Apply current exponential de Finetti theorem to realistic quantum key distribution

0.29 MB·English

by  Yi-Bo Zhao

Apply current exponential de Finetti theorem to realistic quantum key distribution
Yi-Bo Zhao, Zheng-Fu Han, and Guang-Can Guo
∗
Key Lab of Quantum Information, University of Science and Technology of China, (CAS), Hefei, Anhui 230026, China
In the realistic quantum key distribution (QKD), Alice and Bob respectively get a quantum
state from an unknownchannel, whose dimension may be unknown. However, while discussing the
security,sometime weneedtoknowexactdimension, sincecurrentexponentialdeFinettitheorem,
crucial to the information-theoretical security proof, is deeply related with the dimension and can
only be applied to finite dimensional case. Here we address this problem in detail. We show that
if POVM elements corresponding to Alice and Bob’s measured results can be well described in a
finitedimensional subspace with sufficiently small error, then dimensions of Alice and Bob’s states
9
can be almost regarded as finite. Since the security is well defined by the smooth entropy, which
0
is continuous with the density matrix, the small error of state actually means small change of
0
security. Then the security of unknown-dimensional system can be solved. Finally we prove that
2
for heterodyne detection continuous variable QKD and differential phase shift QKD, the collective

n attack is optimal undertheinfinitekey size case.
a
J PACSnumbers: 03.67.Dd,03.67.Hk

8
1
I. INTRODUCTION: dimension of quantum state is unknown, current expo-

] nential de Finetti theorem may not be directly applied
h
and the security against the most general attack is diffi-
p Information-theoreticalsecurityproof[1]is a powerful
- and general way to prove the security for quantum key cult to given by the information-theoretical method. In
t Ref. [5], Renner gave some concrete examples to show
n distribution (QKD). In this method, to give the amount
a of unconditional secretkeys, we only need to discuss up- the de Finetti theorem. From these examples we can
u see that if the dimension of individual quantum state
per or lower bounds of some entropies. The exponential
q is higher than the block size, the whole state may be
de Finetti theorem is crucial to this method, which sup-
[
far away from an almost i.i.d. state. For some QKDs,
port that as the key size goes to infinite, Eve cannot get

2 moreinformationfromthecoherentattackthanfromthe the dimension problem can be solved by introducing the
v squashingmodel[6,7]. Howeverforsomeotherprotocols
collectiveattack[1]. SinceinthecollectiveattackEveat-
3 we do not know whether there exist a squashing model,
tacks each signal independently with the same method,
8 i.e. continuous variable (CV) QKD [8, 9] and differen-
it is much easy for us to discuss the security. However,
6
tial phase shift (DPS) QKD [10]. Then, it is necessary
2 currentexponentialdeFinettitheoremrelyingonthedi-
for Alice and Bob to get some information about their
. mension and even diverges if the dimension is infinite,
9 dimensions.
while in practice the dimension is often unknownor infi-
0
8 nite. Here we give a general way to estimate the effective
0 There are also some other kind of quantum de Finetti dimension (In the following we will see that Alice and
: theorems. InRef. [2,3,4],severaldeFinettitheoremsfor Bob’s measurement data are obtained almost only from
v
differentconditionsaregiven. ThesedeFinettitheorems a finite dimensional subspace. Here we call the dimen-
i
X can be independent with the dimension. Evenunder the sionofthissubspaceaseffectivedimension.) ofasystem,
r infinite dimensional case, they still converge. However, andageneralmethodtoapplycurrentinformationtheo-
a
These de Finetti theorems are polynomial and not ex- reticalsecurityprooftopracticalQKD.Finallyweprove
ponential. As the key size goes to infinite, they can not thatifPOVMelementscorrespondingtoAliceandBob’s
exponentially converge to zero. Whether such polyno- measuredresults canbe welldescribedin a finite dimen-
mialdeFinettitheoremscanbeappliedtoQKDrequires sionalsubspace with sufficiently smallerror,the security
further discussion. ofunknowndimensionalsystemis very closeto thatof a
Wecanthinkaboutamoregeneralcase. AliceandBob finitedimensionalsystem,whereAliceandBobputfinite
respectively get a quantum state from a channel and do dimensionalfiltersbeforetheirdetectors. Thesecurityof
measurement and thus hold classical data finally. Real- this finite dimensional system is covered by current in-
istically, they only know the classical data and do not formation theoretical security proof method. Then the
know anything about the dimension of quantum state security of unknown-dimensional system can be solved.
beforehand. Therefore, it is not realistic for us to as- Our solution is based on the estimation of the effective
sume the dimensionbeforediscussingthe security. Ifthe dimension of a system. In Ref. [11], Wehner et al. gave
an estimation to the lower bound of the dimension of a
system. We hope future works can shrink the gap be-
tween these two results. Up to now, some efforts have
∗Electronicaddress: [email protected] been done for the finite key size case [12, 13]. The se-
2
curity under finite key size case may be much different sional protocol is covered by Ref. [1], then the security
from that under infinite key size case. To give a better of that unknown-dimensional protocol can be solved.
resultforfinitekeysizecase,itisnecessarytogiveatight In the following we will introduce a general QKD
estimation to the effective dimension. protocol at first and then discuss unknown-dimensional
We may think that the world is always finite, so re- problem. Latter we will introduce a finite dimensional
garditasguaranteedthatcurrentexponentialdeFinetti protocol and prove that if components of POVM ele-
theoremcanbedirectlyappliedtopracticalsystem. Itis mentscorrespondingtoAliceandBob’smeasuredresults
notnecessarythecase. Firstly,finitemeasurementresult on high dimensional bases are small enough then the se-
does not always mean finite dimensional quantum state. curity of original unknown-dimensional protocol can be
A finite measurement result can also be generated from well approximated by this finite dimensional protocol.
an infinite quantum state. Secondly, to know the upper While discussing their difference, we will introduce an
bound of the dimension of quantum state is required if entanglementversionmeasurementtodescribeAliceand
we consider the finite key size case. From the Ref. [1] Bob’s detection. Finally some application examples will
we know that the amount of secret key rate under the be given. In application examples, we will only discuss
finite key size case is deeply related with the dimension. the infinite key size case, while our result is also useful
Our estimation of effective dimension is expected to be under the finite key size case.
favorable to finite key size situation.
