revtex4-1Repair the float

††† These two authors contributed equally.
∗ Corresponding author<EMAIL_ADDRESS>
#  Experimental network advantage for quantum conference key agreement

Alexander Pickston† Institute of Photonics and Quantum Sciences, School of
Engineering and Physical Sciences, Heriot-Watt University, Edinburgh EH14 4AS,
United Kingdom  Joseph Ho† Institute of Photonics and Quantum Sciences, School
of Engineering and Physical Sciences, Heriot-Watt University, Edinburgh EH14
4AS, United Kingdom  Andrés Ulibarrena  Institute of Photonics and Quantum
Sciences, School of Engineering and Physical Sciences, Heriot-Watt University,
Edinburgh EH14 4AS, United Kingdom  Federico Grasselli  Institut für
Theoretische Physik III, Heinrich-Heine-Universität Düsseldorf,
Universitätsstraße 1, D-40225 Düsseldorf, Germany  Massimiliano Proietti
Institute of Photonics and Quantum Sciences, School of Engineering and
Physical Sciences, Heriot-Watt University, Edinburgh EH14 4AS, United Kingdom
Christopher L. Morrison  Institute of Photonics and Quantum Sciences, School
of Engineering and Physical Sciences, Heriot-Watt University, Edinburgh EH14
4AS, United Kingdom  Peter Barrow  Institute of Photonics and Quantum
Sciences, School of Engineering and Physical Sciences, Heriot-Watt University,
Edinburgh EH14 4AS, United Kingdom  Francesco Graffiti  Institute of Photonics
and Quantum Sciences, School of Engineering and Physical Sciences, Heriot-Watt
University, Edinburgh EH14 4AS, United Kingdom  Alessandro Fedrizzi  Institute
of Photonics and Quantum Sciences, School of Engineering and Physical
Sciences, Heriot-Watt University, Edinburgh EH14 4AS, United Kingdom

###### Abstract

One of the great promises of quantum technology is the development of quantum
networks, which will allow global distribution of entanglement for tasks such
as distributed quantum computing [1, 2], distributed quantum sensing [3, 4]
and quantum-secure communication [5, 6, 7, 8]. To leverage the full potential
of quantum networks we require protocols that draw an efficiency advantage
from genuine multi-partite entanglement as opposed to strictly pair-wise
correlations such as Bell states. Multi-user entanglement such as Greenberger-
Horne-Zeilinger (GHZ) states have already found application in quantum
conference key agreement [9, 10, 11, 12], quantum secret sharing [13, 14, 15]
and quantum communication complexity problems [16, 17]. However, a true
network advantage has not yet been achieved. In this work we create a six-
photon graph-state network from which we derive either a four-user GHZ state
for direct quantum conference key agreement [18, 19, 20, 21] or the required
amount of Bell pairs for the equivalent pair-wise protocol. We show that the
GHZ-state protocol has a more than two-fold rate advantage by only consuming
half the amount of network resources per secure conference key bit.

In quantum conference key agreement (QCKA), N users aim to establish a common
and identical secret key for group-wide encryption. There are two main
approaches to achieve this when the group of users are connected in a network
as depicted in Figure 1. The first method involves obtaining bi-partite
entangled states from which secure pair-wise keys are generated using standard
QKD [22]. This set of keys can then be used to produce the conference key by
performing a bit-wise XOR operation on the individual keys—we will refer to
this as the ‘2QKD’ approach. A more resource-efficient method, referred to as
‘NQKD’, leverages multi-partite entanglement to obtain the conference key
directly from a GHZ state supplied to all participating users. This approach
can outperform the 2QKD scheme by consuming up to N$-1$ fewer network
resources in constrained quantum networks [9, 23]. QCKA was recently
demonstrated in a four-user NQKD scenario where a four-photon GHZ state was
directly transmitted over up to 50 km of telecom fibre [12]. However, a direct
comparison showing the experimental resource advantage over the 2QKD approach
in a quantum network has not yet been achieved.

In this work we demonstrate a genuine network advantage of QCKA when
exploiting multi-partite entanglement by using a six-photon graph state to
emulate a non-trivially connected six-user network. We use the graph state
shown in Figure 1 and so-called network coding techniques [24, 20, 25], which
involve local operations, quantum measurements and classical communication to
alter the connectivity of the network. This allows network users to conduct
the two alternative QCKA techniques to reveal the direct resource advantage of
using a multi-partite protocol.

Figure 1: Conceptual illustration of a multi-node quantum network. Physical
qubits are represented by nodes (circles), while edges (lines) represent pair-
wise interactions that entangle the qubits within the wider network. Here, we
define a subnetwork consisting of six users represented by nodes within the
rounded rectangle. Within this subnetwork, four of the users may wish to
perform quantum protocols such as conference key agreement. The traditional
method involves distributing Bell pairs among the participants first, followed
by post-processing steps to extract keys in a pairwise fashion before arriving
at the final conference key as shown by the right path in blue. An alternative
approach is to obtain a GHZ state and employ a multi-party quantum conference
key agreement protocol to extract the key directly, as represented in the left
red path.

For the NQKD approach we consider the N-BB84 protocol [10] that was
implemented in Ref. [12]. In each protocol round, an N-partite GHZ state is
distributed among N users. Each user performs a measurement on their
respective qubit according to a pre-agreed sequence of two possible
measurements. In type-1 rounds each user measures their qubit in the Pauli
Z-basis, exploiting the perfect Z-correlations for generation of the raw key;
type-2 rounds correspond to jointly measuring in X and are used for parameter
estimation. Security is established by evaluating $Q_{\text{X}}$ from the
type-2 rounds and determining the quantum bit error rate (QBER) from a random
subset of publicly disclosed type-1 outcomes. We can assess the performance of
the N-BB84 protocol, in the limit of an infinite number of rounds, by
determining these two parameters and calculating the asymptotic key rate (AKR)
[10, 12]. The AKR establishes the fractional secret key bit extracted for each
copy of the resource state and is defined as,

$\mathrm{AKR}=1-H(\textrm{QBER})-H(Q_{\text{X}}),$ (1)

where $H(x)\doteq-x\log_{2}(x)-(1-x)\log_{2}(1-x)$ is the binary entropy
function. The explicit evaluation of QBER and $Q_{\text{X}}$ is detailed in
the Appendix.

In the case of 2QKD, users initially obtain sets of Bell states, rather than a
GHZ state, from which they run pairwise BB84 protocols whose AKR is also given
by the expression in (1). However, unlike in the NQKD approach, the 2QKD
method involves obtaining N$-1$ unique, pairwise keys spanning the N-user
group first. This is followed by a classical step, e.g., applying the bit-wise
XOR, to transform the individual keys into the final conference key [9]. As we
will show in our experiment, depending on the underlying topology of the
quantum network, this leads to the 2QKD approach requiring up to N$-1$ times
more network resource states than NQKD.

