Table Of Content

General quantum key distribution inhigherdimension Zhao-XiXiong1,3, Han-DuoShi1, Yi-NanWang1, LiJing1, JinLei1, Liang-ZhuMu1 , andHengFan2 ∗ † 1School of Physics, Peking University, Beijing 100871, China 2Institute of Physics, Chinese Academy of Sciences, Beijing 100190, China 3Department ofPhysics,Massachusetts InstituteofTechnology, Cambridge, Massachusetts02139, USA (Dated:January12,2012) Westudyageneralquantumkeydistributionprotocolinhigherdimension.Inthisprotocol,quantumstatesin arbitraryg+1(1≤g≤d)outofalld+1mutuallyunbiasedbasesinad-dimensionalsystemcanbeusedfor thekeyencoding. Thisprovidesanaturalgeneralizationofthequantumkeydistributioninhigherdimension and recovers the previously known results for g = 1 and d. In our investigation, we study Eve’s attack by twoslightlydifferentapproaches. OneisconsideringtheoptimalclonerforEve,andtheother,definedasthe 2 optimalattack,ismaximizingEve’sinformation. Wederiveresultsforbothapproachesandshowthedeviation 1 oftheoptimalclonerfromtheoptimalattack.Withoursystematicinvestigationofthequantumkeydistribution 0 protocolsinhigherdimension,onemaybalancethesecuritygainandtheimplementationcostbychangingthe 2 number ofbasesinthekeyencoding. Asasideproduct, wealsoprovetheequivalency betweentheoptimal phasecovariantquantumcloningmachineandtheoptimalclonerfortheg=d−1quantumkeydistribution. n a J PACSnumbers:03.67.Dd,03.65.Aa,03.67.Ac,03.65.Ta 1 1 I. INTRODUCTION ically,howa(g+1)-basisQKDprotocolisformalized. Our investigationofthe(g+1)-basisprotocolisanaturalgener- ] h alization of the previously studied cases. The results of our Quantum key distribution (QKD) is a promising applica- p systematicstudymayhelponebalancethe securitygainand - tionofquantummechanics. ThefirstQKDprotocolwaspro- theimplementationcostbychangingthechoiceofg. t posed by Bennett and Brassard in 1984 (BB84) [1] and has n a beenprovedtobeunconditionallysecure[2,3]. Thisprotocol Inthisarticle,ourgeneralQKDprotocolthatusesarbitrary u waslatergeneralizedtothesix-stateprotocol[4].Meanwhile, g+1MUBsisthefollowing.SupposeAlice,thesender,wants q variousotherprotocolsweredeveloped,amongwhich,forex- tosendBob,thereceiver,asetofclassicalsymbolsconsisting [ ample, was the Ekert 91 protocol [5]. In the past decades, of0,1,...,d 1. Tostart,Aliceencodeseverysymbol,sayi, 3 significantprogresshasbeenmadeboththeoreticallyandex- intoapurequ−antumstate i or ˜i(k) ofonerandomlychosen | i | i v perimentallyinestablishingpoint-to-pointaswellasnetwork MUBoutoftheg+1andsendsthestatetoBob.Uponreceipt, 0 typesofkeydistributions;see,forexample,Refs. [6–11]. Bobmeasuresthestateusingagainarandomlychosenbasis, 4 which is correct with probability 1/(g + 1). Subsequently, Inasimpletwodimensionalsystem,onecaneitherusefour 5 thechoiceofbasesarepubliclyannouncedbyAlice,andthe 4 quantumstatesorsixquantumstates,whichcorrespondtothe statesmeasuredinbasesdifferentfromtheyarepreparedare . BB84 protocoland the six-state protocolrespectively, to en- 8 discarded by the two parties. In the absence of any eaves- code binary symbols. In a higher-dimensionalsystem of di- 0 dropping and environmentalnoises, Alice and Bob are then mensiond[12],therearealtogetherd+1mutuallyunbiased 1 leftwithidenticalstringsofsymbolswhiletheyareleftwith 1 bases(MUBs)availablefortheQKD.Thecounterpartsofthe partially correlated strings in the presence of Eve, an eaves- : BB84 protocoland the six-state protocolof a d-dimensional v