WenotedtwoparallelworksshowninRef. [14,15]. In
II. PROTOCOL:
these two works, the unconditional security of CVQKD
is addressed. In Ref. [14], Renner et al. modified pre-
Here we limit our analysis to the following protocol.
vious exponential de Finetti theorem and this new theo-
Alice and Bob take N quantum states from a chan-
rem can be directly applied to CVQKD. From this new
nel respectively. Then they permute their subsystem
de Finetti theorem we can see that in CVQKD if the
according to a commonly chosen random permutation.
variance of Bob’s measurement result is finite, the state
TheyseparateN statesintolblocksandperformPOVM
Alice, Bob and Eve share can still be approximated by
measurement to each state. Without loss of general-
an almost i.i.d. state. Our result only works for hetero-
ity, we assume Alice and Bob respectively hold several
dyne CVQKD and requires the maximum value of Al-
POVMs,MAi = MAi andMBi = MBi (i=1,...,l),
ice and Bob’s heterodyne detection to be finite. Under { xi } { yi }
the infinite key size case, our result can give the same where xi and yi denote corresponding measurement re-
approximation that the state describes the whole infi- sults, and they perform the POVM MAi = MAi and
{ xi }
nite communications can be approximated by an almost MBi = MBi tothei-thblocks(weassumethechoiceof
{ yi }
product state with arbitrarily small error. In Ref. [15], POVMsispublicly known). Thenthey publishmeasure-
Leverrier et al. directly addressed the unconditional se- mentresultsfromthefirstblocktoestimatethechannel.
curityofCVQKDwithoutthe deFinetti theorem. Their Before the classical procedure they estimate the dimen-
work is based on the Gaussian optimality. In this paper sion of their quantum state according to the region of
we approximate the CVQKD by a finite dimension pro- their measurement results. Then they give up partial of
tocol. The security of finite dimension protocol can be their measurement results (required by the information-
coveredbycurrentinformationtheoreticalsecurityproof. theoretical security proof [1]) and finally obtain classical
Then the unconditional security of CVQKD is possible strings. After performing data processing, information
to prove. Compared with these two works, one advan- reconciliationandprivacyamplification,theyfinallygen-
tage of our work is its application to photon number de- erate secret keys. Here, we allow Alice and Bob to hold
tection protocols, e.g. another coherent state protocol, severalPOVMs,mainlybecauseinmanyQKDprotocols,
DPSQKD. In the following, we will demonstrate how to Alice and Bob need to randomly change their measure-
apply our result to DPSQKD. ment bases. One POVM corresponds to one choice of
The basic idea of our approach is as following. Al- bases.
though the dimension of quantum state Alice, Bob and From current de Finetti theorem we know that if the
Eve initially share is totally unknown, after obtaining dimension of the channel is finite, the state Alice, Bob
measurement results, Alice and Bob collapse Eve’s state and Eve share after many communications is close to an
intoalesscomplexstateandcanknowsomeinformation almost product state. It has been shown that such al-
about the effective dimension of their state. Then we most product state almost has the same property with
can constructanother finite dimensional protocol,where the product state. The product state corresponds to the
Alice and Bob put a finite dimensional filter right be- collective attack. Then we only need to consider collec-
fore their detection equipments that can filter out high tive attack [1]. However, if the dimension is infinite, the
dimensional components. We prove that final state of de Finetti theorem may diverge. Then we cannot know
this new finite dimensional protocol is only slightly dif- the difference between collective attack and coherent at-
ferent from the original one. Then the security of that tack.
unknown-dimensional protocol can be approximated by Weassumeaftergettingquantumstate,Alice,Boband
this new protocol. The security of this new finite dimen- Eve share the state ρ . Since discarding subsys-
ANBNEN
3
tem never increases mutual information, we can safely same. Nevertheless, for most of current protocols, it is
assume that Eve holds the purification of ρ , so not difficult to find a tight D˜A and D˜B. For example, in
ANBNEN
that ρ is pure [1, 8, 16]. After measuring all theheterodynedetectionCVQKD,AliceandBobdonot
ANBNEN
N states, Alice and Bob know the region of their mea- change the basis, so there are only two blocks, one used
surement results. For example, in DPSQKD [10], if they for parameter estimation, one used to generate secret
usephotonnumberresolvingdetector,theycanknowthe keys. We assume at Alice’s side the maximum value of
maximum photon number they received from one pulse. oneblockisVmax1,andthatoftheotherisVmax2. Then
A A
InCVQKD[9]withheterodynedetection,theycanknow DA1 = MA1 and DA2 = MA2.
xi Vmax1 xi xi Vmax2 xi
the maximum amplitude they get. Here, we will show Since AlPice u≤seAs the same POVM for tPhese≤twAo blocks,
that such information is enough for Alice and Bob to wehaveMA1 =MA2. IfVmax1 >Vmax2,wecanchoose
xi xi A A
know whether their system can be approximated by a D˜A = MA1, which satisfies Eq. (1). Then
finite dimensional system. D˜A DPA1xi=≤V0Amaanxd1 D˜Axi DA2 = MA1,
staAtelicaeccaonrddiBngobtocamneamsaukreemaennitnriteisaulltess.tiAmfatteironAltiocethaenidr whi−ch is a POVM elem−ent. In tPheVADmaPx2S<QxKi≤DVA,maBxo1b axliso
Bobknowsthe regionoftheir measurementresults,they does not change his bases, so a similar result can be ob-
canonlyconsidersuchρ thatcangeneratetheir tained.
ANBNEN
measured results with probability higher than certain Toanalysisthe securitywecanonlyconsiderthe state
small parameter ε. Then the collection of states they ρANBNEN that satisfies
need to consider is largely reduced. The insecure proba-
tr[(D˜AD˜B) Nρ ] ε (2)
bility introduced by suchmethodis no largerthanε and ⊗ ANBNEN ≥
the strength of security will be reduced by ε [17]. This
while the final strength of security will be reduced by
procedure is required by our proof.
ε, where D˜A and D˜B are properly chosen elements that
More precisely, we assume Alice and Bob’s measure-
satisfy Eq. (1). Then the collection of ρ we
ment results from a single state of i-th block belong to ANBNEN
need to consider is largely reduced. It can be seen that
the region Ξ(Xi) and Ξ(Yi) respectively. We let
to shrink the collection of ρ , we need to find
ANBNEN
DAi = MAi tight D˜A and D˜B. In the following, we will see that this
X xi technique is required by our argument.
xi Ξ(Xi)
∈ After Alice and Bob’s measurement, the state Alice,
Bob and Eve hold becomes ρ , where X and
XNYNEN
DBi = MBi Y are classical variable that can take the value xi and
yi
X yi and can be expressed by orthogonal quantum state
yi Ξ(Yi)
∈ [1]. Actually, the security of QKD system directly re-
Then DAi and DBi actually are POVM elements that lated to the state ρ , rather than original state
XNYNEN
correspond to Alice and Bob’s measurement results be- ρ . Therefore, if we can find a finite dimensional
ANBNEN
longingtothe regionΞ(Xi)andΞ(Yi)respectively. DAi systemthatgeneratesanotherstateρ˜ veryclose
XNYNEN
(DBi)maybedifferentfordifferentblocks. Toavoiddis- to ρ , then the security of the original unknown
XNYNEN
tinguishingdifferentDAis(DBis),herewedefinePOVM system can be approximated by this finite dimensional
elements, D˜A and D˜B satisfying that for arbitrary state system.