Figure 2: Experimentally generating and manipulating the six-photon graph
state. (a) On the left is the linear optical circuit for generating the target
graph state on the right. Three photon-pair sources are represented as black
boxes with each horizontal line representing a labelled optical mode
containing one photon. Two sources produce Bell states, $|\Phi^{+}\rangle$,
while the third generates a biseparable state with each photon in $|+\rangle$.
The two-qubit fusion gates are denoted by two squares on the modes they act
upon connected by a vertical line. Single-qubit operations, i.e., Hadamard and
Pauli-Z gates are shown as squares with letters $\mathds{H}$ and Z
respectively. (b) The set of graph transformations for obtaining the four-
qubit GHZ state, in modes $\\{1,2,5,6\\}$, are depicted in the red path. This
corresponds to local operations consisting of single-qubit gates
$\textrm{N}\doteq\sqrt{-i\text{X}}$ and $\textrm{T}\doteq\sqrt{i\text{Z}}$,
where X and Z are again Pauli gates, followed by quantum measurements on non-
participatory qubits $\\{3,4\\}$ in the $Z$ basis. The remaining qubits can be
measured in the joint-Z or-X basis allowing us to evaluate the key rate
performance for the NQKD method. (c) We outline the two sets of local-graph
operations for obtaining the three Bell pairs which are needed for the 2QKD
approach.

We experimentally prepare the six-photon graph state using a linear optical
setup containing three photon-pair sources, see Appendix for details. In
Figure 2(a) we outline the general layout of the sources, two-qubit Fusion
gates and single-qubit rotations. Two of the sources produce Bell states,
$|\Phi^{+}\rangle$, while the third generates a biseparable state with each
photon encoded as $|+\rangle$. We arrive at the six-photon graph state by
applying the set of two-qubit Fusion gates and single-qubit operations, where
$\mathds{H}$ and Z denote the Hadamard and Pauli-Z gates. In our setup we use
probabilistic two-qubit fusion gates [26] which have a success rate of $1/2$
per gate. This leads to an overall probability of obtaining the target six-
photon state as $P_{s}=1/8$, conditional on detecting one photon in each mode.

We adopt the graph state formalism [24] to represent the six-photon state.
This representation allows us to exploit techniques for transforming the
underlying entanglement structure, via local complementation (LC) [24, 25,
20], as shown in Figure 2(b). We illustrate how LC operations on the six-
photon graph results in a four-party GHZ state in modes $\\{1,2,5,6\\}$,
corresponding to four users, e.g., Alice, Bob-1, Bob-2 and Bob-3, implementing
NQKD. Conventionally, Alice denotes the party who co-ordinates the error
correction and privacy amplification steps after the raw key is established
[12, 10, 9]. We also include LC operations mapped to sets of single-qubit
gates [25] in the circuit. Nodes 3 and 4 represent users Charlie and Debbie,
who do not participate in the QCKA key generation. They measure their qubits
in the Z basis then announce their outcomes, which allows the qubits to be
coherently removed from the graph. The remaining four qubits are transformed
into the star graph which is a locally equivalent to the four-party GHZ state
[24] required for the NQKD protocol. We then construct measurement sequences
consistent with type-1 and type-2 rounds, i.e., $\text{Z}^{\otimes 4}$ and
$\text{X}^{\otimes 4}$ respectively, of the NQKD protocol.

The method for transforming the six-photon state into Bell pairs for the 2QKD
protocol is outlined in Figure 2(c). To generate a conference key among the
four users, at least three pairwise keys are required. There are two sets of
network transformations for obtaining three individual Bell pairs among the
same group of four users that participated in the NQKD protocol. On the top of
Figure 2(c) we show how to obtain Bell pairs between nodes $\\{1,2\\}$ and
$\\{5,6\\}$ respectively from a single copy of the six-photon resource graph
state. While the bottom of the same figure shows a single Bell pair
established between modes $\\{2,5\\}$. We similarly construct the measurement
sequences corresponding to type-1 and type-2 rounds for each Bell pair, see
Appendix for details.

The outcomes of type-1 and type-2 rounds are used to calculate the noise
parameters QBER and $Q_{\text{X}}$ which are then used to evaluate the AKR
using the expression in (1). This expression corresponds to the asymptotic
conference key rate for the NQKD approach and we denote it as
$\textrm{AKR}_{\text{N}}$. While for the 2QKD approach, (1) first computes the
pairwise AKR of each BB84 protocol, denoted
$\\{r_{AB_{1}},r_{B_{2}B_{3}},r_{AB_{2}}\\}$; the resulting asymptotic
conference key rate is then obtained using the expression,

$\textrm{AKR}_{2}=\frac{1}{\frac{1}{r_{AB_{2}}}+\textrm{max}\\{\frac{1}{r_{AB_{1}}},\frac{1}{r_{B_{2}B_{3}}}\\}}.$
(2)

In the ideal case where the AKR of each Bell pair is unity, we obtain
$\textrm{AKR}_{2}^{ideal}=1/2$ while for the NQKD case with an ideal four-
party GHZ state we can attain $\textrm{AKR}_{\text{N}}^{ideal}=1$. The
expected ratio of the key rate advantage in favour of NQKD is therefore
$\textrm{AKR}_{\text{N}}^{ideal}:\textrm{AKR}_{2}^{ideal}=2$ given our
specific six-photon graph. This advantage originates from the ability to use a
single copy of the six-photon graph state to produce one secure bit of the
conference key via NQKD, whereas in 2QKD each secure bit requires two copies
of the network graph state.

We compare the experimental results of type-1 and type-2 measurements for both
approaches in Figure 3. We set the pump power to each source to obtain an
average six-photon detection rate of $\sim 0.0141$ Hz for all measurements.
This optical pumping regime was chosen to limit multi-photon events while
still ensuring sufficient detection rates to collect statistics for each
protocol, for details on the effect of optical pump parameters see
Supplementary Materials. From the data in Figure 3 we calculate QBER and
$Q_{\text{X}}$, for each resource state. We then evaluate the asymptotic
conference key rate for NQKD, $\textrm{AKR}_{\text{N}}=0.093(22)$ and for
2QKD, $\textrm{AKR}_{2}=0.044(15)$. We arrive at the experimentally measured
ratio of the two approaches to be
$\textrm{AKR}_{\text{N}}^{exp}:\textrm{AKR}_{2}^{exp}=2.13(6)$. The
uncertainties reported here are taken as one standard deviation from the
average of samples via a Monte Carlo simulation which assumes Poissonian
counting statistics.

