text:
# Coherent pulse implementations of quantum cryptography protocols resistant to photon number splitting attacks

## I Introduction

Quantum cryptography, or more precisely, quantum key distribution (QKD) followed by the one-time pad, is the only secure way of transmitting secret information (see  for a review). Its security is not based on some mathematical assumptions, such as a limited eavesdropper’s computational power, but on the laws of Quantum Mechanics. Because of the Heisenberg’s uncertainty principle, a measurement on a quantum system modifies the system itself. Thus, Eve’s measurement on a quantum state carrying sender’s information produces a change on the state that can be noticed by Alice and Bob. The security of QKD schemes can also be understood in terms of the no-cloning theorem . Eve cannot make and keep a perfect copy of the quantum state carrying the information from Alice to Bob .

Most of the known QKD protocols use two-dimensional quantum states, called qubits, as information carriers, although there exist alternative proposals using higher dimensional systems, either finite  or infinite . The information encoding can be performed by means of any two-dimensional quantum state, but very often this is done using photons that are sent through an optical fiber, the quantum channel. Therefore, Alice, must be able to prepare and send single photons to Bob. The existence of single-photon sources is then an implicit and crucial requirement for many of the proposed implementation of the existent schemes. Since there are no practical single-photon sources available, Alice generally uses a weak coherent pulse, $`|\mu e^{i\theta }`$, with mean photon number $`\mu 1`$, as an approximation of the single-photon pulse. Moreover, since there is no phase reference outside Alice’s lab, the effective state used for the information encoding is

$$\rho =\frac{d\theta }{2\pi }|\mu e^{i\theta }\mu e^{i\theta }|=\underset{n}{}p(n,\mu )|nn|,$$
(1)
with the number $`n`$ of photons distributed according to a Poisson statistics of mean $`\mu `$, $`p(n,\mu )=e^\mu \mu ^n/n!`$ . Thus, instead of the ideal one-photon Fock state, Alice produces a zero-photon state with probability $`p(0,\mu )`$, a one-photon state with probability $`p(1,\mu )`$ and so on.

Intuitively, the presence of pulses with more than one photon may deteriorate the security of the protocol, since a perfect copy of the quantum state is then produced by the imperfect single-photon source. Indeed, it was shown in  that the presence of these multi-photon pulses makes the best-known QKD protocol, the BB84 scheme , insecure if the losses in the channel become important. Eve can then perform the so-called photon number splitting (PNS) attack that allows her to get full information without being detected. This limits the distance up to which BB84 with weak coherent pulses and lossy optical fibers can be securely implemented. For typical experimental parameters this critical distance, $`d_c`$, is of the order of 50 km. As we will show below, similar conclusions are valid for weak pulse implementations of other QKD schemes, such as the B92  and the 4+2 protocol .

Recently, new quantum cryptography protocols have been proposed that are more robust against PNS attacks . The scope of the present article is to give a detailed security analysis of these protocols under different eavesdropping scenarios. In the next section we review the PNS attack for the BB84 scheme, and we show how the same results and conclusions also apply for the B92 and 4+2 protocols. Then, we discuss QKD implementations including a strong reference pulse as a first possibility for minimizing the importance of PNS attacks. Moreover, the results of section II give us some insight into the requirements needed for a QKD protocol to be resistant to PNS attacks in a weak pulse implementations. The family of investigated protocols is presented in section III. We will focus on a particular one, that differs from BB84 only in the classical sifting procedure for extracting the key. We will consider various possible attacks, some which do not introduce errors, some which use cloning machines (which do introduce some errors), and some which are the combination of both. We briefly discuss the experimental data of  in the light of our results, as an example of a QKD implementation secure against PNS attacks. At the end, we also explore possible generalizations. The last section summarizes the main results.

Let us end the introduction with four important remarks about our results. First, in order to make a fair comparison between all the analyzed protocols, we take as a reference the BB84 scheme using $`\mu =0.1`$, i.e. for all the protocols the raw rate at very large distances must be the same as in this reference scheme. Second, we do not consider advantage distillation protocols for secret-key distillation (see for instance ). Therefore, a protocol is said secure if and only if the information Alice-Bob is greater than Eve’s information. Indeed, it was shown in  that secret-key distillation is possible using one-way privacy amplification whenever

$$I_{AB}>\mathrm{min}(I_{AE},I_{BE}).$$
(2)
Third, although Eve is supposed to have unlimited technological power, we assume that she is not able to manipulate Bob’s detector (contrary to what is done in Ref. ). This is a crucial point for our analysis . Indeed, let us suppose that Eve can modify the detector efficiency, $`\eta _{det}`$, in such a way that it is equal to one for those instances where she has got the full information (her attack is successful). If we take $`\eta _{det}=0.1`$, our results should be modified (see for instance Eq. (4)) by a factor of ten, which means a factor of 10 dB, or equivalently of 40 km, in all our curves. And four, we do not take into account coherent attacks, where Eve interacts with more than one pulse .

## II The PNS attack

Any experimental realization using photons of a QKD protocol with two-dimensional quantum states must ideally be performed with a single-photon source. Unfortunately, this is a very strong requirement with present day technology, and one has to design a way of experimentally approximating the single-photon source. In spite of the fact that QKD has proven to be unconditionally secure (see for instance ), this may not be the case any longer if the technology of the honest parties is not perfect.

In most of the existent implementations, the one-photon pulse is approximated by a weak coherent pulse $`|\mu e^{i\theta }`$. As said above, and since there is no absolute phase reference, the state seen by Bob and Eve is given by Eq. (1), an incoherent mixture of multi-photon states with Poisson probabilities. Eve can then perform a photon number non-demolition measurement, keep one of the photons when a multi-photon state is found, and forward the rest to Bob. Note that Eve’s action is not detected by Bob if he is assumed to have only access to the average detection rate, and not to the statistics of the photons he receives. We also assume that Eve is able to control the losses on the line connecting Alice and Bob (or equivalently she can send photons to Bob by a lossless line). In this situation, Eve can perform the so-called PNS attack that, as we show below, limits the security of many of the known existing protocols.

### A The BB84 protocol

In the BB84 protocol , Alice chooses at random between two mutually unbiased bases, in which she encodes a classical bit. Denoting by $`|\pm x`$ ($`|\pm y`$) the eigenvectors of $`\sigma _x`$ ($`\sigma _y`$) with eigenvalue $`\pm 1`$, she can encode a logical 0 into either $`|+x`$ or $`|+y`$ and a 1 into either $`|x`$ or $`|y`$. She sends the qubit to Bob, who measures at random in the $`x`$ or $`y`$ basis. Then, they compare the basis and when they coincide, the bit is accepted. In this way, half of the symbols are rejected, and, in the absence of perturbations, they end with a shared secret key. In practical situations, and due to the presence of errors and possibly a spy, some error correction and privacy amplification techniques have to be applied, in order to extract a shorter completely secure key.

Now, let us see how Eve can take advantage of the multi-photon pulses. Alice sends a pulse with $`\mu 1`$ coding the classical bit (say on light polarization). Eve performs the photon number measurement and when two or more photons are detected, she takes one and forward the rest to Bob by her lossless line. Eve stores the photon in a quantum memory and waits until the basis reconciliation. Once the basis is announced, she has only to distinguish between two orthogonal states, which can be done deterministically. Thus, for all the multi-photon pulses Eve obtains all the information about the sent bit. If Alice and Bob are in principle connected by a lossy line, Eve can block some of the single-photon pulses, and forward the multi-photon pulses, on which she can obtain the whole information, by her lossless line. In this way, Alice and Bob do not notice any change in the expected raw rate, and Eve remains undetected. When the losses are such that Eve can block all the single-photon pulses, the protocol ceases to be secure.

Denote by $`\alpha `$ the losses in dB per km on the line. The expected raw rate at Bob’s side is giving by

$$R_{Bob}=\mu \mathrm{\hspace{0.17em}10}^{\delta /10}\text{ [photons/pulse]},$$
(3)
where $`\delta =\alpha d`$ is the total attenuation in dB of the quantum channel of length $`d`$. Eve will apply the PNS attack on a fraction $`1q`$ of the pulses. Since she does not want to be detected, the raw rate must not change, i.e. she has to choose $`q`$ in such a way that

$$R_{Bob}^{PNS}=q\mu +(1q)R_{BB84}=R_{Bob},$$
(4)
where $`R_{BB84}_{n=2}^{\mathrm{}}p_n(n1)`$ . Eve’s information is zero when she does nothing, and one for the PNS attack, i.e. denoting by $`S_{BB84}_{n=2}p_n`$,

$$I_{eve}(q)=\frac{(1q)S_{BB84}}{q+(1q)S_{BB84}}.$$
(5)
If the losses are such that $`q`$ can be zero in Eq. (4) (all the one-photon pulses can be blocked), Eve gets all the information, without being detected. The critical attenuation, $`\delta _c`$, is then given by the condition $`R_{BB84}=R_{Bob}`$. In figure 1 we show the variation of $`I_{eve}`$ as a function of $`d`$ for $`\mu =0.1`$ and $`\alpha =0.25\mathrm{dB}/\mathrm{km}`$ . The critical attenuation in this case is $`\delta _c=13`$ dB, and the corresponding distance $`d_c=52`$ km. Two important points have to be stressed here. First, we do not claim the optimality of the PNS strategies we consider in this section from the point of view of Eve’s information for losses lower than $`\delta _c`$. Indeed, when the losses begin to be relevant, it is more convenient for Eve to perform the PNS attack on all the multi-photon pulses and block some of the single-photon pulses. One can see that this slightly increase $`I_{eve}`$, but does not change the critical distance, as defined in this article. Second, alternative and more conservative definitions of the critical distance can be proposed. For simplicity, we consider no perturbations in the absence of Eve, i.e. the information Alice-Bob, $`I_{AB}`$, is one. But in realistic situations and due to the presence of errors (for instance due to detector and optical noise) this is not true, and the critical distance corresponds to the point where $`I_{eve}=I_{AB}`$. If the error rate is important, this distance may be smaller than the one indicated here. In any case, for channel attenuations greater than $`\delta _c`$, the implementation of the BB84 protocol using weak coherent pulses is not secure.

