Chau-Wang-Wong17 Scheme Is Experimentally More Feasible Than The Six-State Scheme

TL;DR

This paper demonstrates that the four-dimensional qudit-based QKD scheme by Chau et al. is more experimentally feasible and tolerant to errors than the six-state scheme, supported by theoretical analysis and a proof-of-principle experiment.

Contribution

It provides a detailed comparison showing the Chau et al. scheme's higher error tolerance and experimental advantages over the six-state scheme, including a practical implementation.

Findings

Chau et al.'s scheme tolerates up to 21.6% four-dimensional dit error rate.

The scheme has comparable secret key rates to the six-state scheme under ideal conditions.

Experimental implementation shows practical advantages over traditional six-state QKD.

Abstract

Recently, Chau et al. [Phys. Rev. A 95, 022311 (2017)] reported a quantum-key-distribution (QKD) scheme using four-dimensional qudits. Surprisingly, as a function of the bit error rate of the raw key, the secret key rate of this scheme is equal to that of the (qubit-based) six-state scheme under one-way classical communication using ideal apparatus in the limit of arbitrarily long raw key length. Here we explain why this is the case in spite of the fact that these two schemes are not linearly related to each other. More importantly, we find that in terms of the four-dimensional dit error rate of the raw key, the Chau et al.'s scheme can tolerate up to 21.6% using one-way classical communications, which is better than the Sheridan and Scarani's scheme [Phys. Rev. A 82, 030301(R) (2010)]. In addition, we argue the experimental advantages of the Chau et al. implementation over the standard six-state scheme and report a corresponding proof-of-principle experiment using passive basis selection with decoy states. We also compare our experiment with the recent high secret key rate implementation of the Sheridan and Scarani's scheme by Islam et al. [Sci. Adv. \text{3}, e1701491].

Tables

Table 1. Table 1: The length of fiber ( l 𝑙 l ), the mean photon numbers ( μ 𝜇 \mu , ν 𝜈 \nu and υ 𝜐 \upsilon ) per packet and yield ( Q 𝑄 Q ) per packet, error rates ( E 1 superscript 𝐸 1 E^{1} , E 2 superscript 𝐸 2 E^{2} , and E 3 superscript 𝐸 3 E^{3} ), and the secret key rate per packet (R). By increasing optical misalignment intentionally, additional observations of E 2 superscript 𝐸 2 E^{2} and the corresponding secret key rate are listed in brackets.

$l$	Intensity		$Q$	$E^1$	$E^2$	$E^3$	$R$
$50$km	$\mu$	$0.66$	$5.63\times {10}^{-3}$	$0.216\%$	$1.81\%$ $\left(15.1\%\right)$	$0.217\%$	$7.31\times {10}^{-4}$ $\left(1.64\times {10}^{-5}\right)$
	$\nu$	$0.04$	$3.56\times {10}^{-4}$	$1.24\%$	$2.77\%$ $\left(19.4\%\right)$	$1.24\%$
	$\upsilon$	$0.0016$	$2.92\times {10}^{-5}$	$13.4\%$	$14.2\%$ $\left(20.4\%\right)$	$13.4\%$

Equations

$$R$$

$$+\min \sum _{g=0}^3{\Omega }^g[s-H_2(\{{\delta }_p^g{\}}_p)]\},$$

$$\min \sum _{g=0}^3{\Omega }^g\left[s-H_2(\{{\delta }_p^g{\}}_p)\right]$$

$$=$$

$$f(e_{01})\equiv e_{01}^3-(1-3e_{01}-e^{\ast })(e^{\ast }-6e_{01}{)}^2=0$$

Full text

I Introduction

In theory, the six-state scheme Bruß (1998) is a powerful qubit-based quantum key distribution (QKD) scheme that tolerates higher channel noise (up to 12.6% bit error rate (BER) using one-way classical communication using non-degenerate code Lo (2001)) than the BB84 protocol Bennett and Brassard (1984). However, it does not attract much experimental attention because it requires more optical components, making it more lossy than the BB84 protocol Scarani et al. (2009). Along a different direction and based on an earlier work of Chau Chau (2015), his group reported an $N$-dimensional-qudit-based scheme that has exactly the same one-way secret key rate formula as a function of the bit error rate of the raw key for ideal equipment in the arbitrarily long raw key length limit provided that $N=4$ Chau et al. (2017a). We call their scheme the CWW174 scheme, where the subscript refers to the Hilbert space dimension $N$ of the qudit used.

