## Abstract

We introduce a novel time-frequency quantum key distribution (TFQKD) scheme based on photon pairs entangled in these two conjugate degrees of freedom. The scheme uses spectral detection and phase modulation to enable measurements in the temporal basis by means of time-to-frequency conversion. This allows large-alphabet encoding to be implemented with realistic components. A general security analysis for TFQKD with binned measurements reveals a close connection with finite-dimensional QKD protocols and enables analysis of the effects of dark counts on the secure key size.

© 2013 Optical Society of America

## 1. Introduction

Light and matter are ultimately constituted of quantum entities, so that the limitations of technology cannot be prescribed by the principles of classical physics. Quantum-optical devices promise better-than-classical performance in sensing [1, 2], computation [3–5] and, in particular, communications [6, 7]. Quantum effects in optical systems are easily observed at room temperature because thermal background radiation at optical frequencies is negligible. Light has numerous degrees of freedom that can be co-opted for the transmission of quantum information, and optical signals can be generated and detected efficiently. Modern telecommunications leverage the very large capacity of optical fields via dense multiplexing techniques, and the efficiency of quantum information processing can be similarly enhanced with the use of large-alphabet encoding strategies. In this connection, time-frequency encoding offers numerous advantages over polarisation or spatial-mode encodings, since multiple spectral modes are supported in waveguides and optical fibres with minimal dispersion, and zero cross-talk. For this reason, large-alphabet spectral-temporal multiplexing in quantum optics has recently received growing attention [8, 9], with immediate applications in *quantum key distribution* (QKD) [10–12].

Public key cryptography underpins much of commerce today [13], but it is threatened by the advanced computational tools made possible by quantum information processing. Although a quantum computer remains many years away, the threat is sufficient to motivate the search for security that is immune to a quantum adversary. Quantum key distribution [14] provides this security, and in the three decades since the first proposals were made based on polarized photons [15], it has developed into both a burgeoning industry [16], and a diverse research field [17–20]. While polarisation states are vulnerable to corruption in waveguides and optical fibres, the arrival time of photons is a more robust encoding [21]. In general, transmission losses limit the range of QKD, but the use of entangled photons [22] allows the distance to be extended by means of quantum repeaters [23, 24], which employ entanglement swapping between short segments to distribute secure correlations over large distances.

These considerations motivate the study of QKD with photon pairs entangled in their chrono-cyclic degree of freedom [8, 25–30]. The security of such time-frequency QKD (TFQKD) protocols is based on the ability to detect non-classical correlations in at least two complementary measurement bases, and these bases should be mutually unbiased (*i.e.* Fourier conjugates of one another) to maximise the sensitivity of the measured correlations to intrusion by an eavesdropper. Time and frequency domain detection provides a particularly convenient conjugate pair both because time- and frequency-resolving measurements are mature technologies, and because photon sources based on parametric scattering, such as spontaneous downconversion or four-wave mixing naturally produce photon pairs with widely-tunable correlation properties ranging from uncorrelated emission [31, 32] to extremely broadband spectral entanglement [33–35]. However, accessing the large entropy of these photon pairs requires precise measurements in both time and frequency bases, which is a non-trivial problem because of technical constraints on the timing jitter of photon detectors and the resolution of spectrometers.

Recently it was proposed to use fast time-resolving photon detectors to record the correlated arrival times of entangled photons, and to insert a dispersive medium before the detectors to measure in the frequency basis [10]. The dispersion delays each spectral component of the incident photons differently, converting the arrival time at the detector into a frequency measurement [36]. This protocol has the advantage that a single detector can sample a large region in chronocyclic space [37]. However the timing jitter of the detector sets a lower limit to the correlation time of the photon pairs. Fast detectors are not yet efficient [38, 39], whereas efficient detectors are generally slower [40–42], so with current technology the spectral correlations should be very narrowband in order for the arrival-time correlations to extend over a long enough period to be resolved by the detectors. Besides the challenges of engineering a bright photon source to fit these criteria, the narrow bandwidth also means that extremely dispersive media are required to implement the frequency measurements, which are generally lossy.

Here we introduce an alternative large-alphabet entangled TFQKD protocol that is dual to [10]. We propose to use spectral measurements to detect frequency correlations, and to use phase modulators to convert these measurements to the time basis. We show that with this detection scheme it is feasible to demultiplex up to 4 bits per photon with readily available components, while technical advances — essentially improving the power dissipation of electro-optical phase modulators to allow larger modulation depth — could allow much larger alphabets. While chronocyclic entanglement produces correlations between the continuous variables of arrival time and frequency, measurements inevitably map these correlations to a set of discrete outcomes. We provide a security analysis that accounts for the effects of this detector-binning, and we model the constraints on the secure key arising from dark counts.

## 2. The protocol

Key distribution aims at generating a pair of correlated random bit strings shared exclusively by two parties — conventionally called *Alice* and *Bob* — that can be used to encrypt and decrypt communications by means of a *one time pad*[43]. In our TFQKD protocol, Alice and Bob construct correlated bit strings by recording the results of joint measurements on pairs of spectrally entangled photons. The entanglement produces correlations in both the frequencies and the arrival times of the photons which are destroyed if the system is measured by a third party. Uncorrelated measurement results therefore reveal the presence of an eavesdropper (*Eve*) when Alice and Bob compare a subset of their bits. We consider the set-up sketched in part (a) of Fig. 1, in which the measurement basis at each party is selected randomly by a 50:50 beam splitter. Transmitted photons are directed to a spectrometer, and reflected photons are directed to an apparatus that measures their arrival time by means of a time-to-frequency converter (see below) followed by another spectrometer. After publicly revealing their measurement bases, but not their measurement outcomes, Alice and Bob generate a sifted key by rejecting measurement outcomes that were recorded with incommensurate bases. Some fraction [44] of the sifted key is then shared so that Alice and Bob can estimate the error probability in the sifted key: provided the errors are low enough, this allows Alice and Bob to generate a reduced key with certified security.

