Äîêóìåíò âçÿò èç êýøà ïîèñêîâîé ìàøèíû. Àäðåñ îðèãèíàëüíîãî äîêóìåíòà : http://qilab.phys.msu.ru/papers/SPIE-5833-272-281(2005).pdf Äàòà èçìåíåíèÿ: Mon Feb 4 18:39:37 2008 Äàòà èíäåêñèðîâàíèÿ: Mon Oct 1 20:02:38 2012 Êîäèðîâêà:

Optimal alphabets for noise-resistant quantum cryptography
Denis V. Sych, Boris A. Grishanin, and Victor N. Zadkov

International Laser Center and Department of Physics, M. V. Lomonosov Moscow State University, Moscow, Russia

ABSTRACT
Possibilities of improving critical error rate of quantum key distribution (QKD) protocols for different strategies of eavesdropping are investigated. QKD-protocols with discrete alphabets, letters of which form regular polyhedrons

on the Bloch sphere (tetrahedron, octahedron, cube, icosahedron, and dodecahedron, which have 4, 6, 8, 12, and 20 vertexes respectively) and QKD-protocol with continuous alphabet, which corresponds to the limiting case of a polyhedron with infinitive number of vortexes are considered. Stability of such QKD-protocols to the noise in a quantum channel, which is due to the Eve's interference that apply either intercept-receipt or optimal eavesdropping strategy at the individual attacks, is studied in detail. It is shown that in case of optimal eavesdropping strategy, after bases reconciliation, the QKD-protocol with continuous alphabet surpasses all other protocols in terms of noise-resistance. Without basis reconciliation the highest critical error rate have the protocol with tetrahedron-type alphabet. Keywords: quantum key distribution, quantum cryptography, critical error rate, quantum alphabet

1. INTRODUCTION
Since 1970s, when the idea of quantum cryptography was proposed first [1] ,a number of different quantum key distribution (QKD) protocols implementing it have been suggested [2--5]. Despite their diversity all of them are based on a beautiful idea employing a basic "no-cloning" principle of quantum mechanics--impossibility of copying arbitrary quantum states [6] . Thanks to this, an eavesdropper cannot intercept the quantum communication channel without disturbing a transmitting message if it contains a set of incompatible, i.e. , essentially quantum, not governed by the rules of classical logic, states. Moreover, any attempt of obtaining any information about this set of states inevitably disturbs the transmitted message.

Keeping this advantage of quantum physics for cryptography in mind, any QKD protocol uses messages entirely composed of an incompatible set of quantum states or so called quantum alphabet that consists of
incompatible "letters" . Various QKD protocols are distinguished in essence only by different alphabets, which ensure secure message transmission up to a critical error rate that determines the protocol efficiency. Analyzing

distortions in received messages one can reveal an eavesdropping attack, but in order to establish a secure
connection one should also be capable to resist such attacks. Therefore, one of the reasons for developing novel Q KD protocols is increasing their critical error rates. All known QKD protocols [1 ,3, 4] using carriers of information with finite-dimensional Hubert space are based on discrete quantum alphabets, i.e. with fixed number of letters. First QKD protocol proposed in 1984 by Bennett and Brassard (BB84) [1] gives an example of the protocol in which four quantum incompatible states, setting two mutually nonorthogonal bases, are used. Alphabet of six-state protocol [4] is composed of three mutually i))//}} of the two-dimensional Hilbert space, which nonorthogonal bases {{IO) , I1)}, {(O) i))//}, {(O) makes this protocol totally symmetrical on the Bloch sphere and leads to the fact that information characteristics, namely, critical error rate of six-state protocol surpasses those of the BB84-protocol [4, 7] . Further increasing the critical error rate, as it is discussed in the literature [8--lU] , is basically connected with increasing the dimension of the Hilbert space of the quantum channel. In two-dimensional case, there is a commonly accepted opinion that six-state protocol has the best efficacy [11]. However, there is no proof of this statement for all possible eavesdropping strategies and in this paper we will clarify whether increasing the number of letters in the alphabet in the Hilbert space of fixed dimension could
E-mail: sych©comsim 1 .phys.msu.ru; grishan©comsiml phys. msu.ru; zadkov©comsiml .phys. msu.ru