ρ and i, we always have NowwecancomparetwoschemesasillustratedinFig.
1. One is the originalunknown-dimensionalscheme,and
tr(D˜Aρ) tr(DAiρ) the other is a modified scheme, in which Alice and Bob
≥ (1)
tr(D˜Bρ) tr(DBiρ) respectivelyputfiltersbeforetheirdetectors. Weassume
≥
these two filters can totally filter out high dimensional
To know the requirement given in Eq. (1) well, we can
component of received state and dimensions of output
see some examples. It can be seen that D˜A = I is one
statesofthesetwofiltersared andd respectively. For
A B
trivial element that always satisfy Eq. (1). Also, if all
convenience,wewillcalltheoriginalprotocolasprotocol
DAis are just the same, D˜A = DAi is the one satisfying 1andthe modifiedoneasprotocol2. Theninthe proto-
Eq. (1). Furthermore, since for any i and arbitrary ρ, col2dimensionsofAliceandBob’sreceivedstatesared
A
the expectation value of D˜A DAi and D˜B DBi are and d respectively. In the following, we will see that if
non-negative,D˜A DAi andD−˜B DBi areno−n-negative weproBperlysetthefilterandchoosehighenoughd and
operators. Theref−ore, if D˜A D−Ai and D˜B DBi are d , then the security of protocol 1 can be approximAated
− − B
not zero, they are also valid POVM elements. Then by that of protocol 2.
DAi,D˜A DAi,I D˜A and DBi,D˜B DBi,I D˜B To simplify our discussion,itis necessaryto avoiddis-
{ − − } { − − }
constituteaPOVMrespectively(Itshouldbenotedthat tinguishingdifferentblocks. WeknowthatD˜A DAiand
I maybe anoperationofaninfinite dimensionalspace.). D˜B DBi are also POVM elements. Here we−introduce
Here we define the POVM elements D˜A and D˜B mainly othe−r two classical data xi and yi that correspond to
′ ′
becausethemaximumvalueofmeasurementresultofdif- POVM elements D˜A DAi and D˜B DBi respectively.
ferentblocksmaybe differentandthen DAis arenotthe Then in protocol1 Al−ice and Bob’s m−easurement results
4
tector, which directly gives her the classical data. After
reading out the classicaldata, Alice set the detector and
environment to the initial state to do the next measure-
ment. In this model we require initial states of Alice’s
detector and environment are pure and respectively to
be de and Env . Forconvenience,herewelet ini
A A A
| i | i | i
denote de Env . Thenthe interactionamongthe re-
A A
| i | i
ceivedstate,detectorandenvironmentfori-thblockcan
be given by
Ui = xi Q ini MAi (3)
A X| i| xiiAh |q xi
xi
where xi s are orthogonal states of detector, Q de-
| i | xii
scribesorthogonalstateoftheenvironment, ini denotes
h |
theinitialpurestateofAlice’s detectorandenvironment
and MAi is the POVM operators corresponding to
q xi
POVM element MAi [16]. To check the validity of this
xi
measurement, we can apply it to a two parties system
ρ . After the interaction described by Ui, the state of
AB A
FIG.1: Illustrationofprotocol1andprotocol2,whereinpro- whole system becomes
tocol 2 finitedimensional filters are put before thedetectors.
ρ = Uiρ ini iniUi+
Ifthefiltersareproperlychosen,thesecurityofprotocol1can ABXQX A AB⊗| iAh | A
bewellapproximatedbythatofprotocol2,whilethesecurity
= xi Q MAi+ρ xj Q MAj
ofprotocol2iscoveredbycurrentinformation theoreticalse- X| i| xiiq xi ABXh |h xj|q xj
curityproofmethod. Theexactdifferencebetweenprotocol1 xi xj
and protocol 2 becomes significant while we consider the the
where Q denotes the environmentand all of Q s are
finitekey size case. X | xii
orthogonal with each other. After we trace out the sys-
temAandenvironmentwe immediatelyobtainthe state
of i-th block are within the region Ξ(Xi) xi and
nΞo(Yt ci)ha∪n{gye′ii}f irtesrpuencstiavselfyo.llTowhse.reWforhei,lethgiesttpinr∪ogt{omc′eoa}lsduorees- ρXB =Xxi |xiihxi|⊗trA(qMxAii+ρABqMxAii)
mentresultsfromastateofi-thblock,AliceandBobac- We see that
ceptthemonlywhenthey belongtoregionΞ(Xi) xi
′
and Ξ(Yi)∪{y′i} respectively. Otherwise, they d∪is{card} trA(qMxAii+ρABqMxAii)=P(xi)ρxBi
them. Now we can calculate the difference between the
protocol 1 and the protocol 2. where P(xi) is the probability of the out come xi and
ρxi denotes Bob’s conditional state while Alice’s mea-
B
surement result is xi. Then ρ becomes
XB
III. ESTIMATION OF L1-DISTANCE BASED ρ = P(xi)xi xi ρxi
ON OBSERVATIONS: XB | ih |⊗ B
X
xi
Before calculating the difference, here we introduce a whichconsistswiththePOVMmeasurement. SinceAlice
entanglement version measurement. There are several only acceptthe data within the collectionΞ(Xi) x′i ,
∪{ }
interpretations for the quantum measurement, e.g. von we can reduce the unitary transformationgiven in Eq. 3
Neumann measurement scheme and Many-worlds inter- to a general quantum operation Oˆi to describe Alice’s
A
pretation[18]. Here we are notto give a new philosophi- effective measurement, which is given by
calinterpretation,buttoconstructaphysicalmodelthat
cicaanlemffoedcteilvaelllyowpesrufosrtmoPeaOsiVlyMfinmdeathsuerdemiffeenretn.cTehbisetpwheyesn- OˆAi =xi Ξ(XXi) x′i |xii|QxiiAhini|qMxAii (4)
∈ ∪{ }
protocol 1 and protocol 2. For briefness, here we only
take Alice’s measurementas an example. Alice’s POVM Here we can see that Oˆi may not be a unitary transfor-
A
measurementcanbe performedby the equipment shown mation. The quantum operation that describes Alice’s
in Fig. 2. The measurement procedure is realized by an total N detection is
interactionamongherreceivedstate,detectorandtheen-
l
vironment. After the interaction,Alice givesup received OˆAN = (OˆAi )⊗ni (5)
state and the environment and thus only holds the de- O
i=1
5
Alice,BobandEvefinallyhold. Forthe protocol-1,they
finally hold the state ρ and for the protocol-2,
XNYNEN
theyfinally shareρ˜ . Ifweknowthe L distance
XNYNEN 1
between ρ and ρ˜ we can know the dif-
XNYNEN XNYNEN
ference between securities of protocol-1 and protocol-2
[1]. Since tracing out the subsystem never increases the
L distance [1], the L distance between ρ and
1 1 XNYNEN
ρ˜ is no larger than that between Ψ and
ΨXNYN.EWN e know that | P−1i
P 2
| − i
Ψ = (8)
| ANBNENi
FIG. 2: Illustration of entanglement version measurement, (PAdABdB)⊗N|ΨANBNENi+(PAdABdB)⊗N|ΨANBNENi
where |Envi and |dei respectively denote the initial state of
environmentandthedetector. Themeasurementcanbereal- where P denotes the orthogonalcomplementspace ofP.
