Twin-Field QKD

Every point-to-point quantum key distribution link fights the same enemy: fiber loss that grows exponentially with distance. A photon launched from Alice reaches Bob with probability equal to the transmittance $\eta$ , and in 2017 Pirandola, Laurenza, Ottaviani and Banchi proved this is not a hardware limitation but a fundamental ceiling — the repeaterless secret-key capacity is $-\log_2(1-\eta)$ , which falls off as $O(\eta)$ . No protocol can beat it; to go further you must change the setting. That is what Twin-Field QKD does — the first practical scheme to surpass the repeaterless bound without a single quantum memory. The idea, from Lucamarini, Yuan, Dynes and Shields in 2018, is to move the detector to the middle. Two senders at the ends prepare phase-coherent weak optical fields and send them toward an untrusted central node, Charlie, who interferes them on a beam splitter and announces which detector fired. Each field crosses only half the link, transmittance $\sqrt{\eta}$ , and a single photon reaching the midpoint from either sender heralds a key bit. Because the rate is set by one photon completing a half-trip rather than a full trip, it scales as $\sqrt{\eta}$ — the geometric mean of the two half-transmittances — halving the loss exponent and doubling the reachable distance. The catch is that first-order interference between two lasers hundreds of km apart demands global phase coherence: the relative phase of the arriving fields is the key, so residual drift washes out the fringe and inflates the error rate. TF-QKD trades the problem fiber does worst — attenuation — for one engineering can fight — phase stabilization. This article assembles that trade quantitatively: the $\sqrt{\eta}$ scaling, the interference that encodes the bit, and the decoy-state security that makes it real.

Key takeaways

Twin-Field QKD places an untrusted node (Charlie) at the midpoint; two distant senders transmit phase-randomized weak coherent fields, and a single-photon interference click heralds a correlated key bit.
Because a click needs only one photon to reach the centre over a half-channel of transmittance $\sqrt{\eta}$ , the rate scales as $O(\sqrt{\eta})$ — beating the repeaterless PLOB bound $-\log_2(1-\eta)\approx\eta/\ln2$ that caps every point-to-point protocol at $O(\eta)$ .
The square-root scaling halves the loss exponent: at $500$ km ( $\eta=10^{-10}$ ) single-photon heralding is a factor $1/\sqrt{\eta}=10^{5}$ more likely than an end-to-end transit.
The key lives in the relative phase $\phi-\theta$ ; which detector fires reveals whether Alice and Bob chose equal or opposite phases, and the untrusted node closes all detector side channels as in MDI-QKD.
Phase randomization plus the decoy-state method estimates the single-photon gain $Q_1$ and phase-error rate $e_1$ , defeating the photon-number-splitting attack as in decoy BB84.
Key idea: place an untrusted detector at the midpoint and herald a key bit on single-photon interference between two distant senders' phase-coherent weak fields. A click needs only one photon to reach the centre over half the channel, so the rate scales as $\sqrt{\eta}$ — the geometric mean of the two half-transmittances — beating the $O(\eta)$ repeaterless PLOB bound that constrains every direct point-to-point protocol.

The core insight

Place an untrusted detector at the midpoint and herald a key bit on single-photon interference between two distant senders' phase-coherent weak fields. A click requires only one photon to reach the centre over half the channel, so the rate scales as $\sqrt{\eta}$ — the geometric mean of the two half-transmittances — beating the $O(\eta)$ repeaterless PLOB bound that constrains every direct point-to-point protocol.

Where this lives today

Twin-Field QKD is now the frontier of long-haul quantum cryptography. Within a few years of the 2018 proposal, groups in China, the UK and elsewhere turned it into hardware that beat the repeaterless bound over real fiber: sending-or-not-sending implementations carried secure keys across 509 km of deployed field fiber and then, in laboratory spools, past 600 and eventually 833 km — distances at which every direct protocol delivers a rate indistinguishable from zero. These are the current world records for fiber-based QKD, and they exist only because single-photon interference converts the loss exponent from $\eta$ to $\sqrt{\eta}$ . The enabling technology is phase control: phase-locked loops, a co-propagating strong reference laser, and fast feedback holding the relative phase of two independent lasers stable to a fraction of a radian over hundreds of km of drifting fiber. Beyond point links, TF-QKD relaxes the trusted-node assumption today's metropolitan backbones depend on — the midpoint can sit in an untrusted telecom exchange — and it is the practical, memory-free precursor to true quantum repeaters.

