathit{AB}}}{2(1-s^2)}}{|0⟩⟨0|}_E+\frac{\frac{1-{\eta }_{\mathit{AB}}}{2(1-s^2)}}{{\eta }_{\mathit{AB}}+\frac{1-{\eta }_{\mathit{AB}}}{2(1-s^2)}}|{\tilde{\psi }}_0⟩⟨{\tilde{\psi }}_0{|}_E,\hfill \\ \hfill & {\tau }_{01,E}=|{\tilde{\psi }}_1⟩⟨{\tilde{\psi }}_1{|}_E,\hfill \\ \hfill & {\tau }_{10,E}=|{\tilde{\psi }}_0⟩⟨{\tilde{\psi }}_0{|}_E,\hfill \\ \hfill & {\tau }_{11,E}=\frac{{\eta }_{\mathit{AB}}}{{\eta }_{\mathit{AB}}+\frac{1-{\eta }_{\mathit{AB}}}{2(1-s^2)}}{|0⟩⟨0|}_E+\frac{\frac{1-{\eta }_{\mathit{AB}}}{2(1-s^2)}}{{\eta }_{\mathit{AB}}+\frac{1-{\eta }_{\mathit{AB}}}{2(1-s^2)}}|{\tilde{\psi }}_1⟩⟨{\tilde{\psi }}_1{|}_E.\hfill \end{array}$$ 50

From Eqs. (48) and (50), the success probability of eavesdropping in Eq. (49) is obtained by Eq. (32).

Secret key rate

In this section, we derive the secret key rate when Eve’s POVM optimizes the success probability of eavesdropping.

Secret key rate of type-I eavesdropping structure

To derive the secret key rate, we need to evaluate entropies H(A), H(B, A), H(E) and H(B, E). For equal prior probabilities (i.e., $q_0=q_1$), H(A) is given by

$$\begin{array}{c}\hfill H(A)=-q_0{log}_2{q}_0-q_1{log}_2{q}_1=1.\end{array}$$ 51

Also, H(B, A) is given by

$$\begin{array}{c}\hfill H(B,A)=-\sum _{a,b\in \{0,1\}}{\tilde{P}}_{\mathit{AB}}(a,b){log}_2{\tilde{P}}_{\mathit{AB}}(a,b),\end{array}$$ 52

where ${\tilde{P}}_{\mathit{AB}}(a,b)$ is a post-processed joint probability between Alice and Bob after Bob discards his inconclusive result:

$$\begin{array}{c}\hfill {\tilde{P}}_{\mathit{AB}}(a,b)=\frac{P_{\mathit{AB}}(a,b)}{{\sum }_{a,b\in \{0,1\}}{P}_{\mathit{AB}}(a,b)},\end{array}$$ 53

and $P_{\mathit{AB}}(a,b)$ is a pre-processed joint probability

$$\begin{array}{c}\hfill P_{\mathit{AB}}(a,b)=q_a\text{tr}\left\{{\mathrm{\Lambda }}^{(A\to B)},(|{\psi }_a⟩,⟨{\psi }_a|),K_b^{(B)†},K_b^{(B)}\right\}=\frac{1}{2}\left\{{\eta }_{\mathit{AB}},{\alpha }_b,{\delta }_{\mathit{ab}},+,\frac{(1-{\eta }_{\mathit{AB}}){\alpha }_b}{2(1-s^2)}\right\}.\end{array}$$ 54

Here, we consider the post-processing that Bob discard his inconclusive result, since this post-processing can enhance unambiguous quantum communication protocol⁵⁹.

