Measurement-Device-Independent QKD

Every deployed quantum key distribution link has a soft underbelly, and it is not the channel — it is the detector. BB84 proves that no eavesdropper can copy an unknown qubit, yet the theorem says nothing about a single-photon detector that can be blinded by a bright laser, nudged by a time-shifted pulse, or exploited through an efficiency mismatch between its two channels. The overwhelming majority of successful attacks on real systems have walked in through exactly this door: the measurement apparatus, not the quantum states. Device-independent QKD closes the door completely by certifying security from a loophole-free Bell violation, but it demands near-unit detection efficiency and remains punishingly hard to realize. Measurement-device-independent QKD, introduced by Lo, Curty and Qi in 2012, finds the sweet spot. Its structural move is disarmingly simple: make Alice and Bob both transmitters. Each prepares a BB84 state and sends it to a central node, Charlie, who is assumed to be completely untrusted — he may be the eavesdropper Eve herself. Charlie performs a Bell-state measurement that interferes the two photons and publicly announces which Bell state he saw, or a failure. A successful announcement correlates Alice's and Bob's signals without revealing either, so they can sift a key while the detector — the very organ that leaked in every hardware hack — sits in enemy hands. The reason this is safe is best seen by running teleportation backwards. Where teleportation consumes entanglement to move a state, a Bell measurement on two travelling photons creates entanglement between the two distant senders — entanglement swapping. Because virtual entanglement appears no matter who or what runs the measurement, the honest parties inherit a secure key from untrusted hardware. The price is rate: two photons must arrive coincidentally, so the key rate falls with the product of the two channel transmittances — the penalty that later motivated twin-field QKD.

Key takeaways

Measurement-device-independent QKD (MDI-QKD) removes all detector side-channel attacks by handing the measurement to an untrusted relay, Charlie, who performs a Bell-state measurement (BSM) on photons that Alice and Bob both send inward.
Security follows from time-reversed EPR: a successful BSM swaps entanglement between Alice and Bob, so Charlie's public announcement — even if he is Eve and lies — is statistically independent of the sifted key, $I(K\!:\!c)=0$ .
A linear-optics BSM cleanly identifies only $|\psi^-\rangle$ and $|\psi^+\rangle$ ; the other two Bell states bunch indistinguishably, capping the success probability at $P_{\text{succ}}=\tfrac12$ for ideal single photons.
Real systems use weak coherent pulses, which reopens the photon-number-splitting threat at the source; three-intensity decoy states bound the single-photon yield $Y_{11}$ and phase error $e_{11}^X$ to restore security.
The secret rate scales linearly with total transmittance, $R\propto\eta_A\eta_B=\eta$ — the same order as a direct link — because a two-photon coincidence multiplies survival probabilities; twin-field QKD later recovered $\sqrt{\eta}$ .
Key idea: turn both honest parties into transmitters and give the measurement to an untrusted middle node performing a Bell-state measurement — a successful BSM swaps entanglement between Alice and Bob, so the announced outcome reveals nothing about the key and no detector attack can succeed.

The core insight

Turn both honest parties into transmitters and give the measurement to an untrusted middle node performing a Bell-state measurement: a successful BSM swaps entanglement between Alice and Bob, so the announced outcome reveals nothing about the key and no detector attack can succeed — security becomes independent of the measurement device.

Where this lives today

MDI-QKD has moved from theory to deployable network element. Because the relay can be wholly untrusted, it is the natural building block for star-topology metropolitan networks: a provider runs the expensive, attack-prone detectors at one central node, and every subscriber needs only a transmitter, with any pair of users routing photons to the shared relay for a pairwise key. Field trials have run it over installed telecom fiber across cities. Its most consequential offspring is twin-field QKD, which kept the untrusted relay but replaced the two-photon coincidence with single-photon interference; experiments have since pushed secure key distribution past 800 km of fiber and beaten the Pirandola–Laurenza–Ottaviani–Banchi repeaterless capacity bound — a milestone the untrusted-relay idea made conceptually possible. The open frontiers are now source-side: closing Trojan-horse and mode-mismatch channels, tightening finite-key proofs for realistic block sizes, and stabilizing the interferometric phase between two independent lasers to keep twin-field visibility high over hundreds of kilometers.

The physical picture

Imagine Alice and Bob each mailing a sealed photon to a referee who claims to have "measured them together." If the referee is honest, his Bell-state announcement tells him only the relation between the two photons, never either individual value — like learning that two coins landed the same without learning whether both were heads or both tails. If the referee is Eve, she is welcome to the relation: it is public anyway, and it does not name the key. The first figure lays out this three-party geometry and the numbers that flow from it.