The physical picture

Think of channel loss as a coin. In direct QKD a photon must cross the whole fiber, landing "heads" with probability $\eta$ . TF-QKD replaces that with two half-length coins, each landing heads with probability $\sqrt{\eta}$ , and — crucially — a single head from either coin heralds a bit. The eavesdropper-controlled node at the centre is a beam splitter feeding two detectors; when one fires, quantum mechanics forbids saying whether the photon came from Alice or Bob, and that which-path ambiguity fuses their independent phase choices into one shared bit. The first figure lays out this architecture and the transmittances that make it win.

Figure

Twin-field architecture: Alice and Bob each send a phase-coherent field over a half-channel of transmittance √η to an untrusted midpoint Charlie, who interferes them on a 50:50 beam splitter and announces which detector clicked. At 500 km of fiber the end-to-end transmittance is η = 10⁻¹⁰, but each half-channel passes √η = 10⁻⁵, so single-photon heralding is 10⁵ times more likely than a full transit.

The interference is first-order — amplitude interference of a single photon — and that is the whole game. MDI-QKD also puts detectors at an untrusted centre, but performs a two-photon Bell-state measurement: both photons must survive their half-channels and coincide, so its usable-event probability is the product $\sqrt{\eta}\cdot\sqrt{\eta}=\eta$ . TF-QKD heralds on one photon from either side, a sum $\sqrt{\eta}+\sqrt{\eta}$ linear in $\sqrt{\eta}$ . That single algebraic difference — sum versus product — is the entire rate-distance advantage. The second figure shows how the resulting rate curve bends away from the fundamental bound.

Figure

Rate versus distance on a log scale: the PLOB repeaterless bound falls as η (slope 0.02 decades per km, in red), while twin-field QKD falls as √η (slope 0.01 decades per km, in blue). The curves cross near 300 km at R ≈ 1.4×10⁻⁶ bits per pulse; beyond the crossing TF-QKD is the only known protocol above the repeaterless secret-key capacity.

That the central node is untrusted is a feature, not a bug. Every detector sits at Charlie, outside Alice and Bob's trust boundary, so blinding, time-shift, and dead-time attacks buy Eve nothing she could not already do by being Charlie. Security rests on the statistics the senders accumulate, not on any hardware in the middle — the measurement-device-independence MDI-QKD offers, now with a better rate exponent.

The core equations

The reference point is the ceiling every direct protocol runs into. Pirandola, Laurenza, Ottaviani and Banchi proved that the secret-key capacity of a pure-loss channel of transmittance $\eta$ — the most key any point-to-point scheme can distill per channel use, with unlimited two-way classical communication — is fixed and finite.

R_{\mathrm{PLOB}}(\eta) = -\log_2(1-\eta) \qquad (1)

where: $R_{\mathrm{PLOB}}$ — maximum secret bits per channel use over a point-to-point lossy channel; $\eta$ — end-to-end transmittance. Reading: a hard upper bound; for small $\eta$ it linearizes to $\eta/\ln2$ , so any direct protocol delivers $O(\eta)$ — the wall TF-QKD climbs over. Fiber attenuation makes $\eta$ shrink exponentially with distance, and splitting the link converts that exponent's slope. The half-channel each field crosses has transmittance $\sqrt{\eta}$ , the geometric mean that names the advantage.

\eta = 10^{-\alpha L/10}, \qquad \sqrt{\eta} = 10^{-\alpha L/20} \qquad (2)

where: $\alpha$ — fiber attenuation, typically $0.2\ \mathrm{dB/km}$ at $1550$ nm; $L$ — total Alice–Bob length; $\sqrt{\eta}=10^{-\alpha(L/2)/10}$ is the transmittance of a half-length $L/2$ . Reading: the square root halves the dB loss, so a rate $\propto\sqrt{\eta}$ decays half as fast with distance as one $\propto\eta$ . At Charlie the two coherent fields meet on a 50:50 beam splitter, which maps input amplitudes to their sum and difference at the two output ports — the mechanism that turns two absolute phases into one measurable relative phase.

|\alpha e^{i\phi}\rangle_A \otimes |\beta e^{i\theta}\rangle_B \xrightarrow{\ \text{50:50 BS}\ } \left|\tfrac{\alpha e^{i\phi}+\beta e^{i\theta}}{\sqrt2}\right\rangle_c \left|\tfrac{\alpha e^{i\phi}-\beta e^{i\theta}}{\sqrt2}\right\rangle_d \qquad (3)

where: $\alpha,\beta$ — field amplitudes arriving after half-channel loss; $\phi,\theta$ — the phases Alice and Bob impose; $c,d$ — the detector modes. Reading: port $c$ carries the sum, port $d$ the difference, so which port lights up depends only on how the phases add or cancel. Squaring the output amplitudes gives the click probabilities; their dependence on the phase difference is the encoding — for balanced amplitudes one detector goes dark for equal phases and the other for opposite phases.