It is instructive to find out the underlying reason for the agreement of the one-way key rate formulas of these two schemes. Here we first show that the six-state scheme cannot be imbedded in the CWW174 scheme and vice versa. Then, we argue that this key rate agreement is out of a lucky coincidence.

Along a different line, Sheridan and Scarani Sheridan and Scarani (2010, 2011) introduced a scheme using four-dimensional qudits as information carrier that we called the SS104 scheme. In their scheme, states are prepared and measured either in the computational basis \{\mbox{\left|j\right\rangle}\}_{j=0}^{3} or its Fourier transformed basis \{\sum_{k=0}^{3}e^{\pi ijk/2}\mbox{\left|k\right\rangle}/2\}_{j=0}^{3}. They showed that by using ideal apparatus and single photon source and in the limit of infinite raw key length, the SS104 scheme tolerates up to an error rate of 18.9% for qudit depolarizing channel Sheridan and Scarani (2010, 2011). Although not explicitly defined, it is evident from their analysis that they referred to the four-dimensional dit error rate111That is to say, there are four possible measurement outcomes for each qudit, say, $0,1,2,3$. The dit error rate refers to the error rate of this sifted key expressed in dits. One may convert this dit string to a bit string, say, by mapping $0,1,2,3$ to $00,01,10,11$, respectively. And one may talk about the BER of this sifted bit string key. (DER) of the raw key. And this translates to a tolerable BER of 12.6%, which equals exactly that of the six-state scheme. Nevertheless, by carefully studying their proof, it is clear that if Alice and Bob just care about the average BER without looking into the three different four-dimensional DERs, their scheme can only tolerate up to 11.0% BER just like the BB84 protocol because a channel that independently produces spin flip and phase shift errors to each qudit will produce the same BER as a qudit depolarizing channel. In fact, their proof implicitly showed that the secret key rate of (the unbiased basis selection version of) the SS104 scheme is 1.5 times that of the six-state scheme partly because Alice and Bob has two rather than three bases to choose from. We explicitly write down their argument in Appendix A.

It is instructive to compare the theoretical and experimental performances of the CWW174 and the SS104 schemes. Here we find that the CWW174 scheme can tolerate up to a DER of 21.6% in the raw key using one-way classical communciation in the infinite raw key length limit using ideal single photon source and detectors, which is higher than that of the SS104 scheme. Based on earlier success of time-bin implementations Takesue et al. (2015); Wang et al. (2015); Li et al. (2016); Yin et al. (2018); Guan et al. (2015); Wang et al. (2018) of the round-robin differential-phase-shift Sasaki et al. (2014), the Chau15 Chau (2015) and the SS104 Islam et al. (2017) schemes, it makes sense to implement the CWW174 scheme via the time-bin representation. So, we perform such an experiment using passive basis selection and decoy states, and discuss its practical advantages over the original six-state scheme as well as comparing it with the recent implementation of a biased basis selection version of the SS104 scheme by Islam et al. Islam et al. (2017).

II Differences between the six-state and the CWW174 schemes

Recall that in the six-state scheme, Alice and Bob prepare and measure qubits in one of the basis states of the following three mutually unbiased bases (MUBs) \{\mbox{\left|0\right\rangle},\mbox{\left|1\right\rangle}\}, \{(\mbox{\left|0\right\rangle}\pm\mbox{\left|1\right\rangle})/\sqrt{2}\}, and \{(\mbox{\left|0\right\rangle}\pm i\mbox{\left|1\right\rangle})/\sqrt{2}\} Bruß (1998); whereas those states for the CWW174 scheme using four-dimensional qudits are \mbox{\left|\psi_{jk}^{\pm}\right\rangle}\equiv(\mbox{\left|j\right\rangle}\pm\mbox{\left|k\right\rangle})/\sqrt{2} for $0\leqslant j<k\leqslant 3$ Chau et al. (2017a). Here {\mathcal{B}}_{\ell}=\{\mbox{\left|j\right\rangle}\colon 0\leqslant j<\ell\} is an orthonormal basis of the $\ell$-dimensional Hilbert space. (Note that Ref. Chau et al. (2017a) labelled the four basis states using finite field notation to emphasize its underlying mathematical structure. Here we just label them from [math] to $3$ for the convenience of experimentalists.) In the six-state scheme, the raw key bit of Alice (Bob) is assigned to [math] if the preparation (measurement) state is $\left|0\right\rangle$, (\mbox{\left|0\right\rangle}+\mbox{\left|1\right\rangle})/\sqrt{2} or (\mbox{\left|0\right\rangle}+i\mbox{\left|1\right\rangle})/\sqrt{2}. Otherwise, it is assigned as $1$ Bruß (1998). For the CWW174 scheme, the 12 preparation and measurement states form three set of MUBs in the four-dimensional Hilbert space. Therefore, each prepared or measured qudit corresponds to two raw bits. For instance, for states prepared or measured in the basis \{(\mbox{\left|j\right\rangle}+(-1)^{k}\mbox{\left|j+2\right\rangle})/\sqrt{2}\colon j,k=0,1\}, the raw bits are $j$ and $k$ Chau et al. (2017a).