ized by the unitary operation among received state, detector By putting the Eq. (8) into Eq. (6) we quickly know
and the environment. After theoperation, thereceived state
and the environment are given up and the measurement re- ΨP 1 =αΨP 2 +β Ψ′
sultcanbedirectlygivenbythestateofdetector,denotedby | − i | − i | i
ρX. where
(PdAdB) NOˆ+ Oˆ+ Oˆ Oˆ (PdAdB) N
β = qh AB ⊗ AN BN AN BN AB ⊗ i.
where n denotes the length of i-th block. By the same
i | | Oˆ+ Oˆ+ Oˆ Oˆ
way we can give the operator describing Bob’s whole N qh AN BN AN BNi
detections (By substituting the notation A by B.). (9)
Sinceweonlyneedtoconsiderthecasethatρ and
ANBNEN
is pure, here we assume the initial state Alice and Bob
Oˆ Oˆ (PdAdB) N Ψ Ψ
receive is |ΨANBNENi. The initial state of Alice and Ψ′ = AN BN AB ⊗ | ANBNENi| XNYNQNXQNYi
Binobi’s idneitec.torThanend feonrvtirhoenmpreonttociosl-|1Ψ,XaNftYerNQANXliQcNYeian=d | i qh(PAdABdB)⊗NOˆA+NOˆB+NOˆANOˆBN(PAdABdB)⊗Ni
A B
| i | i
Bob’smeasurement(generalquantumoperation[16])the is a state obtained from the complimentary space
state describing Alice, Bob, Eve, detectors and environ- (PdAdB) N, which may not be orthogonal with Ψ .
ment becomes FroAmB th⊗e Appendix-A of Ref. [1] we know that|thPe−L2i
1
distance oftwopure state Ψ and Ψ canbe givenby
|ΨP−1i = |ΨXNYNANBNQNXQNYENi | 1i | 2i
= OˆANOˆBN|ΨANBNENi|ΨXNYNQNXQNYi (6) |||Ψ1i−|Ψ2i||=2p1−|hΨ1|Ψ2i|2
Oˆ+ Oˆ+ Oˆ Oˆ where denotestheL1distance. ThentheL1distance
qh AN BN AN BNi betwee|n|·|Ψ| and Ψ isnolargerthan2β ,which
P 1 P 2
yields | − i | − i | |
where X and Y denotes Alice and Bob’s detectors, Q
X
and Q denote the environment around Alice and Bob,
Y ρ ρ˜ 2β
Oˆ istheoperatordescribingBob’swholeN detections || XNYNEN − XNYNEN||≤ | |
BN
and hOˆA+NOˆB+NOˆANOˆBNi describes expectation value of For convenience here we let D˜ = D˜AD˜B. If we put
Oˆ+ Oˆ+ Oˆ Oˆ . Eqs. (4) and (5) into Eq. (9) and apply the fact that
AN BN AN BN
In protocol-2Alice and Bobrespectively put a d and operators of different detectors are commutate, we can
A
d dimensional filter before their detectors. The filter know that
B
canbedescribedbyaprojectionintoasubspace. Herewe
let the projector PdA and PdB denotes Alice and Bob’s tr [D˜ N(PdA,dB) Nρ (PdA,dB) N]
fiTlhteerns.foFrorthceonpvreontioeAcnocle-2waeftleeBtrPAAdlABicdeBadnednoBtoesb’PsAdmAe⊗aPsuBdrBe-. |β|=vuut ABE ⊗ trAABBE[D˜⊗⊗NρAANNBBNNEENN] AB ⊗
(10)
ment the whole state becomes
Now we can see that if all of pure state ρ satis-
ANBNEN
Ψ = Ψ˜ (7) fyingEq. (2)make β smallenough,thenprotocol-1can
| P−2i | XNYNANBNQNXQNYENi be well approximate|d|by protocol-2.
= OˆANOˆBN(PAdABdB)⊗N|ΨANBNENi|ΨXNYNQNXQNYi To estimate |β| here we give a very useful theorem.
(PdAdB) NOˆ+ Oˆ+ Oˆ Oˆ (PdAdB) N Theorem 1 Let 1 , 2 , ..., and 1 , 2 , ...,
qh AB ⊗ AN BN AN BN AB ⊗ i | iA | iA | iB | iB
be bases of Alice and Bob’s Hilbert spaces respec-
After tracingoutreceivedquantumstateAN andBN, tively, by which projectors PdA and PdB can be respec-
A B
and the environment QN and QN we obtain the state tively given by PdA = 1 1 + ... + d d and
X Y A | iAh | | AiAh A|
6
PdB = 1 1 + ... + d d . Then if we have strength of parameter estimation is ǫ +2δ, where the
tfPorBAr∞i=B,1a∞[,Drj˜=b⊗idtNA|ra(|irPAByAhdhiAB|Dρd|˜BAA)N⊗|BjNiNAρE|AN+N|BPBiNti∞i(=BP,1ih∞sA,djAB=Bdad|BBlw)|⊗aByNhsi]|D:˜=saBtL|ijs≤ifiBedε|3≤.thεNa3t, pFHρ˜Xri¯ǫnok′taE¯ol(lcyρ˜oislth1eesctEaiǫ¯m′n)+abteeǫlde′′gai+kbvyeǫn′′,d′bwa+ythaHi5lδeom2bδtsi+hnteaeǫc′iun(srρteerXd¯e′ks′n′efEg¯rct|orEh¯met)o−fkpperlyoaetraoarkacmItoReelteo≥1rf.