#### 2.1. Source

As shown in Fig. 1, a parametric source (which may or may not be under the control of Eve) produces photon pairs in the entangled state (ignoring for the moment the emission of vacuum or double pairs)

*ω*,

*ω′*〉 indicates a photon pair received by Alice and Bob with frequencies

*ω*+

*ω*

_{0}and

*ω′*+

*ω*

_{0}, respectively, with

*ω*

_{0}the central frequency of the pair. Here

*f*(

*ω*,

*ω′*) is the joint spectral amplitude describing the frequency correlations between a photon pair emitted with detunings

*ω*,

*ω′*from degeneracy. In general, energy conservation and phasematching considerations produce non-factorable joint spectra,

*f*(

*ω*,

*ω′*) ≠

*f*

_{A}(

*ω*)

*f*

_{B}(

*ω′*) [45,46], and the degree of entanglement — the number of correlated spectral modes — is conveniently quantified by the

*Schmidt number*$K=1/{\sum}_{j}{\lambda}_{j}^{4}$, where the {

*λ*} are the singular values of

_{j}*f*[47]. Broad spectral entanglement with

*K*∼ 10

^{3}has been observed [33] and routes to extremely multimode emission with

*K*∼ 10

^{7}have been proposed [35]. Therefore although source engineering is non-trivial, it is already possible to produce photon pairs with a high degree of quantum correlations. As discussed above, the primary challenge for implementing TFQKD lies with the detection scheme.

#### 2.2. Frequency measurements

In our protocol, Alice and Bob each have a photon-counting spectrometer, which they use to measure the frequencies of their photons. A photon entering one of the spectrometers is spatially dispersed and then directed towards one of *M* photon counting detectors, such that a ‘click’ at the *j*^{th} detector (*j* = 1, 2,...,*M*) is described by a projective positive operator-valued measure (POVM) element

*F*is the instrument response that represents the finite resolution of the spectrometer — that is, the range of frequencies coupled to the

_{j}*j*

^{th}detector. For simplicity in the calculations below we will assume a ‘top hat’ profile [48]

*ω*=

_{j}*ω*

_{0}+ [

*j*− (

*M*+ 1)/2]

*δω*. This describes a spectrometer with a resolution

*δω*and a flat response to all frequencies in the range

*ω*

_{0}− Δ

*ω*/2 ≤

*ω*≤

*ω*

_{0}+ Δ

*ω*/2, where Δ

*ω*=

*Mδω*. This description would be appropriate for a grating spectrometer equipped either with a photon counting charge-coupled device (CCD), or a v-groove array of fibres coupled to Geiger-mode avalanche photodiodes (APDs), for example [49]. The entanglement of the state in Eq. (1) will cause correlated clicks at the outputs of Alice’s and Bob’s spectrometers, which they can use to generate a cryptographic key. The frequency measurements have

*M*possible outcomes, so that a detection event can extract up to a maximum of

*I*= log

_{M}_{2}

*M*bits of information from each photon pair.

#### 2.3. Arrival time measurements

To certify the security of their key, they need to also check that the arrival times of the photons are correlated. As mentioned previously, the large timing jitter (≳ 200 ps for APDs) of efficient photon-counting detectors makes it challenging to resolve the temporal correlations directly. Instead, we propose to implement measurements in the time basis by sending each photon through a *time-to-frequency converter*[50–52]. As shown in Fig. 1, this comprises a dispersive element followed by a phase modulator, the combined effect of which is to implement a Fourier transform on the incident waveform, thus converting time to frequency. The effect is rigorously analogous to a spatial Fourier transform implemented on the transverse profile of a light field using a lens followed by free-propagation over a distance equal to its focal length. To see how this works, consider first the effect of the phase modulator on an incoming field (analogous to free propagation alone). The modulator imprints a sinusoidally time-varying [53] phase *ϕ*(*t*) = *A*cos(Ω*t*) with amplitude *A* and angular frequency Ω. Near the peak of the modulation at *t* ≈ 0 the phase has a quadratic time dependence *ϕ*(*t*) ≈ −*A*Ω^{2}*t*^{2}/2 = − *ϕ̈t*^{2}/2, where we have defined *ϕ̈* = *A*Ω^{2} and we dropped an unimportant global phase. The time-dependent amplitude *E*(*t*) of the incident field is transformed to *E*(*t*)exp{i*ϕ̈t*^{2}/2}, which in frequency space induces a transformation analogous to the Fresnel-Kirchhoff diffraction formula,

*group velocity*dispersion, which imparts a spectral phase

*φ*(

*ω*) = −

*φ″ω*

^{2}/2 (analogous to a lens). Inserting this phase and multiplying out the Gaussian exponent in Eq. (4), the full transformation becomes

*φ″*= 1/

*ϕ̈*corresponds to the

*spectral Fraunhofer limit*[55] in which the quadratic phase factor in the integrand of Eq. (5) is removed, and the transformation is then operationally identical to a Fourier transform (the analogous cancellation of Fresnel diffraction in the focal plane of a lens is well-known). That is, any measurement of the spectral intensity of the transformed field is equivalent to a measurement of the temporal intensity — the

*arrival time*— of the input field, described by the POVM element

*δt*=

*δω/ϕ̈*, where

*δω*is the spectral resolution of the photon-counting spectrometer, as described above. Note that this is independent of the timing jitter of the photon counters used to register the photons. Like an ordinary spatial lens, the time lens has a finite aperture

*τ*, which is the region in time over which the phase modulation remains quadratic. To a good approximation this is given by

*τ*= 1/Ω [50]. This sets a limit to how fast the modulator can be run, since the signals to be detected must pass through the aperture within this time window.

