Decoy-State QKD

Every security proof of BB84 begins with a fiction: that Alice emits exactly one photon per round. No real source does this. Attenuate a laser far enough and you get a weak coherent pulse whose photon number is a Poisson lottery — mostly vacuum, sometimes one photon, occasionally two or more. The single-photon rounds are the ones the no-cloning theorem protects; the multiphoton rounds are a gift to an eavesdropper, who performs a quantum non-demolition count, keeps one photon from every multiphoton pulse, and forwards the rest untouched. This is the photon-number-splitting (PNS) attack, and against it a naive user is helpless: knowing only the total click rate, Alice and Bob must concede every multiphoton pulse to Eve. The worst-case (GLLP) key rate then collapses as the square of the transmittance, $R\sim\eta^2$ , cutting secure distance to a fraction of what an ideal single-photon source would reach. The decoy-state method dissolves this deadlock with one almost impudent idea: give Alice and Bob resolution in photon number without a photon-number-resolving source. Alice secretly randomizes her intensity $\mu$ pulse by pulse, mixing signal pulses with weaker "decoy" pulses from the same laser. Because a Fock state $|n\rangle$ carries no label recording which intensity produced it, Eve must treat every $n$ -photon pulse identically — her yield $Y_n$ and error $e_n$ cannot depend on $\mu$ . The measured gains at different intensities become Poisson averages of the same unknown yields, an over-determined linear system that pins down the single-photon yield $Y_1$ and error $e_1$ — the only quantities that make key. The rate is restored to $R\sim\eta$ , and decoy-state BB84 becomes the workhorse of every deployed fibre, free-space, and satellite QKD system, and the foundation of measurement-device-independent QKD.

Key takeaways

Real QKD sources are weak coherent pulses, not single photons: the photon number is Poisson, $p_n(\mu)=e^{-\mu}\mu^n/n!$ , so a fixed fraction of pulses carry two or more photons that leak fully to a photon-number-splitting eavesdropper.
Without countermeasures Alice and Bob must concede all multiphoton clicks, forcing the secure rate to scale as $O(\eta^2)$ instead of the ideal $O(\eta)$ — a crippling distance penalty.
Decoy states randomize the intensity $\mu$ secretly, pulse by pulse; since Eve cannot tell a signal from a decoy of the same photon number, her $Y_n$ and $e_n$ are locked equal across intensities.
The gain is a Poisson average $Q_\mu=\sum_n p_n(\mu)Y_n$ of the same yields for every $\mu$ ; measuring it at several intensities over-determines the $Y_n$ and tightly bounds $Y_1$ and $e_1$ .
Vacuum plus one weak decoy already recovers the true single-photon yield to within a few percent, restoring $O(\eta)$ scaling and extending secure distance by tens of kilometres.
The vacuum-plus-weak-decoy scheme is the de-facto standard: commercial QKD, the Micius satellite, and measurement-device-independent QKD.
Key idea: because an eavesdropper cannot distinguish a signal pulse from a decoy pulse of the same photon number, the per-photon-number yield $Y_n$ and error $e_n$ are identical across intensities; measuring $Q_\mu=\sum_n p_n(\mu)Y_n$ at several intensities over-determines these yields and pins down the secure single-photon contribution.

The core insight

Because an eavesdropper cannot distinguish a signal pulse from a decoy pulse of the same photon number, the per-photon-number yield $Y_n$ and error $e_n$ are forced to be identical across intensities; measuring the total gain $Q_\mu=\sum_n p_n(\mu)Y_n$ at several intensities $\mu$ over-determines these yields and pins down the secure single-photon contribution.

Where this lives today

Decoy-state BB84 is no longer a research curiosity — it is the default. Commercial systems from vendors such as Toshiba and ID Quantique ship decoy-state intensity modulation as standard, running metropolitan links at gigahertz clocks and generating megabit-per-second keys over installed fibre. The 2017 Micius satellite used it to close the one link no fibre can — free space to low-Earth orbit — distributing keys between ground stations more than 1200 km apart, where the transmittance falls to $10^{-6}$ and time-varying atmospheric loss makes direct measurement of $Y_0$ , $Y_1$ , and $e_1$ indispensable. These estimators now feed finite-key proofs, underpinning the ETSI QKD standardization effort. And the method propagates upward: measurement-device-independent QKD is secure only because independent decoy randomization at both senders bounds the two-single-photon yield, and twin-field QKD, which beats the repeaterless rate-loss bound, inherits the same machinery. The open frontier is tighter finite-key bounds and integrating decoy sources with on-chip photonics for compact transmitters.