P_c \propto |\alpha e^{i\phi}+\beta e^{i\theta}|^2, \qquad P_d \propto |\alpha e^{i\phi}-\beta e^{i\theta}|^2 \qquad (4)

where: $P_c,P_d$ — click probabilities in the constructive and destructive ports; the relative phase $\phi-\theta$ controls the split. Reading: with $\alpha=\beta$ , port $d$ is dark when $\phi=\theta$ and port $c$ is dark when $\phi-\theta=\pi$ , so a click labels the senders' phase agreement — the raw key bit. The certified secret rate combines the single-photon contribution with the cost of error correction, in the GLLP/decoy form familiar from BB84; only single-photon events, whose statistics the decoy method pins down, are credited to the key.

R_{\mathrm{TF}} = \tfrac12\Big\{\, Q_1\big[1-H_2(e_1)\big] - f\,Q_\mu H_2(E_\mu) \,\Big\} \qquad (5)

where: $Q_1$ — single-photon heralding gain; $e_1$ — single-photon phase-error rate; $Q_\mu,E_\mu$ — gain and QBER of signal pulses of mean photon number $\mu$ ; $f\ge1$ — reconciliation inefficiency; $\tfrac12$ — sifting factor. Reading: the first term is the private information carried by single photons, the second subtracts what error correction leaks, and a positive difference is distillable key. The binary entropy quantifies both the privacy of the single-photon bits and the leakage of reconciliation, so it appears twice in the rate.

H_2(x) = -x\log_2 x - (1-x)\log_2(1-x) \qquad (6)

where: $x$ — an error probability such as $e_1$ or $E_\mu$ , with $0\le x\le\tfrac12$ . Reading: $H_2(0)=0$ (free key), $H_2(\tfrac12)=1$ (no key); $1-H_2(e_1)$ stays positive for all $e_1<\tfrac12$ , though reconciliation pushes the usable threshold to about $11\%$ . Putting the scaling together gives the headline inequality: the single-photon gain, and hence the rate, inherits the half-channel's $\sqrt{\eta}$ , overtaking the bound any $O(\eta)$ protocol obeys.

Q_1 \sim O(\sqrt{\eta}), \qquad R_{\mathrm{TF}} \sim O(\sqrt{\eta}) \;>\; R_{\mathrm{PLOB}} \sim O(\eta) \qquad (7)

where: $Q_1$ — single-photon gain set by one photon reaching the centre; $R_{\mathrm{TF}}$ — the TF rate, dominated by $Q_1$ at high loss. Reading: since $\sqrt{\eta}\gg\eta$ as $\eta\to0$ , the TF curve sits above PLOB beyond a crossover of a few hundred km.

Derivation ASquare-root scaling from single-photon heralding

The goal is to show why the twin-field heralding probability, and hence its rate, scales as $\sqrt{\eta}$ while both direct and MDI-QKD scale as $\eta$ — the one structural fact that lets TF-QKD surpass the repeaterless bound. We compare the probability of a usable heralding event in three architectures over the same total transmittance $\eta=10^{-\alpha L/10}$ , counting how many half-channels a photon must cross before a click, then translate that arrival probability into a rate through the single-photon gain.

Step 1. In direct QKD a photon emitted by Alice must cross the entire fiber and be detected, so the per-pulse detection probability is $P^{\mathrm{direct}}=\eta_d\,\eta$ , linear in the full transmittance $\eta$ . Why: with sender and receiver at the two ends, there is exactly one full-length channel to survive, so the loss enters once as $\eta$ .

