Experimental quantum cryptography with qutrits

We produce two identical keys using, for the first time, entangled trinary quantum systems (qutrits) for quantum key distribution. The advantage of qutrits over the normally used binary quantum systems is an increased coding density and a higher security margin. The qutrits are encoded into the orbital angular momentum of photons, namely Laguerre–Gaussian modes with azimuthal index l + 1, 0 and −1, respectively. The orbital angular momentum is controlled with phase holograms. In an Ekert-type protocol the violation of a three-dimensional Bell inequality verifies the security of the generated keys. A key is obtained with a qutrit error rate of approximately 10%.

The wish to protect information from unauthorized listeners has driven humans from early mankind on to invent all sorts of cryptographic schemes and encryption algorithms. The modern computer age has made the security need as important and the difficulty of breaking classical algorithm-based cryptography as easy as never. In the last decades of the 20th century, cryptography schemes were proposed where the security relies on the laws of quantum mechanics [1]- [4]. An intruder trying to listen in will always be detected. Because these schemes establish identical secret keys in two remote locations they have since become known under the term quantum key distribution (QKD). QKD has been experimentally performed using all sorts of 2 Institute of Physics ⌽ DEUTSCHE PHYSIKALISCHE GESELLSCHAFT systems, applying various protocols, over distances of up to 120 km [5]- [8]. These experiments are performed in the lab as well as in real-life environments, such as the nightly sky of a metropolitan city [9]- [11]. Even a secure bank transfer has been performed [12] and commercial prototype systems are already available, which underlines the need and usefulness of QKD systems.
All experiments performed so far were based on two-dimensional quantum systems (qubits). Only in recent years noteworthy research efforts have been put into higher-dimensional quantum systems (qudits), in particular multi-dimensional entanglement. Especially their application in tests of quantum nonlocality and quantum information processing have attracted substantial interest [13]- [18]. For quantum cryptography the usage of higher-dimensional systems offers advantages such as an increased level of tolerance to noise at a given level of security and a higher flux of information compared to the qubit cryptography schemes. In general a QKD protocol is considered secure as long as the mutual information of the two parties A and B exchanging the key is greater than the mutual information of A and E (or B and E), where E is an eavesdropper. The possible mutual information of an eavesdropper with one of the observers is strictly related to the noise rate of the protocol and therefore an upper noise bound for a secure key distribution can be found. For the BB84 and the Ekert qubit schemes the limit on the noise ratio is 14.6% [19], which may be slightly improved with alternative qubit schemes, e.g. using the full set of d + 1 mutually unbiased bases (MUBs) [20]. In contrast, for three-dimensional quantum systems (qutrits) the noise may be as high as 22.5% [21] for the Ekert-based protocol. Furthermore, because a larger alphabet is used, each system contains more information than a two-dimensional one. 5 Here we present QKD using entangled qutrits in an extended Ekert scheme [4], similar to the first QKD experiment with entangled qubits, performed by Jennewein et al [22]. The security of the keys obtained is thereby confirmed by violating a three-dimensional Bell-type inequality.
In the present work, the qutrits are encoded into the orbital angular momentum (OAM) of photons in the Laguerre-Gaussian modes LG p,l , which are the solution of the paraxial wave equation in its cylindrical coordinate representation. The index p represents the number of radial nodes and the index l is the winding number, with 2πl describing the change in phase on a closed path around the propagation axis. Thus a mode with p = l = 0 is a Gaussian mode. Throughout this paper we only consider photons with p = 0, which span an infinite-dimensional Hilbert space.