Figure 3: Experimentally measured populations of (a) three Bell pairs used for
2QKD and (b) the four-party GHZ state for NQKD. The type-1 rounds are shown in
the top set of measurements, while type-2 rounds are shown in the bottom set.
These outcomes are extracted from complete measurements in the six-photon
state space, wherein post-selection of the non-participatory nodes have taken
place. The theoretically expected populations are included as transparent
bars. All measurements are recorded for the same integration time at a fixed
optical pump power and error bars are shown for one standard deviation
assuming Poissonian statistics.

Noise distributed unevenly between qubits leads to different pairwise key
rates for the 2QKD approach. In turn, this leads to a larger maximum in the
denominator of (2) resulting in a decrease of the 2QKD conference key rate.
Meanwhile, for the NQKD approach we remark that QBER is set by the largest
pair-wise error rate with respect to a common user, typically labelled as
Alice [10]: $\textrm{QBER}\doteq\textrm{max}_{i}\\{Q_{AB_{i}}\\}$. However,
since the NQKD protocol is symmetric with respect to permutations of the
parties’ roles, choosing which party is labelled as Alice can be delayed to
the classical post-processing phase, allowing for an optimal choice which
minimises the QBER and hence maximises $\textrm{AKR}_{\text{N}}$.

We have demonstrated that QCKA performed on our graph-state quantum network
derives an above two-fold rate advantage from multi-party entanglement when
compared to Bell states generated from the same network. Distributing GHZ
states directly for NQKD will struggle to outperform much faster state-of-the-
art point-to-point QKD systems [22, 27], as loss scales exponentially with the
number of transmitted photons [28, 29]. However, once genuine quantum networks
which generate large-scale entanglement in the background become available,
NQKD outperforms 2QKD in terms of key rate per network use as we have
demonstrated here.

In principle, NQKD can achieve an $\text{N}-1$, i.e., three-fold advantage in
our four-user scenario. However, our specific graph allows for a Bell state
_multi-cast_ [9], where more than one Bell pair can be shared from a single
network resource between participating users. The 2QKD rate is therefore
boosted by 50%. While NQKD will still always retain an advantage, the option
of multi-casting needs to be taken into account for rate comparisons in other
network topologies. In the Supplementary Discussion we investigate this for
the six-photon graph that corresponds to the canonical ‘butterfly’ network.

Another aspect where NQKD seems to have an advantage over 2QKD, which is worth
further quantification, is in key post-processing. When evaluating our secure
NQKD rates, we made use of the fact that the protocol allows for pairwise
error rates to be evaluated for all permutations of the conference group, with
Alice being designated based on minimising the overheads lost in error
correction. A similar optimisation for 2QKD would require a-priori channel
estimation, and thus additional network resources, to establish the optimal
user pairs for Bell state distribution. Note that the NQKD rate advantage
receives a further slight boost once finite key effects are considered, as
previously noted in Ref [12].

As one of the first multi-user quantum communication protocols with a network
advantage, QCKA is now a very active research area. Protocols have been
developed for measurement-device independent scenarios [30] and
implementations with weak coherent states that might outperform N-photon GHZ
state transmission [31]. Studies of QCKA have raised fundamental questions
about the type of entanglement that is useful in multi-user quantum
communication. It has been shown that genuine multi-partite entanglement is
not strictly required for QCKA [32]. Nonetheless, obtaining a non-zero
conference key could be used as a witness for entanglement in a network [32].

It will be important to explore other protocols that gain an advantage from
multi-partite entanglement in quantum networks. One example is anonymous
conference key agreement which enables a conference key to be distilled while
hiding the identities of the participants [33, 34, 35, 36]. A QCKA-based
variant of this protocol has theoretically been shown to gain a significant
advantage when using both GHZ states and Bell pairs [34] compared to using
Bell pairs alone [37]. Going beyond QCKA, quantum secret sharing [13] is a
well-known multi-user cryptography task that has a provable network advantage
using GHZ-state correlations in the continuous variable regime [38]. A key
question for these protocols is whether the required multi-party states can be
obtained from an underlying network efficiently. For networks based on graph
states this has been answered in the affirmative [20] however generalisations
to other resource states is an ongoing challenge [39].

Acknowledgements
This work was supported by the UK Engineering and Physical Sciences Research
Council (Grant Nos. EP/T001011/1.). F Graffitti acknowledges studentship
funding from EPSRC under Grant No. EP/L015110/1. F Graselli acknowledges
support from the Deutsche Forschungsgemeinschaft (DFG, German Research
Foundation) under Germany’s Excellence Strategy - Cluster of Excellence Matter
and Light for Quantum Computing (ML4Q) EXC 2004/1 -390534769.

Author contributions
MP, AF conceived the project. F Grasselli, AP, JH developed the theoretical
framework. AP, JH, AU, CLM, F Graffitti, PB performed the experiment and
collected the data. AP, JH analysed experimental data and prepared figures.
All authors contributed to writing the manuscript.

Competing interests
The authors declare no competing interests.

