title: Tomography-based Quantum Key Distribution
authors: Yongtao Zhan Hoi-Kwong Lo
text: 
  
  
  Department of Electrical and Computer Engineering, University of Toronto, Toronto, Ontario, M5S 3G4, Canada
  
  
  hklo@ece.utoronto.ca
  Department of Electrical and Computer Engineering, University of Toronto, Toronto, Ontario, M5S 3G4, Canada
  Department of Physics, University of Hong Kong, Pokfulam, Hong Kong
  
  
  
  
  
  It has previously been shown that quantum state tomography can be used to increase the key rate of quantum key distribution (QKD) for the special case of qubits (i.e., d=2). Here, we consider the case of higher dimensions, i.e., qudits, and show that, for a prime number d>2, quantum state tomography can also improve the key rate of d-dimensional qudit-based QKD schemes, compared to the standard (d+1)-basis protocol. We apply our results to previous QKD experiment based on OAM (orbital angular momentum) encoding and demonstrate the advantage of tomography-based QKD protocols. Moreover, we compare the key rate of tomography-based QKD protocol with reference-frame-independent QKD protocol. We show that, for a rotation channel, the two protocols give the same key rate. However, for any other channels, tomography-based QKD protocol always gives a higher key rate than reference-frame-independent QKD protocol. 
  
  
  
  
                                
  Tomography-based Quantum Key Distribution
      Hoi-Kwong Lo
      December 30, 2023
  =========================================
  
  
  
  
  
  
  § INTRODUCTION
  
  Quantum key distribution(QKD) offers a scheme for unconditionally secure communication. The most renown QKD protocols are BB84 protocol<cit.> and six-state protocol<cit.>. In these protocols, Alice prepare photon in conjugate basis and send it to Bob. Bob randomly select one of the conjugate basis to measure the received state. After that, they pick up the measurement results that they use the same basis, producing a shared random key. Although these protocols are secure theoretically, the gap between theory and experiment remains big. For example, quantum channel in real-life applications, usually is the optical fibre or free space, changes the quantum state of the photon during transmission. Many works has been done to improve the key generation rate of QKD in real-life channels. The tomography-based QKD protocol was proposed in Ref.<cit.> to improve the key rate of QKD with accurate channel estimation. In BB84 and the six-state QKD protocols, data that are transmitted and received with mismatched bases are simply thrown away. For this reason, BB84 and the six-state QKD protocols only make use of the matched measurements {σ_iσ_i} and consider diagonal matrix elements in the Bell-basis(σ_is are the Pauli matrices).  In contrast, a tomography-based QKD protocol keeps all the measurements {σ_iσ_j}, thus allows Alice and Bob to work out of the off-diagonal elements too. With the full matrix elements, one can get a higher key rate with a tomography-based QKD protocol (when compared to BB84 and the six-state protocol). Here in this paper, we extend the tomography-based QKD protocol to higher dimensions. We show how to perform quantum process tomography of the channel using the method introduced in Ref.<cit.>. The tomography-based protocol also gives a higher key rate in high dimensional QKD compared to previous ones. The asymptotic key rate bound of the conventional (d+1)-basis protocol is given in Ref.<cit.>, while we show tomography-based protocol can achieve an improvement over their result. By numerical simulating the two protocols in amplitude damping channel, we find the tomography-based protocol can tolerate higher noise. We apply our results to previous QKD experimental data and demonstrate the advantage of tomography-based QKD protocols. Hence tomography-based protocol can be utilized to improve the key rate in future real-life QKD applications.
  
  In Ref.<cit.>, Anthony et. al. proposed the so-called reference-frame-independent(RFI) QKD protocol. Their paper aims to address the problem that the reference frame of Alice(the sender) and Bob(the receiver) may not be well aligned, e.g. the polarization state may change in satellite-to-ground quantum communication due to the rotation of satellite. They showed how to bound the eavesdropper's information using Alice and Bob's measurement results. In this paper, we briefly summarize the two types of QKD protocols and compare them in different quantum channels. We show that the key rate of tomography-based QKD protocol is the same as RFI-QKD protocol in rotation channel. However, for any other channels including realistic optical fibre, the tomography-based QKD protocol gives a higher key rate. We come to the conclusion that the tomography-based protocol is a better choice than RFI-QKD in real-life QKD applications.
  
  
  This paper is organized as follows. In Section.II, we will introduce the tomography-based QKD protocol and present a key rate formula for tomography-based QKD in the qubit case. In Section.III, we extend the tomography-based QKD to high-dimensional case, i.e. qudits, and show its advantage compared to the traditional (d+1)-basis protocol. Then we apply the high-dimensional tomography-based QKD to experiment using previous experimental data in Section.IV. The reference-frame-independent QKD protocol and high-dimensional RFI-QKD are introduced in Section.V and Section.VI. Finally we compare the RFI-QKD and tomography-based QKD in Section.VII.
  
  
  
  § KEY RATE IN TOMOGRAPHY-BASED QKD PROTOCOL
  
  Tomography-based Quantum Key Distribution<cit.> can increase key rate with accurate channel estimation. In this section, we briefly review the protocol of tomography-based QKD and calculate the key rate of the tomography-based six-state protocol. In six-state protocol, Alice randomly sends the bit 0 or 1 to Bob by modulating it into a transmission basis that is randomly chosen from the z basis(|0_z⟩,|1_z⟩), the x basis(|0_x⟩,|1_x⟩), or the y basis(|0_y⟩,|1_y⟩). In 
  the entanglement-based version, Alice prepares a maximally entangled state |ϕ^+⟩=1/√(2)(|0⟩|0⟩+|1⟩|1⟩) and sends the second qubit to Bob. The qubit channel ℰ_B between Alice and Bob can be described by the affine map as follows <cit.>
  
      [[ θ_z; θ_x; θ_y ]] ↦[[ R_z z R_z x R_z y; R_x z R_x x R_x y; R_y z R_y x R_y y ]][[ θ_z; θ_x; θ_y ]]+[[ t_z; t_x; t_y ]]
      
  where (θ_z,θ_x,θ_y) describes a vector in the Bloch sphere. This vector represents the state of a single qubit ρ=1/2(I+θ_xσ_x+θ_yσ_y+θ_zσ_z) .
  