272

Quantum Informatics 2004, edited by Yuri I. Ozhigov, Proceedings of SPIE Vol. 5833 (SPIE, Bellingham, WA, 2005) · 0277-786X/05/$15 · doi: 10.1117/12.620519


improve the QKD protocol efficacy or not. In other words, whether we could surpass six-state protocol efficacy, even in two-dimensional case, due to the increasing the number of letters in the alphabet or not? In order to answer this question, we introduce QKD protocols with discrete alphabets, letters of which form regular polyhedrons on the Bloch sphere (tetrahedron, octahedron, cube, icosahedron, and dodecahedron, which

have 4, 6, 8, 12, and 20 vertexes), and QKD protocol with continuous alphabet, which corresponds to the
limiting case of a polyhedron with infinitive number of vertexes. Well known six-state protocol corresponds to the octahedron--type alphabet, so by analogy with it we will call such protocols 4-, 6-, 8-, 12-, 20-, and oc-state protocols, respectively. Their efficacy can be calculated the same way as for other standard QKD protocols, i.e. with the help of regular information analysis based on calculation of the mutual Shannon information between different two-partite subsystems of the tripartite system Alice--Eve--Bob [12]. The paper is organized as follows. In Section 2, we outline specific properties of the oc-state protocol and give the basic concept and key mathematical formalism of the compatible information in application to the quantuminformation analysis of arbitrary QKD protocols. In Section 3 we provide a comparative quantum-information analysis of the considered QKD protocols. Future trends of using Hubert spaces with arbitrary dimension in QKD protocols are considered in Section 4. We conclude the paper by summarizing the results and discussing possibilities of experimental realization in Section 5.

2. SPECIFIC PROPERTIES OF THE oo-STATE QKD PROTOCOL
From theoretical point of view, key difference in analysis of oc-state protocol and QKD protocols with discrete alphabets lies in calculation of the amount of information that can be encoded with the help of continuous

alphabet. A natural quantitative measure for the amount of information is the standard mutual Shannon
information functional of the classical input--output (Alice-Bob) joint probability distribution PAB:
IAB[PABJ
where
S{PA] + S[PB] --

S[PAB],

(1)

S{P] is the classical Shannon entropy functional for the joint, P = PAB, and marginal, P = PA, PB,

probability measures [13]. Specific of continuous alphabet is shown up in calculation of the joint probability distribution, defined on the continuous set of elementary quantum events, which can be determined by the wave functions or the state

vectors of the quantum information system. Mathematically, a choice of a set of elementary events can be given by defining a set of positive operators E,. = v) (v, representing a non-orthogonal expansion of the unit
operator [14] or the positive operator valued measure (POVM) {15]:

1=E.
i=fIv)(dv
where

(2)

In case of oo--state protocol, when the information exchange between two quantum systems employs all states of the Hilbert space, expansion (2) transforms into the continuous non-orthogonal expansion of the form [16]:
(3)

dV is the volume differential normalized to the dimension of Hubert space D: f dV = D. The correPAB(da,d,13) = TrAB([EA(ck4

sponding joint probability distribution has the form:

® EB(d/3)]B),

(4)

where EA,B(dv) = V)AB (VA,B dV, and defines the so called non-selected mutual information [16,17]

'AB =jj

[fPAB(da,d/3)log2

PAB(da,d/3) PA(da)PB(d/3)

(5)