One may wonder whether this attack is only possible because the information is encoded on light polarization. However the same reasoning is also valid for other encodings such as, for instance, in the time-bin scheme (see ). There the information is transmitted using the relative phase between two weak coherent pulses that are sent through the fiber. In principle, the state leaving Alice’s side is $`|\varphi =|\mu e^{i\theta }|\mu e^{i\theta }e^{i\varphi }`$ where $`\varphi =0,\pi `$ ($`\varphi =\pm \pi /2`$) correspond to $`\pm x`$ ($`\pm y`$). But since there is no phase reference, the effective state seen by Eve and Bob is

$$\rho =\frac{d\theta }{2\pi }|\varphi \varphi |=\underset{n}{}p(n,2\mu )|\phi _n(\varphi )\phi _n(\varphi )|,$$
(6)
where $`p(n,2\mu )`$ are Poisson probabilities of mean photon number $`2\mu `$ and

$$|\phi _n(\varphi )=\underset{m=0}{\overset{n}{}}\sqrt{\left(\begin{array}{c}n\\ m\end{array}\right)\frac{1}{2^n}}e^{im\varphi }|nm|m.$$
(7)
Note that Bob’s state is given by an expression like (6) multiplying the mean photon number by the channel attenuation. It is possible to define a creation and annihilation operator

$`a^{}(\varphi )`$ $`=`$ $`{\displaystyle \frac{a_1^{}+e^{i\varphi }a_2^{}}{\sqrt{2}}}`$ (8)
$`a(\varphi )`$ $`=`$ $`{\displaystyle \frac{a_1+e^{i\varphi }a_2}{\sqrt{2}}},`$ (9)
such that acting on the two-mode vacuum state gives $`a^{}(\varphi )|0,0=|\phi _1(\varphi )`$. It is straightforward to see that

$$|\phi _n(\varphi )=\frac{(a^{}(\varphi ))^n}{\sqrt{n!}}|0,0,$$
(10)
$`[a^{},a]=1`$ and $`\phi _n^{}(\varphi )|\phi _n(\varphi )=\delta _{n,n^{}}`$. Thus, the situation is the same as in the previous polarization encoding scheme . Eve can count the total number of photons in the two (now temporal) modes, in an analogous way as in the previous photon number measurement for polarization, without being noticed by Bob. When “more than one” photons are detected, i.e. she projects into $`|\phi _2`$, she stores one copy of the state in her quantum memory until the basis reconciliation. Obviously, the equations and critical values in this case are the same as the ones found above for the polarization encoding scheme.

### B The B92 protocol

An alternative QKD scheme is given by the B92 protocol . The classical bit is simply encoded by Alice using two non-orthogonal states, $`|\psi _0`$ and $`|\psi _1`$ with $`\psi _0|\psi _10`$. Without loosing generality we will take

$$|\psi _0=\left(\begin{array}{c}\mathrm{cos}\frac{\eta }{2}\\ \mathrm{sin}\frac{\eta }{2}\end{array}\right)|\psi _1=\left(\begin{array}{c}\mathrm{cos}\frac{\eta }{2}\\ \mathrm{sin}\frac{\eta }{2}\end{array}\right),$$
(11)
with $`0\eta \pi /2`$ and the overlap is $`|\psi _0|\psi _1|=\mathrm{cos}\eta `$.

Bob has to distinguish between two non-orthogonal quantum states, and this can only be done with some probability. The measurement optimizing this probability is defined by the following positive operators, summing up to one ,

$`\mathrm{\Pi }_0`$ $`=`$ $`{\displaystyle \frac{1}{1+\mathrm{cos}\eta }}|\psi _1^{}\psi _1^{}|`$ (12)
$`\mathrm{\Pi }_1`$ $`=`$ $`{\displaystyle \frac{1}{1+\mathrm{cos}\eta }}|\psi _0^{}\psi _0^{}|`$ (13)
$`\mathrm{\Pi }_\mathrm{?}`$ $`=`$ $`\text{11}\mathrm{\Pi }_0\mathrm{\Pi }_1,`$ (14)
where $`|\psi ^{}`$ denotes the state orthogonal to $`|\psi `$. When Bob’s measurement outcome is the one associated to $`\mathrm{\Pi }_i`$, with $`i=0,1`$, he knows that the state was $`|\psi _i`$. The probability of obtaining an inconclusive result is equal to the overlap between the states, $`p_\mathrm{?}=\psi _0|\mathrm{\Pi }_\mathrm{?}|\psi _0=\psi _1|\mathrm{\Pi }_\mathrm{?}|\psi _1=\mathrm{cos}\eta `$. Thus, Alice and Bob will accept the sent bit only for those cases where Bob’s measurement gives a conclusive result. The probability of acceptance is $`p_{ok}=1\mathrm{cos}\eta `$, while for the BB84 this probability is equal to one half. Eve’s PNS attack is described in the following lines.

In a weak pulse encoding scheme, this protocol is clearly insecure. What Eve can simply do is to perform the same unambiguous measurement as Bob. When a conclusive result is found, she knows the state and she prepares a copy of it on Bob’s side. When Eve is not able to determine the state, she blocks the pulse. Of course, as soon as we have some losses in the channel Alice and Bob cannot detect the eavesdropping (since they assume that the absence of signal is due to the losses), and the protocol is insecure. Note that no quantum memory and lossless line is needed by Eve in this case.

### C The 4+2 protocol

A third QKD protocol was proposed in  combining some of the ideas of the B92 and BB84 schemes. As in the BB84 protocol, there are four states grouped into two sets $`\{|0_a,|1_a\},\{|0_b,|1_b\}`$. However, as in the B92, the states in each set are not orthogonal, their overlaps being $`|0_a|1_a|=|0_b|1_b|=\mathrm{cos}\eta `$. The situation is depicted in figure 2, the four states lie on the same parallel of the Bloch sphere. Thus, Alice chooses randomly in which of the two sets the bit is encoded. Bob performs at random one of the two POVMs distinguishing the two states of each set. After basis reconciliation, they determine all the cases where Bob has applied the correct measurement obtaining a conclusive result. At first sight, this protocol seems more resistant against PNS attacks: compared to the BB84 case, Eve can keep some of the photons but her measurement after the basis reconciliation may not be conclusive. And compared to the B92 case, she does not know which of the two measurements has to be applied. However, and due to the particular geometry of the sets of states, this scheme does not offer any advantage over the two previous ones. But before describing Eve’s attack, let us show how the three-outcome POVM described by (12) can be interpreted as the concatenation of two two-outcome measurements.

The effect of any quantum measurement can be represented by a set of operators $`\{A_i\}`$ satisfying $`_iA_iA_i^{}=\text{11}`$. If the initial state is $`\rho `$, the probability for any outcome, say $`i`$, is

$$p_i=\text{tr}(A_i\rho A_i^{}),$$
(15)
and the state is transformed into

$$\rho _i=\frac{1}{p_i}A_i\rho A_i^{}.$$
(16)
Consider the states (11). The POVM described by the operators (12) can be effectively replaced by a sequence of two two-outcome measurements. First, one applies a measurement described by the operators

$`A_{ok}`$ $``$ $`{\displaystyle \frac{1}{\sqrt{1+\mathrm{cos}\eta }}}\left(|+x\psi _1^{}|+|x\psi _0^{}|\right)`$ (17)
$`A_\mathrm{?}`$ $``$ $`\sqrt{\text{11}A_{ok}A_{ok}^{}}.`$ (18)
The effect of this first measurement is the following: with probability $`p_{ok}=1\mathrm{cos}\eta `$ the state $`|\psi _0`$ ($`|\psi _1`$) is mapped into $`|+x`$ ($`|x`$). This operation is often called a filtering, and it is equivalent to the cases where the POVM (12) gives a conclusive result. When the outcome $`ok`$ has been obtained, it is said that the states have passed the filter. If this is the case, a standard von Neumann measurement on the $`x`$ basis suffices for discriminating between the two states.

Let us come back to the 4+2 protocol and consider the filter for the states in set $`a`$, sending these state into the $`x`$ basis. It is not difficult to see that the same filter maps the states in set $`b`$ into $`|\pm y`$. Therefore, a BB84-like situation is recovered!

It is now easy to design a PNS attack. First, Eve counts the number of photons. Similar to the B92 case, she applies the filtering two-outcome measurement when a multi-photon pulse is obtained. When the result is conclusive, she keeps the resulting photon in a quantum memory and forwards the rest of photons to Bob. Then, as in the BB84 case, she waits for the basis reconciliation, and performs the right von Neumann measurement allowing her to read the bit. In order to make a fair comparison, we always impose the same key rate in the absence of Eve as in BB84 using $`\mu =0.1`$. In this case this means that we must have

$$\mu _{BB84}=\mu _{4+2}(1\mathrm{cos}\eta ).$$
(19)
In a similar way as above for the BB84 case, one can compute Eve’s information for this attack. It almost coincides with the one found for the BB84 protocol, and the critical distance is again $`\delta _c=52`$ km (see figure 1). Indeed, the critical distance turns out to be quite independent of the degree of non-orthogonality between the states in the 4+2 protocol, if one imposes the equality of the raw rates (19).

The analysis of the 4+2 protocol ends the present section. All the studied QKD schemes do not guarantee a secure key distillation when the channel attenuation is around 15 dB. Unfortunately, the use of non-orthogonal states has not been enough for avoiding Eve’s attacks. The critical distance basically corresponds to the point where the raw rate on Bob’s side can be simulated by the number of multi-photon pulses leaving Alice’s lab.

### D Strong pulse implementations

The three protocols analyzed in the previous sections are not robust against PNS attacks in a weak coherent pulse implementation. Eve exploits the presence of multi-photon pulses and the losses on the line. Indeed, at the critical distance the losses are such that she can block the pulse without being noticed when her attack has not succeeded. A possible way of avoiding this problem is to send also a strong reference pulse that must always be detected on Bob’s side, as in the original B92 proposal . In this way, Eve cannot block the pulses without introducing errors. From the implementation point of view, a new detector should be added, checking the presence of the strong pulse. In the following lines we consider these implementations from the point of view of PNS attacks. We mainly concentrate on the B92 protocol although, as we will see, the same conclusions are valid for the other schemes.

The information encoding uses the relative phase between a weak coherent pulse with respect to a strong reference pulse that is sent later through the line. Thus, Alice prepares a weak coherent pulse and a strong pulse sent as a reference, $`|\varphi =|\mu ^{}e^{i\theta }|\mu e^{i\theta }e^{i\varphi }`$, where $`\mu ^{}\mu `$ and $`\varphi =0,\pi `$ encodes the classical bit. For a BB84 scheme, $`\varphi =0,\pi `$ for one of the basis and $`\varphi =\pm \pi /2`$ for the other. Note that the BB84 implementation with a strong pulse is indeed the 4+2 scheme . Let us come back to the simplest B92 and denote by $`t`$ the ratio between the two intensities $`t=\mu /\mu ^{}1`$. The overlap between the two non-orthogonal states is $`|0|\pi |=e^{2\mu }`$, so $`\mu <1`$. Bob delays the weak pulse and makes it interfere with a fraction $`t`$ of the strong pulse. Constructive and destructive interference correspond to the values 0 and $`\pi `$. The probability of inconclusive result is $`p_\mathrm{?}=e^{2\mu }`$ as expected (see  for a practical implementation of this measurement), and the transmission rate for small $`\mu `$ is $`2\mu `$ . The detection of the $`1t1`$ fraction of the strong reference pulse by Bob should allow him to detect Eve’s intervention, i.e. none of the pulses can be blocked. Note that this forces the strong pulse mean photon number to be significant at Bob’s side. However, Eve can always take advantage of the multi-photon pulses for acquiring partial information.

