High Capacity Quantum Key Distribution via Hyper-Entangled Degrees of Freedom

Quantum key distribution (QKD) has long been a promising area for application of quantum effects toward solving real-world problems. But two major obstacles have stood in the way of widespread applications: low secure key generation rates and short achievable operating distances. In this paper, a new physical mechanism for dealing with the first of these problems is proposed: interplay between different degrees of freedom in a hyperentangled system (parametric down conversion) is used to increase the Hilbert space dimension available for key generation while maintaining security. Polarization-based Bell tests provide security checking, while orbital angular momentum (OAM) and total angular momentum (TAM) provide higher key generation rate. Whether to measure TAM or OAM is decided randomly on each trial. The concurrent non-commutativity of TAM with OAM and polarization provides the physical basis for quantum security. TAM measurements link polarization to OAM, so that if the legitimate participants measure OAM while the eavesdropper measures TAM (or vice-versa), then polarization entanglement is lost, revealing the eavesdropper. In contrast to other OAM-based QKD methods, complex active switching between OAM bases is not required; instead, passive switching by beam splitters combined with much simpler active switching between polarization bases makes implementation at high OAM more practical.


Quantum key distribution
In quantum key distribution (QKD) two experimenters (Alice and Bob) generate a shared cryptographic key, using quantum mechanics to guarantee that an eavesdropper (Eve) cannot obtain significant information about the key without being revealed. Commonly, for optical QKD schemes, key bits are derived from photon polarization. This can be done by having Alice prepare for Bob a single photon in a randomly chosen polarization state known only to her (BB84 protocol [1]), or by Alice and Bob each receiving from a common source half of an entangled photon pair (Ekert protocol [2]). Either way, polarization measurements by Eve produce detectable disturbances. Each photon is prepared in one of two non-orthogonal, mutually unbiased bases. Eve, intercepting a photon traveling to Bob, must guess which basis to measure in; if she measures in the same basis as the two legitimate participants, she acquires full information without detection. However, half the time she guesses the wrong basis, ensuring that her outcome is uncorrelated with Aliceʼs; she then obtains no useful information and simultaneously exposes herself to detection by randomizing Bobʼs results. This occurs because the polarization operators in the two non-orthogonal bases are not mutually commuting. Exchanging results for a subset of measurements, Alice and Bob see the decrease in correlation between their polarizations, revealing Eveʼs actions. For fiber systems, phase is often used instead of polarization, but the principle remains the same.
There have been two principal obstacles to widespread application of QKD outside of research labs. First, most methods have been limited in the distances over which they can operate; the simplest single-photon or weak coherent state approaches, for example, are generally limited to tens of kilometers before photon losses introduce unacceptable levels of error.
Second, most approaches to QKD with optical systems have used polarization or phase as the variables from which cryptographic key segments are generated. However, polarization can normally only encode one qubit per photon, unless substantial extra complications to the apparatus are added to allow for qutrit or ququart exploitation. Similarly, it is difficult at a practical level to increase the number of dimensions of the states encoded by phase beyond two, or at most, four. It would therefore be desirable to find a more practical means of encoding highdimensional states into a photon. This would increase the rate of key generation by allowing more than one bit of cryptographic key to be shared between the legitimate users of the system per exchanged photon.
As a means of increasing the key rate, there has been much interest (see [3][4][5][6] and references therein) in using the photonʼs orbital angular momentum (OAM) instead of polarization. The range of applications of states with OAM, such as Laguerre-Gauss states, to both classical and quantum communication has been rapidly expanding; see for example [7,8]. OAM is quantized, =  L l z z , with integer topological charge l z . There is no fundamental upper limit to the value of l z , so the alphabet size or effective Hilbert space dimension, N, is in principle unbounded. Using a range of l z values from −l 0 to +l 0 , each photon can generate up to = + ( ) N l log log 2 1 2 2 0 bits of cryptographic key. OAM was first successfully used [3] to generate a quantum key by means of the three-dimensional qutrit space spanned by = ± l 0, 1 z . However, switching between unbiased, noncommuting bases in a higher-dimensional OAM space is now needed. This basis switching is much more difficult for OAM than for polarization and the difficulty grows with increasing basis size. Therefore the apparatus complexity and experimental difficulty increase rapidly with growing N.
