Experimental quantum secret sharing with spin-orbit structured photons
Michael de Oliveira, Isaac Nape, Jonathan Pinnell, Najmeh TabeBordbar, Andrew Forbes
EExperimental quantum secret sharing with spin-orbit structured photons
Michael De Oliveira, Isaac Nape, Jonathan Pinnell, Najmeh TabeBordbar, and Andrew Forbes ∗ School of Physics, University of the Witwatersrand,Johannesburg 2000, South Africa
Secret sharing allows three or more parties to share secret information which can only be decryptedthrough collaboration. It complements quantum key distribution as a valuable resource for securelydistributing information. Here we take advantage of hybrid spin and orbital angular momentumstates to access a high dimensional encoding space, demonstrating a protocol that is easily scalable inboth dimension and participants. To illustrate the versatility of our approach, we first demonstratethe protocol in two dimensions, extending the number of participants to ten, and then demonstratethe protocol in three dimensions with three participants, the highest realisation of participantsand dimensions thus far. We reconstruct secrets depicted as images with a fidelity of up to 0.979.Moreover, our scheme exploits the use of conventional linear optics to emulate the quantum gatesneeded for transitions between basis modes on a high dimensional Hilbert space with the potential ofup to 1.225 bits of encoding capacity per transmitted photon. Our work offers a practical approachfor sharing information across multiple parties, a crucial element of any quantum network.
I. INTRODUCTION
In a world where cloud computing environments dom-inate our personal and corporate lives, secure commu-nication and key distribution between multiple partiesis a growing concern. This includes the secure sharingof encryption keys, missile launch codes, bank accountinformation and social media profiles. In popular cryp-tography methods either a single copy of the encryptionkey is kept in one location for maximum secrecy or mul-tiple copies of the same key are kept in different locationsfor greater reliability, but at an increased security risk.Secret sharing is a multiparty communication techniquewhere a secret is divided and shared among N partiesand then securely reconstructed through collaboration,making it ideal for storing and sharing information thatis highly sensitive, achieving both high levels of privacyand reliability [1, 2].The first quantum secret sharing (QSS) scheme pro-posed the use of particle entangled states [3]. In thisprotocol, three parties (Alice, Bob and Charlie) ran-domly choose between two measurement bases and inde-pendently measure their particle. If their measurementresults are correlated, Bob and Charlie can use their mea-surement bases and outcome information to determinethe result of Alice’s measurement, otherwise the round isdiscarded. Since approximately half the instances will bediscarded the intrinsic efficiency is about 50%. This pro-tocol was improved to accommodate an arbitrary num-ber of parties based on multi-particle qubit entanglementstates [4], and later to multi-particle d dimensional en-tanglement states [5].Although much theoretical [6–14], and (to a lesser ex-tent) experimental [15–17] attention has focussed on QSSusing multi-particle entangled states, progress has been ∗ [email protected] limited by the intrinsic hurdle that the number of par-ties involved is bound by the number of entangled par-ticles: this makes particle entanglement-based QSS inef-ficient and unscalable (multi-photon entanglement is no-toriously inefficient).As a result of these limitations, two dimensional QSSschemes using single photon states, similar to those usedin QKD, have been proposed [18] and implemented [19].Here, each party performs sequential unitary operationson the same particle instead of several entangled parti-cles. The security was found to be less robust as com-pared to quantum key distribution (QKD) and suscepti-ble to cheating strategies in that dishonest parties couldinfer some information about the choice of bases of an-other party [20, 21]. To address this deficiency, multi-party high dimensional QSS protocols were theoreticallyproposed [22–25] but with few suggestion as to how theymight be (practically) implemented in the laboratory[26–28]. Challenges in high dimensional state prepara-tion, transformation and detection, the key steps of anyQSS protocol, have so far presented barriers to experi-mental realisation.Here we realise the first experimental high dimensionalsingle photon QSS protocol using photons that are vec-torially structured