dropper.Bycheckingtheagreementofasubsetofthesymbol systemarethe2-basisprotocolandthe(d+1)-basisprotocol. i sequence, Alice and Bob can decide whether to continue or X Naturally,onemaythinkof a general(g +1)-basisprotocol abortthe protocol. If the disagreementis below a threshold, r (g =1, 2, ..., d),wherearbitraryg+1MUBsareutilizedto a theythenperformadirectreconciliationandaprivacyamplifi- encoded-arysymbols. Inthepastfewyears,therehavebeen cationtoobtainasetofsharedkey.Inthisarticle,weconsider many studies on higher-dimensional QKD protocols. The thatEveattackstheQKDbyinterceptingandcloningthestate QKD using four-level systems were done first [13, 14], and beingsenttoBob. Forsimplicity,wethinkofthatEveusesa interests soon extended to the d-dimensional case [15–23]. fixedandbalanced(balancedbetweendifferentbases)cloning Most of these studies, however, focused on the 2-basis and transformationforeachqudit,andthatEvemeasuresherstate the(d+1)-basiscases,andtheresearchonthemostgeneral beforetheone-waypost-processingbetweenAliceandBob. caseisstillabsent.Inthisarticle,wepresentthestudyonsuch ageneral(g+1)-basisQKDprotocol. In this article, we investigate Eve’s attack scheme by two Inprinciple,thequantumstatesofahigherdimensioncan slightly different approaches, both starting from a general be encoded in a continuous variable system such as a har- form of cloning transformation proposed in Ref. [25]. One monic oscillator [24]. It is of fundamental interest, theoret- approachisconsideringtheoptimalclonerforEvewherewe maximizethefidelitiesofthestateofEve.Theotherisconsid- eringmaximizingtheinformationEvehasaboutAlice’sstate, which,ratherthanmaximizingthefidelities,isdefinedasthe ∗[email protected] optimalattack. WedotheseseparatelyinSec. IIandSec. IV †[email protected] and compare the two approachessubsequently. As we shall 2 see, theygivedifferentresults. Thesecondapproachisdone whereA,B,EandE denoteAlice,Bob,Eveandhercloning ′ inasomewhatrestrictivesense,butitissufficienttoprovethe machinerespectively. b are the discrete fouriertransform mn differencebetweentheoptimalclonerandtheoptimalattack. ofa , i.e. b = 1 a ωkn rm. Eqs. (5a)and(5b) mn mn d k,r kr − Sec. IIIgivessomeanalyticalsolutionstotheoptimalcloner makeitconvenienttowritedownthedensitymatricesofBob in special cases, includingthe symmetric clonercorrespond- aswellasEve.For ψ Pbeingstate i or ˜i(k) ofeachMUB, A | i | i | i ingtoageneralg. InSec. V,weintroduceasideproductof wehave our first approach to the QKD attack, where we present the linkbetweenaQKDclonerandarevisedasymmetricformof d 1 − ρ = a 2 i+m i+m, (6a) theoptimalsymmetricphasecovariantquantumcloningma- B mn | | | ih | chine proposed in Ref. [26] and prove the optimality of the m,n=0 X latter. InSec. VI,weendthearticlebyabriefconclusion. d 1 ρ˜(k) = − a 2(U ˜i(k) )( ˜i(k) U ), (6b) B | mn| mn| iB h |B m†n m,n=0 X II. THEOPTIMALCLONEROFEVE d 1 − ρ = b 2 i+m i+m, (6c) E mn | | | ih | Now we investigate the optimal cloner that Eve can use. m,n=0 X Before proceeding, let us first introduce some notations. In d 1 dimensiond,thereared+1mutuallyunbiasedbases,namely ρ˜(k) = − b 2(U ˜i(k) )( ˜i(k) U ) (6d) i and ˜i(k) (k =0, 1, ..., d 1),whichmoreexplic- E | mn| mn| iE h |E m†n m,n=0 {| i} {| i} − X itlyare (k =0, 1, ..., g 1). − d 1 1 − ˜i(k) = ωi(d−j)−ksj j , (1) | i √d | i Let us consider the fidelities of the states B and E with j=0 X respecttoalltheg+1differentbases. Thefidelityherecan with sj = j +...