  For the channel ℰ_B and each pair of bases (a, b) ∈{z, x, y}^2, define the biases of the outputs as
  
      Q_ab0   =⟨ 0_b|ℰ_B(|0_a⟩⟨ 0_a|)| 0_b⟩-⟨ 1_b|ℰ_B(|0_a⟩⟨ 0_a|)| 1_b⟩
       
      Q_ab1   =⟨ 1_b|ℰ_B(|1_a⟩⟨ 1_a|)| 1_b⟩-⟨ 0_b|ℰ_B(|1_a⟩⟨ 1_a|)| 0_b⟩
  
  then the parameters of the channel in Eq.(<ref>) can be written as
  
      R_ba=1/2(Q_ab0+Q_ab1), t_b=1/2(Q_ab0-Q_ab1)
  
  
  After Alice send the qubit to Bob, their joint state ρ_AB can be written as:  
  
  ρ_AB=(id⊗ℰ_B)|ϕ^+⟩⟨ϕ^+| (id⊗ℰ_B^†)=
  
  
  
  
      1/4[[                 1+R_z z+t_z     R_x z+t_x+𝐢 R_y z+𝐢 t_y               R_z x-𝐢 R_z y R_x x+R_y y+i R_y x-𝐢 R_x y;     R_x z+t_x-𝐢 R_y z-𝐢 t_y                 1-R_z z-t_z R_x x-R_y y-𝐢 R_y x-𝐢 R_x y              -R_z x+i R_z y;               R_z x+𝐢 R_z y R_x x-R_y y+𝐢 R_y x+𝐢 R_x z                  1-R_zz+t_z     -R_x y+t_x-𝐢 R_y z+𝐢t_y; R_x x+R_y y-𝐢 R_y x+𝐢 R_x y              -R_z x-𝐢 R_z y     -R_x z+t_x+𝐢 R_y z-𝐢t_y                 1+R_z z-t_z ]]
  
  
  
  That means, by analyzing the full probability distribution of their measurement results, Alice and Bob can have the full information of the channel. We treat only Alice's bit transmitted in z basis and corresponding Bob's bit sequence received in σ_z measurement. In this tomography-based QKD protocol, the key rate of direct reconciliation is <cit.>
  
      r_QST=I_ρ(X|Y)-χ_ρ(X:E)
  
  where I_ρ(X|Y) is the mutual information between Alice and Bob, and χ_ρ(X:E) denotes the Holevo quantity between Alice and Eve.
  
  Here we give an explicit form of the Devetak-Winter rate in Eq.(<ref>) as an function of ρ_AB:
  
      I_ρ_AB(X|Y)=1+∑_i=1^4δ_i log_2δ_i+h(δ_1+δ_3)
  
  
      χ_ρ_AB(X:E)=S(ρ_AB)-1/2S(_A⟨ 0|ρ_AB|0 ⟩_A)-1/2S(_A⟨ 1|ρ_AB|1 ⟩_A)
  
  
      r_QST=   I_ρ_AB(X|Y)-χ_ρ_AB(X:E)
      
          =   1+∑_i=1^4δ_i log_2δ_i+h(δ_1+δ_3) 
         -S(ρ_AB)+1/2S(_A⟨ 0|ρ_AB|0 ⟩_A)+1/2S(_A⟨ 1|ρ_AB|1 ⟩_A)
  
  
      
   where δ_is are the diagonal elements of the density matrix in the computational basis.
   
      δ_1   =⟨ 00|ρ_AB|00 ⟩, δ_2=⟨ 01|ρ_AB|01 ⟩, 
      δ_3   =⟨ 10|ρ_AB|10 ⟩, δ_4=⟨ 11|ρ_AB|11 ⟩
  
   
  
  We plug the density matrix in Eq.(<ref>) into Eq.(<ref>) and get the key rate in tomography-based QKD:
  
      r_QST=    1-S(ρ_AB)+∑_i=1^4δ_i log_2δ_i+h(1+t_z/2) 
         +1/2h((1+√((R_zz+t_z)^2+(R_xz+t_x)^2+(R_yz+t_y)^2))/2)
          
         +1/2h((1+√((R_zz-t_z)^2+(R_xz-t_x)^2+(R_yz-t_y)^2))/2)
      
  
  
  § EXTENDING TOMOGRAPHY-BASED QKD PROTOCOL TO HIGH DIMENSIONS
  
  
  
   §.§ Security of high dimensional QKD
  
  Traditional QKD protocols are based on two level systems, or qubits. Some QKD protocols using higher-dimensional quantum systems(or qudits) have been proposed. These qudit-based protocols can achieve higher key rates and security tolerance to noise<cit.>.
  
  There are two main families of high dimensional QKD protocols.  The first protocol is (d+1)-basis protocol, which is the generalization of six-state protocol. In this protocol, Alice and Bob choose one of (d+1) mutually unbiased basis(MUB) in d-dimensional Hilbert space to send and measure the state independently. Then they compare the basis they use and keep the measurement results that they use the same basis. The second is two-basis protocol, which is the generalization of BB84 protocol. It is similar to the (d+1)-basis protocol except for Alice and Bob using two MUBs to encode the information instead of (d+1) MUBs.  For simplicity we only focus on the (d+1)-basis protocol here.
  
  Here we briefly introduce the concept of MUB. Two orthonormal basis ℳ_1={|ϕ_(1, i)⟩, i=0,1, …, d-1} and  ℳ_2={|ϕ_(2, j)⟩, j=0,1, …, d-1} of a d-dimensional Hilbert space ℋ_d are said to be mutually unbiased if and only if all pairs of basis vector satisfy
  
      |⟨ϕ_(1, i) | ϕ_(2, j)⟩|^2=1/d
  
  
  Physically, this means if a state in ℳ_1 is measured with respect to ℳ_2, all outcomes are equal probable.  This property makes them important for QKD protocols. Wootters and Fields<cit.> proved that the number of MUBs one may find for any dimension d is at most (d+1) and the (d+1) MUBs do exist whenever d is a power of a prime. So our discussion is restricted to the cases that the dimension d is a prime power.
  