It has been experimentally shown [23,24], and was later theoretically confirmed [25,26], that in the process of parametric down-conversion the orbital angular momentum is conserved for each individual pump photon if all beams are collinear. Moreover, it has been demonstrated [23] that the down-converted photons are in an entangled state with respect to the OAM, which can be transformed into the maximally entangled state using local filtering [27]. Therefore, using a pump beam with a Gaussian profile one can obtain the maximally entangled state Here |1 is the LG 0,1 mode, |2 the LG 0,−1 mode and |0 the Gaussian mode LG 0,0 . Such a maximally entangled state can violate a three-dimensional Bell-type 3 Institute of Physics ⌽ DEUTSCHE PHYSIKALISCHE GESELLSCHAFT inequality [28,29] and therefore local realism: with being the probabilities that the outcomes of observers A and B measuring A a and B b differ by k (modulo 3). The observables A 1 , A 2 and B 1 , B 2 correspond to different local analyser settings. Note, that the local realistic bound for inequality (2) is the same as for the standard CHSH inequality [30]. The maximal violation for the maximally entangled state is S max It is interesting to note that for certain non-maximally entangled states quantum mechanics predicts an even higher violation, i.e. S non−max [31]. The violation of (2) has been experimentally shown by Vaziri et al [32].
To realize QKD based on an extended three-dimensional Ekert scheme, the observers A and B randomly switch between three settings of their transformation holograms. A 1 , A 2 (B 1 , B 2 ) are the settings to maximally violate inequality (2) (and therefore check the security of the protocol) and A 3 , B 3 are settings leading to perfect correlations and therefore are used for key production. A and B choose their settings independently and at random and also record their photon detections independently. After sufficiently many measurement runs A and B compare their hologram settings. One-ninth of the produced data can be used for the key, while 4/9 of the data are for the violation of the Bell inequality and the remaining 4/9 have to be discarded. After this basis reconciliation B publicly announces his data for the Bell inequality check, and A computes the value of S 3 . In the case that S 3 > 2, the key is secure and an eavesdropper will not have gained any useful information on the key. 6 In our experimental setup (figure 1) we pump a type-I 1.5 mm thick β-barium-borate (BBO) crystal with an Ar + laser at 351 nm. The optical pump power is approximately 95 mW and the pump laser is vertically polarized. Via spontaneous parametric down-conversion (SPDC) pairs of photons entangled in orbital angular momentum are produced. To ensure indistinguishability, only the energy-degenerate photons are selected via narrow band filters in fibre-coupled air gaps. The produced state is almost maximally entangled, with effective coefficients α = 0.642 ± 0.009, β = 0.546 ± 0.009 and γ = 0.539 ± 0.009, which are calculated from the observed coincidence count rates for A 3 and B 3 .
In order to produce and control the LG modes we use transmission phase hologramsdiffraction gratings which are interference patterns of an LG 0,1 mode with a plane wave [33,34]. The holograms etched into quartz glass are 3 mm×3 mm, have a periodicity of 30 µm, and their first-order diffraction efficiency at 702 nm is approximately 80%. If a beam passes such a hologram, an LG 0,0 is, in the first diffraction order, transformed into an LG 0,1 mode. 7 If the hologram is slightly horizontally displaced, a superposition of the two modes is obtained, with the respective amplitudes being a function of the displacement [23]. By inverting the beam direction the transformation process of the hologram is also inverted and an LG 0,1 is transformed into an LG 0,0 . With these holograms it is possible to create different superpositions of LG modes necessary for a test of Bell's inequality and for our cryptographic scheme [35].
To transform the state of the entangled photons, a pair of holograms is placed in each down-conversion arm (see figure 1). These transformations approximate ladder-operations, i.e. one is a +1 and the other a −1 operation. Superpositions of the three LG modes (LG 0,0 , LG 0,1 and LG 0,−1 ) with different relative amplitudes and phases can be produced by displacing the individual holograms with step motors. Observers A and B now choose the right positions of their holograms and can then violate inequality (2).
