# Quantum Digital Signatures with Random Pairing

Ji-Qian Qin  State Key Laboratory of Low Dimensional Quantum Physics,
Department of Physics,
Tsinghua University, Beijing 100084, China  Cong Jiang  State Key Laboratory
of Low Dimensional Quantum Physics, Department of Physics,
Tsinghua University, Beijing 100084, China  Jinan Institute of Quantum
technology, SAICT, Jinan 250101, China  Yun-Long Yu  State Key Laboratory of
Low Dimensional Quantum Physics, Department of Physics,
Tsinghua University, Beijing 100084, China  Xiang-Bin Wang
<EMAIL_ADDRESS>State Key Laboratory of Low Dimensional Quantum
Physics, Department of Physics,
Tsinghua University, Beijing 100084, China  Jinan Institute of Quantum
technology, SAICT, Jinan 250101, China  Shanghai Branch, CAS Center for
Excellence and Synergetic Innovation Center in Quantum Information and Quantum
Physics, University of Science and Technology of China, Shanghai 201315, China
Shenzhen Institute for Quantum Science and Engineering, and Physics
Department, Southern University of Science and Technology, Shenzhen 518055,
China  Frontier Science Center for Quantum Information, Beijing, China

###### Abstract

Digital signatures can guarantee the unforgeability and transferability of the
message. Different from classical digital signatures, whose security depends
on computational complexity, quantum digital signatures (QDS) can provide
information-theoretic security. We propose a general method of random pairing
QDS (RP-QDS), which can drastically improve QDS efficiency. In a way, our
random pairing method provide a tightened result of security level of QDS. In
the method, the parity value of each pair is used for the outcome bit value.
We present general formulas for fraction of untagged bits and error rates of
the outcome bits. Random pairing can be applied as a fundamental method to
improve the QDS efficiency for all existing quantum key distribution (QKD)
protocols. We take sending-or-not-sending (SNS) QDS and side-channel-free
(SCF) QDS as examples to demonstrate the advantage of random pairing through
numerical simulation. Similar advantage with random pairing is also founded
with decoy-state MDIQKD and also decoy-state BB84 protocol. We study the RP-
SNS-QDS with finite data size through novel optimization. The numerical
simulation results show that the signature rate can be increased by more than
$100\%$ under noisy channel using our random pairing method.

##  I Introduction

Digital signatures can guarantee classical messages to be securely exchanged
from one signer to multiple receivers Diffie and Hellman (1976). Classical
digital signatures include signature and verification algorithms and the
security is based on computational complexity. In contrast, quantum digital
signatures (QDS) Gottesman and Chuang (2001) can provide a higher level of
security, information-theoretic security, which is guaranteed by the
fundamental principles of quantum mechanics. Potentially, QDS is practically
useful because the original assumptions of quantum memory and secure quantum
channel have been removed Andersson  _et al._ (2006); Dunjko  _et al._ (2014);
Amiri  _et al._ (2016); Yin  _et al._ (2016a). Actually, a lot of experimental
demonstrations have been done for QDS Collins  _et al._ (2014); Donaldson  _et
al._ (2016); Croal  _et al._ (2016); Yin  _et al._ (2017); Roberts  _et al._
(2017); Zhang  _et al._ (2018); Ding  _et al._ (2020) in applications such as
emails, financial transactions, and more Pirandola  _et al._ (2020).

In this work, we mainly consider the protocol with one signer (Alice) and two
receivers (Bob and Charlie). It should be noted that, in the three-party
protocol, at most one party can be dishonest. Because if there are two
dishonest parties, it is easy to cheat on the third party through collusion.
The security in QDS means that the message has unforgeability and
transferability Gottesman and Chuang (2001). A successful forgery means that
anyone other than Alice can produce a signature which is accepted by
receivers. Transferability (or nonrepudiation) means that if one honest
receiver accepts the signature generated by Alice, the other honest receiver
will also accept this signature. The QDS protocols Wallden  _et al._ (2015);
Amiri  _et al._ (2016); Puthoor  _et al._ (2016) usually have two stages: the
first is the distribution stage, where Alice-Bob and Alice-Charlie
independently perform key generation protocol (KGP) to generate the correlated
bit strings for signature; the second is the messaging stage, where the
message is signed and verified.

Given the prior art theory Amiri  _et al._ (2016), the quantum communication
of any quantum key distribution (QKD) protocol can be directly applied for QDS
through taking the post data processing on the raw bits there. Given the
quantum part of various QKD protocols, for example, the BB84 Bennett and
Brassard (2014), the decoy-state BB84 Hwang (2003); Wang (2005); Lo  _et al._
(2005); Boaron  _et al._ (2018), the measurement-device-independent (MDI) QKD
Lo  _et al._ (2012); Braunstein and Pirandola (2012); Wang (2013); Zhou  _et
al._ (2016); Yin  _et al._ (2016b), sending-or-not-sending (SNS) Wang  _et
al._ (2018) of twin-field (TF) QKD Lucamarini  _et al._ (2018) and so on, we
can apply the existing post data processing method Amiri  _et al._ (2016) for
QDS. Yet, it is still an interesting problem to find novel post data
processing method to improve the QDS efficiency. Here in this work, we propose
such a method, the novel method of random pairing QDS (RP-QDS). The method can
be applied to all existing QKD protocols and improve the QDS efficiency
drastically. In real situations, the data size is always finite. We consider
RP-SNS-QDS with finite pluses and optimize the signature rate with finite data
size.

##  II Iteration relation of random pairing

Compared with other QDS protocols, the biggest difference of our protocol is
that the step of random pairing is applied in the KGP, which can effectively
improve the signature efficiency.

As shown in Fig. 1, there are quantum channels (solid lines) between each
party (Alice, Bob and Charlie) and the relay Eve, and there are authenticated
classical channels (dashed lines) between each two of parties. It should be
noted that in the KGP, depending on the needs of specific protocols, such as
MDI-QDS Puthoor  _et al._ (2016), a relay Eve can be added, who can be un-
trusted. In our protocol, Alice is a signer and Bob and Charlie are two
receivers. Alice can sign the message and send it with signature to two
receivers for verification.

Figure 1: Schematic of quantum digital signature Puthoor  _et al._ (2016); Yin
_et al._ (2017); Zhang  _et al._ (2021). Our random pairing method can be
directly used in the existing quantum digital signature protocols. Alice can
sign the message and send it with the signature to Bob and Charlie for
verification. Eve is a relay and can be un-trusted. Solid lines and dashed
lines represent quantum channels and authenticated classical channels,
respectively.

We need to determine the bit-flip error rate and phase phase-flip error rate
of the bit string after random pairing to choose the length of the signature
string, which can affect the security level and efficiency of the protocol.

In the KGP of distribution stage after error test, Alice and Bob obtain the
$N_{t}$-bit string $z_{A}$ and $z_{B}$ with bit-flip error rate $E$ (error
rate in $Z$ basis) and phase-flip error rate $e^{\mathrm{ph}}$ (error rate in
$X$ basis). They take the random pairing and use the parity values of the bit
pairs as the outcome of each pairs. The outcome bits make new bit strings
$z_{A}^{\prime}$ and $z_{B}^{\prime}$ at each sides with each of them
containing $N_{t}/2$ bits. They use the new bit strings $z_{A}^{\prime}$ and
$z_{B}^{\prime}$ for signature. We can list the following steps for the
method: 1, After KGP with error test, they obtain $N_{t}$ raw bits. Bob
randomly pairs his bits and asks Alice to take the same pairing. 2, They use
the parity value of each pairs as the outcome bits. For example, suppose a
pair containing bit $i$ and bit $j$ in the initial string $z_{A}$ ($z_{B}$)
with bit values $z_{A,i}$ and $z_{A,j}$ ($z_{B,i}$ and $z_{B,j}$). Bob (Alice)
uses parity value $z_{B,i}\oplus z_{B,j}$ ($z_{A,i}\oplus z_{A,j}$) for the
outcome bit value, where notation $\oplus$ denotes bit addition modulo $2$ and
$i,j\in\\{1,2,\dots,N_{t}\\}$, $i\neq j$. After this step they obtain
$N_{t}/2$ outcome bits. 3, They calculate the phase error rate of those
$N_{t}/2$ outcome bits, test their bit-flip error rate and use them for QDS.

After random pairing, the number of effective bits $N_{t}^{\prime}$ becomes
half of the original

$\begin{split}&N_{t}^{\prime}=\frac{1}{2}N_{t},\\\ \end{split}$ (1)

where $N_{t}$ represents the number of effective bits before random pairing.
Without loss of generality, we always assume $N_{t}$ to be an even number.

The bit-flip error rate $E^{\prime}$ for the $N_{t}^{\prime}$ outcome bit
string after random pairing can be tested directly. When only one of the
paired bits in original bit string has an error, the new bit made up of their
parity value will have an error. So the expected value for bit flip error rate
$E^{\prime}$ of new bit strings is

$\begin{split}&E^{\prime}=2E(1-E),\\\ \end{split}$ (2)

where $E$ represents the bit flip error rate before random pairing. Note that
the bit-flip error of the outcome bits after random pairing is supposed to be
tested directly in our protocol as shown later. Eq. (2) above is the
expected[tation value] result used for numerical simulation.

The untagged bit in new bit string is generated by pairing two untagged bits
or one untagged bit with one tagged bit in original bit string, so the
proportion $\Delta_{\mathrm{un}}^{\prime}$ of untagged bits (which are defined
in specific QDS protocols in next section) after random pairing is

$\begin{split}&\Delta_{\mathrm{un}}^{\prime}=\Delta_{\mathrm{un}}^{2}+2\Delta_{\mathrm{un}}(1-\Delta_{\mathrm{un}}),\\\
\end{split}$ (3)

where $\Delta_{\mathrm{un}}$ represents the proportion of untagged bits before
random pairing.

Figure 2: The phase flip error rate after random pairing. Notations ”un
$\oplus$ un” and ”un $\oplus$ tag” represent two untagged bits are paired and
one untagged bit and one tagged bit are paired, respectively.

As shown in Fig. 2, we analyze the phase flip error rate after the random
pairing in two cases: one is two untagged bits are paired with probability
$\Delta_{\mathrm{un}}^{2}$, the other is one untagged bit and one tagged bit
are paired with probability $2\Delta_{\mathrm{un}}(1-\Delta_{\mathrm{un}})$.

Figure 3: The CNOT operation in $Z$ basis is equivalent to the inverse CNOT
operation in $X$ basis Gottesman and Lo (2003).  Figure 4: The bilateral CNOT
operations on two entanglement pairs, entanglement pair $\mathbb{1}$ and
entanglement pair $\mathbb{2}$, in the virtual protocol. The qubit $1$ and $2$
belong to Alice and the qubit $1^{\prime}$ and $2^{\prime}$ belong to Bob.

When one untagged bit and one tagged bit are paired, the phase flip error rate
is

$\tilde{e}^{\mathrm{ph}}=e^{\mathrm{ph}}.$ (4)

For the iteration formulas of phase error for the outcome bits from pairs
containing two untagged bits, we consider the virtual protocol using quantum
entanglement. In the real protocol, there is a pair containing two untagged
bits, bit $1$ with bit value $a_{1}$ and bit $2$ with bit value $a_{2}$. As
shown in Fig. 3, the classical operation of $a_{1}\oplus a_{2}$ in the real
protocol is equivalent to the CNOT operation in $Z$ basis on the two qubits,
qubit $1$ and qubit $2$ in the pair. This is also equivalent to the CNOT
operation in $X$ basis with the target bit and control bit reversed Gottesman
and Lo (2003). After this operation, qubit $2$ is discarded and qubit $1$ is
used for further processing.

The CNOT operation above corresponds to bilateral CNOT operations on two
entanglement pairs in the virtual protocol as shown in Fig. 4. Consider the
corresponding virtual protocol using quantum entanglement in Fig. 4. After the
bilateral CNOT operations, the phase error of the entanglement pair
$\mathbb{2}$ is determined by the number of initial phase errors of those two
entanglement pairs, i.e., $0$ or $2$ phase errors will not cause any phase
error in entanglement pair $\mathbb{2}$, while $1$ phase error will cause one
error of the entanglement pair $\mathbb{2}$. This fact means after the
bilateral CNOT operations, through observing the phase error information of
the entanglement pair $\mathbb{2}$, we can classify entanglement pair
$\mathbb{1}$ by two different phase error rates. One is

$\begin{split}&\tilde{e}_{1}^{\prime\mathrm{ph}}=\frac{(e^{\mathrm{ph}})^{2}}{(e^{\mathrm{ph}})^{2}+(1-e^{\mathrm{ph}})^{2}},\end{split}$
(5)

if there isn’t any phase error in the entanglement pair $\mathbb{2}$ after the
bilateral CNOT operations; the other is

$\tilde{e}_{2}^{\prime\mathrm{ph}}=\frac{1}{2},$ (6)

if there is a phase error in the entanglement pair $\mathbb{2}$. In the real
protocol, all these entanglements and CNOT operations are not needed. We
simply use Eq. (5) and Eq. (6) for phase error iteration after random pairing.

Based on the above analysis, we can obtain the asymptotic length $l$ of the
key after error correction and privacy amplification in QKD with random
pairing,

$\begin{split}l=&N_{t}^{\prime}\big{\\{}\Delta_{\mathrm{un}}^{\prime}-\Delta_{\mathrm{un}}^{2}\big{[}p_{1}H(\tilde{e}_{1}^{\prime\mathrm{ph}})+(1-p_{1})H(\tilde{e}_{2}^{\prime\mathrm{ph}})\big{]}-\\\
&2\Delta_{\mathrm{un}}(1-\Delta_{\mathrm{un}})H(e^{\mathrm{ph}})\big{\\}}-fN_{t}^{\prime}H(E^{\prime}),\\\
\end{split}$ (7)

where $H(x)=-x\log_{2}x-(1-x)\log_{2}(1-x)$ is the binary Shannon entropy
function; $p_{1}=(e^{\mathrm{ph}})^{2}+(1-e^{\mathrm{ph}})^{2}$ and $f$ is the
error correction coefficient and usually in the range of $1.1$ to $1.2$.

###### Remark 1

The KGP of QDS does not need the steps of error correction and private
amplification, because the definition of security in QDS is different from
that of QKD Amiri  _et al._ (2016); Puthoor  _et al._ (2016).

###### Remark 2

The RP method in this work is to use the parity of two bits for one new
outcome bit, there is no post-selection, no need of two-way classical
communication. The method here is to reduce the phase-flip error while the
bit-flip rises. The AOPP method in our earlier work Xu  _et al._ (2020) takes
parity check of two bits and then discard one bit and use the other bit for
the surviving pair, discard both bits in the pair that has not passed the
parity check. There is a post-selection and two-way classical communication is
needed. The AOPP method there is to reduce the bit-flip error by iteration,
while the phase-error there rises.

