Analysis of a High-Dimensional Extended B92 Protocol

The need for perfect security necessitated the development of cryptographic systems where there are no computational constraints on the capabilities of the adversary. Quantum key distribution (QKD) is one such system that is extensively studied and is increasingly maturing to the point of real-world adoption. In QKD, using quantum mechanical properties of communication resources, two parties Alice (A) and Bob (B), following a specified set of steps, generate a shared secret that is secure from an all-powerful adversary Eve (E).

Since the first QKD protocol by Bennett and Brassard in $1984$ (BB84) [1], there have been numerous advances in both theoretical and practical aspects [2, 3, 4]. However, because generating, maintaining, and manipulating quantum resources are exceptionally hard with current technologies, people have strived to create conceptually simpler protocols that also require less quantum resources. For instance, BB84 itself uses four quantum states and two measurement bases. In 1992, Bennett proposed an even simpler QKD protocol called B92, that uses only two non-orthogonal states and measurement bases [5].

The unconditional security of this protocol has been investigated by several authors [6, 7] with continually improving results (for instance, in [7], a noise tolerance of $6.5\%$ is reported). However, B92 is very noise sensitive compared to other protocols like BB84 as was already noted in the original paper [5]. Lucamarini et al. [8], proposed an extended version of B92 (Ext-B92) which added two additional non-informative states to better bound Eve’s information gain. Depending on the user-defined choice for key encoding states, the noise tolerance of that protocol can approach $11\%$ in the asymptotic scenario [8], similar to BB84, and at least $7\%$ in the finite key scenario [9].

These protocols mentioned above use qubits (dimension two systems) as the communication resource between Alice and Bob. However, higher dimensional quantum systems (see [10] for a brief survey) have been shown to have several advantages and interesting properties over qubit-based protocols. Some protocols have been shown to withstand a high channel noise level as the dimension of the system increases [11, 12, 13, 14]. Others exhibit interesting theoretical properties such as the so-called “Round Robin” protocol which can bound Eve’s information based only on the dimension of the system and not necessarily through observing channel noise [15]. In addition to several theoretical results that prove the unconditional security of HD-QKD protocols, the actual technology to implement high-dimensional systems is also becoming more mature with recent high-dimensional protocols proving to be feasible to implement [16, 17, 18, 19, 20]. Thus, it is worth studying protocols that are highly susceptible to noise, like B92 based variants (in our case the extended B92), to see if HD-systems give an advantage.

In this work, we propose a high-dimensional variant of the Ext-B92 protocol of [8]. Keeping in mind that certain high-dimensional states are difficult to create or distinguish, we make sure in our protocol to limit the required state preparations and measurement operations required. In particular, Alice need only be able to send three high dimensional states while Bob need only be able to perform a computational basis measurement (distinguishing any computational state $\{\ket{0},\ket{1},\cdots,\ket{D-1}\}$) or be able to perform a partial basis measurement in an alternative basis - this partial measurement need only distinguish a particular superposition state defined in the protocol and need not be capable of distinguishing all $D$ possible states. As far as we are aware, this is a novel high-dimensional QKD protocol.

Despite these limitations on Alice and Bob’s capabilities, we show that these higher dimensional states do help improve noise tolerance in this protocol as the dimension of the system increases which agrees with recent research on high-dimensional BB84. We perform an information-theoretic security analysis and show that it can maintain a positive key rate while withstanding noise levels of $5.35\%$ for qubits (dimension $2$) to $15.5\%$ for dimension $2^{14}$ in a depolarizing channel. Thus, we show that higher dimensions can aid in depolarization noise tolerance for a B92 style encoding scheme with (partial) extended test cases in the form of a third basis state being transmitted for testing the channel. Moreover, we consider an amplitude damping channel and show that choosing the distinguished superposition state carefully in a high-dimensional QKD protocol is of significant importance as different choices lead to different noise tolerances.

We make several contributions in this work. First, we describe and analyze a high-dimensional version of the Ext-B92 protocol originally introduced for qubits [8]. We perform an information theoretic security analysis against collective attacks (a powerful class of attacks against QKD protocols) to derive its key-rate in the asymptotic scenario for arbitrary dimensions and channel parameters. Our methods here may have a broader impact in other QKD protocol security analyses, especially for high-dimensional systems with only partial basis measurements or state preparations as with our protocol here. Finally, we evaluate our resulting key rate and compare it with a high-dimensional version of the BB84 protocol, showing how the choice of states to send can greatly affect the key-rate depending on the channel.