Proof: We can see that L is no larger than min X¯kE¯| − IR
estimationis ǫ +2δ,the stateρ˜ is estimatedby the
mweaxe|xΨpNainhdΨNhΨ|DN˜⊗|D˜N⊗|ΨNN|Ψi,Nwih=erheΨ|NΨ|N(PiAdA∈BdB(P)⊗AdNABdD˜B⊗)⊗NN|Ψ.NIif dsHaaettriasefytohibnetgatientrrem[d(D′˜′Hf′rAoǫD′m˜B(pρ)˜⊗roNtoρcAEo¯Nl)B1NEalX¯enNakd]Ek¯o≥nliyδs atihsmeocoρunAnstNidBoefNrtEehdNe.
into product spaces PAdA(PAdA)⊗N−1(PBdB)⊗N,..., ǫ +ǫ +ǫ +2δmsiencurX¯eksE¯e|cret−e keysIoRf protocol 2, while
and do straightforward calculation, we can imme- ′ ′′ ′′′
dia∞i=te,1∞l,yj=dfiBn|dBhtih|Da˜tB|LjiB|≤] ≤Nε[P3.∞i=,1∞(,Tj=hdeA|sAtrhai|iDg˜hAtf|joirAw|ar+d 2bthδyectohstmereednsagtftarhoomobfttaphiaenrefadamcftreottemhratepsrttohitmeoasctotailot1ne.ρ˜isX¯ǫk′E¯′′ +is(cid:3)2esδt,imwahteerde
cPalculation is too bothering to show here. Detailed one
The state distance ρ ρ˜ 2δ can
can be seen in the appendix.) (cid:3) || XNYNEN − XNYNEN||≤
be evaluated from the measurementresults through the-
Since trABE[D˜⊗NρANBNEN] ≥ ε, from Eq. (10), we orem 1. The security of protocol 2 is covered by current
can see that Theorem 1 actually gives a sufficient condi- informationtheoreticalsecurity proofmethod. Then the
tion for β ε. the security of protocol 1 can be solved.
| |≤
Now, we can know the distance between protocol 1
and protocol 2 from the measurement results. The only
remained problemis to give the difference between secu-
rities of protocol-1 and protocol-2 if the state difference IV. SECURITY OF PROTOCOL 2.
of them is known.
Theorem 2 If ρ ρ˜ 2δ for all If Alice and Bob’s received initial state in protocol
ρ satisfy||inXgNtYr[N(DE˜NAD−˜B)XNNYρNEN|| ≤] δ, then 1 is ρANBN, the state they received in protocol 2 is
ANBNEN ⊗ ANBNEN ≥ ρ˜ = 1(PdAdB) Nρ (PdAdB) N, where 1 is
the 5δ +ǫ-secure secret key rate of protocol-1 is no less ANBN p AB ⊗ ANBN AB ⊗ p
introduced for normalization. After quantum commu-
than the 2δ+ǫ-secure secret key rate of protocol-2, while
Alice and Bob take results from protocol-1 as that from nication, Alice and Bob will permute their state, then
ρ is permutation invariant. The projection oper-
protocol-2 to estimate the secret key rate of protocol-2 by ANBN
the information theoretical method. ator (PAdABdB)⊗N commutates with the permutation op-
erator, so ρ˜ is also a permutation invariant state.
ANBN
Proof: The L1 distance cannot be increased by quan- The dimension of individual state of ρ˜ANBN is dAdB.
tumoperationsandthus classicalbit-wiseprocessing[1]. Then there is a symmetric purification for ρ˜ in a
ANBN
aρI˜fnX¯|dk|ρE¯EX¯||N≤dYeNn2EδoNtaen−dAρ˜l|Xi|cρNeXYNaNnYEdNN−B||oρ˜≤bX’Ns2Yδc,Nlat|sh|se≤inca2wlδed,ahwtahaveearen||dρX¯X¯kEk,vE¯Y¯e−’ks Huρ˜AaillNbsBetrNattEesNpoaf[c1ρe˜, o2f0]d.imTehneissnio(ndth(eddAdd)im2B.)e2nANsci,oconwrhdoiifcnhgthatecotiucnuadrlilrvyeindist-
ANBNEN A B
stateafterthedataprocessingrespectively,duringwhich exponential de Finetti theorem, the state ρ˜ is
ANBNEN
someinformationmaybeannounced. Thesecurityiswell close to an almost product state [21]. Then we can only
definedbysmoothmin-andmax-entropies. The amount consider the collective attack. Since under the collective
of ǫ-secure secret keys can be given by Hmǫ′in(ρX¯kE¯|E¯)− attack, Eve attacks all of signals independently by the
liseaǫk′′I′,Rw[1h9e]r,ewHhmǫil′ien(t·h|·e) sdterneontgetshtohfepsamraomotehtemriens-teinmtarotipoyn, sBaombeamndethEovde,shhearreewaeftleert ρa˜AsBinEgldeencoomtems tuhneicsattaitoen.AlBicee-,
leakIRdenotestheamountofinformationpublisheddur- fore calculating the secret key rate, we need to estimate
ing the ǫ′′-secure reconciliation and ǫ′+ǫ′′+ǫ′′′ = ǫ [1]. possible ρ˜ABE from measurement results. It should be
Since ||ρX¯kE¯ − ρ˜X¯kE¯|| ≤ 2δ, the smooth min-entropy noted that although ρ˜ABE belongs to a Hilbert space of
satisfies Hm2δi+nǫ(ρX¯kE¯|E¯) ≥ Hmǫin(ρ˜X¯kE¯|E¯) [1]. Also, if dimension (dAdB)2, we do not really need to estimate it
Alice and Bob use the data from the protocol-1 as that only in a (d d )2 dimensional subspace. We can still
A B
from the protocol-2 to estimate the state of protocol-2, construct it in an infinite dimensional space, because a
the security of the parameter estimation [1] will be re- state belonging to a (d d )2 dimensional Hilbert space
A B
duced by 2δ, because ρ ρ˜ 2δ. Fur- also belongs to a infinite dimensional Hilbert space [22].
|| XNYN − XNYN|| ≤
thermore, if we only consider the ρ satisfying This point shows that while we discuss the collective at-
ANBNEN
tr[(D˜AD˜B) Nρ ] δ, the strength of security tack for protocol 2, we do not need to take the filter in
⊗ ANBNEN ≥
will also be reduced by δ. In all, the ǫ +ǫ +ǫ secure to account. If we give up filters in protocol 2, the pro-
′ ′′ ′′′
securityofprotocol2isgivenbyHǫ′ (ρ˜ E¯) leak , tocol 2 becomes the same as protocol 1. Then if we do
min X¯kE¯| − IR
while the strength of parameter estimation is ǫ and not take the filter into account, the security against col-
′′′
the ρ˜X¯kE¯ is estimated by the data obtained from pro- lective attack of protocol 2 is actually equivalent to that
tocol 2. The ǫ +ǫ +ǫ +2δ secure security of pro- of protocol 1. Finally, our conclusion is as follows. The
′ ′′ ′′′
tocol 2 is given by Hǫ′ (ρ˜ E¯) leak , while the security of protocol 1 can be approximated by that of
min X¯kE¯| − IR
7
protocol 2. For the protocol 2 we only need to consider Here we give two application examples. We will see
thecollectiveattack. WhiletheHilbertspaceofprotocol that our result can be readily used for heterodyne de-
2 is only a subspace of protocol 1, then the secrete key tection and photon number detection case. It should
rateofprotocol2againstcollectiveattackisnolessthan be noted that in the following we only proved that for
that of protocol 1 against collective attack. Finally, we CVQKD and DPSQKD the collective attack is optimal
actually give the difference between coherent attack and under infinite key size case. How to prove their security
collective attack for protocol 1. We introduce the filter against collective attack has not been solved in this pa-
only to apply currentde Finetti theoremand to give the per. For short, we only take the infinite key size case
difference between coherent attack and collective attack for examples. It seems that our estimation of effective
for protocol 1. dimension is meaningless under this case. However, we
The 5δ + ǫ-secure unconditional secret key rate of should note that under the finite key size case, the esti-
protocol-1 is no less than the 2δ + ǫ-secure secret key mation of effective dimension will be useful.