In this paper, we wish to propose a means of increasing the number of secret key bits generated per transmitted photon, while avoiding the increasingly difficult basis modulations required by other schemes when going to higher Hilbert space dimensions. In the next section, we introduce a new physical mechanism for key generation that will allow a simpler experimental route to this goal. The approach we propose makes use of OAM for increased Hilbert space dimension, but here the OAM is employed in a fundamentally different manner than in all previous methods. In particular, we will make use of its joint entanglement with polarization, arranging the setup in such a way that the polarization is able to serve as a signal of attempts at eavesdropping on the OAM. Conceptually, rather than switching between two nonorthogonal bases in the space of orbital angular momentum, we switch between two nonorthogonal bases in the larger space of total angular momentum. This is much easier to accomplish because only the measurement basis of the photon polarization needs to be actively modulated.

Quantum nondemolition measurements
The idea of using OAM to generate a secret key while only performing security-enforcing basis modulations in polarization seems to reveal an immediate problem. The two variables commute, so that one may be measured without disturbing the other. For example, the OAM eigenvalue, l z , may be obtained by performing an ideal quantum nondemolition (QND) measurement [9][10][11][12]. This in principal causes no disturbance to the polarization or spin.
In practice, the situation is a little more complicated. Practical execution of QND requires nonlinear optical processes such as Kerr nonlinearity; however, it has been shown that the physics of nonlinear interaction ensure that QND measurement of OAM will cause some disturbance to the signalʼs polarization state [13]. This both reveals Eveʼs presence and destroys the information she was attempting to obtain, since it prevents Alice and Bob from agreeing reliably on a shifted key. Furthermore, the low amplitudes of nonlinear processes guarantee low efficiency at the single photon level; only a small fraction of the photons will participate in the interaction, allowing Eve to determine only a small fraction of the OAM values.
But these considerations are specific to the case of QND measurements via Kerr nonlinearities. It may be possible that Eve has an advanced technology that allows her to make QND measurements of l z by some other, as yet unknown, means. There is no fundamental principal, to our knowledge, that guarantees that other such QND technologies must cause a similar disturbance to polarization when applied to OAM. Thus, we wish to avoid this problem by arranging a fundamental linkage between the polarization and OAM that will cause QND measurements of one variable to disturb the other, independent of the physical mechanism used to make the measurement. We propose a means of accomplishing this in the following sections.

Hyperentangled QKD
We propose a high-dimensional OAM-based QKD scheme that requires no random switching between OAM bases. For full security, it is necessary to treat both variables, polarization and OAM, in a fully quantum manner. The goal is to do this in such a way that active basis modulations are only needed in polarization, not in OAM. This is achieved by adding a third variable, the total angular momentum (TAM)Ĵ about the propagation axis, and then allowing a random choice between measuringˆ=ˆ+Ĵ L S z z z or measuringL z .Ĵ provides a linkage between the spinŜ (which determines the circular polarization state) and the OAML, that allows the desired goal to be achieved.
The principal idea is to separate key generation and security into different degrees of freedom; however, these variables must be closely linked in such a way that unauthorized measurements of one variable produce detectable signatures in the other. We will use OAM and TAM in tandem for key generation (due to their high dimensionality and subsequent high keygeneration capacity), while employing polarization for security checks (due to the ease of alternating between polarization bases). This is possible because spontaneous parametric downconversion (SPDC) supplies photon pairs hyperentangled [14][15][16][17][18][19] in polarization and OAM (among other variables). Hyperentanglement in SPDC has found applications in recent years ranging from quantum interferometry [15] and quantum imaging [20] to quantum cryptography and dense coding [21,22]. Polarization-OAM hyperentangled states have also been used for ultra-sensitive angular measurements [23].