Since as usual there is no global phase reference available, the effective state leaving Alice’s lab is

$$\rho =\frac{d\theta }{2\pi }|\varphi \varphi |=\underset{n}{}p(n,\mu +\mu ^{})|\phi _n(\varphi )\phi _n(\varphi )|,$$
(20)
where $`p(n,\mu +\mu ^{})`$ are Poisson probabilities and

$$|\phi _n(\varphi )=\underset{m=0}{\overset{n}{}}\sqrt{\left(\begin{array}{c}n\\ m\end{array}\right)\frac{t^m}{(1+t)^n}}e^{im\varphi }|nm|m.$$
(21)
In a similar way as above, one can define

$`a^{}(\varphi )`$ $`=`$ $`{\displaystyle \frac{1}{\sqrt{1+t}}}\left(a_1^{}+\sqrt{t}e^{i\varphi }a_2^{}\right)`$ (22)
$`a(\varphi )`$ $`=`$ $`{\displaystyle \frac{1}{\sqrt{1+t}}}\left(a_1+\sqrt{t}e^{i\varphi }a_2\right),`$ (23)
such that acting on the two-mode vacuum state gives $`a^{}(\varphi )|0,0=|\phi _1(\varphi )`$. Again, we have

$$|\phi _n(\varphi )=\frac{(a^{}(\varphi ))^n}{\sqrt{n!}}|0,0,$$
(24)
$`[a^{},a]=1`$ and $`\phi _n^{}(\varphi )|\phi _n(\varphi )=\delta _{n,n^{}}`$. Eve can perform a non-demolition measurement for these number states without being detected by Bob. Indeed, his state is the same as in Eq. (20), just taking into account the channel attenuation.

Denote the channel losses by $`\delta `$. Since $`\mu ^{}\mu `$, Eve’s Poisson distribution is centered around $`\mu ^{}`$ while Bob’s around $`\mu ^{}10^{\delta /10}`$. Moreover the strong pulse must be always detected by Bob, so we will impose $`\mu ^{}10^{\delta /10}=10`$ (at least), which means that $`\mu ^{}=10^{(1+\delta /10)}`$. In order to make a fair comparison with the BB84 scheme using $`\mu =0.1`$, we take the same raw rate in the absence of Eve at the critical distance, which leads to

$$\frac{\mu _{BB84}}{2}=2\mu _{B92},$$
(25)
and then $`\mu _{B92}=0.025`$, i.e. $`|0|\pi |=0.95`$, and $`t=10^{(2+\delta /10)}/4`$.

Now, Eve performs the measurement in the $`|\phi _n`$ basis. Since her Poisson probability is centered around $`\mu ^{}`$, she obtains a pulse containing (on average) $`\mu ^{}`$ photons. On Bob’s side a pulse with ten photons is expected, so Eve keeps $`|\phi _{\mu ^{}10}`$ and forwards $`|\phi _{10}`$ to Bob by her lossless line. Eve’s intervention remains unnoticed to Bob. Eve is now faced with the problem of detecting two states having an overlap

$$|\phi _{\mu ^{}10}(\pi )|\phi _{\mu ^{}10}(0)|=\left(\frac{1t}{1+t}\right)^{\mu ^{}10}\left(\frac{1t}{1+t}\right)^\mu ^{}.$$
(26)
She applies the measurement maximizing her information , obtaining

$$I_{Eve}=I(p_e),$$
(27)
where $`I(p)=1+\mathrm{log}_2p+(1p)\mathrm{log}_2(1p)`$ is the binary mutual information (in bits) and $`p_e`$ is the error probability,

$$p_e=\frac{1}{2}\left(1\sqrt{1|\phi _{\mu ^{}10}(\pi )|\phi _{\mu ^{}10}(0)|^2}\right).$$
(28)
It is not hard to compute the limit for Eve’s information. For very large distances, $`\mu ^{}\mathrm{}`$ and then

$$|\phi _\mu ^{}(\pi )|\phi _\mu ^{}(0)|=\underset{\mu ^{}\mathrm{}}{lim}\left(\frac{1\mu /\mu ^{}}{1+\mu /\mu ^{}}\right)^\mu ^{}=e^{2\mu },$$
(29)
i.e. the initial overlap gives the searched limit and $`I_{Eve}0.07`$ bits. Thus, for any distance, the protocol is clearly secure against PNS attacks. The same is valid for the strong pulse realization of the BB84 protocol, which, as said, is the 4+2 scheme.

Note that strong pulse implementations appear as an intermediate step in the transition from discrete to continuous variables QKD schemes using coherent states . There, a strong reference pulse, with very large mean photon number $`\mu ^{}`$, is sent through the channel with a weaker pulse, containing about hundred photons. The security comes from the fact that although $`\mu `$ is not weak, an infinite range of values is used for the information encoding (while, for example, we have only two in the B92 case) and Eve is not able to discriminate the sent state. However, many of the results presented in this section can be translated to these protocols, opening the possibility of new eavesdropping attacks .

Before ending this section let us stress an important point about strong pulse QKD implementations that was somehow hidden in the previous discussion. It is important to guarantee a reasonable photon number for the strong pulse on Bob’s side, i.e. the condition $`\mu ^{}10^{\delta /10}10`$ must be always satisfied. Therefore, $`\mu ^{}`$ increases with the distance up to which the key should be established. Note that $`\mu `$ is just fixed by the desired overlap between the two states used in the B92 scheme, independently of the distance. In the previous lines we took a quite conservative value, coming from Eq. (25). We can indeed consider $`\mu =1/4`$, which gives $`|0|\pi |=0.6`$ and $`I_{Eve}0.5`$. This forces $`\mu ^{}`$ and the ratio $`t`$ to increase with the distance, which can lead to problems in the interferometric arrangement needed for detection. For instance for a distance of 80 km, that taking as usual $`\alpha =0.25`$ means 20 dB, we have $`\mu ^{}=10^3`$ and $`t=10^4/4`$. However if these requirements are met, a secure implementation becomes possible with a key generation rate significantly larger than for the BB84 scheme using $`\mu =0.1`$.

For the rest of the article however, we will not consider this type of scenario and we will deal only with implementations using weak coherent pulses.

## III QKD protocols resistant to PNS attacks

The aim of the present section is to give QKD protocols resistant to the PNS attack in a weak pulse implementation. From the previous discussion we can understand some of the basic requirement for these schemes. We have seen above that the apparent robustness of the 4+2 protocol was not true due to the existence of a quantum operation (measurement), represented by (17), that allows Eve to make pairwise orthogonal the states in the sets $`a`$ and $`b`$. After successfully performing this operation, she can wait for the basis reconciliation, as in the BB84 case, and read the information by a von Neumann measurement. Therefore, what Alice needs is a configuration of sets of states in which to encode her information such that there does not exist any quantum operation increasing, even with some probability and at the same time, the overlap of the states in each set. This is what a protocol needs to be resistant to the PNS attack.

A simple configuration achieving this property is the same as in the 4+2, but with one of the two set of states reflected with respect to the $`xy`$ plane (see figure 2). But, even simpler, one can restrict oneself to any plane in the Bloch sphere, as in the BB84 case. This situation is depicted in figure 3. The general expression for these states is

$`|0_a`$ $`=`$ $`\left(\begin{array}{c}\mathrm{cos}\frac{\eta }{2}\\ \mathrm{sin}\frac{\eta }{2}\end{array}\right)|1_a=\left(\begin{array}{c}\mathrm{cos}\frac{\eta }{2}\\ \mathrm{sin}\frac{\eta }{2}\end{array}\right)`$ (30)
$`|0_b`$ $`=`$ $`\left(\begin{array}{c}\mathrm{sin}\frac{\eta }{2}\\ \mathrm{cos}\frac{\eta }{2}\end{array}\right)|1_b=\left(\begin{array}{c}\mathrm{sin}\frac{\eta }{2}\\ \mathrm{cos}\frac{\eta }{2}\end{array}\right)`$ (31)
After successfully application of the filter that makes orthogonal the states in set $`a`$, the overlap between the states in set $`b`$ has significantly increased. Indeed, it is not difficult to see that if the outcome of a quantum operation, say $`A_i`$, makes orthogonal the states of set $`a`$, for the same outcome the states in set $`b`$ are less orthogonal (see appendix A). So, now Eve has to consider two different filters, $`F_a`$ and $`F_b`$, that make the states in set $`a`$ and set $`b`$ orthogonal, respectively. If she wants to get the whole information about the bit sent by Alice, she has to block all the pulses with less than three photons. When the pulse contains three photons, she applies $`F_a`$ to the first one, $`F_b`$ to the second one, and only when both of them are conclusive, she forwards the third photon to Bob. It is clear that the distance where Eve can perform this attack without being detected is much larger than above. It basically corresponds to the point where the raw rate is equal to the number of pulses on Alice’s side with more than two photons. There, Eve can simulate the expected raw rate using only these pulses.

Using this idea, we can design different state configurations. One of them turns out to be equivalent, at the quantum level, to the BB84 scheme. The states and the measurements are the same as in this protocol, the only difference being in the reconciliation process. But, surprisingly, this variation makes the protocol significantly more resistant to PNS attacks. The remaining of this section will be devoted to the detailed security analysis of this protocol.

### A Four-state protocol

The configuration of states in figure 3 allows Alice and Bob to exchange a key in a secure way for larger distance than for many of the existing protocols. In the case in which the angle between the states in each set is $`\pi /2`$ we recover a BB84-like state configuration. Nevertheless, note that Alice’s bit encoding has radically changed (see figure 3), since orthogonal states encode the same classical bit.

Suppose as in the standard BB84 that Alice uses as information carriers the eigenvectors of $`\sigma _x`$ and $`\sigma _y`$. Now, the bit 0 is encoded into $`|\pm x`$ and 1 into $`|\pm y`$. Consider the case in which Alice’s bit is equal to zero. She chooses randomly between $`|\pm x`$ and sends the state, say $`|+x`$, to Bob. Bob measures randomly in the $`x`$ or $`y`$ basis. After this, Alice starts the reconciliation process announcing the sent state and one of the two possible states encoding one, for instance $`\{|+x,|+y\}`$. If Bob’s measurement was in the $`x`$ basis, the result was $`+1`$ (remember that the sent state was $`|+x`$) and he cannot discriminate between the two alternatives. If Bob measured in the $`y`$ basis, for half of the cases the result was +1 and for the rest -1. In the first case, he cannot discriminate either, but in the latter, he knows for sure that the sent bit was not $`|+y`$, and accepts the sent bit. At first sight this is just a simple, and not very useful, modification of the BB84 protocol. However with these variations the obtained protocol is much more resistant to Eve’s attacks.

Eve is faced with the following problem: after Alice’s announcement she will have to deal with one of four possible sets of two states,

$`s_1\{+x,+y\}s_2\{+y,x\}`$ (32)
$`s_3\{x,y\}s_4\{y,+x\}.`$ (33)
Eve can unambiguously determine the sent state with some probability for all the pulses of at least three photons. Indeed she measures in the $`x`$ and $`y`$ basis the two first photons, which allows her to discard two of the possibilities. Then, she applies to the third photon the measurement discriminating between the two remaining states. This intuitively shows that this scheme is more robust against PNS attacks, since only three-photon pulses provide her with the full information. In the next lines we will extend these ideas in a more precise way, showing that the distance for a secure implementation of this protocol is approximately twice the one for the standard BB84. First we deal with attacks exploiting the presence of multi-photon pulses without introducing errors on Bob’s side. Then we move to cloning-based attacks, where some error is allowed, and finally we analyze the combined action of these two eavesdropping strategies.

