Experimental Investigation of High-Dimensional Quantum Key Distribution Protocols with Twisted Photons

Home , Mutually unbiased bases, Quantum cloning

Experimental investigation of high-dimensional quantum key distribution protocols with twisted photons

Frédéric Bouchard1, Khabat Heshami2, Duncan England2, Robert Fickler1, Robert W. Boyd1 3 4, Berthold-Georg Englert5 6 7, Luis L. Sánchez-Soto3 8, and Ebrahim Karimi1 3 9

1Department of physics, University of Ottawa, Advanced Research Complex, 25 Templeton, Ottawa ON Canada, K1N 6N5 2National Research Council of Canada, 100 Sussex Drive, Ottawa ON Canada, K1A 0R6 3Max-Planck-Institut für die Physik des Lichts, Staudtstraße 2, 91058 Erlangen, Germany 4Institute of Optics, University of Rochester, Rochester, NY 14627, USA 5Centre for Quantum Technologies, National University of Singapore, 3 Science Drive 2, Singapore 117543, Singapore 6Department of Physics, National University of Singapore, 2 Science Drive 3, Singapore 117542, Singapore. 7MajuLab, CNRS-UNS-NUS-NTU International Joint Unit, UMI 3654, Singapore. 8Departamento de Óptica, Facultad de Física, Universidad Complutense, 28040 Madrid, Spain 9Department of Physics, Institute for Advanced Studies in Basic Sciences, 45137-66731 Zanjan, Iran. November 30, 2018

Quantum key distribution is on the verge 1 Introduction of real world applications, where perfectly secure information can be distributed Quantum cryptography allows for the broadcast- among multiple parties. Several quantum ing of information between multiple parties in cryptographic protocols have been theo- a perfectly secure manner under the sole as- retically proposed and independently real- sumption that the laws of quantum physics are ized in diﬀerent experimental conditions. valid [1]. Quantum Key Distribution (QKD) [2, Here, we develop an experimental plat- 3] is arguably the most well-known and studied form based on high-dimensional orbital an- quantum cryptographic protocol to date. Other gular momentum states of single photons examples are quantum money [4] and quantum that enables implementation of multiple secret sharing [5]. In QKD schemes, two par- quantum key distribution protocols with a ties, conventionally referred to as Alice and Bob, single experimental apparatus. Our versa- exchange carriers of quantum information, typi- tile approach allows us to experimentally cally photons, in an untrusted quantum channel. survey diﬀerent classes of quantum key An adversary, known as Eve, is granted full ac- distribution techniques, such as the 1984 cess to the quantum channel in order to eaves- Bennett & Brassard (BB84), tomographic drop on Alice and Bob’s shared information. It is protocols including the six-state and the also assumed that Eve is only limited by the laws Singapore protocol, and to investigate, for

arXiv:1802.05773v3 [quant-ph] 29 Nov 2018 of physics and has access to all potential future the first time, a recently introduced differ- technologies to her advantage, including opti- ential phase shift (Chau15) protocol using mal cloning machines [6], quantum memories [7], twisted photons. This enables us to ex- quantum non-demolition measurement appara- perimentally compare the performance of tus [8], and full control over the shared photons. these techniques and discuss their benefits In particular, the presence of Eve is revealed to and deficiencies in terms of noise tolerance Alice and Bob in the form of noises in the channel. in different dimensions. It is the goal of QKD to design protocols for which secure information may be transmitted even in Frédéric Bouchard: [email protected] the presence of noises [9]. For quantum chan- Ebrahim Karimi: [email protected] nels with high levels of noises, it has been rec-

Accepted in Quantum 2018-11-27, click title to verify 1 ognized that high-dimensional states of photons QKD protocol relies on the uncertainty principle, constitute a promising avenue for QKD schemes, since a measurement by Eve in the wrong ba- due to their potential increase in noise tolerance sis will not yield any useful information for her- with larger encrypting alphabet [10, 11]. How- self. However, this also means that half of the ever, this improvement comes at the cost of gen- time, Alice and Bob will perform their genera- erating and detecting complex high-dimensional tion/detection in the wrong basis. This is known superpositions of states, which may be a difficult as sifting: Alice and Bob will publicly declare task. their choices of bases for every photon sent and Orbital angular momentum (OAM) states are only when their bases match will they keep their associated with helical phase fronts for which a shared key. On average, Alice and Bob will only quantized angular momentum value of `¯h along use half of their bits in their shared sifted key. the photons propagation direction can be as- Nevertheless, in the infinite key limit, the sift- cribed, where ` is an integer and ¯h is the reduced ing efficiency of several protocols, such as the Planck constant [12]. Any arbitrary superposi- BB84 and the six-state protocol, can approach tion of OAM states can be straightforwardly re- 1, by making the basis choice extremely asym- alized by imprinting the appropriate transverse metric [34]. In addition to sifting, Alice and phase and intensity profile on an optical beam, Bob’s shared key will be further reduced in size which is typically done by displaying a hologram at the final stage of the protocol when performing onto a spatial light modulator (SLM) [13, 14, 15]. error correction (EC) and privacy amplification OAM-carrying photons, also known as twisted (PA) [9]. In the case of BB84 in dimension 2, the photons, have been recognized to constitute use- number of bits of secret key established per sifted ful carriers of high-dimensional quantum states photon, defined here as the secret key rate R, is for quantum cryptography [16, 17, 18], quan- given by the following expression, tum communication [19, 20, 21, 22] and quantum information processing [23, 24, 25, 26, 27]. R = 1 − 2h(eb), (1) The flexibility in preparation and measurement of twisted-photon states enables us to create and where eb is the quantum bit error rate (QBER) use a single experimental setup for implement- and h(x) := −x log2(x) − (1 − x) log2(1 − x) is ing several QKD protocols that offer different the Shannon entropy. From this equation, we advantages, such as efficiency in secure bit rate find that the secret key rate becomes negative per photon or noise tolerance for operation over for eb > 0.11. Hence, if Alice and Bob only have noisy quantum channels. Here, we use OAM access to a quantum channel with a QBER larger states of photons to perform and compare high- than 0.11 to perform the BB84 protocol, they dimensional QKD protocols such as the 2-, 4- will not be able to establish a secure key regard- and 8-dimensional BB84 [2], tomographic proto- less of sifting and losses. Due to this limitation, cols [28, 29, 30] using mutually unbiased bases it has been the goal of many research efforts to (MUB) [31] and Symmetric Informationally Com- come up with QKD protocols that are more error plete (SIC) Positive Operator-Valued Measures tolerant. One of the first proposed QKD proto- (POVMs) [32], and, for the first time, the 4- and cols that was aimed at extending the 0.11-QBER 8-dimensional Chau15 protocols using twisted threshold, is the so-called six-state protocol [28]. photons. We finally demonstrate applications The six-state protocol is an extension of the BB84 in full characterization of the quantum channel in dimension 2, where all three MUB are used. through quantum process tomography [33]. Indeed, it is known that in dimension 2, there exists precisely 3 MUB. In the general case of a d-dimensional state space, the number of MUB is 2 Theoretical background (d + 1), given that d is a power of a prime number [31]. Moreover, it is known that there exist Let us first start by briefly reviewing the BB84 at least three MUB for any dimension [31] such protocol, which was introduced in 1984 by Ben- that these 3 MUB can be used to increase error nett and Brassard [2]. In this protocol, Alice uses thresholds in dimensions which are not a power qubits to share a bit of information (0 or 1) with of a prime number [35, 36]. Of course, this has Bob, while using two different MUB [31]. This the drawback of decreasing the efficiency of ob-

