Äîêóìåíò âçÿò èç êýøà ïîèñêîâîé ìàøèíû. Àäðåñ îðèãèíàëüíîãî äîêóìåíòà : http://qilab.phys.msu.ru/papers/SPIE-5833-229-238(2005).pdf Äàòà èçìåíåíèÿ: Mon Feb 4 18:39:37 2008 Äàòà èíäåêñèðîâàíèÿ: Mon Oct 1 20:02:26 2012 Êîäèðîâêà:

Comparative characteristics of quantum key distribution protocols with alphabets corresponding to the regular polyhedrons on the Bloch sphere
Denis V. Sych*, Boris A. Grishanin, and Victor N. Zadkov

International Laser Center and Department of Physics M. V. Lomonosov Moscow State University, Moscow 119899, Russia

ABSTRACT
Possibilities of improving characteristics of quantum key distribution (QKD) protocols via variation of character set in quantum alphabets are investigated. QKD protocols with discrete alphabets, letters of which form regular polyhedrons on the Bloch sphere (tetrahedron, octahedron, cube, icosahedron, and dodecahedron, which have 4, 6, 8, 12, and 20 vertexes) , and QKD protocol with continuous alphabet, which corresponds to the limiting case of a polyhedron with infinitive number of vertexes, are considered. Stability of such QKD protocols to the interceptresend and optimal eavesdropping strategies at the individual attacks, is studied in detail. It is shown that in case of optimal eavesdropping strategy, after safety bases reconciliation, critical error rate of the QKD protocol with continuous alphabet surpasses all other protocols. Without basis reconciliation the highest critical error rate have the protocol with tetrahedron-type alphabet. Keywords: Quantum information, quantum cryptography, quantum key distribution

1. INTRODUCTION
Since 1970s, when the idea of quantum cryptography was proposed first [1], a number of different quantum key distribution (QKD) protocols implementing it have been suggested [2--5]. Despite their diversity all of them are based on a beautiful idea employing a basic "no-cloning" principle of quantum mechanics--impossibility of copying arbitrary quantum states [6] . Thanks to this, an eavesdropper cannot intercept the quantum communication channel without disturbing a transmitting message if it contains a set of incompatible, i.e. , essentially quantum, not governed by the rules of classical logic, states. Moreover, any attempt of obtaining any information about this set of states inevitably disturbs the transmitted message.
Keeping this advantage of quantum physics for cryptography in mind, any QKD protocol uses messages entirely composed of an incompatible set of quantum states or so called quantum alphabet that consists of incompatible "letters" . Various QKD protocols are distinguished in essence only by different alphabets, which ensure secure message transmission up to a critical error rate that determines the protocol efficiency. Analyzing distortions in received messages one can reveal an eavesdropping attack, but in order to establish a secure connection one should
also be capable to resist such attacks. Therefore, one of the reasons for developing novel QKD protocols is increasing their critical error rates.
All known QKD protocols [1 ,3, 4] using carriers of information with finite-dimensional Hubert space are based on discrete quantum alphabets, i.e. with fixed number of letters. First QKD protocol proposed in 1984 by Bennett and Brassard (BB84) [1] gives an example of the protocol in which four quantum incompatible states, setting two mutually nonorthogonal bases, are used. Alphabet of six-state protocol [4] is composed of three mutually nonorthogonal 1))//}} of the two-dimensional Hilbert space, which makes this protocol bases {{ 0) , I 1)}, { (JO) I i))//} , { (10) totally symmetrical on the Bloch sphere and leads to the fact that information characteristics, namely, critical error rate of six-state protocol surpasses those of the BB84-protocol [4, 7] . Ftirther increasing the critical error rate, as it is discussed in the literature [8--10], is basically connected with increasing the dimension of the Hubert space of the quantum channel. In two-dimensional case, there is a commonly accepted opinion that six-state protocol has the best efficacy [11]. However, there is no proof of this statement for all possible eavesdropping strategies and in this paper we will clarify
*

E-mail: sych©comsiml .phys.msu.ru

Quantum Informatics 2004, edited by Yuri I. Ozhigov, Proceedings of SPIE Vol. 5833 (SPIE, Bellingham, WA, 2005) · 0277-786X/05/$15 · doi: 10.1117/12.620514