For generation of the final secret key from the raw bits, we follow the standard Shor and Preskill procedure Shor and Preskill (2000) adapted to the decoy state situation Wang (2005); Lo et al. (2005); Ma et al. (2006). using one-way classical communication. And for simplicity, we use the so-called random key assignment in the sense that whenever Bob does not detect a signal, he will randomly and uniformly assign the “measurement result” as one of the four pairs of bits $00,01,10$ and $11$. Finally, in case more than one of the Bob’s detectors click, we randomly assign Bob’s measurement result Fung et al. (2011).

By considering a corresponding entanglement-distillation protocol of four-dimensional qudits, Chau et al. Chau et al. (2017a) proved that for ideal apparatus and in the infinitely long sifted key length limit, the one-way key rate of the CWW174 scheme equals to that of the six-state scheme. But they do not know why. In Appendix B, we show that although the six-state and the CWW174 schemes have the same one-way key rate as a function of the BER in the raw key in the case of ideal source and detectors, they are very different schemes in the sense that one cannot be imbedded in the other. In simple terms, it means that the preparation methods of these two schemes are so different that they are not linearly related. Consequently, we believe that they have the same one-way key rate formulas in the ideal apparatus situation because of a lucky coincidence. And this coincidence comes from the following observation. As Alice and Bob each randomly picks one of the three MUBs, they in effect completely mix the phase and spin flip errors in the quantum channel Chau et al. (2017a). For the CWW174 scheme, the worst-case one-way key rate for a given raw key rate happens when the phase and spin flip errors are independent Chau et al. (2017a). Thus, this worst-case key rate can be computed as if each raw bit had passed through a depolarizing channel — the very same situation of the six-state scheme.

III One-way secret key rate formulas for the original and the modified CWW174 schemes

The one-way secret key rate formula for the CWW174 scheme for ideal single photon source in Ref. Chau et al. (2017a) can extended to the case of using standard decoy state via the flagging method first explicitly presented in Ref. Ma et al. (2006). (See Ref. Chau et al. (2017b) for detail.) It is given by

[TABLE]

