**Preface to "Basics and Applications in Quantum Optics"**

Quantum technologies are advancing very rapidly and have the potential to innovate communication and computing far beyond current possibilities. Among the possible platforms that are suitable for running quantum technology protocols, in recent decades, quantum optics has received a lot of attention due to the handiness and versatility of optical systems. In addition to studying the fundamentals of quantum mechanics, quantum optical states have been exploited for several applications, such as quantum-state engineering, quantum communication and quantum cryptography protocols, enhanced metrology and sensing, quantum optical integrated circuits, quantum imaging, and quantum biological effects. In this Special Issue, we collect some papers and a review focusing on some recent research activities that show the potential of quantum optics for the advancement of quantum technologies. The addressed topics range from quantum computing to quantum-state engineering, from quantum communication to quantum cryptography, and from quantum simulation to quantum imaging, in perfect agreement with the four pillars of the European Commission Quantum Technologies Flagship Program.

> **Maria Bondani, Alessia Allevi, Stefano Olivares** *Editors*

**Alessia Allevi 1,2,\*,†, Stefano Olivares 3,† and Maria Bondani 2,†**


#### **1. Introduction**

Quantum technologies are advancing very rapidly and have the potential to innovate communication and computing far beyond current possibilities. Among the possible platforms suitable to run quantum technology protocols, in the last decades quantum optics has received a lot of attention for the handiness and versatility of optical systems. In addition to studying the fundamentals of quantum mechanics, quantum optical states have been exploited for several applications, such as quantum-state engineering, quantum communication and quantum cryptography protocols, enhanced metrology and sensing, quantum optical integrated circuits, quantum imaging, and quantum biological effects. In this Special Issue, we collect some papers and also a review on some recent research activities that show the potential of quantum optics for the advancement of quantum technologies.

#### **2. Quantum Optics Applications**

The topics addressed in the Special Issue range from quantum computing to quantumstate engineering, from quantum communication to quantum cryptography, from quantum simulation to quantum imaging, in perfect agreement with the four pillars of the European Commission Quantum Technologies Flagship Program.

The first paper [1] of this Special Issue, authored by A. Candeloro et al., focuses on an enhanced version of an all-optical system used to implement a quantum finite automaton [2]. The considered automaton recognizes a well-known family of unary periodic languages that play a crucial role in Descriptional Complexity Theory and in the area of Formal Language Theory. The performance of the device benefits from considering the orthogonal output polarizations of the employed single photons. Moreover, the effect of the detector dark counts on the proper operation of the automaton is taken into account. This kind of photonic quantum automaton could be hardwired into "hybrid" architectures that combine classical and quantum components to build very succinct finite-state devices operating in environments where dimension and energy absorption are particularly critical issues.

The paper written by G. Chesi et al. addresses the topic of quantum-state engineering. The authors present the generation and characterization of Sub-Poissonian states by means of conditional measurements performed on multi-mode twin-beam states [3]. These measurements are based on the use of Silicon photomultipliers [4], a class of photon-number-resolving detectors. Such detectors, very compact and cheap, can open new perspectives in the field of quantum optics and quantum technologies, being suitable for investigating mesoscopic states of light [5]. In the paper, a comprehensive model taking into account all the features of the employed detectors is developed and experimentally verified.

In their paper, M.-S. Kang et al. develop a quantum message authentication protocol for improving security against an existential forgery by means of single-qubit unitary operations [6]. The protocol consists of two parts: a quantum encryption and a correspondence

**Citation:** Allevi, A.; Olivares, S.; Bondani, M. Special Issue on Basics and Applications in Quantum Optics. *Appl. Sci.* **2021**, *11*, 10028. https:// doi.org/10.3390/app112110028

Received: 15 October 2021 Accepted: 22 October 2021 Published: 26 October 2021

**Publisher's Note:** MDPI stays neutral with regard to jurisdictional claims in published maps and institutional affiliations.

**Copyright:** © 2021 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https:// creativecommons.org/licenses/by/ 4.0/).

check. The first part is realized by means of a linear combination of wave plates [7], while the second one is performed using the Hong–Ou–Mandel interference [8]. The successful experimental implementation of the protocol proves that the employed optical system can be considered as the base technology for a complete quantum cryptosystem providing confidentiality, authentication, integrity, and nonrepudiation.

Furthermore, the paper written by K. Park et al. is devoted to quantum-state engineering [9]. Starting form the recent proposal of obtaining high-purity bi-photon states without degrading brightness and collection efficiency by means of a nonlinear interferometer [10], the authors experimentally investigate the fine tunability of the nonlinear interference method to match constructive interference patterns, while maintaining the high spectral purity of the biphoton state. Their results enrich the usefulness and practicality of the method based on the nonlinear interferometer for the efficient generation of photon pairs with high spectral purity, which represents an excellent practical source for quantum information protocols.

The paper authored by A. Allevi et al. focuses on the role of losses in the degradation of the nonclassicality of mesoscopic quantum states of light to be used for secure data transmission in quantum communication protocols [11]. In particular, the authors investigate, both theoretically and experimentally, the effect caused by two realistic kinds of statisticallydistributed amounts of loss, namely a Gaussian distribution and a log-normal one, on the nonclassical photon-number correlations between the two parties of multi-mode twin-beam states [12]. The achieved results show to what extent the involved parameters, both those connected to loss and those describing the employed states of light, preserve nonclassicality.

In the last research paper, J. Lin˜ares et al. present the physical simulation of the dynamical and topological properties of atom-field quantum interacting systems by means of integrated quantum photonic devices [13]. The photonic device consists of integrated optical waveguides supporting two collinear modes, which are coupled by integrated optical gratings [14]. The two-mode photonic device with a single-photon quantum state represents the quantum system, and the optical grating corresponds to an external field. This photonic simulator can be regarded as a basic brick for constructing more complex photonic simulators.

Finally, in the review paper by C. Abbattista et al. the advancement of the research toward the design and implementation of quantum plenoptic cameras is presented and discussed [15]. At variance with standard plenoptic cameras, these devices have dramaticallyenhanced features, such as diffraction-limited resolution, large depth of focus, and ultra-low noise [16]. For the quantum advantages of the proposed devices to be effective and appealing to end-users, the authors propose to develop high-resolution single-photon avalanche photodiode arrays and high-performance low-level programming of ultra-fast electronics, combined with compressive sensing and quantum tomography algorithms, with the aim of reducing both the acquisition and the elaboration time by two orders of magnitude. These new strategies will open the way to new opportunities and applications, such as for biomedical imaging, security, space imaging, and industrial inspection.

**Author Contributions:** Conceptualization, A.A., S.O. and M.B.; methodology, A.A.; writing original draft preparation, A.A., S.O. and M.B; writing—review and editing, A.A., S.O. and M.B. All authors have read and agreed to the published version of the manuscript.

**Funding:** This research received no external funding.

**Institutional Review Board Statement:** Not applicable.

**Informed Consent Statement:** Not applicable.

**Data Availability Statement:** The datasets used and analysed during the current study are available from the corresponding author on reasonable request.

**Acknowledgments:** This issue would not have been possible without the contributions of several valued authors, professional reviewers, and the Applied Sciences editorial team. We first extend our congratulations to all the authors. Second, we would like to take this opportunity to show our sincere gratitude to all reviewers. Finally, we thank the editorial team of Applied Sciences and especially Patrick Han.

**Conflicts of Interest:** The authors declare no conflict of interest.

#### **References**


### *Article* **An Enhanced Photonic Quantum Finite Automaton**

**Alessandro Candeloro 1,†, Carlo Mereghetti 1,†, Beatrice Palano 2,†, Simone Cialdi 1,3,†, Matteo G. A. Paris 1,3,† and Stefano Olivares 1,3,\*,†**


**Abstract:** In a recent paper we have described an optical implementation of a *measure-once one-way quantum finite automaton* recognizing a well-known family of unary periodic languages, accepting words not in the language with a given error probability. To process input words, the automaton exploits the degree of polarization of single photons and, to reduce the acceptance error probability, a technique of confidence amplification using the photon counts is implemented. In this paper, we show that the performance of this automaton may be further improved by using strategies that suitably consider *both* the orthogonal output polarizations of the photon. In our analysis, we also take into account how detector dark counts may affect the performance of the automaton.

**Keywords:** quantum finite automata; periodic languages; confidence amplification; photodetection

#### **1. Introduction**

In the recent years, quantum computers have eventually leaped out of the laboratories [1] and become accessible to a still growing community interested in investigating their actual potentialities. Nevertheless, a full-featured quantum computer is still far from being built. However, it is reasonable to think of classical computers exploiting some quantum components. In this framework, quantum finite automata [2,3]—theoretical models for quantum machines with finite memory—may play a key role, as they model small-size quantum computational devices that can be embedded in classical ones. Among possible models, the so-called measure-once one-way quantum finite automaton [4,5] is the simplest, and it has been shown to be the most promising for a physical realization [6]. In fact, restricted models of computation, such as quantum versions of finite automata, have been theoretically studied [7–9] and, very recently, experimentally investigated [6,10].

In [6], a measure-once one-way quantum finite automaton recognizing a well-known family of unary periodic languages [4], namely, languages *Lm*, has been implemented using quantum optical technology [11,12]. In our implementation, a given input word is accepted by the automaton, with a given error probability, whenever a single photon arrives at the output of the device with a specific polarization. In particular, the experimental realization, based on the manipulation of single-photon polarization and photodetection, has demonstrated the possibility of building small quantum computational component to be embedded in more sophisticated and precise quantum finite automata or also in other computational systems and approaches [13–15]. Albeit the photonic automaton realized in [6] is fed with single photons, it works in a regime where polarized laser pulses (coherent states) are enough, up to detecting the intensity of the output signals instead of counting the number of photons successfully passing through the device with a given polarization (see in [6] for details).

**Citation:** Candeloro, A.; Mereghetti, C.; Palano, B.; Cialdi, S.; Paris, M.G.A.; Olivares, S. An Enhanced Photonic Quantum Finite Automaton. *Appl. Sci.* **2021**, *11*, 8768. https://doi.org/10.3390/app11188768

Academic Editor: Caterina Ciminelli

Received: 10 August 2021 Accepted: 18 September 2021 Published: 21 September 2021

**Publisher's Note:** MDPI stays neutral with regard to jurisdictional claims in published maps and institutional affiliations.

**Copyright:** © 2021 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https:// creativecommons.org/licenses/by/ 4.0/).

In this paper, we propose an enhanced version of our photonic automaton mentioned above, where, to further reduce the acceptance error probability, we consider not only the photons with the "correct" polarization, but also the other ones. To achieve this goal, the use of single-photon techniques turns out to be crucial, such as the detection of coincidence count to reduce the dark-count rate of the photodetectors [16]. Analytical and numerical results, supported by simulated experiments, show that the enhanced version allows to reduce the error probability by orders of magnitude compared to the previous version, or, analogously, to drastically reduce the mean number of photons needed to achieve the same performance.

The paper is structured as follows. As our work requires some previous knowledge from Theoretical Computer Science about formal languages and finite automata, Section 2 is devoted to introduce the reader to these topics, providing the relevant motivations. In Section 3, we briefly review basics of formal language theory and the definition of a measure-once one-way quantum finite automaton. Section 4 describes the implementation of the measure-once one-way quantum finite automaton based on the polarization of single photons, linear optical elements, and photodetectors. In Section 5, we explain how to improve the confidence of the obtained measure-once one-way quantum finite automaton by processing the number of counts at the detectors. We also introduce new strategies that reduce the error probability, namely, the probability that a "wrong" word is accepted by the automaton or a "correct" word is rejected. The numerical results and the simulated experiments are reported in Section 6. We close the paper with some concluding remarks in Section 7.

#### **2. Formal Languages, Finite Automata, and Quantum Computing**

In this section, we would like to expand on motivations that have been driving our research covered by the present contribution and the previous one in [6]. The aim of our work, that bridges between Theoretical Computer Science and Experimental Quantum Optics, has been and is to show that a quantum computing device with finite memory is physically realizable by means of photonics, using a very limited amount of "quantum hardware". To the best of our knowledge, our physical implementation, described here and in [6], of a quantum finite automaton for language acceptation is the first proposed in the literature. Thus, we have shown how the quantum behaviour of microscopic systems can actually represent a computational resource, as theoretically established within the discipline of Quantum Computing. From this perspective, the simple language *Lm*, introduced in the next section and for which we build our photonic quantum finite automaton, is not really the point here. Instead, the point is the concrete creation of a programmable fully quantum computer with finite memory.

With this being said, we would also like to quickly comment on the language *Lm* from a Theoretical Computer Science viewpoint. Notwithstanding its simplicity, the language *Lm* plays a crucial role in Descriptional Complexity Theory (see, e.g., in [17–21]), the area of Formal Language Theory in which the *size* of computational models is investigated. In particular, a well-consolidated trend in Descriptional Complexity is devoted to study the size of several types of *finite automata*. The reader is referred to, e.g., the work in [22] for extensive presentations of automata theory. Very roughly speaking, the hardware of a (one-way) finite automaton *A* features a read-only input tape consisting of a sequence of cells, each one being able to store an input symbol. The tape is scanned by an input head always moving one position right at each step. At each time during the computation of *A*, a finite state control is in a state from a *finite* set *Q*. Some of the states in *Q* are designated as accepting states, while a state *q*<sup>0</sup> ∈ *Q* is a designated initial state. The computation of *A* on a word (i.e., a finite sequence of symbols) *ω* from a given input alphabet begins by having (i) *ω* stored symbol by symbol, left to right, in the cells of the input tape; (ii) the input head scanning the leftmost tape cell; and (iii) the finite state control being in the state *q*0. In a move, *A* reads the symbol below the input head and, depending on such a symbol and the state of the finite state control, it switches to the next state according to

a fixed transition function and moves the input head one position forward. We say that *A* accepts *ω* whenever it enters an accepting state after scanning the rightmost symbol of *ω*; otherwise, *A* rejects *ω*. The language accepted by *A* consists of all the input words accepted by *A*.

The one described so far is the original model of a finite automaton, called *deterministic*. Several variants of such an original model have been introduced and studied in the literature, sharing the same hardware but different dynamics. Therefore, we have *nondeterministic*, *probabilistic* and, recently, *quantum* finite automata (see, e.g., in [23–25]). Furthermore, *two-way* automata are studied, where the input head can move back and forth on the input tape.

Finite automata represent a formidable theoretical model used in the design and analysis of several devices such as the control units for vending machines, elevators, traffic lights, combination locks, etc. Particularly important is the use of finite automata in very large-scale integration (VLSI) design, namely, in the project of sequential networks which are the building blocks of modern computers and digital systems. Very roughly speaking, a sequential network is a boolean circuit equipped with memory. Engineering a sequential network typically requires modeling its behaviour with a finite automaton whose number of states directly influences the amount of hardware (i.e., the number of logic gates) employed in the electronic realization of the sequential network. From this point of view, having fewer states in the modeling finite automaton directly results in employing smaller hardware which, in turn, means having less energy absorption and fewer cooling problems. These "physical" considerations, that are of paramount importance given the current level of digital device miniaturization, have led to define the size of a finite automaton as the number of its states. In particular, reducing or increasing the number of states is studied, when using different computational paradigms (e.g., deterministic, nondeterministic, probabilistic, quantum, one-way, and two-way) on a finite automaton to perform a given task. Here, is where our simple language *Lm* comes into play. In fact, this language is universally used as a benchmark to emphasize the succinctness of several types of automata. Several results in the literature shows that accepting *Lm* on classical models of finite state automata is particularly size-consuming (i.e., it requires a great number of states), while only two basis states are enough on quantum finite automata, as we will see in the next section.

Modular design frameworks have been theoretically proposed [7–9], where more reliable and sophisticated quantum automata can be built by suitably composing (see, e.g., in [26]) easy-to-obtain variants of the quantum automaton for *Lm*. Hence, our work provides crucial and concrete quantum components for such frameworks, and suggest investigating a physical implementation of some automata composition laws. More generally, the Krohn–Rhodes decomposition theorem [27] states that any classical finite automaton can be simulated by composing very "simple" finite automata: one of these simple automata is exactly the one for *Lm*. From this perspective, our photonic quantum automaton could be hardwired into "hybrid" architectures joining classical and quantum components to build very succinct finite state devices operating in environments where dimension and energy absorption are particularly critical issues (e.g., drone or robot-based systems [28]).

#### **3. Measure-Once One-Way Quantum Finite Automaton**

Here, we briefly overview the main concepts on automata and formal language theory. We refer the interested reader to any of the standard books on these subjects (see, e.g., in [22]), as well as to our contribution [6].

An alphabet is any finite set Σ of elements called symbols. A word on Σ is any sequence *σ*1*σ*<sup>2</sup> ··· *σ<sup>n</sup>* with *σ<sup>i</sup>* ∈ Σ. The set of all words on Σ is denoted by Σ∗. A language *L* on Σ is any subset of Σ∗, i.e., *L* ⊆ Σ∗. If |Σ| = 1, we say that Σ is a *unary* alphabet, and languages on unary alphabets are called unary languages. In case of unary alphabets, we customarily let <sup>Σ</sup> <sup>=</sup> {*a*} so that a unary language is any set *<sup>L</sup>* <sup>⊆</sup> *<sup>a</sup>*∗. We let *<sup>a</sup><sup>k</sup>* be the unary word obtained by concatenating *k* times the symbol *a*.

In what follows, we will be interested in the unary language *Lm* defined as

$$L\_m = \{ a^k \mid k \in \mathbb{N} \text{ and } k(\text{mod } m) = 0 \}. \tag{1}$$

This language is rather famous in the realm of automata theory, since it has proven particularly "size-consuming" to be accepted by several models of classical automata, as the number of needed states increases with *m* [6]. The reader may find a deep investigation on this fact in the literature [22,29–31]. On the other hand, as presented in [6], very succinct measure-once one-way quantum finite automata (1qfa's, from now on) may be designed and physically realized for *Lm*. Let us now sketch the main ingredients for a 1qfa accepting *Lm*.

If we consider the two orthogonal states |*H* = (1, 0) and |*V* = (0, 1), the 1qfa is defined as (here we use the formalism based on the Dirac's notation; the analysis based on a more general formalism can be found in [6])

$$\mathcal{A}\_1 = \left\{ |H\rangle, \mathcal{U}\_{\text{m}}, P^H \right\} \tag{2}$$

where |*H* represents the initial state, the unitary operation applied by the automaton upon processing any input symbol *a* is defined as

$$i\mathcal{U}\_{\mathcal{W}} = \exp\left(-i\theta\_{\mathcal{W}}\sigma\_{\mathcal{Y}}\right) \tag{3}$$

$$\mathbf{H} = \begin{pmatrix} \cos \theta\_{\text{ff}} & \sin \theta\_{\text{ff}} \\ -\sin \theta\_{\text{ff}} & \cos \theta\_{\text{ff}} \end{pmatrix} \tag{4}$$

with *<sup>θ</sup><sup>m</sup>* <sup>=</sup> *<sup>π</sup>*/*<sup>m</sup>* and *<sup>σ</sup><sup>y</sup>* the Pauli matrix, while *<sup>P</sup><sup>H</sup>* <sup>=</sup> <sup>|</sup>*HH*<sup>|</sup> is the projector onto the mono-dimensional accepting subspace spanned by <sup>|</sup>*H*. The probability *<sup>p</sup>*A<sup>1</sup> (*ak*) that the 1qfa <sup>A</sup><sup>1</sup> accepts the word *<sup>a</sup><sup>k</sup>* writes as

$$p\_{\mathcal{A}\_1}(a^k) = p^H(a^k) \equiv |\langle H | \mathcal{U}\_m^k | H \rangle|^2 \tag{5}$$

$$\theta = \cos^2(k\theta\_m) \to \begin{cases} = 1 & k(\text{mod } m) = 0 \\ \le \cos^2\theta\_m & \text{otherwise.} \end{cases} \tag{6}$$

Therefore, the 1qfa <sup>A</sup><sup>1</sup> perfectly recognizes the word *<sup>a</sup><sup>k</sup>* <sup>∈</sup> *Lm*, as we can set a *cut point λ* and an *isolation ρ* to the following values (see in [6] for details on accepting languages with isolated cut point)

$$
\lambda = \frac{1 + \cos^2 \theta\_{\text{ff}}}{2} \quad \text{and} \quad \rho = \frac{1 - \cos^2 \theta\_{\text{ff}}}{2}. \tag{7}
$$

However, A<sup>1</sup> may also recognize an input word not in *Lm* with a non-null probability. In the following, we let *ak*<sup>1</sup> with *k*1(mod *m*) = 1 any of the word with the highest probability of erroneously being accepted, i.e., cos2 *θm*, which tends to 1 as *m* gets large. This can be seen also by the fact that *ρ* → 0 as *m* increases.

As matter of fact, we can also introduce the following 1qft, where we still consider the initial state |*H*, but, at the output, we focus on the final projection involving the state |*V*, namely

$$\mathcal{A}\_2 = \left\{ |H\rangle, \mathcal{U}\_{\text{m}}, \mathbb{I} - P^V \right\}\_{\prime} \tag{8}$$

where *<sup>P</sup><sup>V</sup>* <sup>=</sup> <sup>|</sup>*VV*|. Indeed, <sup>A</sup><sup>2</sup> is formally equivalent to <sup>A</sup>1, as <sup>−</sup> *<sup>P</sup><sup>V</sup>* <sup>≡</sup> *<sup>P</sup>H*. In fact, the probability of accepting a word is now given by

$$p\_{\mathcal{A}\_2}(a^k) = 1 - p^V(a^k) \to \begin{cases} = 1 & k(\text{mod } m) = 0\\ \le \cos^2 \theta\_m & \text{otherwise} \end{cases} \tag{9}$$

that is the same as in Equation (6), as one may expect. Nevertheless, we show in the next section that the two are not equivalent in a photonic implementation for reasons that will be clear soon.