Accepted in Quantum 2018-11-27, click title to verify 2 taining sifted data from 1/2 to 1/3. Nevertheless, and Ekert [41], respectively. Moreover, this QKD by simply adding another basis to the encoding protocol may also be extended to higher dimen- measurement scheme, the QBER threshold now sions [42] with the major advantage that the SIC- increases to 0.126, as can be deduced from the POVMs are believed to exist for all dimensions, secret key rate of the six-state protocol [28] including those that are not powers of prime numbers, contrary to MUB. 3 3 R = 1 − h e − e log (3). (2) 2 b 2 b 2

Another avenue to increase error tolerability in Another class of QKD protocols using qu- QKD is to use high-dimensional quantum states, dits has recently been introduced, in which qu- also known as qudits [37]. This may be intu- dits are used to encode a single bit of informa- itively understood from the fact that the pres- tion. Although, such protocols primarily benefits ence of an optimal cloning attack leads to larger from one of the advantages mentioned earlier, i.e. signal disturbance in higher-dimensional QKD an increase in the QBER threshold, they have schemes [11, 38]. The BB84 protocol may be ex- proven to be interesting and advantageous due to tended here by using qudits. The adoption of a simplified generation and measurement of the high-dimensional quantum systems has two dis- states. Their main drawback is the fact that at tinct benefits: (i) an increase of the error-free key a null QBER, the key rate per sifted photons is rate per sifted photons to a value of R = log2(d); never larger than R = 1. An example of such (ii) an increase in the maximum tolerable QBER, a protocol is the Differential Phase Shift (DPS) i.e. the error threshold for R = 0. For the simple QKD protocol [43]. The information is encoded case of a d-dimensional BB84 protocol, the secret by Alice in the relative phase of a superposition key rate is given by [39], of all states then sent over the quantum chan-

(d) nel. Bob may then measure the relative phase by R = log2(d) − 2h (eb), (3) detection of the different phases using an interfer- ometric apparatus. In particular, the advantage where h(d)(x) := −x log (x/(d − 1)) − (1 − 2 of the 3-dimensional DPS scheme is in the higher x) log (1 − x) is the d-dimensional Shannon en- 2 sifting efficiency in comparison to BB84 in the tropy. Furthermore, it is also possible to extend finite key limit. An extension of the DPS pro- the six-state protocol to higher dimensions by em- tocol is the Round-Robin Differential Phase Shift ploying all (d + 1) MUB, assuming that d is a (RRDPS) protocol [44] where Bob’s interferomet- power of a prime number, where the secret key ric apparatus is slightly modified. This modifica- rate is given by, tion results in a bound on Eve’s leaked informa- d + 1 d + 1 tion removing the need to monitor signal distur- R = log (d)−h(d) e − e log (d+1). 2 d b d b 2 bance (QBER) for performing privacy amplifica- (4) tion. Nevertheless, the qudits employed in the This type of QKD scheme is also known as RRDPS QKD protocol consist of a superposition tomographic QKD [29, 30], where all measure- of d states, which may pose some practical limi- ments, including the sifted ones, are used to per- tations in experimental implementations as d be- form quantum state tomography (QST). In par- comes larger. However, the RRDPS scheme has ticular, MUB are closely related to the problem recently been demonstrated experimentally using of quantum state tomography, where projections twisted photons [45]. The recently introduced over all the states of every MUB, although re- Chau15 protocol [46, 47] addresses this problem dundant, yields a full reconstruction of the state’s as it uses “qubit-like” superpositions where only density matrix [40]. Following similar ideas, the two states of the d-dimensional space are em- Singapore protocol has been proposed using SIC- ployed. More specifically, the information is en- POVMs [30], as they are known to be the most coded in the relative phase of a qubit-like state ± √ efficient measurements to perform QST. The Sin- of the form |φiji = (|ii ± |ji)/ 2 with states in gapore protocol may be equivalently performed in a 2n-dimensional Hilbert space with n ≥ 2. This a prepare-and-measure or an entanglement-based protocol will be explained in more details in the scheme, similar to the analogy between BB84 discussion section.

Accepted in Quantum 2018-11-27, click title to verify 3 a b SLM-A Alice 21.0⇡ ± | 01i 0.8 02± BBO Bob | i 355nm IF ± 0.6 | 03i KE D1 SLM-B ± IF IF | 12i 0.4

13± | i 0.2 Coincidence D2 ± | 23i 00

Figure 1: (a) Simplified experimental setup. Alice generates pairs of single photons using spontaneous parametric downconversion in a type-I β-barium borate (BBO) crystal. The pump wavelength (355 nm) is filtered using an interference filter (IF) and the photons are separated using a knife edge (KE) in the far-field of the crystal. The spatial modes of the photon pairs are filtered using single mode optical fibres making the photons completely separable. Alice imprints a state onto her signal photon using a holographic technique by means of a spatial light modulator (SLM-A). The photon is then sent to Bob through the quantum channel. Bob measures the photon’s state using a phase flattening technique with his SLM-B followed by a single mode optical fibre. Moreover, Alice locally measures the idler photon and sends timing information to Bob via an electric signal over the classical channel. Our experimental configuration allows us to test different protocols by changing the holograms displayed on the SLMs using the same experimental apparatus without intermediate adjustments. Thus, we are able to compare the different strategies in a systematic manner. (b) States employed in the Chau15 (N = 4) protocol. The phase (Hue colour) is shown modulated by the intensity profile of the beam. .