229


whether increasing the number of letters in the alphabet in the Hilbert space of fixed dimension could improve the QKD protocol efficacy or not. In other words, whether we could surpass six-state protocol efficacy, even in two-dimensional case, due to the increasing the number of letters in the alphabet or not? In order to answer this question, we introduce QKD protocols with discrete alphabets, letters of which form regular polyhedrons on the Bloch sphere (tetrahedron, octahedron, cube, icosahedron, and dodecahedron, which have 4, 6, 8, 12, and 20 vertexes), and QKD protocol with continuous alphabet, which corresponds to the limiting case of a polyhedron with infinitive number of vertexes. By analogy with well known six-state protocol, we will call such protocols 4-, 6-, 8-, 12-, 20-, and oo-state protocols. Their efficacy can be calculated the same way as for other standard QKD protocols, i.e. with the help of regular information analysis based on calculation of the mutual
Shannon information between different two-partite subsystems of the tripartite system Alice--Eve--Bob [12].

The paper is organized as follows. In Section 2, we outline specific properties of the co-state protocol and give the basic concept and key mathematical formalism of the compatible information in application to the quantuminformation analysis of arbitrary QKD protocols. In Section 3 we provide a comparative quantum-information analysis of the considered QKD protocols. Future trends of using Hilbert spaces with arbitrary dimension in QKD protocols are considered in Section 4. We conclude the paper by summarizing the results and discussing possibilities of experimental realization in Section 5.

2. SPECIFIC PROPERTIES OF THE oo-STATE QKD PROTOCOL
In the following, we assume that before eavesdropping Alice--Bob system is described entirely by a totally entangled pair of photons.t In other words, we will analyze EPR version of the QKD protocols, which is similar to the Eckert's version of the BB84 protocol [2]. Obviously, such representation of the QKD protocols is equivalent to the variance when Alice simply transmits to Bob single photons, without any source of EPR pairs. From theoretical point of view, key difference in analysis of co-state protocol and QKD protocols with discrete alphabets lies in calculation of the amount of information that can be encoded with the help of continuous alphabet. A natural quantitative measure for the amount of information is the standard mutual Shannon information functional of the classical input--output (Alice-Bob) joint probability distribution PAB:
IAB[PAB] = S[PA] + S[PB] _ S[PAB],

(1)

where S[P] is the classical Shannon entropy functional for the joint, P = PAB , and marginal, P = PA , PB , probability measures [13]. Specific of continuous alphabet is shown up in calculation of the joint probability distribution, defined on the continuous set of elementary quantum events, which can be determined by the wave functions or the state vectors of the quantum information system. Mathematically, a choice of a set of elementary events can be given by defining

a set of positive operators E,, = Iv) (vi, representing a non-orthogonal expansion of the unit operator [14] or the
positive operator valued measure (POVM) [15]:

1=E.
I=fIvvIdvv

(2)

In our case, when the information exchange between two quantum systems employs all states of the Hilbert space, expansion (2) transforms into the continuous non-orthogonal expansion of the form [16]:
(3)

where dV is the volume differential normalized to the dimension of Hilbert space D: f dV = D. The corresponding joint probability distribution has the form:

PAB(da,

d/3) =

T1AB[EA(&) ® EB(d/3)]I3AB,

(4)

tMost straightforward description of the information system Alice--Bob, which clearly reflects an experimental implementation of the QKD-scheme, is a semiclassical description with the conditional density matrix pB(cE) of Bob that depends on the classical parameter c corresponding to the transmitted by Alice state a). However, the description of Alice--Bob system as an entangled pair of states has definite methodological benefit as it allows to describe all the participants of the information

exchange in the system Alice--Eve--Bob as peering parties.