The physical picture

Think of each laser pulse as a lottery ticket whose hidden number $n$ is drawn from a Poisson distribution. Eve can act only on the value $n$ — the Fock state travelling down the fibre — never on the private intensity label Alice attached before she attenuated the pulse. A single-photon ticket ( $n=1$ ) is inviolable: by no-cloning Eve cannot copy it without disturbing it, so she either blocks it or forwards it honestly. A multiphoton ticket ( $n\ge2$ ) is a hole in the armour: Eve performs a quantum non-demolition photon count, siphons one photon into a quantum memory, and sends the rest through a lossless line she has substituted for the real fibre; when Alice announces the basis, Eve measures her stored photon and learns the bit for free. A vacuum ticket ( $n=0$ ) carries nothing; any click it makes is a dark count.

Figure

One weak coherent pulse at μ = 0.5, three fates set by its photon number n which Eve attacks in place of Alice's secret intensity. Poisson weights p₀ = 0.607 vacuum with no key, p₁ = 0.303 single-photon and secure, p≥2 = 0.090 multiphoton and conceded to a photon-number-splitting attack

The trick that defeats the eavesdropper is not a better source but a better accounting. Because a Fock state carries no intensity label, the channel — Eve included — must respond to $|n\rangle$ with a definite $Y_n$ and $e_n$ , the same whether $|n\rangle$ came from a bright signal or a dim decoy. So the gain $Q_\mu=\sum_n p_n(\mu)Y_n$ is one linear equation in the unknown yields, and each new intensity supplies another in the same unknowns. Vacuum plus two decoys suffice, because at small $\mu$ the Poisson weights concentrate on $n=0,1,2$ and the tail can be bounded away. What emerges is a tight lower bound on $Y_1$ and upper bound on $e_1$ — the single-photon channel extracted from inside the Poisson mixture, without ever building a single-photon gun.

Figure

The payoff: secure key rate versus fibre distance. Decoy-state BB84 gives R proportional to η, a gentle line reaching past 150 km, while GLLP without decoys gives R proportional to η² and dies near 125 km. Anchor point R = 5.1×10⁻⁴ secure bits per pulse at 50 km for μ = 0.5, ν = 0.1

The core equations

The starting point is the source. A coherent state of mean photon number $\mu$ , once its phase is discarded, is a classical mixture of Fock states with Poisson weights — the probability a pulse holds exactly $n$ photons.

p_n(\mu) = \frac{e^{-\mu}\,\mu^{n}}{n!} \qquad (1)

where: $\mu$ — mean photon number (intensity) of the coherent pulse; $n$ — number of photons (Fock component); $p_n(\mu)$ — probability the pulse holds exactly $n$ photons. Reading: for $\mu=0.5$ this gives $p_0=0.607$ , $p_1=0.303$ , $p_{\ge2}=0.090$ — most pulses are empty, and multiphoton pulses are a small but non-negligible tax. The channel — fibre loss, detector efficiency, dark counts, and any eavesdropper — turns an emitted $n$ -photon state into a click at Bob with conditional probability $Y_n$ , the yield. The overall gain, the click probability per pulse, is the Poisson average of these yields.

Q_\mu = \sum_{n=0}^{\infty} p_n(\mu)\,Y_n = \sum_{n=0}^{\infty} \frac{e^{-\mu}\mu^n}{n!}\,Y_n \qquad (2)

where: $Q_\mu$ — gain: detection probability given Alice sent intensity $\mu$ ; $Y_n$ — yield: conditional detection probability given an $n$ -photon pulse. Reading: the gain factorizes over photon-number sectors because the channel acts on each Fock component independently — read at several $\mu$ , this one equation is the entire decoy-state machine. Errors are bookkept identically: each detected $n$ -photon event is wrong with probability $e_n$ , so the error-weighted gain is a second Poisson average over the same sectors.