rate of protocol-2. Under the infinite key size case, the
unconditional secrete key rate of protocol 2 is given by
the secret key rate against collective attacks [1]. The se-
cret key rate under collective attack of protocol 2 is no A. Unconditional security of CVQKD
less than that of protocol 1. Also under the infinite key
size case, the parameter ǫ can approach to zero. Then
Now we apply our results to the heterodyne detection
the 5δ-secure unconditional secret key rate of protocol-1
CVQKD and prove that as the key size goes to infinite
isnolessthanthe2δ secureunconditionalsecretkeyrate
the collective is optimal. In the prepare & measurement
of protocol-2 and no less than its secret key rate against
CVQKD, Alice prepare a continuous variable EPR pair,
collective attacks,where 2δ comes from the factthat Al-
andsendsoneparttoBob. AliceandBobrespectivelydo
ice and Bob use the data of protocol 1 to estimate the
heterodynedetectiontotheirheldstates. Thesecurityof
state of protocol 2. In addition, under the infinite key
suchscheme againstcollective attack is discussedin Ref.
size case, we may choose large enough d and d so as
A B [9]. Here, we prove that for this protocol the collective
to make δapproach to zero. Then we can directly say
attack is optimal under the infinite key size case. We
that for protocol1 if the POVM elements corresponding
denote Alice and Bob’s measurement result by (p ,q )
to the measured results can be arbitrarilywell described A A
and (p ,q ) respectively. The corresponding POVM el-
in a finite dimensional space, the collective attack is op- B B
ements are respectively M = 1 p +iq p +iq
timal under the infinite key size case. pA,qA π| A Aih A A|
and M = 1 p +iq p +iq . In a realistic sys-
For many practical QKDs, the projection of POVM pB,qB π| B Bih B B|
tem, the maximum value of Alice and Bob’s measure-
elements of measured results on high dimensional basis
mentresultsis finite (orAlice andBobcangiveupsome
is extremely small. For example, the POVM element for
extremely larger measurement results). Then their fi-
heterodyne detection corresponding to measured result
(p,q) is M = 1 p+iq p+iq , whose component on nal shared data is within certain region. We assume
p,q π| ih | Vmax and Vmax are large enough, so that for all pos-
the photon number basis m exponentially goes to zero A B
| i sible (p ,q )s and (p ,q )s Alice and Bob hold satisfy
as m increase. The POVM of inefficient photon number A A B B
p2 + q2 Vmax and p2 + q2 Vmax (or Alice and
resolving detector [23] also has similar property. Then A A ≤ A B B ≤ B
Bob only accept the data with amplitude no larger than
if a QKD protocol utilize such detectors, Alice and Bob
canannouncethe maximump2+q2 ormaximumphoton VAmax and VBmax). Then we can construct D˜A and D˜B
respectively to be
number received from one pulse. Then Alice and Bob
can construct the big POVM D˜ and for a given ε3 they
N 1
canfind a big enoughd (smaller than N) that in photon D˜A = p +iq p +iq dp dq
number picture satisfies ∞,∞ iD˜ j ε3. Then π Z | A Aih A A| A A
i=1,j=d|h | | i| ≤ N p2+q2 Vmax
thedifferencebetweenstaPtesofprotocol1andprotocol2 A A≤ A
1
canbe smallerthan2ε. The 5ε+ǫ-securesecretkeyrate D˜B = p +iq p +iq dp dq
can be given by 2ε+ǫ-secure secret key rate of protocol π Z | B Bih B B| B B
2, which is covered by Ref. [1]. p2B+qB2≤VAmax
Thefilter PdA andPdB canbe choseninphotonnumber
A B
V. APPLICATIONS: space. We let
In the realistic case, the measured result is always fi- PdA = 0 0 + 1 1 +...+ d 1 d 1
nite. In heterodyne detection protocols, the maximum A | iAh | | iAh | | A− iAh A− |
PdB = 0 0 + 1 1 +...+ d 1 d 1
value of measured result is limited. In photon number B | iBh | | iBh | | B − iBh B − |
detection protocol, the maximum received photon num-
ber is finite. Such realistic cases allow us readily apply where i i and j j denote the photon number
A B
| i h | | i h |
our results. state. Now we utilize theorem1 to discuss the difference
8
between protocol 1 and protocol 2. We see that up data is extremely small. Such procedure only causes
extremely small change of state, and thus only cause ex-
,
∞∞ tremely small change of security. On the other hand,
iD˜A j
|Ah | | iA| a realistic security proof for CVQKD should take such
X
i=0,j=dA−1 cut off procedure into account. After all, in a realistic
,
1 ∞∞ situation, the maximum value of measurement results is
= ip +iq
π Z |Ah | A Ai always finite.
X
p2A+qA2≤VAmax i=0,j=dA−1
p +iq j dp dq
A A A A A
h | i | B. Unconditional security of DPSQKD
∞,∞ ri rj exp[ r2]
= 2 A A − A dr
Z X √i!j! A Now we apply our result to coherent state DPSQKD,
rA2≤VAmax i=0,j=dA−1 whose dimension is infinite in principle. Up to now,
∞ ri exp[ r2] ∞ rj the security against collective attack for DPSQKD un-
= 2 A − A A dr (11)
Z X √i! X √j! A der noiseless case is proved[10]. Here we show that that
rA2≤VAmax i=0 j=dA−1 proof actually is unconditional security proof. To allow
AliceandBobdorandompermutation,inRef. [10]Zhao
where in the forth line we used the result that A ipA+ etal. cutthelongsequenceofcoherentstatesintoblocks
iqAi| = rAi exp√[−i!rA2/2] and let rA2 = p2A + qA2|. hU|nder and regarded one block as one big state. Then Alice
the case that d Vmax, we can use the Stirling for- and Bob can permute these big states. In the DPSQKD
(mruAl/a√tdoAa)pdAp,rowxhAimic≫ahteex√Apoj!n.enTthiaelnlywgeoehsatvoezPer∞jo=adAs d√rAAjj!in∝- AnolitceesstehnedsstaBteobofaabbiglosctka)t,ea|cΨco~xNrbdiin=giNtN=ob1h|(e−r1b)ixnia+r1yαsit(rdineg-
creases. Then the whole term ∞i=,0∞,j=dA|Ahi|D˜A|jiA| ~x = (x1,x2,...,xNb), where |(−1)xi+1αi is a coherent
will exponentially go to zeroPwith the increase of state. Then Bob measures the phase difference between
dA. By the same way we can prove that the term each two individual state. The collective attack means
∞i=,1∞,j=dB|Bhi|D˜B|jiB| will also exponentially goes to Eve attack these big states (blocks) independently with
zPero with the increase of d . Finally, for a given ε3 and the same method. Here we require Bob use the pho-
B
large enough N, we can find a d N and d N, ton number resolving detector. After many rounds of
A B
≪ ≪
that satisfy quantumcommunications,Bobannouncesthemaximum
photon number received from one big state (one block).