Figure

MDI-QKD architecture: Alice and Bob are both transmitters sending BB84 photons inward to an untrusted relay Charlie, whose Bell-state measurement announces c. For a 200 km fiber split into two 100 km arms at 0.2 dB/km, each arm transmits η = 0.01, so the two-photon coincidence probability is η_A·η_B = 10⁻⁴

The deeper picture is time-reversed teleportation. In ordinary teleportation a Bell measurement plus a classical message destroys a state here and recreates it there. Run the logic backward and a Bell measurement on two travelling photons creates entanglement between the two distant senders — entanglement swapping. Because this happens no matter who runs the measurement, the honest parties can establish virtual entanglement through completely untrusted hardware, then read a key off it. What makes the whole scheme practical rather than merely elegant is that the Bell measurement can be built from a single beam splitter and two detectors — the second figure shows exactly which outcomes such a linear-optics analyzer can and cannot resolve.

Figure

Linear-optics Bell-state measurement: two photons meet at a 50:50 beam splitter. The singlet ψ⁻ leaves the two photons in different output ports (a two-detector coincidence); ψ⁺ sends both to the same port; the φ± states bunch identically and cannot be told apart. Only 2 of the 4 Bell states are identified, so P_succ = 50 percent for ideal single photons

The index of these correlations changes nothing about the security core but everything about the rate: two photons must survive their separate journeys and arrive together, and independent survival probabilities multiply. This is the conceptual seed of twin-field QKD — interfere a single photon's worth of amplitude at the relay instead of demanding a genuine two-photon coincidence, and the quadratic penalty softens to a square root.

The core equations

The four Bell states are the alphabet of the whole protocol: they are the maximally entangled two-qubit states, mutually orthogonal, and it is which one Charlie reports that carries the sifting information. Only two of them survive a linear-optics analyzer, a fact that will cost a factor of two in rate.

|\psi^{\pm}\rangle = \tfrac{1}{\sqrt{2}}\big(|01\rangle \pm |10\rangle\big),\qquad |\phi^{\pm}\rangle = \tfrac{1}{\sqrt{2}}\big(|00\rangle \pm |11\rangle\big) \qquad (1)

where: $|0\rangle,|1\rangle$ — computational (e.g. horizontal/vertical polarization) basis states of a single photonic qubit; $|\psi^{\pm}\rangle,|\phi^{\pm}\rangle$ — the four maximally entangled Bell states. Reading: a linear-optics BSM cleanly flags only $|\psi^-\rangle$ and $|\psi^+\rangle$ , so a real analyzer speaks a two-letter alphabet plus "fail." Each round of the prepare-and-measure protocol is one line: Alice and Bob independently prepare BB84 states and send them to Charlie, whose only output is a public classical symbol. Everything downstream — sifting, error estimation, distillation — acts on that symbol and the two parties' private records.

|\Psi\rangle_{AB} = |x_A\rangle_A \otimes |x_B\rangle_B \quad\xrightarrow{\;\text{BSM at } C\;}\quad \text{announce } c\in\{\psi^-,\psi^+,\text{fail}\} \qquad (2)

where: $|x_A\rangle,|x_B\rangle$ — BB84 states, each drawn from the $Z$ basis $\{|0\rangle,|1\rangle\}$ or the $X$ basis $\{|+\rangle,|-\rangle\}$ ; $C$ — untrusted relay (Charlie / Eve); $c$ — public BSM announcement used for sifting. Reading: the honest parties keep rounds where a valid Bell state was announced and they used a common basis; the rest are discarded. The Bell measurement itself is nothing more than a 50:50 beam splitter feeding two polarization-resolving detectors. The mode transformation below is the entire optical content of Charlie's box, and the interference it produces is what maps a Bell state onto a detector pattern.

\hat a_{1} = \tfrac{1}{\sqrt 2}(\hat a_A + \hat a_B),\qquad \hat a_{2} = \tfrac{1}{\sqrt 2}(\hat a_A - \hat a_B) \qquad (3)

where: $\hat a_A,\hat a_B$ — input mode annihilation operators for Alice's and Bob's photons; $\hat a_1,\hat a_2$ — output modes feeding the two detector ports. Reading: a coincidence across the two ports with orthogonal polarizations flags $|\psi^-\rangle$ ; a double click in one port flags $|\psi^+\rangle$ . Because $|\phi^{\pm}\rangle$ cause the two photons to bunch into a single mode (Hong–Ou–Mandel interference) indistinguishably, they cannot be resolved. Exactly two of the four states are identifiable, which fixes the ideal success probability.