##  III Applications

Our major idea of random pairing together with its iteration formulas Eqs.
(2-6) for error rates after random pairing applies for all QKD protocols for
QDS task, here we take two important protocols to show the advantages of
random pairing. One is the well known SNS Wang  _et al._ (2018) protocol,
which has been experimentally demonstrated by a number of experiments
recently, including the first TF-QKD experiment with real setup Liu  _et al._
(2019), the experiment over a secure distance of 509 km Chen  _et al._ (2020),
which is the first TF-QKD exceeding a secure distance of 500 km with MDI
security, the experiments over 550 km and 600 km Pittaluga  _et al._ (2021),
and very importantly, the field tests over 428 km Liu  _et al._ (2021) and 511
km Chen  _et al._ (2021). We shall show how to apply our random pairing method
to the SNS protocol to achieve quantum digital signature, i.e., RP-SNS-QDS.
Moreover, we shall also take our random pairing method to SCF-QKD proposed by
Wang et al. Wang  _et al._ (2019) for RP-SCF-QDS. Numerical simulation shows
clearly the significant advantages of random pairing in QDS to improve the
signature efficiency.

We show the flow chart of our RP-QDS protocol in Fig. 5.

Figure 5: The flow chart of our RP-QDS protocol, which has two stages, the
first is the distribution stage including RP-KGP and symmetrization; the
second is the messaging stage, where the message is signed and verified. The
details are introduced in the main text.

###  III.1 RP-SNS-QDS

####  III.1.1 Distribution stage

The RP-SNS-KGP of Alice-Bob is the same as that of Alice-Charlie and they can
be done simultaneously. We take RP-SNS-KGP of Alice-Bob as an example.

(1) In each time window, Alice and Bob randomly choose the signal window with
probability $p_{z}$ and the decoy window with probability $1-p_{z}$.

In the signal window, Alice (Bob) decides to send Eve the phase-randomized
coherent state of intensity $\mu$ with the probability of $q$ and writes down
the classical bit value $1$ ($0$); Alice (Bob) decides to not send this phase-
randomized coherent state, that is, send the vacuum state to Eve, with the
probability of $1-q$ and writes down the classical bit value $0$ ($1$). In the
decoy window, Alice (Bob) randomly sends weak coherent state
$|\sqrt{\mu_{k}}e^{\imath\delta_{k}}\rangle$, $k=1,2,\dots$, with probability
$p_{1},p_{2},\dots,$ to Eve, where $\delta_{k}$ is random in $[0,2\pi)$.

(2) Eve uses a beam splitter to make measurements and announces the
measurement outcome in each time window.

###### Definition 1

(Effective events, effective bits and effective windows in RP-SNS-QDS).
Effective events are the events where one and only one detector clicks. The
bits and time windows corresponding to effective events are called effective
bits and effective windows, respectively.

###### Definition 2

(${Z}$ window, $\tilde{X}$ window in RP-SNS-QDS). The ${Z}$ window includes
all events when both parties (Alice and Bob) choose the signal window. If both
parties choose the decoy window, it is an $\tilde{X}$ window.

###### Definition 3

(Untagged bits in RP-SNS-QDS). The effective bits of single-photon states in
$Z$ windows where one party (between Alice and Bob) decides to send and the
other party decides not to send are untagged bits.

(3) Using the decoy state method, the proportion of untagged bits and the
phase flip error rate can be estimated. These effective bits used for
parameter estimation are discarded. After this, Alice and Bob obtain the
associated bit strings $z_{A}$ and $z_{B}$, each one of length $N_{t}$, which
are effective bits in $Z$ windows. Instead of directly applying this data for
QDS Amiri  _et al._ (2016); Puthoor  _et al._ (2016); Zhang  _et al._ (2021),
here they make random pairing to generate outcome bit strings $z_{A}^{\prime}$
and $z_{B}^{\prime}$ for signature. They test the bit-flip error rate
$E^{\prime}$ for their outcome bit strings. They also compute parameter values
requested for QDS, such as phase flip error rate for the outcome bit strings.
Details are shown later around Eq.(13). The bit strings generated by RP-SNS-
KGP between Alice and Bob forms outcome bit string with length of
$N_{t}^{\prime}$.

(4) Alice and Charlie perform the same steps above to generate a pair of
associated bit strings for signature.

(5) For each possible one-bit message $m=0$ or $1$, Alice and Bob (Alice and
Charlie) select outcome bit strings for signature, which are $S_{0}^{B}$,
$S_{1}^{B}$ for Alice and $K_{0}^{B}$, $K_{1}^{B}$ for Bob ($S_{0}^{C}$,
$S_{1}^{C}$ for Alice and $K_{0}^{C}$, $K_{1}^{C}$ for Charlie), each one of
length $\mathcal{L}$. The subscript $m$ of $S_{m}^{p}$ and $K_{m}^{p}$
represents the message $m$ that needs to be signed and the superscript
$p\in\\{B,C\\}$ indicates that the bit string is generated by Alice in
collaboration with the receiver Bob or Charlie.

(6) Bob and Charlie symmetrize their bit strings $K_{m}^{B}$ and $K_{m}^{C}$.
Bob and Charlie randomly select $K_{m}^{B,\mathrm{s}}$ and
$K_{m}^{C,\mathrm{s}}$ of length $\mathcal{L}/2$ and send these bit values and
their corresponding positions to each other, respectively. The remaining bits
$K_{m}^{B,\mathrm{k}}$ and $K_{m}^{C,\mathrm{k}}$ of length $\mathcal{L}/2$
are kept locally. The superscript $\mathrm{s}$ of $K_{m}^{p,\mathrm{s}}$
represents the bits sent to each other and the superscript $\mathrm{k}$ of
$K_{m}^{p,\mathrm{k}}$ represents the bits kept locally. The symmetrized bit
strings held by Bob and Charlie are recorded as $S_{m}^{\prime
B}=(K_{m}^{B,\mathrm{k}},K_{m}^{C,\mathrm{s}})$ and $S_{m}^{\prime
C}=(K_{m}^{B,\mathrm{s}},K_{m}^{C,\mathrm{k}})$ of length $\mathcal{L}$,
respectively.

####  III.1.2  Messaging stage

(1) Alice sends the message $m$ along with the signature
$\mathrm{Sig}_{m}=\left(S_{m}^{B},S_{m}^{C}\right)$ with length of
$2\mathcal{L}$ to one desired receiver, for example, Bob.

(2) Bob determines whether to accept the message $m$ or not by comparing
$\mathrm{Sig}_{m}$ with his bit string $S_{m}^{\prime B}$. If two parts, one
is the comparison between $K_{m}^{B,\mathrm{k}}$ and the corresponding bits of
$S_{m}^{B}$, and the other is the comparison between $K_{m}^{C,\mathrm{s}}$
and the corresponding bits of $S_{m}^{C}$, both have a mismatch rate less than
$s_{a}$ ($<1/2$), then Bob accepts the message. Otherwise, Bob rejects the
message.

(3) Bob forwards the $(m,\rm{Sig}_{m})$ he received from Alice to Charlie.

(4) Charlie makes a similar comparison to determine whether to accept the
message $m$ or not. If the mismatch rates of two parts, one is the comparison
between $K_{m}^{B,\mathrm{s}}$ and the corresponding bits of $S_{m}^{B}$, and
the other is the comparison between $K_{m}^{C,\mathrm{k}}$ and the
corresponding bits of $S_{m}^{C}$, are less than $s_{v}$
($0<s_{a}<s_{v}<1/2$), then Charlie accepts the message. Otherwise, Charlie
rejects the message.

###  III.2 RP-SCF-QDS

The SCF-QDS protocol does not require switching physical bases to modulate the
states differently. So it is not only immune to all attacks in the side-
channel space of source-states but also retains the security of measurement-
device-independence.

The difference between RP-SCF-QDS and RP-SNS-QDS is the KGP in distribution
stage. Here we list the different steps. The RP-SCF-KGP of Alice-Bob is the
same as that of Alice-Charlie and they can be done simultaneously. Here, we
take the RP-SCF-KGP between Alice and Bob as an example.

(1) In each time window, Alice (Bob) prepares a coherent state
$|\alpha_{A}\rangle$ ($|\alpha_{B}\rangle$) and announces it,

$\begin{split}&|\alpha_{A}\rangle=e^{-\mu/2}\sum_{n=0}^{\infty}\frac{\mu^{n/2}}{\sqrt{n!}}e^{\imath\gamma_{A}}|n\rangle,\\\
&|\alpha_{B}\rangle=e^{-\mu/2}\sum_{n=0}^{\infty}\frac{\mu^{n/2}}{\sqrt{n!}}e^{\imath\gamma_{B}}|n\rangle,\\\
\end{split}$ (8)

where $\mu$ is the intensity of the coherent state; $\gamma_{A}$
($\gamma_{B}$) is the global phase and $\imath$ is the imaginary unit.

Alice (Bob) decides to send Eve the coherent state $|\alpha_{A}\rangle$
($|\alpha_{B}\rangle$) with the probability of $q$ and writes down the
classical bit value $1$ ($0$); Alice (Bob) decides to not send the coherent
state $|\alpha_{A}\rangle$ ($|\alpha_{B}\rangle$), that is, sends the vacuum
state to Eve, with the probability of $(1-q)$ and writes down the classical
bit value $0$ ($1$).

(2) Eve uses a beam splitter to make measurements and announces the
measurement outcome in each time window. The definitions of effective event,
effective bits and effective windows are the same as those in RP-SNS-QDS.

###### Definition 4

($\tilde{Z}$ window, $\mathcal{B}$ window and $\mathcal{O}$ window in RP-SCF-
QDS). A time window when one party (between Alice and Bob) decides to send the
coherent state and the other party decides to not send the coherent state is
$\tilde{Z}$ window. A time window when both parties decide to send the
coherent state or when both parties decide to not send the coherent state is
$\mathcal{B}$ window or $\mathcal{O}$ window.

###### Definition 5

(Untagged bits in RP-SCF-QDS). The effective bits in $\tilde{Z}$ window are
untagged bits.

(3) In all time windows, Alice and Bob choose two random subsets $v$ and $u$
through classical communication. The subset $v$ is used to test the bit-flip
error rate. They can use the data in the subset $v$ to estimate the bounds of
some quantities in the subset $u$ to obtain the upper bound of the phase-flip
error rate. These efficient bits used for parameter estimation are discarded.
After Alice and Bob obtain the associated bit strings with the length of
$N_{t}$, they make random pairing and use the parity values of the bit pairs
as the new bit string for signature. They test the bit-flip error rate
$E^{\prime}$ for their outcome bit strings and calculate phase flip error rate
for the outcome bit strings. Details are shown later around Eq.(13). The bit
strings generated by RP-SCF-KGP have the length of $N_{t}^{\prime}$.

The step (4)-(6) of distribution stage and the step (1)-(4) of the messaging
stage are the same as those in RP-SNS-QDS.

We use the quantum communication of SCF-QKD Wang  _et al._ (2019) to generate
the associated bit strings for signature and the subsequent steps of RP-SCF-
QDS can be regarded as the post data processing. By adopting the security
analysis method of SCF-QKD Wang  _et al._ (2019), we can also demonstrate that
our RP-SCF-QDS is immune to all attacks in the side-channel space of emitted
photons and measurement-device independent.

###  III.3 Others

Straightly, the RP method can also be applied for decoy-state MDIQKD Wang
(2013); Zhou  _et al._ (2016) and decoy-state BB84 Hwang (2003); Wang (2005);
Lo  _et al._ (2005); Boaron  _et al._ (2018) protocol: after quantum
communication stage of this protocols, we can find the bit-flip error rate,
verify the single-photon phase-flip error rate and the number of untagged bits
by decoy-state analysis. We then calculate the single-photon phase-flip rate
and number of untagged after RP by iteration formulas Eqs. (2)-(6) and then
QDS can be done with these. The bit-flip error rate after RP can be actually
tested directly in a real protocol, though it can also be calculated.

It should be noted that the step of random pairing can be moved to messaging
stage of our protocol. That is, there is no change in distribution stage,
Alice and Bob (Alice and Charlie) just perform KGP in the standard way Amiri
_et al._ (2016): Alice sends out the bits from quantum communication of QKD
(without random pairing) to generate associated bit strings and Bob and
Charlie symmetrize their bit strings. In messaging stage, Bob (Charlie)
performs random pairing for the bit strings sent by Alice and the bit strings
held locally. Bob (Charlie) determines whether to accept the message based on
the comparison results of the outcome bit strings. From this point of view,
the method of random pairing can provide a tightened result for the security
level of QDS. For conciseness, here we shall only consider the method
introduced earlier before Eq. (1), where Alice did the random pairing in
distribution stage.

To test security, we need bound values of a number of parameters. In what
follows, we will show how to work out all these values reliably and make a
quantitative security analysis.

##  IV Security Analysis

The security level of quantum digital signature protocol is $\varepsilon$
Amiri  _et al._ (2016), if

$\varepsilon=\max\\{P_{\mathrm{ro}},P_{\mathrm{fo}},P_{\mathrm{re}}\\},$ (9)

where $P_{\mathrm{ro}}$ represents the probability of an honest run aborting;
$P_{\mathrm{fo}}$ and $P_{\mathrm{re}}$ represent the probability of forging
and repudiation, respectively.

Robustness. Bob rejects a message that is signed by Alice when at least one
mismatch rate is greater than $s_{a}$ (one is the comparison between
$K_{m}^{B,\mathrm{k}}$ and the corresponding bits of $S_{m}^{B}$, and the
other is the comparison between $K_{m}^{C,\mathrm{s}}$ and the corresponding
bits of $S_{m}^{C}$). Therefore, $P_{\mathrm{ro}}$ is associated with the
error rate of parameter estimation of two parts, one ($\varepsilon_{1}$) is
related to the outcome bit string generated by RP-KGP between Alice and Bob,
the other ($\varepsilon_{2}$) is related to the outcome bit string generated
by RP-KGP between Alice and Charlie,

$P_{\mathrm{ro}}\leq\varepsilon_{1}+\varepsilon_{2}.$ (10)

In the asymptotic case, $\varepsilon_{1}=\varepsilon_{2}=0$, thus
$P_{\mathrm{ro}}=0$.

Unforgeability. Internal parties (Bob and Charlie) are more likely to succeed
in forging signatures than external parties. If one receiver (Bob) generates a
signature that is not received from Alice, but is accepted by another receiver
(Charlie), then it means a successful forgery. Based on Amiri  _et al._
(2016), in asymptotic case, the probability of forgery is

$\begin{split}&P_{\mathrm{fo}}\leq p_{\mathrm{F}}+g,\\\ \end{split}$ (11)

in which

$\begin{split}&p_{F}=\frac{1}{g}\\{2^{-\frac{\mathcal{L}}{2}[\mathcal{H}-H(\frac{2r}{\mathcal{L}})]}+\varepsilon_{e}\\},\\\
\end{split}$ (12)

and

$\begin{split}\mathcal{H}=&\Delta_{\mathrm{un}}^{\prime}-\Delta_{\mathrm{un}}^{2}\big{[}p_{1}H(\tilde{e}_{1}^{\prime\mathrm{ph}})+(1-p_{1})H(\tilde{e}_{2}^{\prime\mathrm{ph}})\big{]}-\\\
&2\Delta_{\mathrm{un}}(1-\Delta_{\mathrm{un}})H(e^{\mathrm{ph}}),\\\
\end{split}$ (13)

where $\tilde{e}_{1}^{\prime\mathrm{ph}}$ and
$\tilde{e}_{2}^{\prime\mathrm{ph}}$ are shown in Eq.(5) and Eq.(6), $g$ is the
upper bound of probability that Bob makes fewer than $r$ errors in
$K_{m}^{C,k}$ with length of $\mathcal{L}/2$ except with probability at most
$p_{F}$; $\mathcal{H}$ is obtained from the analysis in section II;
$\varepsilon_{e}$ is related to the smooth min-entropy, which is shown in Eq.
(16).