Having described how to implement temporal measurements, we consider the parameters required for an effective TFQKD protocol using our approach. As an idealised example, we assume a Gaussian correlated joint spectrum of the form [56, 57]

_{+}, Δ

_{−}are the marginal and correlation bandwidths, respectively. The Schmidt number is given by 2

*K*= Δ

_{+}/Δ

_{−}+ Δ

_{−}/Δ

_{+}, which is roughly the ratio of the major and minor widths of the joint spectrum (see Fig. 1). This coincides with the intuition that the number of correlated modes is found by dividing up the joint spectrum and counting the number of bins of width roughly equal to the correlation bandwidth Δ

_{−}. To access these correlated modes with our detectors, we engineer the source such that Δ

_{−}=

*β*

_{−}

*δω*and Δ

_{+}=

*β*

_{+}Δ

*ω*, where the constants

*β*

_{±}are chosen so that the spectral resolution roughly matches the correlation bandwidth, and the spectral response covers the full width of the joint spectrum. For example, the choice

*β*

_{+}= 3/4 yields a reasonably flat marginal probability distribution across all detection channels, while choosing

*β*

_{−}= 1/5 provides sufficiently tight correlations that cross-talk between channels is negligible.

The correlations in the time domain are determined by the joint temporal amplitude *f̃*(*t,t′*), which is the two-dimensional Fourier transform of the joint spectral amplitude, *f* (*ω*,*ω′*). The form assumed in Eq. (9) is convenient because *f̃*(*t,t′*) is again a correlated Gaussian as shown in Fig. 1, with major and minor temporal widths given by *T*_{±} = 1/Δ_{∓}. If we require the same ability to resolve temporal correlations as spectral correlations, we should have a temporal resolution *δt* = *T*_{−}/*β*_{−}, which fixes the modulator phase curvature to be

*τ*≥

*T*

_{+}, which limits the modulator frequency to Since the modulation frequency is restricted, the modulation depth

*A*must be large enough to achieve the required phase curvature. The demands on the modulation depth are minimised by matching the modulator frequency and the spectrometer resolution to achieve equality in the above condition. This can be achieved with modern GHz-bandwidth modulators and a relatively modest grating spectrometer. For instance, using the choices for

*β*

_{±}introduced above, a 50 GHz modulator could be used with a 2 nm-resolution spectrometer and telecoms-band photons. Operating at this limit, the modulation depth required to implement the time lens is This is a relatively demanding condition: the modulation depth must rise in proportion to the number of frequency bins used for the QKD protocol. That is, exponentially in the number of bits carried by each photon pair. However modulation depths of order 20

*π*radians are feasible with lithium-niobate modulators [58], which would allow

*M*= 16 (an alphabet size of

*I*= 4 bits per photon pair). We note finally that the dispersion required to reach the Fraunhofer limit in this example would be provided by ∼220 m of ordinary silica fibre, with a GVD on the order of 300 fs

_{M}^{2}cm

^{−1}. Such a short length of fibre would introduce very small losses.

## 3. Security

The output of TFQKD is a digital bit string, as for all QKD protocols, but this is extracted from measurements on continuous degrees of freedom. Therefore it is not immediately obvious whether a security analysis developed for discrete-variable QKD protocols can be applied. To examine the security of TFQKD with entangled photons, we adapt arguments developed for spatially-encoded QKD [59] to the case of finite detector resolution [60–65]. To proceed, we consider the correlations revealed by the sifted joint probability distribution {
${p}_{ba}^{\text{BA}}$} describing the probability of Bob’s *b*^{th} detector firing along with Alice’s *a*^{th} detector, when both measure in the frequency basis. These correlations are quantified by the *mutual information I _{BA}*,

*I*is the mutual information between Bob and Eve [66]. We can calculate

_{BE}*I*

_{BA}from the statistics of Alice’s and Bob’s measurements but

*I*

_{BE}is not known and must be bounded by analyzing the correlations in the complementary (temporal) basis. To proceed, we write the mutual information in the form

*I*

_{XY}=

*H*

_{X}−

*H*

_{X|Y}[59], where ${H}_{\text{X}}=-{\sum}_{x}{p}_{x}^{\text{X}}{\text{log}}_{2}{p}_{x}^{\text{X}}$ is the marginal entropy and where the conditional entropy is given by

*x*

^{th}detector of party X fires, given that the

*y*

^{th}detector of party Y fires. We then obtain Next we need to find a lower bound for

*H*

_{B|E}. To do this, we note that the variability of Bob’s measurement results in time and frequency are restricted by Heisenberg’s uncertainty principle. More generally, if Bob receives an arbitrary quantum state

*ρ*, the marginal entropies

*H*

_{B}(

*ρ*) (

*H̃*

_{B}(

*ρ*)) for Bob’s measurements in frequency (time), satisfy the entropic uncertainty relation where

*B*is a number that depends only on Bob’s measurements, not on the state

*ρ*. Alice’s and Eve’s measurements on the state emitted by the source produce a conditional state

*ρ*

_{B|A=}

_{a,}_{E=}

*at Bob’s detectors, so that we have*

_{e}*H*

_{B}(

*ρ*

_{B|A=}

_{a,}_{E=}

*) =*

_{e}*H*

_{B|A=}

_{a,}_{E=}

*, using a natural tripartite extension of the notation in Eq. (14). Substituting this conditional state into Eq. (16) and averaging over the possible outcomes of Alice’s and Eve’s measurements, we obtain Now, since uncertainty (entropy) is only increased by removing a “given” precondition from a conditional distribution, we can remove Alice as a given from the first conditional entropy, and Eve as a given from the second, to get Inserting this into Eq. (15) gives The formula for the entropic bound is where $C={\text{max}}_{jk}{\Vert {\mathrm{\Pi}}_{j}^{1/2}{\tilde{\mathrm{\Pi}}}_{k}^{1/2}\Vert}_{\infty}$, with ||*

_{e}*A*||

**denoting the largest singular value of the operator**

_{∞}*A*[60, 67, 68]. This bound is how the complementarity of the temporal/spectral measurement bases underpins the security of the key. As shown in Appendix A,

*C*is well approximated by the quantity $\sqrt{\delta \omega \delta t/2\pi}$, so that finally the size of the secret key is