P_{\text{succ}} = \tfrac{1}{2}\quad(\text{ideal single photons, linear-optics BSM}) \qquad (4)

where: $P_{\text{succ}}$ — probability that the linear-optics BSM unambiguously names the incoming Bell state. Reading: the cap of $\tfrac12$ is a hard ceiling for passive linear optics; ancilla photons or nonlinear interactions can raise it but are impractical. The asymptotic secret-key rate keeps only the events where both parties emitted a single photon — those are the events whose security decoy states can certify. The first term is the distillable key from single-photon rounds; the second is the cost of reconciling errors on the full sifted data.

R = Q_{11}\big[1 - H_2(e_{11}^{X})\big] - Q_{\mu\sigma}\, f\, H_2(E_{\mu\sigma}^{Z}) \qquad (5)

where: $Q_{11}$ — gain from rounds where both Alice and Bob emit exactly one photon; $e_{11}^{X}$ — $X$ -basis (phase) error rate of those single-photon rounds, which bounds Eve's information; $Q_{\mu\sigma},E_{\mu\sigma}^{Z}$ — overall gain and $Z$ -basis QBER at signal intensities $\mu$ (Alice) and $\sigma$ (Bob); $f\gtrsim 1$ — reconciliation inefficiency ( $f=1$ at the Shannon limit). Reading: the key is built from the $Z$ basis, its secrecy certified by the $X$ -basis phase error — the same "data / test basis" split as BB84. The binary entropy function converts an error probability into a number of bits, and it appears twice in the rate: once as the leakage to Eve and once as the reconciliation overhead.

H_2(x) = -x\log_2 x - (1-x)\log_2(1-x) \qquad (6)

where: $x$ — an error probability in $[0,\tfrac12]$ ; $H_2$ — bits of uncertainty per symbol. Reading: $H_2(0)=0$ , $H_2(\tfrac12)=1$ ; the rate stays positive only while $H_2(e_{11}^X)$ is small enough that the first term of (5) survives. With weak coherent pulses the source emits a Poisson mixture of photon numbers, and a multi-photon pulse is vulnerable to photon-number splitting. The decoy-state yield model is what lets Alice and Bob bound the single-photon contribution without trusting Eve.

Y_n = Y_0 + \eta_n - Y_0\,\eta_n,\qquad \eta_n = 1-(1-\eta)^n \qquad (7)

where: $Y_n$ — detection probability given $n$ photons entered the channel; $Y_0$ — dark-count / background yield; $\eta$ — single-photon transmittance (including relay detection efficiency). Reading: by varying the mean photon number and solving the resulting linear system, the parties bound $Y_{11}$ and $e_{11}^X$ — the two quantities equation (5) actually needs. Finally, the two-photon coincidence requirement fixes how the rate falls with distance, and a simple entropy inequality fixes the highest tolerable error. Both are the practical headline numbers.

R \propto \eta_A\,\eta_B = \eta,\qquad R>0 \iff e_{11}^{X} < 11\%\;(\text{one-way limit}) \qquad (8)

where: $\eta_A,\eta_B$ — per-arm transmittances; $\eta=\eta_A\eta_B$ — total end-to-end transmittance; $11\%$ — the BB84-class threshold where $1-2H_2(e)=0$ . Reading: the rate scales linearly in total transmittance — the same order as a direct link — and dies once the phase error crosses $11\%$ .

Derivation AWhy the untrusted relay learns nothing about the key

The goal is to show that conditioning on a successful Bell-state announcement leaves Alice and Bob with correlations that are completely independent of anything the measurement device — honest or adversarial — can hold. We work in the entanglement-based picture, where each party keeps one qubit of a local Bell pair and sends its twin to Charlie, follow the state through the swap, and track precisely what marginal information the relay's announcement can carry. The payoff is the formal content of measurement-device independence: the mutual information between the key and the public announcement is exactly zero, so no manipulation of the detectors can either extract or bias the key.