### B PNS attacks

The first type of attacks we consider are of the same type as the PNS attack for the BB84. Eve uses the multi-photon pulses for acquiring information. However, her attack cannot be noticed by the honest parties because of their limited technological powers, i.e. she must not introduce errors on Bob’s side.

As shown above, Eve can determine unambiguously the state sent by Alice when the pulse contains more than three photons. This is indeed a general result: unambiguous discrimination between $`N`$ states of a two-dimensional Hilbert space is only possible when at least $`N1`$ copies of the state are available . In this case, the $`N`$ states $`|\psi _i^{(N1)}`$ belong to the symmetric subspace of $`(\text{}^2)^{(N1)}`$ of dimension $`N`$. Since the $`N`$ states are always linearly independent (see appendix B), unambiguous discrimination is possible. Above we have described a sequence of measurements allowing unambiguous discrimination between three copies of the four states $`|\pm x,|\pm y`$. The probability of success is given by the third measurement that discriminates between two quantum states having an overlap of $`1/\sqrt{2}`$, i.e. $`p_{ok}=11/\sqrt{2}0.3`$. However, better strategies should be expected if one acts globally on the three copies of the unknown state. For instance, one can use the natural generalization of the POVM described by Eqs. (12). For any $`i=\pm x,\pm y`$ one can define $`|\psi _i^{}(\text{}^2)_{sym}^3`$ as the state orthogonal to the three vectors $`|\psi _j^3`$, with $`ji`$. Then, the searched measurement is given by the five positive operators summing up to the identity of $`(\text{}^2)_{sym}^3`$, denoted by $`\text{11}_{3,sym}`$,

$`\mathrm{\Pi }_i`$ $`=`$ $`{\displaystyle \frac{2}{3}}|\psi _i^{}\psi _i^{}|`$ (34)
$`\mathrm{\Pi }_\mathrm{?}`$ $`=`$ $`\text{11}_{3,sym}{\displaystyle \underset{i}{}}\mathrm{\Pi }_i.`$ (35)
The probability of having an inconclusive result is, where $`|i^{(3)}=|i^3`$,

$$p_\mathrm{?}=i^{(3)}|\mathrm{\Pi }_\mathrm{?}|i^{(3)}=\frac{1}{2}.$$
(36)
Indeed, this measurement is optimal if we impose that the probability of conclusive result has to be the same for the four possibilities to be distinguished. From  we know that the maximal probability of unambiguous discrimination is equal to the reciprocal of the maximum eigenvalue of the operator

$$\frac{1}{4}\underset{i=\pm x,\pm y}{}(|\psi _i^{}\psi _i^{}|),$$
(37)
which gives $`p_{ok}=1/2`$ .

Eve’s first strategy will consist of counting the number of photons on each pulse and block those with less than three photons. When at least three photons are detected, she performs the previous measurements and blocks all the instances where an inconclusive result is obtained. When she is able to determine the state, she can prepare a new copy of it for Bob. Again, if the channel losses are small, she must apply this strategy on a fraction of the pulses. The corresponding equations are quite similar to the ones seen above, and the critical distance corresponds to the point where

$$R_{Bob}=p_{ok}^{max}\underset{n=3}{\overset{\mathrm{}}{}}p_n(n2).$$
(38)
Eve’s information is shown in figure 4, and the critical distance turns out to be of approximately 100 km. Note that we take $`\mu =0.2`$, in order to make a fair comparison with BB84 using $`\mu =0.1`$.

It is evident that for small distances, this strategy is quite inefficient from Eve’s point of view. Indeed, for those instances it is better for her to apply a different PNS attack, that we call storing attack: all single-photon pulses are blocked, while for all the multi-photon pulses, she keeps one photon in a quantum memory until the set reconciliation. Then, she has to distinguish between two non-orthogonal quantum states, say $`|+x`$ and $`|+z`$. She will apply the measurement maximizing her information obtaining (see Eq. 27)) $`I_{eve}0.4`$ and where the error probability is

$$p_e=\frac{1}{2}\left(1\sqrt{1|+x|+z|^2}\right)0.14.$$
(39)
Storing attacks are particularly dangerous as soon as there are errors in the transmission. If this is the case, the information $`I_{AB}`$ is smaller than one and indeed, it may be smaller than Eve’s information (see section IV for a more careful analysis). In a similar way to that described above, depending on the channel losses, Eve can interpolate between these two attacks. The corresponding information curves are shown in figure 4.

The presence of multi-photon pulses represents a serious drawback, since Eve can take advantage of them for acquiring information on the sent bit. Since we do not consider advantage distillation protocols, the honest parties can extract a key when Eq. (2) is satisfied. This means that the secret bit rate generation, after error correction and privacy amplification, is

$$R_{key}=\frac{1}{4}R_{Bob}(1I_{Eve}),$$
(40)
where $`R_{Bob}`$ is the raw rate of Eq. (3). The $`1/4`$ term takes into account the set reconciliation process (Bob has to choose the right measurement and obtain the right outcome), and the last term comes from the privacy amplification protocol. Note that we assume for simplicity no errors between Alice and Bob, $`I_{AB}=1`$.

There is in principle an obvious way of avoiding the influence of multi-photon pulses: to decrease the pulse mean photon number. Nevertheless, this solution may be very inefficient, since the raw rate, $`R_{Bob}`$, is approximately proportional to $`\mu `$. Therefore, there is a compromise from the point of view of key generation. Using the same techniques as for figure 4, for any $`\delta `$ one can compute the optimal $`\mu `$ maximizing $`R_{key}`$. The corresponding curve is shown in figure 5. Note that mean photon numbers of the order of 0.2 are indeed optimal for losses $`20`$ dB.

### C Individual attacks using cloning machines

All the eavesdropping strategies studied up to now take advantage of the fact that the technological power for the honest parties has some limitations. In particular, Eve uses the multi-photon pulses for acquiring information on the sent bit without introducing any error. Nevertheless, the present protocol must be also analyzed under the presence of errors, even at the single-photon level. It may happen that a small amount of error would allow Eve to gain a large amount of information making the protocol unpractical. Indeed, these are the attacks Eve would apply at very short distances, where she cannot block almost any pulse and almost all the non-empty pulses reaching Bob contain just one photon.

The optimal individual eavesdropping strategy for this protocol is unknown. Nevertheless, note that the quantum structure is the same as for the BB84 scheme, so it seems natural to consider its robustness against attacks using asymmetric phase covariant cloning machines . These machines, that are briefly described in appendix C, clone in an optimal way all the states in the $`xy`$ plane. Let us stress here that they provide the optimal eavesdropping for the BB84 protocol . The action of these machines in the protocol is depicted in figure 6.

Key distillation using privacy amplification is possible whenever Eq (2) is fulfilled. This means that the honest parties can tolerate an error up to $``$ 15$`\%`$, slightly larger than the $`14.67\%`$ for the BB84. There are two facts in these curves that deserve explanation. First, note that the Cerf cloning machine  is clearly more efficient from Eve’s point of view than the Niu-Griffiths one . Second, note the surprising decreasing behavior of Eve’s information for large values of the QBER. Both of them are related to the quantum correlations introduced by each of the cloning machines between Eve and Bob, and the sifting procedure used in the described protocol.

Eve waits until the sifting process before doing her measurement. If, for instance, Alice announces $`|+x,|+y`$ and Bob accepts the symbol, Eve knows that Bob has successfully projected onto either $`|x`$ or $`|y`$. Then, she modifies her quantum state according to this information. The fact that Bob has got a conclusive result (he could discriminate between the two non-orthogonal states) increases also the distinguishability on Eve’s side because of the quantum correlations. On the one hand, this justifies why the Cerf cloning machine is more efficient for eavesdropping. It establishes a stronger correlation between Eve and Bob, and this helps Eve after the sifting process. On the other hand, this also explains the decreasing behavior of Eve’s information curves. For very large disturbances, the correlations between Eve and Bob decreased, and knowing that Bob has obtained a conclusive result does not help her too much. Thus, it is better to keep some quantum correlations with Bob, in such a way that his successful unambiguous discrimination increases the distinguishability on Eve’s side. In the limiting case of $`QBER=0.5`$, Eve just takes the state sent by Alice and prepares at random one of the four possible states for Bob (or in equivalent terms, she forwards a completely noisy state). Her information is simply given by Eq. (27) as expected.

### D PNS+cloning attacks

The eavesdropping strategies analyzed up to now take advantage, either of the presence of multi-photon pulses (PNS attacks) or of the errors on Bob’s side (cloning attacks). However for losses such that Eve can simulate the expected rate even if she blocks all the single-photon pulses, she can combine the two type of attacks, if she is allowed to introduce some errors. This basically corresponds to distances $`d40`$ km (see figure 4). There, Eve counts the number of photons in the pulse and stops those having one photon. For all the two-photon pulses, she applies an asymmetric phase covariant $`23`$ cloning machine, and forwards one of the clones to Bob. This operation introduces errors, depending on the quality of Bob’s clone. In general, for a pulse having $`n`$ photons, she uses an $`nn+1`$ cloning machine, although in this section we consider only the $`23`$ case, since $`p_2`$ is significantly larger than $`p_3`$. As far as we know this type of attack has been never considered before. This may explain why the expression for the phase covariant $`nm`$ asymmetric cloning machine is unknown (at least to us). In appendix D we describe two unitary transformations generalizing, in a non-optimal way, the asymmetric $`12`$ cloning machines to the $`23`$ case (see also ).

Eve counts the number of photons in the pulse. All the single-photon pulses are blocked, while for those pulses having two photons she applies one of the $`23`$ cloning machines shown in appendix D. In this case it is unclear which of the clone states she has to forward to Bob. It turns out that for small disturbances, such that Eve’s information is smaller than $`I_{AB}`$, there is almost no difference between the two cases. Figure 7 shows the information Eve can get with this strategy as a function of the disturbance on Bob’s side. We consider that Bob receives one of the two clones with the same fidelity, i.e. either the first or the second qubit of Eq. (74) or (76). Key distillation is possible using error correction and one-way privacy amplification up to disturbances of approximately $`8.5\%`$.

### E The Geneva-Lausanne experiment

The four-state protocol is at the level of state preparations and measurements, identical to the BB84 scheme. It only differs in the sifting process, less efficient in the absence of Eve by a factor of two on the raw key, but more robust against PNS attacks. Thus, all the existent experimental implementations of the BB84 protocol can be thought of as implementations of the new four-state protocol.