Transferability (or Nonrepudiation). The transferability of message means that
if it is accepted by one honest receiver, then it will be accepted by another
honest receiver. That is, if both honest receivers accept the message, then
the signer cannot repudiate the signature. The steps of symmetrization in
distribution stage can ensure the security against repudiation. According to
Amiri  _et al._ (2016), the probability of repudiation is

$P_{\mathrm{re}}\leq 2e^{-\frac{1}{4}(s_{v}-s_{a})^{2}\mathcal{L}},$ (14)

where $s_{a}$ and $s_{v}$ are thresholds for the two receivers to decide
whether to accept the message or not.

Thresholds $s_{a}$ and $s_{v}$. The thresholds $s_{a}$ and $s_{v}$ are
determined by the bit-flip error rate $E_{\mathcal{L}/2}$ of
$K_{m}^{p,\mathrm{k}}$ with length of $\mathcal{L}/2$ and the minimum error
rate $P_{e}$ when the eavesdropper (Bob or Charlie) guesses
$K_{m}^{p,\mathrm{k}}$ ($p\in\\{B,C\\}$, $m\in\\{0,1\\}$),

$\begin{split}&s_{a}=E_{\mathcal{L}/2}+\frac{1}{3}(P_{e}-E_{\mathcal{L}/2}),\\\
&s_{v}=E_{\mathcal{L}/2}+\frac{2}{3}(P_{e}-E_{\mathcal{L}/2}).\\\ \end{split}$
(15)

Either Bob or Charlie could be a malicious participant, for who the only
unknown bit string is the one ($K_{m}^{p,k}$ with length of $\mathcal{L}/2$)
that has not been sent in symmetrization step of distribution stage. For
example, in order to forge a signature for Charlie to accept the message, Bob
can be the eavesdropper.

In Supplemental Information, we show how to get the bit-flip error rate before
random pairing. Combined with the iteration relations, the bit-flip error rate
$E_{\mathcal{L}/2}$ after random pairing can be obtained. In the following, we
analyze how to obtain $P_{e}$.

We can use the eavesdropper’s smooth min-entropy to describe the average
probability of guessing $K_{m}^{p,\mathrm{k}}$ within a certain threshold

$\begin{split}H_{\min}^{\varepsilon_{e}}(K_{m}^{p,k}|I_{e})\geq&\frac{\mathcal{L}}{2}\mathcal{H},\\\
\end{split}$ (16)

where $\mathcal{H}$ is shown in Eq. (13) and $I_{e}$ represents all
information of the eavesdropper. Based on Amiri  _et al._ (2016), the minimum
error rate $P_{e}$ when the eavesdropper guesses $K_{m}^{p,\mathrm{k}}$ can be
obtained by

$\begin{split}&H(P_{e})=\mathcal{H},\\\ \end{split}$ (17)

where $\mathcal{H}$ is shown in Eq. (13).

Summary of parameters. Alice sends $N$ pulses in total during RP-KGP with Bob.
After the step of random pairing, Alice can generate the outcome bit strings
with length of $N_{t}^{\prime}$. In the symmetric case, Alice does the same
procedure with Charlie and generates the $N_{t}^{\prime}-$bit string for
signature. For each possible one-bit message $m=0$ or $1$, Alice’s signature
is $\mathrm{Sig}_{0}=(S_{0}^{B},S_{0}^{C})$ or
$\mathrm{Sig}_{1}=(S_{1}^{B},S_{1}^{C})$, each one of length $2\mathcal{L}$.
That is, to sign $n_{s}$ one-bit messages, where
$n_{s}=\frac{N_{t}^{\prime}}{2\mathcal{L}}$, Alice needs to send $N$ pluses
during RP-KGP with Bob. So, the signature rate Zhang  _et al._ (2021) $R$ of
our RP-QDS protocol can be defined as

$R=\frac{n_{s}}{N}.$ (18)

Given system parameters $(N,\alpha,\eta_{d},P_{d},g,\varepsilon)$, we should
optimise over all other parameters to obtain the optimal signature rate $R$.
Notation $\alpha$ is the loss coefficient of fiber, $\eta_{d}$ is the
detection efficiency, $P_{d}$ is the dark count rate of detectors, the meaning
of $g$ is explained following Eq. (13) and $\varepsilon$ is the security
level.

We show how to obtain the bit-flip error rate $E$ and phase-flip error rate
$e^{\mathrm{ph}}$ of the bit string before random pairing in Supplemental
Information. Combined with the iteration relations shown in Eqs. (2)-(6), the
bit-flip error rate and phase-flip error rate of the outcome bit string can be
obtained, which are used to determine the security level $\varepsilon$ and
thresholds $s_{a}$, $s_{v}$ of our protocol.

Numerical simulations.

Table 1: System parameters used in numerical simulation. $\alpha$ |  $\eta_{d}$ |  $P_{d}$ |  $g$ |  $\varepsilon$
---|---|---|---|---
$0.2\ \mathrm{dB/km}$ |  $80\%$ |  $10^{-11}$ |  $10^{-12}$ |  $10^{-5}$

In Fig. 6 and Fig. 7, we show the log scale of the signature rate
$R_{\mathrm{RS}}$ (of RP-SNS-QDS) and $R_{\mathrm{RC}}$ (of RP-SCF-QDS) as a
function of the distance $L$ (km) between Alice and Bob, which is the same as
the distance between Alice and Charlie in the symmetric case, under different
misalignment error rates $e_{d}$. System parameters used in numerical
simulation are shown in table 1. For both protocols, with the increase of
misalignment error rate $e_{d}$, the signature rate $R_{\mathrm{RS}}$ and
$R_{\mathrm{RC}}$ decrease. It should be emphasized that the results in Fig. 7
have a higher level security, that is, our RP-SCF-QDS is not only measurement-
device independent, but also immune to all attacks in the side-channel of
emitted photons.

Figure 6: The red, green and blue lines represent the signature rates
$R_{\mathrm{RS}}$ of RP-SNS-QDS under misalignment error rate $e_{d}=0$, $5\%$
and $10\%$, respectively. Figure 7: The red, green and blue lines represent
the signature rates $R_{\mathrm{RC}}$ of RP-SCF-QDS under misalignment error
rate $e_{d}=0$, $5\%$ and $10\%$, respectively.

In Fig. 8 and Fig. 9, we show that the signature rate can be increased by
$\gamma_{1}$ and $\gamma_{2}$ with random pairing using SNS-QDS and SCF-QDS,
respectively, where $\gamma_{1}=\frac{R_{\mathrm{RS}}}{R_{\mathrm{S}}}-1$,
$\gamma_{2}=\frac{R_{\mathrm{RC}}}{R_{\mathrm{C}}}-1$; $R_{\mathrm{S}}$ and
$R_{\mathrm{C}}$ are signature rate of SNS-QDS and SCF-QDS. It can be found
that for both protocols, applying random pairing can greatly improve the
signature rate, that is, $\gamma_{1}>0$ and $\gamma_{2}>0$, and this advantage
becomes more and more obvious with the increase of misalignment error $e_{d}$.
For instance, when $L=200$ km, $e_{d}=10\%$, the signature rate of SNS-QDS and
SCF-QDS can be increased by $86\%$ and $101\%$ with random pairing,
respectively.

Figure 8: The signature rate can be increased by $\gamma_{1}$ with random
pairing using SNS-QDS protocol under misalignment error $e_{d}=0$ (red), $5\%$
(green) and $10\%$ (blue). Figure 9: The signature rate can be increased by
$\gamma_{2}$ with random pairing using SCF-QDS protocol under misalignment
error $e_{d}=0$ (red), $5\%$ (green) and $10\%$ (blue).

##  V Random pairing with finite pluses

In any real application of quantum cryptography, the data size is always
finite. Effects of finite data size has to be robustly considered for
security. Here we shall optimize the signature rate with finite data size.

We focus on signing a one-bit message $m=0$ or $1$. Alice does RP-KGP with
Bob, during which she sends $N_{f}$ pulses in total and generates the outcome
bit string with length of $N_{t,f}^{\prime}$. In the symmetric case, Alice
does the same procedure with Charlie and generates the $N_{t,f}^{\prime}-$bit
string. That is, to sign a one-bit message ($n_{s}=1$), Alice needs to send
$N_{f}$ pluses in total during RP-SNS-KGP with Bob. So, the signature rate
Zhang  _et al._ (2021) $R_{f}$ is

$R_{f}=\frac{1}{N_{f}}.$ (19)

Our practical RP-SNS-QDS protocol can be extended to sign multi-bit messages
using the method in Wang  _et al._ (2015). The main idea of Wang  _et al._
(2015) is to encode each bit 0 (1) of the multi-bit message into 000 (010) and
add codeword 111 to the start and the end of the message. This approach
improves the security of signing multi-bit messages, which can resist more
attacks on multi-bit messages, but has no effect on the advantages of random
pairing.

All parameters values listed above for the optimization of signature rate
given system parameters have to be estimated robustly with finite data size.
Here we show the estimation for bit-flip error rate and phase-flip error rate
of outcome bit string. The other parameter estimations are presented in
Supplemental Information. Firstly, to obtain the bit-flip error rate
$E^{\prime}_{f}$ of $K_{m}^{p,k}$ with length of $\mathcal{L}/2$, $T$ bits are
randomly selected and we use the bit-flip error rate $E_{T}$ of these $T$ bits
to estimate $E^{\prime}_{f}$ Serfling (1974),

$\begin{split}&E^{\prime}_{f}\leq
E_{T}+\mu(\frac{\mathcal{L}}{2},T,\varepsilon_{\mathrm{PE}}),\\\ \end{split}$
(20)

where

$\begin{split}&\mu(\frac{\mathcal{L}}{2},T,\varepsilon_{\mathrm{PE}})=\sqrt{\frac{(\frac{\mathcal{L}}{2}-T+1)\ln(\frac{1}{\varepsilon_{\mathrm{PE}}})}{T\mathcal{L}}},\\\
\end{split}$ (21)

in which except for a small probability $\varepsilon_{\mathrm{PE}}$, the above
estimation is successful. As analyzed above, the bit-flip error rate $E_{T}$
for thees $T$ outcome bits can be tested directly. When only one of the paired
bits in original bit string has an error, the new bit made up of their parity
value will have an error. So the expected value for $E_{T}$ is

$E_{T}=2E(1-E),$ (22)

where $E$ is the bit-flip error rate of original bit strings. It should be
noted that $E_{T}$ can be directly observed in experiments and we use $E_{T}$
(22) in numerical simulations.

Then we analyze how to obtain the phase-flip error rate of $K_{m}^{p,k}$.
There are two cases: one is that the outcome bit is generated by two untagged
bits, and the other is that the outcome bit is generated by one tagged bit and
one untagged bit. For the first case (two untagged bits are paired), we
classify the outcome bits according to the number of phase errors carried by
the bit pairs. Notation $n_{x}$, $x\in\\{0,1,2\\}$, represents the number of
bit pairs consisting of two untagged bits with $x$ phase error(s) in
$K_{m}^{p,k}$ with length of $\frac{1}{2}\mathcal{L}$,

$n_{0}=\frac{1}{2}\mathcal{L}\Delta_{u,f}^{2}(1-e^{\mathrm{ph}})^{2},$ (23)

$n_{1}=\mathcal{L}\Delta_{u,f}^{2}e^{\mathrm{ph}}(1-e^{\mathrm{ph}}),$ (24)

$n_{2}=\frac{1}{2}\mathcal{L}\Delta_{u,f}^{2}(e^{\mathrm{ph}})^{2},$ (25)

where $\Delta_{u,f}$ and $e^{\mathrm{ph}}$ is the proportion of untagged bits
and the phase-flip error rate of the original bit string, respectively. When
the total number of phase error is even ($0$ and $2$ phase error(s)), the
corresponding phase-flip error rate is $\frac{n_{2}}{n_{0}+n_{2}}$. When the
total number of phase error is odd ($1$ phase error), the corresponding phase-
flip error rate is $\frac{1}{2}$, which has no contribution to the signature.

For the second case (one tagged bits and one untagged bit are paired), the
phase-flip error rate is $e^{\mathrm{ph}}$ and the number of bit pairs in
$K_{m}^{p,k}$ with length of $\frac{1}{2}\mathcal{L}$ is

$\displaystyle n_{\mathrm{ut}}=\mathcal{L}\Delta_{u,f}(1-\Delta_{u,f}).$ (26)

The smooth min-entropy $H_{\min}^{\varepsilon_{e}}(K|I_{e})$ can be used to
characterize the average probability when the forger guesses $K_{m}^{p,k}$
within a threshold,

$\begin{split}H_{\min}^{\varepsilon_{e}}(K_{m}^{C,k}|I_{e})\geq&\frac{1}{2}\mathcal{L}\mathcal{H}_{f},\\\
\end{split}$ (27)

where $I_{e}$ represent all information of the forger, and

$\begin{split}\mathcal{H}_{f}=&\frac{2}{\mathcal{L}}\big{[}(n_{0}^{\mathrm{L}}+n_{2}^{\mathrm{U}})[1-H(\frac{n_{2}^{\mathrm{U}}}{n_{0}^{\mathrm{L}}+n_{2}^{\mathrm{U}}})]\\\
&+n_{\mathrm{ut}}^{\mathrm{L}}[1-H(e^{\mathrm{ph}})]\big{]},\\\ \end{split}$
(28)

where $V^{\mathrm{L}}$ ($V^{\mathrm{R}}$) represents the lower bound (upper
bound) of $V$ and the calculation of $\mathcal{H}_{f}$ is explained in detail
in Supplemental Information .

Considering the finite data size effects, the probabilities
$P_{\mathrm{ro}},P_{\mathrm{fo}},P_{\mathrm{re}}$ related to the security
level $\varepsilon$
($=\max\\{P_{\mathrm{ro}},P_{\mathrm{fo}},P_{\mathrm{re}}\\}$) become

$P_{\mathrm{ro},f}\leq 2\varepsilon_{\mathrm{PE}},$ (29)

where $\varepsilon_{\mathrm{PE}}$ is the failure probability of parameter
estimation, which is shown in Eq. (20),

$\begin{split}&P_{\mathrm{fo},f}\leq\frac{1}{g}\\{2^{-\frac{\mathcal{L}}{2}[\mathcal{H}_{f}-H(\frac{2r}{\mathcal{L}})]}+\varepsilon_{e}\\}+g+\varepsilon_{\mathrm{PE}}+8\xi,\\\
\end{split}$ (30)

where $g$ is the upper bound of probability that Bob makes fewer than $r$
errors in $K_{m}^{C,k}$ except with a small probability of
$\frac{1}{g}\\{2^{-\frac{\mathcal{L}}{2}[\mathcal{H}-H(\frac{2r}{\mathcal{L}})]}+\varepsilon_{e}\\}$;
$8\xi$ is generated in parameter estimating (the detail is shown in
Supplemental Information ); $\varepsilon_{e}$ is related to the smooth min-
entropy, which is shown in Eq. (13),

$P_{\mathrm{re},f}\leq 2e^{-\frac{1}{4}(s_{v}-s_{a})^{2}\mathcal{L}}.$ (31)

Given system parameters $(\alpha,\eta_{d},P_{d},\varepsilon)$, we need to
optimize the signature rate $R_{f}$ in RP-SNS-QDS with finite-size effects,
that is, maximize $R_{f}$ by choosing appropriate parameters
$(\mu,q,\mu_{1},\mu_{2},p_{z},p_{0},\Delta,\gamma_{T},\varepsilon_{PE},g,\xi)$,
which are detailedly analyzed in Supplemental Information. Without loss of
generality, we consider the symmetric case, where the distance between every
participant (Alice, Bob and Charlie) and Eve is the same. In Fig. 10, we show
the signature rate $R_{f}$ as a function of the distance $L$ (km) between
Alice and Bob when misalignment error rate $e_{d}\in\\{1\%,2\%,3\%\\}$ in our
practical RP-SNS-QDS. Obviously, as $e_{d}$ increases, the signature rate
$R_{f}$ decreases.