Step 2. In MDI-QKD both photons must each cross a half-channel and coincide at the centre for a Bell-state measurement, so $P^{\mathrm{MDI}}\propto\sqrt{\eta}\cdot\sqrt{\eta}=\eta$ . Why: a two-photon coincidence is a logical AND of two independent survivals, and the probability of both is the product of the two half-transmittances, which reassembles the full $\eta$ .

Step 3. In TF-QKD a single photon from either sender reaching the midpoint triggers the interference click, so $P^{\mathrm{TF}}_{\mathrm{herald}}\propto\sqrt{\eta}+\sqrt{\eta}=2\sqrt{\eta}$ . Why: heralding is a logical OR over the two senders, a sum rather than a product, and each term carries only one half-channel's loss $\sqrt{\eta}$ — the exponent is halved.

Step 4. The single-photon gain inherits this, $Q_1\propto P^{\mathrm{TF}}_{\mathrm{herald}}\propto\sqrt{\eta}$ , and feeding it into $R_{\mathrm{TF}}\sim Q_1[1-H_2(e_1)]$ gives $R_{\mathrm{TF}}\sim O(\sqrt{\eta})$ . Why: the rate is proportional to how often a single-photon click occurs, so the $\sqrt{\eta}$ arrival probability passes straight through to the rate, which then dominates $O(\eta)$ at long distance. *Verified: reproduces the central result of Lucamarini et al. (2018) and the PLOB scaling of Pirandola et al. (2017); at 500 km, $\eta=10^{-10}$ gives $\sqrt{\eta}=10^{-5}$ , an advantage factor $1/\sqrt{\eta}=10^{5}$ in heralding probability.*

Go deeper · Derivation B · 1 minPhase encoding and the error rate from imperfect interference

Derivation BPhase encoding and the error rate from imperfect interference

The aim is to compute the intrinsic quantum bit error rate of the single-photon interference as a function of residual phase mismatch, exposing why phase stabilization is the decisive hurdle of TF-QKD. From the balanced beam-splitter click probabilities, we let the realized relative phase differ from the intended encoding by a residual $\delta$ folding in laser drift and reference error, read off the misidentification probability, and average over the distribution of $\delta$ to get an error rate in terms of fringe visibility.

Step 1. The destructive-port intensity for balanced amplitudes is $P_d\propto|\alpha|^2+|\beta|^2-2|\alpha||\beta|\cos(\phi-\theta)$ , which at $\alpha=\beta$ becomes $P_d\propto1-\cos\delta$ and $P_c\propto1+\cos\delta$ , with $\delta$ the residual phase mismatch. Why: the cross term $2|\alpha||\beta|\cos\delta$ is the interference that makes the ports complementary in $\delta$ .

Step 2. An error is a click in the port opposite the intended bit, so $e_{\mathrm{opt}}=P_d/(P_c+P_d)=(1-\cos\delta)/2$ , vanishing at $\delta=0$ . Why: the normalization removes overall intensity, leaving a pure fringe that maps phase error onto bit error.

Step 3. Averaging over zero-mean Gaussian jitter of variance $\sigma^2$ uses $\langle\cos\delta\rangle=e^{-\sigma^2/2}\equiv V$ , giving $e_{\mathrm{opt}}=(1-V)/2=(1-e^{-\sigma^2/2})/2$ . Why: the Gaussian characteristic function is $e^{-\sigma^2/2}$ , so jitter enters only through the visibility $V$ .

Step 4. A positive rate needs $e_1$ small enough that $1-H_2(e_1)$ survives reconciliation, so $\sigma$ must be held to a fraction of a radian; for $\sigma=0.2$ rad, $V=0.980$ and $e_{\mathrm{opt}}\approx0.99\%$ . Why: the exponential sensitivity of $V$ to $\sigma^2$ means modest drift collapses the fringe, mandating active phase locking or a shared reference. *Verified: the visibility-to-error relation $e_{\mathrm{opt}}=(1-V)/2$ is standard interferometry; $\sigma=0.1,0.2,0.3$ rad give $V=0.995,0.980,0.956$ and $e_{\mathrm{opt}}=0.25\%,0.99\%,2.2\%$ , consistent with reported TF-QKD phase-stabilization budgets.*

Go deeper · Derivation C · 1 minDecoy-state estimation of the single-photon yield

Derivation CDecoy-state estimation of the single-photon yield

The purpose is to show how phase-randomized weak coherent pulses at several intensities let Alice and Bob lower-bound the single-photon gain $Q_1$ and upper-bound its error rate $e_1$ , defeating the photon-number-splitting attack without a true single-photon source. We use that a phase-randomized coherent state is a classical Poisson mixture of Fock states, write the measured gain as a Poisson-weighted sum over the unknown $n$ -photon yields, and note that varying the mean photon number makes this a solvable linear system for the quantities the rate formula needs.