Step 1. Replace each BB84 source by its entanglement-based twin: Alice holds qubit $A$ and emits $a$ , Bob holds $B$ and emits $b$ , with each local pair in $|\Phi\rangle=\tfrac1{\sqrt2}(|00\rangle+|11\rangle)$ , so the global state before the relay is $|\Phi\rangle_{Aa}\otimes|\Phi\rangle_{Bb}$ . Why: by the source-replacement lemma, preparing random BB84 states is statistically identical to measuring half of a Bell pair, so proving security here proves it for the real prepare-and-measure protocol.

Step 2. Project the two travelling qubits $a,b$ onto a Bell state at Charlie. Direct algebra gives $\langle\psi^-|_{ab}\,|\Phi\rangle_{Aa}|\Phi\rangle_{Bb}\propto|\psi^-\rangle_{AB}$ : the measurement swaps entanglement, leaving the two retained qubits $A,B$ maximally entangled even though they never met. Why: this is entanglement swapping — the honest parties end up sharing a fresh Bell pair created entirely by hardware they do not trust, and the same holds up to a known Pauli correction for the $\psi^+$ outcome.

Step 3. Have Alice and Bob measure $A$ and $B$ in a common basis. The singlet gives $\Pr(a=b\mid Z,\psi^-)=0$ : perfectly anti-correlated outcomes, from which a shared key bit is extracted after an agreed bit flip. Why: a maximally entangled state is perfectly correlated in every basis, so the key can be read in $Z$ and its integrity checked in $X$ — exactly the two-basis structure security needs.

Step 4. Ask what Charlie ever held. His announcement $c$ is a function of the travelling qubits $a,b$ alone; the reduced state $\rho_C=\mathrm{Tr}_{AB}\rho_{ABC}$ carries no marginal information about which key bit $A$ and $B$ will yield, because that bit is only defined once Alice and Bob measure their retained halves. Hence $I(K\!:\!c)=0$ . Why: the key does not exist as classical data until after the swap, so a symbol computed before it cannot correlate with it — adversarial control of the BSM cannot change this.

Step 5. Transfer the conclusion back to prepare-and-measure. Because Steps 1–4 used only the source-replacement equivalence and the algebra of the swap, the real protocol — random BB84 states plus a public announcement — inherits $I(K\!:\!c)=0$ with no trust assumption whatsoever on the detectors. Why: this is what "measurement-device-independent" means precisely — security that survives Eve owning, operating, and lying about the entire measurement apparatus.

Go deeper · Derivation B · 1 minHow a beam splitter sorts two of the four Bell states

Derivation BHow a beam splitter sorts two of the four Bell states

The goal is to derive, from the beam-splitter mode transformation alone, the detector signatures that let a passive linear-optics analyzer distinguish $|\psi^-\rangle$ and $|\psi^+\rangle$ while leaving $|\phi^{\pm}\rangle$ hopelessly ambiguous, and thereby to pin the success probability at one half. We write each polarization Bell state in second-quantized form, push the creation operators through the 50:50 beam splitter, and read off where the two photons land. The bunching and anti-bunching that emerge are pure Hong–Ou–Mandel interference, and they are the reason MDI-QKD pays a factor of two.

Step 1. Write the singlet as $|\psi^-\rangle=\tfrac1{\sqrt2}(\hat a_{A,H}^\dagger\hat a_{B,V}^\dagger-\hat a_{A,V}^\dagger\hat a_{B,H}^\dagger)|0\rangle$ , the antisymmetric combination of one photon in each input arm with orthogonal polarizations. Why: the exchange antisymmetry of the singlet is exactly the property the beam splitter will convert into a spatial anti-bunching signature.

Step 2. Substitute the beam-splitter rule $\hat a_A^\dagger\to\tfrac1{\sqrt2}(\hat a_1^\dagger+\hat a_2^\dagger)$ and $\hat a_B^\dagger\to\tfrac1{\sqrt2}(\hat a_1^\dagger-\hat a_2^\dagger)$ . The same-port terms $\hat a_{1,H}^\dagger\hat a_{1,V}^\dagger$ and $\hat a_{2,H}^\dagger\hat a_{2,V}^\dagger$ cancel by the minus sign, leaving only cross-port terms. Why: the antisymmetric input survives only where the two photons exit in different ports, so $|\psi^-\rangle$ produces a coincidence across the two detectors — its unique fingerprint.

Step 3. Repeat for $|\psi^+\rangle$ , the symmetric combination. Now the cross-port terms cancel and the same-port terms add, so both photons exit the same port with orthogonal polarizations — a double click in one detector. Why: $\psi^+$ and $\psi^-$ therefore have distinct, cleanly separable signatures, which is why precisely two Bell states are resolvable.