For the analysis of the different LG modes the beams first pass a 2 : 1 and then a 1 : 1 beam splitter, hence equally splitting them into three parts. Each one of the resulting beams passes a hologram and is then coupled into a single-mode fibre. Two of the holograms are aligned such that they transform an LG 0,1 (LG 0,−1 ) mode into an LG 0,0 mode. The third hologram is off-centred, and therefore leaves the modes untransformed. Since only the LG 0,0 has substantial overlap with the fibre mode this arrangement acts as a probabilistic mode analyser with 1/3 probability of success. The probabilistic nature of the analysers is equivalent to a reduced detection efficiency but otherwise leads to no additional security loopholes. In order to find the optimal settings for the violation of the Bell inequality each of the analyser holograms was displaced by ±1.2 mm from the beam centre in 16 equal steps. For every one of the 83521 (17 4 ) combinations of analyser settings all nine coincidences and the single count rates were integrated over 5 s and written to a file. The data was finally analysed to check for any violation of inequality (2). The maximal value we found for S 3 was 2.825 ± 0.052, which is a violation by approximately 16 standard deviations. The respective settings in millimeters from the beam centre were 1.05, 0.75 (hologram 1), 1. The communication partners A and B had two different, completely independent, computers and logics measuring their respective count rates. They only identified coincidences with the help of synchronization signals. If they registered both, the signal from the other side and a local detection, one entry, 0, 1 or 2 depending on the result of the local detectors, was stored locally in a computer file (see figure 1). Furthermore, the current setting of the transformation holograms was also written to the data file. Each measurement lasted 1 s and the step motors needed about 5 s to align. After many runs the data were analysed by comparing the bases.

Institute of Physics ⌽ DEUTSCHE PHYSIKALISCHE GESELLSCHAFT
The Bell parameter was S 3 = 2.688 ± 0.171, which represents a clear violation of local realism. This ascertained the security of the protocol. We extracted keys of a length of 150 trits for A and B separately (the keys are shown in figure 2). Out of the 150 trits 14 were errors, which corresponds to a quantum trit error rate (QTER) of 9.3%. This demonstrates the successful key distribution, since Bell's inequality (2) is violated and additionally the error rate is well below the maximal allowed noise ratio of 22.5%. Table 2 shows a possible communication between A and B using the key generated with the presented QKD.
We have, for the first time, realized an experimental qutrit QKD. The completely independent parties A and B produce keys secured by the violation of a three-dimensional Bell inequality by more than 4 standard deviations. The sifted keys had an error rate of approximately 10%. The effective key rate was rather low due to the slow motorized base change. This could be improved by implementing the base transformation with fast devices such as a spatial light modulator or electro-optical switches. In addition, with a biased choice of the positions of the transformation  (2), with S 3 = 2.688 ± 0.171. On the right are the keys after a classical error reduction, which is done by checking the parity of blocks of three trits and throwing away those with different parities. The final keys are reduced to a length of 72 trits and are error-free. Table 2. Encryption and decryption of a short message sent between the two partners A and B using the error-corrected key obtained via the three-dimensional QKD. Three trits are sufficient to represent each letter of the alphabet plus the space character. An eavesdropper trying to intercept the message only gets random characters and hence cannot obtain any information on the original text, whereas observer B uses his key to decypher the original message. holograms, the key production rate could be further increased. An additional challenge is the distortion-free transmission of OAM-encoded photons over large distances. The possibilities of free-space and fibre links are still under investigation, since atmospheric turbulences and mode crosstalk in fibres have to be overcome. Gibson et al [36] already demonstrated a free-space link of photons with OAM over a distance of 15 m. Alternatively, encoding higher dimensions into other degrees of freedom of photons, such as time bins [37], or as suggested by Chen et al [38] using the four-dimensional entangled states recently realized by [14,18], might also be considered, as they can be transported in fibre or free-space over long distances. For cryptography schemes based on single qutrits, similar to the BB84 scheme, transformations between MUBs are required. With our holographic OAM scheme it is certainly possible to do such transformations and a protocol of this type is currently under investigation. In contrast to the polarization degree of freedom, in principle there is no limitation on the dimension of the two photon entanglement and therefore an extension of the qutrit to a more general qudit case seems feasible.