## References

  * [1] Beals, R. _et al._ Efficient distributed quantum computing.  _Proceedings of the Royal Society A: Mathematical, Physical and Engineering Sciences_ 469, 20120686 (2013).  URL https://royalsocietypublishing.org/doi/10.1098/rspa.2012.0686.
  * [2] Van Meter, R. & Devitt, S. J.  The path to scalable distributed quantum computing.  _Computer_ 49, 31–42 (2016).  Conference Name: Computer.
  * [3] Gottesman, D., Jennewein, T. & Croke, S.  Longer-baseline telescopes using quantum repeaters.  _Phys. Rev. Lett._ 109, 070503 (2012).  URL https://link.aps.org/doi/10.1103/PhysRevLett.109.070503.
  * [4] Kómár, P. _et al._ A quantum network of clocks.  _Nature Physics_ 10, 582–587 (2014).  URL https://www.nature.com/articles/nphys3000.
  * [5] Peev, M. _et al._ The SECOQC quantum key distribution network in Vienna.  _New Journal of Physics_ 11, 075001 (2009).
  * [6] Sasaki, M. _et al._ Field test of quantum key distribution in the Tokyo QKD network.  _Optics express_ 19, 10387–10409 (2011).
  * [7] Dynes, J. _et al._ Cambridge quantum network.  _npj Quantum Information_ 5, 1–8 (2019).
  * [8] Chen, T.-Y. _et al._ Implementation of a 46-node quantum metropolitan area network.  _npj Quantum Information_ 7, 1–6 (2021).  URL http://www.nature.com/articles/s41534-021-00474-3.
  * [9] Epping, M., Kampermann, H., Macchiavello, C. & Bruß, D.  Multi-partite entanglement can speed up quantum key distribution in networks.  _New Journal of Physics_ 19, 093012 (2017).  URL https://doi.org/10.1088/1367-2630/aa8487.
  * [10] Grasselli, F., Kampermann, H. & Bruß, D.  Finite-key effects in multipartite quantum key distribution protocols.  _New Journal of Physics_ 20, 113014 (2018).  URL https://doi.org/10.1088/1367-2630/aaec34.
  * [11] Murta, G., Grasselli, F., Kampermann, H. & Bruß, D.  Quantum conference key agreement: a review.  _Advanced Quantum Technologies_ 3, 2000025 (2020).  URL http://arxiv.org/abs/2003.10186.
  * [12] Proietti, M. _et al._ Experimental quantum conference key agreement.  _Science Advances_ 7, eabe0395 (2021).  URL https://advances.sciencemag.org/content/7/23/eabe0395.
  * [13] Hillery, M., Bužek, V. & Berthiaume, A.  Quantum secret sharing.  _Physical Review A_ 59, 1829 (1999).
  * [14] Tittel, W., Zbinden, H. & Gisin, N.  Experimental demonstration of quantum secret sharing.  _Physical Review A_ 63, 042301 (2001).
  * [15] Broadbent, A., Chouha, P.-R. & Tapp, A.  The GHZ state in secret sharing and entanglement simulation.  In _2009 Third International Conference on Quantum, Nano and Micro Technologies_ , 59–62 (IEEE, 2009).
  * [16] Buhrman, H., Cleve, R., Massar, S. & De Wolf, R.  Nonlocality and communication complexity.  _Reviews of Modern Physics_ 82, 665 (2010).
  * [17] Ho, J. _et al._ Entanglement-based quantum communication complexity beyond Bell nonlocality.  _npj Quantum Information_ 8, 1–7 (2022).
  * [18] Epping, M., Kampermann, H. & Bruß, D.  Robust entanglement distribution via quantum network coding.  _New Journal of Physics_ 18, 103052 (2016).  URL https://doi.org/10.1088/1367-2630/18/10/103052.
  * [19] Epping, M., Kampermann, H. & Bruß, D.  Large-scale quantum networks based on graphs.  _New Journal of Physics_ 18, 053036 (2016).  URL https://doi.org/10.1088/1367-2630/18/5/053036.
  * [20] Hahn, F., Pappa, A. & Eisert, J.  Quantum network routing and local complementation.  _npj Quantum Information_ 5, 1–7 (2019).  URL https://www.nature.com/articles/s41534-019-0191-6.
  * [21] Wallnöfer, J., Pirker, A., Zwerger, M. & Dür, W.  Multipartite state generation in quantum networks with optimal scaling.  _Scientific Reports_ 9, 1–18 (2019).
  * [22] Wengerowsky, S., Joshi, S. K., Steinlechner, F., Hübel, H. & Ursin, R.  An entanglement-based wavelength-multiplexed quantum communication network.  _Nature_ 564, 225–228 (2018).  URL http://www.nature.com/articles/s41586-018-0766-y.
  * [23] Hahn, F., Dahlberg, A., Eisert, J. & Pappa, A.  Limitations of nearest-neighbour quantum networks.  _arXiv:2202.10886 [quant-ph]_ (2022).  URL http://arxiv.org/abs/2202.10886.
  * [24] Hein, M., Eisert, J. & Briegel, H. J.  Multi-party entanglement in graph states.  _Physical Review A_ 69, 062311 (2004).  URL http://arxiv.org/abs/quant-ph/0307130.
  * [25] Adcock, J. C., Morley-Short, S., Dahlberg, A. & Silverstone, J. W.  Mapping graph state orbits under local complementation.  _Quantum_ 4, 305 (2020).  URL http://arxiv.org/abs/1910.03969.
  * [26] Browne, D. E. & Rudolph, T.  Resource-efficient linear optical quantum computation.  _Physical Review Letters_ 95, 010501 (2005).  URL https://link.aps.org/doi/10.1103/PhysRevLett.95.010501.
  * [27] Joshi, S. K. _et al._ A trusted node–free eight-user metropolitan quantum communication network.  _Science Advances_ 6, eaba0959 (2020).  URL https://www.science.org/doi/full/10.1126/sciadv.aba0959.
  * [28] Singkanipa, P. & Kok, P.  Quantum conference key agreement with photon loss.  _arXiv preprint:2101.01483_ (2021).
  * [29] Takeoka, M., Guha, S. & Wilde, M. M.  Fundamental rate-loss tradeoff for optical quantum key distribution.  _Nature communications_ 5, 1–7 (2014).
  * [30] Ottaviani, C., Lupo, C., Laurenza, R. & Pirandola, S.  Modular network for high-rate quantum conferencing.  _Communications Physics_ 2, 1–6 (2019).  URL https://www.nature.com/articles/s42005-019-0209-6.
  * [31] Grasselli, F., Kampermann, H. & Bruß, D.  Conference key agreement with single-photon interference.  _New Journal of Physics_ 21, 123002 (2019).  URL https://doi.org/10.1088/1367-2630/ab573e.
  * [32] Carrara, G., Kampermann, H., Bruß, D. & Murta, G.  Genuine multipartite entanglement is not a precondition for secure conference key agreement.  _Physical Review Research_ 3, 013264 (2021).  URL http://arxiv.org/abs/2007.11553.
  * [33] Hahn, F., de Jong, J. & Pappa, A.  Anonymous quantum conference key agreement.  _PRX Quantum_ 1, 020325 (2020).
  * [34] Grasselli, F. _et al._ Robust anonymous conference key agreement enhanced by multipartite entanglement.  _arXiv:2111.05363 [quant-ph]_ (2021).  URL http://arxiv.org/abs/2111.05363.
  * [35] de Jong, J., Hahn, F., Eisert, J., Walk, N. & Pappa, A.  Anonymous conference key agreement in linear quantum networks.  _arXiv preprint arXiv:2205.09169_ (2022).
  * [36] Thalacker, C., Hahn, F., de Jong, J., Pappa, A. & Barz, S.  Anonymous and secret communication in quantum networks.  _New Journal of Physics_ 23, 083026 (2021).
  * [37] Huang, Z. _et al._ Experimental implementation of secure anonymous protocols on an eight-user quantum key distribution network.  _npj Quantum Information_ 8, 1–7 (2022).  URL https://www.nature.com/articles/s41534-022-00535-1.
  * [38] Walk, N. & Eisert, J.  Sharing classical secrets with continuous-variable entanglement: Composable security and network coding advantage.  _PRX Quantum_ 2, 040339 (2021).  URL https://link.aps.org/doi/10.1103/PRXQuantum.2.040339.
  * [39] Dahlberg, A., Helsen, J. & Wehner, S.  How to transform graph states using single-qubit operations: computational complexity and algorithms.  _Quantum Science and Technology_ 5, 045016 (2020).  URL https://iopscience.iop.org/article/10.1088/2058-9565/aba763.
  * [40] Pickston, A. _et al._ Optimised domain-engineered crystals for pure telecom photon sources.  _Optics Express_ 29, 6991–7002 (2021).  URL https://www.osapublishing.org/oe/abstract.cfm?uri=oe-29-5-6991.
  * [41] Fedrizzi, A., Herbst, T., Poppe, A., Jennewein, T. & Zeilinger, A.  A wavelength-tunable fiber-coupled source of narrowband entangled photons.  _Optics Express_ 15, 15377–15386 (2007).  URL https://www.osapublishing.org/oe/abstract.cfm?uri=oe-15-23-15377.
  * [42] Langford, N. K. _et al._ Demonstration of a simple entangling optical gate and its use in Bell-state analysis.  _Physical Review Letters_ 95, 210504 (2005).  URL https://link.aps.org/doi/10.1103/PhysRevLett.95.210504.
  * [43] Dahlberg, A., Helsen, J. & Wehner, S.  Transforming graph states to Bell-pairs is NP-Complete.  _Quantum_ 4, 348 (2020).  URL https://quantum-journal.org/papers/q-2020-10-22-348/.
  * [44] Dahlberg, A., Helsen, J. & Wehner, S.  How to transform graph states using single-qubit operations: computational complexity and algorithms.  _arXiv:1805.05306 [quant-ph]_ (2018).  URL http://arxiv.org/abs/1805.05306.
  * [45] Dahlberg, A., Helsen, J. & Wehner, S.  The complexity of the vertex-minor problem.  _arXiv:1906.05689 [quant-ph]_ (2019).  URL http://arxiv.org/abs/1906.05689.