+(d 1) and ω = ei2dπ [27]. By saying bedefinedasF ψ ρout ψ ,thevalueofwhichdiffersfor two bases, say ˜i(0) −and ˜i(1) , are mutually unbiased, statesofdifferen≡tbhase|s.rWed.i|thithehelpofthepropertiesofthe {| i} {| i} we mean that ˜i(1) k˜(0) = 1 for any k˜(0) and ˜i(1) in PaulimatricesandtheBellstates, wefigureoutthefidelities |h | i| √d | i | i thetwobasesrespectively.ThegeneralizedPaulimatricesσ ofB andE foreachmutuallyunbiasedbasis: x andσ actonthestatessothatσ j = j+1 andσ j = z x z ωj j . Throughoutthearticle,weo|miitthe| “modiulod,”w|hiich F = a 2, (7a) B 0n iωsjtn|heij+camseh.eFrien.alWlye,tdheefigneeneUrmalnize=ddσ-xmdiσmznensosiothnaatlUBmelnl|sjtaite=s F˜(k) = Xn |a | 2, (7b) read| i B | m,km| m X |Φmni=(I⊗Um,−n)|Φ00i, (2) FE = d1 | amn|2, (7c) withm, n=0, 1, ..., d 1and Xm Xn − 1 F˜(k) = a 2 (7d) 1 d−1 E d | m,n+km| Φ = j j . (3) n m 00 X X | i √d | i| i (k =0, 1, ..., g 1). Xj=0 − Now, we consider the optimal cloner for Eve. Suppose a state ψ issentbyAliceandinterceptedbyEve.Then,Eve | iA FortheQKD usingg+1 MUBs, withoutlossofgeneral- preparesamaximallyentangledstate|Φ00iE′E andperforms ity, we suppose that the bases i , ˜i(0) , ..., ˜i(g−1) a unitary transformation U of the general form proposed in {| i} {| i} {| i} are chosen by the two legitimate parties. For simplicity, we Ref. [25]: assumethatEve’sattackisbalanced,i.e. sheinducesanequal d 1 probabilityoferrorforalltheg+1MUBs. Thisassumption U = − a (U U I). (4) followsfromthereasoningthatEvecanbedetectedeasilyby mn mn m, n ⊗ − ⊗ unbalanced disturbance otherwise, and that, as we find, Eve m,n=0 X cannotmaximizeallherg+1fidelitiessimultaneouslyifthe Here, a are the parameters of the unitary transformation, mn disturbanceisunbalanced.Hence,weassume satisfying a 2 =1. Thistransformationyields m,n| mn| PU ψ A Φ00 E′E FB =F˜B(0) =...=F˜B(g−1). (8) | i | i = amnUmn ψ B Φ m,n E′E (5a) Atthispoint,toobtainanoptimalcloner,Evehastomaximize | i ⊗| − i Xm,n herfidelitiesforagivenFB,whichquantifiesthedisturbance. = bmn Φ m,n BE′ Umn ψ E, (5b) We claim and will show later that Eve can maximize all her | − i ⊗ | i g+1fidelitiessimultaneouslyandthattheyareequal.Westart m,n X 3 bya“vectorization”ofthematrixelementsof(a ). Let Correspondingly,Eve’sfidelityF becomes mn E α~ = (a ,...,a ) (i=0, ..., g 1), (9) A~i = (A11,1,i...,Add−11,)(,d−1)i − (10) FE = d1[(|v|+ (d−1)(FB −|v|2))2 − d 1 +(p1+2v 2 3F +2 F v 2)2]. − B B A = a (i=1, ...,d 1). (11) | | − −| | i ij − p p j6=0,i,X...,(g−1)i Thusfar,wehavemaximizedoneofEve’sfidelities.Theother fidelities can be obtained simply by transposing the roles of The restelementsare a (j = 0, ...,d 1). Eq. (8) gives 0j − “the horizontal direction,” “the vertical direction,” and “the thefollowingrestrictions: diagonal direction” of the matrix (a ) and redefining α~ , mn 0 d−1 a 2 =F a 2, (12) α~1, andA~ accordingly. Doingso, we find thatthe condition 0j B 00 for optimizationof all Eve’s fidelities, with an overallphase | | −| | Xj=1 omitted,is α~ 2 =F a 2 (i=0,...,g 1). (13) i B 00 || || −| | − v x x x ... OneofEve’sfidelityF nowreads E x x y y ... F = 1( d−1a 2+ g−1α~ +A~ 2). (14) (amn)=xx yy xy xy ...... , E d |Xj=0 0j| ||Xi=0 i ||  ... ... ... ... ...    Eqs. (12)-(14) tell us how the fidelities of Eve and Bob are   coupledwitheachother. wheretheelementsareallreal,and NowweshowhowEqs. (9)-(14)workbydoingtheg = 2 versionof them. The resultsfor a genericg can be obtained F v2 1+2v2 3F B B analogously.Forg =2, x= − , y = − . r d−1 s(d−1)(d−2) d 1 F = 1( − a 2+ α~ +α~ +A~ 2), AllEve’sfidelitiesarefoundtobeequal. Theyareequalto E 0j 0 1 d | | || || j=0 X 1 d−1 a 2 = α~ 2 = α~ 2 =F a 2. FE = d{[v+(d−1)x]2+(d−1)[2x+(d−2)y]2}. 