Let us analyze the recent Geneva-Lausanne experiment , where a key was distributed over 67 km using the BB84 scheme. The mean photon number of the pulses used in this experiment was indeed 0.2 photons/pulse, so all our results directly apply. According to figure 1, the protocol is not secure at this distance because of the PNS attack even for $`\mu =0.1`$ (and BB84 encoding). However this is not the case if one uses the new protocol. The experimental QBER was approximately $`5\%`$, where $`4\%`$ was due to dark counts on the detector and $`1\%`$ due to optical imperfections. As said above, Eve is assumed to have only access to the optical error. Then $`I_{AB}=I(0.05)0.71`$ bits, while $`I_{Eve}`$ (see figure 7) is clearly smaller than 0.5. Thus, Alice and Bob can safely distill a key. Note that even in the more restrictive scenario where Eve can take advantage of the full error (including the detector noise), her information is smaller than $`I_{AB}`$ and the protocol is secure. Therefore, the existing implementation becomes secure just by changing the sifting process.

## IV Generalization to more sets

The detailed analysis of the four-state protocol has given us insight into the way of designing QKD protocols resistant to PNS attacks. The presence of multi-photon pulses is still a problem, since they open the possibility of unambiguous discrimination or storing attacks providing Eve full or partial information. But there is a simple way of improving the robustness of the protocol: just adding more states for the encoding. A quite natural generalization of the previous protocol follows this idea and consists of adding more bases in a plane of the Bloch sphere for the encoding of the bit, as shown in figure 8 for the case of four bases (eight states). On the one hand more photons (or copies of the unknown state) are needed for the unambiguous discrimination to be possible. On the other hand the overlap between the two announced states decreases, which is also good against storing attacks. Nevertheless, the key rate decreases unless we use a larger mean photon number, which increases the presence of multi-photon pulses, that are dangerous for the security. Thus, a compromise appears. The aim of this section is to explore this fact by analyzing the resistance of this generalized protocols against the two type of attacks mentioned above: PNS with unambiguous discrimination and storing attacks.

Any protocol is uniquely defined by the number of bases $`n_b`$ used for the bit encoding. We will not consider a very large number of bases, since the protocol would become impractical. In the previous sections we had $`n_b=2`$ while $`n_b=4`$ for the protocol in figure 8. If Alice wants to send a bit $`b`$, she chooses at random between the $`n_b`$ states encoding $`b`$ and sends it to Bob. Bob measures at random in any of the $`n_b`$ bases. Then, Alice announces the sent state plus, again randomly, one of the two neighboring states (encoding $`1b`$). Bob accepts the bit when (i) he has measured in one of the two bases associated to the two states announced by Alice and (ii) his measurement outcome is orthogonal to one of these states. Indeed, this allows him to discard one of the two possibilities and to infer $`b`$. Thus, Bob needs to choose the right measurement and obtain the right outcome, which happens with probability

$$p_b=\frac{1}{n_b}\mathrm{sin}^2\left(\frac{\pi }{2n_b}\right).$$
(41)
As usual, in order to make a fair comparison, we impose for any protocol that at very large distances (attenuations) the raw rate is the same as in the standard BB84 with $`\mu =0.1`$. This implies that

$$\mu (n_b)=\frac{1}{20p_b}=\frac{n_b}{20\mathrm{sin}^2\left(\frac{\pi }{2n_b}\right)}.$$
(42)
Note that for large $`n_b`$, $`\mu (n_b)n_b^3`$. This means that the mean photon number becomes significant when $`n_b`$ increases and we are not longer dealing with weak pulses. Therefore, some of the approximations used above (see ) are not valid.

Eve has now to discriminate between $`2n_b`$ one-qubit states, and this can be done with certainty only when $`n_e=2n_b1`$ copies of the unknown state are available (see  and appendix B). The maximum probability of success, $`p_{ok}`$, correspond to the maximum eigenvalue of the operator

$$\frac{1}{2n_b}\underset{k=0}{\overset{n_e}{}}|k^{}k^{}|.$$
(43)
Here $`|k^{}`$ denotes the state in $`(\text{}^2)_{sym}^{n_e}`$ orthogonal to all $`|j^{n_e}`$, where $`j=0,\mathrm{},n_e`$ but $`jk`$ and

$$|k=\frac{1}{\sqrt{2}}\left(\begin{array}{c}1\\ e^{ik\pi /n_b}\end{array}\right).$$
(44)
We have numerically calculated these probabilities up to $`n_b=8`$ and they appear to be given by the formula $`p_{ok}(n_b)=n_b/4^{n_b1}`$, although we do not have an analytical proof. The critical attenuation $`\delta _1`$ (in dB) where the protocol ceases to be secure against this attack has to be such that Eve can simulate the expected rate by the number of pulses containing at least $`n_e`$ photons and giving a conclusive result. This leads to

$`{\displaystyle \underset{n>0}{}}p(n,\mu (n_b)10^{\delta _1/10})(1(1\eta _{det})^n)=`$ (45)
$`p_{ok}(n_b){\displaystyle \underset{mn_e}{}}p(m,\mu (n_b))(1(1\eta _{det})^{(mn_e+1)}).`$ (46)
The corresponding curve is shown in figure 9.

There are other attacks, exploiting the presence of multi-photon pulses, that provide Eve with partial information without introducing errors. For instance, Eve can count the number of photons and keep $`n_s`$, depending on the channel attenuation, without being detected. She waits until the basis reconciliation and performs the measurement maximizing her information (see Eq. (27)). These attacks can be very dangerous as soon as we consider errors on the transmission. We assume that the main sources of errors are the detector noise, quantified by the probability $`p_d`$ of having a dark count, and the optical error $`QBER_{opt}`$. The total $`QBER`$ for a channel attenuation of $`\delta `$ is approximately equal to

$$QBER=\frac{p_d/2}{p_d+\mu (n_b)\eta _{det}10^{\delta /10}}+QBER_{opt},$$
(47)
since half of the dark counts produce a click in the wrong detector. Thus, for any distance one can compute the amount of errors and the corresponding $`I_{AB}=I(QBER)`$. If $`I_{Eve}`$ is larger than $`I_{AB}`$, the protocol is not secure. For any $`n_s`$, we can define a critical attenuation such that the honest parties cannot notice Eve’s storing attack. This attenuation corresponds to the point where

$`{\displaystyle \underset{n>0}{}}p(n,\mu (n_b)10^{\delta (n_s)/10})(1(1\eta _{det})^n)=`$ (48)
$`{\displaystyle \underset{mn_s}{}}p(m,\mu (n_b))(1(1\eta _{det})^{(mn_s)}).`$ (49)
For intermediate attenuations (distances), Eve can interpolate between two attacks, as described above. In this way, we can compute the two curves $`I_{AB}`$ and $`I_{Eve}`$ as a function of the distance. Figure 10 shows the obtained results, where we took $`\eta _{det}=0.1`$, $`p_d=10^5`$ and $`QBER_{opt}=1\%`$. The point where $`I_{AB}=I_{Eve}`$ provides the critical distance, $`\delta _2`$, for this type of attacks. In figure 9 we plot both the $`\delta _1`$ and $`\delta _2`$ as a function of $`n_b`$. It is quite plausible that $`\mathrm{min}(\delta _1,\delta _2)`$ gives a good estimation for $`\delta _c`$, the critical distance associated to the unknown optimal attack. Thus, one can safely conclude that a key can be established using a reasonable number of bases up to distances of the order of 150 km .

## V Conclusions

Unconditional security of quantum cryptography relies on some experimental assumptions that are not achievable with present-day technology. Thus, in a more realistic scenario, the honest parties have to deal with approximated single-photon sources, noisy channels, inefficient detectors and so on, while no limitation on the eavesdropper technology should be assumed. This opens the possibility for alternative eavesdropping attacks, taking advantage of Alice and Bob’s technological imperfections. Indeed, using as a reference the BB84 scheme with $`\mu =0.1`$, all the known protocols become insecure against PNS attacks for channel losses of the order of 13 dB.

In this article we show how to construct QKD protocols resistant against PNS attacks up to channel losses of 40 dB. There are two possibilities for that: (i) to exploit the non-orthogonality of quantum states in a different way, as in the presented four-state protocol or (ii) to include a strong reference pulse that must be always detected by Bob. Both possibilities seem achievable with current technology. In the first case, already existent implementations of the BB84 protocol  provide an experimental demonstration of QKD secure against PNS attacks, when the alternative sifting process is applied. The second possibility shows a connection between discrete and continuous variables QKD schemes that deserves further investigation.

## VI Acknowledgements

We thank Nicolas Cerf, Daniel Collins, Norbert Lütkenhaus and Grégoire Ribordy for helpful discussion. We acknowledge financial supports by the Swiss OFES and NSF within the European project RESQ (IST-2001-37559) and the national center ”Quantum Photonics”.

## Appendix A

In this appendix we show that the overlap between all the states in figure 3 cannot be decreased by the same quantum operation. Using the parametrization of Eq. (30), one can see that

$`|0_b`$ $`=`$ $`c|0_a+c^{}|1_a`$ (50)
$`|1_b`$ $`=`$ $`c^{}|0_a+c|1_a,`$ (51)
where

$$c=\frac{\mathrm{cos}\eta }{\mathrm{sin}\eta }c^{}=\frac{1}{\mathrm{sin}\eta }.$$
(52)
Now, consider a quantum operation, $`M`$, mapping with some probability $`p_a`$ the states in set $`a`$ into some new states, $`|0_a^{}`$ and $`|1_a^{}`$, such that $`0_a^{}|1_a^{}=0`$. This means that

$$M|i_a=\frac{1}{\sqrt{p}_a}|i_a^{},$$
(53)
where $`i=0,1`$. Because of the linearity of Quantum Mechanics, the states in set $`b`$ will be mapped into

$`|0_b^{}`$ $`=`$ $`{\displaystyle \frac{1}{\sqrt{p_b}}}(c|0_a^{}+c^{}|1_a^{})`$ (54)
$`|1_b^{}`$ $`=`$ $`{\displaystyle \frac{1}{\sqrt{p_b}}}(c^{}|0_a^{}+c|1_a^{}),`$ (55)
with probability

$$p_b=\frac{1+\mathrm{cos}^2\eta }{\mathrm{sin}^2\eta }\frac{1}{p_a}.$$
(56)
Their overlap is

$$|0_b^{}|1_b^{}|=\frac{2\mathrm{cos}\eta }{1+\mathrm{cos}^2\eta }\mathrm{cos}\eta ,$$
(57)
i.e. the states in set $`b`$ become less distinguishable.

## Appendix B

In this appendix we will show that $`N1`$ copies of $`N`$ one-qubit state are always linearly independent (see also ). Consider $`N1`$ copies of $`N1`$ general states of one qubit, $`|\psi _i`$ with $`i=1,\mathrm{},N1`$. They belong to the symmetric subspace $`(\text{}^2)_{sym}^{(N1)}`$ of dimension $`N`$. Our aim now is to add a new state and to see when this state can be written as a linear combination of the previous ones. In other terms, we want to find a state $`|\psi _N\text{}^2`$ such that the determinant of the $`N\times N`$ matrix

$$\left(\begin{array}{c}|\psi _1^{(N1)}\mathrm{}|\psi _{N1}^{(N1)}|\psi _N^{(N1)}\end{array}\right)$$
(58)
is zero. Note that the norm of the state does not play any role, so we can write

$$|\psi _N=\left(\begin{array}{c}1\\ x\end{array}\right),$$
(59)
where $`x`$ is an unbounded complex number. Condition (58) then gives an $`N1`$ degree polynomial equation on $`x`$. There are $`N1`$ solutions, that correspond to the $`N1`$ trivial cases $`|\psi _N=|\psi _i`$ for $`i=1,\mathrm{},N1`$. Thus, $`N1`$ copies of any $`N`$ different one-qubit state are always linearly independent.

