High-dimensional quantum cryptography with twisted light

Quantum key distribution (QKD) systems often rely on polarization of light for encoding, thus limiting the amount of information that can be sent per photon and placing tight bounds on the error rates that such a system can tolerate. Here we describe a proof-of-principle experiment that indicates the feasibility of high-dimensional QKD based on the transverse structure of the light field allowing for the transfer of more than 1 bit per photon. Our implementation uses the orbital angular momentum (OAM) of photons and the corresponding mutually unbiased basis of angular position (ANG). Our experiment uses a digital micro-mirror device for the rapid generation of OAM and ANG modes at 4 kHz, and a mode sorter capable of sorting single photons based on their OAM and ANG content with a separation efficiency of 93%. Through the use of a seven-dimensional alphabet encoded in the OAM and ANG bases, we achieve a channel capacity of 2.05 bits per sifted photon. Our experiment demonstrates that, in addition to having an increased information capacity, multilevel QKD systems based on spatial-mode encoding can be more resilient against intercept-resend eavesdropping attacks.

hand, the spatial degree of freedom of photons has been identified recently as an extremely useful resource for transferring information [4,5].Using this principle of operation, the information transfer capacity of classical communication links has been increased to more than one terabit per second [6].In addition, it has been shown that employing multilevel quantum states (qudits) can increase the robustness of a QKD system 1 arXiv:1402.7113v1[quant-ph] 28 Feb 2014 against eavesdropping [7].Considering the above benefits, it is expected that realizing a large alphabet by means of spatial-mode encoding can drastically enhance the performance of a QKD system.
The feasibility of high-dimensional QKD in the spatial domain has been previously demonstrated by encoding information in transverse linear momentum and position bases [8,9].While such encoding schemes provide a simple solution for increasing the information capacity, they are not suitable for long-haul optical links due to the effects of diffraction, which results in transmission loss.Additionally, the varying amount of loss for different spatial frequencies leads to cross-talk [10].The resulting increase in quantum bit error rate (QBER) fundamentally limits the secure key rate of a QKD system.This undesired effect can be avoided by employing OAM modes.Due to their rotational symmetry, OAM modes have the desirable property of remaining orthogonal upon propagation in a system with round apertures [11].In a recent experiment, OAM modes were used for performing classical communication through a 3-km-long free-space optical link [12].
The OAM of photons has enabled many applications in the field of quantum information including studies of quantum entanglement [13][14][15][16], photonic superdense coding [17], and quantum cloning [18].Similarly, a number of studies have investigated the possibility of using OAM modes in quantum cryptography [19,20].
Recently, rotation-invariant OAM vector modes have been used for performing QKD in a two-dimensional state space [21].Although this method offers advantage in terms of optical alignment, it fails to utilize the large information capacity of the OAM basis.Realization of a high-dimensional QKD system with OAM has remained impractical up until now mostly due to the difficulty in efficiently sorting single photons in the OAM basis.. Additionally, any realistic application requires a fast key generation rate that cannot be achieved with most of the common methods for generating OAM modes.
In this paper we present an experimental scheme for performing high-dimensional quantum cryptography with OAM modes.We encode information in a 7-dimensional set of OAM modes along with modes in the complementary basis of azimuthal angle (ANG).Our scheme uses a digital micro-mirror device (DMD) for fast generation, and an efficient technique for unambiguous sorting of both OAM and ANG modes.By combining these techniques, we selectively generate the set of 14 spatial modes at a speed of 4 kHz and correspondingly detect them with a separation efficiency of 93%.We measure a channel capacity of 2.1 bits per sifted photon with an average symbol error rate of 10.5% that is well below the error bounds that are required for security against the most rigorous eavesdropping attacks.
In our scheme, Alice randomly chooses her photons from two complementary bases.The primary encoding basis is a set of OAM vortex modes.These modes have a top-hat intensity structure and a helical phase profile characterized by Ψ = e i ϕ , where ∈ {−3 : 3} (See Fig. 1).The complementary basis set is formed by a linear combination of OAM modes with an azimuthal quantum number | |≤ 3 with equal parts We refer to these modes as the angular (ANG) modes due to their localized intensity patterns (See Fig. 1).
The ANG modes form a mutually unbiased basis with respect to the OAM basis [22,23].Consequently, if an ANG-mode photon is measured in the OAM basis it has an equal probability to appear in any of the component OAM modes, and vice versa.
Our experimental setup is depicted in Fig. 1.We use a prepare-and-measure scheme similar to the BB-84 protocol.Alice generates the modes by illuminating a binary hologram realized on a digital micro-mirror device (DMD) [24].A He-Ne laser beam is modulated by an acousto-optic modulator (AOM) to create 125 ns  The spatial modes are mapped to number between 0 to 6 (errors are marked in red and underlined).Notice the errors marked by the red color.Each symbol is converted into a 3 digit binary number first and the binary key is randomized before the error-correction.The cascade protocol is used for error correction.Since a part of the key is used to estimate the error rates the error-corrected key becomes shorter.This procedure gets more efficient for a very large key where the error estimation will be initially done on a small portion of the key.To perform the privacy amplification, Alice and Bob decide to what extent they want to shorten the key.This is done by estimating the number of bits of information known by Eve, using the sifted key error rate and the number of bits communicated in the error-correction procedure.
pulses that contain on average µ = 0.1 photons each.The prepared modes are then imaged to Bob's receiving aperture via a 4f telescope that forms a lossless 2-m-long communication link.Bob's system consists of a mode sorter that performs a log-polar to cartesian transformation [25].Going through the sorter, an OAM mode is converted to a plane wave with a tilt that is proportional to the OAM quantum number .An ANG mode transforms to a localized spot shifted by an amount proportional to the angular index n.The transformed modes are then replicated into multiple copies using a fan-out element (SLM1) and recombined after phase correction (SLM2).The coherent beam-copying and the subsequent recombination results in a drastic reduction in the overlap between the neighboring transformed modes [26].Finally the sorted modes are coupled to an array of fibers that are connected to avalanche photodiodes (APDs).
