# Reference-frame-independent design of phase-matching quantum key
distribution

Anran Jin  Electrical Engineering Division, Department of Engineering,
University of Cambridge, CAPE Building 9 JJ Thomson Avenue, CB3 0FA Cambridge,
UK  Pei Zeng  Center for Quantum Information, Institute for Interdisciplinary
Information Sciences, Tsinghua University, Beijing 100084, China  Richard V.
Penty  Electrical Engineering Division, Department of Engineering, University
of Cambridge, CAPE Building 9 JJ Thomson Avenue, CB3 0FA Cambridge, UK
Xiongfeng Ma<EMAIL_ADDRESS>Center for Quantum Information, Institute
for Interdisciplinary Information Sciences, Tsinghua University, Beijing
100084, China

###### Abstract

The recently proposed phase-matching quantum key distribution offers means to
overcome the linear key rate-transmittance bound. Since the key information is
encoded onto the phases of coherent states, the misalignment between the two
remote reference frames would yield errors and significantly degrade the key
generation rate from the ideal case. In this work, we propose a reference-
frame-independent design of phase-matching quantum key distribution by
introducing high-dimensional key encoding space. With encoded phases spanning
the unit circle, the error statistics at arbitrary fixed phase reference
difference can be recovered and treated separately, from which the
misalignment angle can be identified. By naturally extending the binary
encoding symmetry and complementarity to high dimensions, we present a
security proof of this high-dimensional phase-matching quantum key
distribution and demonstrate with simulation that a 17-dimensional protocol is
completely immune to any degree of fixed misalignment and robust to slow phase
fluctuations. We expect the high-dimensional protocol to be a practical
reference-frame-independent design for general phase-encoding schemes where
high-dimensional encoding is relatively easy to implement.

##  I INTRODUCTION

Quantum key distribution (QKD) resorts to quantum systems to distribute
private and random keys between two distant parties. Moreover, the privacy
does not rely on any computational assumption as in the classical key
distributions, nor the randomness derived from any pseudo random number
generations. In fact, the perfect privacy and randomness are intrinsic in
quantum systems, as the security of QKD can be proved by reducing it to the
distillation of entangled quantum states Lo and Chau (1999); Shor and Preskill
(2000); Koashi (2009).

The traditional QKD protocols are essentially point to point, where one party
transmits quantum states according to the classical keys and the other party
receives and measures the quantum states to distinguish the corresponding
classical keys Bennett and Brassard (1984); Bennett (1992). Under this
formalism, a linear bound can be placed on the relation between channel
transmittance and key generation rate Takeoka  _et al._ (2014); Pirandola  _et
al._ (2017). This is reasonable, since only when the encoded states are
transmitted through the channel can they be detected and used to generate raw
keys. In 2012, the measurement-device-independent quantum key distribution
(MDI QKD) was presented Lo  _et al._ (2012), originally intended to remove all
of the detection loopholes. Yet moreover, MDI QKD employs a setup that differs
from the traditional point-to-point scheme, in the sense that an untrusted
third party is in between the two communicating parties. Through the claimed
Bell-state measurements of the third party, the communicating parties can
entangle their qubits through entanglement distillation.

The original MDI QKD, although having an untrusted relay in between, still
cannot break the linear key rate-transmittance bound. This is essentially
because MDI QKD encodes entanglements in the degree of freedom of photons, for
instance polarization. In this way, two photons need to be detected for one
successful detection, which yields one bit raw key. Since the third party who
makes detection is in the middle of the two communicating parties, the
detection rate of each photon is the square root of the total channel
transmittance, and hence the total detection rate, which requires two photons,
still scales linearly with the channel transmittance.

The breakthrough was made in the recent work of twin-field quantum key
distribution (TF QKD) Lucamarini  _et al._ (2018), which opens the possibility
of phase-encoding MDI QKD protocols. In this MDI scheme with single-photon
interference Pfleegor and Mandel (1967), a successful detection requires in
total one photon from the two sides, saving the detection compared to the
original MDI QKD schemes. As a result, TF QKD improves the key rate-
transmittance bound from linear to square root. Afterwards, variants of TF QKD
and their rigorous security proofs have been presented Ma  _et al._ (2018);
Lin and Lütkenhaus (2018); Curty  _et al._ (2019). Among these works, a scheme
named phase-matching quantum key distribution (PM QKD) Ma  _et al._ (2018)
encodes the key bits in the phase of coherent states and removes the need of
basis switching, which has been demonstrated in a 502-km fiber-based
experiment Fang  _et al._ (2020).