3 Experimental setup of 70 %. The OAM states are produced using a phase-only holography technique [14]. Due to the versatility of SLMs, any OAM superposition We implement a prepare-and-measure QKD states of single photons may be produced, hence scheme at the single-photon level using the OAM covering a large possibility of QKD schemes. Al- degree of freedom of photons, see Fig.1 (a). ice’s heralded photon is subsequently sent over The single photon pairs, namely signal and idler, the untrusted quantum channel. Upon reception are generated by spontaneous parametric down- of the photon, Bob uses his SLM-B followed by a conversion (SPDC) at a type I β-barium borate SMF to perform a projection over the appropri- (BBO) crystal. The nonlinear crystal is pumped ate states for a given protocol. In order to do so, by a quasi-continuous wave ultraviolet laser op- Bob uses the phase-flattening technique to mea- erating at a wavelength of 355 nm. The gen- sure OAM states of light [48, 49]. If the incoming erated photon pairs are coupled to single-mode photon carried the OAM mode corresponding to optical fibres (SMF) in order to filter their spa- Bob’s projection, the phase of the mode is flat- tial modes to the fundamental mode; i.e., Gaus- tened and the photon will couple to the SMF. sian. Following the SMF, a coincidence rate of This verification-type measurements can further 30 kHz is measured within a coincidence time reduce the sifting rate, unless the protocols re- window of 2 ns. The heralded signal photon is quires only a binary measurement and “no-click” sent onto SLM-A corresponding to Alice’s gener- events are included. Coincidences are recorded ation stage. The SLM (X10468-07, Hamamatsu) using single photon detectors (ID120-500-800nm, are electronically controlled nematic liquid crys- ID Quantique) with a dark count rate of less than tal devices with 792 × 600 pixels, a refresh rate 50 Hz and a measured deadtime of approximately of 60 Hz and a diffraction efficiency in excess

Accepted in Quantum 2018-11-27, click title to verify 4 400 ns. For an integration time of 10 s and a a d =4 b d =8 11.0 coincidence time window of 2 ns, approximately

14,000 coincidences are recorded when both SLM- } } i i

A and SLM-B are set to the same mode. This cor- =4 =8 0.8 d ij d ij Theory

responds to a transmission of approximately 5 %. {| {| Finally, in order to evaluate the single photon na- 0.6 ture of the SPDC source, we build a Hanbury- d=4 d=8 {h ij |} {h ij |} Brown and Twiss interferometer in order to mea- c d 0.5 (2) sure the degree of second-order coherence g (0) 0.4 for our single photon source in a three-detector } } measurement conﬁguration. The signal photon is i i =4 =8

d ij d ij 0.2 sent to a beam splitter and subsequently mea- {| {| sured at both output ports of the beam split- Experiment ter, i.e. detectors A and B, while the idler pho- 00 d=4 d=8 ton is measured directly at detector C. The ex- {h ij |} {h ij |} perimentally determined second-order coherence (2) Figure 2: Results for the Chau15 protocol. (a)- is given by g (0) = (NABC NC )/(NAC NBC ), (b) Theoretical probability-of-detection matrices for the where NABC is the three-fold coincidence rate Chau15 protocol in dimension d = 4 and d = ± among detectors A, B and C, NC is the single 8, respectively. Rows are given by states |φiji ∈ + − + − count rate at detector C, NAC is the coincidence {|φ1,2i, |φ1,2i, |φ1,3i, ..., |φ3,4i} sent by Alice, whereas ± rate between detector A and C and NBC is the columns corresponds to sate projections, hφij|, by coincidence rate between B and C. We obtained Bob. (c)-(d) Experimentally measured probability-of- an experimental value of g(2)(0) = 0.015 ± 0.004, detection matrices for the Chau15 protocol in dimen- where the experimental uncertainty is calculated sion d = 4 and d = 8. The sifted data corresponds assuming Poissonian statistics. For the case of to the on-diagonal 2 × 2 blocks. The remaining of the probability-of-detection matrix may be used to evaluate BB84, the knowledge of the g(2)(0) and the effi- the dit error rate. ciency of the source is sufficient to characterize the effect of multiphoton events on the secret key rate [50]. Following the analysis of [51], the secret key rate given in Eq.1 becomes: 4 Results and Discussion

4.1 Chau15 protocol e R = (1 − ∆) 1 − h b − h (e ) , (5) 1 − ∆ b At first, we perform the recently introduced Chau15 protocol, which is a qudit-based prepare- and-measure QKD scheme, where information is where ∆ = Pm/Q is the multiphoton rate, encoded in a qubit-like state of the form |φ±i = Pm = 1−P0−P1 is the probability of having more √ ij P∞ n than one photon in a pulse, Q = n=0 YnPn is (|ii ± |ji)/ 2 with states in a 2 -dimensional the gain, Yn is the yield of an n-photon signal Hilbert space with n ≥ 2; see [46, 47, 52]. The and Pn is the probability of having n photons in protocol starts with Alice randomly selecting i, a pulse. The probability of creating a multipho- j, and s, where {i, j} ∈ GF(d = 2n), GF(d) be- (2) ton state, Pm, is upper bounded by g (0), i.e. ing the Galois field, and s = ±1. Then, Alice√ 2 (2) s Pm ≤ µ g (0)/2, where µ is the mean photon prepares and sends the state (|ii + (−1) |ji) / 2 number in a pulse. From the experimental pa- over an untrusted channel to Bob. Upon recep- 0 0 0 rameters mentioned above, we obtain a gain, a tion, Bob randomly selects i , j 6= i ∈√GF(d) mean photon number, and a multiphoton rate of and measures the state along (|i0i ± |j0i)/ 2. By Q = 10−5, µ = 3 × 10−4, and ∆ = 4 × 10−5, re- announcing (i, j) and (i0, j0) through a classical spectively, which will have a negligible effect on channel, Alice and Bob can establish a raw bit the secret key rate. For instance, in the case of sequence (key) from those events where (i, j) = BB84 in dimension 2, the secret key rate consider- (i0, j0) and by keeping a record of s. ing multiphoton events is reduced by an amount As discussed in [47], the performance of the on the order of 10−5 bits per sifted photon. scheme can be assessed through two sets of pa-

