How Do a CW Laser, an EOM, and an APD Generate a QKD Key?

A 1550 nm CW laser, electro-optic modulators and avalanche photodiodes can form a weak-coherent QKD system, but each component does only part of the job. The transmitter prepares optical states, the receiver turns measurements into candidate bits, and both endpoints use statistical analysis and classical processing to obtain a shared secret key. The fiber carries encoded states; usable keys are distilled locally.

This article uses one consistent example: phase-encoded, two-time-bin, decoy-state BB84. BB84, COW and DPS can share components while using different encodings and security analyses, so their reported key rates cannot be interchanged. Security also depends on the device model, private randomness, authentication and finite-data security parameters; an absence of obvious disturbance is not itself a security proof.^[7][8]

From CW light to two time bins: preparing the state

EOM is a family of devices. A phase modulator (PM) changes optical phase; a Mach–Zehnder intensity modulator (IM) converts a phase difference into output power. Pulse carving, decoy-intensity selection and phase encoding are separate functions, implemented using multiple devices or an integrated module.^[2]

In Figure 1, an IM carves CW light into pulses and a PM randomizes the common phase. An unbalanced Mach–Zehnder interferometer (AMZI) prepares early and late temporal modes separated by Δt. Alice sets their relative phase φ_A; another IM chooses signal/decoy intensity and a VOA sets attenuation. Real systems also need synchronization, phase/polarization stabilization, filtering and monitoring.^[1][3]

One symbol here is the entire pair, and μ is its total mean photon number. Its single-photon component can be represented as:

|ψ(φ_A)⟩ = (|E⟩ + e^iφ_A|L⟩)/√2

E and L are temporal modes. This is a single-photon superposition, not a claim that every weak-coherent symbol contains one photon. The bases can be B₀ = {0, π} and B₁ = {π/2, 3π/2}. States within a basis are orthogonal; squared overlap between bases is 1/2.^[1][6]

Relative and global phase have different roles. E and L retain coherence within a pair so Bob can interfere them. The common phase θ varies randomly between symbols under standard decoy-analysis assumptions. Multiplying both modes by e^iθ preserves their relative phase. CW is the source selected here, not a requirement of BB84 itself.^[3][8]

Figure 1 | One phase-encoded BB84 topology. Global and relative phases have separate roles; both receiver ports have SPADs. Only middle-slot events are used. Synchronization, stabilization and monitoring details are omitted; this is not a construction or bend-radius plan.

Weak-coherent light is not a single-photon source

Phase-randomized coherent symbols have Poisson photon-number statistics:

P(n) = e^−μ μⁿ/n!; P(0) = e^−μ; P(1) = μe^−μ; P(≥2) = 1 − (1 + μ)e^−μ.^[3]

Figure 2 uses a common scale. At μ = 0.1, vacuum, single-photon and multi-photon probabilities are about 90.48%, 9.05% and 0.47%. At μ = 0.5 the multi-photon probability is about 9.02%. These describe sent symbols, not the composition of Bob’s clicks, which is reweighted by loss, efficiency and background.

Multi-photon components allow a photon-number-splitting (PNS) attack: in an idealized attack, Eve retains one photon, forwards others and waits for basis announcements before measuring. This need not raise QBER. Lowering μ reduces multi-photon probability but also reduces detections; it does not replace a security analysis.^[3][8]

Decoy analysis randomly varies μ and combines the gains and error rates of different intensities to bound single-photon contributions. The illustrated μ_s = 0.5, μ_d = 0.1 and μ_v = 0 are examples, not optimized settings. Real vacuum preparations can contain residual light. Standard analysis assumes phase randomization and no additional intensity label in states conditioned on the same photon number. Decoys give statistical bounds; they do not identify individual single-photon clicks.^[3][5]

Figure 2 | μ is the mean for the whole pair. Bars share a scale and values are calculated from the Poisson law. Intensities are examples, not optimized settings or photon-number labels assigned to SPAD clicks.

Bob reads bits through interference, detection and sifting

An APD does not directly measure optical phase. Bob’s AMZI matches Δt so early light taking the long path overlaps late light taking the short path in the middle slot. Choosing φ_B = 0 or π/2 selects the measurement basis. The 50:50 couplers split and recombine paths; the phase setting chooses the basis. Outer slots are not used for this phase-bit readout.^[1]

For an ideal single-photon event, balanced amplitudes, equal port efficiencies and no background, with fixed interferometer phases absorbed into the calibrated D₀/D₁ convention:

P(D₀ | accepted click) = cos²[(φ_A − φ_B)/2]; P(D₁ | accepted click) = 1 − P(D₀ | accepted click).

Matching bases ideally produce Alice’s bit; different bases give either result with probability 1/2. Figure 3 separates phase settings, bases and detector outcomes. These conditional probabilities do not include the probability of no detection due to channel loss.