in their orbital angular momentum(OAM) and polarisation. Our approach requires onlysimple linear optical elements: spin-orbit coupling opticsto prepare the initial state, half waveplates (HWPs) withdove prisms (DP) to encode the secret in the sequentialphase transformation of each party, and a deterministicdetector for all basis elements in the high dimensionalvector space. We successfully implement this protocolin two dimensions for ten parties, and three dimensionswith three parties - the highest realisation of participantsand dimensions thus far. Our approach is scalable in thenumber of participants, highly efficient and provably se-cure. a r X i v : . [ qu a n t - ph ] S e p II. SINGLE PHOTON QUANTUM SECRETSHARING PROTOCOL
We begin by extending the single photon QSS protocol[22] to prime dimensions and then we outline the generalstructure of a N-party QSS scheme using a single pho-ton state. In this protocol multiple participants performlocal operations on a single photon encoded in prime d dimensions. Suppose a participant R , also known as thedistributor, wants to share a secret key amongst multi-ple parties, R , . . . , R N , then the QSS protocol can besummarised in four steps (see Fig. 1):1. State preparation:
The distributor, R , preparesan initial single photon state | e (0)0 (cid:105) from a set ofmutual unbiased bases (MUB) in the desired primedimension d . In our protocol, the MUBs are for-mulated from the logical basis, | (cid:96) (cid:105) , as follows: | e ( j ) k (cid:105) = 1 √ (cid:88) (cid:96) =0 ω ( j +2 k ) | (cid:96) (cid:105) (1)in two dimensions and in odd prime dimensions ( d (cid:48) )they are generalised as [22], | e ( j ) k (cid:105) = 1 √ d (cid:48) d (cid:48) − (cid:88) (cid:96) =0 ω (cid:96) ( k + j(cid:96) ) | (cid:96) (cid:105) (2)where k maps onto a mode from the j th MUB and ω = exp( i πd ). Note that (cid:96), j, k ∈ { , . . . , d − } .2. Distribution:
The distributor modulates the pho-ton initially in the state | e (0)0 (cid:105) with the operators X x d Y y d , where x , y ∈ { , . . . , d − } are chosenrandomly and indicate how many times the oper-ators should be applied. The photon is then sentsequentially to each participant R , . . . , R N , whoupon receiving the single photon, randomly choose x n , y n ∈ { , . . . , d − } , such that they apply thecorresponding unitary operations X x n d Y y n d .To map between the MUB basis states, each partyhas access to two operators: X d and Y d . The oper-ator X d is defined as, X d = d − (cid:88) (cid:96) =0 ω (cid:96) | (cid:96) (cid:105) (cid:104) (cid:96) | (3)for prime dimensions. We adapted the protocol [22]for two dimensions such that the operator Y d isdefined as Y = (cid:88) (cid:96) =0 ω (cid:96) | (cid:96) (cid:105) (cid:104) (cid:96) | (4)in two dimensions and in odd prime dimensions ( d (cid:48) )as Y d (cid:48) = d − (cid:88) (cid:96) =0 ω (cid:96) | (cid:96) (cid:105) (cid:104) (cid:96) | (5) The operator X x n d cycles through x n modes in thesame basis, while the operator Y y n d cycles through y n MUBs, as shown in Fig. 1(a). Using both opera-tors in sequence results in the mapping between allMUB states which is crucial in the implementationof the single photon secret sharing protocol.3.
Measurement:
After receiving the single photonfrom the last participant, the distributor requestthat parties R , . . . , R N broadcast their choice of y n in a random order, keeping their value of x n a secret. By considering the sum of all y n , thedistributor chooses a measurement basis form theMUB set in such a way that the measurement leadsto a deterministic result. In prime dimensions thisis equivalent to applying the local unitary operator Y Jd and measuring the photon in the basis | e ( J ) k (cid:105) ,where J = N (cid:88) n =1 y n mod d (6)The final measurement result obtained by the dis-tributor is labelled a ∈ { , . . . , d − } . Since themeasurement is performed in a basis that yields acorrelated result, the efficiency of the protocol is100% [25]. If Eq. 6 holds, the participants have astrongly correlated selection of x n , satisfying N (cid:88) n =1 x n + C = a mod d. (7)where we define C = (cid:98) (cid:80) N +1 n =1 y n (cid:99) for two dimen-sions, which accounts for the additional X opera-tor imparted by every odd number of Y operators,and C = 0 in odd prime dimensions, due to thecyclic property of the operators in d (cid:48) dimensions.4. Key generation:
The distributor resets his valueof x ( scrt )1 = ( a − x + C ) mod d according to the mea-surement result a . Consequently, if participants R , . . . , R N collaborate and reveal among them-selves their choice of x n , they can reconstruct thedistributors secret value x ( scrt )1 = (cid:80) Nn =2 x n mod d ,which was previously only known to the distributor R . By repeating this procedure, the distributorcan share a secret key among the rest N − R checks the security, such that herandomly selects a subset of rounds. The degree ofsecurity specifications determines the size of the subset.In order to increase the security, as justified in [25], R must make sure that the subset of valid rounds includesa round in which each participant broadcasts his choice FIG. 1. (a) General scheme for a 4 party single qubit QSS scheme. The distributor, R , prepares an initial state from a set of d = 2MUBs. The qubit is then sequentially distributed to each party, who in turn performs a unitary phase operation given by X x n d Y y n d .The choice of X x n is analogous to a change in local states within the basis, and a choice of Y y n corresponds to a change of basis. Thelast participant sends the qubit back to the distributor. The distributor requests that parties R , R , R broadcast their choice of y n and performs a measurement in a basis that leads to a deterministic result. The distributor can generate a secret key x ( scrt ) by usingthe measurement result to reset their choice of x n . The other parties, upon collaborating and broadcasting their choice of x n , can alsogenerate the same secret key x ( scrt ) . We also show the state preparation for d = 3 dimensions. Note that the operators are cyclic inthree dimensions because of the cyclic property of MUBs in odd prime dimensions. (b) The distributor can securely encrypt a messageby applying a simple XOR encryption operation using their generated secret key. The encrypted message, after being distributed, can bedecrypted by each participant using their own secret key. At no point is the secret key shared among any participants. of y n last. Each participant reveals their inferred value x ( scrt ) for the subset of rounds, which is compared tothe value determined by the distributor. If there is adiscrepancy any dishonest eavesdropping or cheatingstrategy is exposed.In the next step, we investigate the necessary tools toimplement a high-dimensional single photon QSS scheme.We explore vector modes and how we can implement uni-tary phase operators using simple linear optics. III. EXPERIMENTAL REALISATION
Here we introduce the tools (operations) needed forsingle photon secret sharing in prime dimensions. Lastly,we show how the protocol can be implemented in both d = 2 and d = 3 dimensions using polarisation and OAMcontrol (see Fig. 2). A. 2-Dimensional realisation
If we consider the polarisation subspace coupledwith the OAM subspace, spanned only by | (cid:96) | , wecan construct a two dimensional mode set, i.e H =span( {| R (cid:105) | (cid:96) (cid:105) , | L (cid:105) |− (cid:96) (cid:105)} ) as illustrated in Fig. 3(a).The basis states can be mapped as orthogonal columnvectors, | R (cid:105) | (cid:96) (cid:105) = , | L (cid:105) |− (cid:96) (cid:105) = (8)This allows us to map the MUBs (see Fig. 3(b)) as rowvectors in matrix form as follows:M = 1 √ − , M = 1 √ i − i (9) FIG. 2.
Generalised experimental setup of a single photon quantum secret sharing scheme, showing the state preparation, distributionand measurement steps for (a) d = 2 and (b) d = 3 dimensions. The initial states are generated using a combination of geometric phaseoptics (i.e. a q-plate (QP)). The initial state is then sequentially communicated to each participant, who perform a unitary phase operatoremployed using simple linear optics such as a half waveplate (HWP) and a dove prism (DP). A HWP in the measurement step was usedto perform the measurement in the same basis each time. The different states can be deterministically detected (a) using a combinationof geometric phase control and multi-path interference using beam splitters (BM) and polarising beam splitter (PBS), or (b) via modaldecomposition using a spatial light modulator (SLM). M are mirrors. The first step in implementing the protocol is preparingthe photon in the initial state within our MUB set. Wegenerated the initial state, | e (0)0 (cid:105) = √ ( | R (cid:105) | (cid:96) (cid:105) + | L (cid:105) |− (cid:96) (cid:105) )denoted by | Ψ (cid:105) , from a horizontally polarised Gaussianbeam incident on a spin-orbit coupling q -plate [29, 30].The next step is to find a way to independently movebetween each MUB state, by applying the required op-erators. This is easily implemented by a half waveplate(HWP). It is straight forward to see that a