Proc. of SPIE Vol. 5833

273


In case of information exchange between two quantum systems via arbitrary discrete quantum alphabet, expansion (2) is defined by a specific set of quantum letters composing the specific quantum alphabet. From practical point of view, most significant difference between QKD protocol with continuous alphabet and QKD protocols with discrete alphabets lies in the bases reconciliation procedure. In QKD protocols with discrete alphabets, Alice and Bob performs exact basis reconciliation, i.e. after transmission of all massages they select only those part of messages, for which they have used the same information bases. By contrast with discrete alphabet, one cannot performs exact basis reconciliations procedure for the ocstates protocol, because one needs to transmit an infinitive amount of information about a point from continuum. Therefore, we suggest to apply approximate bases reconciliation procedure for the oc-states protocol, which is outlined below. Let us split the continuous alphabet into several equal, possibly partially overlapping, areas that are composed of approximately equal quantum letters. During the bases reconciliation procedure, Alice and Bob will transmit number of an area to which belongs the information basis, an will decide then that they used equal bases if they belong to the same area. Clearly, such approximate bases reconciliation procedure introduces additional errors, or internal noise, into the transmitted message due to the differences between quantum letters of the same area. However, the smaller

size for the areas we select, the smaller such errors. We can calculate how the amount of information I in a single transmitted qubit depends on the number of areas M in which we split the Hilbert space. To do that, let us split the Bloch sphere into an equal, for simplicity circle, areas, which partially overlap each other. It is easy to show, that 2N2 circle areas with radius rr/2N cover all Bloch sphere with unit radius. Calculating the information per qubit
(6)

with integration over the circle area we obtain results shown on the table 1.
Table 1. Amount of information per qubit after approximate basis reconciliation as a function of a number of areas.

Number of areas

1

2

8

18

32

50

72

98

Amount of information 0.279 0.469 0.801 0.906 0.946 0.965 0.976 0.982
With increasing the total number or areas (decreasing their size, respectively), 'AB changes from 0.279 to 1 1, i.e., when the quantum alphabet is composed of only one area and, therefore, bases reconciliation is de facto vanishes, the amount of information is equal to the accessible information 'AB 0.279 bit [16, 18J. With increasing the number of areas up to M 100 we get 'AB 1 bit and in the limit of M --*oc we have a priori evident result lAB --f 1 bit. In other words, in order to ensure high values of JAB one needs just to select essential number of areas M < oo.* Note, that reduction of the area size leads to increasing of the number of areas we split the Hilbert space in and, therefore, to the responding increase of the additional information on the number of area transmitted via a public channel. The amount of messages selected after the bases reconciliation procedure is also decreasing proportionally to the size of the area. So, the total traffic on the both classical and quantum channels increases. In practice, however, there is no need in infinite increase of the accuracy in bases reconciliation; it is enough to choose a reasonable level of accuracy in bases reconciliation for every specific case. One more specificity of the oo-states protocol, which follows directly from approximate bases reconciliation procedure, is how to estimate the level of Eve's interference. One of the most accepted in the literature characteristics for estimation of the Eve's interference is the quantum bit error rate (QBER). It was suggested to

bit. At M =

*The fact that there are no any principal limitations on the physically allowed complexity of the bases reconciliation procedure allows us to use in the following for the estimation of the maximal error rate of the QKD protocol the respective value for the number of areas M --* oo.

274

Proc. of SPIE Vol. 5833


characterize the error rate in the sifted key and defines as follows:

Q=1-,
max

(7)

where N is the number of correctly transmitted letters and Nmax is the total number of transmitted letters. This definition of the QBER contains an implicit assumption that without eavesdropping Q is equal to zero. Obviously, the QBER for an ideal quantum channel without noise is equal to zero and one can use the QBER
for estimation of the Eve's interference. However, in the case of oc-states protocol, when due to the approximate bases reconciliation we have information per message less than a whole bit, and Q is not equal to zero even without eavesdropping, we cannot use the QBER characteristic for estimation of eavesdropping. In this case, the QBER as it has been defined previously simply does not reflect the real level of the Eve interference because it equally takes into account external noise due to the possible eavesdropping and internal noise due to the QKD protocol specifics, namely, an approximate bases reconciliation. In order to resolve this contradiction with the definition of QBER (see also Ref. [19]), we suggest to use another characteristic for the error rate, which correctly reflects the degree of Eve's interference for an arbitrary QKD protocol. Let us define the fidelity of data transmission not as a relative number of correctly transferred letters, but as the relative amount of correctly transferred information. Then, the error rate can be defined as