where $s=2$ is the conversion factor from a $4$-dimensional dit to 2 bits Chau (2015); Chau et al. (2017a), $q=1/3$ is the chance that Alice and Bob use the same basis, $Q_{\mu}=\sum_{n=0}^{+\infty}Y_{n}\mu^{n}\exp(-\mu)/n!$ is the overall gain of the signal, $Y_{n}$ is the conditional probability that Bob’s detector(s) clicks given Alice emits $n$ photons. Also, $H_{2}(\{x_{k}\}_{k=1}^{N})=H_{2}(x_{1},\dots,x_{N})\equiv-\sum_{k=1}^{N}x_{k}\log_{2}x_{k}$ is the binary entropy function provided that $\sum_{k=1}^{N}x_{k}=1$, $E_{\mu}^{g}=\sum_{n=0}^{+\infty}e_{n}^{g}Y_{n}\mu^{n}\exp(-\mu)/(Q_{\mu}n!)$ is the overall rate of the $4$-dimensional signal dit with error $g$, and $e_{n}^{g}$ is the corresponding conditional probability given Alice emits $n$ photons Ma et al. (2006). Here, $g(=0,1,2,3)$ error means that the bitwise addition modulo 2 of the two corresponding raw secret bits of Alice and Bob is $g$ Chau (2015); Chau et al. (2017a). (Using the example in the last sentence of the second last paragraph, the least significant bit of $g$ is $j$ and the most significant bit of $g$ is $k$.) Further, $\Omega^{g}=Y_{1}\mu\exp(-\mu)e^{g}_{1}/Q_{\mu}$ is the fraction of single photon that experience error $g$, and $\delta_{p}^{g}$ is the “phase error rate” of those dits in the raw key with error $g$. Finally, the minimization is over all $\delta_{p}^{g}$’s that are consistent with the deduced values of $e_{1}^{g}$’s. Specifically, from Ref. Chau et al. (2017b) which extends the work of Ref. Chau et al. (2017a), we have $e_{1}^{0}=A+B+C+D$, $e_{1}^{1}=2(B+D)$, $e_{1}^{2}=2(C+D)$ and $e_{1}^{3}=4D$ with $A+3B+3C+9D=1$ and $0\leqslant A,B,C,D\leqslant 1$. Moreover, the BER of the single photon event in the raw key is $e=(e_{1}^{1}+e_{1}^{2})/2+e_{1}^{3}$. Then, the minimization (subject to a fixed $e$) is attained when $H_{2}(\{\delta_{p}^{3}\}_{p})=H_{2}(\{D/4D,D/4D,D/4D,D/4D\})=2$, $H_{2}(\{\delta_{p}^{1}\}_{p})=H_{2}(\{B/[2(B+D)],B/[2(B+D)],D/[2(B+D)],D/[2(B+D)]\})$, $H_{2}(\{\delta_{p}^{2}\}_{p})=H_{2}(\{C/[2(C+D)],C/[2(C+D)],D/[2(C+D)],D/[2(C+D)]\})$ and $H_{2}(\{\delta_{p}^{0}\}_{p})=H_{2}(\{A/(A+B+C+D),B/(A+B+C+D),C/(A+B+C+D),D/(A+B+C+D)\})$.

Let us also compute the secret key rate as a function of the DER of the raw key. By concavity of the entropy function, the worst case secret key rate occurs when $E_{\mu}^{1}=E_{\mu}^{2}=E_{\mu}^{3}$ and $e_{1}^{1}=e_{1}^{2}=e_{1}^{3}$ in the infinite raw key length limit. Moreover, using the notations in Ref. Chau et al. (2017a) (with the minor changes of using labels [math] to $3$ instead of labels in finite field notations), $e_{01}=e_{02}=e_{03}=e_{10}=e_{20}=e_{30}=e_{11}=e_{23}=e_{32}$, $e_{12}=e_{21}=e_{33}$ and $e_{13}=e_{22}=e_{31}$. Thus, $\{\delta_{p}^{0}\}=\{e_{00}/e_{1}^{0},e_{01}/e_{1}^{0},e_{01}/e_{1}^{0},e_{01}/e_{1}^{0}\}$ and $\{\delta_{p}^{g}\}=\{e_{01}/e_{1}^{g},e_{01}/e_{1}^{g},e_{12}/e_{1}^{g},e_{13}/e_{1}^{g}\}$ for all $g\neq 0$. Combined with the constraints that $e_{00}+9e_{01}+3e_{12}+3e_{13}=1$ and the DER of the raw key $e^{*}=6e_{01}+3e_{12}+3e_{13}$, we may minimize the second term in Eq. (1) to get the secret key rate. (See Appendix C for detail.)

Fig. 1 depicts the (one-way) secret key rates of various QKD protocols for ideal photon source and detector without the need of decoy. It shows that the modified CWW174 scheme tolerates up to 14.4% BER (or 21.6% DER), which is better than the six-state and the SS104 schemes. Note that the modified CWW174 scheme is better than the unbiased (extremely biased) version of the SS104 scheme when the DER $e^{*}$ exceeds 14.4% (17.7%). This demonstrates the advantage of the modified CWW174 scheme over the SS104 scheme for very noisy channel. Finally, we remark that the curves in Fig. 1 show the worst case secret key rates. In practice, one should use Eq. (1) to compute the secret key rate $R$ because it takes the error rates $e_{1}^{g}$ for all $g$ into account. In a lot of cases, it gives a better value of $R$ that the worst case situation.