E_\mu\,Q_\mu = \sum_{n=0}^{\infty} p_n(\mu)\,e_n\,Y_n \qquad (3)

where: $E_\mu$ — overall quantum bit error rate at intensity $\mu$ ; $e_n$ — error rate of detected $n$ -photon events. Reading: $E_\mu Q_\mu$ is what Alice and Bob count (sifted errors per pulse); the vacuum term contributes $e_0 Y_0$ with $e_0=\tfrac12$ because a dark count is a random bit. The linchpin is that the yields and errors are the same for every intensity — not an assumption about the channel's kindness, but a consequence of Eve's ignorance of the intensity label.

Y_n^{(\mu)} = Y_n^{(\nu)} \equiv Y_n,\qquad e_n^{(\mu)} = e_n^{(\nu)} \equiv e_n \qquad (4)

where: $\mu,\nu$ — any two intensity settings, signal or decoy. Reading: because a photon-number eigenstate carries no intensity tag, the map Eve applies to $|n\rangle$ — and hence $Y_n$ and $e_n$ — cannot depend on which intensity produced it; let Eve learn $\mu$ early and the method fails. With vacuum ( $\mu=0$ ) giving $Y_0$ directly and one weak decoy $\nu$ added, the three gain equations over-determine the low-order yields; eliminating the $n\ge2$ tail with the Poisson structure bounds the single-photon yield from below.

Y_1 \ge Y_1^{L} = \frac{\mu}{\mu\nu - \nu^2}\left( Q_\nu e^{\nu} - Q_\mu e^{\mu}\,\frac{\nu^2}{\mu^2} - \frac{\mu^2-\nu^2}{\mu^2}\,Y_0 \right) \qquad (5)

where: $\nu$ — weak decoy intensity, $0<\nu<\mu$ ; $Y_0$ — background yield from the vacuum decoy; $Y_1^L$ — provable lower bound on $Y_1$ . Reading: for $\mu=0.5,\ \nu=0.1$ this estimator recovers the true $Y_1$ to about $97\%$ (Worked example 1). The single-photon error rate is bounded above by the same logic applied to the error-weighted gain at the decoy intensity, keeping only the vacuum term as a certain subtraction.

e_1 \le e_1^{U} = \frac{E_\nu Q_\nu e^{\nu} - e_0\,Y_0}{Y_1^{L}\,\nu} \qquad (6)

where: $e_0=\tfrac12$ — error rate of vacuum (dark-count) events; $E_\nu$ — measured QBER at the weak decoy; $e_1^U$ — upper bound on the single-photon error rate. Reading: the non-negative $n\ge2$ error terms are dropped, so subtracting only the vacuum error $e_0 Y_0$ can only over-estimate $e_1$ — a safe bound. What the security proof consumes is not $Y_1$ but the single-photon gain — the fraction of transmitted pulses that were both single-photon and detected.

Q_1 = Y_1\,p_1(\mu) = Y_1\,\mu\,e^{-\mu} \qquad (7)

where: $Q_1$ — gain restricted to single-photon signal pulses. Reading: the factor $\mu e^{-\mu}$ peaks at $\mu=1$ , which is why decoy protocols run at $\mu\sim0.5$ rather than the vanishing intensity GLLP would demand. Finally the secure key rate: only single-photon rounds make net key, the whole sifted string pays the error-correction cost, and privacy amplification removes Eve's single-photon information.

R \ge q\,\Big\{ -Q_\mu\, f(E_\mu)\, H_2(E_\mu) + Q_1\big[1 - H_2(e_1)\big] \Big\} \qquad (8)

where: $R$ — secret bits per signal pulse; $q$ — sifting factor ( $\tfrac12$ for symmetric BB84, $\to1$ with biased bases); $f(E_\mu)\ge1$ — error-correction inefficiency; $H_2$ — binary entropy. Reading: the first term is the leakage to error correction on the full string; the second is the extractable secret from provably single-photon detections. The binary entropy appearing twice above is the Shannon cost, in bits, of a binary channel with error probability $x$ .

H_2(x) = -x\log_2 x - (1-x)\log_2(1-x) \qquad (9)

where: $x$ — a probability in $[0,1]$ , here an error rate. Reading: $H_2(0)=0$ , $H_2(\tfrac12)=1$ ; the rate goes positive only when $Q_1[1-H_2(e_1)]$ outruns the reconciliation cost $Q_\mu f H_2(E_\mu)$ .