Despite their ability to enhance the key-rate performance in theory, these
phase-encoding MDI QKD protocols are more challenging when it comes to the
experimental implementation, due to the optical-mode quadrature reference
mismatch between the two parties from the laser sources and optical channels.
The reference mismatch is in fact a problem for general QKD systems, as in the
polarization-based BB84 protocol mismatch between polarization axes gives a
maximally tolerable misalignment error rate of 11% Shor and Preskill (2000).
In Ref. Zeng  _et al._ (2020), the feasibility of PM QKD under 13%
misalignment error rate was demonstrated, yet with severely discounted
achievable secure key rate. In practice, phase-locking techniques can be
employed to fix the phase reference Santarelli  _et al._ (1994), but the
experimental challenges and the cost are considerable. The difficulty of phase
locking is also reflected in the recent experimental demonstrations, which are
either simple demonstration with local settings Minder  _et al._ (2019); Zhong
_et al._ (2019) or highly demanding experiments with advanced technologies
such as lasers with narrow linewidth of 1Hz and active phase feedback controls
Wang  _et al._ (2019), ultrastable cavity and time-frequency transfer locking
Liu  _et al._ (2019), and laser-injection techniques Fang  _et al._ (2020). We
refer to Ref. Mao  _et al._ (2021) for a detailed review on different variants
of PM QKD and TF QKD protocols and the advances on the experimental
techniques. Phase postcompensation is another feasible approach Ma and Razavi
(2012); Ma  _et al._ (2018); Zeng  _et al._ (2020), where extra phase
randomization is introduced and the experimental data with aligned phase
slices are postselected afterwards. If the phase mismatch is relatively fixed,
the data with aligned phase slices will be suitable for key generation. This
approach is again experimentally complicated and requires great amount of data
for phase estimations.

We thus call for the reference-frame-independent design Laing  _et al._
(2010); Lee  _et al._ (2020) of PM QKD to cope with fixed or slowly
fluctuating phase misalignment, completely controlled by the adversary in the
worst case, without overcomplicating the experimental setups.

If we look at the essence of the phase postcompensation, the discrete
randomization in fact expands the key space from two dimensions to high
dimension. After the detection stage, the key space is reduced back to two-
dimensional through postselection of matching phases. The variation in the
key-space dimension complicates the protocol. Naturally, we can remove the
postselection stage by implementing high-dimensional key space from the
beginning. The potential of high-dimensional protocols against channel errors
is already demonstrated for prepare-and-measure protocols, where, in contrast
with the conventional two-dimensional BB84 protocol which tolerates an error
rate of 11% , the four-dimensional BB84 protocol can tolerate up to 35.6% Chau
(2005), and the 16-dimensional BB84 protocol can tolerate 45.4% Chau (2005).
These results shine light on introducing high-dimensional PM QKD to combat
errors introduced by misalignment.

In this work, we introduce the $d$-dimensional PM QKD protocol which encodes
key information onto $d$ uniformly separated phase slices and matches phases
via interference detection at an untrusted measurement site. By extending the
encoding symmetry approach Zeng  _et al._ (2020) to high dimensions, we
present a security analysis of the high-dimensional PM QKD and demonstrate
that it achieves reference-frame independence: it is completely immune to any
degree of fixed-phase misalignment and robust to small phase fluctuation,
where these disturbances are assumed to be controlled by the adversary. As the
high-dimensional PM QKD employs the same setup as the two-dimensional PM QKD
whilst removing the necessity of phase postcompensation, it is in fact a
pragmatic approach to mitigate the effect of reference mismatch.

The rest of the paper is arranged as follows. In Section II, we present the
high-dimensional PM QKD protocol and discuss its relations with the
conventional two-dimensional PM QKD. In Section III, we outline the security
proof of high-dimensional PM QKD. The proof is generalized from two-
dimensional encoding symmetry Ma  _et al._ (2018); Zeng  _et al._ (2020) and
phase-error correction Lo and Chau (1999); Shor and Preskill (2000); Koashi
(2009), and we will justify the elements that cannot be generalized to high
dimensions trivially. Finally, in Section IV, we present the simulation
performance of the 17-dimensional PM QKD and demonstrate its advantage over
the two-dimensional PM QKD against both fixed-phase misalignment and small
phase fluctuation. We justify the rationales behind this advancement.

##  II HIGH-DIMENSiONAL PM QKD PROTOCOLS

We introduce the high-dimensional PM QKD protocol as the following, with Fig.
1 as a schematic diagram:

High-dimensional PM QKD protocol

  1. 1.

Encoding: Alice randomly generates a key “dit” $\kappa_{a}$ from
$\\{0,1,\cdots,d-1\\}$ and prepares the coherent state
$\ket{\sqrt{\mu/2}~{}e^{i\frac{2\pi}{d}\kappa_{a}}}_{A}$. Similarly, Bob
randomly picks $\kappa_{b}$ and prepares
$\ket{\sqrt{\mu/2}~{}e^{i\frac{2\pi}{d}\kappa_{b}}}_{B}$.

