General Quantum Key Distribution in Higher Dimension
Zhao-Xi Xiong, Han-Duo Shi, Yi-Nan Wang, Li Jing, Jin Lei, Liang-Zhu Mu, Heng Fan
aa r X i v : . [ qu a n t - ph ] J a n General quantum key distribution in higher dimension
Zhao-Xi Xiong , , Han-Duo Shi , Yi-Nan Wang , Li Jing , Jin Lei , Liang-Zhu Mu ∗ , and Heng Fan † School of Physics, Peking University, Beijing 100871, China Institute of Physics, Chinese Academy of Sciences, Beijing 100190, China Department of Physics, Massachusetts Institute of Technology, Cambridge, Massachusetts 02139, USA (Dated: November 13, 2018)We study a general quantum key distribution protocol in higher dimension. In this protocol, quantum states inarbitrary g + 1 ( ≤ g ≤ d ) out of all d + 1 mutually unbiased bases in a d-dimensional system can be used forthe key encoding. This provides a natural generalization of the quantum key distribution in higher dimensionand recovers the previously known results for g = 1 and d . In our investigation, we study Eve’s attack bytwo slightly different approaches. One is considering the optimal cloner for Eve, and the other, defined as theoptimal attack, is maximizing Eve’s information. We derive results for both approaches and show the deviationof the optimal cloner from the optimal attack. With our systematic investigation of the quantum key distributionprotocols in higher dimension, one may balance the security gain and the implementation cost by changing thenumber of bases in the key encoding. As a side product, we also prove the equivalency between the optimalphase covariant quantum cloning machine and the optimal cloner for the g = d − quantum key distribution. PACS numbers: 03.67.Dd, 03.65.Aa, 03.67.Ac, 03.65.Ta
I. INTRODUCTION
Quantum key distribution (QKD) is a promising applica-tion of quantum mechanics. The first QKD protocol was pro-posed by Bennett and Brassard in 1984 (BB84) [1] and hasbeen proved to be unconditionally secure [2, 3]. This protocolwas later generalized to the six-state protocol [4]. Meanwhile,various other protocols were developed, among which, for ex-ample, was the Ekert 91 protocol [5]. In the past decades,significant progress has been made both theoretically and ex-perimentally in establishing point-to-point as well as networktypes of key distributions; see, for example, Refs. [6–11].In a simple two dimensional system, one can either use fourquantum states or six quantum states, which correspond to theBB84 protocol and the six-state protocol respectively, to en-code binary symbols. In a higher-dimensional system of di-mension d [12], there are altogether d + 1 mutually unbiasedbases (MUBs) available for the QKD. The counterparts of theBB84 protocol and the six-state protocol of a d -dimensionalsystem are the -basis protocol and the ( d + 1) -basis protocol.Naturally, one may think of a general ( g + 1) -basis protocol( g = 1 , , ... , d ), where arbitrary g + 1 MUBs are utilized toencode d-ary symbols. In the past few years, there have beenmany studies on higher-dimensional QKD protocols. TheQKD using four-level systems were done first [13, 14], andinterests soon extended to the d -dimensional case [15–23].Most of these studies, however, focused on the -basis andthe ( d + 1) -basis cases, and the research on the most generalcase is still absent. In this article, we present the study on sucha general ( g + 1) -basis QKD protocol.In principle, the quantum states of a higher dimension canbe encoded in a continuous variable system such as a har-monic oscillator [24]. It is of fundamental interest, theoret- ∗ [email protected] † [email protected] ically, how a ( g + 1) -basis QKD protocol is formalized. Ourinvestigation of the ( g + 1) -basis protocol is a natural gener-alization of the previously studied