Step 4. Try $|\phi^{\pm}\rangle=\tfrac1{\sqrt2}(\hat a_{A,H}^\dagger\hat a_{B,H}^\dagger\pm\hat a_{A,V}^\dagger\hat a_{B,V}^\dagger)|0\rangle$ . Here the two photons share a polarization, so they bunch into a single spatial mode and $\phi^+$ , $\phi^-$ produce identical statistics — no measurement of click position or polarization tells them apart. Why: with only linear optics there is no port-and-polarization pattern that separates $\phi^+$ from $\phi^-$ , so both are lost.

Step 5. Count: two of the four equally likely Bell states are identified, so an ideal single-photon input yields a resolvable outcome with probability $P_{\text{succ}}=\tfrac24=\tfrac12$ . Why: this ceiling is a theorem about passive linear optics, not an engineering limit — it directly halves the coincidence yield that reaches the key.

Go deeper · Derivation C · 2 minWhy the secret-key rate scales with the total transmittance

Derivation CWhy the secret-key rate scales with the total transmittance

The goal is to establish that MDI-QKD's secret-key rate falls linearly with the total end-to-end transmittance — quadratically in each per-arm transmittance — because a Bell measurement demands that two independently attenuated photons arrive together. We count the survival of each photon down its own fiber, impose the coincidence, fold in the linear-optics BSM ceiling, and then compare the result to both a direct link and to twin-field QKD, so the "why is MDI slow" question gets a quantitative answer rather than a slogan.

Step 1. Assign each arm its own survival probability: Alice's photon reaches Charlie with probability $\eta_A$ and Bob's with probability $\eta_B$ . For a fiber of length $L/2$ per arm, $\eta_{A,B}=10^{-\alpha L/(2\cdot 10)}$ with attenuation $\alpha$ in dB/km. Why: the relay sits in the middle, so each photon travels only half the total distance — this is what MDI trades for its two-photon requirement.

Step 2. Impose the coincidence. A Bell-state measurement needs both photons present in the same time window, and the two arms are independent, so the probabilities multiply: $\Pr(\text{both arrive})=\eta_A\eta_B\equiv\eta$ . Why: this single product is the origin of the entire rate penalty — one lost photon kills the round regardless of the other.

Step 3. Fold in the analyzer ceiling from the previous derivation: at most half of the coincidences yield a resolvable Bell state, so the useful click probability per pulse pair is $P_{\text{succ}}\,\eta\le\tfrac12\eta$ , and the rate carries this same $\eta$ dependence, $R\propto\eta_A\eta_B=\eta$ . Why: the rate is linear in the total transmittance $\eta$ but quadratic in each arm's transmittance — the defining scaling of MDI-QKD.

Step 4. Compare fairly. A direct point-to-point link over the full length $L$ has transmittance $10^{-\alpha L/10}$ , which equals $\eta_A\eta_B$ for the two-arm split — so MDI matches the order of a direct link's $\eta$ -scaling and buys detector security, not extra rate. Twin-field QKD instead interferes single-photon amplitudes at the relay, so a single arm's survival $\sqrt\eta$ suffices and $R\propto\sqrt\eta$ , beating the repeaterless bound. Why: replacing a two-photon coincidence with first-order interference is exactly the move from $\eta$ to $\sqrt\eta$ — the reason twin-field QKD reaches roughly twice the distance of MDI at the same loss.

Limiting cases

The secure rate and the security guarantee behave in instructive ways at the extremes; each row isolates one lever of the protocol.

Case	Result	Meaning
Lossless single photons	$R\to Y_{11}[1-H_2(e_{11}^X)-f\,H_2(e_{11}^Z)]$	rate set by the single-photon yield $Y_{11}$ ; positive whenever the phase error $e_{11}^X$ is small — the ideal ceiling
High-loss symmetric link	$R\propto\eta_A\eta_B=\eta$	two-photon coincidence forces linear scaling in total transmittance — the characteristic MDI distance penalty
Untrusted / malicious relay	$I(\text{key}\!:\!c)=0$	even if Eve owns Charlie and picks $c$ adversarially, sifted bits stay independent of $c$ — no detector attack helps
Twin-field successor	$R\propto\sqrt\eta$	single-photon interference at the relay recovers square-root scaling, beating the PLOB repeaterless bound while keeping measurement-device independence
Phase error at threshold	$e_{11}^X\to 11\%$	$1-2H_2(e)\to0$ , the secret rate vanishes; MDI's own optics must hold visibility well below this

Worked examples

1 · Rate-distance penalty over a 200 km fiber (fully worked)

A symmetric MDI-QKD link spans $L=200$ km of fiber at attenuation $\alpha=0.2$ dB/km, with the untrusted relay at the midpoint. Find each arm's transmittance, the two-photon coincidence probability, the best-case useful BSM click rate per pulse pair, and how a twin-field link over the same distance would compare.