HWP actingon the initial state | e (0)0 (cid:105) , induces a relative phase differ-ence, e i θ , between the circular polarisation states. Thiscan be summarized asˆ U ( θ ) ∝ e i θ (10)where θ ∈ { , π/ , π/ , π/ } is the rotation angle ofthe HWP, corresponding to the transformations ˆ U ( θ ) = { X Y , X Y , X Y , X Y } . In this way, Fig. 3(b)shows that we can move independently between allMUBs.Once the initial state is sent through a set of even Nconsecutive HWPs, allowing each party to apply theirunitary operator, the final state of the photon will be: | Ψ N (cid:105) = e i Ω √ (cid:2) | R (cid:105) | (cid:96) (cid:105) + e i Φ | L (cid:105) |− (cid:96) (cid:105) (cid:3) (11)where Ω = ( − i ) N e − i ( (cid:80) Nn =1 ( − n +1 θ n ) and Φ =4 (cid:80) Nn =1 ( − n +1 θ n . The distributor then applies the cor-responding operator for φ J ∈ { , π/ } using a HWP, such that performing the measurement in the basis √ (cid:0) | R (cid:105) | (cid:96) (cid:105) + e iφ J | L (cid:105) |− (cid:96) (cid:105) (cid:1) leads to deterministic result.Next, we discuss the detection system used to distin-guish between all MUB states. The different states canbe deterministically detected using a combination of geo-metric phase control and multi-path interference as seenin Fig. 2(a). The beam was split into two polarisation de-pendent paths using a combination of quarter waveplates(QWP) and a polarizing beam splitter (PBS), such thatthe state of the qubit becomes, | Ψ N (cid:105) = e i Ω √ | R (cid:105) a | (cid:105) a + e i Φ | L (cid:105) b |− (cid:105) b ] (12)where the subscripts a and b refer to the polarisation de-pendent paths. The photon paths were interfered at a50:50 beam splitter (BS), setting the dynamic phase dif-ference between the two paths to π/
2. An extra reflectionwas added to one path so that the number of reflections,and thus the polarisation of the two output paths, wasautomatically reconciled. Henceforth, we will drop thepolarisation kets in the expression as the polarisation in-formation is path dependent. The resulting state afterthe BS is | Ψ (cid:48) N (cid:105) = e i Ω − e i Φ ) | (cid:105) c + i (1 + e i Φ ) |− (cid:105) d ] (13)where the subscript c and d refer to the output paths ofthe beam splitter. From this equation we see that thedetection scheme is in fact deterministic for given valuesof Φ, such that all the light will be in either path c or d .Next, we extend the two dimensional implementationto three dimensions, using a similar linear optics setup. FIG. 3. (a) Illustration of the spin-orbit coupled modes that formour d = 2 computational basis, from which we construct our MUBs.Right circularly polarised light is shown in red, left circularly po-larised light is shown in green and linear polarisation in blue. (b)We realise the operators in d = 2 using a half waveplate (HWP).A HWP at θ = π/ X operator, cycling between thestates within the same basis; at θ = π/ Y operator,moving between MUBs. Note that the Y operator is not cyclic,due to the extra X operator that is imparted by every odd numberof Y . B. 3-Dimensional realisation
We now consider a mode set that spans a three di-mensional (qutrit) space of spin-orbit coupled modes, i.e H =span( { | R (cid:105) | (cid:105) ) , | R (cid:105) | (cid:96) (cid:105) , | L (cid:105) |− (cid:96) (cid:105)} ) as depicted in Fig.4(a). If we map the basis states as orthogonal columnvectors, i.e, | R (cid:105) | (cid:105) = , | R (cid:105) | (cid:96) (cid:105) = , | L (cid:105) |− (cid:96) (cid:105) = (14)the the MUBs can be mapped as row vectors in matrixform, where ω = exp( i π ), as followsM = 1 √ ω ω ω ω , M = 1 √ ω ω ω , M = 1 √ ω ω ω (15) FIG. 4. (a) Illustration of the spin-orbit coupled modes that formour d = 3 computational basis, from which we construct our MUBs.Right circularly polarised light is shown in red and left circularlypolarised light is shown in green. (b) Here we show the cyclic natureof the operators in d = 3. A dove prism (DP) allows us to realisethe X gate, cycling between the states within the same basis, anda half waveplate (HWP) allows us to realise the Y gate, cyclingbetween the MUBs. The initial state was prepared using a interferometriccombination of a q-plate, HWP and beam splitter, as inFig. 2(b). We further engineer the required operators byusing a half waveplate in combination with a dove-prismas illustrated. As before, the HWP induces a relativephase difference, e iθ , between the circular polarisationDoF and the DP imparts a phase which proportional tothe OAM state. A mirror after the dove prism is neededto invert the final OAM state. The unitary transforma-tion, in the basis from Eq. 14 can be summarised asˆ U ( θ, γ ) ∝ e − iγ(cid:96)