cases. The results of oursystematic study may help one balance the security gain andthe implementation cost by changing the choice of g .In this article, our general QKD protocol that uses arbitrary g +1 MUBs is the following. Suppose Alice, the sender, wantsto send Bob, the receiver, a set of classical symbols consistingof , , ..., d − . To start, Alice encodes every symbol, say i ,into a pure quantum state | i i or | ˜ i ( k ) i of one randomly chosenMUB out of the g +1 and sends the state to Bob. Upon receipt,Bob measures the state using again a randomly chosen basis,which is correct with probability / ( g + 1) . Subsequently,the choice of bases are publicly announced by Alice, and thestates measured in bases different from they are prepared arediscarded by the two parties. In the absence of any eaves-dropping and environmental noises, Alice and Bob are thenleft with identical strings of symbols while they are left withpartially correlated strings in the presence of Eve, an eaves-dropper. By checking the agreement of a subset of the symbolsequence, Alice and Bob can decide whether to continue orabort the protocol. If the disagreement is below a threshold,they then perform a direct reconciliation and a privacy amplifi-cation to obtain a set of shared key. In this article, we considerthat Eve attacks the QKD by intercepting and cloning the statebeing sent to Bob. For simplicity, we think of that Eve uses afixed and balanced (balanced between different bases) cloningtransformation for each qudit, and that Eve measures her statebefore the one-way post-processing between Alice and Bob.In this article, we investigate Eve’s attack scheme by twoslightly different approaches, both starting from a generalform of cloning transformation proposed in Ref. [25]. Oneapproach is considering the optimal cloner for Eve where wemaximize the fidelities of the state of Eve. The other is consid-ering maximizing the information Eve has about Alice’s state,which, rather than maximizing the fidelities, is defined as theoptimal attack. We do these separately in Sec. II and Sec. IVand compare the two approaches subsequently. As we shallsee, they give different results. The second approach is donein a somewhat restrictive sense, but it is sufficient to prove thedifference between the optimal cloner and the optimal attack.Sec. III gives some analytical solutions to the optimal clonerin special cases, including the symmetric cloner correspond-ing to a general g . In Sec. V, we introduce a side product ofour first approach to the QKD attack, where we present thelink between a QKD cloner and a revised asymmetric form ofthe optimal symmetric phase covariant quantum cloning ma-chine proposed in Ref. [26] and prove the optimality of thelatter. In Sec. VI, we end the article by a brief conclusion. II. THE OPTIMAL CLONER OF EVE
Now we investigate the optimal cloner that Eve can use.Before proceeding, let us first introduce some notations. Indimension d , there are d + 1 mutually unbiased bases, namely {| i i} and {| ˜ i ( k ) i} ( k = 0 , , ... , d − ), which more explic-itly are | ˜ i ( k ) i = 1 √ d d − X j =0 ω i ( d − j ) − ks j | j i , (1)with s j = j + ... + ( d − and ω = e i πd [27]. By sayingtwo bases, say {| ˜ i (0) i} and {| ˜ i (1) i} , are mutually unbiased,we mean that |h ˜ i (1) | ˜ k (0) i| = √ d for any | ˜ k (0) i and | ˜ i (1) i inthe two bases respectively. The generalized Pauli matrices σ x and σ z act on the states so that σ x | j i = | j + 1 i and σ z | j i = ω j | j i . Throughout the article, we omit the “modulo d ,” whichis the case here. We define U mn = σ mx σ nz so that U mn | j i = ω jn | j + m i . Finally, the generalized d -dimensional Bell statesread | Φ mn i = ( I ⊗ U m, − n ) | Φ i , (2)with m, n = 0 , , ... , d − and | Φ i = 1 √ d d − X j =0 | j i| j i . (3)Now, we consider the optimal cloner for Eve. Suppose astate | ψ i A is sent by Alice and intercepted by Eve. Then, Eveprepares a maximally entangled state | Φ i E ′ E and performsa unitary transformation U of the general form proposed inRef. [25]: U = d − X m,n =0 a mn ( U mn ⊗ U m, − n ⊗ I ) . (4)Here, a mn are the parameters of the unitary transformation,satisfying P m,n | a mn | = 1 . This transformation yields U | ψ i A | Φ i E ′ E = X m,n a mn U mn | ψ i B ⊗ | Φ − m,n i E ′ E (5 a ) = X m,n b mn | Φ − m,n i BE ′ ⊗ U mn | ψ i E , (5 b ) where A , B , E and E ′ denote Alice, Bob, Eve and her cloningmachine respectively. b mn are the discrete fourier transformof a mn , i.e. b mn = d P k,r a kr ω kn − rm . Eqs. (5 a ) and (5 b )make it convenient to write down the density matrices of Bobas well as Eve. For | ψ i A being state | i i or | ˜ i ( k ) i of each MUB,we have ρ B = d − X m,n =0 | a mn | | i + m ih i + m | , (6 a ) ˜ ρ ( k ) B = d − X m,n =0 | a mn | ( U mn | ˜ i ( k ) i B )( h ˜ i ( k ) | B U † mn ) , (6 b ) ρ E = d − X m,n =0 | b mn | | i + m ih i + m | , (6 c ) ˜ ρ ( k ) E = d − X m,n =0 | b mn | ( U mn | ˜ i ( k ) i E )( h ˜ i ( k ) | E U † mn ) (6 d ) ( k = 0 , , ... , g − . Let us consider the fidelities of the states B and E withrespect to all the g + 1 different bases. The fidelity here canbe defined as F ≡ h ψ | ρ outred. | ψ i , the value of which differs forstates of different bases. With the help of the properties of thePauli matrices and the Bell states, we figure out the fidelitiesof B and E for each mutually unbiased basis: F B = X n | a n | , (7 a ) ˜ F ( k ) B = X m | a m,km | , (7 b ) F E = 1 d X m | X n a mn | , (7 c ) ˜ F ( k ) E = 1 d X n | X m a m,n + km | (7 d ) ( k = 0 , , ... , g − . For the QKD using g + 1 MUBs, without loss of general-ity, we suppose that the bases {| i i} , {| ˜ i (0) i} , ..., {| ˜ i ( g − i} are chosen by the two legitimate parties. For simplicity, weassume that Eve’s attack is balanced, i.e. she induces an equalprobability of error for all the g + 1 MUBs. This assumptionfollows from the reasoning that Eve can be detected easily byunbalanced disturbance otherwise, and that, as we find, Evecannot maximize all her g + 1 fidelities simultaneously if thedisturbance is unbalanced. Hence, we assume F B = ˜ F (0) B = ... = ˜ F ( g − B . (8)At this point, to obtain an optimal cloner, Eve has to maximizeher fidelities for a given F B , which quantifies the disturbance.We claim and will show later that Eve can maximize all her g +1 fidelities simultaneously and that they are equal. We startby a “vectorization” of the matrix elements of ( a mn ) . Let ~α i = ( a , i , ..., a d − , ( d − i ) ( i = 0 , ... , g − , (9) ~A = ( A , ... , A d − ) , (10) A i = d − X j =0 ,i,..., ( g − i a ij ( i = 1 , ... , d − . (11)The rest elements are a j ( j = 0 , ... , d − ). Eq. (8) givesthe following restrictions: d − X j =1 | a j | = F B − | a | , (12) || ~α i || = F B − | a | ( i = 0 , ..., g − . (13)One of Eve’s fidelity F E now reads F E = 1 d ( | d − X j =0 a j | + || g − X i =0 ~α i + ~A || ) . (14)Eqs. (12)-(14) tell us how the fidelities of Eve and Bob arecoupled with each other.Now we show how Eqs. (9)-(14) work by doing the g = 2 version of them. The results for a generic g can be obtainedanalogously. For g = 2 , F E = 1 d ( | d − X j =0 a j | + || ~α + ~α + ~A || ) , d − X j =1 | a j | = || ~α || = || ~α || = F B − | a | . We tentatively fix the values of | a | and ~A . By vector ma-nipulation, it is easy to find that the maximum F E is achievedwhen ~α , ~α ∝ ~A,a = ... = a ,d − = r F B − | a | d − e iArg ( a ) . Unfixing | a | and ~A , F E becomes a function of them and ispositively correlated to || ~A || directly. Using