#### **4. Photonic Implementation of the 1qfa**

A photonic implementation of the 1qfa described in the previous section was proposed and demonstrated in [6]. Figure 1 depicts the main elements of the enhanced version of the automata we will describe in the following.

The state of the automaton is encoded in the polarization of single photons, and the Hilbert space is H = span{|*H*, |*V*}. A single photon source generates a horizontalpolarized state, <sup>|</sup>*H*, which is sent to *<sup>k</sup>* rotators of polarization, *<sup>a</sup><sup>k</sup>* being the input word to be processed. Each rotator corresponds to a unitary rotation of an amount *θm*, which is thus language-dependent. After the rotators, the single photon state reads

$$|k\theta\_m\rangle = \cos(k\theta\_m)|H\rangle + \sin(k\theta\_m)|V\rangle\tag{10}$$

and it is sent to a polarizing beam splitter (PBS; see Figure 1) that reflects the vertical polarization component and transmits the horizontal one. Finally, two photodetectors placed after the PBS realize the projective measure of *P<sup>H</sup>* and *PV*. As the reader can see, the scheme is almost the same of that proposed in [6], but here we will implement a new inference strategy exploiting the outcomes from both the detectors.

As we observed in the previous section, the automata A<sup>1</sup> and A<sup>2</sup> accept with certainty a word *a<sup>k</sup>* that belongs to *Lm*. However, there is a high probability that an incorrect word, such as *<sup>a</sup>k*<sup>1</sup> with *<sup>k</sup>*<sup>1</sup> mod *<sup>m</sup>* = 0 can be accepted, as we can see from Equations (6) and (9). Therefore, strategies based on a single-photon shot may not be the optimal way to recognize an arbitrary word *ak*.

#### **5. Confidence Amplification: An Enhanced Strategy**

To reduce the probability of error, we can adopt a technique of confidence amplification as also proposed in [6], namely, we sent a mean number of photons *N*c and we count the number of click *N<sup>x</sup>* <sup>c</sup> (*k*) at the photodetector *x* = *H*, *V*, see Figure 1. Therefore, the observed detection frequency at detector *x* = *H*, *V* for an input word *a<sup>k</sup>* will be

$$f\_k^{\mathbf{x}} = \frac{N\_\mathbf{c}^\mathbf{x}(k)}{\langle N\_\mathbf{c} \rangle} \xrightarrow{\langle N\_\mathbf{c} \rangle \gg 1} p\_{\mathcal{A}\_{i=1,2}}^{\mathbf{x}}(a^k) \,. \tag{11}$$

Thereafter, we turn our problem into that of discriminating among the corresponding detection frequencies and, in particular, we can focus on those related to *k* = 0 (or, equivalently, *k* mod *m* = 0) and *k* = 1 (or, more in general, *k* mod *m* = 1), since if *k* > 1 one has *f <sup>H</sup> <sup>k</sup>* < *<sup>f</sup> <sup>H</sup>* <sup>1</sup> (*<sup>f</sup> <sup>V</sup> <sup>k</sup>* > *<sup>f</sup> <sup>V</sup>* <sup>1</sup> ). To implement this strategy, we set a threshold frequency as

$$f\_{\rm th}^{\rm x} = \frac{f\_0^{\rm x} + f\_1^{\rm x}}{2} = \begin{cases} \frac{1 + f\_1^{\rm H}}{2} & \text{x} = H\_\prime \\\\ \frac{f\_1^{\rm V}}{2} & \text{x} = V\_\prime \end{cases} \tag{12}$$

where *f <sup>H</sup>* <sup>1</sup> (*<sup>f</sup> <sup>V</sup>* <sup>1</sup> ) is the highest (lowest) frequency of erroneously accepted words *<sup>a</sup>k*<sup>1</sup> , while *f H* <sup>0</sup> (*<sup>f</sup> <sup>V</sup>* <sup>0</sup> ) is the frequency corresponding to the correct word. In this formula, we have distinguished the two different strategies: for the *H* detector, *f <sup>H</sup>* <sup>0</sup> = 1, as the corresponding photon will always be detected; instead, for the *V* detector, *f <sup>V</sup>* <sup>0</sup> = 0, as no photon is detected when the word belongs to *Lm*. Therefore, the strategy is to accept the word if *f <sup>H</sup> <sup>k</sup>* > *<sup>f</sup> <sup>H</sup>* th (*f <sup>V</sup> <sup>k</sup>* < *<sup>f</sup> <sup>V</sup>* th) and reject it if *<sup>f</sup> <sup>H</sup> <sup>k</sup>* < *<sup>f</sup> <sup>H</sup>* th (*<sup>f</sup> <sup>V</sup> <sup>k</sup>* > *<sup>f</sup> <sup>V</sup>* th). From now on, we will refer to these strategies as "H strategy" and "V strategy", respectively.

In an ideal scenario, namely, without fluctuations in the sent number of photons, it is clear that the two approaches are complementary and yield to the same conclusion, as the single detections in *H* and *V* are perfectly correlated. Moreover, given that only the words *<sup>a</sup><sup>k</sup>* <sup>∈</sup> *Lm* satisfy the condition *fk* <sup>&</sup>gt; *<sup>f</sup>*th, with this strategy we have a zero error probability, provided that *N*c is large enough such that the integer part of *<sup>N</sup><sup>H</sup>* th (*N<sup>V</sup>* th) is strictly positive (negative) than *N<sup>H</sup>* <sup>c</sup> (*k*1) (*N<sup>V</sup>* <sup>c</sup> (*k*1)), i.e., we have the conditions

$$
\left\lfloor N\_{\text{th}}^{H} \right\rfloor = \left\lfloor \frac{\left\langle N\_{\text{c}} \right\rangle (1 + \cos^{2} \theta\_{\text{m}})}{2} \right\rfloor > \left\lfloor \left\langle N\_{\text{c}} \right\rangle \cos^{2} \theta\_{\text{m}} \right\rfloor,\tag{13}
$$

$$
\left\lfloor N\_{\rm th}^V \right\rfloor = \left\lfloor \frac{\langle \text{N}\_{\rm c} \rangle \sin^2 \theta\_{\rm m}}{2} \right\rfloor < \left\lfloor \langle \text{N}\_{\rm c} \rangle \sin^2 \theta\_{\rm m} \right\rfloor. \tag{14}
$$

In Figure 2 (black lines and dots), we report the minimum values of *Nc* such that the last two inequalities hold.

**Figure 2.** Black line and dots: minimum value *Ncmin* such that Equation (13) (**left plot**) and Equation (14) (**right plot**) are satisfied as a function of *m* in the absence of dark counts (*N*dc = 0). Red line and dots (*N*dc <sup>=</sup> 50), blue line and dot (*N*dc <sup>=</sup> 100): minimum vale *Ncmin* such that Equation (22) (**left plot**) and Equation (23) (**right plot**) are satisfied. Notice the different scaling for the *y*-axis.

In a realistic scenario, the photo-detection is influenced by two distinct noisy effects that can affect the error probability. The first is that the number of detected photons follows a Poisson distribution [32], that is, we have

$$\text{Poi}(n;\mu) = \frac{\mu^n e^{-\mu}}{n!} \tag{15}$$

that is, the probability of detect *n* photons depends on the average number of detected photons *μ*. How this affects the error probability has been thoroughly addressed both theoretically and experimentally in [6].

The second effect that we should consider in order to apply our enhanced strategy is due to the dark counts, namely, the random counts registered by the detector without any incident light on it. Being still related to the detection process, also the dark counts follow a Poissonian distribution, whose mean *N*dc depends on the particular detector one choose to use. In a typical quantum optics experiment, the dark-count rate ranges from tens to hundreds of photons per second, but this number can be drastically reduced by using coincidence counting techniques [16], up to making this effect negligible. For instance, in the implementation in [6] the dark counts where only 0.001% of the effective coincidence counts. As the dark counts occurs randomly, we cannot distinguish between a dark count and signal one. Therefore, the probability of detecting *N* photon in the *H* or *V* photodetector for a word *a<sup>k</sup>* is finally given by

$$P\_k^{\mathbf{x}}(N) = \sum\_{n=0}^{+\infty} \sum\_{m=0}^{+\infty} \text{Poi}(n; \eta^{\mathbf{x}}) \text{Poi}(m; \langle N\_{\text{dc}} \rangle) \delta\_{n+m,N} \tag{16}$$

$$=\text{Poi}(N; \mu\_k^x) \tag{17}$$

where *<sup>η</sup><sup>H</sup>* <sup>=</sup> *N*c cos2(*kθm*) and *<sup>η</sup><sup>V</sup>* <sup>=</sup> *N*c sin2(*kθm*), while we have defined the overall mean number of detected photons as

$$
\mu\_k^H = \langle N\_\mathbf{c} \rangle \cos^2(k\theta\_m) + \langle N\_{\rm dc} \rangle \quad \text{and} \quad \mu\_k^V = \langle N\_\mathbf{c} \rangle \sin^2(k\theta\_m) + \langle N\_{\rm dc} \rangle. \tag{18}
$$

As we noticed above, the dark count rate is usually very small with respect to the detected count rate of the signal. Therefore, for the *H* detector which detects the higher number of photons, see Equation (18), they are relevant only when *N*c∼*N*dc. On the contrary, for the *V* detector, detecting the lower number of photons, their role is fundamental in determining the performance of the photonic automaton, as *μ<sup>V</sup> <sup>m</sup>* = *μ*dc = *N*dc. This is the main difference between the two strategies: in the first, we need to distinguish between two finite mean numbers of photon *μ<sup>H</sup> <sup>m</sup>* <sup>=</sup> *N*c <sup>+</sup> *N*dc and *<sup>μ</sup><sup>H</sup> k*1 , while in the second case, we need to distinguish between the noise due to dark counts, being *μ<sup>V</sup> <sup>m</sup>* = *N*dc, and *μ<sup>V</sup> k*1 . However, to assess the performance of second strategy with respect the first one, we need to evaluate the probability of errors in the two cases.

Let us first find the threshold values in the two different strategy. We need to find the intersection between two Poissonian distributions for a word belong to *Lm* and a word *ak*<sup>1</sup> with highest probability of being erroneously being accepted, as show in Figure 3. By imposing Poi(*N<sup>x</sup>* th; *<sup>μ</sup><sup>x</sup>* <sup>1</sup> ) = Poi(*N<sup>x</sup>* th; *<sup>μ</sup><sup>x</sup> <sup>m</sup>*), where *x* = *H*, *V*, we find an exact solution for *N<sup>x</sup>* th given by (see the vertical dashed line in Figure 3)

$$N\_{\rm th}^{\rm x} = \frac{\mu\_{\rm m}^{\rm x} - \mu\_{k\_1}^{\rm x}}{\ln \mu\_{\rm m}^{\rm x} - \ln \mu\_{k\_1}^{\rm x}}.\tag{19}$$

To highlight the dark counts effects, we introduce the ratio *η* = *N*dc/*N*c, and we have

$$N\_{\rm th}^{H} = \frac{\langle N\_{\rm c} \rangle \sin^{2} \theta\_{m}}{\ln(1+\eta) - \ln(\cos^{2} \theta\_{m} + \eta)},\tag{20}$$

$$N\_{\rm th}^{V} = \frac{\langle N\_{\rm c} \rangle \sin^{2} \theta\_{\rm m}}{\ln \left( \sin^{2} \theta\_{\rm m} + \eta \right) - \ln(\eta)}. \tag{21}$$

In our framework, the accepting problem is introduced as binary discrimination between the correct word and the word with the highest probability of error. However, in the photonic realization of the automata [6], when the number of input photons is small

and *m* is large, also word with larger *k*(mod *m*) may contribute to the error. For this reason, like in the ideal case, we establish the minimum number of input photon *N*c*min* which are necessary to faithfully consider the problem as binary discrimination.

**Figure 3.** Probability density function of the Poissonian distribution in Equation (17) for the *H* detector (**left plot**) and the *V* detector (**right plot**) for *Nc* = 500, *N*dc = 100 and *m* = 11. The probability of error in Equations (25) and (29) are, respectively, *p<sup>V</sup> <sup>e</sup>* = 0.034 (*V* detector) and *p<sup>H</sup> <sup>e</sup>* = 0.205 (*H* detector). The gray dashed line is the threshold values in Equation (19). The values of the involved parameters have been chosen to better highlight the investigated effect.

To have faithfully binary discrimination the fluctuations due to the word with the second-largest probability of error, i.e., a word *ak*<sup>2</sup> with *k*2(mod *m*) = 2, must be much larger than the fluctuations due to the correct word, where here for "large" we mean at least two standard deviations. In this way, the discrimination can be considered only between the words *a<sup>m</sup>* and *ak*<sup>1</sup> . In the case of a Poissonian random variable, the standard deviation is the square root of the mean for Poissonian random variables. Hence, we have the two conditions, respectively, for the *H* and *V* detector

$$
\mu\_{k\_2}^H + 2\sqrt{\mu\_{k\_2}^H} < \mu\_m^H - 2\sqrt{\mu\_{m'}^H} \tag{22}
$$

$$
\mu\_{Dc} + 2\sqrt{\mu\_{Dc}} < \mu\_{k\_2}^V - 2\sqrt{\mu\_{k\_2}^V}.\tag{2.3}
$$

In the first one we ask that the fluctuations due to the word with the second largest probability of error, i.e., a word *k*<sup>2</sup> with *k*2(mod *m*) = 2 are much larger than the fluctuations due to dark counts. In a similar way, we define the threshold for the horizontal detector. These equations can be solved for *N*c and set a lower bounds for it such that the probability of error can be evaluated in term of a binary discrimination problem, as shown in Figure 2 (red and blue lines and points) .

Now, we can evaluate the probability of error for the two strategies. Indeed, this is equal to

$$p\_e^x = p(a^{k\_1})p^x(a^{k\_1} \to a^m) + p(a^m)p^x(a^m \to a^{k\_1}),\tag{24}$$

where we have denoted *<sup>p</sup>x*(*a<sup>i</sup>* <sup>→</sup> *<sup>a</sup><sup>j</sup>* ) as the probability of detecting the word *a<sup>i</sup>* as *a<sup>j</sup>* by the detector *x* = *H*, *V*. As we have no a priori knowledge on the input word we set the prior probabilities *p*(*ak*<sup>1</sup> ) = *p*(*am*) = 1/2, and for the *V* detector we obtain

$$P\_{\varepsilon}^{V} = \frac{1}{2} \left[ \sum\_{n=0}^{\lfloor N\_{\rm th}^{V} \rfloor} \frac{(\mu\_{k\_1}^{V})^n e^{-\mu\_{k\_1}^{V}}}{n!} + \sum\_{n=\lfloor N\_{\rm th}^{V} \rfloor + 1}^{+\infty} \frac{\mu\_{\rm dc}^{n} e^{-\mu\_{\rm dc}}}{n!} \right] \tag{25}$$

$$=\frac{1}{2}\left[1-\frac{\Gamma(\lfloor N\_{\rm th}^V \rfloor + 1, \mu\_{\rm dc}) - \Gamma(\lfloor N\_{\rm th}^V \rfloor + 1, \mu\_{k\_1}^V)}{\lfloor N\_{\rm th}^V \rfloor!}\right] \tag{26}$$

$$=\frac{1}{2}\left[1-\int\_{N\_{\rm dc}}^{N\_{\rm c}\sin^{2}\theta\_{\rm w}+N\_{\rm dc}}\frac{e^{-t}\mathbf{f}\left[N\_{\rm th}^{V}\right]}{\left\lfloor N\_{\rm th}^{V}\right\rfloor!}dt\right],\tag{27}$$

where Γ(*a*, *x*) is the incomplete Gamma function

$$
\Gamma(a, x) = \int\_x^{+\infty} e^{-t} t^{a-1} dt. \tag{28}
$$

Analogously, we may evaluate the probability of error for the detection of a horizontally polarized photon, i.e.,

$$P\_c^H = \frac{1}{2} \left[ \sum\_{n=0}^{\lfloor \frac{N\_{\rm th}^H}{m} \rfloor} \frac{(\mu\_m^H)^n e^{-\mu\_m^H}}{n!} + \sum\_{n=\lfloor \frac{N\_{\rm th}^H}{m} \rfloor + 1}^{+\infty} \frac{(\mu\_{k\_1}^H)^n e^{-\mu\_{k\_1}^H}}{n!} \right]. \tag{29}$$

Eventually, we can introduce a third strategy that combines the two described so far: for each beam of photon, we propose to measure both the *H* and *V* polarization and to combine the results so obtained. From a theoretical point of view, this is equivalent to the automata presented before, as in the ideal case the two detectors perfectly agree, i.e., one sees the photon and the other one does not see it. However, in the non-ideal case, noisy fluctuations affect photodetection. As the fluctuations in the *H* detector are independent from the one in the *V* detector, the probability of erroneously accepting it by looking at both *H* and *V* is given as

$$p\_c^f = p(a^{k\_1})p^H(a^{k\_1} \to a^m)p^V(a^{k\_1} \to a^m) + p(a^m)p^H(a^m \to a^{k\_1})p^V(a^m \to a^{k\_1})\tag{30}$$

where *J* here stands for *joint*.

#### **6. Numerical Results and Simulations**

The comparison of the three strategies is reported in Figure 4. We see that the *V* strategy outperforms the *H* strategy for all the possible values of input photon, reaching almost a negligible error for approximately an order of magnitude less than the *H* strategy. The joint strategy realizes a further enhancement, even though the *p<sup>J</sup> <sup>e</sup>* approaches 0 with the same order of magnitude of *N*c as *<sup>p</sup><sup>V</sup> <sup>e</sup>* . We have also reported the solution for the inequalities (22) and (23) as a point along the corresponding line: for smaller value, the probabilities of error are not reliable as the contribution of the words with larger *k*(mod *m*) is not negligible. In addition, increasing the average number of dark counts slightly increases the probability of error for all the strategies considered, even though no significant effects are detected for the considered range of values of *N*dc.

In Figure 5, we show the number of counts at the *H* and *V* detectors from a simulated experiment. We can see a significant reduction of the fluctuations in the *V* detector, which is also marked by the significant difference in the probability of error *p<sup>H</sup> <sup>e</sup>* and *p<sup>V</sup> <sup>e</sup>* . The main reason is that the counts in the *V* detector are affected only by the randomness due to the dark counts (if present), while in the *H* detector the expected number of photons contributes to the randomness of the outcomes as well. We have also reported the results for words of length *k*(mod *m*) = 2, which are are significantly separated from *N<sup>x</sup>* <sup>c</sup> (*m*) and *N<sup>x</sup>* <sup>c</sup> (*k*1) as the value of *N*c considered is much larger than the threshold given in (22) and (23).

**Figure 4.** Probability of error for the different strategies as functions of the average number of input photon *N*c in a semi-log plot. Red line: *m* = 5; blue line: *m* = 11; green line *m* = 23. (**Top panels**): *H* (solid lines) and *V* (dashed lines) strategies in the absence of dark counts (**left**) and for *N*dc = 100 (**right**). (**Bottom panel**): joint strategy in the case *N*dc = 100. The dots on the lines refer to the threshold values evaluated according to (22) and (23). See the text for details.

**Figure 5.** Simulation of *N<sup>x</sup>* <sup>c</sup> (*k*) for the horizontal (**left**) and vertical (**right**) automata as a function of the experimental run number (*Rep*). Green dot: *k* = *m* = 11, i.e., *k*(mod *m*) = 0; red dot: *k* = 12, i.e., *k*(mod *m*) = 1; orange dot: *k* = 13, i.e., *k*(mod *m*) = 2; black dashed line: *N<sup>x</sup>* th. We considered *N*dc = 100 and *N*c = 500 (the same parameters of Figure 3). The probabilities of error given in Equations (25) and (29) are respectively *p<sup>V</sup> <sup>e</sup>* = 0.034 and *p<sup>H</sup> <sup>e</sup>* = 0.205. The minimum number of input *N*c for the *<sup>H</sup>* detector, solution of (22), is *N<sup>H</sup>* <sup>c</sup> *min* <sup>=</sup> 238, while for *<sup>V</sup>*, solution of (23), is *N<sup>V</sup>* <sup>c</sup> *min* <sup>=</sup> 151.

#### **7. Conclusions**

In this work, we have presented an enhanced photonic implementation of 1qfa for the recognition of unary language that significantly improves the performance obtained by the one originally proposed in [6]. The protocol uses the polarization degree of freedom of single photons, and exploits the possibility of detecting not only the horizontal polarization, as in [6], but also the vertical one. The resulting scheme largely outperforms the original automaton for smaller values of the mean number of sent photon *Nc*. In addition, we have extended the results previously found with a detailed analysis of the conditions for which such 1qfa can work with high reliability. We have evaluated the minimum number of photons that must be sent in order to solve faithfully the inherent binary discrimination

problem. As one would expect, the minimum *Nc* is smaller for the automaton that relies on the new strategy based on the *V* detector.

In our analysis, we have discussed the presence of dark counts in the detection of both strategies, and we have evaluated their effects both on the probability of error and on the minimum *Nc*. Eventually, we also examined a joint strategy in which we combine both the *H* and the *V* detection, which can indeed be used at no additional cost. We have therefore proved that when the number of sent photon is constrained to small values, the *V* detection version of the 1qfa should be preferred.