Step 1. Phase randomization erases coherence, so a pulse of mean photon number $\mu$ contains $n$ photons with Poisson probability $P(n|\mu)=\mu^n e^{-\mu}/n!$ , and Eve sees only photon-number statistics. Why: without a fixed phase the state is diagonal in the Fock basis, a genuine mixture, which makes the decoy accounting rigorous.

Step 2. The measured gain is the Poisson average of the yields, $Q_\mu=\sum_{n=0}^{\infty}(\mu^n e^{-\mu}/n!)\,Y_n$ , where $Y_n$ is the heralding probability given $n$ photons sent. Why: each Fock component clicks with its own yield, so the total click rate is their Poisson-weighted mixture.

Step 3. Measuring $Q_\mu$ at several intensities $\{\mu_1,\mu_2,\mu_3\}$ — including a vacuum decoy — bounds $Y_0,Y_1$ , hence $Q_1=\mu e^{-\mu}Y_1$ and $e_1$ . Why: different $\mu$ weight the same fixed $Y_n$ differently, so a few gain measurements pin the leading unknowns — the Lo–Ma–Chen construction.

Step 4. Because Eve cannot suppress single-photon events without distorting the decoy statistics, any PNS attack is exposed, and only the certified $Q_1,e_1$ enter equation (5). Why: the decoy intensities make the single-photon yield independently observable, so tampering shows up as an anomaly. *Verified: identical decoy machinery to decoy BB84 (Hwang; Lo–Ma–Chen; Wang); with $\mu=0.1$ , $Y_1\approx6\times10^{-6}$ at 500 km gives $Q_1=\mu e^{-\mu}Y_1\approx5.4\times10^{-7}$ , feeding a positive rate in equation (5).*

Limiting cases

How TF-QKD's rate compares with fundamental and practical references in the high-loss regime $\eta\to0$ , where the square-root advantage matters most.

Case	Result	Meaning
PLOB repeaterless bound	$R_{\mathrm{PLOB}}=-\log_2(1-\eta)\xrightarrow{\eta\to0}\eta/\ln2$	Hard upper bound on secret key per use for any point-to-point channel; $O(\eta)$ . TF-QKD's central station takes the end-to-end link outside its scope.
Direct and MDI-QKD scaling	$R_{\mathrm{direct}}\sim O(\eta),\ R_{\mathrm{MDI}}\sim O(\eta)$	BB84, decoy BB84 and MDI-QKD are all linear in $\eta$ ; MDI's two-photon coincidence reassembles the full $\eta$ from two half-channels.
TF-QKD scaling	$R_{\mathrm{TF}}\sim O(\sqrt{\eta})$	Single-photon interference heralds on one photon reaching the midpoint with probability $\sqrt{\eta}$ , halving the loss exponent and surpassing PLOB past the crossover.
Ideal single-repeater bound	$R\le-\log_2(1-\sqrt{\eta})$	TF-QKD approaches the capacity of one idealized intermediate node; it cannot beat $O(\sqrt{\eta})$ , consistent with its single station.
Perfect fringe, no jitter	$\sigma\to0\Rightarrow V\to1,\ e_{\mathrm{opt}}\to0$	Ideal phase locking zeroes the intrinsic optical error; the rate is then limited only by detector noise and reconciliation.

Common trapTwin-field QKD breaks the repeaterless bound, so the PLOB limit must be wrong.

It does neither. The PLOB bound $-\log_2(1-\eta)$ governs a single point-to-point channel, and TF-QKD is not that setting: an untrusted station at the midpoint splits the link into two half-channels of transmittance $\sqrt{\eta}$ , making it effectively a one-node repeater whose capacity scales as $\sqrt{\eta}$ . TF-QKD surpasses PLOB by changing the geometry, not by violating a theorem — and it still obeys the tighter single-repeater bound $-\log_2(1-\sqrt{\eta})$ . Two further traps: the node is untrusted and may be Eve, but the advantage comes from single-photon interference, not from any node relaying a photon; and the two lasers' global phase must be locked or post-selected, since ignoring residual phase noise washes out the fringe, climbs the QBER, and a rate estimate omitting $e_1$ can falsely certify an insecure key.