=1--E[O,1], max

(8)

where I is the amount of information per one message with the presence of eavesdropping and 'max iS its maximal possible value without eavesdropping. We will call this measure, by analogy with QBER, the mutual information

error rate or MIER. By contrast with QBER, MIER correctly reflects the degree of Eve's interference for an arbitrary QKD protocol--either with the exact or approximate bases reconciliation procedure. In absence of any noise both measures QBER and MIER have the same value, Q = Q = 0, which correctly reflects an a priori expected value. However, in the case of maximal Eve's interference, these measures are significantly different: Q =0.5 when Q = 1, which is due to the different definitions of the error rate measures. In the following, when it is not indicated otherwise, we will use the MIER as the most adequate measure of Eve's interference, or QBER with under limiting assumption that the bases for the oc-states protocol are
reconciled exactly.

3. COMPARISON OF THE QKD PROTOCOLS
For determining the critical error rate in the transmitted message up to which the QKD protocol ensures the absolute security of transmitted data one needs generally to prove the absolute security of the QKD protocol [20,21]. However, in this work we are not going to repeat the ultimate security proof, but perform a comparative analysis of one of the best by now 6-states protocol with the 4-, 8-, 12-, 20- and oc-states under Eve's attacks.
We will limit our consideration by considering only two key strategies of eavesdropping--intercept--resend and optimal eavesdropping and will compare the critical error rate for two QKD protocols.

3.1. Intercept--resend strategy of eavesdropping
One of the simplest strategies of eavesdropping is the intercept--resend strategy [12] when Eve measures a message

transmitted over a secure channel in an arbitrary orthogonal basis and then transmits to Bob the results of this measurement. It is clear that using such strategy Eve knows exactly information received by Bob and therefore secure data transmission between Alice and Bob is impossible. Therefore, maximal possible level of errors, which can be corrected and the transmission is a secure one, does not exceed the level of errors caused by the intercept-- resend strategy of eavesdropping. As a result, calculation of the error rate due to this strategy of eavesdropping gives the upper bound of the protocol efficacy at any applied strategy of eavesdropping.
Proc. of SPIE Vol. 5833 275


Let us assume that after bases reconciliation procedure Alice and Bob found that Alice had transmitted to

Bob state a). Let us further assume that Eve had have used an orthogonal basis {'), /j)} to eavesdrop the information. Then, Eve measured the information resulting to either b) with probability (b c) 2 or to bj) with probability I (st-'- a) 2 and transmitted the resulted state to Bob. After measurement of states ) and kbj ) in basis { Ia) , Jcj )} Bob receives the correct result (state a) ) with probabilities (b a ) 2 and (bj c ) 2,
respectively, and incorrect result (state c1))--with probabilities (/.

of getting correct result a) by Bob is equal to F = (b a) I + (bj wrong result is equal to Q = 1 -- Fap.

a) c

)

2

'.

and (/

Total probability Respectively, probability of getting
)
·

a

2

In order to get QBER Q, one needs to average Q over all Alice's bases {c} and minimize then the result of the averaging over the Eve's bases {}:

NaN
and Q12--state =

(9)
{a} {5}

where Na and N,p i5 the number of bases in the Alice's and Eve's alphabet. For the QKD protocol with continuous alphabet averaging means integration instead of summation. 1/3 2 0.333 Calculating Q for the considered QKD protocols, we get Q4--state Q6--state Qoo--state

0.329. It is interesting to note that despite geometrical symmetry of all Q20--state = 74/225 discussed alphabets, they have, nevertheless, different error rates: 4-, 6- and oo-state protocols have equal error rates but exceed 12- and 20-state protocols ones.

3.2. Optimal eavesdropping strategy
It has been proved that in one--way communication schemes, when only Alice can send qubits to Bob, a secure connection between Alice and Bob is possible if the amount of information Bob received from Alice exceeds information Eve received either from Alice or Bob [22] . This condition can be written as

'AB > max(IAE, 'BE).