Our results pave the way to the effective implementation of 1qfa using quantum optical platform, thus opening the possibility of processing strings of input symbols using feasible devices and, in turn, to introduce quantum languages and compare the complexity of classes of languages in classical and quantum cases. More generally, as the assessment of the actual power of quantum computers is one of the most significant challenges of quantum technology, implementing quantum automata provides a relevant arena to better understand the computing capabilities offered by quantum devices.

**Author Contributions:** Conceptualization, A.C., C.M., B.P., S.C., M.G.A.P. and S.O.; Data curation, A.C., S.C. and S.O.; Investigation, A.C., C.M., B.P., S.C., M.G.A.P. and S.O.; Methodology, A.C., C.M., B.P., S.C., M.G.A.P. and S.O.; Supervision, S.O.; Writing—original draft, A.C., C.M., B.P., S.C., M.G.A.P. and S.O.; Writing—review and editing, A.C., C.M., B.P., S.C., M.G.A.P. and S.O. All authors have read and agreed to the published version of the manuscript.

**Funding:** This research received no external funding.

**Institutional Review Board Statement:** Not applicable.

**Informed Consent Statement:** Not applicable.

**Acknowledgments:** M. G. A. Paris is member of GNFM-INdAM. C. Mereghetti and B. Palano are members of GNCS-INdAM. We thank V. Vento for useful discussion.

**Conflicts of Interest:** The authors declare no conflicts of interest.

#### **Abbreviations**

The following abbreviations are used in this manuscript:


#### **References**


### *Article* **Conditional Measurements with Silicon Photomultipliers**

**Giovanni Chesi 1,†, Alessia Allevi 2,3,† and Maria Bondani 3,\*,†**


**Abstract:** Nonclassical states of light can be efficiently generated by performing conditional measurements. An experimental setup including Silicon Photomultipliers can currently be implemented for this purpose. However, these devices are affected by correlated noise, the optical cross talk in the first place. Here we explore the effects of cross talk on the conditional states by suitably expanding our existing model for conditional measurements with photon-number-resolving detectors. We assess the nonclassicality of the conditional states by evaluating the Fano factor and provide experimental evidence to support our results.

**Keywords:** conditional states; silicon photomultipliers; optical cross-talk; nonclassicality

#### **1. Introduction**

Given an entangled state, a conditional measurement, which is a scheme exploiting the reduction postulate [1], is a well-known option for the generation and manipulation of nonclassical and non-Gaussian states [2,3]. Remarkably, optical states have proven to be suitable for this task [3–8], especially in sight of Quantum Information protocols [9–11].

Here we focus on the detection of conditional states of light in the discrete-variable regime via photon-number-resolving (PNR) detectors. In particular, a novel class of PNR detectors, known as Silicon Photomultipiers (SiPMs), has recently experienced a remarkable technological improvement [12] and attracted attention for Quantum Optics applications [13–15]. Due to both their outstanding PNR capability and to their compactness and robustness, SiPMs may now be considered for discrete-variable Quantum-Information protocols [16]. Motivated by these points, we have recently tested a pair of SiPMs for the detection of nonclassical states of light [17,18]. Specifically, in [17] we generated a mesoscopic multi-mode twin-beam (TWB) state via type-I parametric down-conversion and post-selected one of the entangled beams by measuring the photon-number observable on the other one. We succeeded in assessing the nonclassicality of the detected conditional states.

However, as far as we know, the conditioning protocol via SiPMs on a TWB still lacks a full theoretical description. Indeed, the existing model of the effects of detection [3,4] does not include the influence of the major drawback of the SiPMs, i.e., the Optical Cross-Talk (OCT) [12,13,19,20]. The OCT is a process intrinsically connected to the very pixel structure of these devices. Being each pixel a single-photon avalanche diode, there is a chance that the avalanche triggered by a photon emits a secondary photon, which may fire a supplementary cell, resulting in a spurious count. Thus, the OCT influences the output statistics and may conceal the nonclassicality of the detected state.

Here we extend the model presented in [4] by including the effects of the OCT and provide a comparison with our experimental results. In Section 2 we define the positive

**Citation:** Chesi, G.; Allevi, A.; Bondani, M. Conditional Measurements with Silicon Photomultipliers. *Appl. Sci.* **2021**, *11*, 4579. https://doi.org/10.3390/ app11104579

Academic Editors: Robert W. Boyd and Jesús Liñares Beiras

Received: 7 April 2021 Accepted: 14 May 2021 Published: 17 May 2021

**Publisher's Note:** MDPI stays neutral with regard to jurisdictional claims in published maps and institutional affiliations.

**Copyright:** © 2021 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https:// creativecommons.org/licenses/by/ 4.0/).

operator-valued measure (POVM) describing photon counting affected by a limited quantum efficiency and by the OCT, and provide the tools needed for retrieving the statistics of the unconditioned and conditional states. Finally, we address the nonclassicality of the conditional states as sub-Poissonianity and recall the definition of the Fano factor.

In Section 3 we show our results. Firstly, we provide an analytic closed formula for the statistics of a multi-mode thermal state affected by the OCT. In a previous work of ours [21], we have already shown that in the single-mode case such a distribution is expressed in terms of the Fibonacci polynomials. In the present paper, we derive the distribution of the conditional state and consider the limit case of a TWB with an infinite number of modes. We also include the effect of the imbalance between the quantum efficiencies of the detectors. We show the effects of the OCT on the first moment of the statistics and, finally, we provide the Fano factor of the output conditioned distribution.

In Section 4 the theoretical predictions of the developed model are compared with the data from our experiment. In the same Section we also discuss how the OCT affects the light statistics and especially the consequences for the nonclassicality of the conditional states. In Section 5 we draw our conclusions and suggest further improvements to our model.

#### **2. Materials and Methods**

#### *2.1. Theoretical Description*

We provide here all the theoretical tools needed to describe post-selection measurements in the presence of the OCT. We start with the effects of the OCT on the statistics of a multi-mode TWB, then, we derive the expression of the resulting conditional state, and finally, we show how we estimate the nonclassicality of such a state in terms of sub-Poissonianity.

#### 2.1.1. Detected-Event Statistics of a TWB in the Presence of the OCT

A TWB is a multi-mode entangled state of light generated through a nonlinear process known as parametric down conversion [22], which is investigated in the specific context of the photon counting described in [23]. Under the assumption that the energy is equally distributed among the *μ* modes, a TWB state can be written as the tensor product of *μ* single-mode squeezed states [4,24], i.e.,

$$\hat{\Lambda} = \bigotimes\_{j=1}^{\mu} |\lambda\rangle\rangle\_{\hat{j}\hat{\jmath}} \langle\!\langle\lambda|\!\!\rangle \tag{1}$$

where

$$
\langle |\lambda\rangle \rangle = \sqrt{1 - \lambda^2} \sum\_{n} \lambda^n |n\rangle |n\rangle,\tag{2}
$$

being *n* the number of photons, and

$$
\lambda^2 \equiv \frac{N}{N+\mu} \tag{3}
$$

with *N* as the mean number of photons in each beam. The conditioning measurement is performed on one of the two parties of the TWB state, typically named as the idler, so that the corresponding state of the other beam, which is called the signa, is ideally reduced to the same outcome, accordingly with Born's rule [1].

In the absence of the OCT effects, the POVM describing a direct measure of the photon-number operator *n*ˆ over multi-mode radiation reads [4]

$$\hat{\Pi}\_{\mathfrak{m}}(\eta,\mu) = \bigotimes\_{j=1}^{\mu} \sum\_{l\_{j}} \delta\_{\mathfrak{m},\gamma} \hat{\Omega}\_{l\_{j}}(\eta) \tag{4}$$

where *<sup>m</sup>* is the number of detected photons and *<sup>γ</sup>* <sup>≡</sup> <sup>∑</sup>*<sup>μ</sup> <sup>j</sup>*=<sup>1</sup> *lj*, being *lj* the contribution of mode *j* to the number of detected photons. The detection is assumed to be affected by a limited quantum efficiency *η* and

$$
\hat{\Omega}\_l(\eta) = \left(\frac{\eta}{1-\eta}\right)^l \sum\_{n=l}^{\infty} \binom{n}{l} (1-\eta)^n |n\rangle\langle n| \tag{5}
$$

is the single-mode photon counting POVM.

The effect of the OCT is typically described [12–14,19] by the probability *ε* that an avalanche triggers another single spurious avalanche from a different cell. Assuming first-order OCT events, the number of fired spurious cells cannot be larger than the number of detected photons, which implies that, for the detected event *k* in the presence of the OCT, we have *m* ≤ *k* ≤ 2*m* ⇒ *k*/2 ≤ *m* ≤ *k*. Note that this assumption on the OCT model is quite strong. In principle, one should consider that a primary avalanche may be related to more than one OCT event [25–27]. Indeed, it may happen that more than one of the carriers in the primary avalanche triggers a secondary one, or that a secondary avalanche triggers a tertiary one as well, and the tertiary a quaternary and so on. However, here we develop a first-order OCT model since the class of SiPMs employed in the experiment is characterized by a very low cross-talk probability. Therefore, considering higher orders would be useless. Indeed, in a previous paper of ours [14] we have shown that the cross-talk probability associated to a cascade model can be assimilated to that limited to first order as long as a larger effective value of OCT is considered.

Given this picture, we generalize the POVM in Equation (4) as follows

$$\hat{\Pi}\_k(\eta, \mathfrak{e}, \mathfrak{\mu}) = \bigotimes\_{j=1}^{\mu} \sum\_{l\_j} \delta\_{k, \gamma} \hat{\Omega}\_{l\_j}(\eta, \mathfrak{e}) \tag{6}$$

with

$$\hat{\Omega}\_l(\eta, \varepsilon) = \left(\frac{\varepsilon}{1-\varepsilon}\right)^l \sum\_{t=\lceil l/2 \rceil}^l \binom{t}{l-t} \left(\frac{(1-\varepsilon)^2}{\varepsilon}\right)^t \left(\frac{\eta}{1-\eta}\right)^t \sum\_{n=t}^\infty \binom{n}{t} (1-\eta)^n |n\rangle\langle n| \tag{7}$$

where · is the ceiling function. It can be shown that the operator in Equation (6) is a POVM, i.e., <sup>Π</sup><sup>ˆ</sup> *<sup>k</sup>* <sup>≥</sup> 0 and <sup>∑</sup>*<sup>k</sup>* <sup>Π</sup><sup>ˆ</sup> *<sup>k</sup>* <sup>=</sup> <sup>ˆ</sup> I. Hence, one can derive the expression of the joint probability of *ks* detected events on the signal and *ki* on the idler as

$$\mathbf{P}(k\_s, k\_i) = \text{Tr}\_{s,i}[\hat{\Lambda}\hat{\Pi}\_{k\_s} \otimes \hat{\Pi}\_{k\_i}] \tag{8}$$

and the marginal distributions by summing P(*ks*, *ki*) over the corresponding variable. Note that the marginal detected-event distribution of a generic radiation field in the presence of the OCT is expressed as [14]

$$\mathbf{p}(k) = \left(\frac{\varepsilon}{1-\varepsilon}\right)^k \sum\_{m=\lceil k/2 \rceil}^k \binom{m}{k-m} \left(\frac{\eta(1-\varepsilon)^2}{\varepsilon(1-\eta)}\right)^m \sum\_{n=m}^\infty \binom{n}{m} (1-\eta)^n P\_n \tag{9}$$

where *Pn* is the photon-number distribution of the field. In Section 3 we will show the explicit form of p(*k*) for a TWB.

We remark that our model is based on experimentally accessible quantities since the only parameter connected with the pure photon statistics, which is *λ* in Equation (2), can be easily expressed as a function of experimental data and parameters via

$$
\lambda^2 = \frac{\langle \hat{k}\_i \rangle}{\langle \hat{k}\_i \rangle + \eta (1 + \varepsilon) \mu} \tag{10}
$$

where <sup>ˆ</sup> *ki* = (1 + *ε*)*ηN* is the mean value of detected events in the field including all the experimental effects.

#### 2.1.2. Detected-Event Statistics after Post-Selection

The measurement over the idler reduces the entangled counterpart, i.e., the signal, to the corresponding outcome. The expression of the conditional state can thus be retrieved from

$$\boldsymbol{\phi}\_{s}^{(k\_i)} = \frac{1}{\mathbf{p}(\mathbf{k}\_i)} \text{Tr}\_i[\hat{\boldsymbol{\Lambda}} \hat{\mathbb{I}}\_s \otimes \hat{\mathbb{I}} \mathbf{l}\_{k\_i}] \tag{11}$$

where p(*ki*) is the marginal distribution of detected events over the idler, according to Equation (9). Hence, the distribution of detected events for the conditional states follows as

$$\mathbf{p}^{(k\_i)}(k\_s) = \text{Tr}[\boldsymbol{\rho}\_s^{(k\_i)} \boldsymbol{\Pi}\_{k\_s}],\tag{12}$$

which can be read as the probability of detecting *ks* events in the signal arm as long as the conditioning value is *ki*. Given the distribution in Equation (12), the *n*-th moment comes straightforward from

$$
\langle \widehat{k\_s^\eta} \rangle^{(k\_i)} = \sum\_{k\_s} k\_s^\eta \mathbf{p}^{(k\_i)}(k\_s). \tag{13}
$$

#### 2.1.3. Nonclassicality

Sub-Poissonianity is a well-known sufficient condition for nonclassicality [28,29]. A direct and experimentally approachable estimator of sub-Poissonianity is the ratio between the variance and the mean value of the photon-number distribution, which is known as Fano factor [29]. In particular, in Section 3 we will evaluate the Fano factor for the number of detected events, i.e.,

$$\mathcal{F} \equiv \frac{\langle \Delta \hat{k}^2 \rangle}{\langle \hat{k} \rangle} \tag{14}$$

where Δ<sup>ˆ</sup> *<sup>k</sup>*2 <sup>=</sup> !*k*2−<sup>ˆ</sup> *<sup>k</sup>*<sup>2</sup> is the variance of the distribution. As already shown in Refs. [14,16], in the presence of an OCT probability *ε*, the mean value of the detected events can be written as <sup>ˆ</sup> *<sup>k</sup>* = (<sup>1</sup> <sup>+</sup> *<sup>ε</sup>*)*m*ˆ, while the variance reads as Δ<sup>ˆ</sup> *<sup>k</sup>*2 = (<sup>1</sup> <sup>+</sup> *<sup>ε</sup>*)2Δ*m*<sup>ˆ</sup> <sup>2</sup> <sup>+</sup> *<sup>ε</sup>*(<sup>1</sup> <sup>−</sup> *<sup>ε</sup>*)*m*ˆ. The nonclassicality condition is achieved if F < 1. Note that just the knowledge of the first and the second moments, provided by Equation (13), is required.

As a last remark, we point out a well-known effect of the OCT which will be crucial for our considerations on the nonclassicality: by inspecting the definition of OCT, one may infer that both the mean value and the variance of the light distribution are increased by the OCT. It can be shown that this is actually the case. However, one may also ask whether this enhancement is the same for variance and mean value, i.e., if the Fano factor remains unchanged under the effect of the OCT. The answer is no [14,16]: the OCT widens the variance with respect to the mean value and thus it heavily affects the statistics of light. This effect can be easily shown by retrieving the first and second moments of an OCT-affected distribution from Equation (9) and noting that

$$\frac{\langle \Delta \hat{k}^2 \rangle - \langle \hat{k} \rangle}{\langle \hat{k} \rangle} = (1 + \varepsilon) \left[ \frac{\langle \Delta \hat{m}^2 \rangle - \langle \hat{m} \rangle}{\langle \hat{m} \rangle} + \frac{2\varepsilon}{(1 + \varepsilon)^2} \right] \ge \frac{\langle \Delta \hat{m}^2 \rangle - \langle \hat{m} \rangle}{\langle \hat{m} \rangle} \quad \forall \varepsilon \ge 0. \tag{15}$$

#### *2.2. Experimental Setup and Detection Apparatus*

Here we provide a description of the experiment we performed and that we will discuss in Section 4 to test our theoretical predictions.

The setup used to produce conditional states is shown in Figure 1. The fundamental and the third harmonic of a Nd:YLF laser regeneratively amplified at 500 Hz are sent to a *β*-barium-borate nonlinear crystal (BBO1, cut angle = 37 deg, 8-mm long) to generate the fourth harmonic (262 nm, 3.5-ps pulse duration) by sum-frequency generation. This field is used to pump parametric down conversion in a second BBO crystal (BBO2, cut angle = 46.7 deg, 6-mm long) to produce TWB states in a slightly non-collinear interaction geometry. Two twin portions are spatially and spectrally selected by means of two irises and two band-pass filters centered at 523 nm. The selected light is then delivered to a pair of PNR detectors through two multi-mode fibers having a 600-μm core diameter. As to the detectors, we employed two commercial SiPMs (mod. MPPC S13360-1350CS) operated at room temperature with an overvoltage of 3V. According to the datasheet [30], in such conditions, the detectors are endowed with a quantum efficiency of 40% at 460 nm, a moderate dark-count rate (∼140 kHz), and a low cross-talk probability (∼2%). The output of each detector is amplified by a fast inverting amplifier embedded in a computer-based Caen SP5600 Power Supply and Amplification Unit, synchronously integrated by means of a boxcar gated integrator (SR250, Stanford Research Systems) and acquired. In order to reduce as much as possible the effect of SiPMs drawbacks, the light signal was integrated over a short integration gate width (10-ns long), which roughly corresponds to the width of the peak of the output trace of the detector. Thanks to this choice, the possible contributions of dark counts and afterpulses can be neglected.

**Figure 1.** Setup of the experiment described in [17] and addressed in Section 4 to provide experimental evidence to the model presented here. See the text for details.

A half-wave plate (HWP) followed by a polarizing cube beam splitter (PBS) is placed on the pump beam in order to modify its intensity and thus the mean number of photons of the generated TWB states. For each mean value, 100,000 single-shot acquisitions are performed.

#### **3. Results**

#### *3.1. The Effects of the OCT on the Photon-Number Statistics of the TWB*

Here we exploit the model developed in Section 2.1 to investigate the effects of the OCT on the detection of light and, in particular, on the statistics of a multi-mode mesoscopic TWB. The topic has been already widely investigated [13,14,16,17,19]. Still, we are anyway going through this point in order to test our model and use it to provide new insights on the OCT effects implied by this description.

From the inspection of Equation (8), we find that the joint probability of detecting *ki* events on the idler and *ks* on the signal is given by

$$\begin{split} P(k\_{\delta},k\_{i}) &= (1-\lambda^{2})^{\mu} \left(\frac{\varepsilon}{1-\varepsilon}\right)^{k\_{\ast}+k\_{i}} \sum\_{m\_{s}=\lceil \frac{k\_{\ast}}{2} \rceil}^{k\_{\ast}+k\_{i}} \sum\_{m\_{i}=\lceil \frac{k\_{\ast}}{2} \rceil}^{k\_{i}} \binom{m\_{s}}{k\_{s}-m\_{s}} \binom{m\_{i}}{k\_{i}-m\_{i}} \\ & \quad \left(\frac{(1-\varepsilon)^{2}}{\varepsilon} \frac{\eta}{1-\eta}\right)^{m\_{s}+m\_{i}} \sum\_{n=\max\{m\_{s},m\_{i}\}}^{\infty} \binom{n+\mu-1}{n} \binom{n}{m\_{s}} \binom{n}{m\_{i}} (\lambda(1-\eta))^{2n} \end{split} \tag{16}$$

which is the extension of the joint probability retrieved in [4], where just the effect of a limited quantum efficiency is considered.

If we consider the marginal distribution from Equation (16) for the idler beam, we find

$$\begin{split} \mathbf{P}(k\_{i}) &= \frac{(1-\lambda^{2})^{\mu}((1-\varepsilon)\eta\lambda^{2})^{k\_{i}}}{(1-\lambda^{2}(1-\eta))^{k\_{i}+\mu}} \sum\_{l=0}^{\lfloor\frac{k\_{i}}{2}\rfloor} \binom{k\_{i}+\mu-1-l}{\mu-1} \binom{k\_{i}-l}{l} \left(\frac{1-\lambda^{2}(1-\eta)}{(1-\varepsilon)^{2}\eta\lambda^{2}}\varepsilon\right)^{l} \\ &= \frac{(1-\lambda^{2})^{\mu}((1-\varepsilon)\eta\lambda^{2})^{k\_{i}}}{(1-\lambda^{2}(1-\eta))^{k\_{i}+\mu}} \binom{k\_{i}+\mu-1}{\mu-1} . \\ &\quad \,\_2\mathbf{F}\_{1}\left(-\frac{k\_{i}-1}{2}, -\frac{k\_{i}}{2}; -(k\_{i}+\mu-1); -4\varepsilon\frac{1-\lambda^{2}(1-\eta)}{(1-\varepsilon)^{2}\eta\lambda^{2}}\right) \end{split} \tag{17}$$

where · is the floor function and 2F1(*a*, *b*; *c*; *x*) is the ordinary hypergeometric function. It can be shown that Equation (17) can be obtained from Equation (9) as well by replacing *Pn* with the photon-number distribution of a multi-mode TWB state [6,24]. We also remark that, as we showed in [21], in the single-mode case (i.e., *μ* = 1) Equation (17) reduces to a linear combination of Fibonacci polynomials, which should be kept in mind for the considerations that follow.