Figure 10: The red, green and blue lines represent the signature rates $R_{f}$
of RP-SNS-QDS with finite-size effects under misalignment error rate
$e_{d}=1\%$, $2\%$ and $3\%$, respectively, where $\varepsilon=10^{-5}$,
$\alpha=0.2$ dB/km, $\eta_{d}=80\%$ and $p_{d}=10^{-8}$. Figure 11: The
signature rate can be increased by $\gamma$ with random pairing in our
practical SNS-QDS compared with the one without random pairing Zhang  _et al._
(2021) under misalignment error $e_{d}=1\%$ (red), $2\%$ (green) and $3\%$
(blue).

In Fig. 11, we show that the signature rate can be increased by $\gamma$ with
random pairing in our protocol, where $\gamma=\frac{R_{f}}{R_{o}}-1$, $R_{o}$
and $R_{f}$ are signature rate of SNS-QDS and our practical RP-SNS-QDS. For
example, when $e_{d}=3\%$, $L=483$ km, using random pairing, the signature
rate can be increased by about $104\%$. It can be found that as the distance
$L$ and $e_{d}$ increases, the advantage of random pairing becomes more and
more obvious.

##  VI Discussion

In this work, we propose a novel method of random pairing, which can be
applied to any type of KGP in QDS protocols. In Fig 12, we show that the
signature rate can be increased drastically by our random pairing method in
BB84-QDS Amiri  _et al._ (2016), MDI-QDS Puthoor  _et al._ (2016) and SNS-QDS
Zhang  _et al._ (2021).

Figure 12: The signature rate with (solid lines) and without (dashed lines)
random pairing in BB84-QDS (black), MDI-QDS (blue) and SNS-QDS (red) under
misalignment error $e_{d}=5\%$. Other system parameters are shown in table 1.
The signature rate with RP is higher than that witout RP by around
$80\%-100\%$, in all protocols calculated here.

In reality, the data size is always finite. We study the RP-SNS-QDS with
finite pluses through novel optimization. Numerical results show that the
signature rates can be increased dramatically with random pairing and this
advantage becomes more and more obvious with the increase of distance and
misalignment error rate.

Acknowledgements: We thank Zong-Wen Yu and Xiao-Long Hu for helpful
discussions. We acknowledge the financial support in part by Ministry of
Science and Technology of China through The National Key Research and
Development Program of China grant No. 2017YFA0303901; National Natural
Science Foundation of China grant No.11774198 and No.11974204; Open Research
Fund Program of the State Key Laboratory of Low-Dimensional Quantum Physics
No.KF202110.

##  Appendix A Relevant parameters in RP-SNS-QDS

In RP-SNS-QDS protocol, we need to know the bit-flip error rate $E$ and phase-
flip error rate $e^{\mathrm{ph}}$ of the original bit string before random
pairing. Based on Wang  _et al._ (2018), in SNS-KGP, we can define four kinds
of events in $Z$ windows

###### Definition 6

($C_{0}$ window, $C_{1}$ window, $\mathcal{B}$ window and $\mathcal{O}$ window
in RP-SNS-QDS). A time window when Alice decides to not send (send) the
coherent state and Bob decides to send (not send) the coherent state is
$C_{0}$ ($C_{1}$) window. A time window when both parties decide to send the
coherent state or when both parties decide not to send the coherent state is
$\mathcal{B}$ window or $\mathcal{O}$ window.

The counting rate
$S_{\mathcal{K}}^{d}=\frac{n^{d}_{\mathcal{K}}}{N_{\mathcal{K}}}$ are as
follows, where $N_{\mathcal{K}}$ is the number of
$\mathcal{K}\in\\{C_{0},C_{1},\mathcal{B},\mathcal{O}\\}$ windows in $Z$
windows and $n^{d}_{\mathcal{K}}$ is the number of effective $\mathcal{K}$
windows heralded by detector $d$ ($d=l(r)$ represents the left (right)
detector ) in $Z$ windows,

$\begin{split}&S_{\mathcal{B}}^{l}=(1-p_{d})e^{-\eta\mu}I_{0}(\eta\mu)-(1-p_{d})^{2}e^{-2\eta\mu}=S_{\mathcal{B}}^{r},\\\
&S_{C_{0}}^{l}=(1-p_{d})e^{-\eta\mu/2}-(1-p_{d})^{2}e^{-\eta\mu}=S_{C_{0}}^{r},\\\
&S_{C_{1}}^{l}=S_{C_{1}}^{r}=S_{C_{0}}^{r},\\\
&S_{\mathcal{O}}^{l}=p_{d}(1-p_{d})=S_{\mathcal{O}}^{r},\\\ \end{split}$ (32)

where $\eta=10^{-\frac{\alpha l_{0}}{10}}\eta_{d}$ represents the total
efficiency, $l_{0}$ is the distance between Alice and Eve, $\eta_{d}$ is the
detection efficiency, $p_{d}$ is the dark count rate of detectors, $\mu$ is
the intensity of the coherent state and $I_{0}(x)$ is the $0$-order hyperbolic
Bessel function of the first kind.

The bit-flip error rate $E$ of bit string before random pairing is

$\begin{split}&E=\frac{n_{\mathcal{B}}+n_{\mathcal{O}}}{{N_{t}}},\\\
\end{split}$ (33)

in which

$\begin{split}&n_{\mathcal{B}}=Np_{z}^{2}q^{2}(S_{\mathcal{B}}^{l}+S_{\mathcal{B}}^{r}),\\\
\end{split}$ (34)
$\begin{split}&n_{\mathcal{O}}=Np_{z}^{2}(1-q)^{2}(S_{\mathcal{O}}^{l}+S_{\mathcal{O}}^{r}),\\\
\end{split}$ (35)
$\begin{split}&n_{C_{0}}=Np_{z}^{2}q(1-q)(S_{C_{0}}^{l}+S_{C_{0}}^{r}),\\\
\end{split}$ (36)
$\begin{split}&n_{C_{1}}=Np_{z}^{2}q(1-q)(S_{C_{1}}^{l}+S_{C_{1}}^{r}),\\\
\end{split}$ (37)
$\begin{split}&N_{t}=n_{\mathcal{B}}+n_{\mathcal{O}}+n_{C_{0}}+n_{C_{1}},\\\
\end{split}$ (38)

where $N$ is the total number of pluses, $q$ is the probability of sending and
$p_{z}$ the probability of choosing the signal window.

According to the definition of untagged bits, the proportion of untagged bits
is

$\begin{split}&\Delta_{\mathrm{un}}=\frac{n_{1}^{0}+n_{1}^{1}}{{N_{t}}},\\\
\end{split}$ (39) $\begin{split}&n_{1}^{0}=Np_{z}^{2}q(1-q)\mu
e^{-\mu}s_{1}=n_{1}^{1},\\\ \end{split}$ (40)

where $n_{1}^{0}$ and $n_{1}^{1}$ represent the number of effective bits of
single-photon state corresponding to $C_{0}$ and $C_{1}$ windows in $Z$
windows; $s_{1}$ is the counting rate of single-photon states.

For infinite decoy states, the counting rate of single-photon states and
phase-flip error rate can be estimated as

$\begin{split}&s_{1}=(1-p_{d})(\eta+2p_{d}(1-\eta)),\\\ \end{split}$ (41)

$\begin{split}&e^{\mathrm{ph},0}=p_{d}(1-p_{d})(1-\eta)/s_{1},\\\ \end{split}$
(42)

and after considering the misalignment error $e_{d}$, it becomes

$\begin{split}&e^{\mathrm{ph}}=e_{d}(1-2e^{\mathrm{ph},0})+e^{\mathrm{ph},0}.\\\
\end{split}$ (43)

According to the above parameters ($E$, $\Delta_{\mathrm{un}}$,
$e^{\mathrm{ph}}$) and the iteration relations in the main text, we can
optimize the signature rate $R$ by choosing appropriate parameters given
security level $\varepsilon$.

##  Appendix B Relevant parameters in RP-SCF-QDS

We can obtain the bit-flip error rate $E$ and phase-flip error rate
$e^{\mathrm{ph}}$ of the original bit string generated by SCF-KGP before
random pairing according to Wang  _et al._ (2019).

In SCF-KGP, the counting rate
$S_{\mathcal{V}}^{d}=\frac{n^{d}_{\mathcal{V}}}{N_{\mathcal{V}}}$ are as
follows, where $N_{\mathcal{V}}$ is the number of
$\mathcal{V}\in\\{\tilde{Z},\mathcal{B},\mathcal{O}\\}$ windows in set $v$ and
$n^{d}_{\mathcal{V}}$ is the number of effective $\mathcal{V}$ windows
heralded by detector $d$ ($d=l\ (r)$ represents the left (right) detector ) in
set $v$,

$\begin{split}&S_{\mathcal{B}}^{l}=e^{-2\eta\mu}p_{d}(1-p_{d})+(1-e^{-2\eta\mu})(1-p_{d}),\\\
&S_{\mathcal{B}}^{r}=e^{-2\eta\mu}(1-p_{d})p_{d},\\\
&S_{\tilde{Z}}^{l}=(1-p_{d})e^{-\eta\mu/2}-(1-p_{d})^{2}e^{-\eta\mu}=S_{\tilde{Z}}^{r},\\\
&S_{\mathcal{O}}^{l}=p_{d}(1-p_{d})=S_{\mathcal{O}}^{r},\\\ \end{split}$ (44)

where $\eta=10^{-\frac{\alpha l_{0}}{10}}\eta_{d}$ represents the total
efficiency, $l_{0}$ is the distance between Alice and Eve, $\eta_{d}$ is the
detection efficiency, $p_{d}$ is the dark count rate of detectors and $\mu$ is
the intensity of the coherent state.

After taking into account the misalignment error $e_{d}$, these counting rates
become

$\begin{split}&S_{\mathcal{V}}^{\prime
d}=(1-e_{d})S_{\mathcal{V}}^{d}+e_{d}S_{\mathcal{V}}^{d^{\prime}},\\\
\end{split}$ (45)

where $d\neq d^{\prime}$ and $d,d^{\prime}\in\\{\mathcal{L},\mathcal{R}\\}$.

The bit-flip error rate before random pairing is

$\begin{split}&E=\frac{n^{v}_{\mathcal{B}}+n_{\mathcal{O}}^{v}}{n_{v}},\\\
\end{split}$ (46)

in which

$\begin{split}&n^{v}_{\mathcal{B}}=N\gamma_{v}q^{2}(S_{\mathcal{B}}^{\prime\mathcal{L}}+S_{\mathcal{B}}^{\prime\mathcal{R}}),\\\
\end{split}$ (47)
$\begin{split}&n^{v}_{\mathcal{O}}=N\gamma_{v}(1-q)^{2}(S_{\mathcal{O}}^{\prime\mathcal{L}}+S_{\mathcal{O}}^{\prime\mathcal{R}}),\\\
\end{split}$ (48)
$n_{\tilde{Z}}^{v}=2N\gamma_{v}q(1-q)(S_{\tilde{Z}}^{\prime\mathcal{L}}+S_{\tilde{Z}}^{\prime\mathcal{R}}),$
(49) $n_{v}=n^{v}_{\mathcal{B}}+n^{v}_{\mathcal{O}}+n_{\tilde{Z}}^{v},$ (50)

where $N$ is the total number of pluses, $q$ is the probability of sending,
$\gamma_{v}=0.1$ in our simulation and $n_{v}$ is the number of effective
events in set $v$.

The proportion of untagged bits before random pairing is

$\Delta_{\mathrm{un}}=\frac{n^{v}_{\tilde{Z}}}{n_{v}}.$ (51)

According to some observed data in set $v$, the upper bound of phase-flip
error rate before random pairing is

$e^{\mathrm{ph}}\leq\overline{e}^{\mathrm{ph}}=\frac{(1+e^{-\mu})[\overline{S}^{\mathcal{R}}_{X_{+}}-\underline{S}^{\mathcal{L}}_{X_{+}}]+2S^{\prime
L}_{\tilde{Z}}}{2(S_{\tilde{Z}}^{\prime{\mathcal{L}}}+S_{\tilde{Z}}^{\prime{\mathcal{R}}})},$
(52)

where $\overline{S}^{d}_{X_{+}}$ and $\underline{S}^{d}_{X_{+}}$ are the upper
bound and lower bound of ${S}^{d}_{X_{+}}$ and ${S}^{d}_{X_{+}}$,
respectively, $d\in\\{\mathcal{L},\mathcal{R}\\}$, and

$\begin{split}S^{d}_{X_{+}}\leq\overline{S}^{d}_{X_{+}}=&\frac{1}{2(1+e^{-\mu})}\big{\\{}e^{-\mu}S_{\mathcal{O}}^{\prime
d}+\frac{1}{e^{-\mu}}S_{\mathcal{B}}^{\prime d}\\\
+&\frac{(1-e^{-\mu})^{2}}{e^{-\mu}}+2\sqrt{S_{\mathcal{O}}^{\prime
d}S_{\mathcal{B}}^{\prime d}}\\\ +&2(1-e^{-\mu})\sqrt{S_{\mathcal{O}}^{\prime
d}}+\frac{2(1-e^{-\mu})}{e^{-\mu}}\sqrt{S_{\mathcal{B}}^{\prime
d}}\big{\\}},\\\ \end{split}$ (53)
$\begin{split}S^{d}_{X_{+}}\geq\underline{S}^{d}_{X_{+}}=&\frac{1}{2(1+e^{-\mu})}\big{\\{}e^{-\mu}S_{\mathcal{O}}^{\prime
d}+\frac{1}{e^{-\mu}}S_{\mathcal{B}}^{\prime d}\\\
-&\big{[}2\sqrt{S_{\mathcal{O}}^{\prime d}S_{\mathcal{B}}^{\prime
d}}+2(1-e^{-\mu})\sqrt{S_{\mathcal{O}}^{\prime d}}\\\
+&\frac{2(1-e^{-\mu})}{e^{-\mu}}\sqrt{S_{\mathcal{B}}^{\prime
d}}\big{]}\big{\\}}.\\\ \end{split}$ (54)

Using the above parameters ($E$, $\Delta_{\mathrm{un}}$, $e^{\mathrm{ph}}$)
and the iteration relations in the main text, we can choose appropriate
parameters to optimize the signature rate $R$ given security level
$\varepsilon$.