230

Proc. of SPIE Vol. 5833


where EA,B(dv) = I)A,B (VIA,B dV, and defines the so called non-selected mutual information [16, 17J

'AB jj

11

PAB(dcE, d3)1og2 PA(da)PB(df3) ·

PAB(dci,df3)

(5)

In case of information exchange between two quantum systems via arbitrary discrete quantum alphabet, expansion (2) is defined by a specific set of quantum letters composing the specific quantum alphabet. From practica' point of view, most significant difference between QKD protocol with continuous alphabet and QKD protocols with discrete alphabets lies in the bases reconciliation procedure. In QKD protocols with discrete alphabets, Alice and Bob performs exact basis reconciliation, i.e. after transmission of all massages they select only those part of messages, for which they have used the same information bases. By contrast with discrete alphabet , one cannot performs exact basis reconciliations procedure for the oo-states protocol, because one needs to transmit an infinitive amount of information about a point from continuum. Therefore, we suggest to apply approximate bases reconciliation procedure for the oo-states protocol, which is outlined below. Let us split the continuous alphabet into several equal, possibly partially overlapping, areas that are composed of approximately equal quantum letters. During the bases reconciliation procedure, Alice and Bob will transmit number of an area to which belongs the information basis, an will decide then that they used equal bases if they belong to the same area. Clearly, such approximate bases reconciliation procedure introduces additional errors, or internal noise, into the transmitted message due to the differences between quantum letters of the same area. However, the smaller size for the areas we select, the smaller such errors. We can calculate how the amount of information I in a single transmitted qubit depends on the number of areas M in which we split the Hilbert space with the help of quantum compatible information technique outlined above.

To do that, let us split the Bloch sphere into equal, for simplicity round areas, which partially overlap each other. After bases reconciliation, letters of Alice and Bob belong to the same area and continuously fill it. Therefore, a set of elementary events related to the Alice--Bob system can be represented after bases reconciliation with the help of continuous expansion of unit operator at the given rounded area. The respective amount of information 'AB for the approximate bases reconciliation depends on the size of the area or, in fact, on the number of areas we split the Hubert space in. This dependency is shown in Fig. 1.

1.0

0.8 0.6 0.4
0.279

0.2

50

100

150

200

M
Figure 1. The amount of information I per transmission versus the number of areas M in which two-dimensional Hilbert space of states is split.

Proc. of SPIE Vol. 5833

231


bit. At M =

With increasing the total number or areas (decreasing their size, respectively) ,'AB changes from 0.279 to 1 1, i.e., when the quantum alphabet is composed of only one area and, therefore, bases reconciliation is de facto vanishes, the amount of information is equal to the accessible information JAB 0.279 bit [16, 18]. With increasing the number of areas up to M = 100 we get 'AB 0.9 bit and in the limit of M --Â oo we have a priori evident result 'AB ' 1 bit. In other words, in order to ensure high values of 'AB one needs just to select essential number of areas M < oo. Note, that reduction of the area size leads to increasing of the number of areas we split the Hilbert space in and, therefore, to the responding increase of the additional information on the number of area transmitted via a public channel. The amount of messages selected after the bases reconciliation procedure is also decreasing proportionally to the size of the area. In practice, however, there is no need in infinite increase of the accuracy in bases reconciliation; it is enough to choose a reasonable level of accuracy in bases reconciliation for every specific case. One more specificity of the oo-states protocol, which follows directly from approximate bases reconciliation procedure, is how to estimate the level of Eve's interference. One of the most accepted in the literature characteristics for estimation of the Eve's interference is the quantum bit error rate (QBER) . It was suggested to characterize the error rate in the sifted key and defines as follows:

Q=1-/--, max

(6)

where N is the number of correctly transmitted letters and Nmax 5 the total number of transmitted letters. This definition of the QBER contains an implicit assumption that without eavesdropping Q is equal to zero. Obviously, the QBER for an ideal quantum channel without noise is equal to zero and one can use the QBER for estimation of the Eve's interference.
However, in the case of oo-states protocol, when due to the approximate bases reconciliation we have information per message less than a whole bit, and Q is not equal to zero even without eavesdropping, we cannot use the QBER characteristic for estimation of eavesdropping. In this case, the QBER as it has been defined previously simply does not reflect the real level of the Eve interference because it equally takes into account external noise due to the possible eavesdropping and internal noise due to the QKD protocol specifics, namely, an approximate bases reconciliation. In order to resolve this contradiction with the definition of QBER (see also Ref. [19]), we suggest to use another characteristic for the error rate, which correctly reflects the degree of Eve's interference for an arbitrary QKD protocol. Let us define the fidelity of data transmission not as a relative number of correctly transferred letters, but as the relative amount of correctly transferred information. Then, the error rate can be defined as