00 0 e − i ( γ(cid:96) − θ ) , (16)where θ ∈ { , π/ , π/ } is the rotation angle of theHWP and γ ∈ { , π/ , π/ } is the rotation angle of theDP. The DP allows us to realise the X gate, cyclingbetween the states within the same basis, and the HWPallows us to realise the Y gate, cycling between theMUBs (see Fig. 4(b)).The detection system included mapping our vector ba-sis to a scalar basis using a set of half waveplate andquarter waveplates. We measured the detection prob-abilities of each MUB state using match filters encodedon the SLM via modal decomposition (see supplementarymaterial). The detection modes where encoded as phaseand amplitude holograms [31] on a Holoeye Pluto spatiallight modulator (SLM) - a well established technique forspatial mode detection [32].However, using a quantum Fourier transform (QFT) tomap between the MUB superpositions of OAM modes tothe OAM standard basis, one can deterministicaly sortthe MUBs and thereafter sort the OAM modes. In threedimensions, a QFT for OAM has been proposed [33].The technique exploits the tritter [34], by using path andphase control. Once the mapping between the MUB andOAM basis is achieved, mode sorters can be used deter-ministicly to measure the OAM modes [35]. Mode sortinghas been extensively used for both scalar [36] and vectormodes [37]. IV. RESULTS
Here we present the results for our implementation ofthe quantum secret sharing protocol with single photonstates in d = 2 and d = 3 dimensions. For practical pur-poses, the experiment was first performed with a classicallight source and a ccd camera. Later, the light source wasattenuated to an average photon number of µ = 0 .
02 perpulse. Although weak coherent states cannot be usedwithout photon splitting strategies this could, in princi-ple, be overcome by preparing and testing the transmis-sion properties of some decoy states. In the single pho-ton regime, the measurement system includes couplingthe photons through fibres to avalanche photon detec-tors (APD).
A. 2-Dimensional results
The two dimensional detection results of our vector ba-sis ares shown in Fig. 5. This was performed by rotatingthe angle θ of the HWP and measuring the intensity ofeach output port using a ccd camera at each port (seeFig. 5(a)) and in the single photon regime, using singlephoton detectors (see Fig. 5(b)).There is an excellent agreement between the exper-imental results (data points) and the theory (dashedcurves). The Visibility, V , of the detection scheme ineach output port was calculated using the equation: V = |I max − I min |I max + I min (17) FIG. 5.
Detection of superposition of vector states. Each graphshows the detection (normalized intensity) of the photons in a su-perposition of the vector states | Ψ (cid:48) N (cid:105) , generated by rotating theHWP angle θ , using (a) ccd camera and (b) photodiodes in thesingle photon regime. Each data point was generated by averag-ing over 35 measurements. The dashed lines show the theoreticalcurve. where I is the intensity in each arm. Spatial filtering wasapplied to the data obtained using the ccd camera to re-move unwanted noise, resulting in V = 0 . ± . V = 0 . ± . F = 1 + V F = 0 . ± .
005 for the classical implementation and F = 0 . ± .
003 for the single photon regime. Usingthis deterministic detector, we can detect any arbitrarysuperposition of our vector basis with high fidelity.
FIG. 6.
Crosstalk matrices shown theoretically in (a) and experimentally in (b) and (c), for classical light and the single photon regimerespectively. This shows the scattering probabilities for modes prepared and detected in identical bases (diagonal) and the overlap betweenmodes from mutually unbiased bases (off diagonal).
B. 3-Dimensional results
To demonstrate the feasibility of our secret sharingscheme in three dimensions, we verify that the d+1MUBs are each orthogonal with respect to each otherby measuring the scattering probabilities. The crosstalkmatrix is shown theoretically in Fig. 6 (a) and experi-mentally in Fig. 6 (b) and Fig. 6 (c), for the classical andsingle photon regime respectively. To obtain the resultswe first prepared the initial superposition state | e (0)0 (cid:105) andapplied the X and Y gates to iterate through the var-ious basis modes and MUB mode sets. Using a set ofwaveplates, we mapped the circular polarisation photonstates to the horizontal polarisation state and performedprojective measurements via modal decomposition.From the crosstalk matrices, we measured an averagefidelity of F = 0 . ± .