##  Appendix C Relevant parameters in RP-SNS-QDS with finite-key effects

In the practical RP-SNS-KGP, the bit-flip error rate $E$ of bit string before
random can be obtained from Eq. (LABEL:SNS_E) and then the core is how to
obtain the counting rate of single-photon states $s_{1}$ and phase-flip error
rate $e^{\mathrm{ph}}$ of original bit string before random pairing. According
to Yu  _et al._ (2019); Jiang  _et al._ (2019), we use notations $\langle
s_{1}\rangle$ and $\langle e^{\mathrm{ph}}\rangle$ to represent the expected
values, then the corresponding lower bound and upper bound are

$\langle s_{1}\rangle\geq\langle s_{1}^{\mathrm{L}}\rangle=\frac{1}{2}(\langle
s^{\mathrm{L}}_{01}\rangle+\langle s^{\mathrm{L}}_{10}\rangle),$ (55)

$\langle e^{\mathrm{ph}}\rangle\leq\langle
e^{\mathrm{ph},\mathrm{U}}\rangle=\frac{\langle
T_{\Delta}^{\mathrm{U}}\rangle-\frac{1}{2}e^{-2\mu_{1}}\langle
S^{\mathrm{L}}_{00}\rangle}{2\mu_{1}e^{-2\mu_{1}}\langle
s_{1}^{\mathrm{L}}\rangle},$ (56)

where $\langle s^{\mathrm{L}}_{01}\rangle$, $\langle
s^{\mathrm{L}}_{10}\rangle$ are shown in Eq. (59); $\langle
T_{\Delta}^{\mathrm{U}}\rangle$ is shown in Eq. (64). In the decoy window,
Alice (Bob) chooses phase-randomized coherent states with three different
intensities $\mu_{0}=0$, $\mu_{1}$, $\mu_{2}$ and $S_{ij}$
$i,j\in\\{0,1,2\\}$, represents counting rate of source $ij$ when Alice (Bob)
chooses phase-randomized coherent states with intensity $\mu_{i}$ ($\mu_{j}$).

We use Chernoff bound Chernoff (1952) to estimate expected values $\phi$ from
observed values, which are obtained from experiments directly,

$\begin{split}&\phi^{\mathrm{L}}(X)=\frac{X}{1+\delta_{1}(X)},\\\
&\phi^{\mathrm{U}}(X)=\frac{X}{1-\delta_{2}(X)},\\\ \end{split}$ (57)

where $\delta_{1}(X)$ and $\delta_{2}(X)$ can be calculated from

$\begin{split}&(\frac{e^{\delta_{1}}}{(1+\delta_{1})^{1+\delta_{1}}})^{\frac{X}{1+\delta_{1}}}=\frac{\xi}{2},\\\
&(\frac{e^{-\delta_{2}}}{(1-\delta_{2})^{1-\delta_{2}}})^{\frac{X}{1-\delta_{2}}}=\frac{\xi}{2},\\\
\end{split}$ (58)

where $\xi$ is the failure probability of estimation.

Using decoy-state method, we can obtain

$\begin{split}&\langle
s_{01}^{\mathrm{L}}\rangle=\frac{\mu_{2}^{2}e^{\mu_{1}}\langle
S_{01}^{\mathrm{L}}\rangle-\mu_{1}^{2}e^{\mu_{2}}\langle
S_{02}^{\mathrm{U}}\rangle-(\mu_{2}^{2}-\mu_{1}^{2})\langle
S^{\mathrm{U}}_{00}\rangle}{\mu_{1}\mu_{2}(\mu_{2}-\mu_{1})},\\\ &\langle
s_{10}^{\mathrm{L}}\rangle=\frac{\mu_{2}^{2}e^{\mu_{1}}\langle
S_{10}^{\mathrm{L}}\rangle-\mu_{1}^{2}e^{\mu_{2}}\langle
S_{20}^{\mathrm{U}}\rangle-(\mu_{2}^{2}-\mu_{1}^{2})\langle
S^{\mathrm{U}}_{00}\rangle}{\mu_{1}\mu_{2}(\mu_{2}-\mu_{1})},\\\ \end{split}$
(59)

Based on the analysis in Yu  _et al._ (2019); Jiang  _et al._ (2019), notation
$C_{\Delta^{+}}$ ($C_{\Delta^{-}}$) representing all instances where Alice and
Bob prepare $|e^{i\theta_{A}}\sqrt{\mu_{1}}\rangle$ and
$|e^{i\theta_{B}}\sqrt{\mu_{1}}\rangle$ when
$|\delta_{A}-\delta_{B}|\leq\Delta/2$
($|\delta_{A}-\delta_{B}-\pi|\leq\Delta/2$) is used to estimate
$e^{\mathrm{ph},\mathrm{U}}$. There are $N_{\Delta^{\pm}}$ instances in
$C_{\Delta^{\pm}}$

$N_{\Delta^{\pm}}=\frac{\Delta}{2\pi}(1-p_{z})^{2}p_{1}^{2}N,$ (60)

We use $n_{\Delta^{+}}^{l}$ ($n_{\Delta^{-}}^{r}$) to represent effective
events heralded by left (right) detector

$n_{\Delta^{+}}^{l}=n_{\Delta^{-}}^{r}=[T_{X}(1-2e_{d})+e_{d}S_{X}]N_{\Delta^{\pm}},$
(61)

where

$T_{X}=\frac{1}{\Delta}\int_{-\frac{\Delta}{2}}^{\frac{\Delta}{2}}(1-p_{d})e^{-2\eta\mu_{1}\cos^{2}{\frac{\delta}{2}}}d\delta-(1-p_{d})^{2}e^{-2\eta\mu_{1}},$
(62)

$\begin{split}S_{X}=&\frac{1}{\Delta}\int_{-\frac{\Delta}{2}}^{\frac{\Delta}{2}}(1-p_{d})e^{-2\eta\mu_{1}\sin^{2}{\frac{\delta}{2}}}d\delta-(1-p_{d})^{2}e^{-2\eta\mu_{1}}\\\
&+T_{X}.\\\ \end{split}$ (63)

Then, the counting error rate $\langle T_{\Delta}\rangle$ of
$C_{\Delta^{\pm}}$ is

$\langle T_{\Delta}\rangle\leq\langle
T_{\Delta}^{\mathrm{U}}\rangle=\frac{\phi^{\mathrm{U}}(n_{\Delta^{+}}^{r}+n_{\Delta^{-}}^{l})}{2N_{\Delta^{\pm}}}.$
(64)

Next, we use Chernoff bound to estimate real values $\varphi$ of the specific
experiment from expected values,

$\begin{split}&\varphi^{\mathrm{L}}(Y)=[1+\delta_{1}^{\prime}(Y)]Y,\\\
&\varphi^{\mathrm{U}}(Y)=[1-\delta_{2}^{\prime}(Y)]Y,\\\ \end{split}$ (65)

where $\delta_{1}^{\prime}(X)$ and $\delta_{2}^{\prime}(X)$ can be obtained
from

$\begin{split}&(\frac{e^{\delta_{1}^{\prime}}}{(1+\delta_{1}^{\prime})^{1+\delta_{1}^{\prime}}})^{Y}=\frac{\xi}{2},\\\
&(\frac{e^{-\delta_{2}^{\prime}}}{(1-\delta_{2}^{\prime})^{1-\delta_{2}^{\prime}}})^{Y}=\frac{\xi}{2},\\\
\end{split}$ (66)

where $\xi$ is the failure probability of estimation.

Therefore, the proportion $\Delta_{u,f}$ of untagged bits of the original bit
string is

$\begin{split}&\Delta_{u,f}=\frac{\varphi^{\mathrm{L}}(\langle
n_{1}^{\mathrm{L}}\rangle)}{{N_{t}}},\\\ \end{split}$ (67)

where

$\langle n_{1}^{\mathrm{L}}\rangle=2Np_{z}^{2}q(1-q)\mu e^{-\mu}\langle
s_{1}^{\mathrm{L}}\rangle,$ (68)

and

$e^{\mathrm{ph}}=\frac{\varphi^{\mathrm{U}}(N_{t}\Delta_{u,f}\langle
e^{\mathrm{ph},\mathrm{U}}\rangle)}{N_{t}\Delta_{u,f}}.$ (69)

The lower bound (upper bound) of the number $n_{x}$ of bit pairs consisting of
$x$ errors, $x\in\\{0,1,2\\}$, can be calculated by

$\begin{split}&n_{x}^{\mathrm{L}}=\varphi^{\mathrm{L}}(n_{x}),\\\
&n_{x}^{\mathrm{R}}=\varphi^{\mathrm{R}}(n_{x}),\\\ \end{split}$ (70)

where $n_{x}$ is shown in main text. Similarly, the lower bound of the number
of bit pairs consisted of one tagged bit and one untagged bit is

$\begin{split}&n_{\mathrm{ut}}^{\mathrm{L}}=\varphi^{\mathrm{L}}(n_{\mathrm{ut}}),\\\
\end{split}$ (71)

where $n_{\mathrm{ut}}$ is shown in main text. Based on $n_{0}^{\mathrm{L}}$,
$n_{2}^{\mathrm{U}}$, $n_{\mathrm{ut}}^{\mathrm{L}}$ and $e^{\mathrm{ph}}$, we
can obtain $\mathcal{H}_{f}$ in the main text. Given system parameters
$(\alpha,\eta_{d},P_{d},\varepsilon)$, we need to optimize the signature rate
$R_{f}$ by choosing appropriate parameters
$(\mu,q,\mu_{1},\mu_{2},p_{z},p_{0},\Delta,\gamma_{T},\varepsilon_{PE},g,\xi)$.