Step 1. Each arm is $L/2=100$ km, so the per-arm loss is $100\times0.2=20$ dB and the transmittance is $\eta_A=\eta_B=10^{-20/10}=10^{-2}=\mathbf{0.01}$ . Both arms are identical by symmetry.

Step 2. The Bell measurement needs both photons at once, and the arms are independent, so the coincidence probability is the product $\eta=\eta_A\eta_B=10^{-2}\times10^{-2}=\mathbf{10^{-4}}$ .

Step 3. At most half the coincidences yield a resolvable Bell state, so the useful click probability per pulse pair is $P_{\text{succ}}\,\eta\le\tfrac12\times10^{-4}=\mathbf{5\times10^{-5}}$ . Only about one pulse pair in twenty thousand ever produces a sifted bit before any error correction — this is why MDI-QKD is rate-starved at long distance.

Step 4. Compare with twin-field QKD, whose click probability scales as $\sqrt\eta$ instead of $\eta$ : $\sqrt{10^{-4}}=10^{-2}$ . The ratio is $\sqrt\eta/\eta=1/\sqrt\eta=1/10^{-2}=\mathbf{100}$ , so at 200 km the twin-field relay produces useful events roughly two orders of magnitude more often than the MDI relay. η_A = η_B = 0.01, coincidence η = 10⁻⁴, useful click ≤ 5×10⁻⁵ per pair, and twin-field wins by ≈100× at this distance.

2 · Single-photon secret fraction and the 11 percent wall

From the single-photon rounds an MDI-QKD run measures a symmetric error rate $e_{11}^X=e_{11}^Z=3\%$ and uses reconciliation inefficiency $f=1.16$ . What secret fraction does each single-photon Bell event yield, and how much margin remains before the protocol fails?

Step 1. Compute the binary entropy at the operating point. With $H_2(x)=-x\log_2 x-(1-x)\log_2(1-x)$ and $x=0.03$ : $-0.03\log_2 0.03=0.03\times5.059=0.1518$ and $-0.97\log_2 0.97=0.97\times0.04394=0.0426$ , so $H_2(0.03)=\mathbf{0.1944}$ bits.

Step 2. Insert into the per-single-photon secret fraction $r=1-H_2(e_{11}^X)-f\,H_2(e_{11}^Z)$ : $r=1-0.1944-1.16\times0.1944=1-0.1944-0.2255=\mathbf{0.580}$ secret bits per single-photon Bell event. Positive and comfortably large — a healthy operating point.

Step 3. Find the wall. The one-way rate turns negative when $1-2H_2(e)=0$ , i.e. at $H_2(e)=\tfrac12$ . Evaluate at $e=11\%$ : $-0.11\log_2 0.11=0.11\times3.185=0.3503$ and $-0.89\log_2 0.89=0.89\times0.1681=0.1496$ , giving $H_2(0.11)=0.4999\approx\tfrac12$ . So the phase error may climb from 3% to about 11% before the secret rate vanishes — the same Shor–Preskill threshold BB84 obeys.

Step 4. Read the margin. At $e=3\%$ the run sits far below the $11\%$ ceiling, so realistic misalignment (a percent or two) and modest excess noise leave positive key; but because MDI needs two photons to interfere well, the interferometric visibility at the relay is what usually sets $e_{11}^X$ , making mode matching between Alice and Bob the practical battleground. r ≈ 0.58 bits per single-photon event, with roughly 8 percentage points of phase-error headroom before R hits zero.

Physics of the portrait

Measurement-device-independent QKD is the moment quantum cryptography stopped trusting its own hardware. It grew directly out of a decade of embarrassing detector hacks and the beautiful, impractical ideal of device independence — and it was one researcher's insistence on the practical middle path that gave it its form.