0j 0 1 B 00 | | || || || || −| | j=1 Theresultsforagenericgareanalogoustothoseforg =2. X We tentatively fix the values of a and A~. By vector ma- Thedifferenceisthatsome“2”aresubstitutedby“g.”Wethus | 00| presentthefollowingoptimizationconditionandtheoptimal nipulation,itiseasytofindthatthemaximumF isachieved E Eve’sfidelities: when α~0, α~1 ∝A~, FE =F˜E(0) =...=F˜E(g−1) = a =...=a = FB −|a00|2eiArg(a00). 1 [v+(d 1)x]2+(d 1)[gx+(d g)y]2 , (15) 01 0,d−1 r d−1 d{ − − − } v, m=n=0, Unfixing a andA~,F becomesafunctionofthemandis 00 E | | a = x, m=0,n=0orm=0,n=km, (16) positivelycorrelatedto A~ directly.Usingthenormalization mn  6 6 condition a 2||=||1, we find that A~ is maximal y, otherwise m,n| mn| || || wwehevnisauia,2liizP=ethaei,3mia=tri.x..(=a ai,)(:d−1)i(i=1, ..., d−1). Now (k =0,..., g−1), forsomev, mn where v x x x ... x x y y ... 1 1 1 1 F v2 1+gv2 (g+1)F x y x y ...  x= B − , y = − B. (17) (amn)=x32 y32 y32 x23 ... , r d−1 s (d−1)(d−g)  ... ... ... ... ...  Onenoticesthatthereisstillanundetermined,independent     variable v. To achieve the maximalFE for a given FB, one where needsto furtheroptimizethe value of v. In some cases, this F v 2 canbedoneanalytically,but,inthegeneralcase,thereseems x = B −| | eiArg(v), d 1 to be no evident analytical expression. Those analytical re- r − sults are presented in Sec. III. We do numerical calculation A A xi = FB −|v|2 A~i , yi = d i2, forthegeneralcase. p || || − Toshowtheperformanceoftheoptimalcloner,wechoose A~ = 1+2v 2 3F . d = 5asanexampleandplottheoptimizedF andv curves B E || || | | − p 4 whence 1 2 F = (d+1)F 1+ (d 1)(1 F ) E d2 B − − − B + (1 hpF ). p i(21) B − Eqs. (19)and(21)recoverthepreviousknownresultsinRef. [15]. Here, they are related by parameters v and g within a unifiedframework. The third case in which we have analytical results is that Eve andBob have equalfidelities, i.e. F = F = F. We E B startbyobservingthefollowingfact: WhenF = F = F, B E Eq. (15)isequivalentto (d g)[1+gv2 (g+1)F] − − p =v√d 1 (g+1) F v2. (22) − − − Wesquarethisequationandletu=√F vp2,andweendup − withanquadraticequationofuandv, FIG.1: (color online). Thecurves of thefidelityFE (dashed blue (d+1)(g+1)u2+ 2d−g−1v2 lines) and the parameter v (solid red lines) as functions of FB of d g d g theoptimal cloner for d = 5and g = 1,2,...,5. Theg = 1and − − 2(g+1)√d 1 g = 5linesarederivedfromEqs. (19)and(21)respectively. The − uv =1, (23) curves for general g’s are numerically computed from Eqs. (15)- − d g − (17). The general-g curves in some domains with very small FB whichrepresentsanellipsecenteringattheorigin.Thefidelity are incomputable by Eqs. (15)-(17), but they can be obtained by F =u2+v2isthesquareofthedistancefromtheorigintothe exchangingtherolesofEandB. point(u,v)andisthusmaximalatoneendofthemajoraxis. It is easy to find that point by diagonalizing the coefficient as functionsof F in FIG. 1. The figure shows that, as F matrix. The eigenvaluesof that coefficient matrix are found B B increases,F decreases,i.e. asthedisturbancedecreases,the tobe E stateEresemblestheoriginalstateless. Thefigurealsoshows d reasonableshiftsofthecurvesasgvaries.Asgincreases,i.e. λ = [(g+3) P(d,g)], (24) ± 2(d g) ± as more bases are used, the F curve shifts down, suggest- − E ingthatF