  2. 2.

Measurement: Alice and Bob send the two optical modes $AB$ to an untrusted
party, Eve, who is supposed to perform interference measurement and announce
the detection results: no click, double click, $L$ click or $R$ click.

  3. 3.

Sifting: After many rounds of quantum communications, Alice and Bob keep only
the rounds with $L$ or $R$ click. They end up with two correlated
$d$-dimensional strings.

  4. 4.

Parameter estimation: From the raw data they retained, Alice and Bob estimate
the security parameters and derive the secure key rate.

  5. 5.

Key generation: Based on the parameter estimation results, Alice and Bob
reconcile their raw strings by consuming certain secure keys. They then
perform privacy amplification to extract the secure final keys from the
reconciled keys.

Figure 1: Schematic diagram of the PM QKD protocol with $d$-dimensional
encoding Ma  _et al._ (2018). Alice prepares the coherent state
$\ket{\sqrt{\mu/2}~{}e^{i\frac{2\pi}{d}\kappa_{a}}}_{A}$, where
$\kappa_{a}\in\\{0,1,\cdots,d-1\\}$. Similarly Bob prepares
$\ket{\sqrt{\mu/2}~{}e^{i\frac{2\pi}{d}\kappa_{b}}}_{B}$. They send the two
coherent states to interfere at an untrusted measurement site. Ideally, if the
phase difference $\frac{2\pi}{d}|\kappa_{a}-\kappa_{b}|=0$, the detector gives
a single $L$ click. If $\frac{2\pi}{d}|\kappa_{a}-\kappa_{b}|=\pi$, the
detector gives a single $R$ click.

This family of protocols is a direct generalization of the two-dimensional PM
QKD Ma  _et al._ (2018); Zeng  _et al._ (2020) to $d$ dimension. The intuition
of security is similar as the binary case: when Alice and Bob each send
coherent states $\ket{\alpha e^{i\theta_{a}}}$ and $\ket{\alpha
e^{i\theta_{b}}}$ to the interferometer, the device is highly likely to
produce a single $L$ click only when $|\theta_{a}-\theta_{b}|\approx 0$, and a
single $R$ click only when $|\theta_{a}-\theta_{b}|\approx\pi$. Hence, if they
group the rounds with single $L$ clicks and $R$ clicks respectively, they
would obtain a pair of correlated phase strings. They can then distill secure
keys, respectively from the $L$-click group and the $R$-click group, and the
total secure key length is the sum of that from the two groups Gottesman  _et
al._ (2004); Ma (2008). We note that similar protocols with discrete phase
randomization are discussed in Refs. Currás-Lorenzo  _et al._ (2021) and Wang
_et al._ (2020). However, these protocols adopt binary encoding essentially;
the discrete phase randomization is used for a tight parameter estimation. In
contrast, the proposed high-dimensional PM QKD in this work utilizes the
discrete random phases for a high-dimensional encoding.

##  III SECURITY OF HIGH-DIMENSIONAL PM QKD WITH ENCODING SYMMETRY

In this section, we sketch the security analysis of high-dimensional PM QKD
protocols. A complete rigorous security proof is placed in the Appendices.
Generally, the proof extends the binary symmetric encoding approach in Ref.
Zeng  _et al._ (2020) to higher dimensions, which is discussed in Section
III.1, and concludes privacy through the phase-error correction approach in
Ref. Koashi (2009) in Section III.2. In order to generalize the known results
in two dimensions, we resort to the structure of finite field GF($d$) (see
Appendix A.1), which only exists when $d=p^{r}$ for some prime number $p$ and
integer $r$. Hence, we confine the analysis to prime power dimensions. Due to
a small caveat to be mentioned in Section V, unless noticed (e.g., Section
III.2), we confine $d$ to prime numbers. We give the asymptotic key-rate
formula for $d$-dimensional PM QKD with experimentally accessible parameters
in Section III.3.

###  III.1 High-dimensional symmetric encoding protocol

We first consider the symmetric encoding property of the $d$-dimensional PM
QKD Zeng  _et al._ (2020). In a $d$-dimensional symmetric encoding QKD, Alice
and Bob start with a bipartite state $\rho_{AB}$. They independently generate
a random key “dit” $\kappa_{a}$ and $\kappa_{b}$ from $\\{0,1,\cdots,d-1\\}$
and apply $U(\kappa_{a(b)}):=U^{\kappa_{a(b)}}$ to their subsystem $A$ and $B$
respectively, where $U^{d}=I$. Notice that in PM QKD, the encoding operator
$U$ is the rotation operator

$U=e^{i\frac{2\pi}{d}a^{\dagger}a},$ (1)

that rotates a coherent state by an angle of $2\pi/d$. The modulated state
$\rho^{\prime}_{AB}(\kappa_{a},\kappa_{b})$ can be written as