Derivation ADecoy symmetry and the shared linear system

The goal is to establish, from Eve's information alone, why the yields $Y_n$ and errors $e_n$ must be independent of Alice's intensity — and therefore why the observed gains are Poisson averages of a single set of unknowns. This is the load-bearing claim of the whole method: the $Y_1$ bound, the restored $\eta$ -scaling, and the security proof all rest on the equalities in equation (4), and we build it from the structure of the state Eve actually receives, not from any assumption about her honesty.

Step 1. Fix a round in which Alice chose intensity $\mu$ and the source emitted $n$ photons. After phase randomization the emitted state is the Fock state $|n\rangle$ carrying Alice's BB84 polarization and nothing else; $\mu$ was a classical setting in Alice's lab and left no imprint on the state travelling to Bob. Why: a phase-randomized coherent state is exactly the Poisson mixture $\sum_n p_n(\mu)|n\rangle\langle n|$ , so conditioning on $n$ erases every trace of $\mu$ .

Step 2. Model Eve as the most general adversary quantum mechanics permits: she replaces the channel with an arbitrary completely-positive trace-preserving map $\mathcal{E}$ on the received state, possibly entangling it with a private ancilla. Its action is a fixed physical process chosen before she knows $\mu$ . Why: intensity is revealed only in later classical post-processing; during transmission Eve sees only $|n\rangle$ , so her map cannot condition on $\mu$ .

Step 3. Let $Y_n=\Pr[\text{detect}\mid|n\rangle]$ and $e_n=\Pr[\text{error}\mid\text{detect},|n\rangle]$ be the probabilities $\mathcal{E}$ induces on the $n$ -photon input. Since both $\mathcal{E}$ and $|n\rangle$ are independent of $\mu$ , so are $Y_n$ and $e_n$ — exactly $Y_n^{(\mu)}=Y_n^{(\nu)}\equiv Y_n$ and $e_n^{(\mu)}=e_n^{(\nu)}\equiv e_n$ . Why: identical input state and identical channel give identical output statistics — no third variable is left to depend on.

Step 4. Average over the emission distribution at intensity $\mu$ : by total probability over the disjoint photon-number sectors, $Q_\mu=\sum_n p_n(\mu)Y_n$ and $E_\mu Q_\mu=\sum_n p_n(\mu)e_nY_n$ . Why: photon number is a good quantum number, so the sectors are orthogonal and their contributions add.

Step 5. Read this as linear algebra: the unknowns are $(Y_0,Y_1,Y_2,\dots)$ , and each intensity $\mu$ contributes one row $p_n(\mu)$ and one datum $Q_\mu$ . Different intensities give different rows over the same unknowns, so a handful over-determines the low-order yields. Why: this is the "resolution in photon number" a single-photon source gives for free — decoy states buy it with classical randomization instead. *Verified: reproduces the linear-system formulation of Lo–Ma–Chen (PRL 94, 230504) and Ma–Qi–Zhao–Lo (PRA 72, 012326); the equalities (4) are the standard decoy premise.*

Go deeper · Derivation B · 1 minLower-bounding the single-photon yield from vacuum plus one weak decoy

Derivation BLower-bounding the single-photon yield from vacuum plus one weak decoy

The goal is to convert the abstract linear system into the deployable estimator of equation (5) — a rigorous lower bound on $Y_1$ from just three measured numbers, the gains $Q_\mu$ , $Q_\nu$ , and the vacuum yield $Y_0$ . The system has infinitely many unknowns $Y_2,Y_3,\dots$ ; the art is to combine the two gain equations so that every high-order coefficient has a definite sign, making the dropped tail provably conservative rather than merely convenient.

Step 1. Clear the Poisson exponentials: $Q_\mu e^{\mu}=\sum_n \frac{\mu^n}{n!}Y_n$ and $Q_\nu e^{\nu}=\sum_n \frac{\nu^n}{n!}Y_n$ . Why: this puts both equations in a common power-series form so their coefficients match term by term.

Step 2. Form the combination $Q_\nu e^{\nu}-\frac{\nu^2}{\mu^2}Q_\mu e^{\mu}$ , chosen so the $n=2$ terms cancel exactly: $\frac{\nu^2}{2!}-\frac{\nu^2}{\mu^2}\cdot\frac{\mu^2}{2!}=0$ . Why: $Y_2$ is the largest and most dangerous unknown, so we eliminate it outright rather than bound it.