For a quantum system $A$ we will use $\rho_{A}$ to denote its density operator. Its von Neumann entropy will be denoted by $S(A)=S(\rho_{A})$ and is defined by $-\tr(\rho_{A}\log\rho_{A})$. Given a bipartite quantum state $\rho_{AE}$ shared by two systems $A$ and $E$, we will denote the conditional von Neumann entropy of $A$ given access to $E$, by $S(A|E)_{\rho}$. We will often forgo writing the subscript $\rho$ when the context is clear. This conditional entropy is defined as $S(AE)-S(E)$. The Shannon entropy of $A$ will be denoted by $H(A)$ and the conditional Shannon entropy of two systems $A$ and $B$, will be denoted by $H(A|B)$. The binary entropy function will also be represented by $H(p)$ where $H(p)=-p\log(p)-(1-p)\log(1-p)$ for $p\in[0,1]$. All logarithms presented in this work are base $2$. For an arbitrary quantum state $\ket{\psi}$, we use $P(\ket{\psi})$ to denote its projector $\outerproduct{\psi}{\psi}$. Finally, given a vector $\ket{x}$ and a numerical value such as $\frac{1}{2}$ we sometimes write $\ket{\frac{1}{2}x}$ to mean $\frac{1}{2}\ket{x}$.

Later, to compute the lower bound of the conditional von Neumann entropy of a classical-quantum state $\rho_{AE}$, we make use of the following theorem:

The protocol we propose here is a high-dimensional variant of the Ext-B92 protocol originally described in [8]. In that protocol, two non-orthogonal states, similar to B92, are used for key encoding while two additional states are used for quantum tomography (these four states together come from two distinct bases). In the higher dimensional case we analyze here, we will use two non-orthogonal states for key encoding; for error testing, we adopt a simplification from [9] (done there for the qubit case) and not require users to be able to control two complete bases. More specifically, in our high-dimensional extended B92, Alice sends $\ket{i}$ and $\ket{\phi}=\frac{1}{\sqrt{2}}(\ket{i}+\ket{j})$ to encode classical key bits of $0$ and $1$ respectively, where $\ket{i},\ket{j}$ are fixed and chosen from the $D$-dimensional computational basis states $\{\ket{0},...,\ket{D-1}\}$. We ask that Alice send only $\ket{j}$ as the additional uninformative state. Thus, Alice need only be able to prepare and send three distinct quantum states. On Bob’s part, we require his ability to measure in two POVMs. These are $Z=\{\outerproduct{0}{0},...,\outerproduct{D-1}{D-1}\}$ (the complete computational basis) and $X=\{\outerproduct{\phi}{\phi},\mathbb{I}-\outerproduct{\phi}{\phi}\}$ where of course, the identity operator $\mathbb{I}$ is understood to be $D$-dimensional. Hence, Bob would be able to detect any computational basis state but would only need to detect $\ket{\phi}$. Our protocol, which we call here HD-Ext-B92, in detail appears in Protocol 1.

In the quantum communication stage of our protocol, Alice and Bob use the quantum channel to establish a raw-key. Because Eve has total control over this channel, she may attack the traveling signals arbitrarily while only respecting the laws of physics. In this paper, we consider collective attacks whereby Eve attacks each round of the protocol independently and identically, but may delay her measurements until the end of the protocol. These are a powerful class of attack which often imply security of general coherent attacks [27, 28], though we leave a complete proof of whether this applies to our protocol as future work.

The goal of our analysis is to obtain a lower bound on the conditional von Neumann entropy $S(A|E)$, which represents how much entropy is left in Alice’s register $A$, given Eve’s (quantum) memory $E$. Then, we will find how much this quantity differs from the conditional Shannon entropy $H(A|B)$, which represents how much entropy is left in Alice’s register given Bob’s memory $B$. These two terms will ultimately let us calculate our quantity of interest from this protocol, which is, the key rate $r$ (namely, the number of secret key bits, denoted $\ell$ over the size of the produced raw key denoted $M$). To compute the key rate we use the Devetak Winter key-rate [29, 30], which states the key rate $r$ in the asymptotic setting is:

where the infimum is over all collective attacks performed by Eve that fall within the range of observed noise statistics (in our case, those statistics shown in Table 1). Note that the above entropy functions are computed over a single key-round. However $S(A|E)$ is not straightforward to calculate, unlike $H(A|B)$, because it involves Eve’s quantum memory on which we only have partial information. Nevertheless, we can obtain a lower bound on $S(A|E)$ which will be the main goal of our security analysis.