$\rho^{\prime}_{AB}(\kappa_{a},\kappa_{b})=[U_{A}(\kappa_{a})\otimes
U_{B}(\kappa_{b})]\rho_{AB}[U_{A}(\kappa_{a})\otimes
U_{B}(\kappa_{b})]^{\dagger},$ (2)

which is then sent to the third party Eve who is supposed to make a joint
measurement to determine $(\kappa_{a}-\kappa_{b})\text{ mod }d$ and announce
the result. Based on the announcements from Eve, Alice and Bob can modify
their key dits to generate a pair of correlated key strings, with information
reconciliation and privacy amplification to generate the final secure key.

Figure 2:  Schematic diagram of the $d$-dimensional symmetric encoding QKD,
where $\kappa_{a}$, $\kappa_{b}$ take values in $\\{0,1,\cdots,d-1\\}$. Alice
and Bob share the bipartite state $\rho_{AB}$ and each applies a unitary
operation $U(\kappa):=U^{\kappa}$ according to their key values $\kappa_{a}$
and $\kappa_{b}$. The untrusted party Eve is supposed to announce the key
difference $(\kappa_{a}-\kappa_{b})\text{ mod }d$. The setup extends the
binary symmetric encoding protocol in Ref. Zeng  _et al._ (2020).

A pure state $\ket{\psi}_{AB}$ on $AB$ is called an $l$-symmetric state, for
$l$ in $\\{0,1,\cdots,d-1\\}$, if it is the $l$-th eigenstate of $U_{A}\otimes
U_{B}$:

$(U_{A}\otimes U_{B})\ket{\psi}_{AB}=\gamma_{d}^{l}\ket{\psi}_{AB},$ (3)

where $\gamma_{d}=e^{i2\pi/d}$. For a mixture of $l$-symmetric states,
$\rho_{AB}=\sum_{j}p_{j}\ket{\psi_{l}^{(j)}}\bra{\psi_{l}^{(j)}}$, we have

$\rho^{\prime}_{AB}(\kappa_{a},\kappa_{b})=[I_{A}\otimes
U_{B}(\kappa_{b}-\kappa_{a})]\rho_{AB},$ (4)

where the subtraction is under modulus $d$. Hence, the encoded mixture
$l$-symmetric states are indistinguishable as long as the two key dits
$\kappa_{a}$ and $\kappa_{b}$ differ by the same number. As a result, the raw
key dit $\kappa_{a}$ is “hidden” in the encoded state
$\rho^{\prime}_{AB}(\kappa_{a},\kappa_{b})$ as long as the preshared state
$\rho_{AB}$ is a mixture of pure parity states.

To give a more rigorous argument, we resort to the entanglement-based
symmetric encoding protocol, as shown in Fig. 3 below. In the entanglement-
based protocol, Alice and Bob each hold an ancillary system $A^{\prime}$ and
$B^{\prime}$ in the state $\ket{+}_{d}=\sum_{j=0}^{d-1}\ket{j}$. This serves
as the control dit of the encoding operator $U$, i.e. we transfer the
classical random encoding to a quantum control operation. Its equivalence with
the prepare-and-measure symmetric encoding protocol follows if we move the
final measurement prior to the control operation. For the entanglement-based
protocol, when the input state $\rho_{AB}$ is an $l$-symmetric state, the
following is shown in Appendix C:

######  Observation 1.

In the entanglement-based symmetric encoding protocol, if the input state
$\rho_{AB}$ is an $l$-symmetric state, then the $X$-basis measurement result
on $A^{\prime}$ can be determined by the $X$-basis measurement result on
$B^{\prime}$, as they sum to $l$ under modulus $d$ addition. In other words,
Alice and Bob have no phase error between $A^{\prime}$ and $B^{\prime}$.

Note that the $X$-basis complementary to the computational basis in a
$d$-dimensional Hilbert space is defined as

$\ket{\tilde{l}}:=\frac{1}{\sqrt{d}}\sum_{j=0}^{d-1}\gamma_{d}^{-lj}\ket{j},$
(5)

where $\gamma_{d}=\exp(2\pi i/d)$. Hence, it remains only to show that in high
dimensions zero phase-error rate leads to perfect privacy.

Figure 3: Schematic diagram of the entanglement-based $d$-dimensional PM QKD,
where $\rho_{AB}$ is a bipartite state on two optical modes, and the encoding
operation $U$ rotates the coherent state by $2\pi/d$. The optical mode is
phase rotated by $2\pi k/d$ if the $k$-th control dit is triggered. The
encoded state $\rho_{0}$ is sent to the untrusted Eve for measurement, who is
supposed to announce the key difference $(\kappa_{a}-\kappa_{b})\text{ mod
}d$, where $\kappa_{a}$ and $\kappa_{b}$ refer to the control dits triggered
in $A^{\prime}B^{\prime}$. Alice and Bob distill secure keys from the qudit
systems $A^{\prime}$ and $B^{\prime}$. The setup extends the binary
entanglement-based symmetric encoding protocol in Ref. Zeng  _et al._ (2020).