##  Appendix

###  Parameter estimation

In the N-BB84 protocol QBER is defined as the largest pair-wise error rate
observed from the type-1 rounds, i.e., when all users measure jointly in the Z
basis. For convenience we adopt a general labelling of a group of N users
following the set, $\\{A,B_{1},B_{2},...,B_{\text{N}-1}\\}$. Thus for an N-GHZ
state, errors in the Z basis occur when there is a non-zero probability that
one of the Bobs obtains an outcome that differs from Alice. Explicitly, the
QBER is defined as:

$\textrm{QBER}\doteq\max_{i\in\\{1,2,\dots,(\text{N}-1)\\}}Q_{AB_{i}},$ (3)

where
$Q_{AB_{i}}=\Pr(\text{Z}_{A}\neq\text{Z}_{B_{i}})=(1-\langle\text{Z}^{A}\text{Z}^{B_{i}}\rangle)/2$.
As mentioned in the main text, when evaluating the pair-wise error rates for
different $i$, the role of Alice does not have to be assigned to a specific
user. Rather, we can permute the role of Alice within the set of users, by
updating the indices of each user. We find different maximum pair-wise error
rates (QBER) depending on the permutation, due to noise being distributed
unevenly among each of the six qubits of the resource state. By iterating
through all permutations, we select the role of Alice based on yielding the
lowest QBER, optimising the conference key rate.

Phase error for a N-GHZ state can be estimated from X basis measurements. This
is calculated by determining the deviation in measurement outcome from the
expected correlations. This is expressed as,

$Q_{\text{X}}=(1-\braket{\text{X}^{\otimes\text{N}}})/2.$ (4)

Both QBER and $Q_{\text{X}}$ are zero in the absence of error and noise,
indicating that there is no deviation from the expected behaviour of the GHZ
state.

For Bell states, both QBER and $Q_{\text{X}}$ can be evaluated using the same
expressions as above. However, since there are only two users sharing a Bell
state we skip the step of permuting the role of Alice in the group.

###  Experimental layout

_Photon pair sources—_ To produce the six-photon graph state we use three
photon-pair sources which are optically pumped by a picosecond Ti-Sapph laser.
All three are type-II parametric down-conversion (PDC) sources based on
domain-engineered aperiodically-poled KTP (aKTP) crystals that are optimally
phase-matched for spectrally pure photon pairs at 1550 nm [40]. High spectral
purity is achieved without needing narrow-band filters which improves
collection efficiency and increases the overall detection rate. Each aKTP
crystal is embedded in a polarisation-based Sagnac interferometer which can be
optically pumped bidirectionally to produce polarisation-entangled photon
pairs [41],

$|\Psi^{+}\rangle_{a,b}=\frac{|\textsf{hv}\rangle_{a,b}+|\textsf{vh}\rangle_{a,b}}{\sqrt{2}},$

where $|{\textsf{h}}\rangle$ and $|{\textsf{v}}\rangle$ correspond to
horizontal and vertical polarisation states respectively, and subscripts
denote optical modes. We remark that the $|\Psi^{+}\rangle$ Bell state can be
transformed into the $|\Phi^{+}\rangle$ Bell state via a local operation using
polarisation optics. Lastly, we can configure one of the sources to produce
separable states by optically pumping the Sagnac loop in one direction, thus
generating the state $|++\rangle\doteq|\textsf{dd}\rangle$, where
$|\textsf{d}\rangle\doteq\left(|\textsf{h}\rangle+|\textsf{v}\rangle\right)/\sqrt{2}$
is the diagonal polarisation state.

The linear optical circuit responsible for producing the six-photon graph
state consists of three fusion gates [26] along with single-qubit gates on the
respective modes, shown in Figure 2. The linear optical fusion gate is
probabilistic, with a success rate of $1/2$, however successful operation is
heralded by the detection of one photon in each output of the gate. See
Supplementary Methods for further experimental detail. After the network of
fusion gates and upon detecting one photon in each of the six numbered modes,
the joint quantum state of the system is given by,

$\displaystyle\ket{\Psi}_{\text{initial}}=$
$\displaystyle(\ket{\textsf{hhhhhh}}-\ket{\textsf{hhhhvv}}-\ket{\textsf{hhvvhh}}-\ket{\textsf{hhvvvv}}-\ket{\textsf{vvhhhh}}+\ket{\textsf{vvhhvv}}-\ket{\textsf{vvvvhh}}-\ket{\textsf{vvvvvv}})/\sqrt{8}.$
(5)

We remark that this state is equivalent to the six-photon graph state
discussed in the main body of work, subject to a set of local rotations,

$(\mathds{H}\otimes\text{Z}\otimes\mathds{H}\otimes\text{Z}\otimes\mathds{H}\otimes\text{Z})\ket{\Psi}_{\text{initial}}=\ket{\textsf{G}}_{\text{target}}$

where the target state is a graph state, $\ket{\textsf{G}}_{\text{target}}$
and $\mathds{H}$ is the Hadamard gate. After the fusion gates, the photons go
to tomography stages which consist of a HWP, QWP and a PBS, after which
photons are coupled into single mode fibres.