  The security of high dimensional QKD based on MUBs is analyzed in Ref.<cit.>. Here we briefly summarize their results. The MUBs in their  QKD protocol are chosen to be eigenbasis of Weyl operators U_jk. The Weyl operators are generalization of Pauli operators and are defined by U_j k=∑_s=0^d-1ω^s k|s+j⟩⟨ s|  for j,k∈{0,1,2,...,d-1} and ω is the d-th root of unity. The choice of (d+1) MUBs are the eigenbasis of  {U_01,U_1k:k∈[0,d-1]}. In the (d+1)-basis protocol, Alice and Bob choose one of the (d+1) MUBs to send and measure the state. After they get their raw keys, they can estimate the error vectors
  
      q_j k={q_j k^(0), q_j k^(1), …, q_j k^(d-1)}
  
  where q_j k^(t)=Prob(a-b=t  d | j, k) is the probability that Alice's outcome a and Bob's outcome b differed by t, modulo by d, when the basis of U_jk is chosen by both. We note that q^(0)_jk is the probability that Alice and Bob's measurement result matches.
  
  They construct the density matrix of Alice and Bob's joint state  with the estimated error vectors. The density matrix is diagonal in the generalized Bell basis<cit.>.
  
      ρ'=∑_j,k=0^d-1λ_jk|Φ_jk⟩⟨Φ_jk|
  
  The generalized Bell basis are given by |Φ_j k⟩=∑_s=0^d-1ω^s k|s  s+j⟩=𝕀⊗ U_j k | Φ_00⟩. The eigenvalues λ_jk are given in Eq.(4) in Ref.<cit.>, expressed by the estimated error vectors
  
  
  
      λ_j k=1/d(∑_s q_1 s^(s j-k  d)+q_01^(j)-1)
  
  
  
  Although the Bell diagonal mixture may not be the real joint state, it produces the same statistics for Alice's and Bob's measurements. We can suppose without loss of generality that Alice and Bob rather receive the state described in Eq.(<ref>).
  
  The asymptotic key rate of (d+1)-basis QKD protocol is also given in Ref.<cit.>. For asymptotic bounds, We can assume that only one basis is used for generate keys and is chosen almost always, while the other basis are chosen with negligible probability and used to bound the eavesdropper's information. In Ref.<cit.>, They choose the key basis to be the one of U_01. The Devetak-Winter rate is 
  
      r_∞=I(A:B)-χ(A:E)
  
  We can easily get the mutual information is I(A:B)=log_2d-H(q_01). In Ref.<cit.> they get Eve's information
  
      χ(A: E)=H(λ)-H(q_01)
  
  where λ={λ_jk} for j,k∈[0,d-1] are the eigenvalues of the density matrix ρ_AB.
  
  
  
   §.§ High Dimensional Tomography-based QKD
  
  
  In entanglement-based high dimensional QKD protocol, Alice prepare a d-dimensional entangled state |Φ_00⟩=1/√(d)∑_i=0^d-1 |i⟩_A |i⟩_B and send one of the qudit to Bob. After Bob receive the qudit, they randomly choose one of (d+1) mutual unbiased projectors(MUB-projectors) to measure the state. The set of MUB-projectors is given by
  
      𝒫_m^(γ)=|ψ_m^(γ)⟩⟨ψ_m^(γ)|, m=1, …, d, γ=0, …, d
  
  where γ labels one of the (d+1) families of MUBs and m denotes one of the orthogonal state in this family. Instead of only keeping the measurement results that they use the same basis, they use all the results to perform quantum channel tomography. 
  
  
  Here we use the method introduced in Ref.<cit.> to perform quantum process reconstruction. We consider the quantum channel as a general evolution of the qudit described by a completely positive linear map:
  
      ℰ(ρ)=∑_i A_iρ A_i^†
  
  Here ρ is the state that Alice sends to Bob and A_is are the Kraus operators. We use the overcomplete basis of (d^2+d) MUB-projectors to expand the Kraus operators:
  
  
      A_i=∑_α=0^d∑_m=1^d a_i m^(α)𝒫_m^(α)
  
  Then the complete linear map ℰ(ρ) of the quantum channel can be expressed in the following manner:
  
  
      ℰ(ρ)=∑_α, β=0^d∑_m, n=1^dχ_m n^(α, β)𝒫_m^(α)ρ𝒫_n^(β)
  
  where χ_m n^(α, β)≡∑_i a_i m^(α) a_i n^(β) * is the process matrix. This equation is Eq.(6) in Ref.<cit.>. We can do full tomography of the quantum channel by determining all elements of the process matrix. Next we show how Alice and Bob perform quantum channel tomography with their measurement results.
  
  
  We consider the full probability distribution of Alice's and Bob's data. The probability of Alice and Bob choosing each family of MUBs is 1/(d+1). If Alice choose the l-th family and Bob choose the s-th family, the probability of Alice getting |ψ_l^(γ)⟩ and Bob getting |ψ_s^(η)⟩  is 
  
  
      p_η s^(γ, l)   =Tr(ℰ(ρ)𝒫_s^(η))
         =∑_α, β=0^d∑_m, n=1^dχ_m n^(α, β)Tr(𝒫_m^(α)𝒫_l^(γ)𝒫_n^(β)𝒫_s^(η))
  
  This equation is Eq.(11) in Ref.<cit.>. Alice and Bob can provide a good estimation of p_η s^(γ, l) using their measurement results. There are d^2(d+1)^2 unknown elements χ_m n^(α, β) and d^2(d+1)^2 linear equations in total. By solving these linear equations, they can reconstruct the quantum channel.
  
  After Alice and Bob reconstruct the quantum channel, they can find all the elements of the density matrix of their joint state ρ_AB.
  
      ρ=∑_j,k,m,n=0^d-1ρ_jk^mn |Φ_jk⟩⟨Φ_mn|
  
  The matrix elements ρ_jk^mn are given by ρ_jk^mn=∑_i ⟨Φ_jk|(𝕀⊗ A_i)|Φ_00⟩⟨Φ_00|(𝕀⊗ A_i^†)|Φ_mn⟩.
  They can estimate Eve's information and perform postprocessing of their raw key in a similar way as the original tomography-based protocol<cit.>. 
  