Accepted in Quantum 2018-11-27, click title to verify 5 rameters. The first is the bit error rate of the ilar error sources, e.g. misalignment, turbulence sifted raw key (eraw). The second is the aver- or optical aberration. However, for other kinds age bit error rate and the average dit error rate of high-dimensional states of light, such as time- associated with mismatch between preparation bins, the distinction between bit and dit error and measurement basis states. The average bit rates is less ambiguous and the Chau15 may then and dit error rates are estimated by averaging be used to its full potential. probabilities of the qudit states undergoing oper- ations of XuZv in the insecure quantum channel, Tr(vi) 4.2 BB84 protocol where Xu|ii = |i + ui, Zv|ii = (−1) |ii, and Tr(i) = i + i2 + i4 + ... + id/2; see [47] for more We now go on to compare the new Chau15 scheme details. These parameters can be extracted from to established protocols. The same experimen- the experimental joint probability measurements. tal setup is used at first to perform the BB84 (2 Alice and Bob respectively prepare and measure MUB) protocol in dimension d = 2, 4 and 8. In ± √ |φiji = (|ii ± |ji)/ 2, where |ii and |ji (i 6= j) the BB84 protocols, the first basis is given by the are pure OAM states in a Hilbert space of dimen- logical pure OAM basis, i.e. |ψii ∈ {−d/2, ...d/2} sion d = 4, 8, see Fig.1 (b). Using the OAM, and the second basis is given by the Fourier basis Alice and Bob choose i, j ∈ {` = −2, −1, 1, 2} for where the states are obtained from the discrete d = 4 and i, j ∈ {` = −4, −3, −2, −1, 1, 2, 3, 4} Fourier transform, |φ i = √1 Pd−1 ωij|ψ i, with i d j=0 d i for d = 8, where the ` = 0 state has been omit- ωd = exp(i2π/d). The explicit form of the other ted to make the states symmetric. In Fig.2, we MUB may be found elsewhere [31]. Although this show theoretical and experimental probability-of- works only for prime dimensions, it can be easily detection matrices obtained from a Chau15 QKD extended to composite dimensions. For the BB84 protocol for the cases of d = 4 and d = 8. Af- d=2 protocol, values of the QBER of eb = 0.628 %, ter sifting, Alice and Bob are left with the on- d=4 d=8 eb = 3.51 % and eb = 10.9 % were ob- diagonal 2×2 blocks of the presented probability- tained in dimension 2, 4 and 8, respectively cor- of-detection matrices. responding to secure key rates of Rd=2 = 0.8901, d=4 d=8 In the case of d = 4, we obtained an average R = 1.4500 and R = 1.3942. In the low- bit error rate of e(d=4) = 0.778 %, and average error case, the BB84 scheme performs very well. b This is partly due to the fact that the sifting, i.e. dit error rate e(d=4) = 3.79 %. This results in an d 1/2, is independent of dimensionality in the fi- asymptotic secure key rate of R(d=4) = 0.8170 bit nite key limit. Interestingly, the BB84 protocol per sifted photon. For the case of d = 8, we ob- performs better in dimension 4 than it does in di- tained experimental values for the average bit er- mension 8. Hence, although in the error-free case, ror rate, average dit error rate and asymptotic se- (d=8) (d=8) larger dimensions result in larger secure key rates, cure key rate of eb = 3.11 %, ed = 0.82 % this is not necessarily the case in experimen- (d=8) and R = 0.8172, respectively. Note that the tal implementations, due to more complex gen- probability of obtaining sifted data in the Chau15 erations and detections of the high-dimensional 2 protocol is given by 2/(d − d) compared to the OAM states. The nature of the quantum chan- fixed sifting rate of 1/2 for the BB84 protocols nel may also dictate the optimal dimensionality in all dimensions. As we will see in the following of the protocol [53]. sections, the Chau15 protocol does not perform well in the low-error case compared with other QKD protocols. Moreover, the unfavourable scal- 4.3 Tomographic protocols ing of the sifting with dimensionality greatly af- 4.3.1 MUB-based protocol fects the overall secure key rate (sifting included) in the finite key limit. Hence, the advantage of The six-state protocol in dimension d = 2 is an the Chau15 scheme is in the high-error scenario. extension of the BB84 protocol where all exist- In particular, given a small enough dit error rate, ing MUB are considered. The protocol can be max bit error rates of up to eb = 50 % may be toler- extended to higher dimensions (powers of prime ated. In the case of OAM states of light, this does numbers) where all (d + 1) MUB are considered. not represent a clear advantage since bit and dit In dimension 2 and 4, we obtained a QBER of d=2,m=3 d=4,m=5 error rates will, in general, be the result of sim- eb = 0.923 % and eb = 3.87 %

Accepted in Quantum 2018-11-27, click title to verify 6 c d =8 2πi/d 1 1.0 2 and ωd = e . The ﬁducial vectors |fi = 'i '0 P |h | i0 i| have been derived numerically and an- |} 0.8 =8 d i

alytically for diﬀerent dimensions [32]. h { 0.6 b d =4 The ﬁducial vector is found such that 0.5 |} ˆ

0.4 =4 |ψjki = {Djk|fi, j, k = 0...d − 1} are normalized d i

|} a d =2 h 2 { states satisfying |hψ |ψ 0 0 i| = 1/(d + 1) for =8 jk j k d i |} 0.2

h 0 0 2 =2 |} { d =4 j 6= j and k 6= k . This set of d states are i d i

h h { { 0 =2 |} 0 d d=4 d=4 d=8 d=8 then used by Alice and Bob in the prepare-and- i } } i i =2 i =2 i i i h d d {| i} {| i} {| i} {| i} { i i measure Singapore protocol. In dimension 2, the {| {| SIC POVMs are explicitly given by Figure 3: BB84 protocol. (a)-(c) Experimentally measured probability-of-detection matrices for the BB84 protocol in dimension d = 2, 4 and 8, respectively. The rows |ψ0,0i = (0.888|0i + 0.325(1 − i)|1i) , and columns of the matrices correspond to the states sent and measured by Alice and Bob, respectively. The |ψ0,1i = (0.325(1 − i)|0i + 0.888|1i) , sifted data corresponds to the on-diagonal d × d blocks. |ψ1,0i = (0.888|0i − 0.325(1 − i)|1i) ,