## Appendix C

In this appendix we briefly describe the asymmetric phase covariant cloning machines introduced in . These machine clone with maximal fidelity all the states that lie in the $`xy`$ plane. At first sight, their only difference is that the one in  uses as an input state a two-qubit reference state plus the state to be cloned, while for the second one qubit suffices as ancillary system.

Consider an input state to be cloned, and a one-qubit ancillary system in a reference state, say $`|0`$. The Niu-Griffiths cloning machine  is defined by the following unitary transformation

$`U_{12}^{NG}|00_{12}`$ $`=`$ $`|00`$ (60)
$`U_{12}^{NG}|10_{12}`$ $`=`$ $`\mathrm{cos}\gamma |10+\mathrm{sin}\gamma |01,`$ (61)
with $`0\gamma \pi /2`$. From the definition it is evident that this transformation does not affect in the same way the two poles $`|\pm z`$ of the Bloch sphere. Nevertheless, this is not the case for those state lying in the $`xy`$ plane, i.e. $`|\vartheta =(|0+e^{i\vartheta }|1)/\sqrt{2}`$. The searched clones are the mixed local states resulting from tracing either the first or the second qubit on the state resulting from the application of Eq. (60),

$$\rho _i=\text{tr}_{2i}(\mathrm{\Pi }_{NG}(\vartheta )),$$
(62)
where $`i=1,2`$ and $`\mathrm{\Pi }_{NG}(\vartheta )`$ is the projector onto $`U_{NG}|\vartheta |0`$. One can easily see that $`\vartheta `$

$`\rho _1=\mathrm{cos}\gamma |\vartheta \vartheta |+(1\mathrm{cos}\gamma ){\displaystyle \frac{\text{11}}{2}}`$ (63)
$`\rho _2=\mathrm{sin}\gamma |\vartheta \vartheta |+(1\mathrm{sin}\gamma ){\displaystyle \frac{\text{11}}{2}}.`$ (64)
Then, the corresponding clone fidelities, defined as $`F_i=\vartheta |\rho _i|\vartheta `$, are $`(1+\mathrm{cos}\gamma )/2`$ and $`(1+\mathrm{sin}\gamma )/2`$. The larger the fidelity for the first clone, the smaller for the second. Equality is achieved when $`\mathrm{cos}\gamma =\mathrm{sin}\gamma `$, and then $`F_1=F_2=(1+1/\sqrt{2})/2`$.

The second type of cloning machine we consider are those introduced in . There, two qubits are used as the ancillary system, and the unitary transformation is, for any input state $`|\psi \text{}^2`$,

$`U_{12}^C|\psi |00`$ $`=`$ $`F|\psi |\mathrm{\Phi }^++(1F)\sigma _z|\psi |\mathrm{\Phi }^{}+`$ (66)
$`\sqrt{F(1F)}\left(\sigma _x|\psi |\mathrm{\Psi }^++i\sigma _y|\psi |\mathrm{\Psi }^{}\right),`$
where

$`|\mathrm{\Phi }^\pm ={\displaystyle \frac{1}{\sqrt{2}}}\left(|00\pm |11\right)`$ (67)
$`|\mathrm{\Psi }^\pm ={\displaystyle \frac{1}{\sqrt{2}}}\left(|01\pm |10\right)`$ (68)
define the standard Bell basis. It is not difficult to see that the local state in the first two qubits is the same as in Eq. (62), if one takes $`F=(1+\mathrm{cos}\gamma )/2`$.

Eve can use these transformations in order to obtain some information about the sent bit. She clones the state sent by Alice, and she forwards the first clone to Bob and keeps the second. Obviously there is a compromise between the quality of the two clones: the better Eve’s clone the worse Bob’s state. Or in other words, the more the information intercepted by Eve, the more the errors on Bob’s side, that allow the honest parties to detect Eve’s intervention. As seen above, the two machines are in many senses equivalent (especially as far as for the cloning fidelities are concerned). However the two attacks differ in the amount of correlations Eve establishes with Bob. This fact is going to be very important for the type of protocols analyzed in this work.

## Appendix D

In this appendix we give two different unitary transformations that somehow generalizes the $`12`$ asymmetric cloning machines to the $`23`$ case. The complete description of these machines will be given elsewhere .

The first machine is mainly inspired by Niu-Griffiths construction. The initial input state corresponds to two copies of an unknown one-qubit state, $`|\psi ^2(\text{}^2\text{}^2)_{sym}`$. Using a two-dimensional ancillary system, say in state $`|0`$, one can define the unitary operation

$`U_{23}^{NG}|00|0`$ $`=`$ $`|000`$ (69)
$`U_{23}^{NG}|\mathrm{\Phi }^+|0`$ $`=`$ $`{\displaystyle \frac{\mathrm{cos}\gamma (|010+|100)+\mathrm{sin}\gamma |001}{\sqrt{1+\mathrm{cos}^2\gamma }}}`$ (70)
$`U_{23}^{NG}|11|0`$ $`=`$ $`{\displaystyle \frac{\mathrm{cos}\gamma |110+\mathrm{sin}\gamma (|011+|101)}{\sqrt{1+\mathrm{sin}^2\gamma }}}.`$ (71)
As in the $`12`$ case, this machine has not the same effect on the states $`|0`$ and $`|1`$. After some lengthy algebra one can see that all the states $`|\psi `$ in the $`xy`$ plane are cloned with the same fidelity. The local state of each of the three qubits is a combination of the identity with the initial pure state as expected, the fidelities being (see also figure 11)

$`F_1^{NG}`$ $`=`$ $`F_2^{NG}={\displaystyle \frac{1}{2}}+{\displaystyle \frac{\mathrm{cos}\gamma }{2\sqrt{3+\mathrm{cos}(2\gamma )}}}+{\displaystyle \frac{1}{\sqrt{17\mathrm{cos}(4\gamma )}}}`$ (72)
$`F_3^{NG}`$ $`=`$ $`{\displaystyle \frac{1}{2}}+{\displaystyle \frac{\mathrm{sin}\gamma }{2\sqrt{3+\mathrm{cos}(2\gamma )}}}+{\displaystyle \frac{\mathrm{sin}(2\gamma )}{\sqrt{17\mathrm{cos}(4\gamma )}}}.`$ (73)
Note that when $`\gamma =\pi /4`$, $`F_1^{NG}=F_3^{NG}=(6+2\sqrt{2}+\sqrt{6})/120.94`$, slightly larger than the fidelity of the $`23`$ universal symmetric cloning of . It has to be stressed that the fidelity for the third clone never reaches the value of one, contrary to what happens for the $`12`$ case. As we learnt from the analysis of the individual attacks, in the type of protocols we analyze it is more convenient for Eve to introduce an extra ancillary system in such a way that she is better correlated to Bob’s result. This can be done introducing an ancillary system on Eve’s side, such that the action on the states of the computational basis is symmetrized. Note that in the $`12`$ case this procedure allows to pass from the Niu-Griffiths to the Cerf cloning machine. The resulting machine can be expressed as,

$$U_{23}^{NGs}|s|00=(U_{23}^{NG}|s|0)|0+(\stackrel{~}{U}_{23}^{NG}|s|0)|1,$$
(74)
where $`|s=|00,|\mathrm{\Phi }^+,|11`$ and $`\stackrel{~}{U}_{23}^{NG}`$ has the same form as $`U_{23}^{NG}`$ but interchanging zeros and ones. The cloning fidelities are again equal to Eq. (72).

The second machine we consider is based on the Cerf construction . As an input state we have two qubits of an unknown one-qubit state plus a two-qubit ancillary system. Then, we define the following unitary operation,

$`U_{23}^C|\psi ^2|00`$ $`=`$ $`v|\psi ^2|\mathrm{\Phi }^++x(\stackrel{~}{\sigma }_z|\psi ^2|\mathrm{\Phi }^{}+`$ (76)
$`\stackrel{~}{\sigma }_x|\psi ^2|\mathrm{\Psi }^++i\stackrel{~}{\sigma }_y|\psi ^2|\mathrm{\Psi }^{}),`$
where, for $`k=x,y,z`$,

$$\stackrel{~}{\sigma }_k=\sigma _k\text{11}+\text{11}\sigma _k,$$
(77)
and $`v^2+8x^2=1`$. One can see that for any input state in the Bloch sphere, the local state of the first two qubits are two identical clones with fidelity $`F_1^C=F_2^C=12x^2`$, while in the third qubit we have another clone with fidelity $`F_3^C=1(v3x)^2/2`$. Thus, the machine (76) is an asymmetric universal cloning machine, i.e. not phase covariant. Indeed, at the point where the three fidelities are equal, we recover the $`23`$ cloning fidelity of  $`F_1^C=F_3^C=11/12`$ (see also figure 11). Note also that in this case, $`F_3^C`$ can be equal to one. Moreover, there are some points where, for a given fidelity for the first two clones, the fidelity for the third one is larger using this cloning machine than for the phase covariant machine of Eq. (69). This shows that the latter is not the optimal phase covariant asymmetric $`23`$ cloning machine. One is tempted to generalize Cerf construction in a direct way, defining a phase covariant machine by changing the coefficient of one of the error terms in (76). However, the resulting operation is not unitary . Therefore, we can only propose two possible asymmetric phase covariant machines, although we know that they are not optimal. Nevertheless, it is quite reasonable to suppose that the increase on Eve’s information will not be very significant when using the, at present unknown, optimal one .


format: text

text:
# New limits on nucleon decays into invisible channels with the BOREXINO Counting Test Facility

## 1 Introduction

The baryon ($`B`$) and lepton ($`L`$) numbers are considered to be conserved in the Standard Model (SM)111It should be noted that nonperturbative effects at high energies can lead to the $`B`$ and $`L`$ violation even in the SM .. However, no symmetry principle underlies these laws, such as, e.g. gauge invariance, which guarantees conservation of the electric charge. Many extensions of the SM include $`B`$ and $`L`$ violating interactions, predicting the decay of protons and neutrons bounded in nuclei. Various decay mechanisms with $`\mathrm{\Delta }B`$=1, 2 and $`\mathrm{\Delta }(B`$$`L)`$=0, 2 have been discussed in the literature intensively . A novel baryon number violating process, in which two neutrons in a nucleus disappear, emitting a bulk majoron $`nn\chi `$, was proposed recently ; the expected mean lifetime was estimated to be $``$1032-39 y. Additional possibilities for the nucleon ($`N`$) decays are related to theories which describe our world as a brane inside higher-dimensional space . Particles, initially confined to the brane, may escape to extra dimensions, thus disappearing for the normal observer; the characteristic proton mean lifetime was calculated to be $`\tau (p)`$=9.2$`10^{34}`$ y . Observation of the disappearance of $`e^{}`$, $`N`$, $`NN`$ would be a manifestation of the existence of such extra dimensions .