the normalizationcondition P m,n | a mn | = 1 , we find that || ~A || is maximalwhen a i, i = a i, i = ... = a i, ( d − i ( i = 1 , ... , d − ). Nowwe visualize the matrix ( a mn ) : ( a mn ) = v x x x ...x x y y . . .x y x y . . .x y y x . . . ... ... ... ... . . . , where x = r F B − | v | d − e iArg ( v ) ,x i = p F B − | v | A i || ~A || , y i = A i d − , || ~A || = p | v | − F B . Correspondingly, Eve’s fidelity F E becomes F E = 1 d [( | v | + p ( d − F B − | v | )) + ( p | v | − F B + 2 p F B − | v | ) ] . Thus far, we have maximized one of Eve’s fidelities. The otherfidelities can be obtained simply by transposing the roles of“the horizontal direction,” “the vertical direction,” and “thediagonal direction” of the matrix ( a mn ) and redefining ~α , ~α , and ~A accordingly. Doing so, we find that the conditionfor optimization of all Eve’s fidelities, with an overall phaseomitted, is ( a mn ) = v x x x . . .x x y y . . .x y x y . . .x y y x . . . ... ... ... ... . . . , where the elements are all real, and x = r F B − v d − , y = s v − F B ( d − d − . All Eve’s fidelities are found to be equal. They are equal to F E = 1 d { [ v + ( d − x ] + ( d − x + ( d − y ] } . The results for a generic g are analogous to those for g = 2 .The difference is that some “2” are substituted by “g.” We thuspresent the following optimization condition and the optimalEve’s fidelities: F E = ˜ F (0) E = ... = ˜ F ( g − E =1 d { [ v + ( d − x ] + ( d − gx + ( d − g ) y ] } , (15) a mn = v, m = n = 0 ,x, m = 0 , n = 0 or m = 0 , n = km,y, otherwise (16) ( k = 0 , ... , g − , f or some v, where x = r F B − v d − , y = s gv − ( g + 1) F B ( d − d − g ) . (17)One notices that there is still an undetermined, independentvariable v . To achieve the maximal F E for a given F B , oneneeds to further optimize the value of v . In some cases, thiscan be done analytically, but, in the general case, there seemsto be no evident analytical expression. Those analytical re-sults are presented in Sec. III. We do numerical calculationfor the general case.To show the performance of the optimal cloner, we choose d = 5 as an example and plot the optimized F E and v curves FIG. 1: (color online). The curves of the fidelity F E (dashed bluelines) and the parameter v (solid red lines) as functions of F B ofthe optimal cloner for d = 5 and g = 1 , , ..., . The g = 1 and g = 5 lines are derived from Eqs. (19) and (21) respectively. Thecurves for general g ’s are numerically computed from Eqs. (15)-(17). The general- g curves in some domains with very small F B are incomputable by Eqs. (15)-(17), but they can be obtained byexchanging the roles of E and B . as functions of F B in FIG. 1. The figure shows that, as F B increases, F E decreases, i.e. as the disturbance decreases, thestate E resembles the original state less. The figure also showsreasonable shifts of the curves as g varies. As g increases, i.e.as more bases are used, the F E curve shifts down, suggest-ing that F E is lower for a given F B . The difference betweenadjacent curves is small for large g ’s. III. ANALYTICAL SOLUTIONS TO THE OPTIMALCLONER
In this section, we present the analytical expressions of F E and v for some special cases. The first one is the g = 1 case.For g = 1 , an easier method gives that v = F B , x = r F B (1 − F B ) d − , y = 1 − F B d − , (18)whence F E = 1 d [ p F B + p ( d − − F B )] . (19)The second set of analytical results is for g = d . In this case,there exists no y in the matrix ( a mn ) , and v has a fixed valuegiven below. v = r ( d + 1) F B − d , x = s − F B d ( d − (20) whence F E = 1 d hp ( d + 1) F B − p ( d − − F B ) i + (1 − F B ) . (21)Eqs. (19) and (21) recover the previous known results in Ref.