003 when using classical lightand similarly we measured F = 0 . ± .
001 in the singlephoton regime, which is F = 1 for a perfect system. Inour system, the errors are introduced by imperfections,including the rotation of the dove prism and half wave-plates causing slight misalignment in the setup. C. Security analysis
From the measured detection fidelities, we performed asecurity analysis on our QSS scheme for d = 2 and d = 3dimensions. The results of the analysis are summarisedin Table I.The quantum bit error rate (QBER), reflecting theprobability of making detection errors, is related to thefidelity by, QBER = 1 − F (19)which is 0 for a perfect system. The detection fidelitiestranslated into an optical QBER between 0 .
021 and 0 . .
110 and 0 .
156 bounds for un-conditional security against coherent attacks in two andthree dimensions respectively [39].
Measures d=2 d=3Classical Quantum Classical Quantum F QBER I d = 2 and d = 3 experimentalresults for our secret sharing protocol, for both the classi-cal regime using the CCD camera as a detector and for thesingle photon regime using APDs. We show the experimen-tal values of the detection fidelity (F), the quantum bit errorrate (QBER) in bits per photon and mutual information (I)between distributor and participants. From the fidelity we can calculate the mutual informa-tion, I x. This places a bound on the amount of infor-mation that can be shared between the distributor andparticipants. This bound is only due to the generationand detection fidelities, and not intrinsic to the protocolitself. This is given by, I = log ( d ) + F log ( F ) + (1 − F ) log ( 1 − Fd − . (20)For a perfect system we would expect a value of 1 bitper photon in a d = 2 qubit system and 1.58 bits perphoton in in a d = 3 qutrit system. For d = 3 this wasmeasured to be nearly 1 . × the maximum achievable in d = 2 dimensions. We note that increasing the dimen-sion of the quantum secret sharing protocol, did result inhigher mutual information capacity. FIG. 7.
Experimentally generated distributor’s and participants’ secret keys, in (a) d = 2 and (b) d = 3 dimensions, by implementing theprotocol for 100 valid runs. The colour bars indicate the measured probability of generating a 0, 1 or 2. D. Secret key generation:
To corroborate the advantage of our protocol utilisinga higher dimensional encoding space, we experimentallyshared a secret in both d = 2 and d = 3 dimensions usingthe experimental setups described.In two dimensions, the protocol was performed by N = 10 participants - the highest number of participantsrealised thus far - each equipped with a X and Y gate(half waveplate). We ran the protocol for 100 validruns, resulting in a generated secret key of 100 bits.The results are shown in Fig. 7(a), for the identicalsecret key retrieved by the distributor and sharedbetween the participants. The distributor’s secret keywas determined by resetting his choice of x using themeasurement results and the participants choice of y n . The participants shared secret key was calculatedby summing the keys of the participants R , · · · , R ,modulus 2. By performing the measurement in a basisthat would yield correlated results (see Ref. [25]), wesuccessfully implemented the two dimensional protocolwith an efficiency of 100%.Next, exploiting the higher dimensional ( d = 3) encod-ing space, we shared a secret key between N = 3 partici-pants, each equipped with the X gate (dove prism) and Y gate (half waveplate). The results are shown in Fig.7(b), for the secret code retrieved by the distributor andshared between the participants. The keys are identicalas desired. Using the high dimensional protocol for 100valid runs we generated a secure key that was 158 bits. V. DISCUSSION