∞,∞ ∞,∞ ε3 ThenifBobputafilterthatfiltersoutallthestatewhose
iD˜A j + iD˜B j :=Err
|Ah | | iA| |Bh | | iB| ≤ N photon number is larger than certain criteria, the mea-
X X
i=1,j=dA i=1,j=dB sured results should not change too much.
We see that if the efficiency of photon number resolv-
Then from the theorem 1 and 2 we know that the secu-
ing detector is 100%, then we can definitely know the
rity of this CVQKDscheme canbe approximatedby the
security of a scheme of dimension (d d )2 N with actual dimension of Bob’s received state. However, if
A B
≪ that efficiency is not 100%, we cannot determine the ex-
errors no larger than 5ε (Err exponentially approach to
act dimension of Bob’s state from the measured photon
zero with the increase of d and d , so that d and d
A B A B
are proportional with log(N/ε3). Then for large enough numbers.
N,wecanhave(d d )2 N). Then5ε+ǫ-securesecret Here we discuss the imperfect detector case. In Ref.
A B
≪ [24],thePOVMelementofineffectivephotonnumberre-
key rate of heterodyne detection CVQKD can be given
solving detector is given. In that reference, the spacial
by 2ε+ǫ-secure secret key rate of protocol-2, where Al-
ice and Bob respectively put filters PdA and PdB before modeofreceivedphotonstatehasnotbeenconsidered. If
A B
we take the spacialmode and other components into ac-
their detectors. As N , we can find large enough
(d d )2 N, that all→ow∞ε 0, and the security pa- count,wecanextendthatPOVMelementcorresponding
A B
≪ → to n photons to be
rameter ǫ can goes to zero From the Ref. [1] we know
that, under the case that (d d )2 N , the col-
A B
≪ → ∞ ∞
lective attack is optimal for protocol2 and its secretkey Π = Cnγn(1 γ)m nP (12)
rate can be given by that under collective attack. Since n X m − − m
m=n
the secrete key rate against collective attack of protocol
where γ denotes detector efficiency and P denotes the
2 is no larger than that of protocol 1, under the infinite m
projectortomphotonnumbersubspace. Weassumethe
key size case the unconditional secretkey rate of hetero-
dimension of m photon number subspace is f , and P
dyne detection CVQKD equal to its secret key rate un- m m
to be
dercollectiveattacksandthe collectiveisoptimal. Here,
we require Alice and Bob give up such data whose am-
fm
pthliattudfoerislalragregeVrmtahxananVdAmVaxmaaxn,dthVeBmpaxro.pWoretiocnanofexgpiveecnt Pm =X|ϕmk ihϕmk | (13)
A B k=1
9
where ϕm denotes the orthogonal state of m photon finite dimensionalfilters before the detectors,andshown
| k i
number subspace. It can be prove that f l(m+l the security difference between the original unknown-
m
≤ −
1)!/m!, where l denotes the block size. dimensional protocol and this finite dimensional proto-
IfBob’smaximumreceivedphotonnumberisn ,then col based on measurement results. Since the security of
0
the POVM element corresponding to this event can be that finite dimensional protocolis coveredby currentin-
given by formationtheoreticalsecurityproofmethod,thesecurity
ofarealisticunknowndimensionalsystemcanbesolved.
n=n0
Our result can be used to prove the unconditional se-
D˜B = Π (14)
n curity of heterodyne detection CVQKD and DPSQKD.
X
n=0
Finally, we provethat for heterodyne detection CVQKD
InDPSQKD,iftheblocksizeisl,thedimensionofAlice’s andDPSQKDcollectiveattackisoptimalundertheinfi-
modulation is 2l, which is finite. Therefore we only need nitekeysizecase. Thedifferencebetweenprotocol1and
to discuss Bob’s state. We can construct Bob’s filter to protocol2willbemeaningfulifweconsiderthefinitekey
be size case.
Acknowledgement: Special thanks are given to R.
m=m0
PdB = P Renner for fruitful discussions. This work is supported
B X m by National Natural Science Foundation of China under
m=0
Grants No. 60537020and 60621064.
where P is given by Eq. (13). Now we can use theo-
m
rem 1 to estimate the difference between protocol 1 and
protocol2. We enumeratethe basisofthe filter by ϕm . APPENDIX A: DETAILED PROOF FOR
Then we have | k i THEOREM 1
Diff := hϕmk |D˜B|ϕmk′′i (15) At first we can see that
m=0,mX′=m0,k,k′ trAB[D˜⊗N(PAdABdB)⊗NρANBN(PAdABdB)⊗N] is no larger
n0 than max ΨN D˜ N ΨN where ΨN (PdAdB) N.
≤nX=0γnmX=m0Cmn(1−γ)m−nl(m+l−1)!/m! To find |ΨmNaixh|ΨN|ihΨ⊗N||D˜⊗Ni|ΨNi, |wei∈needABto ⊗ex-
n0 pand the space (PdAdB) N by product spaces
γn (1 γ)m nl/n!(m+l 1)l+n 1 AB ⊗
≤nX=0 mX=m0 − − − − dPeAdnAo(tPeAdAt)h⊗eN−pr1o(PjeBdcBto)r⊗Nt,o...A. licHee’sre,(Bwoeb’lse)t kP-AdtAkh (sPtaBdtBke).
whereinthesecondlinewehaveusedEqs. (12),(13)and Also we distinguish bases of k-th state of Alice (Bob)
(14) and the fact that fm ≤l(m+l−1)!/m! and in the as |1iAk,|2iAk,..., (|1iBk,|2iBk,...). We know that
thirdlineweusedthefactthatm(m 1)...(m n) mn. I =PdA+PdA and I =PdA+PdA, where I and
It can be seen that Diff exponenti−ally goes−to z≤ero as IAk aretAhke idenAtkity matBrikxes coBrkrespoBnkdingto AliAcke and
Bk
m0 increases. Then for a given security parameter we Bob’s k-th states. Then we have
canfindalargeenoughkeysizeN thatgivestherequired
security. hΨN|D˜⊗N|ΨNi=hΨN|(PAdA1 +PAdA1)D˜⊗N|ΨNi
nuImtbaelsrorceasonlvbiengsedeentetchtaotriforBaobduetseectthore tpheartfecctanphgoivtoenn =hΨN|PAdA1D˜⊗N|ΨNi+hΨN|PAdA1D˜⊗N|ΨNi
the upper bound ofthe number of receivedphotons (e.g. =CF1 +CL1 (A1)
bourn up if received photon number is too high), then
whereC1 andC1 respectivelydenotethefirstandsecond
theycanfindaprotocol2thatisexactlysameasprotocol F L
term in the second line. Since
1. Then we can immediately get a conclusion that the
collective attack is optimal under the infinite key size PdA = d +1 d +1 + d +2 d +2 +...