Step 3. Expand the survivors: $\left(\nu-\frac{\nu^2}{\mu}\right)Y_1+\left(1-\frac{\nu^2}{\mu^2}\right)Y_0-\sum_{n\ge3}\frac{\nu^n-\nu^2\mu^{n-2}}{n!}Y_n$ , keeping $Y_0,Y_1$ explicit. Why: isolating $Y_1$ requires knowing exactly what multiplies it and what sits in the discarded tail.

Step 4. Sign the tail. For $0<\nu<\mu$ and $n\ge3$ , $\nu^n-\nu^2\mu^{n-2}=\nu^2(\nu^{n-2}-\mu^{n-2})\le0$ , so each tail term enters subtracted times a non-negative $Y_n$ ; dropping it only lowers the right side, keeping the inequality valid. Why: this is the one place $\nu<\mu$ and $Y_n\ge0$ are used — together they make truncation a safe under-estimate.

Step 5. Solve: $Y_1\ge\frac{1}{\nu-\nu^2/\mu}\left(Q_\nu e^{\nu}-\frac{\nu^2}{\mu^2}Q_\mu e^{\mu}-\big(1-\frac{\nu^2}{\mu^2}\big)Y_0\right)$ , whose prefactor equals $\mu/(\mu\nu-\nu^2)$ — equation (5). The vacuum decoy supplies $Y_0$ directly, by sending empty pulses and counting clicks. Why: with $Y_0$ measured and the tail signed away, every quantity on the right is observed or bounded, so the estimator is fully operational. *Verified: identical to Eq. (35) of Ma, Qi, Zhao, Lo (PRA 72, 012326); the tail-sign step needs only $\nu<\mu$ and $Y_n\ge0$ , and Worked example 1 confirms $Y_1^L/Y_1=0.97$ .*

Limiting cases

Case	Result	Meaning
Infinite decoys	$Y_1\to Y_1^{\text{exact}},\ e_1\to e_1^{\text{exact}}$	The system is fully inverted — every $Y_n$ is a Taylor coefficient of $e^{\mu}Q_\mu$ — so the rate equals ideal single-photon BB84 up to the unused multiphoton fraction.
No decoys (GLLP)	$R\gtrsim q\{-Q_\mu f H_2(E_\mu)+Q_1[1-H_2(e_1)]\},\ Q_1\le Q_\mu$	Worst-case attribution concedes all multiphoton clicks; $\mu$ must shrink as $\eta$ , so $R\sim\eta^2$ and distance is sharply capped.
Small- $\mu$ regime	$Q_\mu\approx Y_0+Y_1\mu+\tfrac12 Y_2\mu^2+\cdots$	Vacuum and single-photon terms dominate, so vacuum plus one or two weak decoys estimate $Y_1$ tightly — the practical operating point.
Optimal signal intensity	$\mu_{\text{opt}}=O(1)$ , typically $0.4$ – $0.6$	Maximizing $Q_1=Y_1\mu e^{-\mu}$ gives roughly half a photon per pulse, not the vanishing intensity GLLP forces.
Strong loss, $\eta\to0$	$R_{\text{decoy}}\propto\eta$ , $R_{\text{no-decoy}}\propto\eta^2$	The two schemes diverge without bound as distance grows — the decoy reach advantage is what makes long-haul QKD viable.

Common trapDecoy states hide nothing if Eve learns the intensity, and they do not patch source side-channels

The entire method stands on one premise: Eve cannot tell a signal from a decoy of the same photon number. Each pulse's intensity must be chosen by a private random number generator after the state is prepared, and kept secret until public announcement. If Eve learns it early — through any side-channel that correlates intensity with a distinguishable spectral, temporal, or spatial signature — she can tailor a different attack to signal and decoy pulses, break $Y_n^{(\mu)}=Y_n^{(\nu)}$ , and the whole estimation (and the security proof it feeds) collapses. So intensity modulation must be information-theoretically hidden — a real constraint on the modulator. And decoy states neutralize only the photon-number degree of freedom: they do nothing about detector blinding, Trojan-horse attacks, or mode mismatches, which need their own countermeasures (and motivate measurement-device-independent QKD).