|ψ1,1i = (0.325(1 + i)|0i − 0.888i|1i) . for the 3-MUB and the 5-MUB protocols, see Using the same experimental apparatus, we Fig.4 (a) and (c), corresponding to key rates of perform the Singapore protocol in dimension d = Rd=2,m=3 = 0.8727 and Rd=4,m=5 = 1.5316 bits 2, where a QBER of eb = 1.23 % was measured, per sifted photon. In comparison to the BB84 see Fig.4 (a). protocol, the (d + 1)-MUB protocol has a sift- Inspired by the Singapore protocol [30] an iter- ing efficiency of 1/(d + 1), which scales poorly ative key extraction method can be applied to with dimensions. Nevertheless, in the infinite key extract a sifted secret key surpassing the 1/3 limit, the (d + 1)-MUB approach could exceed limit of the six-state protocol. The asymptotic the performance of the BB84 protocol by consid- efficiency of the iterative approach have been ering an efficient asymmetric basis choice. Fur- shown to reach 0.4 which is slightly smaller than thermore, this scheme only applies to dimensions the theoretical maximum of 0.415 under ideal that are powers of prime numbers. However, the conditions [30]. Here, we use the experimen- (d + 1)-MUB approach consists of a tomographic tal joint probability matrix to find the experi- protocol and in the case of large errors, it will mental mutual information as an upper bound outperform the BB84 scheme. In practical imple- for the key extraction rate. For this purpose, A,B mentations, one could consider an intermediate we parametrize |ψm (x)i vectors (as Alice’s and scenario where the number of MUB considered is Bob’s experimental preparation and measure- between 2 and (d + 1) in order to optimize the ment states). We then numerically minimize a secure key rate. maximum likelihood relation of the form f(x) = 2 2 Pd A B 2 2 m,n=1 |hψm(x)|ψn (x)i| − |hψm|ψni| to find 4.3.2 Singapore protocol deviations (errors) in the experimental SIC states of Alice and Bob. These deviations can also be Finally, we perform another tomographic QKD interpreted as errors in the quantum channel. protocol based on SIC-POVMs, known as the Sin- The Singapore protocol relies on an anti- gapore protocol. In particular, we use the Weyl- correlation between Alice an Bob. In the Heisenberg covariant SIC-POVMs elements. Ref- entanglement-based version of this protocol, this erence vectors |fi have been conjectured to exist can be achieved by sharing a singlet entangled (−) in arbitrary dimensions [32, 54] such that SIC- state. Assuming a singlet state of |Ψ iAB = POVMs can be obtained by considering a dis- √1 Σm=d−1(−1)d−m|mi|d−m−1i, we can extract ˆ d m=0 placement operator Djk acting on the reference the joint anti-correlated prepare-and-measure vector |fi, where probabilities. In dimension d = 2, this takes the form of p = Tr[ˆρ (1+~t ·~σ )(1+~t ·~σ )], where d−1 kl AB k A l B ˆ jk/2 X jm ~tks are unit vectors denoting SIC states and σîs Djk = ωd ωd |k + mihm|, (6) m=0 are Pauli matrices. This typically deviates from

Accepted in Quantum 2018-11-27, click title to verify 7 .Qatmsaepeaainand preparation state Quantum capabili- tomography 55]. QKD full [33, two oﬀer ties the that considered we protocols subsection this In QKD the of tomography process channel Quantum 4.3.3 bits. 0.093 and 0.170 are 0.415, pairs by ququart given and respectively in- qutrit qubit, mutual for The yield formation poor systems. a have higher-dimensional protocol for Singapore the analo- to protocols gous Moreover, scheme. six-state in rate the attainable maximum the surpassing 0.415; where cetdin Accepted of information 0 mutual in results proach by given is Bob and Alice tween where to the leading twirling matrix by probability achieved calculated be This can symmetrization probabilities. sym- prepare-and-measure completely on metric relies protocol Singapore the proba- prepare-and-measure of with bilities case ideal the the for matrices probability-of-detection case measured the Experimentally For (c) respectively. protocols. Bob, on-diagonal (lower) ( and Singapore the the Alice to and by corresponds (upper) measured data and sifted sent the states the to correspond the for the matrices for Results 4: Figure d . 388 1) + Singapore MUBs oprdt h hoeia aiu of maximum theoretical the to compared MBpooo ndimension in protocol -MUB p

k d=2

0 = i p = d=2 {h |} a p Q kl exp I ij kl AB u {| i } P . a {| { 0137 (1 = n = h d l

( =1 t = 2 u d i d | ij d =2 m 4 =2 1) + k,l p h uulifrainbe- information mutual The . 48 X − i kl d − } 081-7 lc il overify to title click 2018-11-27, } =1 2 and MBadSnaoepooosi dimension in protocols Singapore and -MUB δ ( p (1 kl d kl +1) ) − / log p e[ Re [ Re 12 l b δ MBadSnaoepooos a xeietlymaue probability-of-detection measured Experimentally (a) protocols. Singapore and -MUB = kl epi idthat mind in Keep . 2 + ) exp exp P p ] ] d p k k d kl 2 16 =1 p 4 = l δ p . kl kl , , u ap- Our . I AB d d m[ Im [ Im =2 × (8) (7) d = exp exp lcs b eosrce rcs arxfrtesix-state the for matrix process Reconstructed (b) blocks. ] ] 8 hne,btmybcm niseo ogrdis- longer on issue an quantum become may laboratory-scale but our channel, in insigniﬁcant loss or is Mode-dependent scheme itself. channel measurement quantum our the from mode-dependent coming consideration losses so, into doing take By may [56]. we matrix to process approach the computational reconstruct similar a eliminated using be while may the Moreover, assumption matrices. trace-preserving complex an of space oﬀer vector also Tr they basis, as orthogonal matrices Gell-Mann dimensions higher using to to extended be can approach map trace-preserving quantum the channel. characterize and to six-state protocols the Singapore for We results experimental channel. the quantum use be- the characterize go estimation fully to rate and one error allow qubit coarse-grained protocols chan- a these yond the of of Both tomography nel. mea- process and for preparation SIC of surements the set protocol, optimal Singapore are the POVMs be In can on channel. tomography that the process results quantum pro- perform of to states set used overcomplete MUB an possible vide all in measurements hscnte edsrbdb the d by matrix, described cess be then can This 2 = h hne a ecaatrzda positive a as characterized be can channel The , σ ˆ d