Alice and Bob are also connected via a classical link realized by an ethernet cable running a TCP/IP protocol.Alice's computer chooses a random basis and symbol, sets the DMD, and triggers the AOM.Bob's computer on the other end captures the signal from the APDs.A field-programmable gate array (FPGA) is programmed to perform the photon counting using a trigger signal from the AOM.Due to the limited number of available APDs (four), the data for each part of the key is taken in sequence and is combined later.After Alice and Bob collect a sufficiently large number of symbols, they stop the measurement.At this point, they generate a sifted key by announcing their measurement bases over the classical channel.The sifted key is then transformed to a binary form on a symbol-by-symbol basis and randomized by means of a random-number generator shared by Alice and Bob.The cascade protocol is run in the next step to fix the errors [27] (See Fig. 2).In the final step, Alice and Bob perform privacy amplification to minimize Eve's information by reducing the key length using a universal hash function (See Fig. 2) [28].
Figure 3 shows the conditional probability of Bob detecting each mode as a function of the mode sent by Alice.Theoretical values for the case of a system with no errors is shown on the left for comparison.From the data, the mutual information between Alice and Bob is calculated to be 2.1 bits per sifted photon.The average symbol error rate from this data is calculated to be 10.5%.About 4% of the error rate is measured to be from the APD dark counts and the ambient light, while the remaining 6.5 % is due to cross-talk among different modes within the same basis.The probability of correctly detecting each mode in the absence of dark counts, also known as the separation efficiency of the mode sorter, is calculated to be slightly more than 93%.To quantitatively assess the security of our system, we plot the numerical values for the error bound of an intercept-resend eavesdropping attack, a coherent attack, as well as the error rate from our experimental data in Fig. 4. In an intercept-resend attack, the eavesdropper (Eve) measures a photon and and then resends a photon prepared based on the result of her measurement to Bob.In a coherent attack, Eve coherently probes a finite number of qudits in order to gain information about the key [7].
It is evident from this graph that our experimental error rate is well below the required bounds for security against both intercept-resend and coherent attacks (Fig 4).Unlike intercept-resend attacks, the error rate for coherent attacks only depends on system dimension N and is independent of the number of MUBs, M [7].Since coherent attacks impose a stricter bound on the error rate, increasing the number of MUBs beyond 2 results in a drop in the key rate without any gain in security.Nevertheless, there is a clear increase in the allowed error rate for larger system dimensions, demonstrating a clear advantage for using a high-dimensional encoding scheme for QKD such as that of OAM.
Using the error rate, we estimate the information gained by Eve to be 0.35 bits per sifted photon for cloning-based individual attacks.It is has been argued that a cloning-based attack is the optimal strategy for eavesdropping on systems based on qudits [7].This information is removed in the privacy amplification process, leading to a mutual information of 1.75 bits per sifted photon in our secret key.It should be emphasized that our secure key rate analysis assumes an infinite key, while any experimental realization produces only a finite key [29].We are working toward a finite key analysis of the security, which will be reported in the future.
In contrast to phase-only spatial light modulators (SLMs), which are limited to a frame rate of 60 Hz, the DMD used in our setup has the ability to rapidly switch between the modes at a speed of 4 kHz.This is especially important considering the fact that the speed of generation of spatial modes limits the key generation rate of the system.We measure our raw key generation rate to be 16 bits per second.After performing basis reconciliation and privacy amplification, we estimate the secure key rate to be 7 bits per second, which is more than 3 orders of magnitude larger than previously existing spatial mode encoding protocols [9].Several approaches exist for increasing the secure key rate.The key generation rate scales with the optical throughput of Bob's detection system (See the Methods section).The throughput can be readily increased by employing high efficiency spatial light modulators, or AR-coated custom refractive elements.
The spatial mode generation rate can also be increased by using faster commercially-available DMDs [24].
Previously, we have shown that our mode sorter is capable of sorting 25 OAM and ANG modes with an average mutual information of 4.17 bits per detected photons [26].Consequently, the encoded information per photon can be readily increased by increasing the number of APDs in the experiment.Finally, the average number of photons per pulse can be increased through the use of a decoy-state protocol [30].Error-bound for security.Bob's error bound calculated from the theory as a function of the dimension of the Hilbert space for intercept-resend attacks with two MUBs (M=2) and coherent attacks is plotted along with QBER measured from our experimental data (the error bar shows one standard deviation).It is seen that the QBER from our experiment lies well below the theoretical bounds and hence it is sufficient for proof of security.
In conclusion, we demonstrate a 7-dimensional QKD system based on OAM encoding.We generalize the BB84 protocol by using ANG modes, which form a complementary basis with respect to OAM.Using a combination of a coordinate transformation and a beam-copying technique for separating OAM and ANG modes, we achieve a mutual information of 2.1 bits per sifted photon.This is more than twice the maximum allowable capacity of a two-dimensional QKD system.The QBER of our scheme is measured to be 10.5%, which is sufficient for proving unconditional security against coherent and individual eavesdropping attacks.Further, our scheme uses a DMD for generating spatial modes at a speed of 4 kHz.Our experiment opens the door to realizing real-world, multi-level quantum communication systems with record capacities and levels of security.