Previous uses of OAM in conjunction with polarization for QKD applications [21,22] make use of the two variables in a sort of parallel, non-overlapping manner: the measurement of one variable has no effect on the other. The components of the two variables are simply appended to each other to form a vector with more components, thereby expanding the relevant state space to a higher dimension. A complicated procedure of basis switching must still be carried out in this higher-dimensional space in order to ensure security. In contrast, in the current paper hyperentanglement is used in a more intrinsic manner; the pair of entangled variables are partially overlapping in the sense that they can be either independent or perfectly correlated with each other, depending on whether or not a third variable has also been measured. In this way, measurements by the eavesdropper on one variable become apparent through loss of entanglement in a second variable due to the pairwise noncommutativity of the first two variables with the third. The enforcement of security measures is then greatly simplified at high dimensions, since passive switching between the two measurement variables is technically much simpler than active switching between large basis sets for a single variable.
In addition to the technical simplification of QKD at high dimensions, the proposed procedure is interesting for several other reasons. Use of the noncommutativity ofĴ withL and S for quantum communication applications seems to be largely unexplored, as is the use in QKD of pairs of different vector operators in the place of pairs of different components of the same vector operator. Furthermore, the use of angular momentum erasure (see section (2)) to maintain polarization entanglement has not previously been proposed and may be interesting in its own right as the basis for angular momentum-based analogs of quantum eraser and delayed choice experiments.
The proposed approach relies on the fact that although OAM and polarization commute with each other, neither of them commutes with the TAM. To be explicit, the commutators ofL andŜ among themselves are given by: i j so that: This lack of commutativity means that TAM measurements provide an indirect linkage between L andŜ; we make use of this linkage in the following. The specific procedure to be proposed in the next section allows Alice and Bob a random choice between measuring the eigenvalues of either the OAM (L z ) or the TAM (Ĵ z ). Only trials in which Alice and Bob both measure the same variable are kept; on these, the photon spin (polarization) state remains entangled. If Eve measures a variable differently to Alice and Bob, the spin wavefunction collapses into a definite polarization state, which will be detectable by a Bell-type test on polarization. This occurs because once the values ofL z andĴ z have both been measured, the value ofˆ=ˆ−Ŝ J L z z z can be determined as well. Subsequent measurements of the photonʼs linear polarization in the − x y plane will then be affected by this sequence of measurements.
The higher dimension of the OAM state space increases the number of key bits generated per photon; this is done without any additional active modulation beyond what is needed in the usual polarization-based protocols. There is no upper limit to the number of bits possible in principle, although there are of course practical limits. N can potentially be scaled up to a very large size with little additional effort as long as sources with high values of entangled angular momenta and OAM sorters that work over a large enough range are both available. The range of achievable l values for entangled photons has rapidly grown in recent years [24,25]. Measures must be taken to guarantee that the range being used for the alphabet has a flat spectrum; otherwise Eve can use the differing probabilities to gain information about the key. This equalization, however, can be easily achieved, for example by using extra OAM sorters followed by filters with different transmission rates. The span of values that can be sorted by a single sorter has also grown, though more slowly [26][27][28][29][30][31][32]. Figure 1 shows the proposed setup in schematic form, with a more detailed view of portions of it in figures 2 and 4. We will assume that the down-conversion source uses a pump beam with zero OAM. The signal and idler polarizations are perfectly correlated for type I downconversion or perfectly anticorrelated for type II; either way, the OAM is perfectly anticorrelated. For specificity, we henceforth assume type II down-conversion. The particular case drawn in figures 2 and 4 assumes alphabet size N = 3 ( = ± l 0, 1; i.e. = l 1 0 ), so an array of three detectors is required following each sorter. Larger alphabets require more detectors, sorters