i d=4 2 =

r dniyadPuimtie.This matrices. Pauli and identity are i

{h |} c h osadclmso h matrices the of columns and rows The . χ where , (ˆ σ {| E i E σ ˆ

uhthat such (ˆ j i d ρ 2 = ) =4 = ) ( d i } 1) + δ P ij ij MBprotocols, -MUB pnigthe spanning , ρ ˆ χ out d ij 2 σ ˆ × = i ρ ˆ d σ ˆ E 2 j † 0 0 1 (ˆ In . 0 0.2 0.4 0.6 0.8 1.0 ρ . pro- 5 in ) . max exp exp exp Protocol d eb eb R(0) R Sifting R × Sifting Chau15 4 50 % 0.778 % 1 0.8170 1/6 0.1362 8 50 % 3.11 % 1 0.8172 1/28 0.0292 BB84 2 11.00 % 0.628 % 1 0.8901 1/2 – 1∗ 0.4451 – 0.8901 4 18.93 % 3.51 % 2 1.4500 1/2 – 1∗ 0.7250 – 1.4500 8 24.70 % 10.9 % 3 1.3942 1/2 – 1∗ 0.6971 – 1.3942 MUB 2 12.62 % 0.923 % 1 0.8727 1/3 – 1∗ 0.2909 – 0.8727 4 23.17 % 3.87 % 2 1.5316 1/5 – 1∗ 0.3063 – 1.5316 Singapore 2 38.93 % 1.23 % 0.4 0.374∗∗ 1 0.374∗∗

Table 1: Quantum bit error rates and key rates are presented for various quantum key distribution protocols. Four protocols, in various dimensions d, were investigated. The theoretical values of the error-free secret key rate, i.e. max R(0), and the maximum QBER, i.e. eb for which R = 0, are presented for the different protocols alongside the exp exp experimentally measured QBER, eb , and secret key rates, R . Finally, the sifting rate, defined as the probability of obtaining sifted data, is also shown for each protocols. ∗Depending on the size of the key, the choice of basis can be biased to get a larger sifting efficiency than 1/2 and 1/(d+1) for BB84 and MUB, respectively [58]. In the infinite key limit, the sifting efficiency can be made to approach 1. ∗∗Experimental rate for the Singapore protocol is deduced based on the point that a rate of 0.4 per 0.415 value of mutual information can be achieved. tance links [22]. 5 Conclusion Given the experimental preparation and measurement results, we parametrize the process ma- Application of quantum physics in public key trix and minimize a maximum likelihood function cryptography first emerged in the seminal work of of Bennet and Brassard in 1984; leading to several other protocols that benefit from different ~ f(t) = properties of quantum states for secure quan- P ~ 2 [Nab/N − hψb|( i,j χij(t)ˆσi|ψaihψa|σˆj)|ψbi] tum communications. Many experimental efforts X , P ~ have been dedicated to physical implementation a,b 2hψb|( i,j χij(t)ˆσi|ψaihψa|σˆj)|ψbi of these protocols using mostly polarization and to find the process matrix. Here Nab/N temporal degrees of freedom of photons. Despite are normalized prepare-and-measure results, and significant progress in experimental realization of |ψai (|ψbi) are prepared states (measurement pro- QKD protocols, each demonstration is practically jection settings). Using numerical minimization, limited to implement a single protocol in a spe- we find the process matrix for both the six- cific dimension. Structured light, on the other state and Singapore protocols that are depicted hand, have been shown to offer flexibility in quan- in Fig.4b. The quality of the channel may be de- tum state preparation and measurement in a the- scribed using the process fidelity, which is defined oretically unbounded Hilbert space. Here, we em- as F = Tr [χexp χ˜], where χexp is the experimen- ployed the versatility offered by the OAM states tally reconstructed process matrix and χ˜ is the of photons to perform an experimental laboratory ideal process matrix, i.e. χ˜i,j = δi,0δj,0, where δi,j survey of four classes of QKD protocols in differ- is the Kronecker delta. The process fidelity ob- ent dimensions. Table1 summarizes the main tained from the process tomography using MUB results of the several QKD schemes. This in- and SIC-POVMs are given by FMUB = 98.7 % cluded the Chau15 scheme (in d = 4, and 8) and FSIC−POVM = 95.8 %, respectively. Al- based on differential phases, the BB84 protocol though SIC-POVMs offer a more efficient tomog- in dimensions 2, 4, and 8, and tomographic pro- raphy of the channel, measurements of modes be- tocols based on (d + 1)-MUB in d = 2 (six-state), longing to OAM MUB are of higher quality, lead- and 4, and SIC-POVMs in d = 2. We observed ing to a larger process fidelity. This capability in experimental secure bit rates that ranges from tomographic protocols can potentially be used to 0.03 to 0.72 bit per sifted photon with schemes identify attacks, and pre- or post-compensate for that have error tolerances from 11 % up to 50 %. non-dynamical errors in the channel [57]. In particular, for the case of 2-dimensional to-