*H*

_{B}of the measurements (since

*H*

_{B|E}≤

*H*

_{B}). That is, regardless of the measurement precision, the secret key cannot exceed the entropy of Bob’s marginal statistics. This is in turn bounded from above by

*H*

_{B}≤

*I*= log

_{M}_{2}

*M*, which is the maximum information content for

*M*-outcome measurements. By design

*M*= (

*β*

_{+}/2

*β*

_{−})

*K*is roughly equal to the Schmidt number of the source, to within a factor on the order of unity. With appropriate choices of

*β*

_{±}and for sufficiently resolving measurements (such that

*δωδ*

*t*∼

*M*

^{−1}), this protocol can therefore be efficient in terms of the information extracted from the quantum states it consumes as a resource. For the modulation scheme described above, we have

*δt*=

*δω/ϕ̈*, which along with Eq. (10) indeed yields

*δωδt*= (

*β*

_{+}

*β*

_{−}

*M*)

^{−1}. However we note that Eq. (21) is a general expression for the size of the secret key for a TFQKD protocol with arbitrary finite resolution in both the time and frequency bases, which is not specific to our proposed modulation scheme and makes no assumptions about the form of the state produced by the source, or the power of Eve’s interventions.

## 4. Practical considerations

So far we have considered the security of finite-resolution measurements on photon-pair states, but the real photonic states emitted by a parametric source contain dominant contributions from vacuum (no photons emitted), and smaller contributions from multi-pair emission (most significantly, four photons emitted instead of two). Multi-pair emission does not necessarily represent a security threat, since in general the spectral correlations of the source are strictly pair-wise, meaning that Eve cannot glean extra information by ‘splitting off’ extraneous photons. However our security proof is based on a representation of the POVMs in the Hilbert space spanned by a single photon impinging on each detector. The proof is therefore only approximate, but *squashing protocols* have been proposed for qubit-based QKD to deal with the effects of multi-pair emission [69], and a similar idea could be used here by randomly assigning measurement outcomes whenever more than one detector in an array fires.

Alice and Bob can remove the influence of the vacuum components by post-selecting on joint detection events, and this also allows the protocol to run when the channel transmission and detector efficiencies are less than unity. For Alice and Bob to use postselection, they must employ spectral filters and temporal gates that prevent signals entering their detectors with spectral or temporal components outside the range of their measurements. To see why, suppose that Eve is capable of performing a very precise projective (non-destructive) frequency measurement on Bob’s photon. If he goes on to measure in the frequency basis, he will get the same result as Eve, and if Alice also used the frequency basis, this measurement result will form part of the sifted key. However, if Bob makes a temporal measurement without any time gate, the narrow-band photon produced by Eve’s measurement will fall mostly outside of Bob’s detection range in the time domain, and so will not be detected. Alice and Bob therefore discount this event, since they are post-selecting events where both parties receive a photon. *Mutatis mutandis* Eve can make the same kind of intercept-resend attack in the temporal basis. In this way, Eve can gain perfect knowledge of the sifted key, while forcing Alice and Bob to ignore those events where she failed to choose the correct measurement basis. Alice and Bob can prevent this attack by always rejecting photons occupying regions of chronocyclic space outside the sensitivity regions of their detectors, by means of spectral filters and temporal gates [25]. In our proposed protocol this could be accomplished with a combination of a dielectric stack and a Pockels cell preceding each of Alice’s and Bob’s detection systems. See [64] for a more general discussion of the effects of finite detection range on entanglement verification.

With postselection as described above, non-unit efficiencies and losses do not directly affect the security, but they reduce the key exchange rate which increases the fraction of uncorrelated dark counts. As is the case with all other QKD protocols, the increasingly important role of dark counts as channel losses grow ultimately limits the distance over which TFQKD can be run securely [10, 59, 70]. To analyse this limitation we consider a simple error model in which the source joint spectrum produces perfect correlations at Alice’s and Bob’s detectors, while random errors occur with probability *p* in either the time or frequency measurements, so that

*p′*=

*Mp*/(

*M*− 1). With a dark count probability

*d*for each of the

*M*detectors in any given run of the photon source, the error probability is found to be (see Appendix B),

*η*=

*η*

_{chan}

*η*

_{d}, with

*η*

_{chan}=

*e*

^{−L/Latt}the transmission through a quantum channel of length

*L*and attenuation length

*L*

_{att}and

*η*

_{d}the overall detector efficiency, assuming Alice and Bob have identical equipment. We have also introduced the photon-pair emission probability

*ε*such that the quantum state emitted by the source is approximately given by $|0\u3009+\sqrt{\epsilon}|\psi \u3009$, with |0〉 the vacuum state and |

*ψ*〉 given in Eq. (1) (see part (a) of Fig. 2). Note that in a typical implementation with

*M*≫ 1 and {

*η*,

*ε*} ≪ 1, with a small dark count probability

*d*≪

*ηε/M*, we have

*p′*≈

*p*≈ 2

*Md/*

*η*. With the error model in Eq. (22) the conditional entropies are both given by

*h*(

*x*) = −

*x*log

_{2}

*x*−(1−

*x*)log

_{2}(1−

*x*) is the binary entropy. Substituting these expressions into Eq. (21), using

*δωδt*= 1/

*β*

_{+}

*β*

_{−}

*M*, one obtains where we have defined the ‘binning deficit’

*c*= −log

_{2}(2

*πβ*

_{+}

*β*

_{−}). The security condition

*I*≥ 0 is of the same form as that derived in [71], which considered QKD with finite dimensional quantum systems [72, 73]. Therefore we see that TFQKD, based on the continuous chronocyclic degree of freedom, can be treated as a finite-dimensional QKD protocol, with a small correction factor represented by

*c*, that takes account of the choices made in binning the measurements.