###  Graph state formalism.

We use the graph state formalism to represent the transformations of the
resource state used to distribute the GHZ state and Bell pairs between the
four users. As the resource state is capable of distilling a GHZ state and
sets of Bell pairs, this enables direct comparison of QCKA based on NQKD and
2QKD without changing the structure of the linear optical circuit. The general
form of a graph state $\textsf{G}=(V,E)$ reads:

$\ket{\textsf{G}}=\prod_{(i,j)\in E}\textsf{CZ}_{ij}\ket{+}^{\otimes|V|}.$ (6)

where $\textsf{CZ}_{i,j}$ is the two-qubit controlled-Z gate acting on modes
$\\{i,j\\}$, $E$ is the list of edges connecting two vertices and $|V|$ is the
number of vertices of the graph. Using this notation, we define our target
graph state as,

$\displaystyle\ket{\textsf{G}}_{\text{target}}=(\textsf{CZ}_{1,2}\otimes\textsf{CZ}_{2,4}\otimes\textsf{CZ}_{3,4}\otimes\textsf{CZ}_{4,6}\otimes\textsf{CZ}_{5,6})\ket{+}^{\otimes
6},$ (7)

For more details on this construction and the graph state formalism see
Supplementary Methods.

One specific transformation within the graph state formalism is called local
complementation (LC). An LC operation itself is comprised of two different
unitaries. On a vertex designated as the target, the operation
$\text{T}=\sqrt{-i\>\text{X}_{t}}$ is applied, whilst each vertex neighbouring
the target, the operation $\text{N}=\sqrt{i\>\text{Z}_{n}}$ is applied.

Measurement sequences— After the fusion gates, each photon is sent to a
tomography stage consisting of a set of controllable HWP and QWP then onto a
PBS with both ports fibre coupled. From the initial target graph
$\ket{\textsf{G}}_{\text{target}}$ LC operations are used, transforming the
initial graph into alternative graphs within the same entanglement class (or
graph state orbit), whereby different combinations of Bell states or a single
GHZ state can be obtained [25]. This is illustrated in Figure 2 in the main
text.

We assign Alice, Bob-1, Charlie, Debbie, Bob-2 and Bob-3, to qubit numbers 1,
2, 3, 4, 5 and 6 respectively. To evaluate the AKR for a comparison between
QCKA techniques, we need to calculate $Q_{\text{Z}}$ and $Q_{\text{X}}$ for
each state that plays a part in the QCKA protocol. The smaller resource states
users require for QCKA are not directly obtained from the initial graph state.
Instead, necessary single-qubit operations applied to the initial graph—to
obtain the required graph—are encoded onto the measurements settings that
network users would otherwise have used. Obtaining a GHZ shared between Alice
and the Bobs in the four-photon state space, to carry out QCKA with a multi-
partite resource, Charlie and Debbie are required to make projections in the Z
basis. So for each round of measurements, whilst Charlie and Debbie should
always measure in the Z basis, Alice and the Bobs measurements are made based
on whether they want to complete a type-1 round or type-2 round of the
protocol. For example, to measure the observable
$\langle\text{Z}_{1}\text{Z}_{2}\text{Z}_{5}\text{Z}_{6}\rangle$ of the GHZ
state to evaluate the QBER, all users must measure the observable
$\langle\text{Z}_{1}\text{Z}_{2}\text{X}_{3}\text{X}_{4}\text{Z}_{5}\text{Z}_{6}\rangle$,
where the required single-qubit operations leave the default measurement
settings unchanged for Alice and the Bobs, but rotate Charlie and Debbies
measurement settings. To measure the observable
$\langle\text{X}_{1}\text{X}_{2}\text{X}_{5}\text{X}_{6}\rangle$ of the GHZ
state to obtain $Q_{\text{X}}$, all network users must measure the observable
$\langle\text{X}_{1}\text{Y}_{2}\text{X}_{3}\text{X}_{4}\text{X}_{5}\text{Y}_{6}\rangle$,
where now single-qubit operations encoded onto the measurement settings
correspond to rotations of measurements into a different basis. When Alice and
the Bobs wish to partake in QCKA with bi-partite resources, the measurement
procedure suitably follows that of the GHZ state, except now the observables
are for Bell states, and alternate single-qubit—based on required rotations
applied to the initial graph—are encoded onto these settings. Full blueprints
containing the operations applied to each qubit within each measurement set
are presented in Figure 2. The measured
$\langle\text{Z}^{\otimes\text{N}}\rangle$ and
$\langle\text{X}^{\otimes\text{N}}\rangle$ observables, where N is the qubit
number, of the three Bell states and the GHZ state used in this protocol are
presented in Figure 3.

##  Supplementary Materials

###  Supplementary Methods

Here we outline how the six-qubit graph state in the experiment is mapped from
the graph notation onto the linear optical circuit shown in Fig. 4. From the
mathematical description of a graph (Equation 6 in the Appendix of the main
text) one can see that to prepare a graph state requires $V$ qubits
initialised as $\ket{+}$ (equivalent to $\ket{\textsf{d}}$ in polarisation
encoding), connected via CZ gates between specific qubits classified by $E$.
The graph state generated in this work can be mapped onto a general circuit
model depiction which consists of six qubits initialised in $|+\rangle$ and
five CZ gates. Directly translating the circuit model depiction into an
experimentally realisable linear optical circuit leads to large
inefficiencies. Realising CZ gates with linear optics results in a low
probability of success of 1/9 per gate [42]. Instead, we found a linear
optical circuit that could produce a state equivalent to the targeted graph
state (up to local rotations) based on linear optical fusion gates, which have
a much higher probability of success of 1/2. Explicitly realising this linear
optical circuit does require some entangled resources, namely two Bell pairs
as well as a pair of separable photons. Three linear optical fusion gates are
then used to generate multi-photon entanglement, producing the desired state.
Finding the translation to a linear optical circuit enabled the investigation
in this work, as the general circuit model approach carries a probability of
success of 1/59,049. Our arrangement has a probability of success of 1/8.

Figure 4: Graph representation and its realisation. The 6 qubit graph state in
our experiment is shown in the left panel. This can be translated into a
generalised quantum circuit depicted in the middle panel. Our setup, which is
more experimentally friendly in linear optics, is shown in the right panel.
Notably we employ Bell states, $|\Phi^{+}\rangle$ and replace the two-qubit CZ
gates with fusion gates. Additional single qubit operations, Hadamard and
Pauli-Z gates are needed to correct the final state.

We generate photon pairs using type-II parametric down-conversion (PDC)
sources that operate in the filter-less regime, owed to the fact we employ
domain engineering techniques to modify the phase-matching function (PMF) of
the down-conversion process. Despite our aperiodically poled KTP (aKTP)
crystals operating without filters, two-photon interference visibilities of up
to $98.6\pm 1.1\%$ are still obtainable, meaning we carry forward minimal
errors after any instances of two-photon interference. Without lossy spectral
filters we can also access heralding efficiencies of up to $67.5\%$ [40].

We use a pulsed Ti:saphh laser with a central wavelength of 774.9nm producing
photon pairs in a degenerate condition at 1549.8nm. These wavelengths were
chosen to keep the crystal temperatures sufficiently far away from room
temperature. This laser operates with a pulse duration of 1.3ps, matching the
pump-envelope function (PEF) bandwidth to the PMF bandwidth at a repetition
rate of 80MHz.