No evidence for nucleon instability has been found to date. Experimental searches  with the IMB, Fréjus, (Super)Kamiokande and other detectors have been devoted mainly to nucleon decays into strongly or electromagnetically interacting particles, where lower limits on the nucleon mean lifetime of $`10^{3033}`$ y were obtained . At the same time, for modes where $`N`$ or $`NN`$ pairs disappear or they decay to some weakly interacting particles (neutrinos, majorons, etc.), the experimental bounds are a few orders of magnitude lower. Different methods were applied to set limits for such decays222We are using the following classification of decay channels: decay to invisible channel ($`inv`$) means disappearance or decay to weakly interacting particles (one or few neutrinos of any flavors, majorons, etc.). Channel to $`anything`$, mentioned below, includes also decays to $`inv`$. (see table 1 for summary):

(1) Using the limit on the branching ratio of spontaneous fission of 232Th under the assumption that $`p`$ or $`n`$ decay in 232Th will destroy the nucleus . The bound on the mean lifetime obtained in this way can be considered independent of the a $`p`$ or $`n`$ decay mode, since the 232Th nucleus can be destroyed either by strong or electromagnetic interactions of daughter particles with the nucleus or, in the case of $`N`$ disappearance, by subsequent nuclear deexcitation process;

(2) Search for a free $`n`$ created after $`p`$ decay or disappearance in the deuterium nucleus ($`d`$=$`pn`$) in a liquid scintillator enriched in deuterium  or in a volume of D2O ;

(3) Geochemical  or radiochemical  search for daughter nuclides which have appeared after $`N`$ decays in the mother nuclei (valid for decays into invisible channels);

(4) Search for prompt $`\gamma `$ quanta emitted by a nucleus in a de-excitation process after $`N`$ decays within the inner nuclear shell  (valid for invisible channels);

(5) Considering the Earth as a target with nucleons which decay by emitting electron or muon neutrinos; the $`\nu _e`$, $`\nu _\mu `$ can be detected by a large underground detector  (valid for decay into neutrinos with specific flavors);

(6) Search for bremsstrahlung $`\gamma `$ quanta emitted due to a sudden disappearance of the neutron magnetic moment  (limits depend on the number of emitted neutrinos);

(7) Study of radioactive decay of daughters (time-resolved from prompt products), created as a result of $`N`$ or $`NN`$ decays of the mother nuclei, incorporated into a low-background detector (valid for decay into invisible channels). This method was first exploited by the DAMA group with a liquid Xe detector .

In the present paper we use the same approach to search for $`N`$ and $`NN`$ instability with the Counting Test Facility, a 4.2 ton prototype of the multiton BOREXINO detector for low energy solar neutrino spectroscopy . The preliminary results were presented in .

## 2 Experimental set-up and measurements

### 2.1 Technical information about CTF and BOREXINO

BOREXINO, a real-time 300 ton detector for low-energy neutrino spectroscopy, is nearing completion in the Gran Sasso Underground Laboratory (see  and refs. therein). The main goal of the detector is the measurement of the 7Be solar neutrino flux via $`\nu e`$ scattering in an ultra-pure liquid scintillator, while several other basic questions in astro- and particle physics will also be addressed.

The Counting Test Facility (CTF), installed in the Gran Sasso Underground Laboratory, is a prototype of the BOREXINO detector. Detailed reports on the CTF results have been published , and only the main characteristics of the set-up are outlined here.

The CTF consists of an external cylindrical water tank ($``$11$`\times `$10 m; $``$1000 t of water) serving as passive shielding for 4.2 m3 of liquid scintillator (LS) contained in an inner spherical vessel of $``$2.0 m. High purity water with a radio-purity of $``$$`10^{14}`$ g/g (U, Th), $``$$`10^{12}`$ g/g (K) and $`<`$2 $`\mu `$Bq/l for 222Rn is used for the shielding. The LS was purified to the level of $``$10-16 g/g in U/Th contamination.

We analyze here the data following the upgrade of the CTF (CTF-II). The liquid scintillator used at this stage was a phenylxylylethane (PXE, C16H18) with p-diphenylbenzene (para-terphenyl) as a primary wavelength shifter at a concentration of 2 g/l along with a secondary wavelength shifter 1,4-bis-(2-methylstyrol)-benzene (bis-MSB) at 50 mg/l. The density of the scintillator is 0.996 kg/l. The scintillator principal de-excitation time is less than 5 ns which provides a good position reconstruction. In the CTF-II an additional nylon screen between the scintillator vessel and PMTs (against radon penetration) and a muon veto system were installed.

The scintillation light is collected with 100 phototubes (PMT) fixed to a 7 m diameter support structure inside the water tank. The PMTs are fitted with light concentrators which provide a total of 21% optical coverage. The number of photoelectrons measured experimentally is 3.54 per PMT for 1 MeV electrons at the detector’s center.

For each event the charge and timing of hit PMTs are recorded. Each channel is supported by an auxiliary channel, the so-called second group of electronics, used to record all events coming within a time window of 8.2 ms after the trigger, which allows tagging of fast time-correlated events with a decrease of the overall dead time of the detector. For longer delays, the computer clock is used providing the accuracy of $``$0.1 s. Event parameters measured in the CTF include the total charge collected by the PMTs during 0–500 ns, used to determine an event’s energy; the charge in the ”tail” of the pulse (48–548 ns) which is used for pulse shape discrimination; PMT timing, used to reconstruct the event’s position; and the time elapsed between sequential events, used to tag time-correlated events.

### 2.2 Detector calibration

The energy of an event in the CTF detector is defined using the total collected charge from all PMT’s. In a simple approach the energy is supposed to be linear with respect to the total collected charge. The coefficient linking the event energy and the total collected charge is called light yield (or photoelectron yield). The light yield for electrons can be considered linear with respect to its energy only for energies above 1 MeV. At low energies the phenomenon of “ionization quenching” violates the linear dependence of the light yield versus energy . The deviations from the linear law can be taken into account by the ionization deficit function $`f(k_B,E)`$, where $`k_B`$ is an empirical Birks’ constant. For the calculations of the ionitazion quenching effect for PXE scintillator we used the KB program from the CPC library . The “ionization quenching” effect leads to a shift in the position of the full energy peak for gammas on the energy scale calibrated using electrons. In fact, the position of the 1461 keV 40K gamma in the CTF-II data corresponds to 1360 keV of energy deposited for an electron.

The detector energy and spatial resolution were studied with radioactive sources placed at different positions inside the active volume of the CTF. A typical spatial 1$`\sigma `$ resolution is 10 cm at 1 MeV. The studies showed also that the total charge response of the CTF detector can be approximated by a Gaussian. For energies $`E`$$``$1 MeV (which are of interest here), the relative resolution can be expressed as $`\sigma _E/E=\sqrt{3.810^3/E+2.310^3}`$ ($`E`$ is in MeV)  for events uniformly distributed over the detector’s volume.

The energy dependence on the collected charge becomes non-linear for the energies $`E4.5`$ MeV in the first group of electronics because of the saturation of the ADCs used. In this region we are using only the fact of observing or not-observing candidate events, hence the mentioned nonlinearity doesn’t influence the result of the analysis.

Further details on the energy and spatial resolutions of the detector and ionization quenching for electrons, $`\gamma `$ quanta and $`\alpha `$ particles can be found in .

### 2.3 Muon veto

The upgrade of the CTF was equipped with a carefully designed muon veto system. It consists of 2 rings of 8 PMTs each, installed at the bottom of the tank. The radii of the rings are 2.4 and 4.8 m. Muon veto PMTs are looking upward and have no light concentrators. The muon veto system was optimized in order to have a negligible probability of registering the scintillation events in the so-called ”neutrino energy window” (250–800 keV). The behaviour of the muon veto at the higher energies has been specially studied for the present work. Experimental measurements with a radioactive source (chain of 226Ra)  gave, for the probability $`\eta (E)`$ of identification of an event with energy $`E`$ in the LS by the muon veto, the value of (1$`\pm `$0.2)% in the 1.8–2.0 MeV region (see fig. 3 later). The energy dependence of $`\eta (E)`$ was also calculated by a ray-tracing Monte Carlo method accounting for specific features of the light propagation in the CTF which are detailed in . The calculated function was adjusted to reproduce correctly the experimental measurements with the 226Ra source.

### 2.4 Data selection

As it will be shown below, the candidate events, relevant for our studies, have to satisfy the following criteria: (1) the event should occur in the active volume of the detector and must not be accompanied by the muon veto tag; (2) it should be single (not followed by a time-correlated event); (3) its pulse shape must correspond to that of events caused by $`\gamma `$ or $`\beta `$ particles.

The selection and treatment of data (spatial cuts, analysis of an event’s pulse shape to distinguish between electrons and $`\alpha `$ particles, suppression of external background by the muon veto system, etc.) is similar to that in ref. .

The experimental energy spectra in CTF-II, accumulated during 29.1 days of measurements, are shown in fig. 1. The spectrum without any cuts (spectrum 1) is presented on the top. The second spectrum is obtained by applying the muon cut, which suppressed the background rate by up to two orders of magnitude, depending on the energy region.

On the next stage of the data selection we applied a cut on the reconstructed radius. In the energy region 1–2 MeV we used $`R`$100 cm cut aiming to remove the surface background events (mainly due to the 40K decays outside the inner vessel) and leave the events uniformly distributed over the detector volume. The efficiency of the cut has been studied with MC simulation and lays in the range of $`ϵ_R=0.760.80`$ in the energy region 1–2 MeV. Additional $`\alpha /\beta `$ discrimination  was applied to eliminate contribution from $`\alpha `$ particles (spectrum 3 in fig. 1).

The time-correlated events (that occurred in the time window $`\mathrm{\Delta }t`$$`<`$8.2 ms) were also removed (spectrum 4). The peak at 1.46 MeV, present in all spectra, is due to 40K decays outside the scintillator, mainly in the ropes supporting the nylon sphere. The peak-like structure at $``$6.2 MeV is caused by saturation of the electronics by high-energy events. The lower spectrum of fig. 1 presents all the candidate scintillation events in the search for the decay of radioactive nuclides created in the active volume of the CTF after the nucleon disappearance in parent nuclei.

## 3 Data analysis and results

### 3.1 Theoretical considerations

The decay characteristics of the daughter nuclides, resulting from $`N`$ and $`NN`$ decays in parent nuclei – 12C, 13C and 16O – contained in the sensitive volume of the CTF liquid scintillator or in the water shield, are listed in table 2.