and erasure stages, but no further changes are needed; the setup complexity therefore grows much more slowly with alphabet size than in other approaches; a change of OAM bases in the approach of [3], for example, requires the alignment and coordination of rapidly increasing numbers of moving stages as the dimension grows. (Note that even though the alphabet being used is − + { 1, 0, 1}, the sorters will need to be capable of sorting values up to ±2 to carry out the erasure procedure in figure 2.) Alice and Bob can readily measure either OAM eigenvalue l z or spin eigenvalue s z (circular polarization), or both. In the paraxial case,Ŝ andL are well defined and commute, so their components can be simultaneously measured, as verified experimentally in [33]. This fully determines j z . In contrast, the TAM j z about the propagation axis can be measured interferometrically in such a way [33] that it leaves the separate values of both spin and OAM undetermined. So suppose that Alice and Bob each have a beam splitter randomly sending incoming photons either to an apparatus that measuresL z or to one measuringĴ z (the After sorting is done for one of these variables, the information about the other variable is erased (see figure 2). Regardless of which variable is sorted and which is erased, the polarization is undisturbed and available for measurement.  Although this will alter the value of s, it will leave the spin or polarization entanglement undisturbed in trials where both participants measureĴ z , since they will both carry out similar spin flips in opposite directions. sorters in figure 1). After the sorting is done on one variable, information about the other variable is erased by an arrangement of beam splitters, waveplates and holograms (see figures 2, 3 and 4). The sorting by l z and j z values is nondestructive, so the spin or polarization can still be measured afterwards.

Erasing unmeasured variables
The erasure of the unmeasured variable, as illustrated in figure 2, is necessary because otherwise there will be no interference between polarization states. To see this, imagine Alice and Bob place linear polarizers at respective angles θ A and θ B from the horizontal. The states passed by the polarizers will be denoted θ A and θ B . After passing through the polarizers, the probability of joint detection in both labs is proportional to θ θ ψ A B 2 . Provided the angles are not multiples π 2 , both H and V will have nonzero projections onto the θ states, so that crossterms between the H and V pieces will survive in the probability. These cross-terms will be dependent on θ A and θ B , giving rise to the desired Bell interference. However, if the polarization is entangled with another variable (OAM for example), a state such as ± l H l V l V l H , , , , will produce no interference, since theL z eigenstates l 1 Figure 4. A more detailed view of Aliceʼs lab; Bobʼs lab has a similar arrangement. After sorting in one variable (either j z or l z ), information about the other variable then needs to be erased (figure 2) before polarization interference is measured. The outgoing arrows lead to systems for polarization measurement. For the top three outputs in the figure, which particular detector fires at the end will tell Alice the value of j z but will give no information about l z ; the opposite is true in the bottom three outputs. Thus Alice will know the value of only one of these two variables.
and l 2 will still be orthogonal after the polarizer, causing the cross-terms to vanish; there are no intermediate states to bridge the two orthogonal OAM states in the way that the θ states did for polarization. This can be seen in detail in the example given below (section 2.4).
When j z has been measured, information about l z can be erased (top part of figure 2) by sorting different l z values into different paths, inserting appropriate holograms or spiral phase plates to shift the OAM in each path to zero, then recombining the paths. In this manner, the initial OAM values are erased (shifted to zero) so that there is no way of determining which path was taken and what the initial OAM value was. The different incoming OAM states are now indistinguishable, while the polarization states are left entangled. Similarly, when l z is measured information about j z can be erased (bottom part of figure 2) by sorting j z values, shifting the values of s z appropriately with phase plates (converting one circular polarization into the other), and recombining. Although this changes the value of s for each photon, it leaves the entanglement undisturbed in the trials where both Alice and Bob measure j z , since they both carry out similar shifts: an incoming entangled spin state of the form , which is still entangled and in fact proportional to the original state.