For generating Bell states, we place our PDC sources inside a Sagnac
interferometer, where a pump photon generates signal and idler pairs in either
a clockwise or anti-clockwise direction depending on the polarisation state of
the pump photon. When the pump photon is equally likely to produce photons in
the clockwise direction and the anti-clockwise direction an entangled state is
generated. This configuration explicitly consists of a Glan-Taylor prism,
which ensures the pump is in a linear polarisation state followed by a HWP
which rotates this linear polarisation state into $\ket{\textsf{d}}$ for
generating an entangled state, or a linear basis state for generating a
separable state. After the pump polarisation state is prepared, it is
transmitted through a dichroic mirror (DM) which only reflects the down
converted photons propagating back towards the pump. The pump is then
probabilistically split on a dual-wavelength polarising beam-splitter (dPBS)
into transmitted or reflected spatial modes. In the transmitted mode, the pump
photon is in the $\ket{\textsf{h}_{p}}$ polarisation state and will generate
signal and idler pairs in a clockwise direction. In the reflected mode, the
pump photon is rotated from $\ket{\textsf{v}_{p}}$ into $\ket{\textsf{h}_{p}}$
by a dual-wavelength HWP (dHWP) to facilitate type-II PDC in the anti-
clockwise direction. When photons are generated from a pump photon in the
transmitted mode of the dPBS, the down-converted pair are each rotated by the
dHWP, which acts to fix the temporal offset the different set of photon pairs
possess, before being split by the dPBS and collected into SMFs [41]. Upon
collection, the signal and idler pairs exist in a maximally entangled state

$\ket{\Psi^{-}}=\frac{1}{\sqrt{2}}\ket{\textsf{h}_{s}\textsf{v}_{i}}-e^{i\phi}\ket{\textsf{v}_{s}\textsf{h}_{i}}.$

Figure 5: Generating and manipulating the 6-photon graph state. We prepare the
6-photon graph state using photon-pair sources and a linear optics scheme. Two
of the sources are prepared in the Bell state, $|\Phi^{+}\rangle$, while the
third is in a biseparable state with each photon in $|+\rangle$ as shown in
the green region. Using three Fusion gates and single-qubit rotations one
arrives at the 6-photon graph state, up to a set of local rotations, as shown
in the red region. The set of graph transformations for obtaining the 4-qubit
GHZ state, in modes $\\{1,2,5,6\\}$, is shown in the two-tone orange shaded
regions. Notably these consist of local operations and quantum measurements on
non-participatory qubits $\\{3,4\\}$ in the Z basis.

To generate the six-photon state presented in this work, we prepare two Bell
states as $\ket{\Phi^{+}}$ (which are equivalent to $\ket{\Psi^{-}}$ up to
local rotations) in modes $\\{1,2\\}$ and $\\{5,6\\}$ and a single separable
state prepared as $\ket{\textsf{dd}}$ in modes $\\{3,4\\}$. We employ linear
plate polarisers (LPPs) to prepare the state $\ket{\textsf{dd}}$. The required
unitaries for Bell state preparation are performed with manual fibre
polarisation controllers (FPCs). These unitaries act between the sources and
fusion gates. The fusion gates consist of imposing two input optical modes,
launched from SMFs, onto a PBS. Each output modes of the PBS are then
collected into SMFs. A successful fusion operation occurs when there is one
and only one photon in each output optical mode. This means that for the full
circuit to be successful, only a single photon should be in the six optical
modes after the three fusion gates. Within each fusion gate there are
additional optics to correct for the local phase that the PBS within each of
these gates introduces. The correction optics are made up of a HWP sandwiched
between two QWPs. Fusion gate 1 ($F1$) acts between modes $\\{2,3\\}$, fusion
gate 2 ($F2$) between $\\{4,5\\}$ and finally, fusion gate 3 ($F3$) acts
between one of the outputs of both $F1$ and $F2$, in modes $\\{3,4\\}$. The
only difference between these gates is the presence of an additional HWP, just
before the PBS within $F3$, which is present to apply a single-qubit Hadamard
gate. Final FPCs situated directly after the fusion gates ensure that photons
undergo an identity operation between the fusion gates and measurement. Only
the detection of a six-fold event (six photons arriving individually across
all six optical modes comprised of daughter PDC photons created from the same
pump pulse train) heralds the success of all three fusion gates, even in our
case where the outputs of $F1$ and $F2$ feed directly into the input of $F3$.

The final part of the circuit is comprised of measurement stages which consist
of a QWP, HWP and PBS. These stages perform projective measurements. The
measured photons are detected using superconducting nano-wire single photon
detectors that operate at quantum efficiencies $>80\%$ at our wavelengths.
Detection events are processed by time-tagging logic. A full schematic of the
experimental arrangement can be seen in Figure 6.

Figure 6: Experimental layout. Highlighted in green are the sources, linear
optical Fusion gates are in red and polarisation projective measurement stages
in orange. Each source consists of an aKTP crystal, pumped by a Ti-Sapph laser
and embedded in a Sagnac loop with a HWP to set the pump direction. Note only
sources $\\{S1,S3\\}$ are entangled while $S2$ is pumped in one direction to
produce biseparable states. Each photon is coupled into single-mode fibre with
fibre polarisation controllers (PFC) used to set the desired polarisation
states entering the Fusion gates $\\{F1,F2\\}$. Additionally, photons from
$S2$ are sent through linear plate polarisers (LPP) to initialise their states
in $|+\rangle$. Each Fusion gate comprises of two input optical modes which
overlap on a polarising beam splitter (PBS) and successful operation of the
two-qubit gate is conditional on one photon in each output mode. In each
Fusion gate a HWP sandwiched by two quarter-wave plates (QWP) is used to
compensate local phase shifts introduced by the PBS. In the final Fusion gate
$F3$, two HWPs are used to apply the single-qubit Hadamard gates. The
remaining single-qubit gates are determined by the protocol and implemented in
the projective measurement stages on each qubit which consist of a QWP, HWP
and PBS. Single photons are detected using superconducting nanowire single
photon detectors (SNSPDs).