###  III.2 Phase error and privacy in prime power dimensions

Phase error implies information leakage in two dimensions Lo and Chau (1999);
Shor and Preskill (2000); Koashi (2009). In the security proof of two-
dimensional QKD based on complementarity Koashi (2009), the two-body
entanglement distillation is first squashed into an equivalent single-body
coherence distillation protocol given efficient bit-error correction Ma  _et
al._ (2019a). As long as the squashed state is close to the two-dimensional
$X$-basis eigenstate, they can share random and private keys after $Z$-basis
measurements. This essentially connects privacy with phase error, i.e. the
error in estimating the $X$ measurement results. Due to the anticommutability
of the two-dimensional $X$ and $Z$ observables, the final $Z$ measurement
anticommutes with the phase-error correction, and we can move the $Z$-basis
measurement forward and reduce the phase-error correction to random hashing.

It is not obvious to generalize the two-dimensional complementarity argument
to high dimensions. Efforts have been made in proving the security of prime-
power-dimensional BB84 protocols Chau (2005); Nikolopoulos and Alber (2005),
which implicitly connect privacy with phase error in prime power dimensions.
Yet none of these early works have given an explicit distillable key-rate
formula. In Appendix B, we give a simple justification of prime-power-
dimensional phase-error correction based on the complementarity approach with
parity check operations $\\{P_{l}(\mathbf{v})\\}_{l=0}^{d-1}$,

$P_{l}(\mathbf{v})=\sum_{\mathbf{z}\cdot\mathbf{v}=l}\ket{\mathbf{z}}\bra{\mathbf{z}}.$
(6)

We thus yield a similar secure key-rate formula as two dimensions:

$r=\log_{2}d-H(\vec{E}_{ph})-H(\vec{E}_{bit}),$ (7)

where $H$ is the $\log_{2}$ based Shannon-entropy function. $\vec{E}_{ph}$ and
$\vec{E}_{bit}$ are the phase and bit-error vector. They are defined as the
length-$d$ error rate vectors of different shifts. To be specific, under an
asymptotic setup, suppose Alice and Bob measure their $N$ pairs of qudit
systems in $X$ basis and obtain two length-$N$ $d$-dimensional strings
$\mathbf{a}$ and $\mathbf{b}$, the phase-error rate vector is defined as
$\vec{E}_{\text{phase}}:=\vec{wt}(\mathbf{a}-\mathbf{b})/N$, where the
subtraction is of modulus $d$, and the weight function is defined as:

$\vec{wt}(\mathbf{s})=\begin{bmatrix}\text{No. of 0 in $\mathbf{s}$}\\\
\text{No. of 1 in $\mathbf{s}$}\\\ \cdots\\\ \text{No. of $d$-1 in
$\mathbf{s}$}\end{bmatrix}$ (8)

The bit-error rate vector $\vec{E}_{bit}$ can be defined similarly. Note that
a similar formula was derived in Ref. Sheridan and Scarani (2010) from
information theoretic approaches.

We thus arrive at the following relation between phase error and privacy in
prime power dimensions:

######  Observation 2.

In prime power dimensions, if Alice can determine Bob’s $X$-basis measurement
results, i.e. there is no phase error, the protocol generates secure keys in
$Z$ basis.

This, combined with Observation 1, proves the security of $d$-dimensional PM
QKD.

###  III.3 Parameter estimation with decoy states

In practice, the key-rate formula, Eq. (7), cannot be used directly as the
phase-error vector $\vec{E}_{ph}$ based on the hypothetical qudit systems is
not experimentally accessible. We can however estimate it based on the
realistic optical mode systems. To be more specific, Alice and Bob can run
discrete phase randomization where they independently add one of $D$ random
phases $\phi_{a}$ and $\phi_{b}$ to their coherent states. This essentially
transforms their states into mixtures of pseudo-Fock states (see Appendix C.2
and C.3), which are symmetric states that yield no phase error as previously
argued. With light intensity $\mu$, denote the fraction of detection caused by
the $l$-photon state as $q_{l}^{\mu}$, which gives the length-$d$ vector
$\vec{q}_{\mu}$ with $q_{l}^{\mu}$ at its $l$-th entry. We conclude that the
phase-error vector $\vec{E}_{ph}$ is exactly the detection ratio of each joint
Fock state $\vec{q}_{\mu}$. We thus have the experimentally accessible key-
rate formula:

$r=\frac{d}{D}Q_{\mu}\\{\gamma[\log_{2}d-H(\vec{E}^{\mu}_{bit})]-H(\vec{q}_{\mu})\\},$
(9)

where the parameter $\gamma<1$ marks the information reconciliation
efficiency. The bit-error vector $\vec{E}^{\mu}_{bit}$ can be retrieved
directly from random sampling. To access the detection fraction vector
$\vec{q}_{\mu}$ of each symmetric state, we apply the decoy method Lo  _et
al._ (2005); Wang (2005) by varying the light intensity $\mu$. This leads to
the following high-dimensional PM QKD protocol with decoy states for parameter
estimation:

High-dimensional PM QKD protocol with

parameter estimation

  1. 1.

Encoding: Alice randomly generates a key “dit” $\kappa_{a}$ from
$\\{0,1,\cdots,d-1\\}$ and a random intensity $\mu_{a}$ as in the decoy
method. She prepares the coherent state
$\ket{\sqrt{\mu_{a}/2}~{}e^{i\frac{2\pi}{d}\kappa_{a}}}_{A}$. Similarly, Bob
randomly picks $\kappa_{b}$ and $\mu_{b}$, and prepares
$\ket{\sqrt{\mu_{b}/2}~{}e^{i\frac{2\pi}{d}\kappa_{b}}}_{B}$.

  2. 2.

Discrete phase randomization: Alice and Bob independently phase randomize
their coherent states for a large enough phase slice number $D$. That is, they
randomly pick $\phi_{a}$ and $\phi_{b}$ from
$\\{j\frac{2\pi}{D}\\}_{j=0}^{D-1}$ and prepare
$\ket{\sqrt{\mu_{a}/2}~{}e^{i(\phi_{a}+\frac{2\pi}{d}\kappa_{a})}}_{A}$ and
$\ket{\sqrt{\mu_{b}/2}~{}e^{i(\phi_{b}+\frac{2\pi}{d}\kappa_{b})}}_{B}$
respectively.

  3. 3.

Measurement: Alice and Bob send the two optical modes $AB$ to an untrusted
party, Eve, who is supposed to perform interference measurement and announce
the detection results: no click, double click, $L$ click or $R$ click.

  4. 4.

Sifting: After many rounds of quantum communications, Alice and Bob keep only
the rounds with $L$ or $R$ click. They announce the random intensities and
phases $\mu_{a}$, $\phi_{a}$ and $\mu_{b}$, $\phi_{b}$ publicly. They keep
only the rounds with $\mu_{a}=\mu_{b}$. For each intensity group, they
postselect the rounds where
$|\phi_{a}-\phi_{b}|\in\\{k\frac{2\pi}{d}\\}_{k=0}^{d-1}$. They end up with
two correlated $d$-dimensional strings.

  5. 5.

Parameter estimation: From the raw data they retained, Alice and Bob retrieve
the gain $Q_{\mu}$ and the bit-error rate vector $\vec{E}^{\mu}_{bit}$. They
estimate the phase-error rate vector $\vec{q}_{\mu}$ based on Eq. (10) and
(11).

  6. 6.

Key generation: Based on the parameter estimation results, Alice and Bob
reconcile their raw strings by consuming certain secure keys. They then
perform privacy amplification to extract the secure final keys from the
reconciled keys.

Notice that after Eve’s announcement of detection results, they announce the
random phases and postselect the phase-matched rounds where
$|\phi_{a}-\phi_{b}|\in\\{k\frac{2\pi}{d}\\}_{k=0}^{d-1}$. Since Eve announces
only the detection results without access to the random phases, the overall
phase-error rate does not depend on the later phase announcement, and so does
the privacy Ma and Razavi (2012); Ma  _et al._ (2018); Maeda  _et al._ (2019).

To estimate $q_{l}$, denote the yield of $l$-photon states as $Y_{l}$, the
overall gain $Q_{\mu}$ can thus be expressed as:

$Q_{\mu}=\sum_{l=0}^{\infty}P_{\mu}(l)Y_{l},$ (10)

where $P_{\mu}(l)$ denotes the source statistics of $l$-photon states. We can
thus apply decoy methods by varying intensity $\mu$ to estimate the yield of
each joint Fock state Lo  _et al._ (2005); Wang (2005), and the fraction of
detection is given by:

$q^{\mu}_{l}=P_{\mu}(l)\frac{Y_{l}}{Q_{\mu}}.$ (11)

Although it requires infinite decoy levels to estimate each $q_{l}$ exactly,
since the optimal coherent light intensity is far below 1, three or more-
photon components are negligible in the source, and hence in the detected
signals. Therefore, three decoy levels are enough to estimate the phase-error
vector $\vec{q}_{\mu}$ (see also the finite-size analysis in Ref. Zeng  _et
al._ (2020)) and the detection fraction $\vec{q}_{\mu}$ is to be estimated
with decoy states based on Eq. (10) and (11).