A realistic joint spectrum, as approximated in Eq. (9), will not exactly produce the simplified delta-correlated outcome distribution in Eq. (22); in general there will be some finite cross-talk between adjacent detection channels and a Gaussian-like variation in the marginal detection probabilities. However we have verified numerically, using Eq. (9), that the choices *β*_{+} = 3/4, *β*_{−} = 1/5, which we introduced previously, generate *H*_{B} ≈ *I _{M}*, and agree with Eq. (24), to within 0.05 bits, so that Eq. (25) is approximately correct even for a source with a realistic joint spectral amplitude.

Part (b) of Fig. 2 shows the variation of the secure key size *I* on the size *I _{M}* of the alphabet for a typical implementation with APD-type detectors and a channel length with

*L*=

*L*

_{att}, assuming the values of

*β*

_{±}used previously. The secure key initially grows in proportion to the alphabet, albeit with a magnitude reduced by the binning deficit

*c*≈ 0.086 bits. Here the deficit is small enough that exchanging up to 4 secure key bits per detected photon pair remains feasible with the components described previously. However for

*I*

_{M}> 11 (

*i.e. M*> 2048) the secure key decreases and rapidly falls to zero, since the dark count rate from the growing number of detectors causes significant errors that are attributed to Eve.

Part (c) of Fig. 2 shows how the secure key falls off with distance. Here the secret key decays more rapidly with distance for the large alphabet protocols because of increased dark counts. This calculation exemplifies a natural technical trade-off in TFQKD, where information can be extracted rapidly from photon pairs using detector arrays as we propose here, whereas single-detector protocols extract less information per registered photon pair, but are affected much less by dark counts [10].

## 5. Conclusion

We have described an implementation of highly multiplexed time-frequency quantum key distribution using photon-counting spectrometers and phase modulators to implement frequency and arrival-time measurements on pairs of spectrally correlated photons by means of time-to-frequency conversion. We analysed the technical demands required for such a protocol and found that a large-alphabet detection system is feasible with commercially-available components. We developed a general security analysis for continuous-variable QKD protocols with binned measurement results, and applied it to our protocol to model the effects of dark counts on the size of the secure key. The protocol we presented is one of a family of time-frequency protocols well suited to transmission using waveguides and optical fibres, where spatial or polarisation mode encoding is vulnerable to cross-talk and differential scattering losses. Highly multimode quantum light sources are now a well-developed technology, and the use of entangled beams allows the communication distance to be extended via entanglement swapping with quantum repeaters. Our measurement scheme based on phase modulation represents a compact and technically straightforward way to demultiplex a large-alphabet key from a multimode entangled light source, which is a convenient source of correlations that removes the need for an active encoding step. The security analysis we presented shows how the protocol can be treated as a finite-dimensional QKD scheme, despite the continuous nature of the chronocyclic degree of freedom. We anticipate that these results will influence the next generation of quantum cryptographic systems.

## A. Entropic uncertainty relation for finite-resolution measurements

As described in the main text, the complementarity of non-commuting measurements {Π_{j}}, {Π̃* _{k}*} is manifested by the entropic uncertainty relation in Eq. (16), with the bound
$B=-2{\text{log}}_{2}{\text{max}}_{jk}{\Vert {\mathrm{\Pi}}_{j}^{1/2}{\tilde{\mathrm{\Pi}}}_{k}^{1/2}\Vert}_{\infty}$. To compute the singular values of the product
${\mathrm{\Pi}}_{j}^{1/2}{\tilde{\mathrm{\Pi}}}_{k}^{1/2}$ we first note that the square-roots can be dropped because for the top-hat-shaped frequency bins defined in Eq. (3) we have

*F*(

*ω*)

^{1/2}=

*F*(

*ω*). We therefore consider the singular values of the operator

*e*

^{−iωk(ω′−ω″)/ϕ̈}can be dropped since this represents a unitary transformation that does not affect the singular values. Similarly the index

*j*on

*F*is arbitrary since this parameterises a shift in the position of the top-hat function that again does not affect the singular values. The singular values are thus obtained by considering the Schmidt decomposition of the two-dimensional function

_{j}*ω′,ω″*) ≈

*λf*(

*ω′*)

*g*(

*ω″*), where

*f*(

*ω′*) is a mode function with width

*δω*,

*g*(

*ω*

*″*) is a mode function with width 2

*π*

*ϕ̈/*

*δω*, and

*δω*/(2

*πϕ̈/δω*) < 0.1, which is guaranteed by Eq. (10) for a large-alphabet protocol with

*M*≫ 1/

*β*

_{+}

*β*

_{−}. Here we note that even though this approximation breaks down for smaller alphabets, we have checked numerically that the formula in Eq. (21) in the main text can still be used, since the condition

*I*≤

*H*

_{B}becomes saturated. Substituting Eq. (28) into Eq. (20) and using

*δt*=

*δω/ϕ̈*, we obtain the bound on the secret key given in Eq. (21). We note that the resulting bound applies quite generally to any TFQKD protocol employing binned frequency and time measurements with resolutions

*δω*,

*δt*.

## B. Dark count error probability

The error probability *p* is given by [71]

*P*

_{correct},

*P*

_{incorrect}are the probabilities for recording correlated and uncorrelated detector clicks, respectively. Alice and Bob postselect on single clicks at each side, so only events where one detector fires each are counted. We make the simplifying assumption that if both photons from a photon pair are successfully emitted and detected, without a dark count occurring in any other channel, then the two registered outcomes are perfectly correlated. If these photons are not registered, but dark counts occur, it is possible that the outcomes are incorrectly correlated. Taking into account all possibilities yields

*x̄*= 1−

*x*denotes the probabilistic complement. The common factor of

*d̄*

^{2(M−1)}represents the probability that there is no dark count in the

*M*− 1 remaining bins on each side, and this factor cancels out in the expression for

*p*. After some algebra, one obtains the expressions in Eq. (23).