As a first remark, we stress that our model for the OCT, as outlined in Section 2.1, accounts for first-order events only. In the following paragraph, we briefly explore the implications of our simplified model for arbitrary values of *ε*. Then we move back to the realistic case related to our experiment.

We show the transformation of the detected-photon number statistics of TWBs due to the OCT in Figure 2 for the single-mode case and in Figure 3 for the multi-mode one. In both figures, we set the quantum efficiency *η* = 0.17 and the mean photon number *N* = 10 (see Equation (2)), which are experimentally reasonable values as long as SiPMs are employed for detection (see Section 4) and the photon-number regime is mesoscopic (see Section 2). For what concerns the multi-mode case, we have considered the limit *μ* → ∞, since, again, this case is comparable with the number of modes estimated in our experiments, where *μ* ∼ 2000 [17]. As *μ* → ∞, the multi-thermal distribution of TWB converges to a Poissonian one, whereas the detected-event distribution in Equation (17) tends to

$$\mathbf{p}\_{\mu \rightarrow \infty}(k\_i) = \exp\left(-\frac{\langle \hat{k}\_i \rangle}{1+\varepsilon}\right) \sum\_{l=0}^{\lfloor \frac{k\_i}{2} \rfloor} \binom{k\_i - l}{l} \frac{1}{(k\_i - l)!} \left(\frac{\varepsilon}{1-\varepsilon}\right)^l \left(\frac{1-\varepsilon}{1+\varepsilon} \langle \hat{k}\_i \rangle\right)^{k\_i - l}.\tag{18}$$

Note that here we replaced the parameter *<sup>λ</sup>* with <sup>ˆ</sup> *ki* through Equation (10).

At a first glance to Figure 2, we note that the OCT gives rise to an asymmetry in the detected-event distribution: the detection probability of even events enhances proportionally to *ε* as the detection probability of odd events declines. Moreover, this effect is smoothed as the detected-event *ki* increases. A further inspection of our OCT model may help to understand why. Let *m* be the number of photons detected with probability *η*. As mentioned above, according to our OCT model, the outcome is a number *k* such that *m* ≤ *k* ≤ 2*m*. If *m* is odd, then *m*/2 of the possible values for *k* are odd and *m*/2 are even, but, if *m* is even, (*m* + 1)/2 of the possible values for *k* are even while still just *m*/2 are odd. This is basically due to the fact that 2*m*, the superior bound to *k*, is always even. However, as *m* increases, such a difference between even and odd detected-photon numbers becomes negligible compared to *k*. This effect is especially apparent if we look at Equation (17) in the single-mode case. As mentioned above, in such a situation the detected-event distribution reduces to a linear combination of Fibonacci polynomials. This family of polynomials can be defined as [31]

$$\mathcal{F}\_n(\mathbf{x}) \equiv \frac{1}{2^n} \frac{\left(\sqrt{\mathbf{x}^2 + 4} + \mathbf{x}\right)^n + (-1)^{n+1} \left(\sqrt{\mathbf{x}^2 + 4} - \mathbf{x}\right)^n}{\sqrt{\mathbf{x}^2 + 4}} \tag{19}$$

for given *<sup>n</sup>* <sup>∈</sup> <sup>N</sup>. The index of the polynomials in the single-mode detected-event distribution is *n* = *ki* + 1, so that we get larger contributions as *ki* is even and smaller otherwise.

**Figure 2.** Detected-event distribution of the idler beam from Equation (17) in the single-mode case (*μ* = 1) as a function of the number of detected events *ki* and of the OCT probability *ε*. We set the quantum efficiency *η* to 0.17, while the mean photon number *N* to 10. These choices, together with a selected value of *ε*, yield the corresponding mean value *ki* = (1 + *ε*)*ηN*. The plot shows the evolution of a single-thermal distribution due to the OCT.

**Figure 3.** Detected-event distribution of the idler beam from Equation (18) in the multi-mode limit case (*μ* → ∞) as a function of the number of detected events *ki* and of the OCT probability *ε*. We set the quantum efficiency *η* to 0.17, while the mean photon number *N* to 10. These choices, together with a selected value of *ε*, yield the corresponding mean value *ki* = (1 + *ε*)*ηN*. The plot shows the evolution of a Poissonian distribution due to the OCT.

In Figures 4 and 5 we emphasize the most obvious effect of the OCT on the statistics of detected photons, i.e., compared to the case where no OCT affects the measurement, the probability of detecting smaller numbers of events is depleted, while, on the contrary, the larger values of *k* are more likely to be revealed. An expected effect of the OCT which, rather than a consequence, is the very definition of it. Note that here we focus on experimental values of *ε*, which are typically small (*ε* < 0.1) due to the recent technological improvements mentioned above. The plots show the ratio between the difference Δp ≡ p(*ki*) − *p*<sup>0</sup> and *p*0, where *p*<sup>0</sup> ≡ p(*ki*)|*ε*=0. Again, we explore the single-mode case in

Figure 4, and the multi-mode limit case in Figure 5, having fixed every parameter as before. Note that the effect of the OCT in the two cases is the same, as the differences between the two plots have to be ascribed uniquely to the different distributions of pure photons, single-thermal in Figure 4 and Poissonian in Figure 5.

**Figure 4.** Plots of the relative differences Δp/*p*0, with Δp = p(*ki*) − *p*<sup>0</sup> and *p*<sup>0</sup> ≡ p(*ki*)|*ε*=0, in the single-mode case (*μ* = 1) as a function of the number of detected events *ki*, for different values of the OCT probability *ε*, which are *ε* = 1% (green), *ε* = 3% (red), *ε* = 5% (blue), *ε* = 7% (grey) and *ε* = 9% (violet). The quantum efficiency *η* and the mean photon number *N* are again set to 0.17 and 10, respectively.

**Figure 5.** Plots of the relative differences Δp/*p*0, with Δp = p(*ki*) − *p*<sup>0</sup> and *p*<sup>0</sup> ≡ p(*ki*)|*ε*=0, in the multi-mode limit case (*μ* → ∞) as a function of the number of detected events *ki*, for different values of the OCT probability *ε*, which are *ε* = 1% (green), *ε* = 3% (red), *ε* = 5% (blue), *ε* = 7% (grey) and *ε* = 9% (violet). The quantum efficiency *η* and the mean photon number *N* are again set to 0.17 and 10, respectively.

#### *3.2. The Effects of the OCT on the Photon-Number Statistics of the Conditional State*

Here we investigate the effects of the OCT on the statistics of the signal after conditioning over the idler, as described in Section 2.1. We also consider the effect of the imbalance between the quantum efficiencies of the signal and idler detectors.

Note that, while we remove the assumption that the detectors of the two parties share the same quantum efficiency *η* = *η<sup>s</sup>* = *ηi*, we keep assuming the same OCT probability *ε* = *ε<sup>s</sup>* = *εi*. The imbalance is introduced through the parameter *α* ≡ *ηs*/*ηi*, with *η* ≡ *ηi*.

The expression of the reduced state of the signal after measuring *ki* events over the idler is straightforward from Equation (11) and reads

$$\begin{split} \boldsymbol{\beta}\_{s}^{(k\_{i})} &= \frac{(1-\lambda^{2})^{\mu}}{\mathrm{P}(\mathbf{k}\_{i})} \left( \frac{\varepsilon}{1-\varepsilon} \right)^{k\_{i}} \sum\_{m\_{i}=\lfloor \frac{k\_{i}}{2} \rfloor}^{k\_{i}} \binom{m\_{i}}{k\_{i}-m\_{i}} \left( \frac{(1-\varepsilon)^{2}}{\varepsilon} \frac{\eta}{1-\eta} \right)^{m\_{i}} \\ &\overset{\mu}{\mathrm{Q}} \sum\_{j=1}^{\mu} \delta\_{m\_{i},\gamma} \sum\_{n\_{j}=l\_{j}}^{\infty} \binom{n\_{j}}{m\_{j}} \lambda^{2n\_{j}} (1-\eta)^{n\_{j}} |n\_{j}\rangle\langle n\_{j}| \end{split} \tag{20}$$

where again *<sup>γ</sup>* <sup>≡</sup> <sup>∑</sup>*<sup>μ</sup> <sup>j</sup>*=<sup>1</sup> *lj* and · is the ceiling function. Note that the conditional state correctly does not depend on *α* since no detection over the signal party has occurred yet.

On the contrary, the related detected-event distribution is a function of *α*, other than of the number of events detected over the idler *ki*:

$$\begin{split} \mathbf{p}^{(k\_{\ell})}(k\_{\ell}) &= \frac{(1-\lambda^{2})^{\mu}}{\mathbf{p}(k\_{\ell})} \Big( \frac{\varepsilon}{1-\varepsilon} \Bigg)^{k\_{\ell}+k\_{\kappa}} \sum\_{m\_{i}=\lceil \frac{k\_{\ell}}{2} \rceil}^{k\_{\ell}} \sum\_{m\_{\ell}=\lceil \frac{k\_{\ell}}{2} \rceil}^{k\_{\ell}} \binom{m\_{i}}{k\_{\ell}-m\_{i}} \binom{m\_{\ell}}{k\_{\ell}-m\_{\ell}} \Big( \frac{(1-\varepsilon)^{2}}{\varepsilon} \frac{\eta}{1-\eta} \Big)^{m\_{i}} \\ & \qquad \left( \frac{(1-\varepsilon)^{2}}{\varepsilon} \frac{a\eta}{1-a\eta} \right)^{m\_{\ell}} \sum\_{l=m\_{\ell}}^{\infty} \binom{l+\mu-1}{l} \binom{l}{m\_{\ell}} \binom{l}{m\_{l}} \lambda^{2l} (1-\eta)^{l} (1-a\eta)^{l}. \end{split} \tag{21}$$

In the limit of large number of modes, we find

$$\Pr\_{\mu \rightarrow \infty}(k\_s) = \frac{\exp\left(-\frac{\langle k\_i \rangle}{\eta(1+\varepsilon)}\right)}{\mathbf{p}\_{\mu \rightarrow \infty}(k\_i)} \left(\frac{\varepsilon}{1-\varepsilon}\right)^{k\_i+k\_s} \sum\_{\substack{m\_i = \lfloor \frac{k\_i}{2} \rfloor \ m\_s = \lceil \frac{k\_i}{2} \rfloor}}^{k\_i} \binom{m\_i}{k\_i - m\_i} \binom{m\_s}{k\_s - m\_s} \binom{m\_s}{k\_s - m\_s} \tag{22}$$
 
$$\left(\frac{(1-\varepsilon)^2}{\varepsilon} \frac{\eta}{1-\eta}\right)^{m\_i} \left(\frac{(1-\varepsilon)^2}{\varepsilon} \frac{a\eta}{1-a\eta}\right)^{m\_s} \sum\_{l=m\_s}^{\infty} \frac{1}{l!} \binom{l}{m\_s} \binom{l}{m\_i} \tag{22}$$
 
$$\left(\frac{\langle k\_i \rangle (1-\eta)(1-a\eta)}{\eta(1+\varepsilon)}\right)^l .$$

Given Equation (21), we can have access to every moment of the conditional-state distribution. For instance, the first moment reads

$$\langle \hat{k}\_{\varepsilon} \rangle^{(k\_i)} = \frac{a\eta (1 + \varepsilon)}{1 - \lambda^2 (1 - \eta)} \left[ k\_i + \mu \lambda^2 (1 - \eta) - \frac{\partial}{\partial x} \log \chi(x) \Big|\_{x = 0} \right] \tag{23}$$

where

$$\chi(\mathbf{x}) \equiv \sum\_{l=0}^{\lfloor \frac{k}{2} \rfloor} \binom{k\_l + \mu - 1 - l}{\mu - 1} \binom{k\_l - l}{l} \left( \frac{1 - \lambda^2 (1 - \eta)}{(1 - \varepsilon)^2 \eta \lambda^2} \varepsilon \right) \epsilon^{lx} \tag{24}$$

is a sort of characteristic function related to the discrete probability distribution in Equation (17). Indeed, one can easily prove that Equation (17) can be rewritten as

$$\mathbf{p}(\mathbf{k}) = \frac{(1 - \lambda^2)^{\mu} [(1 - \varepsilon)\eta\lambda^2]^{k\_i}}{[1 - \lambda^2(1 - \eta)]^{k\_i + \mu}} \chi(0). \tag{25}$$

The logarithmic derivatives of *χ*(*x*) evaluated in *x* = 0 contribute to the moments of the conditional state, as shown in Equation (23) for the mean value. If *ε* is set to 0 and *α* to 1 in Equation (23), we retrieve the result reported in [4] for the limited-quantum-efficiency condition, i.e.,

$$
\langle \hat{k}\_{\ast} \rangle^{(k\_i)}(\varepsilon = 0, \pi = 1) = \frac{k\_i(\langle \hat{k}\_i \rangle + \eta \mu) + \mu \langle \hat{k}\_i \rangle (1 - \eta)}{\langle \hat{k}\_i \rangle + \mu}. \tag{26}
$$

#### *3.3. The Effects of the OCT on the Nonclassicality of the Conditional State*

Finally, we focus on the nonclassicality of the state generated after post-selection and evaluate to what extent the OCT is detrimental for this quantum resource.

The first and the second moments of the conditional-state distribution allow us to retrieve the Fano factor for the detected events by means of Equation (14) expressed for the operator ˆ *ks*. As mentioned in Section 2.1, the Fano factor provides a sufficient condition for nonclassicality. For the distribution of the conditional state in Equation (21) we find that it reads

$$\begin{split} F\_{s}^{(k\_{l})} &= \frac{1+3\varepsilon}{1+\varepsilon} - a\eta (1+\varepsilon) + \frac{1}{\langle \hat{k}\_{s} \rangle^{(k\_{l})}} \left[ \frac{a\eta (1+\varepsilon)}{1-\lambda^{2}(1-\eta)} \right]^{2} \left[ \lambda^{2} (1-\eta)(k\_{l}+\mu) \right] - \\ & \frac{1}{\langle \hat{k}\_{s} \rangle^{(k\_{l})}} \left[ \frac{a\eta (1+\varepsilon)}{1-\lambda^{2}(1-\eta)} \right]^{2} \cdot \frac{\partial}{\partial x} \log \chi(x) \left[ \lambda^{2} (1-\eta) - \frac{\partial}{\partial x} \log \left( \frac{\partial}{\partial x} \log \chi(x) \right) \right] \bigg|\_{x=0} \end{split} \tag{27}$$

where *χ*(*x*) is defined in Equation (24). Again, we highlight that Equation (27) can be written as a function of experimental quantities by just replacing *λ* with *ki* through Equation (10). Since the expression is quite complex, in Figure 6 we show the behavior of <sup>F</sup>(*ki*) *<sup>s</sup>* as a function of the conditioning value *ki* for different choices of the other parameters: in panel (a), different mean values of the unconditioned state *ki*, in panel (b), different values of the balance parameter *α*, in panel (c), different choices of the cross-talk probability *ε*, and finally in panel (d), different number of modes of the unconditioned state *μ*. It is worth noting that the subPoissonianity of the Fano factor can be increased by decreasing the mean value of the unconditioned state and increasing the number of modes, and by operating on the features of the detectors, namely reducing the OCT probability and increasing the balance factor.

Again, if *ε* = 0 and *α* = 1, we retrieve the known expression of the Fano factor for the conditional state in the context of multi-mode TWB states and limited quantum efficiency, as outlined in [6], i.e.,

$$\mathbf{F}\_{s}^{(k\_{i})}(\varepsilon=0,\mu=1)=(1-\eta)\left[1+\frac{\langle\hat{k}\_{i}\rangle(k\_{i}+\mu)(\langle\hat{k}\_{i}\rangle+\eta\mu)}{(\langle\hat{k}\_{i}\rangle+\mu)[(k\_{i}+\mu)(\langle\hat{k}\_{i}\rangle+\eta\mu)-\eta\mu(\langle\hat{k}\_{i}\rangle+\mu)]}\right].\tag{28}$$

Note that Equation (27) can be significantly simplified by taking the limit to realistic values for the parameters *μ* and *ε*. As mentioned above, our experimental conditions allow us to take the limit *μ* → ∞, which reduces the sum in Equation (24) to

$$\chi(0) \sim \left( \langle k\_i \rangle \frac{1 - \varepsilon}{1 + \varepsilon} \right)^{k\_i} \sum\_{l=0}^{\lfloor \frac{k\_i}{2} \rfloor} \frac{1}{l!(k\_i - 2l)!} \left( \frac{\varepsilon(1 + \varepsilon)}{\langle \hat{k}\_i \rangle (1 - \varepsilon)^2} \right)^l,\tag{29}$$

but then, being the typical OCT probabilities of modern SiPMs of the order 10<sup>−</sup>2, the largest order in the argument of the sum for a given term *l* is

$$\frac{(\varepsilon \slash (\hat{k}\_i \slash))^l}{l!(k\_i - 2l)!}.\tag{30}$$

**Figure 6.** Fano factor of the conditional states as a function of the conditioning values for different choices of the other parameters involved in Equation (27). Panel (**a**): *F* for different choices of the mean value of the unconditioned state. From bottom to top: *k* = 0.5 (black), *k* = 1 (red), *k* = 1.5 (blue), *k* = 2 (green), *k* = 2.5 (magenta), *k* = 3 (cyan). The other parameters are: *η* = 0.17, *μ* = 100, *α* = 1, and *ε* = 0.01. Panel (**b**): *F* for different choices of the balance factor. From top to bottom: *α* = 0.5 (black), *α* = 0.6 (red), *α* = 0.7 (blue), *α* = 0.8 (green), *α* = 0.9 (magenta), *α* = 1 (cyan). The other parameters are: *η* = 0.17, *μ* = 100, *k* = 2, and *ε* = 0.01. Panel (**c**): *F* for different choices of the cross-talk probability. From bottom to top: *ε* = 0.01 (black), *ε* = 0.02 (red), *ε* = 0.05 (blue), *ε* = 0.10 (green), *ε* = 0.15 (magenta), *ε* = 0.20 (cyan). The other parameters are: *η* = 0.17, *μ* = 100, *k* = 2, and *α* = 1. Panel (**d**): *F* for different choices of the number of modes of the unconditioned state. From top to bottom: *μ* = 1 (black), *μ* = 2 (red), *μ* = 5 (blue), *μ* = 10 (green), *μ* = 100 (magenta), *μ* = 1000 (cyan). The other parameters are: *η* = 0.17, *k* = 2, *α* = 1, and *ε* = 0.01.

Thus, provided that the order of the mean number of detected events is larger than the order of *ε*, the argument of the sum gets smaller as *l* increases. If we keep the *l* = 0 term only, all the logarithmic derivatives of *χ*(*x*) are null, so that the mean value and the Fano factor of the conditional state are much simplified. By taking this limit, we neglect the OCT contribution provided by the asymmetry between odd and even detected events, which is reasonable if *ε* is small (i.e., *ε* < 0.1), as highlighted in Figures 4 and 5. Given this approximation and the limit for *μ*, one gets

$$\begin{split} \langle \hat{k}\_{\boldsymbol{s}} \rangle\_{\mu \rightarrow \infty}^{\langle k\_{\boldsymbol{i}} \rangle} &= a \left[ \eta \left( 1 + \varepsilon \right) k\_{\boldsymbol{i}} + \left( 1 - \eta \right) \langle \hat{k}\_{\boldsymbol{i}} \rangle \right] \\ \mathcal{F}\_{\boldsymbol{s}\_{\mu \rightarrow \infty}}^{\langle k\_{\boldsymbol{i}} \rangle} &= \frac{1 + 3 \varepsilon}{1 + \varepsilon} - a \eta \langle 1 + \varepsilon \rangle \left[ 1 - \frac{\left( 1 - \eta \right) \langle \hat{k}\_{\boldsymbol{i}} \rangle}{\eta \left( 1 + \varepsilon \right) k\_{\boldsymbol{i}} + \left( 1 - \eta \right) \langle \hat{k}\_{\boldsymbol{i}} \rangle} \right]. \end{split} \tag{31}$$

Equations (31) allow us to find the threshold conditioning value ¯ *k* such that the detected state is nonclassical, i.e., F(*ki*<¯ *<sup>k</sup>*) *<sup>s</sup>μ*→<sup>∞</sup> <sup>&</sup>lt; 1. Before retrieving ¯ *k*, we remark that in the limit *μ* → ∞, the Fano factor in Equation (28), where *ε* = 0 and *α* = 1, is a function of the quantum efficiency only, i.e.,

$$F\_{s\_{\mu \to \infty}}^{(k)}(\varepsilon = 0, \mathfrak{a} = 1) = \frac{1 - \eta}{1 - \eta/2}. \tag{32}$$

However, 0 <sup>≤</sup> <sup>F</sup>(*ki*) *<sup>s</sup>μ*→<sup>∞</sup> (*<sup>ε</sup>* <sup>=</sup> 0, *<sup>α</sup>* <sup>=</sup> <sup>1</sup>) <sup>≤</sup> <sup>1</sup> <sup>∀</sup>*<sup>η</sup>* <sup>∈</sup> [0, 1], which means that the imperfections in detection due to limited quantum efficiency never provide a detected superPoissonian statistics in this context. Only in the limit case *η* = 0 the nonclassicality of a conditional state from multi-mode TWB is not revealed by the Fano factor, otherwise the detected nonclassicality is just reduced with respect to the ideal case (*η* = 1). On the contrary, the OCT can completely conceal the quantum nature of a conditional state since we may have F(*ki*) *<sup>s</sup>μ*→<sup>∞</sup> <sup>&</sup>gt; 1 for some *ki* <sup>&</sup>lt; ¯ *k* where

$$\bar{k} = \frac{2\varepsilon (1 - \eta) \langle \hat{k}\_i \rangle}{\eta (1 + \varepsilon) [a\eta (1 + \varepsilon)^2 - 2\varepsilon]}. \tag{33}$$

Note that ¯ *<sup>k</sup>* <sup>&</sup>gt; <sup>0</sup> ⇐⇒ *αη*(<sup>1</sup> <sup>+</sup> *<sup>ε</sup>*)<sup>2</sup> <sup>&</sup>gt; <sup>2</sup>*ε*, i.e., if

$$
\eta\_s > \eta\_{th}(\varepsilon) \equiv \frac{2\varepsilon}{(1+\varepsilon)^2} \tag{34}
$$

where we replaced *αη* with the quantum efficiency of the detector of the signal party *η<sup>s</sup>* through the definition of *α*. Therefore, Equation (33) shows that for *ε* > 0 and *η* < 1 there is a conditioning number ¯ *k* > 0 such that if *ki* < ¯ *k* the detected statistics is superPoissonian (see Figure 6). Moreover, Equation (34) gives an experimental condition for the observation of the nonclassicality of the conditional state: provided that *η<sup>s</sup>* is larger than the threshold *ηth*, then a finite ¯ *<sup>k</sup>* exists such that one can measure F(*ki*) *<sup>s</sup>μ*→<sup>∞</sup> <sup>&</sup>lt; <sup>1</sup> <sup>∀</sup>*ki* <sup>&</sup>gt; ¯ *k*. Note that ¯ *k*(*ε* = 0, *η* = 0) = 0, which implies that the detected statistics is subPoissonian, if the only detection imperfection is a non-unit *η* > 0. However, it is remarkable that in the ideal case *η* = 1 we have a subPoissonian statistics independently of *ε*, while if *η* → 0 and *ε* = 0, then the detected statistics is always superPoissonian, independently of *ki*.