  
  
  
   §.§ Asymptotic key rate of High Dimensional Tomography-based QKD
  
  Alice and Bob can reconstruct the quantum state ρ they share through quantum channel tomography. Similar to the two dimensional case in Section.II, we can calculate the asymptotic key rate of high dimensional tomography-based QKD. The classical mutual information and the Holevo quantity are
  
      I_ρ=log_2d+∑_i,j=0^d-1δ_ij log_2δ_ij+H(δ)
  
  
      χ_ρ=S(ρ)-1/d∑_i=0^d-1S(_A⟨ i|ρ|i ⟩_A)
  
  where δ_ij are the diagonal elements of ρ in the computational basis
  
      δ_ij=⟨ ij|ρ|ij ⟩
  
  and δ={∑_j=1^dδ_ij} for i∈[0,d-1]. Once we get the mutual information and the Holevo quantity, we can calculate the key rate using the Devetak-Winter rate formula.
  
  
  
   §.§ Comparison of tomography-based protocol and (d+1)-basis protocol
  
  In conventional (d+1)-basis protocol, Alice and Bob can find out the diagonal elements of the density matrix in generalized Bell basis.  However, in tomography-based protocol, they can perform quantum channel tomography and find out all the elements of the density matrix. With the full information of their quantum state, they can make a better estimation of Eve's information compared to conventional (d+1)-basis protocol, thus improving the key rate.
  
  In tomography-based QKD protocol, Eve's information is quantified by the Holevo quantity χ_ρ, which is given in Eq.(<ref>) in previous section. In (d+1)-basis protocol, Eve's information is
  
  
      χ_ρ'=S(ρ')-1/d∑_i=0^d-1S(_A⟨ i|ρ'|i ⟩_A)
  
  
  We can prove that
  
      χ_ρ≤χ_ρ'
  
  
  The classical mutual information I(A:B) are the same for both protocols. So we come to the conclusion that the tomography-based protocol gives a higher key rate than the (d+1)-basis protocol.
  
   Here we compare the tomography-based protocol and conventional (d+1)-basis protocol in three dimensional amplitude damping channel as an example. The amplitude damping channel is a model describing the decay process of multi-level atoms<cit.>. It can be described by a completely positive linear map in Eq.(<ref>). The superoperators are<cit.>
  
      [ A_0=|0⟩⟨ 0|+√(1-α)| 1⟩⟨ 1|+(1-α)| 2⟩⟨ 2|;      A_1=√(α)|0⟩⟨ 1|+√(2 α(1-α))| 1⟩⟨ 2|;                             A_2=α|0⟩⟨ 2| ]
  
  
  parametrized by a real parameter 0≤α≤ 1.
  
  We calculate the asymptotic key rates for tomography-based protocol and conventional (d+1)-basis protocol using the schemes described in Section.III.A and Section.III.C. The explicit formulas are very complicate so I don't present them here. The key rates of both protocols are plotted in Figure.1. We find the key rate of  tomography-based protocol is always higher than the conventional (d+1)-basis protocol. 
  
  
  
  
  
  
  § HIGH DIMENSIONAL TOMOGRAPHY-BASED QKD IN EXPERIMENT
  
  There are multiple experimental implementation of RFI-QKD<cit.>. However, to our knowledge, the tomography-based QKD protocol hasn't been implemented yet. Here we try to demonstrate the high dimensional tomography-based QKD in experiment.
  
  In Ref.<cit.> the authors present an experimental study of higher-dimensional quantum key distribution protocols based on mutually unbiased bases. The qudits are realized by the orbital angular momentum state of photons. They perform (d + 1) mutually unbiased measurements on a pair of entangled photons for dimensions ranging from d =2 to 5. For simplicity we only focus on d=3 case in this paper.  In the high dimensional QKD protocol, the probability of Alice and Bob choosing each family of MUBs is 1/(d+1). If Alice choose the l-th family and Bob choose the s-th family, the probability of Alice getting |ψ_l^(γ)⟩ and Bob getting |ψ_s^(η)⟩  is p_η s^(γ, l) in Eq.(<ref>). In d=3 case, the full probability distribution of Alice's and Bob's data p_η s^(γ, l) is a 12×12 matrix. They measured the matrix in experiment and their result is depicted in Figure.2. We note that the diagonal elements are approximately equal to 1/3 and the elements corresponding
  to different bases are found to be approximately 1/9. That corresponds to the property of MUBs which we mentioned in Section.III.A .Figure.3 contains their measured secret key rate in the experiment. Then they made a comparison between their experimental data and theoretical key rate in the qudit depolarizing channel. We note that it is only a coincidence that the measured results seems fit precisely the theory curve in d=3 case. They did the QKD experiment in d=2,3,4,5 cases and the measured results fit not very well with the theory curve when d=2,4,5. 
  
  In fact, we can apply the tomography-based protocol with the full probability distribution of Alice's and Bob's data. Using the schemes described in Section.III.A, we can perform quantum channel tomography based on MUBs. Based on the equations in Section.III.C, we then calculate the key rate of tomography-based protocol, which was contained in Figure.3. We find the tomography-based protocol yields a higher key rate than conventional (d+1)-basis protocol.
  