Worked examples

1 · The square-root advantage at 500 km (confidence builder)

A twin-field link spans $L=500$ km of fiber at $\alpha=0.2$ dB/km. Compare the end-to-end and half-channel transmittances, the PLOB ceiling, and the heralding advantage over a full transit.

Step 1. End-to-end loss is $\alpha L=0.2\times500=100$ dB, so $\eta=10^{-100/10}=\mathbf{10^{-10}}$ — a direct photon has one chance in ten billion of crossing.

Step 2. Each half-channel is $250$ km, $50$ dB, so $\sqrt{\eta}=10^{-50/10}=\mathbf{10^{-5}}$ — the probability a single photon reaches Charlie from one side, and the exponent that sets the TF rate.

Step 3. The PLOB ceiling is $R_{\mathrm{PLOB}}=-\log_2(1-10^{-10})\approx10^{-10}/\ln2=\mathbf{1.44\times10^{-10}}$ bits per use — the best any direct protocol could do here.

Step 4. The heralding advantage is $\sqrt{\eta}/\eta=1/\sqrt{\eta}=10^{5}$ . Single-photon heralding is $10^{5}$ times more likely than an end-to-end transit — why TF-QKD delivers a usable rate where direct QKD delivers essentially zero.

2 · Assembling a secret rate from decoy and phase data (fully worked)

At the same 500 km link take $\eta_d=0.6$ , $\mu=0.1$ , single-photon yield $Y_1\approx\sqrt{\eta}\,\eta_d=6\times10^{-6}$ , and $e_1=1\%$ , neglecting reconciliation for an upper estimate. Find $Q_1$ and the secret rate.

Step 1. The single-photon gain is $Q_1=\mu e^{-\mu}Y_1$ . With $\mu=0.1$ , $\mu e^{-\mu}=0.0905$ , so $Q_1=0.0905\times6\times10^{-6}=\mathbf{5.4\times10^{-7}}$ heralding events per pulse.

Step 2. The privacy factor is $1-H_2(e_1)$ with $e_1=0.01$ : $H_2(0.01)=\mathbf{0.081}$ , so $1-H_2(e_1)=0.919$ — each certified single-photon bit is $92\%$ private.

Step 3. The rate (with the $\tfrac12$ sifting factor, reconciliation dropped) is $R_{\mathrm{TF}}\approx\tfrac12 Q_1[1-H_2(e_1)]=0.5\times5.4\times10^{-7}\times0.919=\mathbf{2.5\times10^{-7}}$ bits per pulse.

Step 4. Against Example 1's ceiling, $R_{\mathrm{TF}}/R_{\mathrm{PLOB}}=2.5\times10^{-7}/1.44\times10^{-10}\approx\mathbf{1.7\times10^{3}}$ . TF-QKD beats the repeaterless bound by more than three orders of magnitude at 500 km — order $10^{-7}$ per pulse instead of the sub- $10^{-9}$ any direct scheme is capped at.

3 · How much phase noise can the protocol tolerate?

Phase jitter between Alice's and Bob's lasers is modelled as zero-mean Gaussian with standard deviation $\sigma$ . Find the optical error rate for $\sigma=0.1,0.2,0.3$ rad and comment on the security margin.

Step 1. Visibility is $V=e^{-\sigma^2/2}$ : for $\sigma=0.1,0.2,0.3$ rad, $V=0.995,0.980,0.956$ .

Step 2. Optical error is $e_{\mathrm{opt}}=(1-V)/2$ , giving $\mathbf{0.25\%,\ 0.99\%,\ 2.2\%}$ — even a third of a radian keeps the intrinsic error near $2\%$ .

Step 3. The single-photon privacy $1-H_2(e_1)$ stays comfortably positive ( $H_2(0.022)\approx0.15$ ), well below the $\sim11\%$ threshold where reconciliation swallows the key. Phase noise up to a few tenths of a radian is survivable; holding $\sigma$ there over hundreds of km of drifting fiber is exactly what phase-reference distribution and active locking achieve.

Physics of the portrait

Twin-Field QKD is where the rate-distance question of quantum cryptography finally cracked open — a bound proved in 2017 and a protocol that overtakes it published one year later, from a laboratory that also had to build the phase stabilization to make it real.