Worked examples

1 · Full decoy estimation at 50 km (fully worked)

A 50 km fibre at 0.2 dB/km feeds a 10%-efficient detector, so $\eta=0.01$ ; take $Y_0=1.0\times10^{-5}$ , intrinsic error $e_d=3.3\%$ , $e_0=\tfrac12$ , $f=1.16$ , $q=\tfrac12$ . Alice runs signal $\mu=0.5$ , one weak decoy $\nu=0.1$ , and vacuum. Find $Y_1^L$ , $e_1^U$ , $Q_1$ , and the secure rate $R$ .

Step 1. Predict the measured gains from $Q_\mu=1-(1-Y_0)e^{-\mu\eta}$ : at signal $Q_\mu=1-(1-10^{-5})e^{-0.005}=\mathbf{4.997\times10^{-3}}$ and at decoy $Q_\nu=1-(1-10^{-5})e^{-0.001}=\mathbf{1.010\times10^{-3}}$ — the click rates Alice and Bob tally, about $0.50\%$ and $0.10\%$ of pulses.

Step 2. From $E_\mu Q_\mu=e_0Y_0+e_d(1-e^{-\mu\eta})$ the QBERs are $E_\mu=\mathbf{3.39\%}$ and $E_\nu=\mathbf{3.76\%}$ — the decoy runs slightly noisier as its lower gain lets the fixed dark-count error weigh more.

Step 3. Apply the yield bound (5) with $\mu=0.5,\ \nu=0.1$ : the prefactor is $\mu/(\mu\nu-\nu^2)=0.5/0.04=12.5$ , giving $Y_1^L=12.5\big(Q_\nu e^{0.1}-Q_\mu e^{0.5}(0.04)-0.96\,Y_0\big)=\mathbf{9.71\times10^{-3}}$ . The true yield $Y_1=1-(1-Y_0)(1-\eta)\approx1.00\times10^{-2}$ , so the bound recovers $\mathbf{97\%}$ of it — nearly tight.

Step 4. Bound the error with (6): $e_1^U=(E_\nu Q_\nu e^{0.1}-e_0Y_0)/(Y_1^L\nu)=\mathbf{3.81\%}$ , just above the true $e_1\approx3.35\%$ . The single-photon gain from (7) is $Q_1=Y_1^L\,\mu e^{-\mu}=9.71\times10^{-3}\times0.303=\mathbf{2.94\times10^{-3}}$ — about $59\%$ of all clicks are certified single-photon.

Step 5. Assemble the rate (8) with $H_2(0.0339)=0.214$ , $H_2(0.0381)=0.234$ : $R\ge\tfrac12\{-4.997\times10^{-3}\times1.16\times0.214+2.94\times10^{-3}\times(1-0.234)\}=\mathbf{5.1\times10^{-4}}$ secure bits per pulse — roughly 0.5 Mbit/s at a 1 GHz clock, the anchor point of the punchline figure.

2 · The Poisson photon budget, and why no-decoy forces a tiny μ

For $\mu=0.5$ , quantify the photon-number budget and show why GLLP accounting without decoys would force Alice to a far smaller intensity.

Step 1. Evaluate the weights: $p_0=e^{-0.5}=\mathbf{0.607}$ , $p_1=0.5e^{-0.5}=\mathbf{0.303}$ , $p_{\ge2}=1-p_0-p_1=\mathbf{0.090}$ . Of the pulses carrying any light, roughly one in four is multiphoton — the hole PNS exploits.

Step 2. In GLLP accounting all $9.0\%$ of multiphoton pulses are conceded to Eve, so the provable single-photon gain is $Q_1^{\min}\approx Q_\mu-p_{\ge2}$ . With $Q_\mu=5.0\times10^{-3}$ at 50 km, $Q_\mu-p_{\ge2}=5.0\times10^{-3}-9.0\times10^{-2}=\mathbf{-0.085}<0$ — no positive key at all at $\mu=0.5$ without decoys.

Step 3. To rescue a positive bound, GLLP must shrink $\mu$ until $p_{\ge2}\approx\mu^2/2$ drops below the single-photon gain $\sim\eta\mu$ , i.e. $\mu\lesssim2\eta=0.02$ ; then the gain is only $\sim2\times10^{-4}$ and shrinks as $\eta^2$ . Decoy keeps $\mu=0.5$ and an $\eta$ -linear rate; GLLP is driven to $\mu\sim\eta$ and $\eta^2$ — the whole distance advantage in one comparison.