IV Experimental results and their comparison with other QKD schemes

We now report to our CWW174 scheme experiment using time-bin representation. Our implementation is shown in Fig. 2. At Alice’s site, a pulse train with a repetition rate of 1\GHz is generated by modulating a continuous wave laser using the first LiNbO3 intensity modulator (IM1), and only two random pulses indexed by $j$ and $k$ ($j,k\in\{0,1,2,3\}$ and $j<k$) in each packets of 4 time slots (4\ns) are allowed to pass IM2. IM3 is employed to implement the decoy states method Hwang (2003); Wang (2005); Lo et al. (2005), by which each packet is randomly modulated into signal state (whose intensity is $\mu$ photons per packet), and two decoy states (whose intensities are $\nu$ and $\upsilon$ photons per packet respectively.). Naturally, information leakage in single photon emission is decided according to the security proof, and then decoy-state method is straight-forward provided the phase randomized weak coherent source is employed. Then, the first phase modulator (PM1) adds phase $-\pi/2$ or $\pi/2$ on each pulse to encode the key bits, PM2 randomize the global phase of each packet. Finally, a large attenuation is added on these encoded pulses by a variable optical attenuator (VOA). Alice’s output quantum state of each packet is $\left|\psi_{jk}^{\pm}\right\rangle$.

At Bob’s site, the passive scheme based on a $1\times 3$ beam splitter (BS) is used to implement a high-speed, stable, and low-loss decoding measurement. Following the passive measurement-delay choice, three unbalanced Faraday-Michelson interferometers (FMI) with $\Delta=k-j\in\{1,2,3\}$ temporal delays are employed to make the $j$th pulse interfere with $k$th pulse. One three-port optical circulator (CIR), one $50:50$ BS and two Faraday mirrors (FM) constitute a FMI, whose two output ports are connected to two channels of one single photon detector (SPD), respectively. There are totally three double-channel SPDs, and all detection events are recorded by a time-to-digital convertor (TDC) that records the time-tagged and which-channel information. (In principle, we should add a narrow-bandwidth filter in Bob’s side to prevent wavelength-dependent beam-splitter attack Li et al. (2011). But as we are in effect uisng a monochromatic laser source, we decided not to do so in this demonstrative experiment to simply matter.)

Compared to the active scheme, the passive approach of the variable-delay interferometer with three delay values can be characterized as follows: (i) Highspeed, the passive choice among three 1\ns, 2\ns and 3\ns delay FMIs has no speed limits in principle Wang et al. (2015); (ii) Stable, three FMIs are insensitive to polarization variations, and also independent, so we can actively and independently compensate the phase shift of each interferometer, which is placed in small and separate ABS plastic case and on heating plate to keep its temperature a little above the environment temperature. Each interferometer is individually stabilized by controlling the current of corresponding heating plate, the feedback signals include counts of SPD when only IM1 works and error rate during key distribution procedure; (iii) Low-loss, the insertion loss (IL) of each FMI depends on ILs of the CIR, BS, and FM, so the ILs of these three FMIs are almost identical, and approximate to be $0.80$ dB. Nevertheless, we have to point out that the passive approach needs more SPDs, and also cannot implement bias basis choices as easily as the active scheme.

Albeit the present implementation shares the same key rate formula with the six-state QKD protocol, they have its own features experimentally. The main advantage of the present scheme lies in its less demand for phase encoding. In fact, a main drawback of a time-phase coding six-state system is that Alice must module her phase modulator with four phases [math], $\pi/2$, $\pi$ and $3\pi/2$, but our scheme only needs $-\pi/2$ and $\pi/2$ phases. Two-phase modulation and $V_{\pi}$ peak-to-peak voltage facilitate the realization of high speed QKD, since four-phase modulation is more complex than two-phase modulation and $V_{3\pi/2}$ peak-to-peak voltage is higher than $V_{\pi}$. In a word, CWW174 has a simple phase-coding device, thus is particularly significant for practical QKD networks.

For each SPD, both channels are based on InGaAs/InP avalanche photodiodes (APD), and operated in gated Geiger mode with sine-wave filtering method Walenta et al. (2012). The two output ports of each FMI are different, the output port from the 3rd port of CIR includes about additional 0.40\dB IL compared to the other one, which is connected to the channel of the corresponding SPD with lower detection efficiency. In order to achieve optimal performances and low error rate, we first add a width discriminator to remove the wider filtered avalanche signals in each channel of SPD He et al. (2017), and then set the measurement time window to 800\ps in TDC for all SPDs. The average detection efficiency, dark count rate, and after-pulse probability of these three double-channel SPDs is approximately $20.23\%$, $2.58\times 10^{-6}$ per gate, and $1.05\%$, respectively. Here, the IL of CIR from the 2nd port to the 3rd port and the reduction effect by setting measurement time window have been included in the detection efficiency, the dark count rate of one SPD is the sum value of both channels.