## References

  * Diffie and Hellman (1976) W. Diffie and M. Hellman, “New directions in cryptography,” IEEE Transactions on Information Theory 22, 644–654 (1976).
  * Gottesman and Chuang (2001) Daniel Gottesman and Isaac Chuang, “Quantum digital signatures,” arXiv preprint quant-ph/0105032 (2001).
  * Andersson  _et al._ (2006) Erika Andersson, Marcos Curty, and Igor Jex, “Experimentally realizable quantum comparison of coherent states and its applications,” Phys. Rev. A 74, 022304 (2006).
  * Dunjko  _et al._ (2014) Vedran Dunjko, Petros Wallden, and Erika Andersson, “Quantum digital signatures without quantum memory,” Phys. Rev. Lett. 112, 040502 (2014).
  * Amiri  _et al._ (2016) Ryan Amiri, Petros Wallden, Adrian Kent, and Erika Andersson, “Secure quantum signatures using insecure quantum channels,” Phys. Rev. A 93, 032325 (2016).
  * Yin  _et al._ (2016a) Hua-Lei Yin, Yao Fu, and Zeng-Bing Chen, “Practical quantum digital signature,” Phys. Rev. A 93, 032316 (2016a).
  * Collins  _et al._ (2014) Robert J. Collins, Ross J. Donaldson, Vedran Dunjko, Petros Wallden, Patrick J. Clarke, Erika Andersson, John Jeffers, and Gerald S. Buller, “Realization of quantum digital signatures without the requirement of quantum memory,” Phys. Rev. Lett. 113, 040502 (2014).
  * Donaldson  _et al._ (2016) Ross J. Donaldson, Robert J. Collins, Klaudia Kleczkowska, Ryan Amiri, Petros Wallden, Vedran Dunjko, John Jeffers, Erika Andersson, and Gerald S. Buller, “Experimental demonstration of kilometer-range quantum digital signatures,” Phys. Rev. A 93, 012329 (2016).
  * Croal  _et al._ (2016) Callum Croal, Christian Peuntinger, Bettina Heim, Imran Khan, Christoph Marquardt, Gerd Leuchs, Petros Wallden, Erika Andersson, and Natalia Korolkova, “Free-space quantum signatures using heterodyne measurements,” Phys. Rev. Lett. 117, 100503 (2016).
  * Yin  _et al._ (2017) Hua-Lei Yin, Yao Fu, Hui Liu, Qi-Jie Tang, Jian Wang, Li-Xing You, Wei-Jun Zhang, Si-Jing Chen, Zhen Wang, Qiang Zhang, Teng-Yun Chen, Zeng-Bing Chen, and Jian-Wei Pan, “Experimental quantum digital signature over 102 km,” Phys. Rev. A 95, 032334 (2017).
  * Roberts  _et al._ (2017) GL Roberts, M Lucamarini, ZL Yuan, JF Dynes, LC Comandar, AW Sharpe, AJ Shields, M Curty, IV Puthoor, and E Andersson, “Experimental measurement-device-independent quantum digital signatures,” Nature communications 8, 1–7 (2017).
  * Zhang  _et al._ (2018) Chun-Hui Zhang, Xing-Yu Zhou, Hua-Jian Ding, Chun-Mei Zhang, Guang-Can Guo, and Qin Wang, “Proof-of-principle demonstration of passive decoy-state quantum digital signatures over 200 km,” Physical Review Applied 10, 034033 (2018).
  * Ding  _et al._ (2020) Hua-Jian Ding, Jing-Jing Chen, Liang Ji, Xing-Yu Zhou, Chun-Hui Zhang, Chun-Mei Zhang, and Qin Wang, “280-km experimental demonstration of a quantum digital signature with one decoy state,” Optics letters 45, 1711–1714 (2020).
  * Pirandola  _et al._ (2020) Stefano Pirandola, Ulrik L Andersen, Leonardo Banchi, Mario Berta, Darius Bunandar, Roger Colbeck, Dirk Englund, Tobias Gehring, Cosmo Lupo, Carlo Ottaviani, _et al._ , “Advances in quantum cryptography,” Advances in Optics and Photonics 12, 1012–1236 (2020).
  * Wallden  _et al._ (2015) Petros Wallden, Vedran Dunjko, Adrian Kent, and Erika Andersson, “Quantum digital signatures with quantum-key-distribution components,” Phys. Rev. A 91, 042304 (2015).
  * Puthoor  _et al._ (2016) Ittoop Vergheese Puthoor, Ryan Amiri, Petros Wallden, Marcos Curty, and Erika Andersson, “Measurement-device-independent quantum digital signatures,” Phys. Rev. A 94, 022328 (2016).
  * Bennett and Brassard (2014) Charles H. Bennett and Gilles Brassard, “Quantum cryptography: Public key distribution and coin tossing,” Theoretical Computer Science 560, 7–11 (2014), theoretical Aspects of Quantum Cryptography – celebrating 30 years of BB84.
  * Hwang (2003) Won-Young Hwang, “Quantum key distribution with high loss: Toward global secure communication,” Phys. Rev. Lett. 91, 057901 (2003).
  * Wang (2005) Xiang-Bin Wang, “Beating the photon-number-splitting attack in practical quantum cryptography,” Phys. Rev. Lett. 94, 230503 (2005).
  * Lo  _et al._ (2005) Hoi-Kwong Lo, Xiongfeng Ma, and Kai Chen, “Decoy state quantum key distribution,” Phys. Rev. Lett. 94, 230504 (2005).
  * Boaron  _et al._ (2018) Alberto Boaron, Gianluca Boso, Davide Rusca, Cédric Vulliez, Claire Autebert, Misael Caloz, Matthieu Perrenoud, Gaëtan Gras, Félix Bussières, Ming-Jun Li, Daniel Nolan, Anthony Martin, and Hugo Zbinden, “Secure quantum key distribution over 421 km of optical fiber,” Phys. Rev. Lett. 121, 190502 (2018).
  * Lo  _et al._ (2012) Hoi-Kwong Lo, Marcos Curty, and Bing Qi, “Measurement-device-independent quantum key distribution,” Phys. Rev. Lett. 108, 130503 (2012).
  * Braunstein and Pirandola (2012) Samuel L. Braunstein and Stefano Pirandola, “Side-channel-free quantum key distribution,” Phys. Rev. Lett. 108, 130502 (2012).
  * Wang (2013) Xiang-Bin Wang, “Three-intensity decoy-state method for device-independent quantum key distribution with basis-dependent errors,” Phys. Rev. A 87, 012320 (2013).
  * Zhou  _et al._ (2016) Yi-Heng Zhou, Zong-Wen Yu, and Xiang-Bin Wang, “Making the decoy-state measurement-device-independent quantum key distribution practically useful,” Phys. Rev. A 93, 042324 (2016).
  * Yin  _et al._ (2016b) Hua-Lei Yin, Teng-Yun Chen, Zong-Wen Yu, Hui Liu, Li-Xing You, Yi-Heng Zhou, Si-Jing Chen, Yingqiu Mao, Ming-Qi Huang, Wei-Jun Zhang, Hao Chen, Ming Jun Li, Daniel Nolan, Fei Zhou, Xiao Jiang, Zhen Wang, Qiang Zhang, Xiang-Bin Wang, and Jian-Wei Pan, “Measurement-device-independent quantum key distribution over a 404 km optical fiber,” Phys. Rev. Lett. 117, 190501 (2016b).
  * Wang  _et al._ (2018) Xiang-Bin Wang, Zong-Wen Yu, and Xiao-Long Hu, “Twin-field quantum key distribution with large misalignment error,” Phys. Rev. A 98, 062323 (2018).
  * Lucamarini  _et al._ (2018) M. Lucamarini, Z. L. Yuan, J. F. Dynes, and A. J. Shields, “Overcoming the rate-distance limit of quantum key distribution without quantum repeaters,” Nature 557, 400–403 (2018).
  * Zhang  _et al._ (2021) Chun-Hui Zhang, Xingyu Zhou, Chun-Mei Zhang, Jian Li, and Qin Wang, “Twin-field quantum digital signatures,” Optics Letters 46, 3757–3760 (2021).
  * Gottesman and Lo (2003) Daniel Gottesman and Hoi-Kwong Lo, “Proof of security of quantum key distribution with two-way classical communications,” IEEE Transactions on Information Theory 49, 457–475 (2003).
  * Xu  _et al._ (2020) Hai Xu, Zong-Wen Yu, Cong Jiang, Xiao-Long Hu, and Xiang-Bin Wang, “Sending-or-not-sending twin-field quantum key distribution: Breaking the direct transmission key rate,” Phys. Rev. A 101, 042330 (2020).
  * Liu  _et al._ (2019) Yang Liu, Zong-Wen Yu, Weijun Zhang, Jian-Yu Guan, Jiu-Peng Chen, Chi Zhang, Xiao-Long Hu, Hao Li, Cong Jiang, Jin Lin, Teng-Yun Chen, Lixing You, Zhen Wang, Xiang-Bin Wang, Qiang Zhang, and Jian-Wei Pan, “Experimental twin-field quantum key distribution through sending or not sending,” Phys. Rev. Lett. 123, 100505 (2019).
  * Chen  _et al._ (2020) Jiu-Peng Chen, Chi Zhang, Yang Liu, Cong Jiang, Weijun Zhang, Xiao-Long Hu, Jian-Yu Guan, Zong-Wen Yu, Hai Xu, Jin Lin, Ming-Jun Li, Hao Chen, Hao Li, Lixing You, Zhen Wang, Xiang-Bin Wang, Qiang Zhang, and Jian-Wei Pan, “Sending-or-not-sending with independent lasers: Secure twin-field quantum key distribution over 509 km,” Phys. Rev. Lett. 124, 070501 (2020).
  * Pittaluga  _et al._ (2021) Mirko Pittaluga, Mariella Minder, Marco Lucamarini, Mirko Sanzaro, Robert Woodward, I, Ming-Jun Li, Zhiliang Yuan, and Andrew J. Shields, “600-km repeater-like quantum communications with dual-band stabilization,” Nature Photonics 15, 530+ (2021).
  * Liu  _et al._ (2021) Hui Liu, Cong Jiang, Hao-Tao Zhu, Mi Zou, Zong-Wen Yu, Xiao-Long Hu, Hai Xu, Shizhao Ma, Zhiyong Han, Jiu-Peng Chen, Yunqi Dai, Shi-Biao Tang, Weijun Zhang, Hao Li, Lixing You, Zhen Wang, Yong Hua, Hongkun Hu, Hongbo Zhang, Fei Zhou, Qiang Zhang, Xiang-Bin Wang, Teng-Yun Chen, and Jian-Wei Pan, “Field test of twin-field quantum key distribution through sending-or-not-sending over 428 km,” Phys. Rev. Lett. 126, 250502 (2021).
  * Chen  _et al._ (2021) Jiu-Peng Chen, Chi Zhang, Yang Liu, Cong Jiang, Wei-Jun Zhang, Zhi-Yong Han, Shi-Zhao Ma, Xiao-Long Hu, Yu-Huai Li, Hui Liu, Fei Zhou, Hai-Feng Jiang, Teng-Yun Chen, Hao Li, Li-Xing You, Zhen Wang, Xiang-Bin Wang, Qiang Zhang, and Jian-Wei Pan, “Twin-field quantum key distribution over a 511km optical fibre linking two distant metropolitan areas,” Nature Photonics 15, 570+ (2021).
  * Wang  _et al._ (2019) Xiang-Bin Wang, Xiao-Long Hu, and Zong-Wen Yu, “Practical long-distance side-channel-free quantum key distribution,” Phys. Rev. Applied 12, 054034 (2019).
  * Wang  _et al._ (2015) Tian-Yin Wang, Xiao-Qiu Cai, Yan-Li Ren, and Rui-Ling Zhang, “Security of quantum digital signatures for classical messages,” Scientific Reports 5, 9231 (2015).
  * Serfling (1974) R. J. Serfling, “Probability inequalities for the sum in sampling without replacement,” The Annals of Statistics 2, 39–48 (1974).
  * Yu  _et al._ (2019) Zong-Wen Yu, Xiao-Long Hu, Cong Jiang, Hai Xu, and Xiang-Bin Wang, “Sending-or-not-sending twin-field quantum key distribution in practice,” Scientific reports 9 (2019).
  * Jiang  _et al._ (2019) Cong Jiang, Zong-Wen Yu, Xiao-Long Hu, and Xiang-Bin Wang, “Unconditional security of sending or not sending twin-field quantum key distribution with finite pulses,” Phys. Rev. Applied 12, 024061 (2019).
  * Chernoff (1952) Herman Chernoff, “A measure of asymptotic efficiency for tests of a hypothesis based on the sum of observations,” The Annals of Mathematical Statistics , 493–507 (1952).


#  The phase symmetry
of classical electrodynamics

Serhii Samokhvalov
Dniprovsk State Technical University, Ukraine e-mail<EMAIL_ADDRESS>
( ***
)

###### Abstract

The dynamic $U(1)$ symmetry of classical electrodynamics without charges,
similar to the known phase symmetry of quantum mechanics, is analyzed. Using
this symmetry, alternative Lagrangians of classical electrodynamics, similar
to quantum-mechanical ones, were found, and their symmetry properties were
investigated.

##  1 Introduction

The most characteristic feature of quantum mechanics is the use of complex
numbers to describe states, which leads to the existence of a compact phase of
the wave function. The wave property of matter are connected with it. A
notable peculiarity of the quantum-mechanical phase usage is the existence of
the phase symmetry (the requirement of the unitarity of the quantum theory).

Besides the wave characteristics, the quantization of the particles quantity
is the result of the phase compactness and their conservation is connected
with the phase symmetry.

Thus, the two main properties of quantum mechanics: wave-likeness and
discreteness there are due to phase symmetry, that requires the comprehension
of the role of phase symmetry in it to understand quantum-mechanical laws.

We will look for such comprehension by comparing quantum mechanics with
classical electrodynamics, which, unlike quantum mechanics, was formulated
from the very beginning as purely real, while at the same time having deep
analogies with quantum mechanics.

Greek indices take on values $0,1,2,3$, Latin indexes of the middle of the
alphabet take on values $1,2,3$, $diag(g_{\mu\nu})=(-,+,+,+)$, for a
completely anisymmetric tensor is accepted $\varepsilon^{0123}=1$.

##  2 The phase in the quantum mechanics

The wave function meets Schrödinger equation:

$i\hbar\partial_{t}\psi=-\frac{\hbar^{2}}{2m}\triangle\psi+V\psi.$ (1)

If represent

$\psi=R\exp\left(i\theta/\hbar\right)=\rho^{\frac{1}{2}}\left(\cos\frac{\theta}{\hbar}+i\sin\frac{\theta}{\hbar}\right),$
(2)

where $\rho=R^{2}=\exp(2\tau)$, complex equation (1) splits into two real
equations (its real and imagine parts), i.e. its decomplexification takes
place:

$\underline{Re}:\qquad\partial_{t}\theta=-\frac{1}{2m}(\nabla\theta)^{2}-V-Q,$
(3)

$\underline{Im}:\qquad\quad\;\partial_{t}\rho+\nabla\left(\rho\frac{1}{m}\nabla\theta\right)=0,$
(4)

where

$Q=-\frac{\hbar^{2}}{2m}\frac{\triangle
R}{R}=\frac{\hbar^{2}}{4m}\left[\frac{1}{2}\left(\frac{\nabla\rho}{\rho}\right)^{2}-\frac{\nabla\rho}{\rho}\right]$
(5)

– quantum-mechanical potential. That is it that makes a distinction between
quantum-mechanical and classical descriptions, and it’s caused by the
superposition principle, i.e. by Schrödinger equation linearity (1). Equation
(3) is Hamilton-Jacobi equation, and equation (4) is equation of particles
transfer at velocity $\vec{v}=\nabla\theta/m$, i.e. $\vec{p}=\nabla\theta$.

From equation (3) comes directly the equation of motion for a particle, if we
take gradient from each of its parts

$\partial_{t}\vec{p}+\vec{v}\nabla\vec{p}=-\nabla U$ (6)

(in Lagrangian coordinates $d\vec{p}/dt=-\nabla U$) and denote $U=V+Q$. So a
particle is affected by quantum-mechanical force $-\nabla Q$ in addition to
classical force $-\nabla V$.

If instead of $\rho$ we use variable $\tau$ through which the quantum-
mechanical potential is put down like

$Q=-\frac{\hbar^{2}}{2m}\left[(\nabla\tau)^{2}+\nabla\tau\right],$ (7)

equations (3) and (4) will become:

$\partial_{t}\theta=-\frac{1}{2m}(\nabla\theta)^{2}-V+\frac{\hbar^{2}}{2m}\left[(\nabla\tau)^{2}+\nabla\tau\right],$
(8)

$\partial_{t}\tau+\frac{1}{m}\nabla\theta\nabla\tau=-\frac{1}{2m}\nabla\theta.$
(9)

All the equations and definitions listed above are symmetrical in respect of
phase transformations:

$\delta\theta=\hbar\delta\varphi.$ (10)

With direct (algebraic) decomplexification $\psi=\varepsilon+i\chi$
Schrödinger equation (1) splits into two equations:

$\underline{Re}:\qquad\hbar\partial_{t}\chi=-\frac{\hbar^{2}}{2m}\triangle\varepsilon-V\varepsilon,$
(11)

$\underline{Im}:\qquad\hbar\partial_{t}\varepsilon=-\frac{\hbar^{2}}{2m}\triangle\chi+V\chi.$
(12)

Phase symmetry for equations (11) and (12) is put down as:

$\partial\varepsilon=-\chi\delta\varphi,\qquad\delta\chi=\varepsilon\delta\varphi.$
(13)

##  3 Maxwell equations complexification

Maxwell equations in space without charges are:

$\frac{1}{c}\partial_{t}\vec{H}=-\nabla\times\vec{E},\qquad\nabla\cdot\vec{H}=0,$
(14)

$\frac{1}{c}\partial_{t}\vec{E}=\nabla\times\vec{H},\qquad\nabla\cdot\vec{E}=0.$
(15)

Equations (14) are the first pair and equations (15) are the second pair of
Maxwell equations. Equations(14) are consequence of expression $\vec{E}$ and
$\vec{H}$ through electromagnetic potentials (Jacobi identities).

Equations (14) and (15) are symmetric with respect to Rainich transformations
[1], which form group $U(1)^{R}$:

$\delta\vec{E}=-\vec{H}\delta\varphi,\qquad\delta\vec{H}=\vec{E}\delta\varphi,$
(16)

which are the analogue of phase transformations (13) in quantum mechanics.
This symmetry is completely dynamic and it doesn’t exist in the presence of
charges (though symmetry (13) take place also with the presence of the
potential $V$). Transformations (16) confuses the first and the second pairs
of Maxwell equations, i.e. they confuses Lagrangian equation for Maxwell’s
Lagrangian and Jacobi identity for $F_{\mu\nu}$.

This symmetry lets to put down Maxwell equations in complex form:

$\frac{i}{c}\partial_{t}\vec{\xi}=\nabla\times\vec{\xi},$ (17)

$\nabla\cdot\vec{\xi}=0,$ (18)

where $\vec{\xi}=\vec{E}+i\vec{H}$. If equation (17) is written in components:

$\frac{i}{c}\partial_{t}\xi^{i}-\varepsilon^{ijk}\partial_{j}\xi_{k}=0,$ (19)

it look a lot like Dirac equation.

Let’s also introduce $\vec{\eta}=\vec{\xi}^{*}=\vec{E}-i\vec{H}$. Then

$\vec{\xi}\cdot\vec{\eta}=E^{2}+H^{2},$ (20)

$i(\vec{\xi}\times\vec{\eta})=2(\vec{E}\times\vec{H}).$ (21)

Vector $\vec{\eta}$ obeys the equations:

$\frac{i}{c}\partial_{t}\vec{\eta}=-\nabla\times\vec{\eta},\qquad\nabla\cdot\vec{\eta}=0.$
(22)

Rainich transformations (16) for fields $\vec{\xi}$ and $\vec{\eta}$ have such
form:

$\delta\vec{\xi}=i\vec{\xi}\delta\varphi,\qquad\delta\vec{\eta}=-i\vec{\eta}\delta\varphi,$
(23)

or for finite transformations:

$\vec{\xi}^{\prime}=e^{i\varphi}\vec{\xi},\qquad\vec{\eta}^{\prime}=-e^{-i\varphi}\vec{\eta}.$
(24)

Multiplying (17) by $\vec{\eta}$, and (22) by $\vec{\xi}$, and adding them, we
get:

$\partial_{t}(\vec{\xi}\cdot\vec{\eta})+\nabla\cdot\left[ic(\vec{\xi}\times\vec{\eta})\right]=0.$
(25)

Energy density and Umov-Pointing vector

$\omega=\frac{1}{8\pi}(\vec{\xi}\cdot\vec{\eta})=\frac{1}{8\pi}(E^{2}+H^{2}),$
(26)

$\vec{S}=\frac{ic}{8\pi}(\vec{\xi}\times\vec{\eta})=\frac{c}{4\pi}(\vec{E}+\vec{H})$
(27)

let equation (25) be written in the form of the equation:

$\partial_{t}\omega+\nabla\cdot\vec{S}=0.$ (28)

For any substance with density $\rho$ under its transfer velocity we have to
take vector $\vec{v}$ that belongs to the transfer equation:

$\partial_{t}\rho+\nabla\cdot(\rho\vec{v})=0.$ (29)

Thus, the speed of propagation of electromagnetic energy is determined as
follows:

$\vec{v}=\vec{S}/\omega=2c\frac{\vec{E}\times\vec{H}}{E^{2}+H^{2}}$ (30)

and we have $v=c$ only in the case of electromagnetic wave when
$\vec{E}\perp\vec{H}$ and $E=H$. In other cases $v\neq c$. For example, for
electrostatics $\vec{H}=0$ and $\vec{v}=0$. This is effect of mass.