islowerforagivenF . Thedifferencebetween where E B adjacentcurvesissmallforlargeg’s. (d g)(g+1) P(d,g)= (g+3)2 8 − . (25) − d r III. ANALYTICALSOLUTIONSTOTHEOPTIMAL Byfurthercalculatingtheeigenvectors,wefigureoutthemax- CLONER imalfidelityF andthecorrespondingparameterv. Themax- imalfidelityis Inthissection,wepresenttheanalyticalexpressionsofF E 1 2 d g andvforsomespecialcases. Thefirstoneistheg = 1case. F = = − . Forg =1,aneasiermethodgivesthat λ d(g+3) P(d,g) − − 2 d g = − . (26) v =FB, x= FB(d1−1FB), y = 1d−F1B, (18) d(g+3)− (g+3)2−8(d−g)d(g+1) r − − q Thecorrespondingvsatisfies whence u (d+1)(g+1) (d g)λ FE = 1[ FB + (d 1)(1 FB)]2. (19) v = (g+1)√−d −1 + (27) d − − − − p p Thesecondsetofanalyticalresultsisforg = d. Inthiscase, andisthus thereexistsnoy inthematrix(a ),andv hasafixedvalue mn 2 (d 1)(d g) givenbelow. v =[ − − d × (g+3) P(d,g)× − (d+1)FB 1 1 FB 1 ]12. (28) v =r d − , x=sd(d− 1) (20) (d−1)+[2(gd+1)P(d,g)−1− d2gg+−11]2 − 5 We remarkthatEqs. (26) and (28) are the results foran op- Asmentionedabove,I isbetweenthe randomvariableA AE timalsymmetriccloningmachinethatclonesarbitraryg +1 andtherandomvariablepair(E ,E). Suppose(E ,E)takes ′ ′ MUBs and that has notbeen studied. We can find that, as g thevalue(e,e). Eq. (33)tellsusthatitisequivalenttorep- ′ increase,F increasesasitisexpected. resent(e,e)by(m,e). Thus,Eve’sinformationI canbe ′ ′ AE writtenas IV. THEOPTIMALATTACKOFEVE IAE = − p(m,e′)log2p(m,e′) m,e′ X Inourg+1basisQKDprotocol,weconsiderthatEvein- + p(a)p(m,e a)log p(m,e a). (34) terceptseachstateandcopiesitusingafixedcloningmachine ′| 2 ′| a,m,e′ of the form of Eq. (4). We now think of that Eve’s scheme X is to maximizes her information about the state, rather than a is the value the random variable A takes. We assume that the fidelity, for a given, balanced disturbance. We consider Alice sends symbols randomly. Thus, in Eq. (34), p(a) = that the post-processing between Alice and Bob is one-way, 1. The other terms in Eq. (34) are given below, as they are d consisting of a direct reconciliation and a privacy amplifica- derivedfromEq. (33). tion. Therefore,theamountofsecretinformationextractable byAliceandBobreads p(m,e′ a) = 1 amnωn(a−e′) 2, (35) | d| | r =IAB IAE, (29) Xn − 1 p(m,e) = p(m,e a). (36) ′ ′ where I (or I ) is the mutual information between the d | AB AE a twoclassicalstringsofsymbolsofAliceandBob(orofAlice X and Eve). Note that Eve can measure E and E jointly, so The expressions for I of the other bases can be writ- ′ AE I representsthe mutualinformationbetweenthe classical ten analogously. Most generically,the optimalattack can be AE random variable A and the random variable pair E and E, foundbymaximizingtheI ’sundertherestrictionsofEqs. ′ AE whichisEve’sjoint-measurementoutcome(forconvenience, (30) and (31). This can be done in principle, but it is hard wedenotetheassociatedrandomvariablesagainbyA,B,E , because of the great number of variables and summations. ′ andE). Hence, instead, we here maximize Eve’s information condi- Let us now see what restrictions are imposed on Eve. tionally: We suppose that the matrix (a ) takes the form mn We supposedthatEve’sattack is balancedbetween different ofEq. (16) butthatv is adjustableto maximizeEve’sinfor- bases, i.e. the fidelities of Bob’s state are same for different mation(ratherthanEve’sfidelities). One can checkthatEq. MUBs. Here, for similar reasons, we also suppose that, for (16)satisfiesEqs. (30)and(31),andoneneedonlycalculate each basis, the probabilities that Bob make different errors I withrespecttoonebasisbecauseEq.