All rotations required to allow Alice and Bobs to share different resource
states among them are encoded onto the measurement settings. Figure 5 is an
example of the experimental arrangement for a round in which Alice and the
Bobs wish to share a GHZ state. The single-qubit operations acting on each
mode after the creation of the resource state, highlighted in yellow and
orange within Figure 5, are applied to each qubit upon measurement, meaning
that each user is provided with measurement settings required to extract
different states from the shared network resource state. In this way,
entanglement amongst a subset of the six network users can be allocated in a
dynamic way. To determine the correct measurements users have to perform, we
first decide which type of measurement round being performed, either type-1 or
type-2. For both measurement types we already know that Charlie and Debbie,
modes {3,4}, are required to measure in the Z-basis, so operations on their
qubits are encoded onto their measurement basis. Settings on Alice and Bobs
qubits, or modes {1,2,5,6}, do depend on which type of round is being
performed. If a type-1 round is taking place, then their starting measurement
basis is Z, and the single qubit operations on that mode are applied to rotate
(or leave unchanged) this measurement basis. Likewise for type-2 rounds.
Hence, as shown in the Appendix section, the measurement
$\langle\text{Z}_{1}\text{Z}_{2}\text{Z}_{3}\text{Z}_{4}\text{Z}_{5}\text{Z}_{6}\rangle$
to complete a type-1 round actually requires the measurement
$\langle\text{Z}_{1}\text{Z}_{2}\text{X}_{3}\text{X}_{4}\text{Z}_{5}\text{Z}_{6}\rangle$
after rotation have been applied, and the measurement
$\langle\text{X}_{1}\text{X}_{2}\text{Z}_{3}\text{Z}_{4}\text{X}_{5}\text{X}_{6}\rangle$
becomes
$\langle\text{X}_{1}\text{Y}_{2}\text{X}_{3}\text{X}_{4}\text{X}_{5}\text{Y}_{6}\rangle$.
As a consequence of the GME implicit of the shared network resource state,
whenever Charlie and Debbie perform a measurement they need to disentangle
themselves from the system coherently. When Charlie and Debbie measurements
are in the X basis (due to rotations), they can attain either 0 or 1 as their
result. The resulting GHZ may contain a local phase rotation conditioned on
the outcomes of Charlie and Debbie. This rotation must be corrected for and is
done so in a post-processing step.

The work contained within this manuscript focuses on an investigation into a
network protocol, where the particular scenario demands the distribution of a
GHZ and a number of Bell states to specific users. For the determining how to
obtain states, we use a software library which can manipulate graph states
based on available experimental transformations. This lets us form a search of
available smaller resource states a given graph can produce. The search is
brute-force, emanating from the fact that transforming graphs, or more
generally stabilizer states, into tensor products of bipartite Bell pairs, or
just a set of Bell pairs between specific vertices, using only a certain class
of local operations and classical communication is a $\mathds{NP}$-complete
problem [43]. Likewise for GHZ state distillation from arbitrary graphs, if we
wish to arrive at a GHZ state between a specific set of vertices [44] or if we
require a GHZ state of fixed size [45], the task is $\mathds{NP}$-complete.

Figure 7: AKR, raw photon generation rate and key generation rate as a
function of the pump power. Multi-photon generation rate from a PDC source is
not linear with respect to the amount of optical pump power applied to the
non-linear crystal. The benefit of having higher pump powers is a larger
N-fold generation rate. A caveat to this relationship is the additional noise
generated by the presence of $>\text{N}$ photons consequential of the
probabilistic nature of the PDC sources. (a) Shows how the AKR becomes worse
as the pump power increases, a direct result of the additional noise present
when higher order photon pairs are produced. (b) The N-fold generation rate
however, follows a cubic increase. This means that although the noise increses
as a function of power, the generation rate increases quicker than the noise
decreases. (c) The key generation rate is a product of both the AKR and the
generation rate, revealing that for the experimental parameters contained
within this work, the ideal pump power is $\sim 105$mW in order to obtain the
highest key generation rate with an NQKD appraoch to QCKA.

###  Supplementary Results

Assessing the performance of the protocol at a variety of different six-photon
generation rates, reveals how the rates scale with noise. The main source of
noise that degrades the quality of the prepared state is from higher order
photon pair emissions due to the probabilistic nature of PDC sources. Even
whilst operating with a post-selection criteria, higher order emission events
can trigger detection patterns identical to that of the signal. These higher
order emission terms result in a reduction to the magnitude of coherence, as
events from incorrect pair generation events interfere with signal photons and
degrade the purity of the state. The relation between the overall noise and
the AKR is not trivial, partly due to the fact noise is not symmetrically
distributed across the quantum state. This is evidenced by the different QBER
and $Q_{\text{X}}$ for each of the Bell states derived from the same resource
state. To attain the highest possible key generation rate, a power dependence
measurement is required. This will reveal the ideal power to operate the
protocol at. By computing the product of the AKR, which will fall with respect
to an increase in pump power, and the raw photon generation rate, which will
increase as a function of the pump power, the key generation rate can be
calculated. Figure 7 presents the scaling of AKR, generation rate and
ultimately the key generation rate as a function of pump power, revealing that
the highest key generation rate is at $\sim$105mW.

###  Supplementary Discussion

We remark that owing to the non-deterministic operation of the fusion gates
and photon sources in this experiment, all six users must detect a single
photon in their measurement stages to obtain the correct graph state. It would
be an interesting prospect to determine whether this graph state inherits any
loss robustness for the purposes of QCKA, or indeed other applications when
deterministic sources and gates are used to generate them. Starting form
$\ket{\textsf{G}}_{\text{initial}}$, to achieve two Bell states between
$\\{1,2\\}$ and $\\{5,6\\}$ all that is required—in principle—is a single Z
basis measurement on qubit 4, tolerating the loss of qubit 3 and still
adhering to the graph state formalism.

Figure 8: Ring graph state and the operations required to obtain smaller
network resource states. The ring graph can be used in a similar means to
$\ket{\textsf{G}}_{\text{initial}}$ to compare the key rates of different
approaches to QCKA. Four users—in this illustration {1,3,4,6}—are designated
as the network users. These four users can attain pair-wise correlations with
each other upon the application of Z measurements or X measurements by the two
remaining users. To obtain a GHZ state, local complementation operations are
required, followed by the application of Z measurements, again performed by
the non-participating members of the communication protocol.

In this work, we chose to generate the resource graph state
$\ket{\textsf{G}}_{\text{initial}}$ based on its accessibility with
probabilistic photon sources and linear optical components. If we had
generated a N qubit GHZ state and distributed this amongst network users, the
rate advantage for NQKD scales as $\text{N}-1$. We however, showed a rate
advantage for the NQKD approach which did not scale as $\text{N}-1$, but a
rate advantage of a factor of two, due to the ability to multi-cast Bell pairs
from the shared resource state. Interestingly, there are families of graph
states where the rate advantage can be reduced even further. In a similar
scenario to the work in the main text, the ring graph is capable of
distributing a GHZ state and Bell states to network users. Using the ring
graph as a network resources can allow users to cast pairs of Bell states in
every round, differing from the graph used for investigations within this
work. Because of this, there is more contribution to the overall key per
network usage due to more pair-wise key distribution within the 2QKD rounds.
Figure 8 shows the operations required to obtain smaller network resources
from the ring graph state. Like in the main text, all operations are either
local rotations or single-qubit projection measurements.