Methods
Equipments and experimental techniques.A Helium Neon laser beam (632.8 nm) is spatially filtered using a 6 µm pinhole.The beam's intensity is modulated by an ISOMET 1205C-2 acousto-optic modulator to create rectangular pulses of 125 ns width.The collimated beam then illuminates a a Texas Instrument DLP3000 DMD.This device has a resolution of 608 × 684, and each micro-mirror has a width of of 7.5 µm.The OAM and ANG modes are created using computer generated binary holograms [24].
An aperture is used in between a 4f system to pick up the first-order diffracted beam.Machined PMMA (Poly methyl methacrylate) refractive elements mounted in a Thorlabs cage system are used for log-polar coordinate mapping [25].The power transmission efficiency of the refractive elements is measured to be 85%.Two Holoeye PLUTO phase-only SLMs are used for realizing the holograms for the fan-out element and its corresponding phase-correcting element.In addition, two cylindrical lenses are realized on the SLMs to adjust the aspect ratio of the transformed beams.The diffraction efficiency of each SLM is measured to

Figure 1 :
Figure1: a) The experimental setup.Alice prepares the modes by carving out pulses from a HeNe laser with an acoustooptic modulator (AOM).The spatial mode information is impressed on these pulses with digital micro-mirror device (DMD) at a rate of 4 kHz.After propagation thorough a 2 m imaging system the modes are received by Bob.The mode sorter maps the OAM modes into plane waves and the ANG modes into localized rectilinear spots.After a random basis is chosen by the beam splitter, Bob performs the detection by coupling the transformed modes to an array of fibers.Fan-out elements and phase correctors are used to enhance the separation of the OAM and ANG modes.Note that the output of the sorter is Fourier-transformed for OAM modes, while it is imaged to the fan-out SLM for the ANG modes.b) The alphabet.CCD images of light fields produced light fields in two complementary spatial bases of OAM and ANG (N = 7).The intensity profile of the modes are shown on the right.An example of binary holograms used for the generation of modes in each basis is shown on the left.

Figure 2 :
Figure 2: Key generation An example of a sifted key generated from the experiment.The spatial modes are mapped to number between 0 to 6 (errors are marked in red and underlined).Notice the errors marked by the red color.Each symbol is converted into a 3 digit binary number first and the binary key is randomized before the error-correction.The cascade protocol is used for error correction.Since a part of the key is used to estimate the error rates the error-corrected key becomes shorter.This procedure gets more efficient for a very large key where the error estimation will be initially done on a small portion of the key.To perform the privacy amplification, Alice and Bob decide to what extent they want to shorten the key.This is done by estimating the number of bits of information known by Eve, using the sifted key error rate and the number of bits communicated in the error-correction procedure.

Figure 3 :
Figure 3: Conditional probability of detection.a) Theoretical predictions for an ideal system .The bases chosen by Alice and Bob are marked by subscripts "A" and "B".b)The experimental results.To construct each row of the matrix, about 1 million pulses where captured by saving the signals from APDs and the gate with a 300 MHz oscilloscope on the fast acquisition mode.c) 3D view of the experimental data.

Figure 4 :
Figure4: Error-bound for security.Bob's error bound calculated from the theory as a function of the dimension of the Hilbert space for intercept-resend attacks with two MUBs (M=2) and coherent attacks is plotted along with QBER measured from our experimental data (the error bar shows one standard deviation).It is seen that the QBER from our experiment lies well below the theoretical bounds and hence it is sufficient for proof of security.