Since $q_0=q_1$ implies $u_0=u_1=1-s$ according to Eqs. (39) and (42), the joint probability of Eq. (54) is rewritten by

$$\begin{array}{cc}\hfill P_{\mathit{AB}}(a,b)=& \frac{1}{2}\left\{{\eta }_{\mathit{AB}},(1-s),+,\frac{1-{\eta }_{\mathit{AB}}}{2(1+s)}\right\},\text{if}(a,b)\in \{(0,0),(1,1)\},\hfill \end{array}$$ 55

$$\begin{array}{cc}\hfill P_{\mathit{AB}}(a,b)=& \frac{1-{\eta }_{\mathit{AB}}}{4(1+s)},\text{if}(a,b)\in \{(0,1),(1,0)\}.\hfill \end{array}$$ 56

To evaluate H(B, E) and H(E), we first consider a joint probability $P_{\mathit{ABE}}(a,b,e)$ among Alice, Bob and Eve:

$$\begin{array}{c}\hfill P_{\mathit{ABE}}(a,b,e)=P_{\mathit{AB}}(a,b)P_{E|AB}(e|a,b)=q_a{P}_{B|A}(b|a)P_{E|AB}(e|a,b),\end{array}$$ 57

where $P_{B|A}(b|a)$ and $P_{E|AB}(e|a,b)$ are conditional probabilities.

1. In case of $b\ne ?$, every $|{\gamma }_{\mathit{ab}}⟩$ in Eq. (30) is rewritten by

   $$\begin{array}{c}\hfill |{\gamma }_{\mathit{ab}}{⟩}_E=\frac{1}{\sqrt{P_{B|A}(b|a)}}{\left\{\sqrt{{\eta }_{\mathit{AB}}{\alpha }_b},{\delta }_{\mathit{ab}},|0⟩,+,\sqrt{\frac{(1-{\eta }_{\mathit{AB}}){\alpha }_b}{2(1-s^2)}},|{\tilde{\psi }}_b⟩\right\}}_E,\end{array}$$ 58

   where

   $$\begin{array}{c}\hfill P_{B|A}(b|a)={\eta }_{\mathit{AB}}{\alpha }_b{\delta }_{\mathit{ab}}+\frac{(1-{\eta }_{\mathit{AB}}){\alpha }_b}{2(1-s^2)}.\end{array}$$ 59

   Therefore, $P_{E|AB}(e|a,b)$ is given by

   $$\begin{array}{c}\hfill P_{E|AB}(e|a,b)=⟨{\gamma }_{\mathit{ab}}|M_e^{(E)}|{\gamma }_{\mathit{ab}}⟩=\frac{1}{P_{B|A}(b|a)}\frac{(1-{\eta }_{\mathit{AB}}){\alpha }_b}{2(1-s^2)}{u}_e{\delta }_{\mathit{be}}.\end{array}$$ 60

   Substituting Eq. (60) into $P_{E|AB}(e|a,b)$ of Eq. (57), we obtain

   $$\begin{array}{c}\hfill P_{\mathit{ABE}}(a,b,e)=q_a\frac{(1-{\eta }_{\mathit{AB}}){\alpha }_b}{2(1-s^2)}{u}_e{\delta }_{\mathit{be}},\end{array}$$ 61

   and

   $$\begin{array}{c}\hfill P_{\mathit{BE}}(b,e)=\sum _{a=0}^1{P}_{\mathit{ABE}}(a,b,e)=\frac{(1-{\eta }_{\mathit{AB}}){\alpha }_b}{2(1-s^2)}{u}_e{\delta }_{\mathit{be}},\end{array}$$ 62
2. in case of $b=?$, we provide following equality:

   $$\begin{array}{cc}\hfill K_{?}^{(B)}\otimes {\mathbb{I}}_E|{\mathrm{\Gamma }}_a⟩=& \sqrt{{\eta }_{\mathit{AB}}(1-{\alpha }_0)}{\delta }_{a0}|{\varphi }_0^{(B)}{⟩}_B\otimes {|0⟩}_E+\sqrt{\frac{(1-{\eta }_{\mathit{AB}})(1-{\alpha }_0)}{2(1-s^2)}}|{\varphi }_0^{(B)}{⟩}_B\otimes {|{\tilde{\psi }}_0⟩}_E,\hfill \\ \hfill & +\sqrt{{\eta }_{\mathit{AB}}(1-{\alpha }_1)}{\delta }_{a1}|{\varphi }_1^{(B)}{⟩}_B\otimes {|0⟩}_E+\sqrt{\frac{(1-{\eta }_{\mathit{AB}})(1-{\alpha }_1)}{2(1-s^2)}}|{\varphi }_1^{(B)}{⟩}_B\otimes {|{\tilde{\psi }}_1⟩}_E.\hfill \end{array}$$ 63