=1--e[O,1], max

(7)

where I is the amount of information per one message with the presence of eavesdropping and 'max its maximal possible value without eavesdropping. We will call this measure, by analogy with QBER, the mutual information error rate or MIER. By contrast with QBER, MIER correctly reflects the degree of Eve's interference for an arbitrary QKD protocol-- either with the exact or approximate bases reconciliation procedure. In absence of any noise both measures QBER and MIER have the same value, Q = Q = 0, which correctly reflects an a priori expected value. However, in the case of maximal Eve's interference, these measures are significantly different: Q =0.5 when Q = 1, which is due to the different definitions of the error rate measures. In the following, when it is not indicated otherwise, we will use the MIER as the most adequate measure of Eve's interference, or QBER with under limiting assumption that the bases for the oc-states protocol are reconciled
exactly.

The fact that there are no any principal limitations on the physically allowed complexity of the bases reconciliation procedure allow us to use in the following for the estimation of the maximal error rate of the QKD protocol the respective value for the number of areas M -- oc.

232

Proc. of SPIE Vol. 5833


3. COMPARISON OF THE QKD PROTOCOLS
For determining the critical error rate in the transmitted message up to which the QKD protocol ensures the absolute security of transmitted data one needs generally to prove the absolute security of the QKD protocol [20, 21] . However, in this work we are not going to repeat the ultimate security proof, but perform a comparative analysis of one of the best by now six-states protocol with the 4-, 8-, 12-, 20- and oo-states under Eve's attacks. We will limit our consideration by considering only two key strategies of eavesdropping--intercept--resend and optimal eavesdropping and will compare the critical error rate for two QKD protocols.

3.1. Intercept--resend strategy of eavesdropping
One of the simplest strategies of eavesdropping is the intercept--resend strategy [12] when Eve measures a message

transmitted over a secure channel in an arbitrary orthogonal basis and then transmits to Bob the results of this measurement. It is clear that using such strategy Eve knows exactly information received by Bob and therefore
secure data transmission between Alice and Bob is impossible. Therefore, maximal possible level of errors, which can be corrected and the transmission is a secure one, does not exceed the level of errors caused by the intercept--resend

strategy of eavesdropping. As a result, calculation of the error rate due to this strategy of eavesdropping gives the upper bound of the protocol efficacy at any applied strategy of eavesdropping. Let us assume that after bases reconciliation procedure Alice and Bob found that Alice transmitted to Bob state Ia) and Eve used an orthogonal basis {b), Ib±)} to eavesdrop the information. Then, Eve measured the information resulting to either b) with probability I (L Ia) 12 or to Ib±) with probability I (bj. Ia) 2 and transmitted the resulted state to Bob. After measurement of states Ib) and II'±) in basis {a), a1)} Bob receives the correct result (state c)) with probabilities ('Ãb a ) 2 and (1' Icr) 12, respectively, and incorrect result (state Iat))--with probabilities (XL' aj ) 2 and (bj aj ) 2. Total probability of getting correct result a) by Bob is equal to Fa, -- I (i,L Ia) I + I ('L k) . Respectively, probability of getting wrong result is equal to Q = 1 Fa. In order to get QBER Q, one needs to average Q over all Alice's bases {c} and minimize then the result of the averaging over the Eve's bases {}:

NN

{a}

{}

(8)

where N. and N,p is the number of bases in the Alice's and Eve's alphabet. For the QKD protocol with continuous alphabet averaging means integration instead of summation. 0.333 and Calculating Q for the considered QKD protocols, we get Q4--state Q6--state Qoo--state 1/3 0.329. It is interesting to note that despite geometrical symmetry of all discussed Q12--state = Q20--state -- 74/225 alphabets, they have, nevertheless, different error rates: 4-, 6- and oo-state protocols have equal error rates but exceed 12- and 20-state protocols ones.