A1 | A iA1h A | | A iA1h A |
case. I = 1 1 + 2 2 +...
A1 | iA1h | | iA1h |
the C1 can be given by
F
VI. CONCLUSION:
CF1 = hΨN|PAdA1D˜⊗NIA1|ΨNi (A2)
,
In the above we give a method to apply current expo- ∞∞
= m D˜A m
nential de Finetti theorem to realistic QKD. In realistic h 1| | ′1i·
QKD, the number of Alice and Bob received photons is m1=dAX+1,m′1=1
always finite and their measurement results always be- ΨN m (D˜A) N 1(D˜B) N m ΨN
h | 1i ⊗ − ⊗ h ′1| i
long to a finite region. This property allow us effectively
describe the QKD protocol in a finite dimensional sub- wherewehaveusedthefactthatPAdAk andD˜jAandD˜jB are
space with sufficiently small error. In this paper, we in- commutate if k =j and D˜A and D˜B denote POVM ele-
6 j j
troduce another finite dimensional protocol by putting ments corresponding to j-th state. We know there exist
10
two pure states Φm1 and Φ˜m′1 that can let m ΨN where C2 and C2 respectively denote the first and the
and m ΨN be| w1riitten a|s 1mi ΨN = λ Φhm1′1| andi second teFrm in thLe second line.
hCm1′1|cΨhanN1ib|e=gλiiv′1e|Φn˜m1b′1yi, where |λh1|≤1|1 aind |λ′1|1|≤11.iThen As the CF1, the CF2 can be rewritten as
F
C2 = ΨN PdAPdAD˜ NI ΨN
C1 = ΨN PdAD˜ NI ΨN (A3) F h | A1 A2 ⊗ A2| i
F h | A1 ⊗ A1| i ∞,∞
, = m D˜A m
= λ1λ′1 ∞∞ hm1|D˜A|m′1i· m2=dAX+1,m′2=1h 2| | ′2i·
Φm1m(D1˜=AdA)X+N1,m1′1(=D˜1B) N Φ˜m′1 hΨN|m2iPAdA1(D˜A)⊗N−1(D˜B)⊗Nhm′2|ΨN(iA7)
h 1 | ⊗ − ⊗ | 1 i
Also there exist a pure state Φm2 by which
tishkeBneuofpowprneertghibavotinuagnrdbtihtoerfau|rhpyΦpPm1eOr1|V(bDoM˜uAne)ld⊗eNmto−en1C(tDF1˜M,Bw)c⊗eanNwb|iΦ˜lelm1wd′1irisi|ct.tuesInst h|ΦΨ˜m2N′2|imb2yiPwAdhA1icchahnmb′2e|ΨwNriittceannabseλg2ihvΦem2n|2b|y2aλn′2di|Φ˜am2p′2uir.eSsitnactee
λ 1 and λ 1, from the Eqs. (A5) and (A7) we
into a diagonalform. We assume an arbitraryM can be | 1| ≤ | 2| ≤
know that
written as
,
M =a1|ϕ1ihϕ1|+a2|ϕ2ihϕ2|+... |CF2|≤ ∞∞ |hm2|D˜A|m′2i| (A8)
where ϕ , ϕ ,...areorthogonalbases,anda ,a ,...are m2=dAX+1,m′2=1
1 2 1 2
| i | i
positive real numbers and satisfy a 1. We let ψ
i
and ψ are two arbitrary states. Now≤we consider t|hei If we continuously do such procedure, we will find that
′
| i
following value for ψ and ψ .
′
| i | i
2N
|hψ|M|ψ′i|=|a1hψ|ϕ1ihϕ1|ψ′i+a2hψ|ϕ2ihϕ2|ψ′i+...| hΨN|(D˜AD˜B)⊗N|ΨNi=XCFi +CL2N (A9)
i=1
From the fact that
and
ψ ϕ 2+ ψ ϕ 2+... 1 (A4)
1 2
|h | i| |h | i| ≤
|hψ′|ϕ1i|2+|hψ′|ϕ2i|2+... ≤ 1 |CFi |≤ ∞,∞ |hmi|D˜A|m′ii| (A10)
weknowthatforarbitrarystates|ψiand|ψ′iandPOVM mi=dAX+1,m′i=1
element M, it is always satisfied that
for i N, and
ψ M ψ a ψ ϕ 2+ a ψ ϕ 2+...(A5) ≤
′ 1 1 2 2
|h | | i| ≤ | h | i| | h | i|
p ,
≤ p|hψ|ϕ1i|2+|hψ|ϕ2i|2+...≤1 |CFi |≤ ∞∞ |hmi|D˜B|m′ii| (A11)
where in the first line we applied the Cauchy-Schwartz mi=dBX+1,m′i=1
inequality which says that
for i>N, where
a b +a b +...
1 1 2 2
| |≤
|a1|2+|a2|2+... |b1|2+|b2|2+... CL2N =hΨN|(PAdABdB)⊗ND˜⊗N|ΨNi=0 (A12)
p p
and in the second line we applied Eq. (A4) and the fact and we have applied the fact that ΨN (PdAdB) N.
that ai ≤1. Finally from Eqs. (A9), (A10) (A11|) anid∈(A12A)Bwe⊗can
Now we put Eq. (A5) into Eq. (A3) and obtain
see that
,
∞∞
C1 m D˜A m (A6) 2N
| F|≤m1=dAX+1,m′1=1|h 1| | ′1i| |hΨN|D˜⊗N|ΨNi|≤X|CFi | (A13)
i=1
By the same way C1 can be given by ∞,∞ ∞,∞
L N[ iD˜A j + iD˜B j ]
A A B B
≤ | h | | i | | h | | i |
X X
CL1 = hΨN|PAdA1D˜⊗N|ΨNi i=1,j=dA i=1,j=dB
== hCΨ2N+|PCAd2A1PAdA2D˜⊗N|ΨNi+hΨN|PAdA1PAdA2D˜⊗N|ΨNi tShinecTehEeqo.re(mA113)ishporlodvsefdo.r arbitrary |ΨNi∈(PAdABdB)⊗N,
F L