As the pseudo-Fock states given in Eq. (66) vary with the change in light
intensity $\mu$, Eve may have chances to distinguish between signal and decoy
states, thus cracking the decoy method Cao  _et al._ (2015). Therefore, we
want the generated pseudo-Fock states to be close to the real Fock states,
i.e. we want the discrete randomization close to continuous. As shown in
Appendix C.3, $D\geq 10$ is required for a negligible effect of discrete
randomization. When $d=2$, this essentially introduces a significant sifting
factor $2/D$. For high-dimensional PM QKD that $d\geq 10$, however, we can
simply let $D=d$ and the postselection can be omitted since $\phi_{a}$ and
$\phi_{b}$ are themselves code phases. This manifests the simplicity in
implementing high-dimensional PM QKD.

##  IV REFERENCE-FRAME INDEPENDENCE UNDER REALISTIC fiber SETUPS

We demonstrate, with simulation, that without phase postcompensation, the
high-dimensional PM QKD sufficiently achieves reference-frame independence
Laing  _et al._ (2010). We mainly consider two practical scenarios: fixed-
phase misalignment and small phase fluctuation. The fixed-phase misalignment
corresponds to the intrinsic reference system mismatch and the phase
fluctuation is a random phase drift added by the fiber that is independent of
the encoding, both assumed to be controlled by the adversary. By virtue of the
encoding symmetry, the phase-error rate is decoupled with channel noise Zeng
_et al._ (2020), that is, the bit-error patterns. Hence, phase misalignment
affects only the bit-error rate, whilst the phase-error rate depends merely on
light intensity. We show that fixed phase misalignment does not increase the
bit-error rate of the high-dimensional PM QKD (Section IV.1). Although phase
fluctuation does add to its bit-error rate, the decrease in key rate is
smaller than that of two-dimensional PM QKD due to the concavity of Shannon-
entropy function (Section IV.2).

To justify our arguments, we simulate the asymptotic performance of
17-dimensional PM QKD against two-dimensional without phase postcompensation.
The simulation model is similar to that illustrated in Appendix B of Ref. Ma
_et al._ (2018), with parameters given in Table 1. A detailed description is
placed in Appendix D. The key-rate formula generally follows Eq. (9).

###  IV.1 IMMUNITY TO FIXED-PHASE MISALIGNMENT

We demonstrate that the high-dimensional PM QKD achieves almost completely
immunity to fixed-phase misalignment, in clear contrast with the two-
dimensional PM QKD, which is sensitive to phase-reference mismatch. In the
two-dimensional PM QKD, the worst case scenario is that Alice and Bob hold
phase references that differ by $\delta=\pi/2$. The protocol would not
correlate Alice and Bob’s keys. Suppose Alice sends phase $A_{0}$, it can be
seen that no matter Bob sends $B_{0}$ or $B_{1}$, the interference result
would highly likely be double clicks, and any single click does not provide
too much information that helps Alice to distinguish Bob’s key bit. However,
in a $d$-dimensional PM QKD, suppose the phase references are differed by
$\delta+\frac{2k\pi}{d}$ with $\delta\in[0,\frac{2k\pi}{d})$ and $k$ being
integer. Note the $\frac{2k\pi}{d}$ term results only in a deterministic shift
between key phases, and therefore can be tackled by classical postprocessing.
Hence, the effective misalignment only ranges in $[0,\frac{2k\pi}{d})$, which
gets smaller as $d$ increases, as shown in Fig. 4 below. What is more, for the
17-dimensional PM QKD, we plot in Fig. 5 the key rate at 100 km against
misalignment ranging from 0 to $2\pi/17$. It can be seen that the lowest key
rate is reached when the misalignment is $\pi/34$, which is one fourth between
two key phases. This is reasonable since when the misalignment is half between
two key phases at $\pi/17$, the $A_{0}$ phase would be determinedly matched to
$B_{8}$ as they differ by $\pi$, causing $R$ click. Hence, $\pi/34$ is the
worst-case misalignment right between the two deterministic misalignment 0 and
$\pi/17$. It can be seen from Fig. 5 that the effect of the fixed misalignment
to the key rate of the 17-dimensional PM QKD is of 0.1% scale, and hence
negligible in practice.

Figure 4: Encoding circles of low- and high-dimensional PM QKD against worst-
case misalignment. In the low-dimensional case, both encoding phases are far
away from the deviated phase locations, thus giving much uncertainty. Yet in
the high-dimensional case, the deviated phases are closer to key phases,
enabling the error correction to coordinate the phase shift. Figure 5: Key
rate of the 17-dimensional PM QKD at 100 km against fixed misalignment. The
$\pi/17$ misalignment correlates the opposite key phases by $R$ clicks, and
hence giving almost no effect on the key rate. The worst-case misalignment is
reached at $\pi/34$, whose relative effect is negligible.