  
  
   
  
  
  § KEY RATE IN RFI-QKD PROTOCOL[3]
  
  In this section, we briefly review the RFI-QKD protocol which was introduced in Ref.<cit.>. In the RFI-QKD protocol, we assume one of the three directions is well aligned and the other two directions are rotating dependent of time. Take satellite-to-ground QKD as an example. Vertical and horizontal polarization state may vary in time because of the rotation of the satellite but the circular state is stable. For the well-aligned direction we set Z_A=Z_B. The other two directions are related by X_B=cosβ X_A + sinβ Y_A and Y_B=cosβ Y_A-sinβ X_A and β may change in time. We assume that the frames are varying very slowly that Alice and Bob can collect enough signals to create a key above the finite-size effect in a time interval that β does not vary too much. In this protocol we consider the worst-case scenario that the two directions are fixed and known to Eve. In each run, Alice prepares a maximally entangled state |ϕ^+ ⟩ and sends the second qubit to Bob. We assume that Alice and Bob only use the Z basis to generate the key. So the quantum bit error rate(QBER) is given by
  
      Q=1-⟨ Z_A Z_B⟩/2
  
  Alice and Bob use another quantity to bound Eve's knowledge, which reads
  
      C=⟨ X_A X_B⟩^2+⟨ X_A Y_B⟩^2+⟨ Y_A X_B⟩^2+⟨ Y_A Y_B⟩^2
  
  
  We note that C is invariant under the transformation X_A  → -X_A, Y_A  → -Y_A, X_B  → -X_B and Y_B  → -Y_B. In the presence of such a symmetry, we can replace ρ_AB by ρ̃_AB=1/2(ρ_AB+Z_AZ_Bρ_AB Z_AZ_B), so we have
  
      ρ̃_A B=   μ_1 P_Φ^++μ_2 P_Φ^-+(a/2|Φ^-⟩⟨Φ^+|+H.c.) 
         +μ_3 P_Ψ^++μ_4 P_Ψ^-+(b/2|Ψ^-⟩⟨Ψ^+|+H.c.)
  
  where P_ψ=|ψ⟩⟨ψ| and the four states represent the Bell basis. For convenience of notation, let us call this state ρ(a,b), we find C and Q are the same for state ρ(-a^*,-b^*). So by the same argument, we can study the mixture ρ_AB'=1/2(ρ(a,b)+ρ(-a^*,-b^*)).
  
  
  
  This state is:
  
      ρ_A B'=   μ_1 P_Φ^++μ_2 P_Φ^-+(Im(a)/2|Φ^-⟩⟨Φ^+|+H.c.) 
         +μ_3 P_Ψ^++μ_4 P_Ψ^-+(Im(b)/2|Ψ^-⟩⟨Ψ^+|+H.c.)
  
  
  
  
  This state can be written as Bell diagonal:
  
      ρ_AB'=∑^4_i=1λ_i'|Φ_i⟩⟨Φ_i|
  
  
  
  
  
  
  
  
  
  Since we only consider collective attacks, the key rate of RFI-QKD protocol can also be calculated using Eq.(<ref>), while the density matrix we are studying is ρ_AB':
  
      r_RFI   =I_ρ_AB'(X|Y)-χ_ρ_AB'(X:E)
         =1-S(ρ_AB')+∑_i=1^4δ_i' log_2δ_i'+h(δ_1'+δ_3') 
         +1/2S(_A⟨ 0|ρ_AB'|0 ⟩_A)+1/2S(_A⟨ 1|ρ_AB'|1 ⟩_A)
  
  where δ_is are the diagonal elements of ρ_AB' in the computational basis. We find the latter four terms in Eq.(<ref>) cancel out, so we have
  
      r_RFI=1-S(ρ_AB')
  
  The two protocols have the same formula of key rate but for different density matrix. In the RFI-QKD protocol, Alice and Bob have less information about their joint state, so intuitively we have
  
      r_QST≥ r_RFI
  
  We will give a rigorous proof of this in the appendix.
  
  
  § EXTENDING RFI-QKD PROTOCOL TO HIGHER DIMENSIONS
  
  
  The original RFI-QKD paper<cit.> also discussed high dimensional RFI-QKD protocols. I didn't make any meaningful progress in this topic, so I just write a brief summary of their results here.
  
  In qubit case, we use the constant C in Eq.(<ref>) to quantify the entanglement and bound Eve's knowledge. Similarly, we can calculate a phase-invariant constant C_d using our measurement result in high dimensional case.
  
  For example, in three-dimensional case, they find
  
      C_3=∑_i=2^4∑_j=2^4 e_i j e_i j^*+∑_i=2^4∑_j=-2^-4 e_i j e_i j^*⩽ 3
  
  where e_ij is defined by 
      e_i j=Tr(τ_i⊗τ_jρ_A B)
  
  and τ_i is the i-th so-called Weyl operators. The maximum value of C_3 is 3, achievable only by two qutrit maximally entangled states.
  In order to calculate the lower bound of the key rate, we have to consider the worst case and do the optimization. However, there is no analytical optimization for high dimensional RFI-QKD protocols.
  
  In practical cases, we recommend the tomography-based protocol rather than the RFI-QKD protocol because we still don't know how to measure the phase invariant C_d in Eq.(<ref>) in experiment because it contains expectation value of non-Hermitian operators and e_ij may not be real, which makes the high dimensional RFI-QKD protocol difficult to implement. The tomography-based protocol not only gives a higher key rate but also has an analytical key rate formula. However, the tomography-based protocol has defect when compared to the conventional (d+1)-basis protocol. Although it gives a higher key rate, it requires more measurements to perform precise channel tomography. It is better to choose the (d+1)-basis protocol when we do not have enough measurement results. For future high-rate QKD applications, we should use the tomography-based protocol instead.
  
  
  
  § COMPARISON OF KEY RATES IN DIFFERENT CHANNELS
  
  
  
   §.§ Amplitude damping channel
  
  The key rates of the above two protocols are multivariable functions which makes it difficult to make a direct comparison. We consider applying the two protocols in amplitude damping channel.
  This channel ℰ_p is given by the affine map parametrized by a real parameter 0≤ p ≤ 1.
  
      [[ θ_z; θ_x; θ_y ]] ↦[[    1-p      0      0;      0 √(1-p)      0;      0      0 √(1-p) ]][[ θ_z; θ_x; θ_y ]]+[[ p; 0; 0 ]]
  
  
  
  
  
  The key rate of tomography-based QKD protocol is given by Ref.<cit.>:
  
      r_QST=1+1/2 h(p)-h(p/2)-1+p/2 h(1/1+p)
  
  We derive the key rate of RFI-QKD protocol, which is:
  
      r_RFI=   1+p/2log_2p/4+2-p-2√(1-p)/4log_22-p-2√(1-p)/4
         +2-p+2√(1-p)/4log_22-p+2√(1-p)/4
  
  which we plotted in Figure.4. Clearly we can see the key rate of tomography-based QKD is higher than RFI-QKD.
  Next we calculated the mutual information between Alice and Bob I(X|Y) and the Holevo quantity between Alice and Eve χ(X:E) in the above two protocols.
  