Let the constant electric field $\vec{\varepsilon}$ be superimposed upon an
electromagnetic wave $\vec{E}$, $\vec{H}$ (such a solution is physical, i.e.
it definitely obeys Maxwell equations). Then we get from (30):

$\vec{v}=\vec{S}/\omega=2c\frac{\vec{E}\times\vec{H}+\vec{\varepsilon}\times\vec{H}}{E^{2}+H^{2}+2\vec{\varepsilon}\cdot\vec{E}+\varepsilon^{2}}.$
(31)

Let’s assume that $\varepsilon$ is small and $\vec{x}=\vec{\varepsilon}/E$.
From (31) with the accuracy to the first order on $x$ we get:

$\vec{v}=c\left[(1-\vec{x}\cdot\vec{n}_{E})\vec{n}_{S}+\vec{x}\times\vec{n}_{H}\right],$
(32)

where $\vec{n}_{E}$ and $\vec{n}_{H}$ are unit vectors along vectors
$\vec{E}$, $\vec{H}$ and $\vec{n}_{S}=\vec{n}_{E}\times\vec{n}_{H}$. From (32)
comes that the velocity of the an electromagnetic wave spreading in the
constant electric field fluctuates with the wave frequency not only in the
value (the first term in (32)) but also in the direction (the last term).

##  4 Phase in electrodynamics

On the analogy with (2) let’s put:

$\vec{\xi}=J^{1/2}\left(\vec{n}_{E}\cos\frac{\theta}{\hbar}+i\vec{n}_{H}\sin\frac{\theta}{\hbar}\right),$
(33)

i.e.

$E=J^{1/2}\cos\frac{\theta}{\hbar},\qquad H=J^{1/2}\sin\frac{\theta}{\hbar},$
(34)

$J=E^{2}+H^{2}$. Phase $\theta$ corresponds to the action for photons and at
Rainich transformations (23) obtains the addition:

$\delta\theta=\hbar\delta\varphi,$ (35)

which completely coincides with (10).

Now our goal is in phase decomplexification of dynamic (with derivativs with
respect to $t$) Maxwell equations (17) by analogy with decomplexification of
Schrödinger equations. As a result we get:

$\underline{Re}:\qquad-\partial_{t}J\sin\frac{\theta}{\hbar}\vec{n}_{H}-2\frac{J}{\hbar}\cos\frac{\theta}{\hbar}\partial_{t}\theta\vec{n}_{H}-2J\sin\frac{\theta}{\hbar}\partial_{t}\vec{n}_{H}=$

$c\left\\{\cos\frac{\theta}{\hbar}(\nabla
J\times\vec{n}_{E})-2\frac{J}{\hbar}\sin\frac{\theta}{\hbar}(\nabla\theta\times\vec{n}_{E})+2J\cos\frac{\theta}{\hbar}(\nabla\times\vec{n}_{E})\right\\},$
(36)

$\underline{Im}:\qquad\partial_{t}J\cos\frac{\theta}{\hbar}\vec{n}_{E}-2\frac{J}{\hbar}\sin\frac{\theta}{\hbar}\partial_{t}\theta\vec{n}_{E}+2J\cos\frac{\theta}{\hbar}\partial_{t}\vec{n}_{E}=$

$c\left\\{\sin\frac{\theta}{\hbar}(\nabla
J\times\vec{n}_{H})+2\frac{J}{\hbar}\cos\frac{\theta}{\hbar}(\nabla\theta\times\vec{n}_{H})+2J\sin\frac{\theta}{\hbar}(\nabla\times\vec{n}_{H})\right\\}.$
(37)

Let’s multiply (36) by $\cos\frac{\theta}{\hbar}\vec{n}_{H}$, and (37) by
$\sin\frac{\theta}{\hbar}\vec{n}_{E}$ and add. As a result we get the analogue
of Hamilton-Jacobi equation (3) for photons:

$\partial_{t}\theta+\frac{\hbar}{2J}\nabla\cdot\left(Jc\cos\left(2\frac{\theta}{\hbar}\right)\vec{n}_{S}\right)+\hbar\frac{c}{2}\left[\vec{n}_{H}\cdot(\nabla\times\vec{n}_{E})+\vec{n}_{E}\cdot(\nabla\times\vec{n}_{H})\right]=0.$
(38)

If multiply (36) by $-\sin\frac{\theta}{\hbar}\vec{n}_{H}$, and (37) by
$\cos\frac{\theta}{\hbar}\vec{n}_{E}$ and add, we’ll get photons transfer
equation:

$\partial_{t}J+\nabla\cdot\left(Jc\sin\left(2\frac{\theta}{\hbar}\right)\vec{n}_{S}\right)=0,$
(39)

which is the same as (28). Equations (38) and (39) do not exhaust equations
(36) and (37). Other ratios can be obtained from them.

##  5 Lagrangians of electrodynamics

Let’s further suppose $c=1$, and also instead of index $t$ let’s write index
$0$.

Maxwell’s Lagrangian of electromagnetic field

$L^{M}=-\frac{1}{16\pi}F_{\mu\nu}F^{\mu\nu}=\frac{1}{8\pi}(E^{2}-H^{2})=\frac{1}{8\pi}Re\xi^{2}$
(40)

leads to second pair of Maxwell equations (15)

$\partial_{\nu}F^{\mu\nu}=0$ (41)

only provided we express $F_{\mu\nu}$ through potentials $A_{\mu}$:

$F_{\mu\nu}=\partial_{\mu}A_{\nu}-\partial_{\nu}A_{\mu},$ (42)

which we should vary. The first pair of Maxwell equations (14):

$\partial_{\nu}\tilde{F}^{\mu\nu}=0,$ (43)

where

$\tilde{F}^{\mu\nu}=\frac{1}{2}\varepsilon^{\mu\nu\rho\tau}F_{\rho\tau},$ (44)

is Jacobi identity - the consequence of (42).

In spite of $U(1)^{R}$-invariance of Maxwell equations, Lagrangian $L^{M}$ is
not $U(1)^{R}$-invariant, though obviously Lorentz-invariant. Transformations
(16) really lead to the addition:

$\delta L^{M}=-\frac{1}{2\pi}\vec{E}\cdot\vec{H}\delta\varphi.$ (45)

Let us try to find the $U(1)^{R}$-invariant Lagrangian of electrodynamics
without worrying about its Lorentz invariance. At that let’s use the analogy
of dynamic Maxwell and Dirac equations, and write down Lagrangian of
electrodynamics, which similar to Dirac’s Lagrangian:

$L^{D}=-\frac{l}{8\pi}\left[\vec{H}\cdot(\partial_{0}\vec{E}-\nabla\times\vec{H})-\vec{E}\cdot(\partial_{0}\vec{H}+\nabla\times\vec{E})\right].$
(46)

where $l$ is the constant of the length dimension.

Variational derivatives of $L^{D}$ with respect to $\vec{E}$ and $\vec{H}$
give the dynamic part of Maxwell equations both the first (14) and the second
(15) pair:

$\frac{\delta
L^{D}}{\delta\vec{E}}=\frac{l}{2\pi}(\partial_{0}\vec{H}+\nabla\times\vec{E})=0,$
(47)

$\frac{\delta
L^{D}}{\delta\vec{H}}=\frac{l}{2\pi}(\partial_{0}\vec{E}-\nabla\times\vec{H})=0.$
(48)

Lagrangian $L^{D}$ don’t give zero divergences for $\vec{E}$ and $\vec{H}$ as
Lagrange equations.

Lagrangian $L^{D}$ is invariant with respect to transformations (16)
($U(1)^{R}$ \- invariant), though obviously is not invariant with respect to
Lorenz transformations.

$U(1)^{R}$-invariance allows us to write down $L^{D}$ in the complex form
(with respect to $\vec{\xi}$ and $\vec{\eta}$):

$L^{D}=-\frac{l}{16\pi}\left[\vec{\eta}\cdot(i\partial_{0}\vec{\xi}-\nabla\times\vec{\xi})-\vec{\xi}\cdot(i\partial_{0}\vec{\eta}+\nabla\times\vec{\eta})\right].$
(49)

Independent variation on $\vec{\xi}$ and $\vec{\eta}$ obviously leads to
equation (17) and the first of the equations (22). $U(1)^{R}$ \- invariance in
notation (49) becomes utterly evident.

##  6 Relativistic transformations of $L^{D}$

At the Lorenz transformations with parameters $\vartheta^{i}$ (angles) and
$v^{i}$ (velocities), we have:

$\delta E_{i}=\delta\vartheta_{k}\varepsilon_{kij}E_{j}-\delta
v_{k}\varepsilon_{kij}H_{j},$ (50)

$\delta H_{i}=\delta\vartheta_{k}\varepsilon_{kij}H_{j}-\delta
v_{k}\varepsilon_{kij}E_{j},$ (51)

or in the complex form:

$\delta\xi_{i}=(\delta\vartheta_{k}+i\delta v_{k})\varepsilon_{kij}\xi_{j},$
(52)

$\delta\eta_{i}=(\delta\vartheta_{k}+i\delta v_{k})\varepsilon_{kij}\eta_{j}.$
(53)

Beside this:

$\delta\partial_{0}=-\delta v_{i}\partial_{i},$ (54)

$\delta\partial_{m}=\delta
v_{m}\partial_{0}+\delta\vartheta_{k}\varepsilon_{kmi}\partial_{i}.$ (55)

Let’s bring into use designations:

$R_{s}=i\partial_{0}\xi_{s}-\varepsilon_{smn}\partial_{m}\xi_{n}=\frac{4\pi}{l}\frac{\delta
L^{D}}{\delta\eta^{s}},$ (56)

$D=\partial_{n}\xi_{n},$ (57)

relativeistic transformations of which are:

$\delta R_{s}=\delta\vartheta_{k}\varepsilon_{ksj}R_{j}-i\delta v_{s}D,$ (58)

$\delta D=-i\delta v_{k}R_{k}.$ (59)

With the use of $R_{s}$ we can write down:

$L^{D}=\frac{l}{4\pi}Re(\eta_{s}R_{s}),\qquad\delta
L^{D}=\frac{l}{4\pi}Re\left[\delta(\eta_{s}R_{s})\right].$ (60)

But:

$\delta(\eta_{s}R_{s})=i\delta v_{m}\eta_{m}(\varepsilon_{mnk}R_{k}-g_{mn}D)$
(61)

and when accomplishing Maxwell equations

$R_{k}=0,\qquad D=0,$ (62)

$\delta L^{D}$ disappears. It’s interesting, that lorenzinvariance of
electrodynamics, that is based on the Lagrangian $L^{D}$, demands $D=0$ as the
extra condition, but $D=0$ isn’t Lagrange equation for $L^{D}$.

Let’s write $\delta L^{D}$ with help of $\vec{E}$ and $\vec{H}$:

$4\pi\delta L^{D}=\delta
v_{m}\,l\left[H_{n}(\varepsilon_{mnk}R^{Re}_{k}-g_{mn}D^{Re})-E_{n}(\varepsilon_{mnk}R^{Im}_{k}-g_{mn}D^{Im})\right],$
(63)

where

$R_{s}^{Re}=-\partial_{0}H_{s}-\varepsilon_{smn}\partial_{m}E_{n},\qquad
R^{Im}_{s}=\partial_{0}E_{s}-\varepsilon_{smn}\partial_{m}H_{n},$ (64)

$D^{Re}=\partial_{n}E_{n},\qquad D^{Im}=\partial_{n}H_{n}.$ (65)

Substituting (64) and (65) in (63), we get:

$8\pi\delta L^{D}=\delta
v_{m}\,l\,[-\varepsilon_{mnk}(H_{n}\partial_{0}H_{k}+E_{n}\partial_{0}E_{k})+(H_{k}\partial_{m}E_{k}-E_{k}\partial_{m}H_{k})+$

$(E_{k}\partial_{k}H_{m}-H_{k}\partial_{k}E_{m})+(E_{m}\partial_{k}H_{k}-H_{m}\partial_{k}E_{k})].$
(66)

As we see, $\delta L^{D}$ doesn’t transform into divergence on the level of
the fields $\vec{E}$ and $\vec{H}$.

Both Lagrangians are invariant with respect to space-time translations [2]:

$\delta x^{\mu}=t^{\mu},$ (67)

$\delta x^{5}=A^{\mu}t^{\mu},$ (68)

($x^{5}$ \- is the fifth coordinate), that lead to the such transformations of
the fields:

$\delta A_{\mu}=-t^{\nu}F_{\nu\mu},$ (69)

$\delta E_{i}=-t^{\nu}\partial_{\nu}E_{i},$ (70)

$\delta H_{i}=-t^{\nu}\partial_{\nu}H_{i}.$ (71)

##  7 Conserved currents

Let’s find currents whose conservation is ensured by the considered invariants
of both Lagrangians.

If the Lagrangian is symmetric with respect to transformations:

$\delta x^{\mu}=\varepsilon^{a}X^{\mu}_{a},$ (72)

$\delta q^{A}=\varepsilon^{a}\alpha^{A}_{a},$ (73)

then, according to Noether’s theorem, currents

$J^{\mu}_{a}=-\frac{\partial
L}{\partial(\partial_{\mu}q^{A})}\alpha^{A}_{a}-LX^{\mu}_{a}.$ (74)

are conserved on the extremals.

For the Lagrangian $L^{M}$ in case of translations (67) and (69) we obtain:

$\alpha^{A}_{a}\sim-F_{\nu\mu},\qquad X^{\mu}_{a}\sim\delta^{\mu}_{a}$ (75)

and as a conserved current acts Maxwell’s energy-momentum tensor

$T^{\mu}_{\nu}=\frac{1}{4\pi}\left(-F^{\rho\mu}F_{\rho\nu}+\frac{1}{4}\delta^{\mu}_{\nu}F_{\rho\tau}F^{\mu\tau}\right),$
(76)

for which $T^{0}_{0}$ coincide with $\omega$ (26), and $T^{i}_{0}$ with
$S^{i}$ (27).

For the Lagrangian $L^{D}$ in case of translations (67), (70) and (71), we
obtain:

$\alpha^{A}_{a}\sim-\partial_{\nu}E_{i},\;\;-\partial_{\nu}H_{i};\qquad
X^{A}_{a}\sim\delta^{A}_{a}.$ (77)

Then the density of the ”energy” for the Lagrangian $L^{D}$ is:

$T^{0}_{0}=\frac{l}{8\pi}\left\\{\vec{E}\cdot[\nabla\times\vec{E}]+\vec{H}\cdot[\nabla\times\vec{H}]\right\\}.$
(78)

On shell:

$\nabla\times\vec{E}=-\partial_{0}\vec{H},\qquad\nabla\times\vec{H}=\partial_{0}\vec{E}$
(79)

and instead of (78) we have:

$T^{0}_{0}=-\frac{l}{8\pi}\left\\{\vec{E}\cdot\partial_{0}\vec{H}-\vec{H}\cdot\partial_{0}\vec{E}\right\\},$
(80)

that practically coincides with density of energy for Dirac’s field and,
apparently, doesn’t coincide with (26). For example, for electrostatic field,
(80) gives $0$. Due to the fact that in the electromagnetic wave
$\vec{E}\bot\vec{H}$, for the flat-polarized wave with (80) we also get $0$.
Very odd ”energy”!