Origins · 1 minHoi-Kwong Lo and how this was discovered

Hoi-Kwong Lo

Caltech PhD 1994 · measurement-device-independent and decoy-state quantum cryptography

Hoi-Kwong Lo is a physicist at the University of Toronto who has spent his career dragging quantum key distribution from proof-of-principle toward deployable engineering. After a Caltech PhD in 1994 and early work with H. F. Chau on the security of QKD, he became one of the architects of the decoy-state method (with Xiongfeng Ma and Kai Chen in 2005), which rescued weak-coherent-pulse BB84 from the photon-number-splitting attack and remains standard in every fielded system. His signature contribution came in 2012, when with Marcos Curty and Bing Qi he proposed measurement-device-independent QKD in Physical Review Letters — a scheme that answered the era's most damaging class of attacks, the detector hacks that had blinded and biased commercial systems, by refusing to trust the detectors at all. The idea was to invert the usual geometry: instead of one party sending to another's measurement box, both parties send to a central relay that need not be trusted, because a successful Bell-state measurement there merely swaps entanglement and announces a symbol that carries no key information. Simultaneously and independently, Braunstein and Pirandola reached the same destination from the entanglement-swapping side under the name "side-channel-free QKD." Lo's version, with its explicit decoy-state recipe and BB84-like encoding, was the one experimentalists could build, and within a year groups had demonstrated it over tens of kilometers of fiber. It also planted the seed for twin-field QKD, the 2018 successor that beat the repeaterless secret-key bound while keeping Lo's central insight: put the fragile, attackable measurement where the enemy can have it, and lose nothing.

History

1984

— Bennett and Brassard introduce BB84, the first quantum key distribution protocol

2010

— Lydersen and colleagues blind commercial QKD detectors, exposing the detector loophole

2012

— Lo, Curty and Qi propose measurement-device-independent QKD; Braunstein and Pirandola give the equivalent side-channel-free scheme

2013

— first MDI-QKD experiments demonstrate the protocol over tens of kilometers of optical fiber

2018

— Lucamarini and colleagues introduce twin-field QKD, recovering square-root scaling and beating the repeaterless bound

Going further

Texts and papers. Lo, Curty & Qi, "Measurement-Device-Independent Quantum Key Distribution," Phys. Rev. Lett. 108, 130503 (2012) · Braunstein & Pirandola, "Side-Channel-Free Quantum Key Distribution," Phys. Rev. Lett. 108, 130502 (2012) · Lo, Ma & Chen, "Decoy State Quantum Key Distribution," Phys. Rev. Lett. 94, 230504 (2005) · Lucamarini et al., "Overcoming the rate–distance limit of QKD without quantum repeaters," Nature 557, 400 (2018) · Nielsen & Chuang, Quantum Computation and Quantum Information, §1.3.7 (teleportation) and §12.6 (QKD) · Preskill, Lecture Notes for Physics 219, Ch. 4 · Watrous, The Theory of Quantum Information, Ch. 2–3 (states, measurements, Bell bases).

Provenance. The Bell-basis definitions, the beam-splitter mode transform, and the 50% linear-optics BSM ceiling are textbook (Nielsen & Chuang §1.3.7; Watrous Ch. 2–3), and a verifier can reconstruct the singlet's output-port coincidence pattern directly from equation (3). The key-rate formula, the decoy yield relation $Y_n=Y_0+\eta_n-Y_0\eta_n$ , Poisson source statistics, and the $\approx 11\%$ one-way threshold ( $1-2H_2(e)>0$ ) follow Lo–Curty–Qi (2012) and standard decoy-state analysis. The security core $I(K\!:\!c)=0$ is the source-replacement / entanglement-swapping argument (Preskill Ch. 4). Worked-example numbers are re-derived here: $\eta=10^{-4}$ from $2\times20$ dB loss, $H_2(0.03)=0.1944$ , $H_2(0.11)=0.4999$ , and the $\sqrt\eta/\eta=100$ twin-field comparison are all directly checkable. No fabricated performance figures are asserted; the quoted constants ( $\tfrac12$ , $11\%$ , the scaling exponents) are standard analytic results.

Prerequisites. BB84 Protocol · Bell-State Measurement · Entanglement Swapping · Quantum Teleportation · Photon-Number-Splitting Attack. Leads to. Twin-Field QKD · Information Reconciliation and Privacy Amplification · Quantum Bit Error Rate and Sifting · E91 Protocol.

Ask the tutor: Ask me to walk through the beam-splitter algebra that pins the Bell-state measurement at 50%, or to show step by step why the relay's announcement leaks exactly zero bits about the key.

Is MDI-QKD the same thing as device-independent QKD?