Accepted in Quantum 2018-11-27, click title to verify 9 mographic protocols, for similar noise levels, the national conference on computers, systems, Singapore protocol can outperform the six-state and signal processing, bangalore, india, 1984 protocol after sifting. For higher dimensions, the (1984). cross-talk among the different OAM modes lim- [3] Scarani, V. et al., The security of practical its the performance of several protocols. For ex- quantum key distribution, Rev. Mod. Phys. ample, the 8-dimensional BB84 fails to offer any 81, 1301 (2009). advantage except for higher error tolerance com- [4] Wiesner, S. Conjugate coding, ACM Sigact pare to its 4-dimensional counterpart. However, News 15, 78–88 (1983). there is a clear benefit in using the 4-dimensional BB84 rather than the 2-dimensional BB84 pro- [5] Hillery, M., Bužek, V. & Berthiaume, A. tocol, both in terms of key rate and noise toler- Quantum secret sharing, Phys. Rev. A 59, ance given our experimental configuration. More- 1829 (1999). over, in the case of the Chau15 scheme, the sifting [6] Scarani, V., Iblisdir, S., Gisin, N. & Acin, A. rate scales unfavourably with dimensions. Thus, Quantum cloning, Rev. Mod. Phys. 77, 1225 it is likely that under most conditions the 4- (2005). dimensional Chau15 scheme will be optimal. Our [7] Simon, C. et al. Quantum memories, Eur. experimental setup allows one to easily switch be- Phys. J. D 58, 1–22 (2010). tween protocols and dimensions to benefit from advantages of different protocols under varying [8] Werner, M. & Milburn, G. Eavesdrop- channel conditions. This included using tomo- ping using quantum-nondemolition measure- graphic protocols for a more elaborate character- ments, Phys. Rev. A 47, 639 (1993). ization of the errors in the quantum channel. [9] Bennett, C. H., Brassard, G., Crépeau, C. & Maurer, U. M. Generalized privacy amplification, IEEE T. Inform. Theory 41, 1915– Acknowledgments All authors would like to 1923 (1995). thank Gerd Leuchs, Markus Grassl and Imran Khan for helpful discussions. F.B. acknowl- [10] Bechmann-Pasquinucci, H. & Tittel, W. edges the financial support of the Vanier grad- Quantum cryptography using larger alpha- uate scholarship of the NSERC. R.F. acknowl- bets, Phys. Rev. A 61, 062308 (2000). edges the financial support of the Banting post- [11] Cerf, N. J., Bourennane, M., Karlsson, A. & doctoral fellowship of the NSERC. This work was Gisin, N. Security of quantum key distribu- supported by Canada Research Chairs; Canada tion using d-level systems, Phys. Rev. Lett. Foundation for Innovation (CFI); Canada Excel- 88, 127902 (2002). lence Research Chairs, Government of Canada [12] Allen, L., Beijersbergen, M. W., Spreeuw, R. (CERC); Canada First Research Excellence Fund & Woerdman, J. Orbital angular momentum (CFREF); Natural Sciences and Engineering Re- of light and the transformation of laguerre- search Council of Canada (NSERC); Singapore gaussian laser modes, Phys. Rev. A 45, 8185 Ministry of Education (partly through the Aca- (1992). demic Research Fund Tier 3 MOE2012-T3-1-009) and the National Research Foundation of Sin- [13] Heckenberg, N., McDuff, R., Smith, C. & gapore; and Spanish Ministerio de Economia y White, A. Generation of optical phase sin- Competitividad (MINECO). gularities by computer-generated holograms, Opt. Lett. 17, 221–223 (1992). [14] Bolduc, E., Bent, N., Santamato, E., Karimi, References E. & Boyd, R. W. Exact solution to simul- taneous intensity and phase encryption with [1] Gisin, N., Ribordy, G., Tittel, W. & a single phase-only hologram, Opt. Lett. 38, Zbinden, H., Quantum cryptography, Rev. 3546–3549 (2013). Mod. Phys. 74, 145 (2002). [15] Forbes, A., Dudley, A. & McLaren, M. Cre- [2] Bennett, C. H. & Brassard, G., Quantum ation and detection of optical modes with cryptography: Public key distribution and spatial light modulators, Advances in Op- coin tossing, Proceedings of the ieee inter- tics and Photonics 8, 200–227 (2016).

Accepted in Quantum 2018-11-27, click title to verify 10 [16] Gröblacher, S., Jennewein, T., Vaziri, A., [29] Liang, Y. C., Kaszlikowski, D., Englert, B.- Weihs, G. & Zeilinger, A. Experimental G., Kwek, L. C. & Oh, C. H. Tomographic quantum cryptography with qutrits, New J. quantum cryptography, Phys. Rev. A 68, Phys. 8, 75 (2006). 022324 (2003). [17] Mafu, M. et al. Higher-dimensional orbital- [30] Englert, B.-G. et al. Efficient and ro- angular-momentum-based quantum key dis- bust quantum key distribution with mini- tribution with mutually unbiased bases, mal state tomography, arXiv preprint quant- Phys. Rev. A 88, 032305 (2013). ph/0412075 (2008). [18] Mirhosseini, M. et al. High-dimensional [31] Durt, T., Englert, B.-G., Bengtsson, I. & Ży- quantum cryptography with twisted light, czkowski, K. On mutually unbiased bases, New J. Phys. 17, 033033 (2015). Int. J. Quantum Inf. 8, 535–640 (2010). [19] D’ambrosio, V. et al. Complete experimental toolbox for alignment-free quantum commu- [32] Renes, J. M., Blume-Kohout, R., Scott, A. J. nication, Nat. Commun. 3, 961 (2012). & Caves, C. M. Symmetric informationally complete quantum measurements, J. Math. [20] Vallone, G. et al. Free-space quantum key Phys. 45, 2171–2180 (2004). distribution by rotation-invariant twisted photons, Phys. Rev. Lett. 113, 060503 [33] Chuang, I. L. & Nielsen, M. A. Prescrip- (2014). tion for experimental determination of the dynamics of a quantum black box, J. Mod. [21] Krenn, M., Handsteiner, J., Fink, M., Fick- Opt. 44, 2455–2467 (1997). ler, R. & Zeilinger, A. Twisted photon entanglement through turbulent air across Vienna, [34] Lo, H.-K., Chau, H. F., & Ardehali, M. Ef- PNAS 112, 14197–14201 (2015). ficient Quantum Key Distribution Scheme [22] Sit, A. et al. High-dimensional intracity and a Proof of Its Unconditional Security, quantum cryptography with structured pho- Journal of Cryptology 18, 133–165 (2005). tons, Optica 4, 1006–1010 (2017). [35] Brádler, K., Mirhosseini, M., Fickler, R., [23] Cardano, F. et al. Quantum walks and Broadbent, A. & Boyd, R. Finite-key se- wavepacket dynamics on a lattice with curity analysis for multilevel quantum key twisted photons, Science Adv. 1, e1500087 distribution, New Journal of Physics 18, (2015). 073030 (2016). [24] Cardano, F. et al. Statistical moments [36] Ding, Y. et al. High-dimensional quantum of quantum-walk dynamics reveal topologi- key distribution based on multicore fiber us- cal quantum transitions, Nat. Commun. 7, ing silicon photonic integrated circuits, npj 11439 (2016). Quantum Information 3, 25 (2017). [25] Cardano, F. et al. Detection of zak phases [37] Genovese, M. & Traina, P. Review on qudits and topological invariants in a chiral quan- production and their application to quantum tum walk of twisted photons, Nature Com- communication and studies on local realism, mun. 8, 15516 (2017). Advanced Science Letters 1, 153–160 (2008). [26] Babazadeh, A. et al. High-dimensional [38] Bouchard, F., Fickler, R., Boyd, R. W. single-photon quantum gates: concepts and & Karimi, E. High-dimensional quantum experiments, Phys. Rev. Lett. 119, 180510 cloning and applications to quantum hack- (2017). ing, Science Adv. 3, e1601915 (2017). [27] Erhard, M., Fickler, R., Krenn, M. & Zeilinger, A. Twisted photons: New quan- [39] Sheridan, L. & Scarani, V. Security proof for tum perspectives in high dimensions, Light quantum key distribution using qudit sys- Sci. Appl. (2018). tems, Phys. Rev. A 82, 030301 (2010). [28] Bruß, D. Optimal eavesdropping in quan- [40] D’ambrosio, V. et al. Test of mutually tum cryptography with six states, Phys. Rev. unbiased bases for six-dimensional photonic Lett. 81, 3018 (1998). quantum systems, Sci. Rep. 3, 2726 (2013).