(10)

We will call Eve's eavesdropping strategy as optimal if Eve extracts from the transmitting message maximum information at the given level of interference, which causes the respective level of errors (note that this can differs from the optimal cloning of the transmitting message [23]).

If the transformation performed by Eve is non-unitary, then it corresponds to a unitary transformation in an extended quantum system with the following averaging over some variables, which gives Eve no any additional information and creates no any additional problems for Alice and Bob. Therefore, we can assume
(without reducing the generality of our consideration) that at the optimal eavesdropping Eve performs the unitary transformation UBE on the transferring from Alice to Bob state 3)B and the probe Eve's state 0)E, which can be written as
UBE

0)B 0)E 1)B 0)E

UBE

0)B OO)E + 1)B O1)E, 10)B 1O)E + 1)B 11)E.

The unitarity imposes the following restrictions, which are due to the orthogonality and normalization conditions:

(ooIio)+(IoiIIii) =0,
IooJ2 +

IoiI2 = IioI2 +

=

1

( 12

)

Taking into account conditions (12) and due to the symmetry of the alphabets of the considered QKD

protocols, we can present a set Kk) of all the states j) as a superposition of only two basis states:
11oo)

=

oi) =
1O)

'YoU

'Yoi
'Yb

'Yio

Iii)
276 Proc. of SPIE Vol. 5833

'Yii
'Yol

yn (0)E
\j1)E)
'YoU

(13)


where the transformation coefficients
7mn
are

(_1)mncos(O_m)cos(_n)

determined via the two angles 0, , controlled by Eve.
.

Initial state of the quantum system Bob-Eve (a) = O)E (OE ® a)B (aB after transformation of optimal . . . . . .. . . (2) eavesdropping (11) is transferred into the final state PEB(c). Calculating joint probability distribution for
three--partite system Alice--Bob--Eve give us PABE(a,

3, )

= T]BE I

1 (2) L()E (eE ® i)B (/3B) PEB()] dVEdVB.

(14)

Averaging it over the third system (Alice, Bob, or Eve, respectively) we obtain two--partite probability distributions PAB, PAE, and PBE, and, in accordance with equation (1), corresponding mutual information 'AB, 'AE, and 'BE as functions of 0 and Ão. Optimal eavesdropping condition, which must be checked, can be written as

'AE,BE =

max lAB const 'AE,BE,

(15)

where Eve can vary the parameters 0 and p. Comparing results for the Alice-Bob, Alice-Eve, and Bob-Eve mutual information (JAB, 'AE, and 'BE, respectively) calculated with the help of equations (1) and (14) versus parameters 0 and p controlled by Eve, one can easily show that for all values of 9, we have 'AE 'BE, thus we will not discuss 'BE in the following. The security condition lAB > 'AE due to the symmetry IAB(O, p) = IAE@p, 0) is fulfilled up to a certain critical level (1) = (1) = rr/8 until which information retrieved by Eve is equal to the information received by Bob. At this critical point, the critical error rate Qo is equal to 0.650, 0.630, 0.607, 0.597, 0.589, and 0.600 for the 4-, 6-, 8-, 12-, 20-, and oo-state protocols, respectively. It's interesting to note, that 4-state protocol shows higher critical error rate then those of 6-state protocol. Up to now, we analyzed the case, when Alice and Bob does not perform the bases reconciliation, which can essentially increase the critical error rate and improve the stability of the QKD protocol at a higher level of the Eve's interference. Let us assume now that Alice and Bob use safety bases reconciliation procedure. Safety means that Eve does not affect selection of data by Alice and Bob during this procedure, does not generate false messages in the public insecure channel, and does not use any additional transformations of her probe state after the bases reconciliation. In other words, she gains no additional information from basis reconciliation procedure. Justification of the assumptions about safety basis reconciliation is based on the following. First, the assumptions made suit well the reality of up-to-date technologies and look reasonable from physical point of view. In order to retrieve additional information from bases reconciliation, Eve has to have unlimited quantum memory, which allow storing of the intercepted quantum information infinitely long. At the up-to-date level of experimental techniques in this field, this is impossible to implement. Any imperfections in storing of the intercepted quantum information lead inevitably to decoherence and, respectively to the loss of information. If the legitimate parties of the QKD protocol (Alice and Bob) make a pause between data transmission and bases reconciliation, which exceeds the typical decoherence time in the system, then the bases reconciliation will not give any additional information to Eve. Second, though the assumption that Eve does not retrieve additional information from the bases reconciliation is definitely a limitation, it is, however, equally applicable to the analysis of all QKD protocols of interest. Calculated critical error rates with limitations on eavesdropping strategies do not serve then as the absolute security criterions, but our goal is to compare different QKD protocols, and, with some restrictions on Eves strategies, this analysis seems to be suitable for this purpose.