[15]. Here, they are related by parameters v and g within aunified framework.The third case in which we have analytical results is thatEve and Bob have equal fidelities, i.e. F E = F B = F . Westart by observing the following fact: When F B = F E = F ,Eq. (15) is equivalent to p ( d − g )[1 + gv − ( g + 1) F ]= v √ d − − ( g + 1) p F − v . (22)We square this equation and let u = √ F − v , and we end upwith an quadratic equation of u and v , ( d + 1)( g + 1) d − g u + 2 d − g − d − g v − g + 1) √ d − d − g uv = 1 , (23)which represents an ellipse centering at the origin. The fidelity F = u + v is the square of the distance from the origin to thepoint ( u, v ) and is thus maximal at one end of the major axis.It is easy to find that point by diagonalizing the coefficientmatrix. The eigenvalues of that coefficient matrix are foundto be λ ± = d d − g ) [( g + 3) ± P ( d, g )] , (24)where P ( d, g ) = r ( g + 3) − d − g )( g + 1) d . (25)By further calculating the eigenvectors, we figure out the max-imal fidelity F and the corresponding parameter v . The max-imal fidelity is F = 1 λ − = 2 d d − g ( g + 3) − P ( d, g ) . = 2 d d − g ( g + 3) − q ( g + 3) − ( d − g )( g +1) d . (26)The corresponding v satisfies uv = ( d + 1)( g + 1) − ( d − g ) λ + − ( g + 1) √ d − (27)and is thus v = [ 2 d × ( d − d − g )( g + 3) − P ( d, g ) × d −
1) + [ d g +1) P ( d, g ) − − d g − g +1 ] ] . (28)We remark that Eqs. (26) and (28) are the results for an op-timal symmetric cloning machine that clones arbitrary g + 1 MUBs and that has not been studied. We can find that, as g increase, F increases as it is expected. IV. THE OPTIMAL ATTACK OF EVE
In our g + 1 basis QKD protocol, we consider that Eve in-tercepts each state and copies it using a fixed cloning machineof the form of Eq. (4). We now think of that Eve’s schemeis to maximizes her information about the state, rather thanthe fidelity, for a given, balanced disturbance. We considerthat the post-processing between Alice and Bob is one-way,consisting of a direct reconciliation and a privacy amplifica-tion. Therefore, the amount of secret information extractableby Alice and Bob reads r = I AB − I AE , (29)where I AB (or I AE ) is the mutual information between thetwo classical strings of symbols of Alice and Bob (or of Aliceand Eve). Note that Eve can measure E ′ and E jointly, so I AE represents the mutual information between the classicalrandom variable A and the random variable pair E ′ and E ,which is Eve’s joint-measurement outcome (for convenience,we denote the associated random variables again by A , B , E ′ ,and E ).Let us now see what restrictions are imposed on Eve.We supposed that Eve’s attack is balanced between differentbases, i.e. the fidelities of Bob’s state are same for differentMUBs. Here, for similar reasons, we also suppose that, foreach basis, the probabilities that Bob make different errorsare equal (one can check that this restriction is compatiblewith the results in Sec. II). Say the error Bob makes is m ( m = 0 , , ... , d − ), i.e. Bob’s symbol is greater thanAlice’s symbol by m . Then, from Eqs. (6 a )-(6 d ), we find thefollowing explicit expressions for these restrictions: d − X j =0 | a mj | = ( F B , m = 0 , − F B d − , m = 0 , (30) d − X i =0 | a i,ki − m | = ( F B , m = 0 , − F B d − , m = 0 (31) ( k = 0 , , ... , g − . Under these restrictions, one can easily find that the mutualinformation between Bob and Alice is given by I AB = log d + F B log F B + (1 − F B ) log − F B d − . (32)To find I AE for one basis {| i i} , we first rewrite Eq. (5 a ) as | i i A → X m,j √ d X n a mn ω n ( i − j ) ! | i + m i B | j i E ′ | j + m i E . (33) As mentioned above, I AE is between the random variable A and the random variable pair ( E ′ , E ) . Suppose ( E ′ , E ) takesthe value ( e ′ , e ) . Eq. (33) tells