Transverse spatial modes of light carrying orbital an-gular momentum have become ubiquitous for encod-ing quantum information with promising applications in quantum communication. Spanning the d ≥ d = 3). Our scheme canbe extended to multiple participants and requires con-ventional linear optical elements making it easily scal-able. For a practical implementation waveplates and doveprisms can be rotated using electronically driven rotationmounts [45], whose rotation rate would be the only lim-iting factor with regards to the generation rates. Thespatial modes used are OAM modes of light, which canbe represented by LG modes and thus are the naturalmodes of quadratic media. Moreover, the scheme can beexploited over long distances (up to 1 km kilometer [46])using few mode fibers, since our basis modes lie in thefirst two mode groups which may have low group delaysand minimal crosstalk, if chosen carefully. Applicationscan also be extended to underwater channels, althoughthe main challenge would be overcoming deleterious ef-fects, like turbulence which could reduce the QBER aspreviously shown for QKD. VI. CONCLUSION
In conclusion, we successfully implemented two-dimensional single photon QSS for 10 parties, the high-est realisation so far. We further extended our schemeto higher dimensions by interfacing independent de-grees of freedom, providing a natural extension to high-dimensional QSS. Our approach shows that by using hy-brid polarisation and OAM encoding, it is possible to realise a d = 2 and d = 3 dimensional single photon QSSusing conventional linear optical elements. Further, byexploiting the non-separability of polarization and OAMin our choice of spatial modes, we were able to realisetransitions on a high dimensional Hilbert space, map-ping between different MUB states, demonstrating theadvantage of interfacing independent DoF. Our practicalscheme is scalable to an unlimited number of participantsand can be realised using current technologies. [1] R. Ahlswede and I. Csisz´ar, IEEE Transactions on Infor-mation Theory (1993).[2] B. Schneier, New York. (1996).[3] M. Hillery, V. Buˇzek, and A. Berthiaume, Physical Re-view A , 1829 (1999).[4] A. Sen, U. Sen, M. ˙Zukowski, et al. , Physical Review A , 032309 (2003).[5] I.-C. Yu, F.-L. Lin, and C.-Y. Huang, Physical ReviewA , 012344 (2008).[6] S. Bandyopadhyay, Physical Review A , 012308 (2000).[7] A. C. Nascimento, J. Mueller-Quade, and H. Imai, Phys-ical Review A , 042311 (2001).[8] T. Tyc and B. C. Sanders, Physical Review A , 042310(2002).[9] V. Karimipour, A. Bahraminasab, and S. Bagher-inezhad, Physical Review A , 042320 (2002).[10] S. Bagherinezhad and V. Karimipour, Physical ReviewA , 044302 (2003).[11] L. Xiao, G. L. Long, F.-G. Deng, and J.-W. Pan, Phys-ical Review A , 052307 (2004).[12] D. Fu-Guo, L. Gui-Lu, W. Yan, and X. Li, ChinesePhysics Letters , 2097 (2004).[13] Y. Li, K. Zhang, and K. Peng, Physics Letters A ,420 (2004).[14] L.-F. Han, Y.-M. Liu, J. Liu, and Z.-J. Zhang, OpticsCommunications , 2690 (2008).[15] W. Tittel, H. Zbinden, and N. Gisin, Physical Review A , 042301 (2001).[16] Y.-A. Chen, A.-N. Zhang, Z. Zhao, X.-Q. Zhou, C.-Y.Lu, C.-Z. Peng, T. Yang, and J.-W. Pan, Physical reviewletters , 200502 (2005).[17] S. Gaertner, C. Kurtsiefer, M. Bourennane, and H. We-infurter, Physical Review Letters , 020503 (2007).[18] G.-P. Guo and G.-C. Guo, Physics Letters A , 247(2003).[19] C. Schmid, P. Trojek, M. Bourennane, C. Kurtsiefer,M. ˙Zukowski, and H. Weinfurter, Physical review let-ters , 230505 (2005).[20] G. P. He, Physical review letters , 028901 (2007).[21] S.-J. Qin, F. Gao, Q.-Y. Wen, and F.-C. Zhu, OpticsCommunications , 5472 (2008).[22] A. Tavakoli, I. Herbauts, M. ˙Zukowski, and M. Bouren-nane, Physical Review A , 030302 (2015).[23] V. Karimipour and M. Asoudeh, Physical Review A ,030301 (2015).[24] S. Lin, G.-D. Guo, Y.-Z. Xu, Y. Sun, and X.-F. Liu,Physical Review A , 062343 (2016).