One may ask if a combination of *<sup>η</sup>* and *<sup>ε</sup>* exists such that F(*ki*) *<sup>s</sup>μ*→<sup>∞</sup> <sup>=</sup> 0 for some *ki*. Unfortunately, this is not the case since in the second line of Equations (31) the Fano factor is a monotone decreasing function of *ki* and it converges to an asymptotic value which is strictly positive ∀*ε* > 0. Finally, we remark that the threshold in Equation (34) is directly connected to the sub-Poissonianity of the original state, which in turn depends on its intrinsic nonclassical correlations. In fact the same threshold can be shown to hold for the observation of sub-shot-noise correlations of TWB. The sub-Poissonianity condition on correlations can be expressed by the noise reduction factor as *R* < 1, where *R* is defined as the ratio of the variance of the difference of detected events and the mean value of their sum, i.e.,

$$R \equiv \frac{\langle \Delta(\hat{k}\_s - \hat{k}\_i)^2 \rangle}{\langle \hat{k}\_s + \hat{k}\_i \rangle}. \tag{35}$$

We showed in Ref. [20] that, in the case of TWB states with a large number of modes, this figure of merit can be reduced to

$$R = 1 - a\eta (1 + \varepsilon) + \frac{2\varepsilon}{1 + \varepsilon'} \tag{36}$$

which gives *R* < 1 for the same condition as in Equation (34). Hence, the connection between the sub-Poissonianity condition and the requirement on the quantum efficiency in Equation (34) is straightforward. Incidentally, note that the Fano factor in the second of Equations (31) can be expressed in terms of the noise reduction factor.

#### **4. Discussion**

In order to validate the model for conditioning addressed in the previous Section, hereafter we present and discuss the experimental generation of nonclassical conditional states. As already explained in [6,17,18], such states can be obtained in post-processing by selecting a certain number of photons in one TWB arm and reconstructing the modified distribution of photons in the other arm. In Section 3 we showed that the unconditioned state is formally described by a multi-thermal distribution, which reduces to Equation (18) when the light in one arm is characterized by a very large number of modes [32–34] and is detected by a SiPM characterized by an OCT probability *ε* = 0. In Figure 7 we show the detected-event distributions having mean values *k* = 2.63 (panel (a)), 2.66 (panel (b)), 1.43 (panel (c)), and 0.57 (panel (d)). The experimental data are shown as gray dots, while the theoretical fitting functions according to Equation (18) are presented as gray lines. To quantify the agreement between the experimental data and the theoretical expectations we evaluate the fidelity *f* = ∑*m*¯ *m*=0 *P*th(*k*)*P*(*k*), in which *P*th(*k*) and *P*(*k*) are the theoretical and experimental distributions, respectively, and the sum extends up to the maximum number of detected events *k* above which both *P*th(*k*) and *P*(*k*) become negligible.

**Figure 7.** Detected-event distributions *P*(*k*) of the unconditioned state having mean value *k* = 2.63 (panel (**a**)), 2.66 (panel (**b**)), 1.43 (panel (**c**)), and 0.57 (panel (**d**)). The experimental data are shown as gray dots, while the theoretical expectations are presented as gray lines. The fidelity values are: *f* = 0.9999 in all panels.

From the fitting procedure, it is possible to obtain the value of the only fitting parameter, namely the OCT. In particular, we notice that for the four considered measurements, the OCT value is of the same order of magnitude and always less than 1%, thus proving that the cross-talk probability affecting this model of SiPM is really small, even if not completely negligible. We remark that the estimated values for the OCT probability in Figure 8 are smaller than those reported in the datasheet of our sensors [30], but consistent with the characterization that we have already provided for these SiPMs in [16].

In order to prove that the conditioning procedure changes the statistical properties of such states making them sub-Poissonian, we calculate the Fano factor of the conditional states obtained from each of the four considered unconditioned states. Indeed, as mentioned in Section 2.1, F < 1 is a sufficient condition for nonclassicality.

**Figure 8.** Fano factor as a function of the conditioning value for four different unconditioned states having mean values *k* = 2.63 (black), 2.66 (red), 1.43 (blue), and 0.57 (magenta). The experimental data are shown as dots plus error bars, while the theoretical fitting functions according to the second line of Equations (31) are presented as dashed curves with the same color choice. The fitting parameters are the following: *η* = 0.134, *α* = 0.990 (black curve), *η* = 0.157, *α* = 0.989 (red curve), *η* = 0.158, *α* = 0.997 (blue curve), and *η* = 0.125, *α* = 0.986 (magenta curve). The reduced *χ*(2) are: 0.34 (black curve), 0.14 (red curve), 0.94 (blue curve), and 0.05 (magenta curve).

In Figure 8 we show the experimental Fano factors shown as dots plus error bars, while the theoretical fitting functions according to the second line of Equations (31) are shown as dashed lines with the same color choice. For all the fitting functions we left *η* and *α* as free fitting parameters, while we used the same values of *ε* obtained from the fitting of the marginal distributions. In particular, in all cases we obtained a balance factor *α* ∼ 0.99 and a quantum efficiency *η* ∼ 0.14. As a general statement, we note that the data corresponding to the conditioning value *ki* = 1 are larger than 1 for the largest mean values. Such a behavior is in agreement with the theoretical expectation expressed by the second line of Equations (31) and the plots in panel (a) of Figure 6. Moreover, we emphasize that for the smallest mean value the conditioning operation is applied up to *ki* = 3 because the number of experimental data is not sufficient to reliably build the states corresponding to *ki* > 3.

In order to explore in which way the conditional measurements modify the statistical properties of the unconditioned states in the presence of the OCT, in the two panels of Figure 9 we show some conditional distributions at different conditioning values together with the corresponding unconditioned statistics having mean values *k* = 2.66 (panel (a)), and 1.43 (panel (b)). The data are presented as colored dots plus error bars (*ki* = 1 in black, *ki* = 2 in red, and *ki* = 3 in blue), while the theoretical expectations

are shown as solid lines with the same color choice. The theoretical curves have been calculated according to Equation (22) using the parameter values of *ε* obtained from the fit of the unconditioned states (see caption of Figure 7) and those of *η* and *α* obtained from the fit of the Fano (see caption of Figure 8). For the sake of clarity, in each panel of Figure 9 we show again the statistics of the unconditioned state as gray dots and the theoretical expectation as gray surface defined by dashed line. As expected from the two panels of the figure, it clearly appears that the conditional measurements change the statistics of the input state. Even in this case, to quantify the agreement between the experimental data and the theoretical expectations we evaluate the fidelity. We note that the higher the conditioning value the lower the fidelity value. This fact can be ascribed to the limited number of data at our disposal to build the statistics, which is lower and lower at increasing values of *ki*. Larger acquisitions of data could overcome such a limit. At the same time, the good dynamic range of SiPMs would suggest that both the unconditioned states and the corresponding conditional ones could be more populated, thus allowing us to really explore the mesoscopic intensity domain.

**Figure 9.** Detected-event distributions *P*(*k*) of the conditional states for *ki* = 1 (black curve), *ki* = 2 (red curve), and *ki* = 3 (blue curve) obtained from an unconditioned state having mean value *k* = 2.66 (panel (**a**)) and 1.43 (panel (**b**)). The experimental data are shown as colored symbols, while the theoretical expectations are presented as solid lines with the same color choice. The fidelity values are: *f* = 0.9999, 0.9961, and 0.9888 in panel (**a**) and *f* = 0.9999, 0.9954, and 0.9863 in panel (**b**). The unconditioned state is shown as gray dots and its theoretical expectation as gray surface defined by dashed line. The fidelity value is *f* = 0.9996 in panel (**a**) and *f* = 0.9999 in panel (**b**).

In general, the good agreement between the experimental data and the theoretical expectations validate the model used to describe the role played by the non-idealities of the employed detectors, namely the cross-talk effect, the non-unitary quantum efficiency and the possible imbalance between the two quantum efficiencies. We emphasize that the detection of subPoissonian states was achieved because, even in the presence of a limited quantum efficiency, the OCT probability is small enough to ensure that *η* > *ηth*. This is not the case of either previous sensors generations, in which the OCT probability was more than 10%, or new kinds of SiPMs with a higher sensitivity in the near infrared region. Indeed, the best generation of such detectors exhibits a cross talk probability of 6% and a low quantum efficiency (less than 20%), which could prevent the generation of nonclassical states by conditional measurements.

#### **5. Conclusions**

In this paper we addressed a thorough theoretical model for the conditional measurements with SiPMs. In particular, we included the contribution of the OCT and we took into account the possibility of an imbalance between the two detection chains. We provided a complete description of the detection of a multi-mode TWB state in the presence of the OCT, showing explicitly the effects of such correlated noise on the reconstructed distribution. We obtained a closed formula for the detected-event distribution of the conditional states and an analytic expression for the first moments. Hence, we retrieved the Fano factor, which represents a sufficient criterion for nonclassicality. In particular, we found that, in the presence of cross-talk effect, nonclassicality is more easily attained by:


Moreover, we found a useful bound between the quantum efficiency of the detectors and the OCT probability, which sets a link between their mutual values for still revealing the nonclassicality of conditional states. Actually, we demonstrated that this bound is valid in general for the twin-beam states, on which the conditioning operation is performed.

The theoretical expectations have been validated by the experimental generation of conditional states by conditional measurements performed on multi-mode TWB states with SiPMs. The good agreement between the experimental data and the theoretical predictions suggests that the conditional measurements can be performed even on more populated states to produce well-populated conditional states as well by exploiting the good dynamic range of SiPMs.

Finally, we hint that the model may be further improved by including the dark counts, which is another common drawback of SiPMs at room temperature. However, it is worth noting that in the case of a light signal integrated over short gate widths [17], which correspond to our experimental condition, the mean number of dark counts is remarkably low, which is the reason why we did not address this topic here. Moreover, it could be interesting to include cascade effects and generation of multiple secondary avalanches in the model for the OCT, so that a realistic case for large *ε* could be compared with the one explored here.

**Author Contributions:** G.C., A.A. and M.B. conceptualized the work, G.C. performed the theoretical calculations, G.C. and A.A. performed the measurements, A.A. and M.B. analysed and interpreted the data, G.C. and A.A. drafted the work, M.B. substantively revised it. All authors have read and agreed to the published version of the manuscript.

**Funding:** This research received no external funding.

**Institutional Review Board Statement:** Not applicable.

**Informed Consent Statement:** Not applicable.

**Data Availability Statement:** The datasets used and analysed during the current study are available from the corresponding author on reasonable request.

**Conflicts of Interest:** The authors declare no conflict of interest.

#### **Abbreviations**

The following abbreviations are used in this manuscript:


#### **References**


## *Article* **Experimental Quantum Message Authentication with Single Qubit Unitary Operation**

**Min-Sung Kang 1,2, Yong-Su Kim 1,3, Ji-Woong Choi 1,4, Hyung-Jin Yang <sup>4</sup> and Sang-Wook Han 1,3,\***


**Abstract:** We have developed a quantum message authentication protocol that provides authentication and integrity of an original message using single qubit unitary operations. Our protocol mainly consists of two parts: quantum encryption and a correspondence check. The quantum encryption part is implemented using linear combinations of wave plates, and the correspondence check is performed using Hong–Ou–Mandel interference. By analyzing the coincidence counts of the Hong–Ou–Mandel interference, we have successfully proven the proposed protocol experimentally, and also showed its robustness against an existential forgery.

**Keywords:** quantum message authentication; quantum three-pass protocol; Gao's forgery; swap test

#### **1. Introduction**

Modern cryptography provides four functions, namely, confidentiality, authentication, integrity, and nonrepudiation [1,2]. Therefore, as a substitution candidate for next-level secure cryptography, quantum cryptography should also have the ability to offer these four functions. Remarkable progress has been made in the area of confidentiality because the quantum key distribution (QKD) protocol that provides confidentiality has been considerably improved [3–6]. QKD aims to enable communication partners, e.g., Alice and Bob, to share secret keys and ultimately perform a one-time pad communication. Those protocols provide unconditional confidentiality based on the principle that an arbitrary unknown quantum state cannot be copied and that quantum measurement is irreversible [7–10]. On the other hand, many researchers have also studied how to use these secret keys in quantum message authentication [11–13], arbitrated quantum signature [14–19], or quantum digital signature [20–29], providing authentication, integrity, and non-repudiation.

In this paper, we introduce a simple and practical quantum message authentication protocol with a quantum three-pass protocol [30–33] and a quantum encryption scheme [19,34]. This protocol is a lightweight to simplify the implementation by removing an arbitrator from our proposed quantum signature protocol [19]. Here, the quantum three-pass protocol is the quantum version of Shamir's three-pass protocol [1,35], and quantum encryption scheme is to prevent existential forgery, called Gao's forgery. More specifically, the core elements of the proposed protocol, such as the quantum three-pass protocol and the quantum encryption scheme, are implemented with only single qubit unitary operators. In other words, these can be implemented easily by using linear combinations of wave plates [36,37]. Additionally, the swap test that checks the correspondence of the original message and quantum message authentication code (QMAC) can be implemented using a Hong–Ou–Mandel interferometer [38–40]. In advance, as the Hong-Ou-Mandel

**Citation:** Kang, M.-S.; Kim, Y.-S.; Choi, J.-W.; Yang, H.-J.; Han, S.-W. Experimental Quantum Message Authentication with Single Qubit Unitary Operation. *Appl. Sci.* **2021**, *11*, 2653. https://doi.org/10.3390/ app11062653

Academic Editors: Maria Bondani, Alessia Allevi and Stefano Olivares

Received: 28 February 2021 Accepted: 13 March 2021 Published: 16 March 2021

**Publisher's Note:** MDPI stays neutral with regard to jurisdictional claims in published maps and institutional affiliations.

**Copyright:** © 2021 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https:// creativecommons.org/licenses/by/ 4.0/).

interferometer is a destructive swap test [40], more resources are needed to implement a controlled swap test.

In Section 2, we briefly explain the concept of the proposed scheme. Section 3 presents a security analysis of the proposed protocol for Alice's private key, the forgery of QMAC pair, and the origin authentication of quantum message. Section 4 describes the experimental setup and measurement results. We conducted three experiments with the proposed protocol. First, we implemented a quantum three pass protocol, which is a method of conveying information in the proposed quantum message authentication. Second, we implemented a quantum encryption scheme with a single qubit unitary operator to prevent forgery. Finally, we confirmed that the QMAC pair with the quantum encryption scheme is robust to Gao's forgery. In Section 5, after a thorough discussion that includes the possibility of expanding the scheme to quantum signature and quantum entity authentication, we present the conclusions of this work.

#### **2. Quantum Message Authentication Protocol**

Quantum message authentication, which is similar to conventional message authentication, should provide message integrity and origin authentication. What differentiates quantum message authentication from conventional message authentication [41,42] is that the former uses quantum states | 0 and | 1 as a message represented by a sequence of "0" and "1" bits. In addition, using arbitrary quantum states as a message enables more information to be delivered at once [43,44]. Moreover, there is a significant difference that is described below. In modern cryptography, asymmetric key cryptography easily provides message integrity, message origin authentication, and nonrepudiation. Unfortunately, a quantum asymmetric key cryptosystem based on the quantum trapdoor one-way function do not exist, making the design of quantum authentication and quantum signature protocols difficult. To overcome this difficulty, we propose a new quantum message authentication protocol based on Shamir's three-pass protocol [1,35]. Shamir's three pass protocol has the advantage that two parties, e.g., Alice and Bob, can share information without exposing their own private keys. In the implementation, the central idea is that the commutative property [19] of exponential operation in Shamir's three-pass protocol is implemented using single-qubit rotation operators consisting of linear combinations of wave plates. To our knowledge, this is the first time a quantum message authentication protocol has been proposed using the quantum three-pass protocol, though other applications of the quantum three-pass protocol, such as direct communication [32], quantum key distribution [30], and quantum signature [19], have been proposed theoretically. Figure 1 schematically shows the quantum message authentication protocol that we implemented. Our quantum message authentication protocol consists of preparation, quantum message authentication, and verification phase.

#### *2.1. Preparation Phase*

In the preparation phase, Alice and Bob pre-share secret key sequences *KAB* <sup>=</sup> *k*1 *AB*, *<sup>k</sup>*<sup>2</sup> *AB*, ..., *<sup>k</sup><sup>N</sup> AB* and *KH* = *k*1 *<sup>H</sup>*, *<sup>k</sup>*<sup>2</sup> *<sup>H</sup>*, ..., *<sup>k</sup><sup>N</sup> H* that determine which single-qubit operation is chosen. The sequences *KAB* = *k*1 *AB*, *<sup>k</sup>*<sup>2</sup> *AB*, ..., *<sup>k</sup><sup>N</sup> AB* and *KH* = *k*1 *<sup>H</sup>*, *<sup>k</sup>*<sup>2</sup> *<sup>H</sup>*, ..., *<sup>k</sup><sup>N</sup> H* are a classical bit sequence with the size of 2*N* and *N* respectively, where *k<sup>i</sup> AB* ∈ {00, 01, 10, 11}, *ki <sup>H</sup>* <sup>∈</sup> {0, 1}. The secret keys *<sup>k</sup><sup>i</sup> AB* and *<sup>k</sup><sup>i</sup> <sup>H</sup>* correspond to the Pauli operators *σk<sup>i</sup> AB* ∈ ) *I*, *σx*, *σy*, *σ<sup>z</sup>* \* and the operator *Hk<sup>i</sup> <sup>H</sup>* <sup>∈</sup> ) *H*<sup>0</sup> = *I*, *H*<sup>1</sup> = *H*\* . Here, operator is a linear combination of the Pauli operators ) *I*, *σx*, *σy*, *σ<sup>z</sup>* \* and unitary operator *H*†*H* = *HH*† = *I*.

$$H = \left(I - i\sigma\_x - i\sigma\_y - i\sigma\_z\right)/2\tag{1}$$

**Figure 1.** Basic structure of the quantum message authentication protocol based on quantum three-pass protocol. Similar to quantum three-pass protocol, which transmits bits three times, our protocol performs three quantum state transmissions. After three attempts of quantum state transmission, Bob finally acquires quantum message states <sup>|</sup> *<sup>M</sup> <sup>u</sup>* <sup>=</sup> <sup>⊗</sup>*<sup>N</sup> <sup>i</sup>*=1*Ry*(*mi*)<sup>|</sup> *<sup>ϕ</sup><sup>i</sup> u* and | *M <sup>d</sup>* <sup>=</sup> <sup>⊗</sup>*<sup>N</sup> <sup>i</sup>*=1*Ry*(*mi*)<sup>|</sup> *<sup>ϕ</sup><sup>i</sup> <sup>d</sup>*. He then uses a swap test twice to confirm the similarity of the two arbitrary quantum states | *M <sup>u</sup>*, | *M <sup>d</sup>* and bit message sequence *M*. *KAB* and *KH* denote the secret key sequences that Alice and Bob previously shared. *S* is the private key sequence that only Alice knows, and *B* is the one known only to Bob.