(16)isbalancedbe- AE are equal (one can check that this restriction is compatible tweendifferentbases. Weshallcomparetheresultswiththose with the results in Sec. II). Say the error Bob makes is m of the optimalcloner approachlater. In this more restrictive (m = 0, 1, ... , d 1), i.e. Bob’s symbol is greater than case,a aregivenpartialfreedom,butasweshallsee,this mn − Alice’ssymbolbym. Then,fromEqs. (6a)-(6d),wefindthe issufficienttoprovethedeviationoftheoptimalattackfrom followingexplicitexpressionsfortheserestrictions: theoptimalcloner. WerefertoEq. (16)andfindthatEq.(35)nowreads d 1 − a 2 = FB, m=0, (30) j=0| mj| (1d−F1B, m6=0, p(m,e′|a)= UinnfodremrathtieodXis=−ne01brX|eeatsiwt,rkeiice−tnimoBn|2os,b=oanned((kcAF1a=d−lBni−−cF,01eeBa,i,ss1il,gmmyi.v.fi.=e6=nn,d00bg,ty−hat1)th.e mu(t3u1a)l Then[(([gvx,vx+−−ndd+(xyud())md−d22d−1,|e)1gr1x−i)−cy]2ωa]ω2,mlm,cgtta|l2c,ulmmammtio==6=6=n0000c,,,a,neeee′′′′b=6===e eaaaaa,,,s−ilytd(otn6=e b0y).adjus(t3in7g) vtomaximizeI ,andbothI andI becomefunctions AE AB AE I =log d+F log F +(1 F )log 1−FB.(32) of FB. Let us focus on the critical point where the amount AB 2 B 2 B − B 2 d 1 ofextractableinformationiszero,i.e.,accordingtoEq. (29), − I = I . As usual, we substitute F with D , the dis- AB AE B I TofindIAE foronebasis{|ii},wefirstrewriteEq. (5a)as turbance, defined as DI = 1 −FB. We compute the DI’s associated with zero extractable information for several d’s i A 1 amnωn(i−j) i+m B j E′ j+m E. sahnodwlisrtegthuelamr binehTaAviBoLrsE: IA.sTdheovragluienscroefatsheess,eDcritiinccarleDasIe’ss, | i → √d !| i | i | i I Xm,j Xn i.e. asmore basesare used, higherdisturbanceis acceptable (33) forAliceandBob. 6 g V. PHASECOVARIANTQUANTUMCLONINGMACHINE DI(%) 1 2 3 4 5 6 7 2 14.64 15.64 Wenowintroduceasideproductoftheoptimalclonerap- 3 21.13 22.47 22.67 d proachtoourg+1protocolQKD.AsmentionedinRef. [15], 5 27.60 28.91 29.12 29.20 29.23 the optimalclonerfor d+1 MUBs (g = d) is the universal 7 30.90 32.10 32.26 32.32 32.36 32.38 32.39 quantumcloningmachine[25,28]. FordMUBs(g =d 1), − onemayintuitivelythinkofphase-covariantquantumcloning TABLEI: ThedisturbanceDI associatedwithzeroextractablein- machine. In this section, we show that the optimal cloner formationforAliceandBob. Thesevaluesareobtainedwithcondi- tionallymaximizedIAE,where(amn)isrestrictedtotheformofEq. of d MUBs is equivalent to the optimal asymmetric phase- (16). Forthed’sandg’sweconsider,DI showsregularbehaviors: covariant quantum cloning machine. More specifically, we Bothwhend increasesandwhen g increases, DI increases. Since showthatitisequivalenttoarevisedasymmetricformofthe theunconditionallymaximizedIAE canbeslightlyhigher, thereal symmetric phase-covariant quantum qudit cloning machine criticalDI canbeslightlylowerthanthevalueshere. presented in Ref. [26], and we prove the optimality of that revisedform. InRef. [26],thefollowingequatorialstatesareconsidered: d 1 1 − Φ (in) = eiφj j , (38) Itisinterestingtoseewhetherthemaximizinginformation | i √d | i approach and the maximizing fidelity approach are equiva- Xj=0 lent. For definiteness, let us consider whether the optimal where φ are arbitrary phase parameters. (Thus, the corre- j cloner corresponds to the maximal I . We substitute the spondingMUBcloningmachineshouldbetheonethatclones AE amn inEqs. (34)-(36)bythevaluesassociatedwiththeopti- thebases ˜i(0) ,...,and ˜i(d−1) .)Theexplicitexpression {| i} {| i} malcloner. Thismeansthatwe plugintoEq. (37) the value forthesymmetriccloningtransformationisgivenas of v of the optimal cloner, as is calculated in Sec. II. Then, β we similarly end up with a table (TABLE II) of the distur- i αii 12 i R+ (ij + ji )j , (39) | i→ | i | i 2(d 1) | i | i | i banceassociatedwithzeroextractableinformation. Weusea − Xj6=i different notation DF here to indicate that it corresponds to where 1, 2 representtheptwo clones while R is the ancillary the maximized FE rather than the maximized IAE. In TA- state. αandβ arerealparametersthatsatisfy α2 +β2 = 1. Theoptimalfidelityforthesymmetriccloningmachinereads 1 F = (d+2+ d2+4d 4). (40) optimal g 4d − DF(%) 1 2 3 4 5 6 7 OnefindsthatEq. (40)isconsistepntwithEq.(26). 2 14.64 15.64 Nowweclaimthattheoptimalasymmetricphase-covariant 3 21.13 22.99 22.67 quantumcloningmachineisequivalenttotheoptimalcloner d 5 27.64 29.75 29.83 29.63 29.23 ofthedMUBsandtakestheform 7 31.10 33.24 33.16 33.00 32.83 32.64 32.39 β i αii i + (cosθ ij +sinθ ji )j ,(41) TinAfoBrLmEatiIoI:n,TobhteaidniesdtusribmanpclyebDyFplausgsgoicnigattehdewvaitlhuezseorofaemxtnracotfabthlee | i→ | i| i √d−1Xj6=i | i | i | i optimalclonerintoEqs.(34)-(36).DF hasanirregularbehavior:As whereθisarealparameter.Toprovethisclaim,wefirstwrite gincreases,DF doesnotchangemonotonously. DF deviatesabove down the fidelities associated with this cloning transforma- DI ofTABLEIexceptforg = d,inwhichcasevisfixed,andthe tion, higherthedimension,thelargerthedeviation.Thissuggeststhatthe 1 2αβ β2(d 2) optimalclonerisnottheoptimalattack(seethetext). F = + √d 1cosθ+ − cos2θ, (42) 1 d d − d 1 2αβ β2(d 2) F = + √d 1sinθ+ − sin2θ, (43) 2 BLEII,D showsanirregularbehavior: Asg increases,i.e. d d − d F asmorebasesareused,D doesnotalwaysincrease. D is where the constraint α2 + β2 = 1 still holds. We per- F F greaterthanD exceptforg =d,inwhichcasevisfixed,and form a numerical calculation that manipulates α, β, as well I the deviationtendsto be largeras d increases. As we know, as θ to maximize one fidelity given the other. The results associated with D is the I that is maximized under the showthat the optimizedfidelities forthis asymmetricphase- I AE conditionthat(a )isoftheformEq. (16),sothemaximal covariantcloningquantummachineareequaltothefidelities mn I freeofthisconditionmaybeslightlylargerandthusthe of the optimal d-MUB cloner, as are computed in Sec. II. AE condition-freeD maybelower. SinceD islargerthanthe Sincecloningequatorialstateshasahigherrequirementthan I F conditionalD ,itislargerthanthecondition-freeD . There- cloningdMUBs,theoptimalityofad-MUBclonerinfersthe I I fore, maximizing F is not equivalent to maximizing I , optimalityofanasymmetricphase-covariantquantumcloning E AE andtheoptimalclonerdoesnotcorrespondtotheoptimalat- machine with the same achieved fidelities, and their equiva- tack. lency.Thisprovesourclaim. 7 VI. CONCLUSION culationstillshowsinterestingresults. Inparticular,itproves (except for g = d) the deviation of the optimal cloner from In this article, we study the general, d-dimensional QKD the optimalattack. Sec. V is dedicated to a side productof thatusesarbitraryg+1MUBs,focusingontheindividualat- ouroptimalclonerapproach.Weshowthattheoptimalasym- tackbyEveandtheone-waypost-processing(adirectrecon- metricphasecovariantquantumcloningmachineisequivalent ciliationplusaprivacyamplification)byAliceandBob. This