3.2. Optimal eavesdropping strategy
It has been proved that in one--way communication schemes, when only Alice can send qubits to Bob, a secure connection between Alice and Bob is possible if the amount of information Bob received from Alice exceeds information Eve received either from Alice or Bob [22] . This condition can be written as

JAB > max(IAE,IBE).

(9)

We will call Eve's eavesdropping strategy as optimal if Eve extracts from the transmitting message maximum information at the given level of interference, which causes the respective level of errors (note that this can differs from the optimal cloning of the transmitting message [23}). If the transformation performed by Eve is non-unitary, then it corresponds to a unitary transformation in an extended quantum system with the following averaging over some variables, which gives Eve no any additional information and creates no any additional problems for Alice and Bob. Therefore, we can assume (without reducing the generality of our consideration) that at the optimal eavesdropping Eve performs the unitary transformation UBE on the transferring from Alice to Bob state II)B and the probe Eve's state I0)E, which can be written as I0)B I0)E --f I0)B IOO)E + 1)B IO1)E,
UBE

I1)B I0)E --p I0)B I1O)E + I1)B I11)E

Proc. of SPIE Vol. 5833

233


The unitarity imposes the following restrictions, which are due to the orthogonality and normalization conditions:

(ooIio)+(Ioi
Taking

IooI2 + oiI2 = 1ioI2

11ii) =0,

+ IiiI2

1.

(11

)

we can present a set ) of all the states

into account conditions (11) and due to the symmetry of the alphabets of the considered QKD protocols, as a superposition of only two basis states:

Ioo)

'yoo yoi

F
where

=

Ioi)
lii)

=

'71°
'Yoi

'711

(IO)E
\j1)E)'

io)

711 710
700

(12)

the transformation coefficients

7mn (_1)mn cos (0 --
are determined via the two angles 0, cc, controlled by Eve.

m)

cos (Ão --

n)

Initial state of the quantum system Alice-Bob-Eve IE = ® f0)E (OlE, which is described by the tensor product of the maximally entangled pair Alice-Bob and an initial Eve's state I0)E(OlE after transformation of optimal eavesdropping (10) is transferred into the final state IE that is an entangled state of Alice, Bob, and Eve: (1) UBE 2)
PABE
PABE

Resulted bipartite Alice-Bob, Alice-Eve, and Bob-Eve density matrices obtained by averaging of the three-partite density matrix PABE over the third system enable us to calculate the respective mutual information:

I5 = I3 =
/5B2?E:

'AB, TBP4JE " 'AE, T1ApJE , 'BE

T]EP4E

('

(13)

Optimal eavesdropping condition, which must be checked, can be written as

'AE,BE =
where Eve can vary the parameters 0 and ÃÝ.

JAB =const

max

'AE,BE,

(14)

Comparing results for the Alice-Bob, Alice-Eve, and Bob-Eve mutual information (JAB, 'AE, and 'BE, respectively) calculated with the help of equations (10) and (13) versus parameters U and controlled by Eve, one can easily show that for all values of 0, Ão we have 'AE 'BE, thus we will not discuss 'BE in the following. The security condition 'AB > 'AE due to the symmetry JAB(O, Ão) = 'AEOP, 0) is fulfilled up to a certain critical (1) = r/8 until which information retrieved by Eve is equal to the information received by Bob. At this level O1) critical point, the critical error rate Qo is equal to 0.650, 0.630, 0.607, 0.597, 0.589, and 0.600 for the 4-, 6-, 8-, 12-, 20-, and oc-state protocols, respectively.

Up to now, we analyzed case, when Alice and Bob does not perform the bases reconciliation, which can essentially increase the critical error rate and improve the stability of the QKD protocol at a higher level of the Eve's interference.