Procedure
Consider now the setup described in the previous section with a two-photon input state generated from type II parametric down-conversion. The pump beam is assumed to have no OAM, = l 0 pump . Alice and Bob each receive one photon from the state, on which to make measurements. Consider several possibilities: • Suppose Alice and Bob both measure l z . Using the fact that their values should be perfectly anticorrelated, they can use the resulting OAM quantum number on Aliceʼs side (or, equally, on Bobʼs) to define a key. Since theL andŜ measurements donʼt affect each other, the spin eigenvalues along each axis remain undetermined and the polarization state remains entangled. In the first two cases, the spin states remain entangled after sorting, so tests on the linear polarization should yield a Bell violation. In the third case, when Alice and Bob measure different variables, such a test should yield no violation, the spin having been reduced to a classical quantity. The measurement of one variable (Ĵ z orL z ) reduces the original space of states for each particle to a two-dimensional subspace, while the measurement of the second variable further reduces each particle to one unique state. Consequently, the two-photon pair goes from an entangled to a separable state.
If Eve attempts QND measurements to determine j z or l z , then on half the retained trials she will measure the wrong variable (the one not measured by Alice and Bob), thus fixing s and causing a detectable loss of the Bell violation.
In this scheme, the beam splitterʼs random choice between causing either aĴ z measurement or anL z measurement replaces the usual random modulation between two measurement bases for components of a single variable. All variables act in a completely quantum manner, with the 'quantumness' coming from the fact that althoughL andŜ commute with each other, neither commutes withĴ; if j z and l z are both measured, whether by the legitimate participants or by eavesdroppers, polarization entanglement is destroyed.
Another equivalent way to view the situation, that makes the analogy to the Ekert case clearer, is that measurements can be made along a basis in angular momentum space aligned with theĴ z axis or one aligned with theL z axis; these are mutually unbiased on each twodimensional subspace defined by a fixed j z value or a fixed l z value, but are also incomplete in the sense that neither measurement fully determines the state. However, making both measurements does uniquely determine the state, completely fixing j z , l z and s z values.
Note that the key-generating capacity grows with increasing dimension, as is the case for all OAM-based QKD methods. However, unlike in other OAM-based schemes, the security checking remains essentially two-dimensional so that the level of security grows more slowly with increasing dimension. This is the price that is paid for reducing the complexity of generating practical high-dimensional keys. The secure key rate and mutual information between participants will be examined in section 3 and the appendix.

Example
To be more concrete, consider an entangled two-photon input state of the form Such a state arises, for example, from type II down-conversion after filtering to equalize the probabilities of various l values. The linear and circular polarization states are related by If both experimenters measure the TAM with Alice obtaining the value j z , then Bob will obtain the value −j z , reducing the state to The first entry in each ket is the l z value, the second is s z . Note that l z and s z remain indeterminate after the j z measurement since multiple combinations of l z and s z can add up to the same j z . If l z is not measured in either branch at any point, then information about it can be erased as in figure 2, in order to arrive at a maximally entangled spin wavefunction, Carrying out a Bell-type test on polarization after the j z sorting then yields a maximal quantum mechanical Bell violation. However, if in addition to the j z sorting, the OAM on Bobʼs side is also measured (by Bob or by Eve), the state of equation (13) ). Placing quarter-wave plates at the output, to convert from circular to linear polarization, the state becomes either Either way, it is now a separable state (both before and after the l z erasure) with definite polarization for each photon, so no Bell violation occurs. If Alice and Bob measure l z while Eve measures j z , a similar result follows.
When Eve guesses whether to measureL z orĴ z , half the time she guesses wrong and causes collapse of the entangled polarization state into a separable state. This lowers the interference patternʼs visibility to classical levels when Bell tests are performed, providing a clear signal of her intervention.
To examine the interference visibility, define the rotated polarization states at Aliceʼs location: for the two-photon entangled spin state of equation (15). A Clauser-Horne-Shimony-Holt (CHSH)-type interference experiment [34] will then exhibit oscillations with visibility  of 100%. On the other hand, if ψ spin is replaced by any separable state of the form (where γ is the polarization direction of the photon measured by Alice), the corresponding inner product is ψ θ the dependences on θ and ϕ now factor so that the visibility can never be greater than the classical limit of ≈ 71% 1 2 . In general, if Eve is eavesdropping a fraction η of the time, the visibility will be . A drop in visibility to below the value set by the Bell-CHSH inequality signals the possible presence of eavesdropping.