us that it is equivalent to rep-resent ( e ′ , e ) by ( m, e ′ ) . Thus, Eve’s information I AE can bewritten as I AE = − X m,e ′ p ( m, e ′ ) log p ( m, e ′ )+ X a,m,e ′ p ( a ) p ( m, e ′ | a ) log p ( m, e ′ | a ) . (34) a is the value the random variable A takes. We assume thatAlice sends symbols randomly. Thus, in Eq. (34), p ( a ) = d . The other terms in Eq. (34) are given below, as they arederived from Eq. (33). p ( m, e ′ | a ) = 1 d | X n a mn ω n ( a − e ′ ) | , (35) p ( m, e ′ ) = 1 d X a p ( m, e ′ | a ) . (36)The expressions for I AE of the other bases can be writ-ten analogously. Most generically, the optimal attack can befound by maximizing the I AE ’s under the restrictions of Eqs.(30) and (31). This can be done in principle, but it is hardbecause of the great number of variables and summations.Hence, instead, we here maximize Eve’s information condi-tionally: We suppose that the matrix ( a mn ) takes the formof Eq. (16) but that v is adjustable to maximize Eve’s infor-mation (rather than Eve’s fidelities). One can check that Eq.(16) satisfies Eqs. (30) and (31), and one need only calculate I AE with respect to one basis because Eq. (16) is balanced be-tween different bases. We shall compare the results with thoseof the optimal cloner approach later. In this more restrictivecase, a mn are given partial freedom, but as we shall see, thisis sufficient to prove the deviation of the optimal attack fromthe optimal cloner.We refer to Eq. (16) and find that Eq. (35) now reads p ( m, e ′ | a ) = [ v +( d − x ] d , m = 0 , e ′ = a, ( v − x ) d , m = 0 , e ′ = a, [ gx +( d − g ) y ] d , m = 0 , e ′ = a, ( x − y ) d | − ω mgt − ω mt | , m = 0 , e ′ = a − t ( t = 0) . (37)Then, numerical calculation can be easily done by adjusting v to maximize I AE , and both I AB and I AE become functionsof F B . Let us focus on the critical point where the amountof extractable information is zero, i.e., according to Eq. (29), I AB = I AE . As usual, we substitute F B with D I , the dis-turbance, defined as D I = 1 − F B . We compute the D I ’sassociated with zero extractable information for several d ’sand list them in TABLE I. The values of these critical D I ’sshow regular behaviors: As d or g increases, D I increases,i.e. as more bases are used, higher disturbance is acceptablefor Alice and Bob. D I (%) g d D I associated with zero extractable in-formation for Alice and Bob. These values are obtained with condi-tionally maximized I AE , where ( a mn ) is restricted to the form of Eq.(16). For the d ’s and g ’s we consider, D I shows regular behaviors:Both when d increases and when g increases, D I increases. Sincethe unconditionally maximized I AE can be slightly higher, the realcritical D I can be slightly lower than the values here. It is interesting to see whether the maximizing informationapproach and the maximizing fidelity approach are equiva-lent. For definiteness, let us consider whether the optimalcloner corresponds to the maximal I AE . We substitute the a mn in Eqs. (34)-(36) by the values associated with the opti-mal cloner. This means that we plug into Eq. (37) the valueof v of the optimal cloner, as is calculated in Sec. II. Then,we similarly end up with a table (TABLE II) of the distur-bance associated with zero extractable information. We use adifferent notation D F here to indicate that it corresponds tothe maximized F E rather than the maximized I AE . In TA- D F (%) g d D F associated with zero extractableinformation, obtained simply by plugging the values of a mn of theoptimal cloner into Eqs. (34)-(36). D F has an irregular behavior: As g increases, D F does not change monotonously. D F deviates above D I of TABLE I except for g = d , in which case v is fixed, and thehigher the dimension, the