For the density of the ”momentum” for the Lagrangian $L^{D}$ we have:

$T^{i}_{0}\vec{e}_{i}=\frac{l}{8\pi}\left\\{[\vec{E}\times\partial_{0}\vec{E}]+[\vec{H}\times\partial_{0}\vec{H}]\right\\}.$
(81)

or on shell (79)

$T^{i}_{0}\vec{e}_{i}=\frac{l}{8\pi}\left\\{[\vec{E}\times[\nabla\times\vec{H}]]-[\vec{H}\times[\nabla\times\vec{E}]]\right\\}.$
(82)

It’s also very odd quantity. For the flat-polarized electromagnetic wave with
(81) we get $T^{i}_{0}=0$.

Now let’s consider Rainich current, that is Noether current of the
transformations (16) for the Lagrangian $L^{D}$. In such case:

$\alpha^{A}_{a}\sim-H_{i},\;\;E_{i};\qquad X^{\mu}_{a}=0$ (83)

and current is:

$J^{0}=l\,\omega=\frac{l}{8\pi}(E^{2}+H^{2}),$ (84)

$J^{i}=l\,S^{i}=\frac{l}{4\pi}[\vec{E}\times\vec{H}]^{i}.$ (85)

It’s interesting, that ”phase” current for the Lagrangian $L^{D}$ coincides
(up to the factor $l$) with ”temporal” current for the Lagrangian $L^{M}$.
What does it mean? Maybe, synchronous moving by phase happens when moving by
time?

If quantity of photons is connected with the $U(1)^{R}$-symmetry, then the
formulas (84) and (85) give the ”quantum-mechanical” interpretation of the
light intensity. In such case the Lagrangian $L^{D}$ is better than $L^{M}$.
The transition from $L^{M}$ to $L^{D}$ may correspond to ”quantization”.

Let’s note, that when $\partial_{0}\vec{E}\sim-h\nu\vec{H}$ and
$\partial_{0}\vec{H}\sim h\nu\vec{E}$ (which corresponds to the synchronous
phase transformation during evolution over time), from (80) and (81) we
obtain:

$T^{0}_{0}\sim h\nu\omega,\qquad T^{i}_{0}\sim h\nu S^{i}.$ (86)

If $\omega$ is proportional to the quantity of the photons, and $S^{i}$ is
proportional to the density of their flow, then obtained formulas lead to the
quantum interpretation of the energy as a quantity that is proportional to
$h\nu$, and of the momentum as a quantity that is proportional to $h/\lambda$.

Let’s note, that Rainich phase transformations (16) and translations along the
fifth coordinate

$\delta x^{5}=t^{5},$ (87)

which are associated with the conservation of charges, in this formalism are
not related. Maybe, it takes place only for uncharged electromagnetic field,
where quantity of particles (photons) isn’t equal to quantity of charges, as
for electrons.

At rotations (50), (51):

$\alpha^{A}_{a}\sim\varepsilon_{kij}E_{j},\;\;\varepsilon_{kij}H_{j};\qquad
X^{\mu}_{a}=0,$ (88)

so the current is:

$M^{0}_{k}=l\,S_{k}=\frac{l}{4\pi}[\vec{E}\times\vec{H}]_{k},$ (89)

$M^{l}_{k}=\frac{l}{8\pi}\left[\delta^{l}_{k}(E^{2}+H^{2})-E^{l}E_{k}-H^{l}H_{k}\right],$
(90)

and the conservation law is:

$\partial_{0}S_{k}+\partial_{k}\omega-\frac{1}{8\pi}(E^{l}\partial_{l}E_{k}+H^{l}\partial_{l}H_{k})=0$
(91)

(when getting it was used that $\partial_{k}E_{k}=0$, $\partial_{k}H_{k}=0$).

At boosts (50), (51):

$\alpha^{A}_{a}\sim-\varepsilon_{kij}H_{j},\;\;\varepsilon_{kij}E_{j},\qquad
X^{\mu}_{a}=0,$ (92)

and current is:

$L^{0}_{k}=0,$ (93)

$L^{l}_{k}=-\frac{l}{8\pi}(E^{l}H_{k}-H^{l}E_{k}).$ (94)

In such case conservation law leads to identity:

$E^{l}\partial_{l}E_{k}=H^{l}\partial_{l}H_{k}$ (95)

(when getting it was also used that $\partial_{k}E_{k}=0$,
$\partial_{k}H_{k}=0$).

##  8 Relativistic generalization of $L^{D}$

The necessity of relativistic generalization of $L^{D}$ consists of the
following. First, the Lagrangian $L^{D}$ (46) has a lower time index 0, that
ensures the fact, that it’s Rainich current is a zero component of ordinary
Maxwell’s energy-momentum tensor (76). Second, not all of Maxwell equations
(but only dynamical) are Lagrange equations for $L^{D}$. And third, it is
desirable to find the ”reasons” of phase symmetry. It, maybe, would allow to
solve the mystery of electron with it’s spin, mass, etc.

Firstly, let’s write down formulas:

$F_{i0}=E_{i},\qquad H_{i}=\frac{1}{2}\varepsilon_{ijk}F^{jk},\qquad
F^{jk}=\varepsilon^{ijk}H_{k},$ (96)

$\tilde{F}_{\mu\nu}=\frac{1}{2}\varepsilon_{\mu\nu\rho\tau}F^{\rho\tau},$ (97)

$\tilde{F}_{i0}=H_{i},\qquad
E_{i}=-\frac{1}{2}\varepsilon_{ijk}\tilde{F}^{jk},\qquad\tilde{F}^{ij}=-\varepsilon^{ijk}E_{k},$
(98)

Lagrangian (46):

$L^{D}=\frac{l}{8\pi}\left[\vec{H}\cdot(\partial_{0}\vec{E}-\nabla\times\vec{H})-\vec{E}\cdot(\partial_{0}\vec{H}+\nabla\times\vec{E})\right].$
(99)

is a zero component of vector Lagrangian:

$L^{D}_{\rho}=\frac{l}{8\pi}(\tilde{F}_{\rho\nu}\partial_{\mu}F^{\nu\mu}-F_{\rho\nu}\partial_{\mu}\tilde{F}^{\nu\mu}).$
(100)

Independent variation of vector Lagrangian $L^{D}_{\rho}$ with respect to
$F^{\mu\nu}$ and $\tilde{F}^{\mu\nu}$ lead to pair of equations:

$\frac{\delta L^{D}_{\rho}}{\delta
F^{\mu\nu}}=-\frac{l}{16\pi}\left[g_{\rho\mu}\partial^{\sigma}\tilde{F}_{\nu\sigma}+\partial_{\nu}\tilde{F}_{\rho\mu}-(\mu<\-->\nu)\right]=0,$
(101)

$\frac{\delta
L^{D}_{\rho}}{\delta\tilde{F}^{\mu\nu}}=\frac{l}{16\pi}\left[g_{\rho\mu}\partial^{\sigma}F_{\nu\sigma}+\partial_{\nu}F_{\rho\mu}-(\mu<\-->\nu)\right]=0.$
(102)

Summing by $\rho$ and $\mu$, we get first and second pair of Maxwell equations
(43), (41):

$\partial^{\sigma}\tilde{F}_{\nu\sigma}=0,$ (103)

$\partial^{\sigma}F_{\nu\sigma}=0,$ (104)

which is the full system of Maxwell equations (besides dynamical equations
also equality to zero of divergences $\vec{E}$ and $\vec{H}$ ). Are there
additional equations in equations (101) and (102) in addition to Maxwell
equations? In any case the multiplication of (101) and (102) by
$\varepsilon^{\rho\tau\mu\nu}$ again leads to equations (104) and (103) (in
reverse order). So each of the equations (101) or (102) are enough to get the
full system of Maxwell equations (103) and (104).

If not to consider $F^{\mu\nu}$ and $\tilde{F}^{\mu\nu}$ as independent and to
use the formula (97), we’ll get:

$\frac{\delta L^{D}_{\rho}}{\delta
F^{\mu\nu}}=\frac{l}{8\pi}\left[\varepsilon_{\rho\tau\mu\nu}\partial_{\sigma}F^{\tau\sigma}-g_{\rho\mu}\partial^{\sigma}\tilde{F}_{\nu\sigma}+g_{\rho\nu}\partial^{\sigma}\tilde{F}_{\mu\sigma}-\partial_{\nu}\tilde{F}_{\rho\mu}+\partial_{\mu}\tilde{F}_{\rho\tau}+\varepsilon_{\sigma\tau\mu\nu}\partial^{\tau}F^{\sigma}_{\rho}\right]=0,$
(105)

in particular, from extra, spatial part of vector Lagrangian $L^{D}_{m}$, we
have:

$\frac{\delta L^{D}_{m}}{\delta
F^{ij}}=\frac{l}{8\pi}\left[\varepsilon_{mij}\partial_{\sigma}F^{0\sigma}-g_{mi}\partial^{\sigma}\tilde{F}_{j\sigma}+g_{mj}\partial^{\sigma}\tilde{F}_{i\sigma}-\partial_{j}\tilde{F}_{mi}+\partial_{i}\tilde{F}_{mj}+\varepsilon_{kij}\partial_{k}F_{m0}-\varepsilon_{kij}\partial_{0}F_{mk}\right]=0,$
(106)

$\frac{\delta L^{D}_{m}}{\delta
F^{0i}}=\frac{l}{8\pi}\left[\varepsilon_{mik}\partial_{\sigma}F^{k\sigma}-g_{mi}\partial_{l}\tilde{F}_{l0}-\partial_{i}\tilde{F}_{m0}+\partial_{0}\tilde{F}_{mi}-\varepsilon_{ikl}\partial^{l}F_{mk}\right]=0.$
(107)

We know, that variation of $L^{D}_{0}$ is enough to get only dynamical part of
Maxwell equations. However, variation of spatial part $L^{D}_{m}$ is enough to
get the full system of Maxwell equations. Really:

$\varepsilon_{mij}\frac{\delta L^{D}_{m}}{\delta
F^{ij}}=\frac{2\,l}{3\pi}\partial_{k}E_{k}=0,$ (108)

$\delta_{mi}\frac{\delta L^{D}_{m}}{\delta
F^{ij}}=-\frac{l}{2\pi}\partial^{\sigma}\tilde{F}_{j\sigma}=\frac{l}{2\pi}(\partial_{0}H_{j}+\varepsilon_{jim}\partial_{i}E_{m})=0,$
(109)

$\delta_{mi}\frac{\delta L^{D}_{m}}{\delta
F^{0i}}=-\frac{3\,l}{4\pi}\partial_{k}H_{k}=0,$ (110)

$\varepsilon_{mij}\frac{\delta L^{D}_{m}}{\delta
F^{0i}}=\frac{l}{2\pi}\partial^{\sigma}F_{j\sigma}=-\frac{l}{2\pi}(\partial_{0}E_{j}-\varepsilon_{jim}\partial_{i}H_{m})=0.$
(111)

##  9 Conserved currents of vector Lagrangian

At translations

$\delta F_{\mu\nu}=-t^{\alpha}\partial_{\alpha}F_{\mu\nu},$ (112)

$\delta\tilde{F}_{\mu\nu}=-t^{\alpha}\partial_{\alpha}\tilde{F}_{\mu\nu},$
(113)

$\alpha^{A}_{a}\sim-\partial_{\nu}F_{\mu\nu},-\partial_{\nu}\tilde{F}_{\mu\nu},\qquad
X^{\mu}_{a}\sim\delta^{\mu}_{a},$ (114)

and in consequence of translation invariance of the vector Lagrangian, current

$T^{\mu}_{\rho\alpha}=\frac{l}{8\pi}(\tilde{F}_{\rho\tau}\partial_{\alpha}F^{\tau\mu}-F_{\rho\tau}\partial_{\alpha}\tilde{F}^{\tau\mu})-\frac{l}{8\pi}\delta^{\mu}_{\alpha}(\tilde{F}_{\rho\tau}\partial_{\sigma}F^{\tau\sigma}-F_{\rho\tau}\partial_{\sigma}\tilde{F}^{\tau\sigma}).$
(115)

is conserved: $\partial_{\mu}T^{\mu}_{\rho\alpha}=0$. On shell the last term
disappears, and the conservation equation of ”energy-momentum” for
$L_{\rho}^{D}$ takes the form:

$\partial_{\mu}\tilde{F}_{\rho\tau}\partial_{\alpha}F^{\tau\mu}=\partial_{\mu}F_{\rho\tau}\partial_{\alpha}\tilde{F}^{\tau\mu}.$
(116)

Phase transformations:

$\delta F_{\mu\nu}=-\tilde{F}_{\mu\nu}\delta\varphi,$ (117)

$\delta\tilde{F}_{\mu\nu}=F_{\mu\nu}\delta\varphi,$ (118)

that generalize transformations (16), lead to the current:

$J^{\mu}_{\rho}=\frac{l}{8\pi}\left(\tilde{F}_{\rho\tau}\tilde{F}^{\tau\mu}+F_{\rho\tau}F^{\tau\mu}\right)=\frac{l}{4\pi}\left(F_{\rho\tau}F^{\tau\mu}+\frac{1}{4}\delta^{\mu}_{\rho}F_{\alpha\beta}F^{\alpha\beta}\right),$
(119)

which coincides (up to the factor $l$) with the energy-momentum tensor (76)
for the Maxwell’s Lagrangian.

Let us consider the Lorentz transformation of $L^{D}_{\rho}$. With them:

$\delta
F_{\mu\nu}=\omega^{\sigma}_{\mu}F_{\sigma\nu}+\omega^{\sigma}_{\nu}F_{\mu\sigma},$
(120)

$\delta\tilde{F}_{\mu\nu}=\omega^{\sigma}_{\mu}\tilde{F}_{\sigma\nu}+\omega^{\sigma}_{\nu}\tilde{F}_{\mu\sigma},$
(121)

$\delta L^{D}_{\rho}=\omega^{\sigma}_{\rho}L^{D}_{\rho}.$ (122)

It follows from (122) that since on shell $L^{D}_{\rho}=0$, we have $\delta
L^{D}_{\rho}=0$.

##  10 Conclusion

It remains unclear how the Rainich phase $\theta$ relates to the ordinary
quantum-mechanical phase of the Hilbert space of quantum electrodynamics.

As to role of a phase in the quantum mechanics, maybe it exists a variant of
quantum mechanics, which has only dynamic phase symmetry, as Maxwell’s
electrodynamics, with the possibility of expression of independent components
of $\psi$-function through potentials.

It remains mysterious the existence of vector Lagrangians and the possibility
of getting the same physical quantities from different Lagrangians as a result
of different symmetries. It would be worth to examine this question in general
case.

## References

  * [1] Fushchych W.I., Nikitin A.G. Symmetry of Maxwell equations. - Kiyv: Naukova Dumka. - 1983. - 200p.
  * [2] Samokhvalov S.E., Vanyashin V.S. Group theory approach to unification of gravity with internal symmetry gauge interactions // Class. Quantum Grav. - 1991. - 8. - P 2277-2282.