Let us assume now that Alice and Bob uses safety bases reconciliation procedure. Safety means, that Eve does not affect selection of data by Alice and Bob during this procedure, does not generate false messages in the public insecure channel and does not use any additional transformations of her probe state after the bases reconciliation. In other words, she gain no additional information from basis reconciliation procedure. Urgency of the assumptions about safety basis reconciliation is based on the following. First, the assumptions made suit well the reality of up-to-date technologies and look reasonable from physical point of view. In order to retrieve additional information from bases reconciliation, Eve has to have unlimited

234

Proc. of SPIE Vol. 5833


quantum memory, which allow storing of the intercepted quantum information infinitely long. At the up-to-date level of experimental techniques in this field, this is impossible to implement. Any imperfections in storing of the intercepted quantum information lead inevitably to decoherence and, respectively to the loss of information. If the legitimate parties of the QKD protocol (Alice and Bob) make a pause between data transmission and bases reconciliation, which exceeds the typical decoherence time in the system, then the bases reconciliation will not give any additional information to Eve. Second, though the assumption that Eve does not retrieve additional information from the bases reconciliation is definitely a limitation, it is, however, equally applicable to the analysis of all QKD protocols of interest. Calculated critical error rates with limitations on eavesdropping strategies do not serve then as the absolute security criterions, but our goal is to compare different QKD protocols, and, with some restrictions on Eves strategies, this analysis seems to be suitable for this purpose.
After such safety bases reconciliation, information received by Bob from Alice proportionally increases by contrast with case when no bases reconciliation made, and reaches its maximum value of 1 bit per message (in the limit of exact bases reconciliation for the QKD protocol with continuous alphabet). Information in the system Alice--Eve remains the same according to the assumption made. After the bases reconciliation, the security condition lAB > 'AE is fulfilled up to a certain, depending on a specific protocol, critical value O2) 42) , different from value O1) 1) corresponding to the case without bases reconciliation. Also, critical error rate Qo becomes significantly higher and is equal to 0.788, 0.806, 0.805, 0.804, 0.805, and 0.811 for the 4-, 6-, 8-, 12-, 20-, and oo-state protocols, respectively. The calculation results for the critical error rate are summarized in Table 1.

Table 1. Critical error rate Qo for 4-, 6-, 8-, 12-, 20- and oo-state QKD protocols with and without bases reconciliation.

[ Number

of letters

4
0.650 0.788

6
0.630 0.806

8
0.607 0.805

Before basis reconciliation After basis reconciliation

12 0.597 0.804

20 0.589 0.805

oo 0.600
0.811

Q > Qo [12]. Then, at the error rates exceeding critical, i.e. at Q > Qo, the QKD protocol does not ensure the security of the transmitted data and the transmission session is not established. So, the higher critical error rate Qo,
the more stable the QKD protocol to the eavesdropping attacks, because it allows greater level of interference. Summarizing, our information analysis shows that without bases reconciliation the 4-state protocol has the best maximum value of the critical error rate. But after safety bases reconciliation procedure applied we see, however, that the co-state protocol has a higher critical error rate in comparison with the considered QKD protocols. In other words, information characteristics of six-state protocol can be surpassed even in case of two-dimensional Hilbert space due to a better choice of the alphabet.

- We do not consider case of two-way communication, when one capable to establish a secure connection even at

4. MULTIDIMENSIONAL CASE
In this Section, we will discuss a potential of using multidimensional Bob's and Alice's spaces (D > 2) for improving the properties of QKD protocols, which is especially promising for the QKD protocol with continuous alphabet. For the upper estimate of the multidimensional protocols efficacy we will calculate, by analogy with two-dimensional case, errors caused by intercept--resend strategy. Let us consider a quantum alphabet, consisting of LD mutually unbiased bases in D-mensional Hilbert space, i.e., alphabet, different letters of which have equal projections to each other. For such alphabet we will calculate now the accuracy of transmitting an arbitrary letter when Eve uses the intercept--resend strategy of eavesdropping. First, Alice transmits a random letter to Bob from randomly selected bases. If Eve guesses this basis, the letter will be transmitted to Bob without distortion: this scenario happens with the probability 1/LD . Otherwise, if Eve does not guesses the right basis (it happens with probability 1 -- 1/LD), then the transmitted to Bob letter will be

Proc. of SPIE Vol. 5833

235


replaced by Eve during resending with equal probability (due to the above suggestion of the symmetrical alphabet) to a different one from another basis. Bob receives a right letter, which was transmitted by Alice, with probability 1/D, otherwise he received a wrong letter. Total probability that Eve does not distort the transmitted by Alice letter (when Eve guesses correctly or incorrectly the basis) is equal to Fjj = 1/LD + (1 -- 1/LD)/D and the respective probability to distort the letter is equal

to

QD=1_FD=1_(1+LDDl).