Physics of the portrait

The decoy-state method is a rare thing in cryptography: a security upgrade that costs no new hardware, only a random-number generator on the intensity modulator — the product of a two-year sprint from bold idea to rigorous proof to deployable recipe.

Origins · 1 minWon-Young Hwang and how this was discovered

Won-Young Hwang

decoy-state proposal, Phys. Rev. Lett. 91, 057901 (2003) · practical quantum key distribution and the photon-number-splitting problem

By the early 2000s the photon-number-splitting attack was understood as the fundamental obstacle to long-distance QKD with realistic lasers: Brassard, Lütkenhaus, Mor, and Sanders had shown that weak-coherent-pulse BB84, honestly accounted, could not beat an $\eta^2$ rate, and the GLLP framework of Gottesman, Lo, Lütkenhaus, and Preskill made that pessimism a theorem. Won-Young Hwang's 2003 proposal cut through it with a disarmingly simple move — deliberately vary the source intensity and watch how the statistics respond. If Eve skims multiphoton pulses, her tampering shows up as an intensity-dependent anomaly she cannot hide, because she cannot see the intensity. Hwang's original argument was heuristic, but the idea was recognized at once as decisive. Within two years Hoi-Kwong Lo, Xiongfeng Ma, and Kai Chen turned it into a rigorous proof, Xiang-Bin Wang gave an independent three-intensity analysis, and Ma, Qi, Zhao, and Lo distilled it into the practical vacuum-plus-weak-decoy scheme with the $Y_1^L$ and $e_1^U$ estimators used to this day. The method inverted the field's outlook: the eavesdropper's one advantage — access to the photon number — became the very handle honest users grasp to measure her.

History

2003

— Hwang proposes decoy states to beat the photon-number-splitting attack in high-loss channels

2004

— Gottesman, Lo, Lütkenhaus, and Preskill formalize QKD security with imperfect devices (GLLP)

2005

— Lo, Ma, and Chen prove decoy-state security; Wang and Ma-Qi-Zhao-Lo give practical multi-intensity schemes

2006

— first experimental decoy-state QKD over installed and laboratory fibre

2017

— the Micius satellite distributes decoy-state BB84 keys over more than a thousand kilometres

Going further

Texts and papers. Hwang, "Quantum Key Distribution with High Loss: Toward Global Secure Communication", Phys. Rev. Lett. 91, 057901 (2003) · Lo, Ma, Chen, "Decoy State Quantum Key Distribution", Phys. Rev. Lett. 94, 230504 (2005) · Wang, "Beating the Photon-Number-Splitting Attack in Practical Quantum Cryptography", Phys. Rev. Lett. 94, 230503 (2005) · Ma, Qi, Zhao, Lo, "Practical Decoy State for Quantum Key Distribution", Phys. Rev. A 72, 012326 (2005) · Gottesman, Lo, Lütkenhaus, Preskill, "Security of quantum key distribution with imperfect devices", Quant. Inf. Comput. 4, 325 (2004) · Scarani et al., "The security of practical quantum key distribution", Rev. Mod. Phys. 81, 1301 (2009) · Nielsen & Chuang, Quantum Computation and Quantum Information, Ch. 12; Preskill, lecture notes Ch. 6.

Provenance. A verifier should: (1) confirm $p_n=e^{-\mu}\mu^n/n!$ and $Q_\mu=\sum_n p_n Y_n$ (standard); (2) re-derive $Y_1^L$ and check it matches Eq. (35) of Ma–Qi–Zhao–Lo, PRA 72, 012326, including the tail-sign step requiring $\nu<\mu$ ; (3) verify the $e_1^U$ bound subtracts the vacuum error $e_0Y_0$ with $e_0=\tfrac12$ ; (4) check the rate $R\ge q\{-Q_\mu f H_2(E_\mu)+Q_1[1-H_2(e_1)]\}$ against GLLP (QIC 4, 325) and Lo–Ma–Chen (PRL 94, 230504); (5) reproduce Worked example 1 — $Q_\mu=5.0\times10^{-3}$ , $Y_1^L=9.7\times10^{-3}$ (97% of true $Y_1$ ), $e_1^U=3.8\%$ , $R=5.1\times10^{-4}$ per pulse at $\eta=0.01$ . The channel model $Y_n=1-(1-Y_0)(1-\eta)^n$ and standard values $e_0=\tfrac12$ , $q=\tfrac12$ , $f=1.16$ are used throughout; no constant is fabricated.