Origins · 1 minMarco Lucamarini and how this was discovered

Marco Lucamarini

co-inventor of twin-field QKD (2018), Toshiba Cambridge and University of York · quantum key distribution and photonic security

The rate-distance limit of quantum cryptography was, for two decades, the field's most stubborn wall. Every discrete-variable protocol from BB84 onward delivered a rate falling linearly with transmittance, and in 2017 Pirandola, Laurenza, Ottaviani and Banchi proved that this $O(\eta)$ scaling is a fundamental repeaterless capacity, not an engineering shortcoming. The obvious escape — a quantum repeater with memories and entanglement swapping — remained far beyond reach. Marco Lucamarini, with Zhiliang Yuan, James Dynes and Andrew Shields at Toshiba's Cambridge Research Laboratory, found a different door. Their 2018 Nature paper, "Overcoming the rate-distance limit of quantum key distribution without quantum repeaters," placed an untrusted interferometric detector at the link's midpoint and heralded key bits on single-photon, first-order interference between two phase-locked distant sources. Because one photon crossing a half-channel suffices, the rate scales as $\sqrt{\eta}$ , surpassing the repeaterless bound with no quantum memory at all. The insight fused three older strands: the measurement-device independence of MDI-QKD, the decoy-state defence against photon-number-splitting, and phase-encoded single-photon interference across hundreds of kilometres. Variants soon sharpened it — Wang's sending-or-not-sending scheme and the phase-matching QKD of Ma, Zeng and Zhou — and within a few years experiments carried secure keys past 500 km, the first to beat the repeaterless capacity.

History

2017

— Pirandola, Laurenza, Ottaviani and Banchi prove the repeaterless secret-key capacity −log₂(1−η)

2018

— Lucamarini, Yuan, Dynes and Shields propose twin-field QKD in Nature 557, 400

2018

— Wang introduces sending-or-not-sending and Ma, Zeng and Zhou introduce phase-matching QKD

2019

— first laboratory TF-QKD demonstrations surpass the PLOB bound over installed-grade fiber

2022

— twin-field QKD reaches 833 km of fiber, the longest-distance QKD demonstrated

Going further

Texts and papers. Lucamarini, Yuan, Dynes, Shields, "Overcoming the rate-distance limit of quantum key distribution without quantum repeaters," Nature 557, 400 (2018) · Pirandola, Laurenza, Ottaviani, Banchi, "Fundamental limits of repeaterless quantum communications," Nature Communications 8, 15043 (2017) · Ma, Zeng, Zhou, "Phase-Matching Quantum Key Distribution," Phys. Rev. X 8, 031043 (2018) · Wang, Yu, Hu, "Twin-field quantum key distribution with large misalignment error" (sending-or-not-sending), Phys. Rev. A 98, 062323 (2018) · Nielsen and Chuang, Quantum Computation and Quantum Information (QKD, no-cloning) · Preskill, Lecture Notes on Quantum Computation (quantum cryptography) · Wilde, Quantum Information Theory, 2nd ed. (private capacity and key distillation).

Provenance. A verifier should confirm: (1) the PLOB bound $-\log_2(1-\eta)$ and its limit $\eta/\ln2$ against Pirandola et al. (2017); (2) the $\sqrt{\eta}$ -versus- $\eta$ heralding argument and $O(\sqrt{\eta})$ rate against Lucamarini et al. (2018); (3) the beam-splitter transformation and $e_{\mathrm{opt}}=(1-V)/2$ from standard quantum optics; (4) the decoy decomposition $Q_\mu=\sum_n(\mu^n e^{-\mu}/n!)Y_n$ and $Q_1=\mu e^{-\mu}Y_1$ from Lo–Ma–Chen theory; (5) the GLLP/decoy rate structure and $H_2$ from Nielsen and Chuang / Wilde. The attenuation $0.2$ dB/km at 1550 nm is standard; the worked numbers ( $\eta=10^{-10}$ , $\sqrt{\eta}=10^{-5}$ at 500 km; $Q_1\approx5.4\times10^{-7}$ ; $e_{\mathrm{opt}}\approx0.99\%$ at $\sigma=0.2$ rad) are recomputed in-text, and the distance records (509–833 km) checked against the cited experiments.

Prerequisites. BB84 Protocol · Photon-Number-Splitting Attack · Bell-State Measurement · Quantum Bit Error Rate and Sifting. Leads to. Information Reconciliation and Privacy Amplification · Entanglement Swapping · No-Cloning Theorem in Cryptography.