The experimental results using standard telecom fiber channels of length l=50\km are listed in Table 1. The universal squash model Fung et al. (2011) is applicable to our experimental setup; and we used the data processing procedure there to handle events with multiple detector click. Actually, these events contribute to no more than 0.003% of the raw key, which has negligible effect on the secret key rate. The BER and DER of the raw key are $(0.216\%+1.81\%)/2+0.217\%=1.23\%$ and $0.216\%+1.81\%+0.217\%=2.24\%$, respectively. With the data given in Table 1, we calculate the corresponding parameters for single photon emission through standard decoy states formulas Lim et al. (2014), which are $Y_{1}=8.38\times 10^{-3}$, $e^{1}_{1}=e^{3}_{1}=0.21\%$ and $e^{2}_{1}=1.9\%$. According to Eq. (1), the secret key rate is $R=7.31\times 10^{-4}$ per packet for the original CWW174 scheme.

To verify the high error tolerance of the proposed protocol, we intentionally lower the optical interference to result in high $E^{2}$, which are listed in the brackets in Table 1. We find that positive secret key rate is achieved even when $E^{2}$ equals $15.1\%$ (which means 7.88% BER and 15.5% DER). As a comparison, let us consider a BB84 experiment with the same experimental conditions of ours. More precisely, we consider a BB84 experiment in time-bin representation in phase encoding and that we intentionally lower the optical interference through the same optical mis-alignment. Clearly, $E_{\text{BB84}}$ in this setup is $E^{2}$. Besides, using the decoy state formulas in Ref. Lim et al. (2014), we arrive at $Y_{1}=8.38\times 10^{-3}$, $e_{1}=20.5\%$. Hence, it is impossible for the BB84 scheme to generate a secure key using this setup. This example, therefore, shows the advantage of the CWW174 scheme over BB84.

To compare our experiment with the recent experiment by Islam et al. Islam et al. (2017), we remark that their experiment aimed at producing the highest possible secret key rate (measured in unit of secret bit per second rather than per packet). That is why they applied a strong bias of $90\%$ in choosing the computational (that is, the time-bin) basis. Besides, they sent photons about 10 times faster than we do; and they optimized the decoy intensities and probabilites of using different decoys (though they did not show these probabilities explicitly, making readers hard to verify their computed secret key rates). Moreover, in order to detect photons in the computational and the Fourier transformed bases, they used 8 photon detectors whereas we only use 3. Using similar commercial fiber with $l=50$ km, their observed DER (for single photon events) is at least $3.73\%$, which is higher than our $2.24\%$. This suggests that the CWW174 scheme may also have an edge in actual experimental setup in terms of noise control.

V Summary

In summary, we show that the CWW174 scheme is not linearly related to the six-state scheme although they share the same one-way key rate. Although these two schemes may be related to each other in some subtle ways, say, due to some hidden symmetry, we believe that it is simply a coincidence that they share the same one-way key rate. We also perform experiments to demonstrate the ease of implementing the CWW174 scheme in time-bin representation over the six-state scheme. Moreover, we show the noise resiliency of the CWW174 scheme over the BB84 scheme by artificially increasing the channel noise to such a level that no secure key can be distilled out from the latter scheme while a secret key can be generated from the former one though at a very low rate.

Last but not least, one may consider the following reduced CWW174 scheme. Instead of using a total of 12 states — four states from each of the three basis, Alice and Bob may use the following three pairs of states each chosen from a basis: $(|0\rangle\pm|1\rangle)/\sqrt{2}$, $(|0\rangle\pm|2\rangle)/\sqrt{2}$ and $(|0\rangle\pm|3\rangle)/\sqrt{2}$. That is to say, Alice randomly prepares these states and Bob randomly measures them in one of the three bases. Instead of two bits, they get one bit per transmitted four-dimensional qudit that is prepared and measured in the same basis. Furthermore, they reject the qudit if the measured state does not belong to the two-dimensional Hilbert subspace used in the state preparation. Using the argument in Ref. Chau et al. (2017a), it is not difficult to show that the one-way key rate of this modified scheme is less than or equal to half that of the six-state scheme, with equality holds if none of the qudits is rejected. (The factor of half in the key rate comes from the fact that Alice and Bob use four-dimensional qudits instead of qubits in transmitting quantum information in the channel.) By considering all other possibilities, we see that out of the possible reduced CWW174 schemes that uses a pair of quantum state per basis, the above one already gives the highest one-way key rate. In this regard, we conclude that the CWW174 scheme, which uses four-dimensional qudits in 12 states that associate with three different bases is the minimalist round-robin differential-phase-shift-type of scheme that achieves the one-way key rate of the six-state scheme with the least number of states and Hilbert space dimension. This analysis shows the advantage of obtaining more than one bit of raw key per channel use. However, in practice, the performance of the proposed protocol may be not so strong, since there may be more noises introduced in the detection process Zhang et al. (2017).