#### *2.2. Quantum Message Authentication Phase*

The quantum message authentication phase is composed of two stages: quantum message generation, QMAC generation, and quantum encryption. In the quantum message generation stage, Alice generates a quantum message state pair

$$\left\langle \left| M \right\rangle\_{\boldsymbol{u}} \left| M \right\rangle\_{\boldsymbol{d}} = \left[ \left\langle \odot\_{i=1}^{N} R\_{\mathcal{Y}}(m\_{\bar{i}}) \right| \left\langle \boldsymbol{\varrho} \right\rangle\_{\boldsymbol{u}}^{(i)} \right] \left[ \left\langle \odot\_{i=1}^{N} R\_{\mathcal{Y}}(m\_{\bar{i}}) \right| \left\langle \boldsymbol{\varrho} \right\rangle\_{\boldsymbol{d}}^{(i)} \right] \tag{2}$$

by applying a single qubit rotation operator

$$R\_y(m\_i) = \begin{pmatrix} \cos\frac{m\_i}{2} & -\sin\frac{m\_i}{2} \\ \sin\frac{m\_i}{2} & \cos\frac{m\_i}{2} \end{pmatrix} \tag{3}$$

where *M* = (*m*1, *m*2, *m*3, ..., *mN*) is a rotation angle sequence, 0◦ ≤ *mi* ≤ 360◦, and <sup>|</sup> *<sup>ϕ</sup>*(*i*) *<sup>u</sup>* | *ϕ* (*i*) *<sup>d</sup>* are the logical states | 0| 0 or | 1| 1 , corresponding to horizontally polarized photons | *H*| *H* and vertically polarized photons |*V*|*V* , respectively. The superscript (*i*) denotes the *i* th qubit, and subscripts *u* and *d* denote up and down, corresponding to the up-line and down-line, respectively, of the experimental setup used for our protocol. The rotation angle sequence *M* = (*m*1, *m*2, *m*3, ..., *mN*) is a bit message sequence, and we assume that it has already been published in public as in the case of a contract or an official document. The reason for publishing *M* is to prevent Alice from attempting to forge using a modulated QMAC pair, which is discussed in detail in Section 3.2 impossibility of forgery.

In the QMAC generation stage, Alice encrypts the quantum message pair | *M <sup>u</sup>*| *M <sup>d</sup>* of Equation (2) by using a single qubit rotation operator *Ry*(*si*);

$$\left[\left|M\right\rangle\_{\mathfrak{u}}\left|S\right\rangle\_{\mathfrak{d}}=\left|M\right\rangle\_{\mathfrak{u}}\left[\left\\otimes\_{i=1}^{N}R\_{\mathfrak{y}}(\mathfrak{s}\_{i})\right|M\right\rangle\_{\mathfrak{d}}\right] = \left[\left\otimes\_{i=1}^{N}R\_{\mathfrak{y}}(m\_{i})\right|\mathfrak{q}\rangle\_{\mathfrak{u}}^{\left(i\right)}\right]\left[\left\otimes\_{i=1}^{N}R\_{\mathfrak{y}}(\mathfrak{s}\_{i})R\_{\mathfrak{y}}(m\_{i})\right|\mathfrak{q}\rangle\_{\mathfrak{d}}^{\left(i\right)}\right].\tag{4}$$

Here, *S* = (*s*1,*s*2, *s*3, ..., *sN*) is a rotation angle sequence, 0◦ ≤ *si* ≤ 360◦. In addition, *S* is a private key known only to Alice. Furthermore, we call | *M <sup>u</sup>*| *S <sup>d</sup>* to a QMAC state pair.

In the quantum encryption stage, Alice applies quantum encryption *σk<sup>i</sup> AB Hki <sup>H</sup>* to the QMAC state pair | *M <sup>u</sup>*| *S <sup>d</sup>* of Equation (4);

$$\left| \left| \mathcal{M} \right\rangle\_{\rm u} \left[ \left\| \mathbb{S}\_{i=1}^{N} \sigma\_{k\_{\mathcal{A}\mathcal{B}}^{i}} H^{k\_{H}^{i}} \right\| S \right\rangle\_{d} \right]. \tag{5}$$

Here, | *M <sup>u</sup>* ' ⊗*N <sup>i</sup>*=1*σk<sup>i</sup> AB Hki <sup>H</sup>* | *S <sup>d</sup>* ( is an encrypted QMAC state pair, and then she sends it to Bob. This quantum encryption is an essential function for verifying that the entity sending the QMAC pair is Alice and for protecting against forgery.

The rotation angles *mi* and *s*<sup>1</sup> are the elements of the finite discrete variable set. For applying them to real protocols, Alice and Bob must preset the range of the finite discrete variable set and pre-decide how to divide the set range. For example, if Alice and Bob split the rotation angle from 0◦ to 360◦ in intervals of 10◦, then the finite discrete variable set becomes {0◦, 10◦, 20◦, . . . , 350◦}. Here, the size of the discrete variable set is determined by the performance of the experimental apparatus. Therefore, as the performance of experimental apparatus improves, the size of the discrete variable set increases. Increasing the size of the discrete variable set means that the rotation angle can be subdivided, and this can lead to authenticating more information compared with using the four states of the BB84 protocol. On the other hand, If the performance of the experimental apparatus is poor, the size of the discrete variable set decreases. Then, the rotation angle cannot be subdivided, and information that can be authenticated decreases. Additionally, in this situation, if the communication members use the subdivided rotation angles to such an extent that the experimental apparatus cannot distinguish, detecting the malicious behavior of Eve is impossible.

#### *2.3. Verification Phase*

The verification phase is divided into five stages: "quantum decryption", "Bob's encryption", "QMAC recovery", "Bob's decryption", and "swap test". In Stage 1, for quantum decryption, Bob uses secret key sequences *KAB* and *KH*, which were pre-shared with Alice to decrypt the encrypted QMAC state pair | *M <sup>u</sup>* ' ⊗*N <sup>i</sup>*=1*σk<sup>i</sup> AB Hki <sup>H</sup>* | *S <sup>d</sup>* ( in Equation (5), received from Alice to obtain the QMAC state pair | *M <sup>u</sup>*| *S <sup>d</sup>* of Equation (4). In Stage 2, Bob's encryption, Bob generates his own private key sequence *B* = (*b*1, *b*2, ..., *bN*) and re-encrypts quantum state <sup>|</sup> *<sup>S</sup> <sup>d</sup>* <sup>=</sup> <sup>⊗</sup>*<sup>N</sup> <sup>i</sup>*=1*Ry*(*si*)| *M <sup>d</sup>* with it to obtain quantum state | *S <sup>d</sup>* <sup>=</sup> <sup>⊗</sup>*<sup>N</sup> <sup>i</sup>*=1*Ry*(*bi*)| *S <sup>d</sup>*. Then, he sends | *S <sup>d</sup>* to Alice while keeping the other quantum message state | *M <sup>u</sup>*. In Stage 3, QMAC recovery, Alice uses her own private key sequence *<sup>S</sup>* to apply rotation operator <sup>⊗</sup>*<sup>N</sup> <sup>i</sup>*=1*Ry*(−*si*) to quantum state | *S <sup>d</sup>* and sends quantum state <sup>|</sup>*<sup>S</sup> <sup>d</sup>* <sup>=</sup> <sup>⊗</sup>*<sup>N</sup> i*=1*Ry*(−*si*)|*S <sup>d</sup>* to Bob. In Stage 4, Bob's decryption, Bob uses his own private key sequence *<sup>B</sup>* and applies rotation operator <sup>⊗</sup>*<sup>N</sup> <sup>i</sup>*=1*Ry*(−*bi*) to quantum state |*S <sup>d</sup>* to obtain quantum message state | *M <sup>d</sup>* <sup>=</sup> <sup>⊗</sup>*<sup>N</sup> <sup>i</sup>*=1*Ry*(−*bi*)|*S <sup>d</sup>*. Because the proposed quantum message authentication based on the quantum three-pass protocol operates Alice's private key *si*, there is a need for a method to verify the encrypted QMAC pair described thus far. This is an important element that the proposed protocol can guarantee the origin of quantum message. In addition, to avoid counterfeiting, it is assumed that quantum encryption such as *σk<sup>i</sup> AB Hki <sup>H</sup>* in Equation (5) is applied to Alice and Bob in every process of exchanging quantum states.

In the final stage, Bob performs the swap test [42,45] twice to verify the QMAC state pair. In the first swap test, Bob verifies whether quantum message state | *M <sup>u</sup>* and quantum message state | *M <sup>d</sup>* are the same. If the test result reveals that | *M <sup>u</sup>* and | *M <sup>d</sup>* agree, Bob accepts QMAC state pair | *M <sup>u</sup>*| *S <sup>d</sup>* sent by Alice. Otherwise, he does not accept it. In the second swap test, Bob generates quantum state |*M* corresponding to the public bit message sequence *M* and verifies that it matches quantum message state | *M <sup>u</sup>* or | *M d*. If the test result reveals that (|*M*, | *M <sup>u</sup>*) or (|*M*, | *M <sup>d</sup>*) agree, then the integrity of QMAC state pair | *M <sup>u</sup>*| *S <sup>d</sup>* is verified completely. For the second swap test, it is noted that the first swap test requires a non-demolition swap test. Figure 2 shows the swap test in the circuit, and the result of inputting

$$\left| \left| m\_{i} \right\rangle\_{\mathfrak{u}} = \mathcal{R}\_{\mathcal{Y}}(m\_{i}) \left| \left| \mathfrak{q} \right\rangle\_{\mathfrak{u}}^{\left( \bar{i} \right)} \right. \tag{6}$$

and

& &*m i <sup>d</sup>* = *Ry m i* | *ϕ* (*i*) *<sup>d</sup>* (7)

in the second and third lines of the circuit is expressed as follows:

$$\frac{1}{\sqrt{2}}\left|0\right\rangle\_{\text{ancill}}\left[\frac{1}{\sqrt{2}}\left(\left|m\_{i}\right\rangle\_{\text{u}}\left|m\_{i}^{\prime}\right\rangle\_{\text{d}}+\left|m\_{i}^{\prime}\right\rangle\_{\text{u}}\left|m\_{i}\right\rangle\_{\text{d}}\right)\right]+\frac{1}{\sqrt{2}}\left|1\right\rangle\_{\text{ancill}}\left[\frac{1}{\sqrt{2}}\left(\left|m\_{i}\right\rangle\_{\text{u}}\left|m\_{i}^{\prime}\right\rangle\_{\text{d}}-\left|m\_{i}^{\prime}\right\rangle\_{\text{d}}\left|m\_{i}\right\rangle\_{\text{d}}\right)\right].\tag{8}$$

**Figure 2.** Circuit of the quantum swap test. "SWAP" indicates a swap gate, and *UH* represents a Hadamard gate. "MS" represents quantum measurement, and the single lines and the double line represent the quantum channel and classical channel, respectively.

If <sup>|</sup>*mi <sup>u</sup>* and & &*m i <sup>d</sup>* agree, the above equation becomes <sup>|</sup> <sup>0</sup> *ancilla*<sup>+</sup> √1 2 |*mi <sup>u</sup>* & &*m i d*+ & &*m i <sup>u</sup>*|*mi <sup>d</sup>* ,, which makes the measurement outcome of the ancilla state to always be <sup>|</sup> <sup>0</sup>. However, if <sup>|</sup>*mi <sup>u</sup>* and & &*m i <sup>d</sup>* do not agree, the measurement outcome becomes | 0 with a probability 1 + *ε*<sup>2</sup> /2 or becomes <sup>|</sup> <sup>1</sup> with a probability 1 + *ε*<sup>2</sup> /2, where *ε* = & & *d* . *m i* & &*mi u*| and 0 ≤ *ε* ≤ 1. Therefore, if the swap test result of the measurement is | 1, we know that <sup>|</sup>*mi <sup>u</sup>* and & &*m i <sup>d</sup>* are different. If the result is | 1, we cannot guarantee that |*mi <sup>u</sup>* and & &*m i <sup>d</sup>* are the same. The parameter *ε* is determined by the arbitrary quantum state components <sup>|</sup>*mi <sup>u</sup>* of Equation (6) and & &*m i <sup>d</sup>* of Equation (7). If the two rotation angles *mi* and *m <sup>i</sup>* are the same, i.e., *mi* = *m i* , then the value of parameter *ε* is 1. On the other hand, if the difference between *mi* and *m <sup>i</sup>* is 180◦, i.e., *mi* = *m <sup>i</sup>* ± 180◦, then the parameter *ε* is 0. As a result, according to rotation angles *mi* and *m i* , the parameter *ε* has a value between 0 and 1, 0 ≤ *ε* ≤ 1. Further, the probability of failure in the verification phase is the total error probability *Pe* for *N* qubits as follows:

$$P\_{\mathcal{E}} \le \otimes\_{i=1}^{N} \left[ \left( 1 + \left| \left< m\_i' \middle| m\_i \right>\_{\mathcal{U}} \right|^2 \right) / 2 \right] \tag{9}$$

Therefore, it is expected that the swap test will work well even though the quantum state sequence is finite. Hence, the probability of failure in the verification phase becomes lower, approaching *Pe* as the size of the quantum state sequence *N* becomes considerably larger [42,45]. For an arbitrary <sup>|</sup>*mi <sup>u</sup>*, a random choice for & &*m i <sup>d</sup>* on the *Ry m i* —rotation circle, the average of *ε*<sup>2</sup> is 1/2. In this case, the upper bound of the total error probability *Pe* is (3/4) *<sup>N</sup>*. If the size of the quantum state sequence is 15, then the upper bound of the total error probability *Pe* is only approximately 1.3%. Therefore, it is expected that the swap test will work well even though the quantum state sequence is finite.

#### **3. Security Analysis**

#### *3.1. Security of Alice's Private Key*

Eve, including Bob, may try to obtain Alice's private key. Especially, as described in Section 2.3, malicious Bob may try to know Alice's private key sequence *S* = (*s*1,*s*2, *s*3, ..., *sN*), which consists of the degrees of rotation about *<sup>y</sup>*ˆ-axis from <sup>|</sup> *<sup>S</sup> <sup>d</sup>* <sup>=</sup> <sup>⊗</sup>*<sup>N</sup> <sup>i</sup>*=1*Ry*(*si*)| *M <sup>d</sup>* in Equation (4). However, the security of Alice's private key sequence *S* is guaranteed by Holevo's theorem, as follows [19,32]:

$$I(\mathbf{x}, \mathbf{S}) \le V(\boldsymbol{\rho}) \le H(\mathbf{S}) \tag{10}$$

Here, *H*(*S*) is the Shannon entropy of the sequence of arbitrary rotation angle *si*, *V*(*ρ*) is the von Neumann entropy of mixed state *ρ* that Eve can acquire through the arbitrary measurement of the quantum state <sup>|</sup> *<sup>S</sup> <sup>d</sup>* <sup>=</sup> <sup>⊗</sup>*<sup>N</sup> <sup>i</sup>*=1*Ry*(*si*)| *M <sup>d</sup>*, and *I*(*x*, *S*) is the mutual information between arbitrary rotation *si* and measurement outcomes *x*. As we can see in Equation (10), the amount of mutual information about the arbitrary rotation angle sequence *S* that Bob acquires using measurement outcomes *x* is limited, and thus, it is impossible for Eve to obtain the information of *S*. Based on the same principle, the security of Bob's private key sequence *B* = (*b*1, *b*2, *b*3, ..., *bN*) is guaranteed.

#### *3.2. Impossibility of Forgery*

Many quantum message authentication and signature protocols use quantum encryption implemented by Pauli operators to ensure message integrity and message origin authentication. A QMAC pair (or quantum signature pair), which is composed of a quantum message and an encrypted quantum message, checks the forgery and modulation of the QMAC pair (or quantum signature pair) using a swap test [34]. As described in Section 2.3, Bob validates the original quantum message state | *M <sup>u</sup>* and the recovered quantum message state | *M <sup>d</sup>* from the QMAC state pair of Equation (4) using the swap test. Bob can be sure that | *M <sup>u</sup>* and | *M <sup>d</sup>* are the same quantum state from the outcomes of the swap test. However, it is not known whether they match the original message *M*. Because of the limitations of this swap test, the proposed protocol can be falsified in two ways.

The first falsification method is that Alice creates a modulated QMAC pair

$$I(\mathbf{x}, \mathbf{S}) \le V(\boldsymbol{\rho}) \le H(\mathbf{S}) \tag{11}$$

with the two same quantum states & & & *M*/ 0 *<sup>u</sup>* and & & & *M* 1 0 *d* that do not correspond to the original message *M* and sends it to Bob. In this case, Bob cannot detect Alice's malicious behaviour even if he verifies that the two quantum states & & & *M*/ 0 *<sup>u</sup>* and & & & *M* 1 0 *d* are the same from the QMAC pair by using the swap test. To prevent this, Alice must disclose message *M*. Additionally, Bob needs an additional process to validate | *M*, which is converted to a quantum state, and | *M <sup>u</sup>* or | *M <sup>d</sup>* by using the swap test.

Second, Eve can try Gao's forgery to apply Pauli operators to a QMAC pair [34,46]. Recently, Gao et al. showed that even if an adversary applies the arbitrary Pauli operator to the QMAC pair (or quantum signature pair), the swap test could not detect it because of the commutation relation of Pauli operators [46]. This is called Gao's forgery, and it can be considered as an existential forgery [34] of modern cryptosystems because it randomly forges QMAC pairs (or quantum signature pairs), which are arbitrary quantum states. The posing of this security problem by Gao et al. was a major turning point in the study of quantum message authentication (or quantum signature) protocols. In 2011, Choi et al. proposed the (I, H)- or (U, V)-type quantum encryption scheme to cope with Gao's forgery [47,48]. In 2013, Zhang et al. pointed out that the encryption scheme of Choi et al. was still insecure against Gao's forgery, and instead they proposed the keycontrolled-"I" quantum one-time pad or key-controlled-"T" quantum one-time pad [49,50] as an alternative. The four unitary operators of the controlled-I quantum one-time pad

are *W*<sup>00</sup> = (*σ<sup>x</sup>* + *σz*)/ <sup>√</sup>2, *<sup>W</sup>*<sup>01</sup> <sup>=</sup> *σ<sup>y</sup>* + *σ<sup>z</sup>* / <sup>√</sup>2, *<sup>W</sup>*<sup>10</sup> <sup>=</sup> *I* + *iσ<sup>x</sup>* − *iσ<sup>y</sup>* + *iσ<sup>z</sup>* / <sup>√</sup>2, and *W*<sup>10</sup> = *I* + *iσ<sup>x</sup>* + *iσ<sup>y</sup>* + *iσ<sup>z</sup>* / <sup>√</sup>2. However, the encryption scheme of Zhang et al. is not easy to implement with simple hardware. In contrast, we propose a quantum encryption scheme with a single qubit unitary operation by randomly using unitary operator *H*, which can be easily implemented by controlling wave plates and an authentication protocol. Therefore, the proposed protocol is robust against an existential forgery. Section 4.3 in Ref. [22] shows that unitary operators can be used randomly to prevent Gao's forgery. The detailed implementation of our experimental setup and the testing results of the quantum three-pass protocol and security against Gao's forgery are described in Section 4. Finally, to prevent Gao's forgery in the proposed protocol, the quantum encryption scheme should be applied to all processes in which Alice and Bob exchange quantum states.

#### *3.3. Origin Authentication of Quantum Message*

To clarify the origin of the quantum message, the proposed quantum message authentication operates by using not only the secret key pre-shared by Alice and Bob but also Alice's private key. In general, message authentication guarantees the origin of message authentication by using a secret key previously shared by Alice and Bob. At this time, as the user who can create a message authentication code (MAC) pair can be Alice or Bob, the origin of the message may become unclear. On the other hand, in the proposed protocol, Alice generates a QMAC pair | *M <sup>u</sup>*| *S <sup>d</sup>* of Equation (4) by using a private key sequence *S* = (*s*1,*s*2, *s*3, ..., *sN*) known only to her; thus, the possibility of such a dispute is very low.

#### **4. Experiment Setup and Measurement Results**

Figure 3a shows the implementation setup of our proposed quantum message authentication protocol. With this setup, we have experimentally proved that the proposed QMAC is robust against existential forgery. Each stage is implemented with a linear combination of wave plates; that is, the *y*-axis rotation operator *Ry*(*θ*), the unitary operator *H*, and the Pauli operators are implemented by combinations of half-wave plates (HWPs) and quarter-wave plates (QWPs). Figure 3b schematically shows a possible forgery attack that Eve can try. Eve can attempt a forgery attack using the same Pauli operators *σei* = *σe i* [46], or she can attempt a forgery attack using different Pauli operators *σei* = *σe <sup>i</sup>* [49,50]. We define these two approaches as an original and improved Gao's Forgeries, respectively. To prevent Gao's forgeries, we need to choose unitary operator *H* randomly. We explain this in detail at the end of this section.

We assume that Alice and Bob have already pre-shared the secret key sequences in the preparation phase. For the message authentication phase, we implemented message generation, QMAC generation, and quantum encryption using wave plates on Alice's side. To create correlated photon pairs, Type-I spontaneous parametric down-conversion (SPDC) photon pairs were generated in a beta barium borate (BBO) crystal pumped by a multimode diode laser with a 408-nm wavelength. The SPDC photon pairs have the same H-polarization and an 816-nm wavelength. The photon pairs are emitted with a noncollinear angle of 3.3◦. One of the photons goes through only the rotation operator for message generation, and the other experiences the sequence of operations from message generation through the quantum encryption scheme with a single qubit unitary operator. Then, they are delivered to Bob. For the verification phase, one photon is kept on Bob's side, and the other photon experiences quantum decryption and Bob's encryption implemented by the wave plate, after which Bob sends it to Alice. Alice then decrypts it by using QMAC recovery. In our experiment, we installed the QMAC recovery stage between Bob's encryption and Bob's decryption for convenience of implementation; it is marked by yellow shading in Figure 3a. Finally, after Bob's decryption, the swap test that verifies the agreement of the two photon sequences is performed using the Hong– Ou–Mandel interferometer. The Hong–Ou–Mandel dip confirms the similarity between

the two photons, which is the last step of the implementation of the proposed quantum message authentication protocol.