## Acknowledgments

The authors gratefully acknowledge helpful discussions with M. G. Raymer, S. J. van Enk and N. K. Langford in the initial stages of this work. BJS was supported by the University of Oxford John Fell Fund and EPSRC grant No. EP/E036066/1. JN and IAW were supported by EPSRC grant No. EP/J000051/1.

## References and links

**1. **J. Rarity, P. Tapster, J. Walker, and S. Seward, “Experimental demonstration of single photon rangefinding using parametric downconversion,” Appl. Opt. **29**, 2939–2943 (1990) [CrossRef] [PubMed] .

**2. **A. Datta, L. Zhang, N. Thomas-Peter, U. Dorner, B. J. Smith, and I. A. Walmsley, “Quantum metrology with imperfect states and detectors,” Phys. Rev. A **83**, 063836 (2011) [CrossRef] .

**3. **P. Shor, “Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer,” Appl. Math. J. Comp **26**, 1484–1509 (1997).

**4. **B. P. Lanyon, T. J. Weinhold, N. K. Langford, M. Barbieri, D. F. V. James, A. Gilchrist, and A. G. White, “Experimental demonstration of a compiled version of Shor’s algorithm with quantum entanglement,” Phys. Rev. Lett. **99**, 250505 (2007) [CrossRef] .

**5. **E. Martin-Lopez, A. Laing, T. Lawson, R. Alvarez, X.-Q. Zhou, and J. L. O’Brien, “Experimental realization of Shor’s quantum factoring algorithm using qubit recycling,” Nat. Photonics **6**, 773–776 (2012) [CrossRef] .

**6. **A. Muller, T. Herzog, B. Huttner, W. Tittel, H. Zbinden, and N. Gisin, ““Plug and play” systems for quantum cryptography,” Appl. Phys. Lett. **70**, 793–795 (1997) [CrossRef] .

**7. **J. H. Shapiro, “Defeating passive eavesdropping with quantum illumination,” Phys. Rev. A **80**, 022320 (2009) [CrossRef] .

**8. **A. Hayat, X. Xing, A. Feizpour, and A. M. Steinberg, “Multidimensional quantum information based on single-photon temporal wavepackets,” arXiv:1212.1483 (2012).

**9. **P. Rohde, J. Fitzsimons, and A. Gilchrist, “The information capacity of a single photon,” arXiv:1211.1427 (2012).

**10. **J. Mower, Z. Zhang, P. Desjardins, C. Lee, J. H. Shapiro, and D. Englund, “High-dimensional quantum key distribution using dispersive optics,” arXiv:1210.4501 (2012).

**11. **Z. Chang-Hua, P. Chang-Xing, Q. Dong-Xiao, G. Jing-Liang, C. Nan, and Y. Yun-Hui, “A new quantum key distribution scheme based on frequency and time coding,” Chin. Phys. Lett. **27**, 090301 (2010) [CrossRef] .

**12. **B. Qi, “Single-photon continuous-variable quantum key distribution based on the energy-time uncertainty relation,” Opt. Lett. **31**, 2795–2797 (2006) [CrossRef] [PubMed] .

**13. **S. Galbraith, *Mathematics of public key cryptography* (Cambridge University, 2012) [CrossRef] .

**14. **N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, “Quantum cryptography,” Rev. Mod. Phys. **74**, 145–195 (2002) [CrossRef] .

**15. **C. Bennett and G. Brassard, “Quantum cryptography: Public key distribution and coin tossing,” Proceedings of IEEE International Conference on Computers, Systems and Signal Processing 175–179 (1984).

**16. **“MagiQ (http://magiqtech.com), ID Quantique (www.idquantique.com), QuintessenceLabs (qlabsusa.com), Toshiba (http://www.toshiba-europe.com/research/crl/qig/quantumkeyserver.html),”.

**17. **D. Simon, N. Lawrence, J. Trevino, L. Negro, and A. Sergienko, “Quantum key distribution with Fibonacci orbital angular momentum states,” arXiv:1206.3548 (2012).

**18. **D. Gauthier, H. Guilbert, Y. Zhu, M. Shi, K. McCusker, B. Christensen, P. Kwiat, T. Brougham, S. Barnett, and V. Chandar, “Quantum key distribution using hyperentanglement,” in “*Quantum Information and Measurement*,” (Optical Society of America, 2012).

**19. **S. Braunstein and S. Pirandola, “Side-channel-free quantum key distribution,” Phys. Rev. Lett. **108**, 130502 (2012) [CrossRef] [PubMed] .

**20. **H. Lo, M. Curty, and B. Qi, “Measurement-device-independent quantum key distribution,” Phys. Rev. Lett. **108**, 130503 (2012) [CrossRef] [PubMed] .

**21. **N. Gisin, G. Ribordy, H. Zbinden, D. Stucki, N. Brunner, and V. Scarani, “Towards practical and fast quantum cryptography,” arXiv:0411022 (2004).

**22. **A. K. Ekert, “Quantum cryptography based on Bell’s theorem,” Phys. Rev. Lett. **67**, 661–663 (1991) [CrossRef] [PubMed] .

**23. **L. Duan, M. Lukin, J. Cirac, and P. Zoller, “Long-distance quantum communication with atomic ensembles and linear optics,” Nature **414**, 413–418 (2001) [CrossRef] [PubMed] .

**24. **E. Saglamyurek, N. Sinclair, J. Jin, J. Slater, D. Oblak, F. Bussières, M. George, R. Ricken, W. Sohler, and W. Tittel, “Quantum memory for quantum repeaters,” in “*International Quantum Electronics Conference*,” (Optical Society of America, 2011).

**25. **B. Qi, “Quantum key distribution based on frequency-time coding: security and feasibility,” arXiv:1101.5995 (2011).

**26. **J. Mower, F. Wong, J. H. Shapiro, and D. Englund, “Dense wavelength division multiplexed quantum key distribution using entangled photons,” arXiv:1110.4867v1 (2011).

**27. **I. Ali-Khan and J. C. Howell, “Experimental demonstration of high two-photon time-energy entanglement,” Phys. Rev. A **73**, 031801 (2006) [CrossRef] .