  For tomography-based QKD:
  
      I_ρ_AB(X|Y)=   1/2+h(1+p/2)+p/2log_2p/2+1-p/2log_21-p/2
      χ_ρ_AB(X:E)=   h(p/2)-1/2h(p)
  
  
  For RFI-QKD:
  
      I_ρ_AB'(X|Y)=   1-h(p/2)
      χ_ρ_AB'(X:E)=   -h(p/2)-p/2log_2p/4
         -2-p-2√(1-p)/4log_22-p-2√(1-p)/4
         -2-p+2√(1-p)/4log_22-p+2√(1-p)/4
  
  We then plot them in Figure.5 for comparison. Clearly we can see I_ρ_AB(X|Y)>I_ρ_AB'(X|Y) and χ_ρ_AB(X:E)<χ_ρ_AB'(X:E) when 0<p<1, which leads to r_QST>r_RFI in amplitude damping channel for the region 0<p<1. In a word, the key rate for QST-based QKD is all strictly higher than that for  RFI-QKD for non-trivial values of p (0<p<1).
  
  
   §.§ Rotation channel
  
  
  
  
  
  In this part we will show that for any unitary rotation channel, the key rate of the two protocols are the same. Since any rotation matrix in three dimensional space can be decomposed as R_n(θ)=R_y(α_y)R_x(α_x)R_z(α_z), where R_n(θ) denotes a rotation by angle θ along the n axis, the general rotation channel can be defined as
  
  
      [[ θ_z; θ_x; θ_y ]] ↦[[  cos α_y -sin α_y        0;  sin α_y  cos α_y        0;        0        0        1 ]]
      [[  cos α_x        0 -sin α_x;        0        1        0;  sin α_x        0  cos α_x ]]
      [[        1        0        0;        0  cos α_z -sin α_z;        0  sin α_z  cos α_z ]]
      [[ θ_z; θ_x; θ_y ]]
  
  
  We plug Eq.(<ref>) into the key rate formula in Section.II and V and get
  
  
      r_QST=r_RFI=1-h(1+cosα_x cosα_y/2)
  
  
  The key rates of the tomography-based QKD and RFI-QKD are the same in this situation. 
  Next we calculate the mutual information between Alice and Bob I(X|Y) of the Holevo quantity between Alice and Eve χ(X:E) of the two protocols. We find
  
      I_ρ_AB'(X|Y)   =I_ρ_AB(X|Y)=1-h(1+cosα_x cosα_y/2)
      χ_ρ_AB'(X:E)   =χ_ρ_AB(X:E)=0
  
  
  The Holevo quantity χ(X:E) is zero in both protocols, which means Eve can not gain any information as the channel applies a unitary rotaion to the transmitted state. This leads to r_QST=r_RFI in Eq.(<ref>).
  Take α_z=0, α_y=0 for an example, this rotation channel was defined as 
  
      [[ θ_z; θ_x; θ_y ]] ↦[[  cos α_x        0 -sin α_x;        0        1        0;  sin α_x        0  cos α_x ]][[ θ_z; θ_x; θ_y ]]
  
  which means the Bloch vector was rotated by α along the x axis. 
  we have 
  
      r_QST=r_RFI=1-h(1+cosα_x/2)
  
  This key rate is plotted in Figure.6.
  
  
  
  
   §.§ Probabilistic rotation channel
  
  Assuming the channel between Alice and Bob rotates the state in a probabilistic way. The probability of rotating the Bloch vector along the x axis or y axis are both 1/2. For simplicity we assume the rotation angles are both α. This channel can be written as
  
      [[ θ_z; θ_x; θ_y ]] ↦1/2[[  2cos α  -sin α  -sin α;   sin α  1+cosα       0;   sin α       0 1+cos α ]][[ θ_z; θ_x; θ_y ]]
  
  In this situation, the entropy of the joint state of Alice and Bob is S(ρ_AB)=h((1-cosα)/4). The key rate of tomography-based QKD and RFI-QKD are calculated as
  
      r_QST=1-h(1-cosα/4)-h(1-cosα/2)+h(1+√((1+cos^2 α)/2)/2)
  
  and 
      r_RFI=1+cos α/2-h(1+cosα/2)
  
  which we plotted in Figure.7. Then we calculated the mutual information I(X|Y) and the Holevo quantity χ(X:E) of the two protocols.
  
  For tomography-based QKD:
  
      I_ρ_AB(X|Y)=   1-h(1-cos α/2)
      χ_ρ_AB(X:E)=   h(1-cos α/4)-h(1-√((1+cos^2α)/2)/2)
  
  
  For RFI-QKD:
  
      I_ρ_AB'(X|Y)=   1-h(1-cos α/2)
      χ_ρ_AB'(X:E)=   1-cos α/2
  
  We then plot them in Figure.8 for comparison. We can see that I_ρ_AB(X|Y)=I_ρ_AB'(X|Y) and χ_ρ_AB(X:E)<χ_ρ_AB'(X:E) when 0<α<π, which lead to r_QST>r_RFI in probabilistic rotation channel for 0<α<π.
  
  
  
  
  
  § COMPARISON IN EXPERIMENT
  
  There are multiple experimental implementation of RFI-QKD<cit.>. However, no QST-QKD experiment has been done yet. The difference of the two protocol is that QST-QKD includes full tomography of the quantum channel while RFI-QKD does not. So if we want to investigate the differences of the two protocols in experimental implementation, we just have to find their differences in dealing with the defects in real life quantum channels(optical fibre).
  
  Photon loss
  
  Usually the channel loss is related to the transmission distance by a loss coefficient β_c in dB/km. The transmittance η is given by 
  
      η=η_B 10^-β_c l/10
  
  where η_B denotes the transmittance on Bob's side. 
  
  The QST-QKD and RFI-QKD protocols are both postprocessing protocols. So the key rate of both protocols are not affected by photon loss. The transmittance of the quantum channel is reduced by η.
  