totheoptimalclonerofdMUBs(g = d 1). Wealsoshow − investigationofthegeneralg+1MUBQKDprotocolisanat- thatthisoptimalasymmetricphasecovariantquantumcloning uralgeneralizationoftheQKDinhigherdimensionandmay machinecanbeformulatedasarevisedversionoftheoptimal helponebalancethegainandthecostoftheimplementation. symmetriccloningtransformationpresentedinRef. [26]. As Inthisarticle,weinvestigateEve’sattackbytwodifferentap- the bottom line, we here remark that there still exist several proaches. One is maximizing F , the fidelity of Eve’s state possibleextensions,whichmaybeoffutureinterests,forour E E, while the other is maximizing I , the information Eve general,(g+1)-basis,qudit-basedQKDprotocol: extension AE has aboutAlice classical symbol. In the first approach(Sec. totwo-waypost-processing,toprime-powerdimensionalsys- II), we derive the fidelities and the parameter of the optimal tems,andtothecoherentattack. cloneranddemonstratetheirbehaviors,whicharereasonable. It turns out that in some special cases, the most significant ofwhichisthesymmetriccloning,theoptimalclonercanby ACKNOWLEDGEMENT solved analytically (Sec. III). In the second approach (Sec. IV), we give the equations for the most generic calculation We thank Xin-Quan Chen for useful discussions. This forI maximization,but,consideringitscomplexity,wedo work is supported by NSFC (10974247), “973” program AE insteadamorerestrictiveversion. Thoughrestricted,thecal- (2010CB922904)andNFFTBS(J1030310). [1] C.H.BennettandG.Brassard,inProceedingsoftheIEEEIn- [16] V.Karimipour,A.Bahraminasab,andS.Bagherinezhad,Phys. ternationalConferenceonComputers,SystemsandSignalPro- Rev.A65,052331(2002). cessing, Bangalore, India (IEEE, New York, 1984), pp. 175- [17] A.Ac´ın,N.Gisin,andV.Scarani,Quant.Info.Comput.3,563 179. (2003). [2] H.K.LoandH.F.Chau,Science283,2050(1999). [18] T. Durt, D. Kaszlikowski, J.-L.Chen, and L. C.Kwek, Phys. [3] P.W.ShorandJ.Preskill,Phys.Rev.Lett.85,441(2000). Rev.A69,032313(2004). [4] D.Bruß,Phys.Rev.Lett.81,3018(1998). [19] G. M. Nikolopoulos and G. Alber, Phys. Rev. A 72, 032320 [5] A.K.Ekert,Phys.Rev.Lett.67,661(1991). (2005). [6] N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, Rev. Mod. [20] G.M.Nikolopoulos,K.S.Ranade,andG.Alber,Phys.Rev.A Phys.74,145(2002). 73,032325(2006). [7] F.Grosshans, G.V. Assche, J.Wenger, R. Brouri, N. J. Cerf, [21] J.BaeandA.Ac´ın,Phys.Rev.A75,012334(2007). andP.Grangier,Nature421,238(2003). [22] K.S.Ranade,Phys.Rev.A80,022301(2009) [8] C.Gobby,Z.L.Yuan,andA.J.Shields,Appl.Phys.Lett.84, [23] L.SheridanandV.Scarani,Phys.Rev.A82,030301(R)(2010). 3762(2004). [24] D. Gottesman, A. Kitaev, and J. Preskill, Phys. Rev. A 64, [9] C.Z.Pengetal.Phys.Rev.Lett.94,150501(2005). 012310(2001). [10] H.Takesue,S.W.Nam,Q.Zhang,R.H.Hadfield,T.Honjo,K. [25] N.J.Cerf,Phys.Rev.Lett.84, 4497(2000); J.Mod.Opt.47, Tamaki,andY.Yamomoto,Nat.Photonics1,343(2007). 187(2000);ActaPhys.Slovaca48,115(1998). [11] T.Y.Chenetal.Opt.Exp.18,27217(2010). [26] H.Fan,H.Imai,K.Matsumoto,andX.B.Wang,Phys.Rev.A [12] Weonlyconsiderthecasethatdisprime. 67,022317(2003). [13] H. Bechmann-Pasquinucci and W. Tittel, Phys. Rev. A, 61, [27] S. Bandyopadhyay, P. O. Boykin, V. Roychowdhury, and F. 062308(2000). Vatan,Algorithmic34,512(2002). [14] T.DurtandB.Nagler,Phys.Rev.A68,042323(2003). [28] J. Fiura´seˇk, R. Filip, and N. J. Cerf, Quant. Info. Comput. 5, [15] N. J. Cerf, M. Bourennane, A. Karlsson, and N. Gisin, Phys. 583(2005). Rev.Lett.88,127902(2002).