Information and security considerations
Instead of testing Bell inequalities on the entangled polarization states, there is a second way to check the security of the transmission, which will be more useful for arriving at quantitative estimates of information and signaling rates. In the set of trials for which Alice and Bob measure the same variable, they can choose a random subset of their measurement values (l z or j z values) for comparison. Ideally, they should both find perfectly anticorrelated values, so that the presence of discrepancies beyond the expected error rate due to the transmission method then serves as a signal of an eavesdropperʼs presence. This method is more directly analogous to that of the BB84 scheme, requiring no active modulation of the detector settings, as opposed to the Bell inequality-based version of the Ekert scheme, which still requires modulation of the settings for the polarization measurements. In this section, we take the BB84-like approach when we look at security considerations, since it is relatively easy to compute the probabilities of the output states and the key rate while taking Eveʼs actions into account. . It should be noted that unlike the case of the Ekert or BB84 protocols, where there is a finite number of possible outcomes (two polarizations) and they are both used, in the current case we make use of a finite subset of a larger (in fact infinite) set of possible output values for j z or l z . As a result, when Eve interferes it is possible to 'run off the end' of the allowed set of values, and this possibility must be accounted for. Also, we note that there are values of j z but only + l 2 1 0 values of l z . As a result of these complications some further refinements to the method must be made. These are discussed in the appendix. The appendix also then gives the resulting probability distributions for Aliceʼs and Bobʼs joint outcomes. In this section, we make use of those distributions to investigate the quantum security of the procedure against eavesdropping.

Error rates
If Eve intercepts a fraction ηof the transmissions, she has a 50% chance of measuring the correct variable each time, obtaining the correct key value k (either from anL z orĴ z measurement) without introducing errors. On the other hand, during the 50% of the times in which she measures the wrong variable, she only has a further 50% chance of sending the correct value to Bob. Specifically, each time she measures the wrong variable her intervention has a 1 8 probability of causing Bob to measure the value − k 2 and an overall probability of 1 8 of causing him to measure the value + k 2, with only a 1 2 probability of obtaining the correct key value, k (see figure A1). So if the alphabet size were infinite, the eavesdropper-induced error rate would be 4 However, we must take into account the fact that Eveʼs actions can cause values to move out of the range being used for the key; this will alter the error rate slightly. Using the probability distribution P AB given in the appendix, it is then straightforward to show that the true eavesdropper-induced error rate is Bobʼs error rate is shown in figure 5 for three different eavesdropping ratios, along with the corresponding values for polarization-based BB84. It is seen that for small l 0 the error rate is slightly lower than the BB84 value, but it rapidly approaches that value as l 0 increases. After dropping the trials in which Alice and Bob measure different variables, the fraction f of the remaining photons that are used to generate the key may also be easily computed from P AB . It is found to be Figure 5. Comparison of the error rate e for the scheme described in this paper (solid curves) to the BB84 protocol (dashed lines). This is done for (from top to bottom) eavesdropping ratios η = 1, η = 0.5 and η = 0.1. In each case, the error rate for the current approach starts a little below the BB84 value for small l 0 , but approaches it rapidly and asymptotically as l 0 increases. the total probability to unity. Straightforward calculation then gives the result that the mutual information [35] between Alice and Bob as a function of parameters η and l 0 is: . Eve gains full information about the key value on half of the measurements she makes and receives none on the other half, so the information gained by Eve is simply η 2 times the information per photon. The results for the information and the secret key rate are plotted in figure 6(b)-(d). The case of BB84 is shown for comparison in figure 6(a). It is seen that κ is always greater than in the BB84 case, that it remains positive for all values of η, and that for any fixed value of ηthe value of κ increases with increasing l 0 . Thus, the amount of key generated per transmitted photon is significantly larger than in the BB84 or Ekert schemes. Security can be further enhanced in various ways, such as replacing the four-state polarization scheme with a six-state approach [36].