  Polarization misalignment
  
  Many commonly used fibres are made of birefringent crystals. It is difficult to maintain the polarization in these fibres. As we have analyzed in Section VII.B, RFI-QKD and QST-QKD protocols have the same key rate if the quantum channel applies a unitary rotation to the transmitted qubit.
  
  Polarization stability
  
  Randoms changes of birefringence in optical fibre due to enviromental variations lead to slow random unitary transformations. This random unitary transformations can be described as:
  R(t)=R_y(γ+Δγ(t))R_x(β+Δβ(t))R_z(α+Δα(t)), where
  
      R_y(γ+Δγ(t))=[[  cos (γ+Δγ(t)) -sin (γ+Δγ(t))              0;  sin (γ+Δγ(t))  cos (γ+Δγ(t))              0;              0              0              1 ]]
  
  
      R_x(β+Δβ(t))=[[  cos (β+Δβ(t))              0 -sin (β+Δβ(t));              0              1              0;  sin (β+Δβ(t))              0  cos (β+Δβ(t)) ]]
  
  
      R_z(α+Δα(t))=[[              1              0              0;              0  cos (α+Δα(t)) -sin (α+Δα(t));              0  sin (α+Δα(t))  cos( α+Δα(t)) ]]
  
  The average transformation is
  
      R̅=1/T∫_0^T R_y(γ+Δγ(t))R_x(β+Δβ(t))R_z(α+Δα(t)) dt
  
  This is a generalized version of probabilistic rotation channel, which we have analyzed in part 4.3. We guess that r_QST>r_RFI always holds. 
  
  We take α=β=γ=π/6, Δα∼ N(0,(π/12)^2)(Δα,Δβ,Δγ, i.i.d.) for an example. In this case, r_QST=0.412>r_RFI=0.367.
  
  Polarization mode dispersion(PMD)
  
  For polarization-entangled photon pairs transmitted in optical fibre, PMD is the chief polarization decoherence mechanism<cit.>. Alice prepare the entangled photon pair before sending one of them to Bob. The initial state of the photon pair is:
  
      |ψ⟩=∬ d t_A d t_B f(t_A-t_B)|t_A, t_B⟩⊗|u_A u_B⟩+ |u'_A u'_B⟩/√(2)
  
  
  where u_A(u_B) and u'_A(u'_B) denote the orthonormal basis of the polarization state of photon A(B). We then represent the polarization dependent part in the basis of principal states of the PMD in the two arms.
  
      |ψ_p⟩ =   (|u_A u_B⟩+ |u'_A u'_B⟩)/√(2)
      =   η_1(|s_A, s_B⟩+ e^i α̃_1|s_A^', s_B^'⟩) / √(2)
         +η_2(|s_A, s_B^'⟩- e^i α̃_2|s_A^', s_B⟩) / √(2)
  
  
  where s_A(s_B) and s'_A(s'_B) denote the principle states of polarization along the path of photon A(B). The coefficients are given by
  
      η_1=(s_A·u_A)(s_B·u_B)+(s_A·u_A^')(s_B·u_B^')
         η_2=(s_A·u_A)(s_B^'·u_B)+(s_A·u_A^')(s_B^'·u_B^')
  
  The phase factor α̃_i is defined through  η_i=|η_i| exp (-iα̃_i/2). The final state of two entangled photons after propagating through the media is
  
      |ψ_out ⟩   =η_1/√(2)|f(t_A-t_B-τ_A-τ_B/2)⟩⊗|s_A, s_B⟩
         +η_2/√(2)|f(t_A-t_B-τ_A+τ_B/2)⟩⊗|s_A, s_B^'⟩
         -η_2^* e^i α̃_2/√(2)|f(t_A-t_B+τ_A+τ_B/2)⟩⊗|s_A^', s_B⟩
         +η_1^* e^i α̃_1/√(2)|f(t_A-t_B+τ_A-τ_B/2)⟩⊗|s_A^', s_B^'⟩
  
  The analysis of PMD effect above is given in Ref.<cit.>. Now we consider how PMD effect affects the key rate of quantum communication.
  
  The density matrix of the final state is
  
      ρ_AB=∬ d t_A d t_B |ψ_out⟩⟨ψ_out|
  
  
  Note that the QST-QKD and RFI-QKD protocol have same key rate formula but for different density matrix ρ_AB and ρ_AB'. For the density matrix in Eq.(<ref>), generally ρ_AB≠ρ_AB', which means the key rate for the two protocols are different. The proof of ρ_AB≠ρ_AB' is not given here because the explicit form of ρ_AB is complicated. 
  
  Take a simple case for example. We assume that u_A and u_B are horizontal polarized state, denoted by |0⟩, and u'_A and u'_B are vertical polarized state, denoted by |1⟩. Alice holds her photon and sends another  photon to Bob, i.e. τ_A=0. The principle state of polarization in the optical fibre is slightly shifted from Alice's basis by an angle β, which means:
  
      |s_A⟩=|0⟩
         |s'_A⟩=|1⟩
         |s_B⟩=cos β|0⟩+sin β |1⟩
         |s'_B⟩=-sin β|0⟩+cos β |1⟩
  
  
  
  
  
  
  
  
  
  
             
  
  
  
  We define an autocorrelation function R(τ_B) as R(τ_B)=∫ dt f^*(t)f(t+τ_B) where τ_B is the time difference between signals propagating in different polarization modes. We calculate and depict the key rates of RFI-QKD and QST-QKD protocols as a function of β in Fig.6. The explicit form of the key rates are complicated so we didn't present them here. The result shows that usually r_QST-QKD is higher than r_RFI-QKD, especially when R is small, i.e. the time difference is big.
  
  
  
  Polarization dependent loss(PDL)<cit.>
  
  
  
  
  
  
  
  We assume the transmmittance of |0⟩(|1⟩) is η^0(η^1) in the quantum channel with PDL effect. In the case of that input state is Bell state, the output state is
  
      |Ψ_final⟩=(√(η^0)|00⟩+ √(η^1)|11⟩)/√(η^0+η^1)
  
  The key rate of QST-QKD and RFI-QKD protocols are
  
      r_QST=r_RFI=h(η^0/(η^0+η^1))
  
  The two protocols have the same key rate in quantum channels with PDL effect.
  