After the disappearance of one or two nucleons in the parent nuclide, one or two holes appear in the nuclear shells; these holes will be filled in a subsequent nuclear de-excitation process, unless the nucleons reside on the outermost shells. If the initial excitation energy, $`E_{exc}`$, is higher than the binding energy $`S_N`$ of the least bound nucleon ($`N`$ is $`p`$ or $`n`$), the nucleus will be de-excited by particle emission ($`p`$, $`n`$, $`\alpha `$, $`d`$, etc.); otherwise ($`E_{exc}<S_N`$) a $`\gamma `$ quantum will be emitted. In the following, we will take into consideration the $`N`$ and $`NN`$ decays from the last filled single-particle levels, when only $`\gamma `$ quanta could be emitted. Thus the daughter nucleus is exactly known. We also neglect by the prompt signal from gamma quanta emitted in initial deexcitation process (in particular, because of generally big half lives of daughter nuclei, and uncertainty in the number of emitted $`\gamma `$’s, their energies, and rejection of high energy events by the muon veto), and search only for subsequent radioactive decay of created nuclei.

The number of nucleons or nucleon pairs participating in the process can be calculated following refs. . For example, after the decay of a neutron with binding energy $`E_n^b(A,Z)`$, the excitation energy of the $`(A1,Z)`$ daughter nucleus will be $`E_{exc}=E_n^b(A,Z)S_n(A,Z)`$. The condition to emit only $`\gamma `$ quanta in the deexcitation process, $`E_{exc}<S_N(A1,Z)`$, gives this restriction on the neutron binding energy: $`E_n^b(A,Z)<S_n(A,Z)+S_N(A1,Z).`$ Similar equations can be written for $`p`$, $`pp`$, $`pn`$ and $`nn`$ decays (see ref. ). The values of the separation energies $`S_N`$ and $`S_{NN}`$ were taken from ref. . For single-particle energies of nucleons $`E_{p,n}^b`$ on nuclear shells we used the continuum shell model calculations  for 12C and 13C, and the Hartree-Fock calculations with the Skyrme’s interaction  for 16O.

### 3.2 Simulation of the response functions

The expected response functions of the CTF detector and related efficiencies for the decay of unstable daughter nuclei were simulated with the EGS4 package . The number of initial electrons and $`\gamma `$ quanta emitted in the decay of the nucleus and their energies were generated according to the decay schemes . The events were supposed to be uniformly distributed in the whole volume of the liquid scintillator (and in a water layer close to the LS). The energy and spatial resolution of the detector , light quenching factors for electrons and gammas , $`\mu `$ veto and triggering efficiency were taken into account in the simulations. The calculated responses for the decay of 11C and 10C in the liquid scintillator (created after $`n`$ and $`nn`$ disappearance in 12C, respectively) and 14O in the water shield ($`nn`$ decay in 16O) are shown in fig. 2. In the last case only the water layer of 1 m thickness closest to the liquid scintillator was taken into consideration. Contributions from layers further out are negligible.

The CTF background was simulated as well in order to check the understanding of the detector. The simulated 40K 1.46 MeV gamma peak together with experimental data is shown in the inset of fig. 1. The shift in the position of the full absorption peak is due to the ionization quenching effect (see section 2.2). One can see the good agreement between the experimental and simulated 40K peak position and resolution.

### 3.3 Limits on probabilities of the $`N`$ and $`NN`$ disappearance

The experimental data (see fig. 2, where the spectrum with all cuts is shown in detail) gives no strong evidence of the expected $`N`$ and $`NN`$ decay response functions, thus allowing only bounds to be set on the processes being searched for. In the present study, in order to extract the limits on the relevant mean lifetimes, we assumed conservatively that all events in the CTF experimental spectrum in the corresponding energy range $`\mathrm{\Delta }E`$ are due to nucleon decays.

The mean lifetime limit was estimated using the formula

$$\tau _{lim}=\epsilon _{\mathrm{\Delta }E}N_{nucl}N_{obj}t/S_{lim}=N_{nucl}N_{obj}t/D_{lim},$$
(1)
where $`\epsilon _{\mathrm{\Delta }E}`$ is the detection efficiency in the $`\mathrm{\Delta }E`$ energy window calculated in the full simulation of the relevant process, taking into account the radial cut efficiency $`ϵ_R`$, and probability of identification by muon veto $`\eta `$; $`N_{nucl}`$ the number of parent nuclei; $`N_{obj}`$ the number of objects ($`n`$, $`p`$ or $`NN`$ pairs) inside the parent nucleus whose decay will give the specific daughter nucleus; $`t`$ the time of measurements; $`S_{lim}`$ the number of events (in the $`\mathrm{\Delta }E`$ window) due to a particular effect which can be excluded with a given confidence level on the basis of experimental data; and $`D_{lim}=S_{lim}/\epsilon _{\mathrm{\Delta }E}`$ the corresponding number of decays in the liquid scintillator/water.

The parameters in (1) were defined in the following way. The mass of scintillator was defined measuring the buoyancy with a precision of 5$`\%`$. The total time of the data taking is 29.1 days and takes into account the dead time of the electronics of $`3\%`$. The measurements were performed in runs of about 24 hours. The internal source of 40K was used to check the energy calibration stability. The position of the 40K peak was defined for every run with statistical accuracy of $`20`$ keV. No systematical shift in energy scale with a time has been found. The same is valid for the energy resolution, which is directly connected to the energy scale. In addition, all the response functions for the searched decays are wider than detector’s resolution, hence the result is insensitive to the observed energy scale uncertainties.

The probability of detecting scintillation events by the muon veto $`\eta =1\pm 0.2\%`$ has been defined from the experimental data for the energy $`E=1.9`$ MeV. This value is in agreement with the MC simulation. For $`\eta (1.9`$ MeV$`)=1.2\%`$ the changes in the integral efficiency $`1\eta (E)`$ is negligible in the case of $`n`$ and $`nn`$ decays, for the $`p`$ and $`pp`$ decays the $`\epsilon _{\mathrm{\Delta }E}`$ will decrease by 7$`\%`$.

#### 3.3.1 $`n`$ and $`nn`$ disappearance

For the $`nn`$ decay, there are four neutrons on the outermost $`1p_{3/2}`$ level of 12C which gives the number of $`nn`$ pairs $`N_{obj}=2`$. The disappearance of the $`nn`$ pair from this level will result in a 10C nucleus in the ground state. Taking into account the statistical uncertainty in the number of experimental events in the 2.0–3.0 MeV energy window (276$`\pm `$17), we calculate $`S_{lim}=297`$ at 90% C.L. Accounting for the associated efficiency $`\epsilon _{\mathrm{\Delta }E}=0.44`$, the limiting value for 10C decays is $`D_{lim}=6.810^2`$. With the values of $`N_{nucl}=1.910^{29}`$ for 12C nuclei and $`t=29.1`$ d, we obtain

$`\tau _{lim}(nn,^{12}`$C$`)=4.410^{25}`$ y with 90% C.L.

For the 16O nucleus we will account for only one $`nn`$ pair on the outermost $`1p_{1/2}`$ orbit ($`nn`$ decay in deeper levels will result the 16O nucleus being too excited). With the number of 16O nuclei (in a 1 m thick water layer) $`N_{nucl}=9.810^{29}`$, $`N_{obj}=1`$ and $`D_{lim}=1.410^4`$ for the energy region 2.2–2.6 MeV, the result is

$`\tau _{lim}(nn,^{16}`$O$`)=5.710^{24}`$ y with 90% C.L.

With the assumption that the mean lifetime of the $`nn`$ pair is the same in 12C and 16O nuclei, and that $`nn`$ decays in both of them contribute to the experimental spectrum simultaneously, one can obtain a slightly more stringent limit for $`nn`$ decay:

$`\tau _{lim}(nninv)=4.910^{25}`$ y with 90% C.L.

For $`n`$ decay in 12C we used a similar approach, just demanding that the simulated response function for 11C decay should be equal to the experimental spectrum in the energy region of 1.0–1.1 MeV (fig. 2). In this way the value $`D_{lim}=3.410^3`$ was determined for the full number of 11C decay events. Together with $`N_{obj}=4`$ (four neutrons on the $`1p_{3/2}`$ level), it gives the following limit:

$`\tau _{lim}(n,^{12}`$C$`)=1.810^{25}`$ y with 90% C.L.

#### 3.3.2 $`p`$ and $`pp`$ disappearance

As for the $`p`$ and $`pp`$ decays into invisible channels, the $`p`$ disappearance in 13C will result in 12B nuclei, the $`\beta ^{}`$ decaying with high energy release $`Q`$=13.370 MeV. The $`pp`$ decays in 13C will produce 11Be nuclei, also the $`\beta ^{}`$ decaying with $`Q`$=11.508 MeV (with probability of decay to the ground state of 57%).

To estimate the $`\tau _{lim}`$ for $`p`$ and $`pp`$ instabilities, we use the fact that no candidate scintillation events were observed in the CTF spectrum with energies higher than 4.5 MeV (fig. 2).

High energy release in the liquid scintillator can activate the muon veto of the CTF, resulting in rejection of the event. We take into account such a suppression of high energy tails in $`\beta `$ decays of 12B and 11Be using the probability $`\eta (E)`$ for identification of an event with energy $`E`$ in the LS by the muon veto (fig. 3). The beta spectra of 12B and 11Be without and with suppression by the muon veto are also shown in fig. 3. The part of the 12B beta spectrum with $`E4.5`$ MeV reduced by a factor of $`1\eta (E)`$ gives an integrated efficiency $`\epsilon _{\mathrm{\Delta }E}=0.39`$. With zero observed events (and with the assumption of zero expected background), the limiting value for the number of events is $`S_{lim}=2.44`$ with 90% C.L. in accordance with the Feldman-Cousins procedure  recommended by the Particle Data Group . Thus we arrive at the value $`D_{lim}=6.2`$ for 12B decay. Together with $`N_{nucl}=2.110^{27}`$ for parent 13C nuclei and the number of $`N_{obj}=4`$ for protons in $`1p_{3/2}`$ orbit, we obtain

$`\tau _{lim}(p,^{13}`$C$`)=1.110^{26}`$ y with 90% C.L.

In a similar way, for the $`pp`$ decay in 13C with the value $`N_{obj}=2`$ for the number of $`pp`$ pairs and $`\epsilon _{\mathrm{\Delta }E}=0.36`$, the mean lifetime limit is

$`\tau _{lim}(pp,^{13}`$C$`)=5.010^{25}`$ y with 90% C.L.

All mean lifetime limits obtained here together with the numbers of parent nuclei, $`N_{obj}`$ and the numbers of decay events are summarized in table 3.

## 4 Conclusions

Using the unique features of the BOREXINO Counting Test Facility – the extremely low background, the large scintillator mass of 4.2 ton and the low energy threshold – new limits on $`N`$ and $`NN`$ decays into invisible channels (disappearance, decays to neutrinos, majorons, etc.) have been set:

$`\tau (ninv)>1.810^{25}`$ y, $`\tau (pinv)>1.110^{26}`$ y,

$`\tau (nninv)>4.910^{25}`$ y and $`\tau (ppinv)>5.010^{25}`$ y with 90% C.L.

Comparing these values with the data of table 1, one can see that the established limits for $`nn`$ and $`pp`$ decays are the best up-to-date limits set by any method, including radiochemical and geochemical experiments.

These limits are obtained in a very conservative assumption that all events in the corrresponding energy region are due to the nucleon decays. The data from the full scale Borexino detector will improve the presented limits by at least two orders of magnitude.