We begin by modeling the state of the joint quantum system held between Alice, Bob, and Eve at the end of one key-round of the protocol. That is, to compute Equation 1, we need the von Neumann entropy of the resulting density operator conditioned on a key bit being distilled and so we must model the joint quantum state, conditioning on the event that Alice and Bob establish a key bit.

At the beginning of the protocol, Alice decides on her classical bit and sends her qudit accordingly to Bob. If she wants to send classical bit $0$, she sends a $\ket{i}$ and if she wants to send $1$, she sends a $\ket{\phi}$. So when she sends the qudits, her own classical register, denoted by $A$ and the transit register, denoted by $T$ (used to model the traveling qudit), is in the following state:

Eve attacks this traveling qudit with a unitary attack operator $U$, which acts on Hilbert space $\mathcal{H}_{T}\otimes\mathcal{H}_{E}$. Here, $\mathcal{H}_{E}$ models Eve’s memory space. Assuming her own memory is in an arbitrary but normalized state $\ket{\chi}_{E}$ that resides in $\mathcal{H}_{E}$, we can describe $U$’s action on a basis state $\ket{a}$ as:

where $D$ is the dimension of each qudit and each $\ket{e_{b}^{a}}$ is an arbitrary state in Eve’s ancilla. Because $U$ is unitary, we note that the following must hold: $\sum_{b=0}^{D-1}\innerproduct{e_{b}^{i}}{e_{b}^{i}}=1.$ Additionally, by linearity of $U$ we have:

where, $\ket{f_{b}}_{E}:=\ket{e_{b}^{i}}_{E}+\ket{e_{b}^{j}}_{E}$. So the result of Eve’s attack on $\rho^{(0)}_{AT}$ is the following:

where, recall, $P(\ket{z})=\outerproduct{z}{z}$ is the projection operator. Henceforth, we will forgo writing the subscript for a register when the context is clear. Now, after the qudit arrives at Bob’s lab, he measures the transit register $T$ in either POVM $Z$ or $X$ with equal probability. Let’s consider the case when he uses $X$ and gets the outcome $\mathbb{I}-\outerproduct{\phi}{\phi}$ (we are conditioning on a successful key-round for this analysis). This is the case when Bob sets his key-bit to $0$, because in a noiseless scenario, this outcome could only be obtained when Alice would have sent an $\ket{i}$. Let’s define the measurement operator in this case as $M_{0}=\mathbb{I}_{A}\otimes(\mathbb{I}-\outerproduct{\phi}{\phi})\otimes\mathbb{I}_{E}$. Then the un-normalized post-measurement state, conditioned on him observing $M_{0}$ (again, we are only interested, for the moment, in a successful key distillation round) is:

where in the last equality, we have defined $\ket{g}=\ket{e_{i}^{i}}-\ket{e_{j}^{i}}$ and $\ket{h}=\ket{f_{i}}-\ket{f_{j}}$. Now that Bob has his $X$ basis measurement result at his hand, we can trace out the transit register $T$ and add Bob’s register $B$ to hold his measurement result. Then the resulting state is:

Similarly, if he uses POVM $Z$ and gets outcome $\mathbb{I}-\outerproduct{i}{i}$, he can be certain in a noiseless scenario that Alice has sent a $\ket{\phi}$. With the measurement operator $M_{1}:=\mathbb{I}_{A}\otimes(\mathbb{I}-\outerproduct{i}{i})\otimes\mathbb{I}_{E}$, in this case we get the following un-normalized post-measurement state:

Following a similar procedure as before, we trace out the transit register $T$ and add Bob’s register holding his measurement result. The resulting density operator is:

Then the total (still non-normalized) density operator that represents a key-bit generation round, is the following:

Keeping in mind that, our ultimate goal is to bound Eve’s entropy about Alice’s register, i.e. $S(A|E)$, in the case where Alice and Bob shares a key-bit, we trace out Bob’s register too, keeping only the registers of Alice and Eve. Thus, we calculate the final required density operator as:

where the normalization term $N$ can be calculated as:

Now, using Theorem 1, we may compute the conditional entropy as:

where:

and:

Thus, to find a lower bound on $S(A|E)$ (thus giving us a lower bound on the protocol’s key-rate), we must determine bounds for the inner-products appearing in the above expressions. Of course, these inner products are functions of Eve’s quantum ancilla. We show how to determine suitable bounds on these systems based only on parameters that are directly observable in our protocol during test rounds (see Table 1).