  
  § CONCLUSION
  
  In this paper we extend the tomography-based QKD to high dimensional cases. We show how to perform full channel tomography using Alice and Bob's measurement results. Compared to the traditional (d+1)-basis protocol, the high-dimensional tomography-based protocol can achieve higher key rate. We demonstrate that by both theoretical analysis and applying our protocol to previous experimental data.
  
  Then we compare the tomography-based QKD protocol to RFI-QKD protocol. By numerical calculating the two protocols in different channels, we show that the tomography-based QKD protocol is a better choice for real-life QKD implementation for it can achieve higher key rate.
  
  
  § ACKNOWLEDGEMENT
  
  We acknowledge discussions with colleagues including Eli Bourassa and Wenyuan Wang. We thank funding support from NSERC, CFI, ORF, Huawei Technologies Canada, MITACS, US Office of Naval Research, Royal Bank of Canada and the University of Hong Kong start-up grant.
  
  
  
  
  
  
  
  
  
  
  
  
  § APPENDIX
  
  Here we give a rigorous proof of Eq.(<ref>) by showing  I_ρ_AB(X|Y)≥ I_ρ_AB'(X|Y) and χ_ρ_AB(X:E)≤χ_ρ_AB'(X:E).
  
  Proof for I_ρ_AB(X|Y)≥ I_ρ_AB'(X|Y):
  
  
  We have 
  
      I_ρ_AB(X|Y)=h(1+t_z/2)-1/2h(1-R_zz+t_z/2)-1/2h(1+R_zz+t_z/2)
  
  
      I_ρ_AB'(X|Y)=1-h(1-R_zz/2)
  
  We can rewrite Eq.(30) as
  
      I_ρ_AB'(X|Y)=h(1/2)-1/2h(1-R_zz/2)-1/2h(1-R_zz/2)
  
  Define a function f(x):
  
      f(x)=h(1+x/2)-1/2h(1-R_zz+x/2)-1/2h(1+R_zz+x/2)
  
  It is easy to prove f(x) is a decreasing function when x<0 and a increasing function when x>0. x=0 is the minimum point of f(x), so we have f(0)≤ f(t_z), which is I_ρ_AB(X|Y)≥ I_ρ_AB'(X|Y).
  
  
  Proof for χ_ρ_AB(X:E)≤χ_ρ_AB'(X:E):
  
  
  We have
  
      χ_ρ_AB(X:E)=S(ρ_AB)-1/2S(_A⟨ 0|ρ_AB|0 ⟩_A)-1/2S(_A⟨ 1|ρ_AB|1 ⟩_A)
  
  
      χ_ρ_AB'(X:E)=S(ρ_AB')-1/2S(_A⟨ 0|ρ_AB'|0 ⟩_A)-1/2S(_A⟨ 1|ρ_AB'|1 ⟩_A)
  
  The conditional von Neumann entropy H_ρ(X|E) can be expressed as
  
      H_ρ(X|E)=   H(ρ_XE)-H(ρ_E)
      =   H(X)+1/2H(ℰ_B(|0⟩⟨ 0|))+1/2H(ℰ_B(|1⟩⟨ 1|))-H(ρ_AB)
  
  So we have χ_ρ_AB(X:E)=H_ρ_AB(X|E)-1, χ_ρ_AB'(X:E)=H_ρ_AB'(X|E)-1.
  
  We use the Lemma 2 in Appendix A in Ref.<cit.> and get
  
      H_ρ̃_AB(X|E)≤ H_ρ_AB'(X|E)
  
  
      H_ρ_AB(X|E)≤ H_ρ̃_AB(X|E)
  
  Hence we have H_ρ_AB(X|E)≤ H_ρ_AB'(X|E), which is χ_ρ_AB(X:E)≤χ_ρ_AB'(X:E).
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  Proof of χ_ρ'≤χ_ρ
  For simplicity we only prove  the d=2 case here. For higher dimensions, the proof is similar.
  
  We use the Lemma 2 in Appendix A in Ref.[3].
  
  Lemma:
  For two channels ℰ_B^1 and ℰ_B^2 and a probabilistically mixed channel ℰ_B^':=λℰ_B^1+(1-λ) ℰ_B^2, Eve's ambiguity is convex, i.e. we have
  
  
  
      χ_ρ^'⩽λχ_ρ^1+(1-λ) χ_ρ^2
  
  
  Define σ_1=diag(1,1,1,-1),σ_2=diag(1,-1,1,1), we have
  
      ρ̃   =1/2(ρ+Z_AZ_Bρ Z_AZ_B) 
      ρ'   =1/2(σ_1ρσ_1+σ_2ρσ_2)
  
  
  where Z_A and Z_B are Pauli Z operators. Using the lemma mentioned above, we get
  
      χ_ρ^'   ⩽χ_ρ̃
      χ_ρ̃   ⩽χ_ρ
  
  
  So χ_ρ'≤χ_ρ.
  
  Amplitude Damping Channel
  
  In previous sections we show that if Alice and Bob's joint state is not Bell-diagonal, the tomography-based protocol gives a higher key rate than (d+1)-basis protocol. Here we give an example of Alice and Bob's joint state in qubit amplitude damping channel. The channel is described by Eq.(<ref>) in Section VII.A. The joint state of Alice and Bob in computational basis is
  
      ρ_AB=1/4[[       2       0       0 2√(1-p);       0       0       0       0;       0       0      2p       0; 2√(1-p)       0       0    2-2p ]]
  
  
  
  
  The density matrix in Bell basis is
  
  
      ρ_AB=1/4[[ 2-p+2√(1-p)           0           0           p;           0           p          -p           0;           0          -p           p           0;           p           0           0 2-p-2√(1-p) ]]
  
  
  
  We can clearly see that the density matrix is not diagonal in Bell basis, that's why the tomography-based QKD protocol gives a higher key rate than six-state protocol in qubit amplitude damping channel, as we have shown in Figure.<ref>.
  
  
  
  
  
  
  
  
  
  *
  
  
  
  