[25] X.-B. Chen, X. Tang, G. Xu, Z. Dou, Y.-L. Chen, andY.-X. Yang, Quantum Information Processing , 225 (2018).[26] H. Qin and R. Tso, Journal of the Chinese Institute ofEngineers , 143 (2019).[27] K.-h. Zhou, Y. Wang, T.-j. Wang, and C. Wang, Inter-national Journal of Theoretical Physics , 3927 (2014).[28] M. Smania, A. M. Elhassan, A. Tavakoli, and M. Bouren-nane, Npj Quantum Information , 16010 (2016).[29] L. Marrucci, C. Manzo, and D. Paparo, Physical reviewletters , 163905 (2006).[30] L. Marrucci, E. Karimi, S. Slussarenko, B. Piccirillo,E. Santamato, E. Nagali, and F. Sciarrino, Journal ofOptics , 064001 (2011).[31] V. Arriz´on, U. Ruiz, R. Carrada, and L. A. Gonz´alez,JOSA A , 3500 (2007).[32] A. Forbes, A. Dudley, and M. McLaren, Advances inOptics and Photonics , 200 (2016).[33] Y. Jo, H. S. Park, S.-W. Lee, and W. Son, Entropy ,80 (2019).[34] M. ˙Zukowski, A. Zeilinger, and M. A. Horne, PhysicalReview A , 2564 (1997).[35] G. C. Berkhout, M. P. Lavery, J. Courtial, M. W. Beijer-sbergen, and M. J. Padgett, Phys Rev Lett , 153601(2010).[36] M. Mirhosseini, M. Malik, Z. Shi, and R. W. Boyd, NatCommun , 2781 (2013).[37] B. Ndagano, I. Nape, B. Perez-Garcia, S. Scholes, R. I.Hernandez-Aranda, T. Konrad, M. P. Lavery, andA. Forbes, Scientific reports , 13882 (2017).[38] N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, Re-views of modern physics , 145 (2002).[39] N. J. Cerf, M. Bourennane, A. Karlsson, and N. Gisin,Physical Review Letters , 127902 (2002).[40] E. Nagali, L. Sansoni, L. Marrucci, E. Santamato, andF. Sciarrino, Physical Review A , 052317 (2010).[41] Y.-B. Sheng and F.-G. Deng, Physical Review A ,032307 (2010).[42] X.-H. Li, Physical Review A , 044304 (2010).[43] J. T. Barreiro, T.-C. Wei, and P. G. Kwiat, Naturephysics , 282 (2008).[44] W.-Y. Wang, C. Wang, and G.-L. Long, InternationalJournal of Quantum Information , 529 (2009).[45] E. Toninelli, B. Ndagano, A. Vall´es, B. Sephton, I. Nape,A. Ambrosio, F. Capasso, M. J. Padgett, and A. Forbes,Advances in Optics and Photonics , 67 (2019).[46] L. Cui, J. Su, X. Li, and Z. Ou, Scientific reports ,14954 (2017).[47] F. S. Roux and Y. Zhang, Physical Review A , 033835(2014). [48] C. Schulze, A. Dudley, D. Flamm, M. Duparre, andA. Forbes, New Journal of Physics , 073025 (2013). VII. SUPPLEMENTARY MATERIALModal decomposition
We employed modal decomposition for performing theinner-product measurements, i.e mode projections. Thistechnique is used for performing optical projective mea-surements in the quantum and classical regime [47].Firstly, to perform the modal overlap between the nor-malised spatial modes ψ ( r ) and φ ( r ), we simply computethe inner-product c = (cid:104) φ | ψ (cid:105) = (cid:90) (cid:90) φ ∗ ( r ) ψ ( r ) d r. (21)Here r = ( x, y ) while | c | is the overlap probability deter-mining the correlation between the two modes. Accord-ingly, any arbitrary input field, ψ ( r ), can be correlated with a second mode φ ( r ) where | c | =1 for a high corre-lation, meaning the modes are equivalent and | c | =0 forno correlation meaning that the modes are orthogonal.Optically, φ ( r ) can be a match filter [48] in the form of ahologram encoded on an SLM. As such the overlap prob-ability | c | can be obtained by taking the Fourier trans-form (using a Fourier lens [48]) of the product φ ∗ ( r ) ψ ( r ),which is the output mode after the match filter, henceyielding the state: A ( k x , k y ) = (cid:90) (cid:90) φ ∗ ( x, y ) ψ ( x, y ) e − i ( k x x + k y y ) dxdy (22)where k x , k y are transverse wave vectors in Cartesian co-ordinates. Evaluating the on-axis point ( k x , k y ) = (0 , A (0 ,
0) = (cid:90) (cid:90) φ ∗ ( r ) ψ ( r ) d r = c (23)results in the intensity at the field center, I (0 ,
0) = | A (0 , | , being the modal overlap weighting (equiva-lently detection probability) | c |2