Appendix A Secret key rate of the SS104 scheme with unbiased basis selection for ideal apparatus and photon source in the infinite raw key length limit

One way to see this is that just like the BB84 scheme, the key rate of the SS104 scheme equals $R=(2-H_{\text{spin}}-H_{\text{phase}})/(2\times 2)$ where $H_{\text{spin}}$ and $H_{\text{phase}}$ are the entropies of the spin flip and phase errors of the raw key, respectively. In addition, the first and the second $2$ in the denominator are due to the conversion of a four-dimensional dit to a bit and the use of two bases with equal probabilities, respectively. For the unbiased protocol using both computational and Fourier transformed states to generate the sifted key, $H_{\text{spin}}=H_{\text{phase}}$ in the worst case scenario. Therefore, $R=(1-H_{\text{spin}})/2$. When using the DER as the figure of merit, the worst case situation occurs when $H_{\text{spin}}=H_{2}(1-3e/2,e/2,e/2,e/2)$ where $e$ is the BER of the raw key (and hence the DER of the raw key equals $3e/2$). Consequently, the secret key rate is $1.5$ times that of the six-state scheme. In contrast, if the BER is used as the figure of merit, the worst case situation occurs when $H_{\text{spin}}=2H_{2}(1-e,e)$. This gives the BB84 key rate.

Appendix B Proof of the unitary non-equivalence between the six-state scheme and the CWW174 scheme

Theorem 1**.**

The six-state and the CWW174 schemes are not linearly related in the sense that for any $m,n>0$, there is no monomorphism imbedding every normalized preparation state of the $m$ qubits for the six-state scheme to those of the $n$ qudits for the CWW174 scheme and vice versa.

Proof.

The following three observations are needed. First, no complex numbers $a,b$ satisfy $|a|=|b|=|a\pm b|/\sqrt{2}=|a\pm ib|\sqrt{2}$. Second, all normalized $n$ qudit preparation states in the CWW174 scheme can be written in the form \sum_{j_{1},\ldots,j_{n}=0}^{3}\alpha_{j_{1},\ldots,j_{n}}\mbox{\left|j_{1},\ldots,j_{n}\right\rangle} with exactly $2^{n}$ non-zero $\alpha_{j_{1},\ldots,j_{n}}$’s each with the same magnitude of $2^{-n/2}$. Third, all normalized $m$ qubit preparation states in the six-state scheme can be written in the form \sum_{k_{1},\ldots,k_{m}=0}^{1}\beta_{k_{1},\ldots,k_{m}}\mbox{\left|k_{1},\ldots,k_{m}\right\rangle} with $2^{\ell}$ non-zero $\beta_{k_{1},\ldots,k_{m}}$’s, each with the same magnitude of $2^{-\ell/2}$ for some $\ell\geqslant 0$.

Now suppose the contrary that there is an injective linear operator $L$ sending normalized preparation states of the $m$ qubit six-state scheme to the normalized $n$ qudit CWW174 scheme. We consider only the case of $m=1$ here as the general case can be proven in the same way. Applying the first two observations to L\mbox{\left|\varphi\right\rangle}, where $\left|\varphi\right\rangle$ is one of the preparation states in the six-state scheme, we conclude that \mbox{\left\langle j_{1},\ldots,j_{n}\right|}L\mbox{\left|0\right\rangle}=0 whenever \mbox{\left\langle j_{1},\ldots,j_{n}\right|}L\mbox{\left|1\right\rangle}\neq 0. However, this means L(\mbox{\left|0\right\rangle}+\mbox{\left|1\right\rangle})/\sqrt{2} has to be a sum of $2^{n+1}$ rather than $2^{n}$ non-zero terms over the basis ${\mathcal{B}}_{4}^{\otimes n}$, which contradicts the second observation.