larger the deviation. This suggests that theoptimal cloner is not the optimal attack (see the text). BLE II, D F shows an irregular behavior: As g increases, i.e.as more bases are used, D F does not always increase. D F isgreater than D I except for g = d , in which case v is fixed, andthe deviation tends to be larger as d increases. As we know,associated with D I is the I AE that is maximized under thecondition that ( a mn ) is of the form Eq. (16), so the maximal I AE free of this condition may be slightly larger and thus thecondition-free D I may be lower. Since D F is larger than theconditional D I , it is larger than the condition-free D I . There-fore, maximizing F E is not equivalent to maximizing I AE ,and the optimal cloner does not correspond to the optimal at-tack. V. PHASE COVARIANT QUANTUM CLONING MACHINE
We now introduce a side product of the optimal cloner ap-proach to our g + 1 protocol QKD. As mentioned in Ref. [15],the optimal cloner for d + 1 MUBs ( g = d ) is the universalquantum cloning machine [25, 28]. For d MUBs ( g = d − ),one may intuitively think of phase-covariant quantum cloningmachine. In this section, we show that the optimal clonerof d MUBs is equivalent to the optimal asymmetric phase-covariant quantum cloning machine. More specifically, weshow that it is equivalent to a revised asymmetric form of thesymmetric phase-covariant quantum qudit cloning machinepresented in Ref. [26], and we prove the optimality of thatrevised form.In Ref. [26], the following equatorial states are considered: | Φ i ( in ) = 1 √ d d − X j =0 e iφ j | j i , (38)where φ j are arbitrary phase parameters. (Thus, the corre-sponding MUB cloning machine should be the one that clonesthe bases {| ˜ i (0) i} , ..., and {| ˜ i ( d − i} .) The explicit expressionfor the symmetric cloning transformation is given as | i i → α | ii i | i i R + β p d − X j = i ( | ij i + | ji i ) | j i , (39)where , represent the two clones while R is the ancillarystate. α and β are real parameters that satisfy α + β = 1 .The optimal fidelity for the symmetric cloning machine reads F optimal = 14 d ( d + 2 + p d + 4 d − . (40)One finds that Eq. (40) is consistent with Eq. (26).Now we claim that the optimal asymmetric phase-covariantquantum cloning machine is equivalent to the optimal clonerof the d MUBs and takes the form | i i → α | ii i| i i + β √ d − X j = i (cos θ | ij i + sin θ | ji i ) | j i , (41)where θ is a real parameter. To prove this claim, we first writedown the fidelities associated with this cloning transforma-tion, F = 1 d + 2 αβd √ d − θ + β ( d − d cos θ, (42) F = 1 d + 2 αβd √ d − θ + β ( d − d sin θ, (43)where the constraint α + β = 1 still holds. We per-form a numerical calculation that manipulates α , β , as wellas θ to maximize one fidelity given the other. The resultsshow that the optimized fidelities for this asymmetric phase-covariant cloning quantum machine are equal to the fidelitiesof the optimal d -MUB cloner, as are computed in Sec. II.Since cloning equatorial states has a higher requirement thancloning d MUBs, the optimality of a d -MUB cloner infers theoptimality of an asymmetric phase-covariant quantum cloningmachine with the same achieved fidelities, and their equiva-lency. This proves our claim. VI. CONCLUSION