**28. **H. Takesue, K. Harada, K. Tamaki, H. Fukuda, T. Tsuchizawa, T. Watanabe, K. Yamada, and S. Itabashi, “Long-distance entanglement-based quantum key distribution experiment using practical detectors,” Opt. Express **18**, 16777–16787 (2010) [CrossRef] [PubMed] .

**29. **I. Ali-Khan, C. J. Broadbent, and J. C. Howell, “Large-alphabet quantum key distribution using energy-time entangled bipartite states,” Phys. Rev. Lett. **98**, 060503 (2007) [CrossRef] [PubMed] .

**30. **L. Olislager, J. Cussey, A. T. Nguyen, P. Emplit, S. Massar, J.-M. Merolla, and K. P. Huy, “Frequency-bin entangled photons,” Phys. Rev. A **82**, 013804 (2010) [CrossRef] .

**31. **P. J. Mosley, J. S. Lundeen, B. J. Smith, P. Wasylczyk, A. B. U’Ren, C. Silberhorn, and I. A. Walmsley, “Heralded generation of ultrafast single photons in pure quantum states,” Phys. Rev. Lett. **100**, 133601 (2008) [CrossRef] [PubMed] .

**32. **O. Cohen, J. S. Lundeen, B. J. Smith, G. Puentes, P. J. Mosley, and I. A. Walmsley, “Tailored photon-pair generation in optical fibers,” Phys. Rev. Lett. **102**, 123603 (2009) [CrossRef] [PubMed] .

**33. **G. Brida, V. Caricato, M. Fedorov, M. Genovese, M. Gramegna, and S. Kulik, “Characterization of spectral entanglement of spontaneous parametric-down conversion biphotons in femtosecond pulsed regime,” Europhys. Lett. **87**, 64003 (2009) [CrossRef] .

**34. **W. P. Grice and I. A. Walmsley, “Spectral information and distinguishability in type-II down-conversion with a broadband pump,” Phys. Rev. A **56**, 1627–1634 (1997) [CrossRef] .

**35. **L. Zhang, A. B. U’ren, R. Erdmann, K. O’Donnell, C. Silberhorn, K. Banaszek, and I. A. Walmsley, “Generation of highly entangled photon pairs for continuous variable Bell inequality violation,” J. Mod. Opt. **54**, 707–719 (2007) [CrossRef] .

**36. **M. Avenhaus, A. Eckstein, P. J. Mosley, and C. Silberhorn, “Fiber-assisted single-photon spectrograph,” Opt. Lett. **34**, 2873–2875 (2009) [CrossRef] [PubMed] .

**37. **I. A. Walmsley and C. Dorrer, “Characterization of ultrashort electromagnetic pulses,” Adv. Opt. Photon. **1**, 308–437 (2009) [CrossRef] .

**38. **H. Takesue, S. Nam, Q. Zhang, R. Hadfield, T. Honjo, K. Tamaki, and Y. Yamamoto, “Quantum key distribution over a 40-db channel loss using superconducting single-photon detectors,” Nat. Photonics **1**, 343–348 (2007) [CrossRef] .

**39. **S. Cova, A. Lacaita, M. Ghioni, G. Ripamonti, and T. Louis, “20-ps Timing resolution with single-photon avalanche diodes,” Rev. Sci. Instrum. **60**, 1104 (1989) [CrossRef] .

**40. **A. Lita, A. Miller, and S. W. Nam, “Counting near-infrared single-photons with 95% efficiency,” Opt. Express **16**, 3032–3040 (2008) [CrossRef] [PubMed] .

**41. **R. H. Hadfield, “Single-photon detectors for optical quantum information applications,” Nat. Photonics **3**, 696–705 (2009) [CrossRef] .

**42. **F. Marsili, V. Verma, J. Stern, S. Harrington, A. Lita, T. Gerrits, I. Vayshenker, B. Baek, M. Shaw, R. Mirin, and S. W. Nam, “Detecting single infrared photons with 93% system efficiency,” Nat. Photonics **7**, 210–214 (2013) [CrossRef] .

**43. **G. Vernam, “Cipher printing telegraph systems for secret wire and radio telegraphic communications,” Transactions of the American Institute of Electrical Engineers **45**, 295–301 (1926) [CrossRef] .

**44. **Since we do not treat finite size effects, the fraction is arbitrary, although realistically it should be large enough to suppress Poissonian errors on the estimation of error rates.

**45. **W. P. Grice, R. Erdmann, I. A. Walmsley, and D. Branning, “Spectral distinguishability in ultrafast parametric down-conversion,” Phys. Rev. A **57**, R2289–R2292 (1998) [CrossRef] .

**46. **C. K. Law, I. A. Walmsley, and J. H. Eberly, “Continuous frequency entanglement: effective finite hilbert space and entropy control,” Phys. Rev. Lett. **84**, 5304–5307 (2000) [CrossRef] [PubMed] .

**47. **J. Eberly, K. Chan, and C. Law, “Schmidt-mode analysis of entanglement for quantum information studies,” in “*Quantum Communication and Information Technologies*,” (Springer, 2003), pp. 1–12 [CrossRef] .

**48. **The assumption of a top-hat profile can be relaxed without changing our analysis, but the calculation in Appendix A would require numerics.

**49. **L. Zhang, L. Neves, J. S. Lundeen, and I. A. Walmsley, “A characterization of the single-photon sensitivity of an electron multiplying charge-coupled device,” J. Phys. B **42**, 114011 (2009) [CrossRef] .

**50. **B. H. Kolner, “Space-time duality and the theory of temporal imaging,” IEEE J. Quantum Electron. **30**, 1951–1963 (1994) [CrossRef] .

**51. **C. V. Bennett and B. H. Kolner, “Upconversion time microscope demonstrating 103 x magnification of femtosecond waveforms,” Opt. Lett. **24**, 783–785 (1999) [CrossRef] .