**Figure 3.** Schematic representation of the experimental setup for the quantum message authentication protocol and an existential forgery. (**a**) Quantum message authentication protocol: the blue box represents Alice's operation, and the green box represents Bob's operation. *mi* is the rotation angle that indicates message. *k<sup>i</sup> AB*, *<sup>k</sup><sup>i</sup> <sup>H</sup>*, *si*, and *bi* are the same as in Figure 1. (**b**) Existential forgery: Eve can attempt forgery on the quantum message authentication code (QMAC) state pair using Pauli operators when Alice transmits the encrypted QMAC state pair to Bob.

In other words, the realization of the quantum three-pass protocol, quantum encryption scheme, and the robustness of Gao's forgery can be confirmed by the Hong–Ou– Mandel Dip. Hong–Ou–Mandel interference is the same as the destructive swap test [40]. Because the destructive swap test does not have an ancilla qubit unlike the controlled swap test, the two quantum states that are compared are directly measured and collapsed. For this reason, we performed only the first swap test in the two swap tests shown in Figure 1. To implement the second swap test in Figure 1 using Hong–Ou–Mandel interference, there is a need for more resources (e.g., single photons and wave plates) than the current experimental setup. There are other ways to implement a second swap test by using an experimental controlled swap gate that was recently implemented [51].

We tested the feasibility of our protocol with the experimental setup for the case without Gao's forgery. First, we verified that the quantum three-pass protocol (Figure 3) was working correctly. As shown in Figure 4a, when the half-wave plate H1s angle *si*/4 is <sup>−</sup>120◦ , the coincidence count reaches its minimum at the half-wave plate H3s angles <sup>−</sup>*si*/4 <sup>=</sup> <sup>30</sup>◦ , 120◦ as expected. This indicates that Alice generates the QMAC state by applying rotation operator *Ry* −120◦ and then uses rotation operator *Ry* −120◦ <sup>±</sup> *<sup>π</sup>n*/2 to recover the QMAC state, where *n* is an integer, because the period of the half-wave plate is *π*/2. The red plots represent the averages of the coincidence counts over one second. In Figure 4b, we recognize that Bob's encryption and decryption also work well. When the half-wave plate H2s angle *bi*/4 is <sup>−</sup>60◦ , the Hong–Ou–Mandel dip occurs at the half-wave plate H4s angles <sup>−</sup>*bi*/4 <sup>=</sup> <sup>60</sup>◦ , 150◦ . Bob uses rotation operator *Ry* −60◦ to re-encrypt the QMAC state, and then he decrypts the re-encrypted QMAC state by applying rotation

operator *Ry* 60◦ <sup>±</sup> *<sup>π</sup>n*/2 , where *n* is an integer. In Figure 4, the experimental data are the average of 10 measurements per 10 s.

**Figure 4.** Coincidence counts of the quantum three-pass protocol. The red plots indicate the average of the coincidence counts for one second. The red bars indicate the standard deviation of the coincidence counts for each point. The blue solid line indicates the sine curve fitted to the data. (**a**) Test for QMAC generation and recovery. (**b**) Test for Bob's encryption and decryption.

During this time, the averages of single counts were 27, 000 and 27, 000, respectively, and coincidence windows are 5 ns; the maximum value of the coincidence counts after accidental coincidences were removed was 127, and the minimum value was 2.

Second, we tested the quantum encryption and decryption. If Alice and Bob are proper users who previously shared secret key sequences *KAB* and *KH* then the quantum message states | *M <sup>u</sup>* and | *M <sup>d</sup>* should be identical. Bob can check the correspondence of these states using the Hong–Ou–Mandel interferometer [38,39]. Figure 4 shows the experimental results for Alice's quantum encryption and Bob's quantum decryption. *Pc* is the coincidence probability of Hong–Ou–Mandel interference, and *Pc* = 1 − *Pc* represents the probability of two quantum message states matching. Figure 5a,b represents whether operator *H* exists or not, respectively. Although theoretically, the red blocks on the diagonal in both cases should be 100%, experimentally they are greater than 82% and 76%, respectively. On the other hand, the blue blocks off the diagonal, when Alice and Bob share different secret keys *k<sup>i</sup> AB* and *<sup>k</sup><sup>i</sup> <sup>H</sup>*, | *M <sup>u</sup>* and | *M <sup>d</sup>* have different quantum states, and the respective probabilities are less than 41% and less than 46%. Considering that theoretically *Pc* can only have less than 50%, the measurement results prove that our scheme works well. From these results, we can conclude that the encryption operates properly because *Pc* is greater than 76% in the case of the same operators and *Pc* is less than 46% in the case of different operators regardless of the existence of operator *H*. The above theoretical values are derived from the success probability <sup>2</sup> = & & *d* . *ψ i* & &*ψi u* & &<sup>2</sup> of the swap test, with <sup>|</sup>*ψi <sup>u</sup>* <sup>=</sup> *UiRy*(*mi*)<sup>|</sup> <sup>0</sup>(*i*) *u* , & &*ψ i <sup>d</sup>* = *U <sup>i</sup>Ry*(*mi*)| 0 (*i*) *<sup>d</sup>* , *Ui*, *U <sup>i</sup>* <sup>∈</sup> ) *I*, *σx*, *σy*, *σz*, *H*, *σxH*, *σyH*, *σzH*\* , and *mi* = 135◦ . Errors in the experiment shown in Figure 5 could be due to an inherent error of the swap test, birefringence in the beam splitter, and/or systematic errors in the wave-plate setting [38,39,42,45].

From the measurement results given in Figures 4 and 5, we have demonstrated that our implementation succeeds in realizing the proposed protocol. Although there are some errors due to unavoidable imperfections of the realization, our practical implementation still performs message integrity and message origin authentication successfully only if our protocol is applied to multiple bits sequentially and analyzed statistically.

**Figure 5.** *Pc* is the coincidence probability of the quantum encryption scheme with a single qubit unitary operator for quantum message authentication. *Pc* = 1 − *Pc* represents the probability of two quantum message states being matched. In (**a**), *Pc* corresponds to the quantum encryption scheme with a single qubit unitary operator that Alice and Bob can select when secret key *k<sup>i</sup> <sup>H</sup>* of Alice and Bob is zero. In (**b**), *Pc* corresponds to every type of quantum encryption with single qubit unitary operator that Alice and Bob can select when secret key *k<sup>i</sup> <sup>H</sup>* of Alice and Bob is one. In this experiment, message *mi* was set to 135◦ .

Gao et al. demonstrated the possibility of existential forgery in the case of quantum message authentication that includes a swap test [34,46,48]. In other words, if the QMAC state pair that Alice generates is not encrypted, Alice cannot detect Eve's intervention. In the quantum encryption *σk<sup>i</sup> AB Hki <sup>H</sup>* in Equation (5), the secret key *k<sup>i</sup> AB* ∈ {00, 01, 10, 11} and *k<sup>i</sup> <sup>H</sup>* ∈ {0, 1} correspond to the Pauli operator *σk<sup>i</sup> AB* ∈ ) *I*, *σx*, *σy*, *σ<sup>z</sup>* \* and the operator *Hki AB* ∈ {*I*, *H*} of quantum encryption with a single qubit unitary operator, respectively. The two bits information *ei* ∈ {00, 01, 10, 11} corresponds to the Pauli operator *σei* ∈ ) *I*, *σx*, *σy*, *σ<sup>z</sup>* \* for Gao's Attack. For example, if *k<sup>i</sup> AB* = 01, *<sup>k</sup><sup>i</sup> <sup>H</sup>* = 0, an encrypted QMAC state pair is

$$\mathbb{E}\left[\left|\mathcal{M}\right\rangle\_{\rm u}\left[\sigma\_{01}H^{0}\middle|\mathcal{S}\right\rangle\_{\rm d}\right] = \left|\left|\mathcal{M}\right\rangle\_{\rm u}\left[\sigma\_{\rm k}\middle|\mathcal{S}\right\rangle\_{\rm d}\right] \tag{12}$$

In addition, the forged QMAC state pair by Eve's Pauli operator σ10 = σ<sup>y</sup> is

$$
\left[\sigma\_{10} \middle| \left. M \right\rangle\_{\
u} \left[\sigma\_{10} \sigma\_{01} H^{0} \middle| \left. S \right\rangle\_{\
d} \right] = \left. \sigma\_{\rm y} \middle| \left. M \right\rangle\_{\
u} \left[\sigma\_{\rm y} \sigma\_{\rm x} \middle| \left. S \right\rangle\_{\
d} \right] \tag{13}
$$

The forged QMAC state pair of Equation (13) transforms into the following state after a decryption process:

$$
\sigma\_{10} \left| M \right\rangle\_{\
u} \left[ \left( H^{\dagger} \right)^{0} \sigma\_{01} \sigma\_{10} \sigma\_{01} H^{0} \left| S \right\rangle\_{d} \right] = \sigma\_{\mathcal{Y}} \left| M \right\rangle\_{\
u} \left[ \sigma\_{\mathcal{X}} \sigma\_{\mathcal{Y}} \sigma\_{\mathcal{X}} \left| S \right\rangle\_{d} \right] = \sigma\_{\mathcal{Y}} \left| M \right\rangle\_{\
u} \left[ -\sigma\_{\mathcal{Y}} \left| S \right\rangle\_{d} \right]. \tag{14}
$$

Assuming that | *M <sup>u</sup>* and | *S <sup>d</sup>* of Equation (14) are the same, Eve succeeded in attacking because the Pauli operator σ<sup>y</sup> remained in the first and second qubits of Equation (14). This is the first method to forge the quantum message code or quantum signature pair proposed by Gao et al. [34,46,48].

As another example, if *k<sup>i</sup> AB* = 01, *<sup>k</sup><sup>i</sup> <sup>H</sup>* = 1, an encrypted QMAC state pair is

$$\left| \left< M \right> \_{\
u} \left[ \sigma\_{01} H^1 \middle| \left. S \right>\_{d} \right] = \left| M \right> \_{\
u} \left[ \sigma\_{\infty} H \middle| \left. S \right>\_{d} \right]. \tag{15}$$

The forged QMAC state pair by Eve's Pauli operator σ10 = σ<sup>y</sup> is

$$
\sigma\_{10} \left| \left. M \right\rangle\_{\
u} \left[ \sigma\_{10} \sigma\_{01} H^{1} \left| \left. S \right\rangle\_{d} \right| = \sigma\_{\rm Y} \left| \left. M \right\rangle\_{\
u} \left[ \sigma\_{\rm Y} \sigma\_{\rm X} H \left| \left. S \right\rangle\_{d} \right] \right. \right. \tag{16}$$

The forged QMAC state pair transforms into the following state after a decryption process:

$$\sigma\_{10}|M\rangle\_{\rm u} \left[ \left( H^{\dagger} \right)^{1} \sigma\_{01} \sigma\_{10} \sigma\_{01} H^{1} |S\rangle\_{\rm d} \right] = \sigma\_{\rm Y} |M\rangle\_{\rm u} \left[ H^{\dagger} \sigma\_{\rm x} \sigma\_{\rm y} \sigma\_{\rm x} H |S\rangle\_{\rm d} \right] = \sigma\_{\rm Y} |M\rangle\_{\rm 1} \left[ -\sigma\_{\rm x} |S\rangle\_{\rm 2} \right] \tag{17}$$

Despite the assumption that | *M <sup>u</sup>* and | *S <sup>d</sup>* of Equation (17) are the same, Eve's attack is unsuccessful. The reason is that the Pauli operators σ<sup>y</sup> and σ<sup>x</sup> remained in the first and second qubits of Equation (17), respectively. This is the (I, H)-type quantum encryption proposed to overcome Gao's forgery [47]. Zhang et al., however, showed that the (I, H)-type quantum encryption is not secure for improved Gao's forgery [49,50]. We [19,34] overcome the original Gao's forgery [46] or the improved Gao's forgery [49,50] with quantum encryption σ*k<sup>i</sup> AB Hki <sup>H</sup>* , which randomly uses operator *H*. Here, the number of all possible cases of quantum encryption σ*k<sup>i</sup> AB Hki <sup>H</sup>* <sup>∈</sup> ) *I*, σx, σy, σz, *H*, σx*H*, σy*H*, σz*H*\* is 8. Furthermore, except σ*ei* = *I*, there are three possible ways that Eve can attack with σ*ei* . Therefore, there are a total of 24 forgery cases using the Pauli operator σ*ei* in the encrypted QMAC state pair | *M <sup>u</sup>* ' σ*ki AB Hki <sup>H</sup>* | *S <sup>d</sup>* ( of Equation (5) in the manuscript, Table 1 lists these 24 cases, and Figure 6 shows the results of the experiment with the existential forgery using the Pauli operator for 12 cases in Table 1.

**Table 1.** A total of 24 forgery cases using the Pauli operator *ei* <sup>∈</sup> ) *σx*, *σy*, *σz* \* in the encrypted QMAC state pair | *M <sup>u</sup>* ' σ*ki AB Hk<sup>i</sup> <sup>H</sup>* | *S <sup>d</sup>* ( . Here, <sup>σ</sup>*ei* <sup>∈</sup> ) *σx*, *σy*, *σz* \* , σ*k<sup>i</sup> AB* ∈ ) *I*, *σx*, *σy*, *σz* \* , and *Hk<sup>i</sup> <sup>H</sup>* ∈ {*I*, *H*}. We assume that the quantum states | *M <sup>u</sup>* and | *S <sup>d</sup>* are the same. The yellow shade represents the case where the operator *σz* is not used for quantum encryption or Gao's forgery.


**Figure 6.** Coincidence probability by existential forgery. Red bars denote the case where Eve attempts original Gao's Forgery when operator *H* is not used in the quantum encryption scheme \$ *ki <sup>H</sup>* = 0 % . The blue bars show the case of attempting improved Gao's Forgery when operator *H* is used in the quantum encryption scheme \$ *ki <sup>H</sup>* = 1 % . *Pc* is the coincidence probability. The black bars indicate the standard deviation of the coincidence counts for 1 s. *k<sup>i</sup> AB* is the same as in Figure 1. *ei* <sup>∈</sup> {00, 01, 10, 11} corresponds to the Pauli operator *<sup>σ</sup>ei* <sup>∈</sup> ) *I*, *σ*x, *σ*y, *σz* \* that Eve uses to attempt Gao's Forgery 1.

#### **5. Conclusions and Discussion**

We have proposed a new quantum message authentication protocol including quantum encryption for improving security against an existential forgery. Additionally, a practical implementation of the proposed protocol has been developed and its robustness against existential forgery has been verified experimentally. It consists of wave plates and the Hong–Ou–Mandel interferometer. The measurement results for each function—QMAC generation and recovery, Bob's encryption and decryption, and quantum encryption and decryption—successfully show the feasibility of robustness against Gao's forgeries.

The system loss and the optical channel loss, etc., should be considered when applying our protocol to real implementation. Let us assume that Alice and Bob use the single photon detector with 20% efficiency and are connected by 30-km single-mode fiber with 0.2 dB/km loss. In a result, the total efficiency becomes 0.08% because the qubits are pass through total 100 km, and if the QMAC pairs are generated at 100 MHz, Bob can receive <sup>8</sup> <sup>×</sup> <sup>10</sup><sup>4</sup> pairs/s. As we mentioned in Section 2, the size of the quantum state sequence should be more than 15. Therefore, Alice must generate at least 1.9 <sup>×</sup> <sup>10</sup><sup>4</sup> QMAC pairs, i.e., 1.9 <sup>×</sup> 104 × 0.08% = 15 that is quite implementable number, and send them to Bob to ensure this accuracy of the swap test.

Our protocol can be used as an arbitrated quantum signature protocol if a trusted center (TC) is added in the communication channel used by Alice and Bob [19]. In addition, if freshness property is added to our protocol, it can be used for quantum entity authentication as well [1,52]. In conclusion, we have proposed the base technology for a complete quantum cryptosystem that provides confidentiality, authentication, integrity, and nonrepudiation.

**Author Contributions:** M.-S.K. conceived the main idea. M.-S.K. wrote the manuscript. M.-S.K. and Y.-S.K. developed the experimental setup and performed the experiment. M.-S.K., Y.-S.K., J.-W.C., H.-J.Y. and S.-W.H. analyzed the results. S.-W.H. supervised the whole project. All authors reviewed the manuscript. All authors have read and agreed to the published version of the manuscript.

**Funding:** Korea Institute of Science and Technology (2E30620); National Research Foundation of Korea (2019 M3E4A107866011, 2019M3E4A1079777, 2019R1A2C2 006381); Institute for Information and Communications Technology Promotion (2020-0-00947, 2020-0-00972).

**Institutional Review Board Statement:** Not applicable.

**Informed Consent Statement:** Not applicable.

**Data Availability Statement:** Not applicable.

**Conflicts of Interest:** The authors declare no conflict of interest.

#### **References**


## *Article* **Tunability of the Nonlinear Interferometer Method for Anchoring Constructive Interference Patterns on the ITU-T Grid**

**Kyungdeuk Park, Dongjin Lee and Heedeuk Shin \***

Department of physics, Pohang University of Science and Technology (POSTECH), Pohang 37673, Korea; kyungdeuk@postech.ac.kr (K.P.); dongjin@postech.ac.kr (D.L.)

**\*** Correspondence: heedeukshin@postech.ac.kr

**Abstract:** Recently, a method of engineering the quantum states with a nonlinear interferometer was proposed to achieve precise state engineering for near-ideal single-mode operation and near-unity efficiency (L. Cui et al., Phys. Rev. A 102, 033718 (2020)), and the high-purity bi-photon states can be created without degrading brightness and collection efficiency. Here, we study the coarse or fine tunability of the nonlinear interference method to match constructive interference patterns into a transmission window of standard 100-GHz DWDM channels. The joint spectral intensity spectrum is measured for various conditions of the nonlinear interference effects. We show that the method has coarse- and fine-tuning ability while maintaining its high spectral purity. We expect that our results expand the usefulness of the nonlinear interference method. The photon-pair generation engineered via this method will be an excellent practical source of the quantum information process.

**Keywords:** quantum state engineering; nonlinear interferometer; spontaneous four-wave mixing

**Citation:** Park, K.; Lee, D.; Shin, H. Tunability of the Nonlinear Interferometer Method for Anchoring Constructive Interference Patterns on the ITU-T Grid. *Appl. Sci.* **2021**, *11*, 1429. https://doi.org/10.3390/ app11041429

Academic Editor: Maria Bondani Received: 7 January 2021 Accepted: 1 February 2021 Published: 5 February 2021

**Publisher's Note:** MDPI stays neutral with regard to jurisdictional claims in published maps and institutional affiliations.

**Copyright:** © 2021 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https:// creativecommons.org/licenses/by/ 4.0/).

#### **1. Introduction**

Modal purity or indistinguishability is an essential factor in achieving high visibility of quantum interference for quantum photonic applications such as quantum teleportation [1] and linear optical quantum computing [2]. High visibility yields high operation fidelity and a high probability of success in quantum information processing using nonclassical states of single photons. Among many approaches to obtain non-classical states of photons, spontaneous four-wave mixing (SFWM) has been intensively investigated for the frequency correlated photon-pair generation and heralded single-photon states [3]. However, frequency-correlated photon pairs by the spontaneous parametric process have complicated two-photon states and have a multi-mode nature [4,5]. The multi-mode nature makes photons distinguishable, degrading the quantum interference's visibility. Therefore, spectrally uncorrelated photon pairs with a factorable joint spectral amplitude (JSA) can induce high visibility of quantum interference [4,6] with high indistinguishability and high spectral purity.

The simplest way to obtain spectrally uncorrelated photon-pair is the spectral filtering method with narrow-band filters, but this method can degrade the brightness and photonnumber purity due to the optical loss by the filters [7]. The other ways for spectrally uncorrelated photons comes from engineering the dispersion of a parametric medium [8,9]. In spontaneous parametric down-conversion, near unity spectral purity can be achieved with a periodically poled structure [10–12], and SFWM has been tested as well with similar techniques [8,13–17]. While most of the methods are successful to some extent, many sources are expensive to make, not easy to implement, or limited to a specific wavelength range of operation due to strict requirements for dispersion and phase matching [18].

Recently, a new method of engineering the quantum states with nonlinear interference (NLI) is proposed and demonstrated [18–20]. The NLI system consists of two identical nonlinear media and one linear dispersive medium, which is placed in between them. Due to the phase shift induced by the linear dispersive medium, the joint spectral intensity (JSI) function of bi-photons shows oscillating interference patterns. By adjusting the NLI properties, the authors demonstrated the improved quantum properties of single-photon, spectral correlation, and Hong-Ou-Mandel interference using commercially available optical fibers [19,20]. The author used programmable and tunable filters as the signal and idler filters to reduce noise photons other than the generated photon pair and to have high spectral purity.