   In the same way as Eq. (30), we obtain

   $$\begin{array}{c}\hfill |{\gamma }_{a?}{⟩}_E=\frac{1}{P_{B|A}(?|a)}\sum _{x\in \{0,1\}}{\left\{\sqrt{{\eta }_{\mathit{AB}}(1-{\alpha }_x)},{\delta }_{\mathit{ax}},|0⟩,+,\sqrt{\frac{(1-{\eta }_{\mathit{AB}})(1-{\alpha }_x)}{2(1-s^2)}},|{\tilde{\psi }}_x⟩\right\}}_E.\end{array}$$ 64

   (Since $P_{B|A}(?|a)$ is too complicated, we do not describe it in detail.) Therefore, $P_{E|AB}(e|a,?)$ is given by

   $$\begin{array}{c}\hfill P_{E|AB}(e|a,?)=\frac{1}{P_{B|A}(?|a)}\left\{\frac{(1-{\eta }_{\mathit{AB}})(1-{\alpha }_0)}{2(1-s^2)},u_e,{\delta }_{e0},+,\frac{(1-{\eta }_{\mathit{AB}})(1-{\alpha }_1)}{2(1-s^2)},u_e,{\delta }_{e1}\right\}.\end{array}$$ 65

   Substituting Eq. () into $P_{E|AB}(e|a,b)$ of Eq. (57), we obtain

   $$\begin{array}{c}\hfill P_{\mathit{ABE}}(a,b,e)=q_a\left\{\frac{(1-{\eta }_{\mathit{AB}})(1-{\alpha }_0)}{2(1-s^2)},u_e,{\delta }_{0e},+,\frac{(1-{\eta }_{\mathit{AB}})(1-{\alpha }_1)}{2(1-s^2)},u_e,{\delta }_{1e}\right\},\end{array}$$ 66

   and

   $$\begin{array}{c}\hfill P_{\mathit{BE}}(?,e)=\sum _{a\in \{0,1\}}{P}_{\mathit{ABE}}(a,?,e)=\frac{(1-{\eta }_{\mathit{AB}})(1-{\alpha }_0)}{2(1-s^2)}{u}_e{\delta }_{0e}+\frac{(1-{\eta }_{\mathit{AB}})(1-{\alpha }_1)}{2(1-s^2)}{u}_e{\delta }_{1e},\end{array}$$ 67

Since $q_0=q_1$ implies $u_0=u_1=1-s$ according to Eqs. (39) and (42), the joint probability $P_{\mathit{BE}}(b,e)$ of Eqs. (62) and (67) are rewritten by

$$\begin{array}{cc}\hfill P_{\mathit{BE}}(b,e)=& \frac{(1-{\eta }_{\mathit{AB}})(1-s)}{2(1+s)},\text{if}(b,e)\in \{(0,0),(1,1)\},\hfill \\ \hfill P_{\mathit{BE}}(b,e)=& 0,\text{if}(b,e)\in \{(0,1),(1,0)\},\hfill \\ \hfill P_{\mathit{BE}}(b,e)=& \frac{(1-{\eta }_{\mathit{AB}})s}{2(1+s)},\text{if}(b,e)\in \{(0,?),(1,?)\}.\hfill \end{array}$$ 68

If Eve discard her inconclusive result, the post-processed joint probability is given by

$$\begin{array}{c}\hfill {\tilde{P}}_{\mathit{BE}}(b,e)=\frac{P_{\mathit{BE}}(b,e)}{{\sum }_{b\in \{0,1,?\}}{\sum }_{e\in \{0,1\}}{P}_{\mathit{BE}}(b,e)},\end{array}$$ 69

and a marginal probability ${\tilde{P}}_E(e)$ is given by

$$\begin{array}{c}\hfill {\tilde{P}}_E(e)=\sum _{b\in \{0,1,?\}}{\tilde{P}}_{\mathit{BE}}(b,e).\end{array}$$ 70