Proc. of SPIE Vol. 5833

277


After such safety bases reconciliation, information received by Bob from Alice proportionally increases by contrast with the case when no bases reconciliation made, and reaches its maximum value of 1 bit per message (in the limit of exact bases reconciliation for the QKD protocol with continuous alphabet). Information in the system Alice--Eve remains the same according to the assumption made. After the bases reconciliation, the security condition 'AB > 'AE is fulfilled up to a certain, depending on a specific protocol, critical value 2) 2) different from value 1) = Ão1 corresponding to the case without bases reconciliation. Also, critical error rate Qo becomes significantly higher and is equal to 0.806, 0.805, 0.804, 0.805, and 0.811 for the 6-, 8-, 12-, 20-, and oo-state protocols, respectively. The calculation results for the critical error rate are summarized in Table 2.
Table 2. Critical error rate Qo for 4-, 6-, 8-, 12-, 20-, and oc-state QKD protocols with and without bases reconciliation.

Number of letters Before basis reconciliation After basis reconciliation

4 0.650
*)

6

0.630 0.806

8 0.607 0.805

12

20

0.597 0.804

0.589 0.805

oc 0.600 0.811

*) The corresponding figure is omitted because the standard basis reconciliation procedure cannot be explicitly introduced for the 4--state protocol, as far as its alphabet cannot be represented as a combination of orthogonal
bases.

We do notconsider a case of two-way communication, when one capable to establish a secure connection Qo [12]. Then, at the error rates exceeding critical, i.e. at Q > Qo, the QKD protocol does not ensure the security of the transmitted data and the transmission session is not established. So, the higher critical error rate Qo, the more stable the QKD protocol to the eavesdropping attacks, because it allows greater level of

even at Q >

interference. Summarizing, our information analysis shows that without bases reconciliation the 4-state protocol has the

best maximum value of the critical error rate. But after safety bases reconciliation procedure applied we see, however, that the oo-state protocol has a higher critical error rate in comparison with the considered QKD protocols. In other words, information characteristics of six-state protocol can be surpassed even in case of two-dimensional Hilbert space due to a better choice of the alphabet.

4. MULTIDIMENSIONAL CASE
In this Section, we will discuss a potential of using multidimensional Bob's and Alice's spaces (D >
two-dimensional case, errors caused by intercept--resend strategy.

for improving the properties of QKD protocols, which is especially promising for the QKD protocol with continuous alphabet. For the upper estimate of the multidimensional protocols efficacy we will calculate, by analogy with
2)

Let us consider a quantum alphabet, consisting of LD mutually unbiased bases in D-mensional Hilbert
space, i.e. , alphabet, different letters of which have equal projections to each other. For such alphabet we will

calculate now the accuracy of transmitting an arbitrary letter when Eve uses the intercept--resend strategy of
eavesdropping.

First, Alice transmits a random letter to Bob from randomly selected bases. If Eve guesses this basis, the letter will be transmitted to Bob without distortion: this scenario happens with the probability 1/LD. Otherwise, if Eve does not guesses the right basis (it happens with probability 1 --1/LD), then the transmitted to Bob letter will be replaced by Eve during resending with equal probability (due to the above suggestion of the symmetrical alphabet) to a different one from another basis. Bob receives a right letter, which was transmitted by Alice, with probability 1/D, otherwise he received a wrong letter.