In this article, we study the general, d-dimensional QKDthat uses arbitrary g + 1 MUBs, focusing on the individual at-tack by Eve and the one-way post-processing (a direct recon-ciliation plus a privacy amplification) by Alice and Bob. Thisinvestigation of the general g +1 MUB QKD protocol is a nat-ural generalization of the QKD in higher dimension and mayhelp one balance the gain and the cost of the implementation.In this article, we investigate Eve’s attack by two different ap-proaches. One is maximizing F E , the fidelity of Eve’s state E , while the other is maximizing I AE , the information Evehas about Alice classical symbol. In the first approach (Sec.II), we derive the fidelities and the parameter of the optimalcloner and demonstrate their behaviors, which are reasonable.It turns out that in some special cases, the most significantof which is the symmetric cloning, the optimal cloner can bysolved analytically (Sec. III). In the second approach (Sec.IV), we give the equations for the most generic calculationfor I AE maximization, but, considering its complexity, we doinstead a more restrictive version. Though restricted, the cal- culation still shows interesting results. In particular, it proves(except for g = d ) the deviation of the optimal cloner fromthe optimal attack. Sec. V is dedicated to a side product ofour optimal cloner approach. We show that the optimal asym-metric phase covariant quantum cloning machine is equivalentto the optimal cloner of d MUBs ( g = d − ). We also showthat this optimal asymmetric phase covariant quantum cloningmachine can be formulated as a revised version of the optimalsymmetric cloning transformation presented in Ref. [26]. Asthe bottom line, we here remark that there still exist severalpossible extensions, which may be of future interests, for ourgeneral, ( g + 1) -basis, qudit-based QKD protocol: extensionto two-way post-processing, to prime-power dimensional sys-tems, and to the coherent attack. ACKNOWLEDGEMENT
We thank Xin-Quan Chen for useful discussions. Thiswork is supported by NSFC (10974247), “973” program(2010CB922904) and NFFTBS (J1030310). [1] C. H. Bennett and G. Brassard, in Proceedings of the IEEE In-ternational Conference on Computers, Systems and Signal Pro-cessing, Bangalore, India (IEEE, New York, 1984), pp. 175-179.[2] H. K. Lo and H. F. Chau, Science , 2050 (1999).[3] P. W. Shor and J. Preskill, Phys. Rev. Lett. , 441 (2000).[4] D. Bruß, Phys. Rev. Lett. , 3018 (1998).[5] A. K. Ekert, Phys. Rev. Lett. , 661 (1991).[6] N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, Rev. Mod.Phys. , 145 (2002).[7] F. Grosshans, G. V. Assche, J. Wenger, R. Brouri, N. J. Cerf,and P. Grangier, Nature , 238 (2003).[8] C. Gobby, Z. L. Yuan, and A. J. Shields, Appl. Phys. Lett. ,3762 (2004).[9] C. Z. Peng et al. Phys. Rev. Lett. , 150501 (2005).[10] H. Takesue, S. W. Nam, Q. Zhang, R. H. Hadfield, T. Honjo, K.Tamaki, and Y. Yamomoto, Nat. Photonics , 343 (2007).[11] T. Y. Chen et al. Opt. Exp. , 27217 (2010).[12] We only consider the case that d is prime.[13] H. Bechmann-Pasquinucci and W. Tittel, Phys. Rev. A, ,062308 (2000).[14] T. Durt and B. Nagler, Phys. Rev. A , 042323 (2003).[15] N. J. Cerf, M. Bourennane, A. Karlsson, and N. Gisin, Phys.Rev. Lett. , 127902 (2002). [16] V. Karimipour, A. Bahraminasab, and S. Bagherinezhad, Phys.Rev. A , 052331 (2002).[17] A. Ac´ın, N. Gisin, and V. Scarani, Quant. Info. Comput. , 563(2003).[18] T. Durt, D. Kaszlikowski, J.-L. Chen, and L. C. Kwek, Phys.Rev. A , 032313 (2004).[19] G. M. Nikolopoulos and G. Alber, Phys. Rev. A , 032320(2005).[20] G. M. Nikolopoulos, K. S. Ranade, and G. Alber, Phys. Rev. A , 032325 (2006).[21] J. Bae and A. Ac´ın, Phys. Rev. A , 012334 (2007).[22] K. S. Ranade, Phys. Rev. A , 022301 (2009)[23] L. Sheridan and V. Scarani, Phys. Rev. A , 030301(R) (2010).[24] D. Gottesman, A. Kitaev, and J. Preskill, Phys. Rev. A ,012310 (2001).[25] N. J. Cerf, Phys. Rev. Lett. , 4497 (2000); J. Mod. Opt. ,187 (2000); Acta Phys. Slovaca , 115 (1998).[26] H. Fan, H. Imai, K. Matsumoto, and X. B. Wang, Phys. Rev. A , 022317 (2003).[27] S. Bandyopadhyay, P. O. Boykin, V. Roychowdhury, and F.Vatan, Algorithmic , 512 (2002).[28] J. Fiur´asˇek, R. Filip, and N. J. Cerf, Quant. Info. Comput.5