Accepted in Quantum 2018-11-27, click title to verify 11 [41] Ekert, A. K. Quantum cryptography based [50] Waks, E. et al. Security aspects of quan- on bell’s theorem, Phys. Rev. Lett. 67, 661 tum key distribution with sub-Poisson light, (1991). Phys. Rev. A 66, 042315 (2002). [42] Bent, N. et al. Experimental realization of [51] Schiavon, M. et al. Heralded single-photon quantum tomography of photonic qudits via sources for quantum-key-distribution appli- symmetric informationally complete positive cations, Phys. Rev. A 93, 012331 (2016). operator-valued measures, Phys. Rev. X 5, [52] Wang, S. et al. Proof-of-principle experi- 041006 (2015). mental realization of a qubit-like qudit-based quantum key distribution scheme, Quantum [43] Inoue, K., Waks, E. & Yamamoto, Y. Differ- Sci. Technol. 3, 025006 (2018). ential phase shift quantum key distribution, Phys. Rev. Lett. 89, 037902 (2002). [53] Bouchard, F., Sit, A., Hufnagel, F., Ab- bas, A., Zhang, Y., Heshami, K., Fickler, [44] Sasaki, T., Yamamoto, Y. & Koashi, M. R., Marquardt, C., Leuchs, G., Boyd, R. Practical quantum key distribution protocol W. & Karimi, E. Quantum cryptography without monitoring signal disturbance, Na- with twisted photons through an outdoor un- ture 509, 475 (2014). derwater channel, Opt. Express 26, 22563– [45] Bouchard F., Sit A., Heshami K., Fick- 22573 (2018). ler R. & Karimi E. Round-robin differ- [54] Scott, A. J. & Grassl, M. Symmetric ential phase-shift quantum key distribution informationally complete positive-operator- with twisted photons, Phys. Rev. A 98, valued measures: A new computer study, J. 010301(R) (2018). Math. Phys. 51, 042203 (2010). [46] Chau, H. Quantum key distribution using [55] Ndagano, B. et al. Characterizing quantum qudits that each encode one bit of raw key, channels with non-separable states of classi- Phys. Rev. A 92, 062324 (2015). cal light, Nat. Phys. 13, 397 (2017). [56] Bongioanni, I., Sansoni, L., Sciarrino, F., [47] Chau, H., Wang, Q. & Wong, C. Exper- Vallone, G., & Mataloni, P., Experimental imentally feasible quantum-key-distribution quantum process tomography of non-trace- scheme using qubit-like qudits and its com- preserving maps, Phys. Rev. A 82, 042307 parison with existing qubit-and qudit-based (2010). protocols, Phys. Rev. A 95, 022311 (2017). [57] Bouchard, F., Hufnagel, F., Koutn`y,D., Ab- [48] Mair, A., Vaziri, A., Weihs, G. & Zeilinger, bas, A., Sit, A., Heshami, K., Fickler, R. & A. Entanglement of the orbital angular mo- Karimi, E., Full characterization of a high- mentum states of photons, Nature 412, 313– dimensional quantum communication chan- 316 (2001). nel, arXiv preprint arXiv:1806.08018 (2018). [49] Qassim, H. et al. Limitations to the deter- [58] Tomamichel, M. et al. Tight finite-key anal- mination of a laguerre–gauss spectrum via ysis for quantum cryptography, Nat. Com- projective, phase-flattening measurement, J. mun. 3, 634 (2012). Opt. Soc. Am. B 31, A20–A23 (2014).

Accepted in Quantum 2018-11-27, click title to verify 12 A Details on estimating mutual information based on experimental results of SIC POVMs

The performance of quantum key distribution protocols based on SIC POVMs can be assessed based on the mutual information between Alice and Bob. We use the experimental joint probability distribution that is depicted in Fig.3(c) and (f) to ﬁnd the experimetnal preparation and measurement vectors A,B of Alice and Bob. For this, we parametrize |ψm (x)i vectors (as Alice’s and Bob’s experimental preparation and measurement states). Then, we numerically minimize a maximum likelihood function 2 2 Pd A B 2 2 of f(x) = m,n=1 |hψm(x)|ψn (x)i| − |hψm|ψni| to ﬁnd the experimental SIC states of Alice and Bob with respect to the experimental joint probability distribution. The Singapore protocol relies on an anticorrelation between Alice an Bob. In the entanglement-based version of this protocol, (−) this can be achieved by sharing a singlet entangled state. Assuming a singlet states of |Ψ iAB = √1 Σm=d(−1)d−m|mi|d − mi, we can extract the joint anti-correlated measure-and-prepare probailities d m=1 of pkl = T r(ρAB(1 + tk.σA)(1 + tl.σB)), where tks are unit vectors denoting SIC states. In dimension d=2, this approach leads to   0.000685 0.086229 0.067171 0.080468   0.080968 0.000121 0.080109 0.072486 Pexp =   , (9) 0.091623 0.097436 0.001494 0.084059   0.080614 0.093169 0.082246 0.001120

1−δkl compared to the ideal case of pkl = 12 . The mutual information between Alice and Bob is given by

d2 pkl IAB = Σk,l=1pkl log2 , (10) pk·p·l

d2 d2 exp where pk· = Σl=1pkl and p·l = Σk=1pkl. In d = 2, the associated mutual information is IAB = 0.408 compared to the ideal mutual information of 0.415; see [30].

Accepted in Quantum 2018-11-27, click title to verify 13