(15)

Checking this formula for BB84 (LD = 2, D = 2) and six-state (LD = 3, D = 2) protocols, we get well-known numbers: 1/4 and 1/3, respectively. In the limit of D -- oo, we get QD --p -- 1/LD. This means that alphabets with maximum number of mutually unbiased letters are more favorable. For the maximum number D + 1 of mutually unbiased bases in D-dimensional space [24] we get the error rate Q = 100 %:
Qoc

= lim QD 1 -- lim D--+oc

--( Dj D--cD + --

= 1.

(16)

For infinite--dimensional case, maximum possible error rate is equal to 100%, by contrast with 50% for the twodimensional case. This is due to the fact that in two-dimensional case non-guessing a letter by Eve means guessing

the opposite letter and if the error rate Q > 0.5 then Bob can simply replace all "0" in the message with "1"

=1-- < os. In multidimensional case, this trick does not work--the higher the and vise versa, achieving dimension of the Hilbert space, the higher the maximum possible error rate.
Therefore, one can conclude from ratio (16) that there are no principal restrictions on increasing the efficacy of the QKD protocols with increasing the dimensionality of the Hilbert space because there is no any upper threshold set by the intercept-resend strategy. Keeping this specifics of QKD protocols with multidimensional alphabets, let us consider now an extension of the oo-state protocol on the case of multidimensional Hilbert space. Note that in multidimensional case, maximum possible selected information between two systems Iax log2 D grows infinitively at D --* oo whereas maximum possible non-selected information is bounded: it is equal to the amount of accessible information [18]
'accessible = log2 D -- k=2

Q

k'

which in the limit D --+ oc is restricted by the value 'cessib1e

0.61 bit. In case when Eve does not extract additional information from bases reconciliation procedure and disengage oneself from a specific eavesdropping strategy, we can estimate the upper limit of maximum amount of non-selected information, which is received by Eve, by the accessible information. In fact, information received by Eve will be even smaller. The amount of information in the systems Alice--Bob and Alice--Eve after the bases reconciliation procedure is given by the maximum possible selected or non-selected information in the system, respectively. Then the critical mutual information error rate (7) in the limit D -- oc is equal to unit:

cc

1--

D--oc

lim

1D accesstble = _ lim 061 D--oclog2D 'max

=

1.

(17)

The critical mutual information error rate Qo calculated by formula (17) versus the dimensionality of the Hilbert space is shown in Fig. 2. This result shows qualitatively novel property of the multidimensional oo-state protocol with respect to two-dimensional case--with increasing the dimensionality of the Hilbert space the critical error rate for this protocol increases and in the limit of infinite-dimensional space the protocol becomes non-threshold.

236

Proc. of SPIE Vol. 5833


1.00

0.96

0.92

.·

0.88

.

0.84
S

0.80

0

4

8

12 16 20 24 28 32
D
versus the dimension D

Figure 2. Critical error rate Qo

of the Hilbert space.

Such behavior of the critical error rate does not depend on specific structure of eavesdropping by Eve and can be clarified as follows. When Alice sends a message, then both Eve and Bob have a prioriminimal information about this message being "maximally entangled" in the multidimensional space. After bases reconciliation, Alice and Bob can select only maximally correlated messages for which they choose approximately similar bases. As a result, information bond between Alice and Bob per one message will be significantly improved. Eve, in her turn, cannot affect the processes of messages selection and her information remains the same. Therefore, Eve with increasing the dimensionality of the Hilbert space retrieves much less information than Bob, which leads finally to the non-threshold property of the QKD protocol with continuous alphabet. In the reasoning above, we made the only assumption about safety basis reconciliation, which was discussed in Section 3.2.