Conclusion
We have proposed a method for performing QKD using high-dimensional OAM and TAM variables in a manner that does not require the complicated high-dimensional basis modulations necessary in other approaches, and which allows an increase in the rate of secure key distribution. The main ingredients are: (i) A hyperentangled system with different functions segregated into different entangled degrees of freedom. (ii) Random switching between two OAM bases is replaced by random switching between measurements of two distinct noncommuting but related variables,L z andĴ z . (iii) Measurement of any one variable does not completely determine the state, while measurement of any two of the three relevant variables does. Together, these ingredients allow the high capacity ofĴ z orL z eigenstates to be used while modulating only the simpler polarization states. As a result, higher-dimensional OAM spaces can be utilized and higher key-generation capacities can be achieved with only relatively minimal increases in apparatus complexity.
Previous approaches to using polarization and OAM together simply used them to generate larger keys from each photon by increasing the number of variables involved. In these past approaches, the variables still remained separate, with no interplay between them. QND measurements on one variable left no signature in the other, so that both must experience independent basis modulations to maintain security. In contrast, the approach described here makes a more fundamental use of the systemʼs hyperentanglement, constructing a chain of three variables such that adjacent pairs in the chain do not commute. This noncommutativity provides a linkage between the variables that enhances security, as well as increasing the number of key bits per photon.
The approach of constructing chains of pairwise noncommuting operators has not been previously used in QKD and is likely to be generalizable to other operators (aside from angular momentum), and to employment in other types of quantum protocols as well. The procedure also makes use of an angular momentum erasure process that is of interest in its own right, since it allows the possibility of conducting future quantum erasure or delayed choice experiments in angular momentum space.
At high l 0 , the eavesdropper-induced error rate is lower than for other two-basis OAM- ; in the current scheme e instead remains near the two-dimensional BB84 error rate; this is because the eigenspaces of the two measured operators (Ĵ z andL z ) are effectively unbiased only on a two-dimensional subspace, due to the two-dimensional nature of the polarization. The dimension of the subspace on which the variables are unbiased does not increase with l 0 . Because of this, the secret key rate κ will be lower than for other OAM-based schemes at large l 0 . However, κ in this approach is always higher than in BB84 or E91 protocols even for the least advantageous case ( = l 1 0 ), and it grows logarithmically with increasing l 0 ; similarly, the BB84-level eavesdropper-induced error rate remains sufficient to detect eavesdropping regardless of dimension.
There are some technical difficulties that must be overcome for the method to become practical. Probably the chief among these is that the most common method of measuring photon OAM is to shift the input l-state to l = 0 and then to collect them in an optical fiber. This method is of low efficiency, which greatly reduces the key transmission rate of all OAM-based schemes. Further, the interferometers used to sort the OAM and TAM values [33] become progressively more complex as the range of l z and j z values to be used increases.
However, when coupled to the much greater ease in this scheme of switching betweenĴ z andL z measurements compared to the difficult switching between measurements of different components ofL in other protocols, the method presented here seems to hold strong promise as a more practical way to reach higher key rates per photon while maintaining full quantum-level security.  In Eveʼs absence, there is ideally perfect anticorrelation when Alice and Bob measure the same variable. The distributions of key values k should be identical, = P k P k ( ) ( ).

A B
Moreover, their joint distribution should be uniform on the diagonal and vanishing elsewhere:  where rows label Aliceʼs outcomes and columns label Bobʼs. The first + l 2 1 0 rows and columns label possible key values, while the last row and column correspond to Alice or Bob, respectively, generating no key. For eavesdropping fraction η, the full joint outcome distribution for all trials becomes  with marginal probabilities for the two participants obtained by summing rows and columns. The eavesdropper-induced error rate, the mutual information shared by Alice and Bob, and the secure key rate may all now be found using this distribution. These quantities are discussed in section 3.