**52. **J. Lavoie, J. M. Donohue, L. G. Wright, A. Fedrizzi, and K. J. Resch, “Spectral compression of single photons,” Nat. Photonics **7**363–366 (2013) [CrossRef] .

**53. **Other phase modulation schemes such as four-wave mixing in waveguides [54] or sum-frequency generation in nonlinear crystals [51] could of course be used. Here we consider electro-optic phase modulation, which can be implemented with off-the-shelf telecoms components efficiently and with low loss.

**54. **R. Salem, M. Foster, A. Turner, D. Geraghty, M. Lipson, and A. Gaeta, “Optical time lens based on four-wave mixing on a silicon chip,” Opt. Lett. **33**, 1047–1049 (2008) [CrossRef] [PubMed] .

**55. **J. Azaña, “Time-to-frequency conversion using a single time lens,” Opt. Commun. **217**, 205–209 (2003) [CrossRef] .

**56. **W. Wasilewski, A. I. Lvovsky, K. Banaszek, and C. Radzewicz, “Pulsed squeezed light: simultaneous squeezing of multiple modes,” Phys. Rev. A **73**, 063819 (2006) [CrossRef] .

**57. **W. P. Grice, A. B. U’Ren, and I. A. Walmsley, “Eliminating frequency and space-time correlations in multiphoton states,” Phys. Rev. A **64**, 063815 (2001) [CrossRef] .

**58. **M. T. Kauffman, W. C. Banyai, A. A. Godil, and D. M. Bloom, “Time-to-frequency converter for measuring picosecond optical pulses,” Appl. Phys. Lett. **64**, 270–272 (1994) [CrossRef] .

**59. **L. Zhang, C. Silberhorn, and I. A. Walmsley, “Secure quantum key distribution using continuous variables of single photons,” Phys. Rev. Lett. **100**, 110504 (2008) [CrossRef] [PubMed] .

**60. **J. Schneeloch, C. J. Broadbent, S. P. Walborn, E. G. Cavalcanti, and J. C. Howell, “EPR steering inequalities from entropic uncertainty relations,” arXiv:1303.7432 (2013).

**61. **Ł. Rudnicki, S. Walborn, and F. Toscano, “Optimal uncertainty relations for extremely coarse-grained measurements,” Phys. Rev. A **85**, 042115 (2012) [CrossRef] .

**62. **J. Schneeloch, P. B. Dixon, G. A. Howland, C. J. Broadbent, and J. C. Howell, “Violation of continuous-variable Einstein-Podolsky-Rosen steering with discrete measurements,” Phys. Rev. Lett. **110**, 130407 (2013) [CrossRef] [PubMed] .

**63. **D. Tasca, L. Rudnicki, R. Gomes, F. Toscano, and S. Walborn, “Reliable entanglement detection under coarse-grained measurements,” arXiv:1210.5945 (2012).

**64. **M. R. Ray and S. van Enk, “Missing data outside the detector range: application to continuous variable entanglement verification and quantum cryptography,” arXiv:1302.5087 (2013).

**65. **J. M. Renes and J.-C. Boileau, “Conjectured strong complementary information tradeoff,” Phys. Rev. Lett. **103**, 020402 (2009) [CrossRef] [PubMed] .

**66. **In general the key distillation will have non-unit efficiency *β*such that *I*= *βI*_{BA}− *I*_{BE}. However high efficiencies can be achieved, with *β*> 90%. Although the formulas are simplified by assuming *β*= 1, our security analysis can be trivially extended to cover the general case.

**67. **M. Krishna and K. Parthasarathy, “An entropic uncertainty principle for quantum measurements,” Sankhyâ A 842–851 (2002).

**68. **F. Grosshans and N. J. Cerf, “Continuous-variable quantum cryptography is secure against non-gaussian attacks,” Phys. Rev. Lett. **92**, 047905 (2004) [CrossRef] [PubMed] .

**69. **N. Beaudry, T. Moroder, and N. Lütkenhaus, “Squashing models for optical measurements in quantum communication,” Phys. Rev. Lett. **101**, 93601 (2008) [CrossRef] .

**70. **R. Ursin, F. Tiefenbacher, T. Schmitt-Manderbach, H. Weier, T. Scheidl, M. Lindenthal, B. Blauensteiner, T. Jennewein, J. Perdigues, P. Trojek, B. Oemer, M. Fuerst, M. Meyenburg, J. Rarity, Z. Sodnik, C. Barbieri, H. Weinfurter, and A. Zeilinger, “Free-space distribution of entanglement and single photons over 144 km,” Nature Phys. **3**, 481 (2007) [CrossRef] .

**71. **M. Bourennane, A. Karlsson, G. Björk, N. Gisin, and N. Cerf, “Quantum key distribution using multilevel encoding: security analysis,” J. Phys. A **35**, 10065 (2002) [CrossRef] .

**72. **N. J. Cerf, M. Bourennane, A. Karlsson, and N. Gisin, “Security of quantum key distribution using *d*-level systems,” Phys. Rev. Lett. **88**, 127902 (2002) [CrossRef] [PubMed] .

**73. **Eq. (27) in [71] corresponds to setting *I*= 0 with *c*→ 0, *M*→ *N*and $p\to {e}_{B}^{N}$.

**74. **J. B. Spring, P. S. Salter, B. J. Metcalf, P. C. Humphreys, M. Moore, N. Thomas-Peter, M. Barbieri, X.-M. Jin, N. K. Langford, W. S. Kolthammer, M. J. Booth, and I. A. Walmsley, “On-chip low loss heralded source of pure single photons,” arXiv:1304.7781 (2013).

**75. **G. Harder, V. Ansari, B. Brecht, T. Dirmeier, C. Marquardt, and C. Silberhorn, “An optimized photon pair source for quantum circuits,” arXiv:1304.6635 (2013).

**76. **D. Payne and W. Gambling, “New silica-based low-loss optical fibre,” Electron. Lett. **10**, 289–290 (1974) [CrossRef] .