5. CONCLUSIONS
In conclusion, our information analysis shows that critical error rate of the six-state protocol can be surpassed even in case of two-dimensional Hilbert space due to a better choice of the alphabet. Namely, without bases reconciliation the 4-state protocol has the best maximum value of the critical error rate. But after bases reconciliation procedure is applied, use of continuous alphabet in case when an eavesdropper has no ability to store the intercepted information in a quantum form leads to a slightly higher critical error rate than that one of the six-state protocol, even in the two-dimensional case. With increasing the dimensionality of the Hilbert space the critical error rate of the oo-state protocol increases, and in the limit of infinite-dimensional space the protocol becomes non-threshold. This promising property could, in our view, stimulate efforts in experimental implementation of this protocol. In case of two-dimensional Hilbert space, the oo-state QKD protocol can be experimentally implemented with a help of the standard QKD schemes, based on coding a qubit with photon polarization. Demonstration of the nonthreshold property of the infinite-dimensional oo-state QKD protocol will, however, require some novel experimental solutions. This work was partially supported by RFBR grants Nos. 02--03--32200, 04--02--17554, and INTAS grant INFO
00--479.

REFERENCES
1. Ch. H. Bennett and G. Brassard, in Proceedings of the IEEE International Conference on Computer, System and Signal Processing, Bangalore, India (IEEE, New York, 1984), p. 175.

Proc. of SPIE Vol. 5833

237


'V 'N 'SAuld 'AO)-J V 'L9 T99 (1661) "TO 'H 'OUUOH 'SAq 'AOj '89 TT '(66T) 'CI 'ssnlH 'SAq 'AoJ 'orI '18 'STO (66T) suqssoirjpiie 'd 'JOiU1f) 'SAud 'AOIi 'WT '88 O6LO '(oo) 9 M 'N SIOOOM PU M 'H 'ImZ O1flN (UOpUOrJ) '66 (6T) L 'H ioonuTnbsid-uu?ur1poH pu 'N 'UTSIf) SAud A03J V ZT7 (6661) II oonuTnbS13-uuwqoopu M sAijj AOIJ y '19 8Oi9O (ooo) ·6 TAT 'OTiUUIflO[ 'V 'uoSsiM pu ')J1O SAq AO)-J y 'f79 9OTO (Too) UT N f 'JD JAI 'OU1UUO1flOj y 'UOSSJiM pu 'USJ SAud AO-J WI '88 O6LT (oog) IT 0 pu MH 'O' 3JJ[J SUO1SU1J JUJ ciooijj '6ff LgJ7 uid-o TToTO/qd-unb

'''

'TI

'°1

j

'6

(oo) T N 'UiSiJ AO-J poj,s SAJd 'T72 'o '°iiio uozvwuofu y 'uiuqsp AZJ piv (oo) T f 'IIi)JSOld LTh27 sou

uuisoo

oo) rJyr ryJ
'LT7

Ii
·9T LI

TT

fLto3jj pun

(oo)

'sss °s

qvij

UO

61

·O

T

j y uujsi '-'ID 3 3 · ·y sqznj j }J-fl pu dM PU T
H 'V
TAT

/J
V

uozxnunuzvoj rnjoÃ) AOIIM ipjoj 1oq LT L6T)

'ii

pTre 'sTIoS

°N

')JJOA

(96T

uiid-

wnuvm uoizniofui puv 'uoivndwo pyp3oI

AN

!PPJ0d

'Ao)p13z

SOAD

V 'sTT3nd ·V 'SOlOd
'IIPISOld
}1

O'j 1oTIS

H

'nqj ouos
SAq

SId

'INWI u!1d-o OTO96/qdVflb (966T)
AOJ

à jo unuiuxo oouqoj !!smJoJuI 'si: T '(oo)

':s

OO
·WT

c

H

y

'ouuo

M

[ sooo

'SIOfl N

'Di v-'

pxssi pu r
a

AO1J

I

'ii

'TTiJ!'D

·uuy

'ioqoj j,'iyis SD '!N P-'
sAq

''

r-'

so!uoipoIEE

6

(oo)

(966T) (6661)
1147

(ooo) Ã nduxo3 'LT

Y 'S1d SATd ItOH V (AN) '161 (66T)

o

(6T)

'9

9TI

(L66T)

238

Proc. of SPIE Vol. 5833