278

Proc. of SPIE Vol. 5833


Total probability that Eve does not distort the transmitted by Alice letter (when Eve guesses correctly or incorrectly the basis) is equal to FD = 1/LD + (1 -- 1/LD)/D and the respective probability to distort the letter is equal to

QD1_FD1_(1+D)

(16)

Checking this formula for BB84 (LD = 2, D = 2) and six-state (LD = 3, D = 2) protocols, we get well--known numbers: 1/4 and 1/3, respectively. In the limit of D --+ oo, we get QD -- 1 -- 1/LD. This means that alphabets with maximum number of mutually unbiased letters are more favorable. For the maximum number D + 1 of mutually unbiased bases in D-dimensional space [24] we get the error rate Q = 100 %:
urn Qoo= D--oo

QD=l-- urn I(+_=. D--ooD \ Dj

(17)

For infinite--dimensional case, maximum possible error rate is equal to 100%, by contrast with 50% for the two-dimensional case. This is due to the fact that in two-dimensional case non-guessing a letter by Eve means guessing the opposite letter and if the error rate Q > 0.5 then Bob can simply replace all "0" in the message < 0.5. In multidimensional case, this trick does not work--the with "1" and vise versa, achieving Q2) = 1 -- higher the dimension of the Hilbert space, the higher the maximum possible error rate. Therefore, one can conclude from ratio (17) that there are no principal restrictions on increasing the efficacy of the QKD protocols with increasing the dimensionality of the Hilbert space because there is no any upper threshold set by the intercept-resend strategy. Keeping this specifics of QKD protocols with multidimensional alphabets, let us consider now an extension of the oc-state protocol on the case of multidimensional Hubert space. Note that in multidimensional case, maximum possible selected information between two systems Iax log2 D grows infinitively at D --* oc whereas maximum possible non-selected information is bounded: it is equal to the amount of accessible information [18]

Q

1cessib1e

log2 D --
k=2

k'

which in the limit D --p oo is restricted by the value 1cessib1e 0.61 bit. In case when Eve does not extract additional information from bases reconciliation procedure and disengage

oneself from a specific eavesdropping strategy, we can estimate the upper limit of maximum amount of nonselected information, which is received by Eve, by the accessible information. In fact, information received by
Eve will be even smaller. The amount of information in the systems Alice--Bob and Alice--Eve after the bases reconciliation procedure

is given by the maximum possible selected or non-selected information in the system, respectively. Then the critical mutual information error rate (8) in the limit D --+ oc is equal to unit:

c°

=1

--

D--oo

1D lim accessible
1rnax

D--oo log2

urn

061
D

1.

(18)

The critical mutual information error rate Qo calculated by formula (18) versus the dimensionality of the Hilbert space is shown in Fig. 1. This result shows qualitatively novel property of the multidimensional oostate protocol with respect to two-dimensional case--with increasing the dimensionality of the Hubert space the critical error rate for this protocol increases and in the limit of infinite-dimensional space the protocol becomes
non-threshold.

Proc. of SPIE Vol. 5833

279


1.00

0.96

····'
S...

.S··S
0
.::

.S··SS
0.84
.

u.otJ

·

I

I

.

I

.

I

.

I

·

I

0

4

8

12

16 20 24 28 32

D
Figure 1. Critical error rate Qo versus the dimension D of the Hilbert space.

Such behavior of the critical error rate does not depend on specific structure of eavesdropping by Eve and can be clarified as follows. When Alice sends a message, then both Eve and Bob have a priori minimal information about this message being "maximally entangled" in the multidimensional space. After bases reconciliation, Alice and Bob can select only maximally correlated messages for which they choose approximately similar bases. As a result, information bond between Alice and Bob per one message will be significantly improved. Eve, in her turn, cannot affect the processes of messages selection and her information remains the same. Therefore, Eve with increasing the dimensionality of the Hubert space retrieves much less information than Bob, which leads finally to the non-threshold property of the QKD protocol with continuous alphabet. In the reasoning above, we made the only assumption about safety basis reconciliation, which was discussed in Section 3.2.