Ask the tutor: Want to see how the crossover distance shifts if you change the detector efficiency, dark-count rate, or fiber attenuation — or how sending-or-not-sending tightens the finite-key security? Ask and we will work it through.

Is twin-field QKD a quantum repeater?

Not quite — it is best read as a memory-free precursor to one. A true quantum repeater stores entanglement in quantum memories and swaps it in stages, achieving a rate that falls only polynomially with distance. TF-QKD has one intermediate station and no memory: it recovers the loss exponent from $\eta$ to $\sqrt{\eta}$ , matching the capacity of a single idealized repeater node but no better. So it delivers the first rung of the repeater ladder with only linear optics and interference, which is why it is buildable today while full repeaters are not. The bridge is real: the central single-photon interference is the amplitude-interference cousin of the Bell-state measurement entanglement swapping performs.

Why must the two lasers be phase-locked when they are hundreds of km apart?

Because the key bit is written in the relative phase $\phi-\theta$ of the fields arriving at Charlie, and single-photon interference is only visible if that phase is stable during the measurement. If the independent lasers drift, the encoding is corrupted by a residual $\delta$ , the visibility drops as $V=e^{-\sigma^2/2}$ , and the optical error rate rises as $(1-V)/2$ ; left uncontrolled, the fringe washes out and no key survives. Real systems fight this with a co-propagating strong phase-reference pulse and fast feedback that cancels the accumulated drift, holding $\sigma$ to a fraction of a radian — the hardest piece of TF-QKD engineering.

If the central node is untrusted, why can't Eve just sit there and steal the key?

Because a detection announcement reveals nothing about the key beyond what the security analysis already accounts for. Charlie only says which detector clicked; that outcome depends on the relative phase of the two fields, not on either sender's absolute phase in a way Eve can exploit without disturbing the interference. Any attack she mounts — including operating the node herself — either leaves the decoy and error statistics intact (she learned nothing usable) or perturbs them (Alice and Bob detect it and abort). This is the measurement-device-independence TF-QKD inherits from MDI-QKD: all detector side channels are closed because the detectors were never trusted.

How is this different from MDI-QKD, which also uses an untrusted midpoint?

The difference is first-order versus second-order interference. MDI-QKD performs a two-photon Bell-state measurement: both photons must survive their half-channels and coincide, and the probability of both arriving is the product $\sqrt{\eta}\cdot\sqrt{\eta}=\eta$ — so its rate scales like direct QKD. TF-QKD heralds on single-photon amplitude interference, where one photon from either sender is enough, giving a heralding probability $\propto\sqrt{\eta}$ . That sum-versus-product distinction is the whole advantage. The cost is that single-photon interference demands global phase coherence, which MDI's two-photon coincidence does not — TF-QKD buys a better exponent by taking on a harder stabilization problem.

Where does the decoy-state method fit, and why is it needed?

TF-QKD uses weak coherent pulses, not true single photons, so some pulses carry two or more photons a photon-number-splitting eavesdropper could tap undetected. The decoy method neutralizes this: because a phase-randomized pulse is a Poisson mixture of photon-number states, sending several intensity settings lets Alice and Bob solve for each number's yield, lower-bounding the single-photon gain $Q_1$ and upper-bounding its error $e_1$ . Only that certified contribution is credited to the key. Any PNS attack that forwards multiphoton pulses distorts the decoy statistics and is caught — the same machinery that secured decoy BB84, now applied to heralding clicks.

What sets the crossover distance where TF-QKD starts to win?

It is where the rate curves meet: $R_{\mathrm{TF}}\approx c_1\sqrt{\eta}$ crosses $R_{\mathrm{PLOB}}\approx\eta/\ln2$ when $\sqrt{\eta}=c_1\ln2$ , i.e. $\eta=(c_1\ln2)^2$ . The constant $c_1$ bundles detector efficiency, dark counts, the intensity $\mu$ , and the sifting factor, so the crossover is apparatus-dependent but lands a few hundred km out — around 300 km in typical experiments. Below it, direct or MDI protocols are better, because the full-transit $\eta$ is not yet small enough for the $\sqrt{\eta}$ head start to pay off. Beyond it, TF-QKD is the only known protocol above the repeaterless capacity, and its advantage grows without bound with distance.