Optical fiber systems can guarantee the interoperability between systems and improve their price competitiveness through the standardization of optical communications technology. The standardization of optical frequency channels is necessary for wavelength division multiplexing and is defined by the International Telecommunication Union-Telecommunication standardization sector (ITU-T). Note that the use of customized filters or optical devices raises the entire system's price and makes system development difficult. Using photons on the ITU-T grids makes quantum technologies simple, as most optical devices in current telecommunication systems have frequency channels specified on the ITU-T grids and are commercially available with a reasonable price, high transmittance, narrow bandwidth, well-defined wavelength, etc. The center wavelength of the constructive interference is mainly determined by the length of the linear medium of an NLI system [18–20]. A carefully selected linear medium can make one of the constructive interference modes in a transmission window of DWDM filters without degrading brightness and collection efficiency to obtain high spectral purity. For the case of using single-mode fiber (SMF) as a dispersive medium, only one constructive island can be matched on the ITU grid as Δ*kSMF* of SMF is quadratically dependent on the detuning of pairs from the pump frequency (Δ*ωs*(*i*) = |ω*<sup>p</sup>* − *ωs*(*i*)|) [18,21]. In order to match all islands on the ITU grids, Δ*kSMF* should be linearly proportional to the detuning, and this requires the replacement of SMF with a device having linear Δ*kSMF* on the detuning [18]. Having pairs over the several ITU-T grids would be helpful for complex multi-photon interference experiments or multi-wavelength channel QKD.

A simple NLI system consists of two dispersion-shifted fiber (DSF) segments as a nonlinear pair generation medium and a section of standard SMF (Corning SMF-28), which is placed between two DSF segments as a linear dispersive medium. The NLI system can be extended by repeatedly adding additional sections of SMF and DSF, and the number of stage (*N*) is the number of DSF sections in the NLI system. For the case of pumping in the C-band (1530–1560 nm) and using a sufficiently long fiber, C-band photon-pair generation in SMF is negligible for a signal and idler detuning of 400 GHz (~3.2 nm) [21]. Ignoring the propagation loss of fibers and pump chirping, the bi-photon state amplitude through an *N*-stage NLI system can be calculated by [18],

$$F\_{\rm NLS}(\omega\_{\rm s}, \omega\_{\rm i}) = F\_{\rm DSF}(\omega\_{\rm s}, \omega\_{\rm i}) \times \left[ \sum\_{n=1}^{N} \exp\{i(n-1)(\Delta k\_{\rm DSF} L\_{\rm DSF} + \Delta k\_{\rm SMF} L\_{\rm SMF})\} \right] \tag{1}$$

where *F*DSF(ωs, ωi) is the JSA at the signal (ωs) and idler (ωi) frequency generated by SFWM in a single DSF section, Δ*k*DSF (Δ*k*SMF) is the phase mismatch between signal, idler, and two pump fields in DSF (SMF), *L*DSF (*L*SMF) is the length of DSF (SMF), respectively. Each *n*-th segment of DSF generates an identical bi-photon state to each other, and the phase shift of Δ*k*DSF*L*DSF + Δ*k*SMF*L*SMF induces the quantum interference in the bi-photon state [18]. From Equation (1), the center wavelength of a constructive interference pattern is tunable by changing Δ*k*DSF, Δ*k*SMF, *L*DSF, *L*SMF, and *N*. The physical parameters such as *L*DSF, *L*SMF, and *N* are variable by changing the length of DSF and SMF and the number of DSF and SMF sections in the NLI system. The optical parameters of Δ*k*DSF and Δ*k*SMF are controllable with the pump wavelength, types of fiber, and temperature.

Here, we investigate the coarse and fine tunability of the nonlinear interference method for creating bi-photon states with high spectral purity. The stimulated-emissionbased JSI, which is the absolute square of JSA, measurement technique [22] is used for fast measurements of the JSI spectra, and the measured results are compared to the theoretical

prediction, which is calculated using Equation (1). We change the pump wavelength, length of DSF and SMF sections, number of stages, and temperature. The coarse and fine tunability of the NLI method is experimentally demonstrated to control a bright JSI pattern to enter into one of the 100-GHz DWDM filters with the ITU-T channel grid. These results prove that the study in this paper enriches the usefulness and practicality of the NLI method for the efficient photon-pair generation with high spectral purity.

#### **2. Measurement Setup**

Figure 1 shows the experimental setup for the stimulated-emission-based JSI measurements. The pump laser is a mode-locked femtosecond (fs) pulse laser (CALMAR FPL-02CTF) with a repetition rate of 18 MHz. Femtosecond pulses are spectrally filtered by a 100-GHz DWDM filter, which has a flat-top spectral shape with about 0.6-nm full-width at half-maximum (FWHM) bandwidth. After filtering, pulses are amplified by an Erbium-Doped Fiber Amplifier (EDFA) and filtered again by DWDM filter to reduce amplified spontaneous emission (ASE) noise from EDFA (not included in Figure 1). The final pump pulse width is about 15 ps and effective bandwidth is about 0.5 nm. The pump peak power (*Pp*) is about 500 mW, and the seed (or signal) laser is a continuous wave laser with a power of about 10 mW. The lights from the pump and seed lasers are combined by a 200-GHz DWDM filter and injected into an NLI sample. The NLI samples consist of *N* sections of DSF and *N*-1 sections of SMF. The length of the DSF and SMF sections is measured using the time-of-flight measurement technique [23]. The polarization states of the pump and seed lights are matched using a polarization controller and an in-line polarizer. The pump light is filtered via a 200-GHz DWDM filter and monitored using an optical power meter to maximize the transmitted power through the in-line polarizer. We discretely vary the wavelength of the seed light while measuring the power of the seed, and generated idler lights using an optical spectrum analyzer. To clearly observe the trend in the shape and position of the JSI spectrum while changing several experimental conditions, we show the normalized spectra. The generated idler power is divided by the input signal power to compensate the system's wavelength-dependent transmittance, and then we normalize it to the maximum value from each measurement's spectrum.

**Figure 1.** Experimental setup for stimulated-emission-based joint spectral intensity measurement. PUMP: A 15-ps pulse laser with a repetition rate of 18 MHz, PROBE: CW laser for seed and its wavelength is swept during measurement, PC: polarization controller, C: 200 GHz DWDM filter for pump and seed combining, NLI: nonlinear interferometer sample, ILP: in-line polarizer, F: 200 GHz DWDM filter for pump filtering, PM: power meter for pump power monitoring, OSA: optical spectrum analyzer for measuring seed power and generated signal spectrum.

The spectral purity of bi-photons might be changed according to the pump bandwidth (*σp*), but under our experimental conditions, the FWHM pump bandwidth is fixed. Since the pump bandwidth is narrower than that of 100-GHz DWDM filters, we selected the 100-GHz DWDM filters as the target filters of signal/idler photons. In addition, since Raman noise photons increase further away from the pump frequency [24], we decided that 100-GHz DWDM filters, whose center frequency spacing from the pump is ±400 GHz, were the target filters for reducing the Raman noise through the NLI optical fiber system.

#### **3. Results**

#### *3.1. Pump Wavelength*

First, we test the effect of the pump wavelength (λ*p*) on the NLI patterns. When we change the pump wavelength, Δ*k*DSF and Δ*k*SMF are varied, simultaneously. The NLI system under this test consists of two 100-m DSF sections and a 50-m SMF section located between two DSF sections. Figure 2a–c show the measured JSIs for various pump wavelengths, λ*<sup>p</sup>* = [(a) 1550.92 nm (ITU ch.33), (b) 1555.75 nm (ITU ch.27), (c) 1560.61 nm (ITU ch.21)]. The patterns show the constructive and destructive interference patterns as an island arc along the diagonal dashed white line as seen in Figure 2a, and the first bright island (*m* = 1) is about 400 GHz away from the pump frequency. The JSI spectrum in Figure 2a–c looks very similar to each other for various λ*p*'s, but as seen in Figure 2d, the normalized diagonal JSI spectrum (like the dotted white line in Figure 2a) against the frequency detuning from the pump frequency shows the slow JSI shift towards λ*<sup>p</sup>* as λ*<sup>p</sup>* increases.

**Figure 2.** The measured joint spectral intensity (JSI) for various pump wavelengths, (**a**) 1550.92 nm, (**b**) 1555.75 nm, and (**c**) 1560.61 nm. (**d**) The plot of the diagonal line (white dotted line in (**a**)). (**e**) Peak frequency against the pump wavelength for *m* = 1, 2, and 3. Lines are theoretical predictions extracted from the calculated JSI by using Equation (1).

Figure 2e shows the difference between the pump center frequency and the peak frequency of the first, second, and third islands (*m* = 1, 2, and 3, respectively) against λ*p*. The lines are the theoretical predictions extracted from the calculated JSI using Equation (1). In the JSI calculation, the zero group-velocity-dispersion (GVD) wavelength of DSF (λ0,DSF) is 1555.5 nm, and its dispersion slope is 71.5 s/m3. The zero GVD wavelength of SMF (λ0,SMF) is known to be about 1300 nm, and the dispersion of SMF at 1550 nm used in the calculation is 18 <sup>×</sup> <sup>10</sup>−<sup>6</sup> s/m<sup>2</sup> with a dispersion slope of 53.3 s/m3. As seen in Figure 2e, the measured peak shift rates with increasing λ*<sup>p</sup>* are approximately −2.5 GHz/nm, −3.6 GHz/nm, and −4.3 GHz/nm for the interference mode number *m* = 1, 2, and 3, respectively. As the mode number, *m*, increases, the peak frequency moves faster towards the pump frequency with increasing λ*p*, and the measured results match well with the theoretical predictions. This slow frequency shift yields the fine tunability of the center frequency of islands.

#### *3.2. Length of Nonlinear Pair Generation Medium*

Second, we test the effect of the DSF length on the NLI patterns. In references [18–20], the authors assume that the wave vector mismatch goes to zero to ensure the satisfaction of the phase matching conditions. This study, however, considers the case where the wave vector mismatch is small but not negligible. In this case, we expect fine changes in NLI with varying the DSF length.

The NLI system in this test consists of two equal-length DSF sections of various lengths and a 50-m SMF section located between two DSF sections, and λ*<sup>p</sup>* is fixed at 1550.92 nm. Figure 3a–c show the measured JSIs for various DSF lengths (*L*DSF), and Figure 3d is the normalized diagonal JSI spectra for various DSF lengths against the frequency detuning from the pump frequency. As seen in Figure 3d, the peak frequency gets away from the pump frequency as *L*DSF becomes longer. Figure 3e is the difference between the pump center frequency and the peak frequency of the first, second, and third islands (*m* = 1, 2, and 3, respectively) against the DSF length. The frequency shift rates with increasing *LDSF* are approximately 0.11322 GHz/m, 0.11953 GHz/m, and 0.14266 GHz/m for *m* = 1, 2, and 3, respectively. The lines are the theoretical predictions using the identical parameters as in Section 3.1 except the DSF lengths and the pump wavelength. The frequency difference slowly grows as increasing *LDSF* if we consider the phase shift induced in DSF (Δ*k*DSF*L*DSF) (solid lines in Figure 3e), meanwhile, the difference is constant if we neglect the DSF phase shift (dashed lines). The measured results match well with the theoretical predictions with the phase shift in DSF. This slow frequency shift may induce the fine-tuning ability of the center frequency of islands.

In addition, Figure 3d shows the envelope changes of the pair-generation spectrum for different DSF lengths. It is known that the pair-generation rate is proportional to the square of the SFWM medium length. Recently, we investigate the length dependence of the pair-generation bandwidth, showing that the longer the SFWM length is, the narrower the spectrum bandwidth is [21]. Therefore, a long DSF nonlinear medium can have a large maximum generation rate but a rapidly degraded generation rate at a frequency away from the pump frequency, as seen in Figure 3d. We should carefully select the DSF length for balancing both the bandwidth and pair-generation rate even though the *L*DSF is the selectable parameter for the fine-tuning of peak frequency.

**Figure 3.** The measured JSI for various dispersion-shifted fiber (DSF) lengths, (**a**) 100 m, (**b**) 150 m, and (**c**) 200 m. (**d**) The plot of the diagonal lines. Dotted lines are measured single stage (*N* = 1, non-interference) JSI case with same length. (**e**) Peak frequency against the DSF length for *m* = 1, 2, and 3. Lines are theoretical predictions extracted from the calculated JSI by using Equation (1) with (solid lines) and without (dashed lines) the phase shift induced in DSF (Δ*k*DSF*L*DSF).

#### *3.3. Length of Linear Dispersive Medium*

The change of *L*SMF causes dramatic effects on the NLI patterns. In this test, λ*<sup>p</sup>* is fixed (1550.92 nm), and *L*DSF is 100 m. Figure 4a–d show the measured JSI for various SMF lengths. The spectra right and above the JSI in Figure 4a indicate the transmittance spectra of idler and signal filters, respectively. The filter type used in this study is the DWDM filters whose center frequencies are detuned by 400 GHz from the pump frequency, and its 3-dB bandwidth is about 0.6 nm (~75 GHz). Insets in Figure 4a–d show the JSI islands after passing through the signal/idler filters for *m* = 1, 2, 3, and 4, respectively. Note that the *m* = 0 islands in Figure 4b–d is not shown as the *m* = 0 islands end before 200 GHz. Figure 4e shows the differences between the pump center frequency and the peak frequency for *m* = 1, 2, 3, and 4 islands against the SMF length. The maximum island frequency gets closer as the SMF length becomes longer. The solid curved lines are the theoretical predictions using the identical parameters as in Section 3.1 except the DSF lengths and SMF lengths with the phase shift induced in DSF. The frequency difference decreases rapidly as increasing *L*SMF. The measured results match well with the theoretical predictions. This fast frequency shift yields the coarse-tuning ability of the center frequency of islands.

**Figure 4.** The measured JSI for various SMF lengths, (**a**) 50 m, (**b**) 94 m, (**c**) 140 m, and (**d**) 185 m. Spectra right side and above JSI in (**a**) are signal/idler filters (100-GHz DWDM filter (3dB-bandwidth ~80 GHz)). Inset in each JSI indicates the filtered JSI after the signal/idler filters within filter bandwidth. (**e**) Frequency difference against the SMF length for *m* = 1, 2, 3, and 4. Lines are theoretical predictions extracted from the calculated JSI by using Equation (1).

The maximum island frequency can be centered at the center of the 100-GHz DWDM filter frequency detuned by 400 GHz from the pump frequency if the condition, Δ*k*DSF*L*DSF + Δ*k*SMF*L*SMF = 2 mπ, can be satisfied [18]. The first, second, third, and fourth islands can be within the signal/idler filter transmittance bandwidth if the SMF length is about 50 m, 90 m, 135 m, and 180 m, respectively. The *m* = 1 island in Figure 4a is elongated diagonally. The JSI bandwidth is wider than the filter bandwidth so that the brightness and collection efficiency, i.e., heralding efficiency, will be degraded. The *m* = 4 island in Figure 4d, however, is almost round, indicating high spectral purity. The spectral purity (*P*) can be extracted from the measured data using the Schmidt decomposition method [22]. The extracted *p* values from the data are *p* = 0.74, 0.85, 0.95, and 0.91 for inset of (a), (b), (c), and (d), respectively. Therefore, we could obtain the photon pairs with high spectral purity by choosing the proper length of SMF.

#### *3.4. Number of Stages*

The change in the number of NLI stages (*N*) has been demonstrated in reference 18 (*N* = 2) and 19 (*N* = 3) under different NLI conditions, such as the DSF and SMF lengths. Here, we increase the stage number under identical NLI conditions and measure the JSI spectrum and its bandwidth. As seen in Figure 5a–d, varying the stage number does not change the maximum island frequency but the FWHM bandwidth of islands. λ*<sup>p</sup>* is fixed at 1550.92 nm, *L*DSF is 100 m, and *L*SMF is 94 m. This condition makes the second island away from the pump frequency by 400 GHz, as seen in Figure 4b. Figure 5a–d are the measured JSI for various *N*s. Insets show the JSI filtered by the signal/idler filters. Note that the second island is anchored at the center of the signal and idler DWDM filters even if we change the stage number from *N* = 2 to *N* = 5.

**Figure 5.** The measured JSI for various number of stage (i.e., number of DSF sample): (**a**) 2, (**b**) 3, (**c**) 4, and (**d**) 5. Inset indicates JSI after signal/idler filter which is 400-GHz detuned 100-GHz DWDM filter (3dB-bandwidth ~ 80 GHz)). (**e**) The plot of the diagonal line. The black dashed line indicates signal/idler filter (flat-top spectral shape). (**f**) Full-Width at Half-Maximum (FWHM) bandwidth of each peak against the number of stages. Lines are theoretical predictions extracted from the calculated JSI by using Equation (1).

Figure 5e is the normalized diagonal JSI spectra for various stage numbers against the frequency detuning from the pump frequency. The black dashed line indicates the signal filter spectrum, and the *m* = 2 island is centered on the filter spectrum. The normalized diagonal JSI spectra in Figure 5e show that the bandwidth of each island gets narrower as the stage number increases, but the peak frequency is stationary. Figure 5f shows the FWHM bandwidth of each island against the stage number. The curved lines are the theoretical predictions with considering the DSF phase shift. The FWHM bandwidth decreases as the stage number increases. The measured data matches well with the theoretical predictions except for the *N* = 5 case. We believe that the non-uniformity of the DSF sections causes this discrepancy, but further study is necessary. The measured *p* values are 0.82, 0.96, 0.98, and 0.97 for *N* = 2, 3, 4, and 5, respectively. Therefore, we could obtain the photon pairs with high spectral purity by adding the proper NLI stages.

#### *3.5. Cooling*

Finally, we test the temperature effects on the NLI method with the NLI system of *N* = 4 in Section 3.4. Since the silica material of optical fibers can generate noise photons by the Spontaneous Raman Scattering (SpRS) process, the SFWM photon generation medium needs cooling to suppress SpRS. The lower the temperature, the less SpRS occurs [25,26], but cooling the fiber system down to liquid nitrogen temperature is the best cost-effective way. When the optical fiber is cooled down, some properties of optical fibers, such as the zero GVD wavelength, are changed. For the DSF case, λ0,DSF is changed by −4 nm at liquid nitrogen temperature [26], and we assume that λ0,SMF also shifts by −4 nm as the DSF and SMF are made of silica. The dispersion slopes of DSF and SMF are not changed. Figure 6a,b are the theoretical predictions of the JSI at the signal/idler filter frequencies detuned by 400 GHz from the pump frequency, and (c), (d) are the measured JSI. Figure 6a,c are the cases at room temperature with λ*p*= 1550.92 nm. The peak center is placed at around 399.5 GHz in the simulation results and 396 GHz in the experimental results. This peak center shifts if we cool down the temperature to liquid nitrogen temperature. λ0,DSF and λ0,SMF are changed from 1555.5 nm to 1551.5 nm and from 1314 nm to 1310 nm, respectively, without changing the dispersion slope. As seen in Figure 6b,d, the peak center shifts to around 393.5 GHz (−6 GHz changed) in the simulation and 390.5 GHz (−5.5 GHz) in the experiment, respectively. As the shifted island due to cooling is within the signal/idler filter bandwidth and the shape of JSI is almost identical, the spectral purities in the simulation and experiment have almost no change.

**Figure 6.** The calculated (**a**,**b**) and measured (**c**,**d**) JSIs at (**a**,**c**) room temperature and (**b**,**d**) liquid nitrogen cooled with *λ<sup>p</sup>* = 1550.92 nm. The calculation of cooling condition is carried out with the assumption that *λ*<sup>0</sup> of DSF and SMF are shifted −4 nm and dispersion slopes are not changed. The x- and y-axes are shown ±40 GHz from filter center which is equivalent to the 3-dB bandwidth of signal/idler filter.

#### **4. Conclusions**

Here, we investigate the coarse and fine tunability and cooling effect of the nonlinear interferometer method. The constructive interference islands are controllable by changing the properties of the nonlinear pair generation medium and linear dispersive medium, such as Δ*k*DSF, Δ*k*SMF, *L*DSF, *L*SMF, and the number of stages (*N*). We succeed in adjusting the peak frequency of constructive interference patterns into a transmission window of commercial 100-GHz DWDM filters. As demonstrated in reference 18, 19, and 20, the dominant parameter is *L*SMF. The peak frequency of a constructive interference island can be coarsely placed near a target wavelength by adjusting the length of SMF. In addition, the pump wavelength and length of DSF can be used for fine-tuning. To match the peak frequency with a DWDM filter center frequency, we should consider the phase shift induced in DSF (Δ*k*DSF*L*DSF). The selection of *L*DSF should be carefully considered as not only the peak frequency but also the pair-generation rate and pair-generation spectral bandwidth are also related to *L*DSF.

Finally, we achieved high spectral purity by selecting an appropriate number of stages (*N*) and interference mode number (*m*). The demonstrated methods show the coarse- and fine-tuning ability to match the peak frequency of a constructive interference island and the center frequency of a commercial filter while maintaining high spectral purity. We think that the demonstrated methods in this study expand the usefulness of the NLI method. The generated photon pairs with the engineered quantum state can be an excellent practical source of quantum information processing involving quantum interference.

**Author Contributions:** Conceptualization, K.P. and H.S.; measurement, K.P.; calculation, D.L.; validation, K.P., D.L. and H.S.; formal analysis, K.P., D.L., and H.S.; writing—original draft preparation, K.P.; writing—review and editing, K.P., D.L. and H.S.; supervision, H.S.; All authors have read and agreed to the published version of the manuscript.

**Funding:** This research was funded by National Research Foundation of Korea, NRF-2019M3E4A1079780; Korea Institute of Science and Technology's Open Research Program, 2E30620-20-052; Institute for Information & communications Technology Promotion (IITP), No. 2020-0-00947; Affiliated Institute of Electronics and Telecommunications Research Institute (ETRI), 2020-080.

**Institutional Review Board Statement:** Not applicable.

**Informed Consent Statement:** Not applicable.

**Data Availability Statement:** The data presented in this study are available on request from the corresponding author.

**Conflicts of Interest:** The authors declare no conflict of interest.

#### **References**