InGaAs/InP SPADs can detect 1550 nm light. A SPAD is an APD operated in Geiger mode: avalanche, quenching and readout electronics produce an event, and time-tagging records its time and port. Ordinary threshold SPADs do not resolve photon number, and not every click is caused by a signal photon.^[4]

Values depend on temperature, bias, gating, hold-off time and device. Modulator bandwidth, symbol clock and sustainable SPAD count rate are different specifications.^[4]

Bob announces accepted detection positions; both endpoints disclose bases and required intensity information, removing no-click and incompatible-basis events. Independent, unbiased choices give a 1/2 basis-match probability among detections, not one retained bit for every two sent symbols. Biased bases, test data and signal-state selection further change the usable fraction.^[5][7]

Figure 3 | Ideal single-photon component; probabilities are conditioned on accepted middle-slot clicks. The constructed eight-symbol example contains six clicks and four basis matches. It cannot estimate QBER or establish security.

After the clicks: distilling a secret key

Sifted data can still contain errors and information known to Eve. Parameter estimation uses basis, intensity and test data to bound single-photon contributions and phase errors. Revealed test bits cannot remain secret.^[3][5]

Information reconciliation exchanges syndromes or other necessary data to correct differences, followed by verification. Both disclosures count as leakage. Privacy amplification uses an appropriate randomly seeded hash family, such as two-universal hashing, to produce a justified length ℓ. The seed may be public; final key values remain local. A fixed ordinary hash or arbitrary shortening is not a substitute for this analysis.^[5][7]

All discussion uses an authenticated public classical channel. Eve may listen, but impersonation must be detected by authentication. QKD does not replace initial trusted authentication. When authentication consumes preshared key material, net key output must account for that cost.^[5][7]

Reading key rates: loss, background and security models

Distinguish sent-symbol rate, accepted detection rate, sifted candidate rate and final secret key rate. A low-click-probability teaching model gives:

η = 10^−αL/10 η_D η_opt; S = f_s [1 − e^−μη]; E ≈ (e_dS + D/2)/(S + D).

Here α is fiber attenuation in dB/km, L is distance in km, η_D is detection efficiency, and η_opt includes receiver optics and slot selection. D is the combined background rate of both ports after the same accepted time windows. Background is assumed uncorrelated with data, with error probability 1/2.^[3]

Every following parameter is illustrative: f_s = 625 MHz (symbol pairs/s), μ = 0.1, α = 0.20 dB/km, η_D = 0.40, η_opt = 0.50, D = 1,000 s⁻¹, and signal error e_d = 1%. Decoy sending fractions, additional connection loss, afterpulsing, dead time and signal/background coincidences are omitted:

At 150 km, S is about 12,500 s⁻¹, rising to 13,500 s⁻¹ with background. Unbiased basis matching leaves approximately 6,750 candidates/s and QBER is 4.63%. This is not a secret key-rate prediction. Increasing loss makes background relatively more important; faster clocks can encounter detector and processing limits.

The familiar r_ideal = max[0, 1 − 2h₂(e)] is a secret fraction per sifted bit for ideal single photons, asymptotic data, symmetric bit/phase errors and ideal one-way reconciliation. Here h₂(e) = −e log₂e − (1 − e) log₂(1 − e). It vanishes near 11.0%, not at a universal abort threshold for all QKD systems.^[6]

One common symmetric, asymptotic decoy-state BB84 bound is:

R_μ ≥ q { Q₁^L [1 − h₂(e₁^U)] − Q_μ f_EC h₂(E_μ) }.^[3]

R_μ is a secret-bit yield bound per sent signal-state symbol, q is the basis-match factor, Q_μ/E_μ are signal gain/QBER, and Q₁^L/e₁^U bound single-photon gain/error. f_EC ≥ 1 accounts for reconciliation inefficiency. Conversion to bit/s also needs the sending rate and signal-selection probability. Finite data require a matching finite-key proof, including a statistical phase-error bound and leakage terms, rather than directly applying this asymptotic expression to measured counts.^[3][7]

Figure 4 | Processing uses authenticated classical discussion. The curve is an ideal-single-photon, asymptotic, symmetric-error limit; it is not a measured WCP key rate or a universal system abort threshold.

What to check before comparing specifications

Check these separate conditions:

• Protocol and encoding: BB84, COW or DPS; whether μ means a pulse, time bin or whole symbol.
• Event definition: all clicks, accepted-slot clicks, matching-basis events or final secret bits; treatment of double and no clicks.
• Detector operating point: efficiency, dark counts, afterpulsing and dead time measured at consistent temperature, bias and gating.
• Channel and data: total loss, background, acquisition time, signal/decoy fractions and basis probabilities.
• Security and net output: proof, finite-key parameters, disclosed information, authentication method and its key consumption.^[4][5][7][8]

The CW source and modulators prepare analyzable states, the AMZI and SPADs provide measurement events, and decoy analysis plus classical processing determine how many bits can safely remain. Secret key rate is a result of the complete process, not laser power, APD counts or low QBER alone.