Suppose there is an injective linear operator $L^{\prime}$ sending normalized preparation states of the $n$ qudit CWW174 scheme to the normalized $m$ qubit six-state scheme. By the Hilbert space dimension consideration, we know that $m\geqslant 2n$. Again, we consider only the case of $n=1$ for the general case can be proven in the same way. We may assume that L^{\prime}\mbox{\left|\psi_{01}^{+}\right\rangle}=\mbox{\left|0\right\rangle}^{\otimes m}. (Otherwise, we simply amend a unitary transformation on the $m$ qubits after $L^{\prime}$ to make it so.) Consider L^{\prime}\mbox{\left|\psi_{12}^{-}\right\rangle}=\mbox{\left|0\right\rangle}^{\otimes m}-L^{\prime}\mbox{\left|\psi_{02}^{+}\right\rangle} and hence \mbox{\left\langle 0,\ldots,0\right|}L^{\prime}\mbox{\left|\psi_{12}^{-}\right\rangle}+\mbox{\left\langle 0,\ldots,0\right|}L^{\prime}\mbox{\left|\psi_{02}^{+}\right\rangle}=1. From observation three, this is possible only if L^{\prime}\mbox{\left|\psi_{02}^{+}\right\rangle} can be expressed as a sum of two non-zero terms over the basis ${\mathcal{B}}_{2}^{\otimes m}$, say, \mbox{\left|0\right\rangle}^{\otimes(m-1)}\otimes(\mbox{\left|0\right\rangle}+\mbox{\left|1\right\rangle})/\sqrt{2}. The same argument plus the injectivity of $L^{\prime}$ lead to L^{\prime}\mbox{\left|\psi_{03}^{+}\right\rangle}=\mbox{\left|0\right\rangle}^{\otimes(m-2)}\otimes(\mbox{\left|0\right\rangle}+\mbox{\left|1\right\rangle})\otimes\mbox{\left|0\right\rangle}/\sqrt{2}, say. However, this implies L^{\prime}\mbox{\left|\psi_{23}^{-}\right\rangle}=\mbox{\left|0\right\rangle}^{\otimes(m-2)}\otimes(\mbox{\left|0\right\rangle}\otimes\mbox{\left|1\right\rangle}-\mbox{\left|1\right\rangle}\otimes\mbox{\left|0\right\rangle})/\sqrt{2}, which is not a preparation state of the $m$ qubit six-state scheme. Hence, $L^{\prime}$ does not exist; and this completes our proof. ∎

We remark on passing that using the same idea in the above proof, there is no monomorphism imbedding every normalized preparation state of the $m$ qudits for the SS104 scheme to those of the $n$ qudits for the CWW174 scheme.

Appendix C Detailed derivation of the secret key rate formula for the CWW174 scheme in the infinite raw key length limit as a function of the DER

We need to minimize the second term in Eq. (1), which can be rewritten as

[TABLE]

where $\Omega=\sum_{g=0}^{3}\Omega^{g}=Y_{1}\mu\exp(-\mu)/Q_{\mu}$. Clearly, the maximum in the above equation is attained when $e_{12}=e_{13}$. Combined with the sum rule $e_{00}+9e_{01}+3e_{12}+3e_{13}=1$ and the expression for the DER $e^{*}=6e_{01}+3e_{12}+3e_{13}$, the $H_{2}(\{e_{jk}\}_{j,k=0}^{3})$ becomes a function of $e^{*}$, $e_{01}$ only. By considering $dH_{2}(\{e_{jk}\}_{j,k=0}^{3})/de_{01}$ and $d^{2}H_{2}(\{e_{jk}\}_{j,k=0}^{3})/de_{01}^{2}$, it is easy to see that $H_{2}(\{e_{jk}\}_{j,k=0}^{3})$ is maximized when

[TABLE]

in the domain $[0,e^{*}/6]$. As $f(0)<0$, $f(e^{*}/6)>0$ and $df/de_{01}>0$ for $e_{01}\in[0,e^{*}/6]$, there is an unique root for $f$ in the domain $[0,e^{*}/6]$. Substituting this root back to $H_{2}$ maximizes it; and hence we obtain the secret key rate through Eq. (1).

Acknowledgements.

H.F.C. is supported by the Research Grant Council of the HKSAR Government (Grant No. 17304716). Other authors are supported by the National Key Research And Development Program of China (Grant No.2016YFA0302600), the National Natural Science Foundation of China (Grant Nos. 61822115, 61775207, 61622506, 61627820, 61575183), and the Anhui Initiative in Quantum Information Technologies.