No, and the near-identical names cause endless confusion. Device-independent QKD (DI-QKD) trusts nothing about the hardware: its security is certified by observing a loophole-free Bell inequality violation, which requires near-unit detection efficiency and is extraordinarily hard to realize. MDI-QKD trusts the sources but not the measurement: Alice and Bob must prepare well-characterized BB84 states, but the detectors — historically the most attacked component — can be owned and operated by Eve. MDI-QKD thus buys the single most valuable slice of device independence, immunity to detector attacks, at a fraction of the experimental cost, which is exactly why it is deployable today while full DI-QKD is still a laboratory milestone.

Why does making both parties transmitters help at all?

Because it moves the vulnerable measurement out of the trusted zone entirely. In BB84, Bob's detector is inside the security perimeter, so any imperfection in it — blinding, time-shift, efficiency mismatch — becomes an attack surface. In MDI-QKD neither honest party measures the incoming quantum signal at all; both only send. The one measurement in the protocol happens at the untrusted relay, whose sole output is a public classical symbol. Since that symbol merely heralds a successful entanglement swap and carries no key information, there is nothing for a detector attack to steal or bias. The geometry, not any new physical law, is what closes the loophole.

Why is the success probability stuck at 50 percent, and does it matter?

A passive linear-optics analyzer — beam splitters, phase shifters, detectors, no nonlinearity or ancilla photons — can distinguish at most two of the four Bell states, because $|\phi^+\rangle$ and $|\phi^-\rangle$ send both photons into the same spatial mode with the same polarization and produce identical detector statistics. That caps $P_{\text{succ}}$ at $\tfrac12$ for ideal single photons. It matters for rate: half of all otherwise-good coincidences are simply discarded, a constant factor on top of the transmittance penalty. It does not matter for security, since the discarded rounds are heralded as failures and never enter the key. In principle nonlinear optics or auxiliary entangled photons can beat $\tfrac12$ , but the resources are impractical.

If the relay is untrusted, what stops Eve from simply lying about the outcome?

Nothing stops her from lying — and it does not help her. Alice and Bob only keep rounds where Eve announces a valid Bell state, so lying about failures just costs rate, not security. If she announces a false success on rounds where she actually learned nothing, she has to guess a consistent correlation between Alice's and Bob's bits; any mismatch shows up as errors in the sampled test data (the $X$ -basis phase error), and once that error crosses the threshold the run aborts. Because her announcement is provably independent of the key ( $I(K\!:\!c)=0$ ), no announcement strategy — truthful, biased, or fabricated — lets her learn the sifted bits without being caught by the error estimate.

Why do we still need decoy states if the detectors are untrusted?

Because decoy states defend the source, not the detectors, and the source is still trusted in MDI-QKD. Real systems use attenuated laser pulses whose photon number is Poisson-distributed, so some pulses contain two or more photons — and multi-photon pulses are vulnerable to the photon-number-splitting attack, in which Eve siphons off a copy and lets one photon through. The MDI property does nothing about this, since it is a source-side leak. Decoy states solve it by sending several intensities and solving the resulting linear system for the single-photon yield $Y_{11}$ and phase error $e_{11}^X$ — the only quantities the key-rate formula certifies as secure — so the multi-photon events are safely bounded and subtracted.

How does MDI-QKD relate to twin-field QKD?

Twin-field QKD is MDI-QKD's direct descendant and keeps its central idea — an untrusted central relay — while changing what the relay measures. MDI-QKD demands a genuine two-photon coincidence, so its rate scales as the product of the two arm transmittances, $\eta_A\eta_B=\eta$ . Twin-field instead has Alice and Bob send dim phase-encoded coherent pulses that interfere at a single detector, first-order, so only one photon's worth of amplitude needs to survive one arm; the rate then scales as $\sqrt\eta$ , which beats the repeaterless secret-key capacity bound and roughly doubles the reachable distance. The cost is that twin-field must stabilize the optical phase between two independent, distant lasers — a demanding interferometric problem that MDI-QKD, relying on photon coincidence rather than phase, avoids.

Does MDI-QKD need true single photons to be secure?

No — it is secure with ordinary weak coherent pulses, which is what makes it practical. The security proof does not assume single photons; it isolates the single-photon component with decoy states and certifies the key from that component alone, treating all multi-photon contributions as potentially compromised. What single photons would buy is rate, not security: coherent pulses add accidental coincidences that raise the error rate. Decoy-state weak coherent pulses hit the sweet spot of security with off-the-shelf lasers, which is why every fielded MDI-QKD system uses them.