Prerequisites. BB84 Protocol · Photon-Number-Splitting Attack · Quantum Bit Error Rate and Sifting · Information Reconciliation and Privacy Amplification · No-Cloning Theorem in Cryptography. Leads to. Six-State and SARG04 Protocols · Reconciliation and Privacy Amplification · Measurement-Device-Independent QKD.

Ask the tutor: Ask me to walk through the $Y_1^L$ derivation line by line, or to recompute the 50 km key rate for your own fibre loss and decoy intensities.

Why can't Eve just attack the decoy pulses differently from the signal pulses?

Because she cannot tell them apart while they are in flight. A decoy and a signal of the same photon number are the same quantum state — a Fock state $|n\rangle$ carrying the BB84 polarization — and the intensity that produced each is a classical setting in Alice's lab, revealed (if ever) only after Bob has recorded his clicks. Eve's most general strategy is a fixed operation on the received state, which cannot condition on information she lacks. So the $Y_n$ and $e_n$ her attack induces on $|n\rangle$ are the same for every intensity — exactly the constraint (4) that makes the estimation work.

Doesn't randomizing the intensity waste pulses and lower the rate?

Only slightly, and the trade is overwhelmingly worth it. Alice sends most pulses at the signal intensity $\mu$ and only a small fraction as decoys $\nu$ and vacuum — just enough to estimate $Y_1$ and $e_1$ with good statistics. Even when the decoy pulses are discarded the loss is a few percent, and against that you win back the entire $\eta^2\to\eta$ scaling — orders of magnitude in rate and tens of kilometres in reach. The bookkeeping cost is tiny; the payoff is enormous.

What is the difference between the yield Y_n and the gain Q_μ?

The yield $Y_n$ is a conditional probability: given that Alice emitted exactly $n$ photons, it is the chance Bob clicks. It is a property of the channel (Eve included) and does not depend on intensity. The gain $Q_\mu$ is the unconditional click probability per pulse, folding the yields with the Poisson weights, $Q_\mu=\sum_n p_n(\mu)Y_n$ . You measure $Q_\mu$ by counting clicks and infer the $Y_n$ from several $Q_\mu$ values — the whole method is that inversion, and security rides on $Y_1$ hidden inside the sum.

Why is only the single-photon contribution counted as secure?

Because only single-photon states are protected by no-cloning. If Alice sends one photon, Eve cannot copy or measure it without disturbing it, so any information she gains shows up as bit errors that privacy amplification removes — $e_1$ is exactly the leakage subtracted. Multiphoton pulses hand Eve identical clones, so she learns those bits with no disturbance; they are conceded entirely, and vacuum pulses carry no bit. That is why the rate (8) rewards only $Q_1[1-H_2(e_1)]$ while charging error correction against the whole sifted string $Q_\mu H_2(E_\mu)$ .

How many decoy intensities do you actually need?

In principle infinitely many would invert the system exactly, reconstructing every $Y_n$ as a Taylor coefficient of $e^{\mu}Q_\mu$ . In practice vacuum plus one weak decoy already recovers $Y_1$ to within a few percent, and vacuum plus two is effectively optimal — Worked example 1 gets 97% of the true $Y_1$ with a single weak decoy. So few suffice because at small intensities the Poisson weights concentrate on $n=0,1,2$ : the low-order yields dominate the gains and the tail is small and provably signed. More intensities only split the statistics for diminishing returns.

Do decoy states make QKD unconditionally secure against any attack?

No — they close one specific, important loophole and nothing more: the multiphoton vulnerability of weak-coherent-pulse sources. They restore the security an ideal single-photon source would give against attacks on the photon number, including the full photon-number-splitting attack. They do not touch imperfections elsewhere — detector side-channels (blinding, time-shift, efficiency mismatch), Trojan-horse probes, or intensity correlations that leak the decoy setting itself. Those need separate defenses: optical isolators and filters, careful modulator design, and the measurement-device-independent architecture for the detectors. Decoy states are a necessary foundation, not a complete shield.