Finally, H(E) and H(B, E) are evaluated as

$$\begin{array}{cc}\hfill H(E)=& -\sum _{e\in \{0,1\}}{\tilde{P}}_E(e){log}_2{\tilde{P}}_E(e),\hfill \\ \hfill H(B,E)=& -\sum _{b\in \{0,1,?\}}\sum _{e\in \{0,1\}}{\tilde{P}}_{\mathit{BE}}(b,e){log}_2{\tilde{P}}_{\mathit{BE}}(b,e).\hfill \end{array}$$ 71

Secret key rate of type-II eavesdropping structure

We first note that the prior probabilities and the quantum channel ${\mathrm{\Lambda }}^{(A\to B)}$ are invariant under the choice of structure. Therefore, H(A) and H(B, A) are evaluated as Eqs. (51) and (52) in the type-I structure.

1. In case of $b\ne ?$, every ${\tau }_{ab,E}$ in Eq. (50) is rewritten by

   $$\begin{array}{c}\hfill {\tau }_{ab,E}=\frac{1}{P_{B|A}(b|a)}\left\{{\eta }_{\mathit{AB}},{\alpha }_b,{\delta }_{\mathit{ab}},|0⟩⟨0|,+,\frac{(1-{\eta }_{\mathit{AB}}){\alpha }_b}{2(1-s^2)},|,{\tilde{\psi }}_b,⟩⟨,{\tilde{\psi }}_b,|\right\},\end{array}$$ 72

   where $P_{B|A}(b|a)$ is given by Eq. (59). Moreover, $P_{E|AB}(e|a,b)$ is given by

   $$\begin{array}{c}\hfill P_{E|AB}(e|a,b)=\text{tr}\left\{{\tau }_{ab,E},M_e^{(E)}\right\}=\frac{1}{P_{B|A}(b|a)}\frac{(1-{\eta }_{\mathit{AB}}){\alpha }_b}{2(1-s^2)}{u}_e{\delta }_{\mathit{be}},\end{array}$$ 73

   which is equal to Eq. (60). Therefore, according to Eq. (57), $P_{\mathit{ABE}}(a,b,e)$ is equal to the case of type-I structure.
2. In case of $b=?$, we consider

   $$\begin{array}{cc}\hfill K_{?}^{(B)}\otimes {\mathbb{I}}_E{\sigma }_{a,BE}{K}_{?}^{(B)}\otimes {\mathbb{I}}_E=& {\eta }_{\mathit{AB}}\mathrm{\Gamma }(\sqrt{1-{\alpha }_0}{\delta }_{a0}|{\varphi }_0^{(B)}⟩+\sqrt{1-{\alpha }_1}{\delta }_{a1}|{\varphi }_1^{(B)}⟩)\otimes {|0⟩⟨0|}_E\hfill \\ \hfill +& (1-{\eta }_{\mathit{AB}})\mathrm{\Gamma }\left(\sqrt{\frac{1-{\alpha }_0}{2(1-s^2)}},|,{\varphi }_0^{(B)},⟩\otimes |,{\tilde{\psi }}_0,⟩+,\sqrt{\frac{1-{\alpha }_1}{2(1-s^2)}},|,{\varphi }_1^{(B)},⟩\otimes |,{\tilde{\psi }}_1,⟩\right),\hfill \end{array}$$ 74

   where we define $\mathrm{\Gamma }(|v⟩):=|v⟩⟨v|$ for convenience. From the above representation, we define a bipartite mixed state shared by Bob and Eve:

   $$\begin{array}{cc}\hfill {\tau }_{a?,BE}=& \frac{1}{P_{B|A}(b|a)}[{\eta }_{\mathit{AB}}\mathrm{\Gamma }(\sqrt{1-{\alpha }_0}{\delta }_{a0}|{\varphi }_0^{(B)}⟩+\sqrt{1-{\alpha }_1}{\delta }_{a1}|{\varphi }_1^{(B)}⟩)\otimes {|0⟩⟨0|}_E\hfill \\ \hfill & +(1-{\eta }_{\mathit{AB}})\mathrm{\Gamma }\left(\sqrt{\frac{1-{\alpha }_0}{2(1-s^2)}},|,{\varphi }_0^{(B)},⟩\otimes |,{\tilde{\psi }}_0,⟩+,\sqrt{\frac{1-{\alpha }_1}{2(1-s^2)}},|,{\varphi }_1^{(B)},⟩\otimes |,{\tilde{\psi }}_1,⟩\right)].\hfill \\ \hfill \end{array}$$ 75

   Then, $P_{E|AB}(e|a,?)$ is given by

   $$\begin{array}{cc}\hfill P_{E|AB}(e|a,?)=& \text{tr}\left\{{\tau }_{a?,BE},\left({\mathbb{I}}_B,\otimes ,M_e^{(E)}\right)\right\}\hfill \\ \hfill =& \frac{1}{P_{B|A}(?|a)}\left\{\frac{(1-{\eta }_{\mathit{AB}})(1-{\alpha }_0)}{2(1-s^2)},u_e,{\delta }_{e0},+,\frac{(1-{\eta }_{\mathit{AB}})(1-{\alpha }_1)}{2(1-s^2)},u_e,{\delta }_{e1}\right\}.\hfill \\ \hfill \end{array}$$ 76

   This is equal to Eq. (65), which implies that $P_{A,B,E}(a,b,?)$ is also equal to the case of type-I structure.

From the above calculation, we confirm that H(B, E) and H(E) in this structure is equal to these in the type-I structure, respectively. This leads us to the result that both structures provide same secret key rate.

It is noted that the formalism of the joint probabilities discussed above can also provide the success probability of eavesdropping. This will be further explained in the next section.

Revisiting success probability of eavesdropping in terms of joint probabilities

In the scenario of the new sequential discrimination, Bob’s measurement result b depends on the input a prepared by Alice, and Eve’s measurement result e depends on a and b. From these facts, the joint probability between three parties $P_{\mathit{ABE}}(a,b,e)$ is easily derived by

$$\begin{array}{c}\hfill P_{\mathit{ABE}}(a,b,e)=q_a{P}_{B|A}(b|a)P_{E|AB}(e|a,b)=q_a{P}_{BE|A}(b,e|a),\end{array}$$ 77

where $q_a$ is the prior probability that Alice prepares a, $P_{B|A}(b|a)$ is the conditional probability that Bob obtains b if Alice prepares a, $P_{E|AB(e|a,b}$ is the conditional probability that Eve obtains e if Alice prepares a and Bob obtains b, $P_{BE|A}(b,e|a$ is the conditional joint probability that Bob and Eve obtain b and e if Alice prepares a, and $P_{\mathit{BE}}(b,e)$ is the joint probability that Bob and Eve obtain b and e. Also, the success probability of eavesdropping is derived by

$$\begin{array}{c}\hfill P_s^{(E)}=\sum _{a,b}{q}_a{P}_{B|A}(b|a)P_{E|AB}(e=b|a,b)=\sum _{a,b}{q}_a{P}_{BE|A}(b,e=b|a)=\sum _b{P}_{\mathit{BE}}(b,e=b).\end{array}$$ 78

It is noted that the expression of the success probability of eavesdropping in Eq. (78) is used for deriving the success probability of eavesdropping when Alice, Bob, and Eve performs the scenario by using the imperfect linear optical technologies.

Author contributions

M.N. and Y.K. conceived the main idea and wrote this manuscript. M.N. performed main calculation in this manuscript and analyzed the theoretical results. Y.K. discussed the analyzed results and improved this manuscript. All authors read and approved the final manuscript.

Data availability

Te datasets used and analysed during the current study available from the corresponding author on reasonable request.

Competing interests

The authors declare no competing interests.