5. CONCLUSIONS
In conclusion, our information analysis shows that critical error rate of the six-state protocol can be surpassed even in case of two-dimensional Hubert space due to a better choice of the alphabet. Namely, without bases reconciliation the 4-state protocol has the best maximum value of the critical error rate. But after bases reconciliation procedure is applied, use of continuous alphabet in case when an eavesdropper has no ability to store the intercepted information in a quantum form leads to a slightly higher critical error rate than that one of the six-state protocol, even in the two-dimensional case. With increasing the dimensionality of the Hilbert space the critical error rate of the oc-state protocol increases, and in the limit of infinite-dimensional space the protocol becomes non-threshold. This promising property could, in our view, stimulate efforts in experimental implementation of this protocol. In case of two-dimensional Hubert space, the oo-state QKD protocol can be experimentally implemented with a help of the standard QKD schemes, based on coding a qubit with photon polarization. Demonstration of the non-threshold property of the infinite-dimensional oo-state QKD protocol will, however, require some novel experimental solutions.

6. ACKNOWLEDGMENTS
This work was partially supported by RFBR grants Nos. 02--03--32200, 04--02--17554, and INTAS grant INFO
00--479.

280

Proc. of SPIE Vol. 5833


REFERENCES
1. Bennett Ch.H. and Brassard G., in Proceedings of the IEEE International Conference on Computer, System and Signal Processing, Bangalore, India (IEEE, New York, 1984), p. 175. 2. Ekert AK., 1991, Phys. Rev. A 67, 661. 3. Bennett Ch.H., 1992, Phys. Rev. Lett. 68, 3121. 4. Bruss D., 1998, Phys. Rev. Lett. 81, 3018. 5. Grosshans F. and Grangier P., 2002, Phys. Rev. Lett. 88, 057902. 6. Wootters W.K. and Zurek W.H., 1982, Nature (London) 299, 802. 7. Bechmann-Pasquinucci H. and Gisin N., 1999, Phys. Rev. A 59, 4238. 8. Bechmann-Pasquinucci H. and Tittel W., 2000, Phys. Rev. A 61, 062308. 9. Bourennane M., Karisson A., and Bjork G., 2001, Phys. Rev. A 64, 012306. 10. Cerf N.J., Bourennane M., Karisson A., and Gisin N., 2002, Phys. Rev. Lett. 88, 127902. 11. Gottesman D. and Lo H-K., 2003, IEEE Transactions Inf. Theory 49, 457; LANL e-print quant-ph/0105121. 12. Gisin N., Ribordy G., Tittel W., and Zbinden H., 2002, Rev. Mod. Phys. 74, 145. 13. Gallagher R.G., 1968, Information Theory and Reliable Communication (New York: John Wiley and Sons). 14. Grishanin BA., 1973, Izv. Akad. Nauk SSSR, Ser. Tekh. Kiber. 11, 127; LANL e-print quant-ph/0301159.

15. Preskill J., Lecture notes on Physics 229: Quantum information and computation, located at
16. 17. 18. 19. 20. 21. 22. 23. 24. http://www.theory.caltech.edu/people/preski11/ph229/. Grishanin B.A. and Zadkov V.N., 2002, JCTE 47, 933. Grishanin B.A., 2002, PIT 38, 31. Caves C.M. and Fuchs C.A., LANL e-print quant-ph/9601025. Fuchs CA. and Peres A., 1996, Phys. Rev. A 53, 2038. Lo H.-K. and Chau H.F., 1999, Science 283, 2050. Shor P.W. and Preskill J., 2000, Phys. Rev. Lett. 85, 441. Bennett C.H. , Brassard G. and Robert J.M., 1988, SIAM J. Comput. 17, 210. Fuchs CA., Gisin N., Griffiths R.B., Niu C-S., and Peres A., 1997, Phys. Rev. A 56, Wootters W.K. and Fields B.D., 1989, Ann. Phys. (N.Y.) 191, 363.

1163.

Proc. of SPIE Vol. 5833

281