To justify the above argument, we simulate the asymptotic performance of the
two-dimensional PM QKD against the 17-dimensional PM QKD under various fixed
misalignment compared with the linear repeaterless bounds Pirandola  _et al._
(2017); Takeoka  _et al._ (2014). The linear bound we used here is the PLOB
bound Pirandola  _et al._ (2017), which corresponds to the secret key capacity
of the lossy channel. As shown in Fig. 6 below, without phase
postcompensation, the key rate of two-dimensional PM QKD decreases
continuously as the fixed misalignment increases. When the misalignment
reaches $\pi/4$, the key rate of binary PM QKD generally discounts by a factor
of 10, and when it further increases to $\pi/3$, the two-dimensional PM QKD
cannot break the linear bound anymore. In clear contrast, the 17-dimensional
PM QKD is almost completely immune to any phase misalignment. As can be seen
in the figure, the 17-dimensional PM QKD performs almost identically under
$\pi/34$ misalignment (the worst case) and no misalignment. Its key rate is
similar to that of the perfectly aligned two-dimensional PM QKD, despite a
slight decrease in the maximal reachable distance. On the other hand, the two-
dimensional PM QKD clearly cannot generate any keys under $\pi/2$
misalignment. This demonstrates the superiority of high-dimensional PM QKD in
terms of immunity to fixed misalignment.

Figure 6: Rate-distance performance of two- and 17-dimensional PM QKD against various fixed-phase misalignment, in comparison with the linear key-rate bounds Takeoka  _et al._ (2014); Pirandola  _et al._ (2017). The linear bound we use in the plot is the PLOB bound Pirandola  _et al._ (2017). The key-rate performance of the 17-PM under the worst-case $\pi/34$ misalignment is similar to that of the 2-PM with no misalignment. The key rate of 2-PM decreases gradually and cannot generate keys at the worst-case $\pi/2$ misalignment. Table 1: Summary of parameters used in the simulation Parameters | Values
---|---
fiber attenuation $\alpha$ | 0.2 dB/km
Dark count rate $p_{d}$ | $1\times 10^{-8}$
Error correction efficiency $\gamma$ | 0.95
Detector efficiency $\eta_{d}$ | 20%
No. of phase slices $D$ | 16

###  IV.2 Robustness to small phase fluctuation

When phase fluctuation is applied, the original code phases can no longer be
recovered exactly since the fluctuation is random within a range of angles. In
reality the phase fluctuation may come from the sources and the fiber, whilst
the latter is length dependent. To illustrate our ideas, we adopt a simplified
model that during each round a random noisy phase (independent of encoding)
uniformly distributed in $[-\phi_{lim},\phi_{lim}]$ is added to the encoded
coherent state, for Alice and Bob respectively. We focus on the term
$\log_{2}(d)-H(\vec{E}_{bit})$, which denotes the mutual information between
Alice and Bob, and the term $H(\vec{q_{\mu}})$, which denotes the cost due to
phase-error rate, i.e., the leak of raw key information. Fixing the
communication distance at 300 km, we compare in Fig. 7(a) the change in mutual
information $\log_{2}(d)-H(\vec{E}_{bit})$ and privacy leakage
$H(\vec{q_{\mu}})$ for two- and 17-dimensional PM QKD against the phase
fluctuation range $\phi_{lim}$. The light intensity $\mu$ is fixed at 0.2 and
0.03, respectively, for the two- and 17-dimensional, which is around the
optimal value under no fluctuation shown in Fig. 7(c). It can be seen that the
privacy leakage term $H(\vec{q_{\mu}})$ remains unchanged for both the two-
dimensional and 17-dimensional regardless of the fluctuation range. This
demonstrates the property of the encoding symmetry analysis (Section III.1)
that it decouples channel disturbance from privacy leakage Zeng  _et al._
(2020), and hence the fluctuation from the channel does not affect privacy.

Notice that the two-dimensional has greater privacy leakage than the
17-dimensional. This is reasonable since in the two-dimensional key space the
adversary is essentially guessing between two symbols, which is significantly
easier than the 17-dimensional case where she guesses between 17 symbols. In
contrast, the mutual information term $\log_{2}(d)-H(\vec{E}_{bit})$ drops for
both cases, as the fluctuation clearly results in higher bit error. We see
that the mutual information of the two-dimensional is higher than that of the
17-dimensional, which implies that the two-dimensional has fewer bit errors.
This can be understood as the single-photon interference detector outputs
binary results (left or right click), and thus it is ideal for binary key
space and yields very low bit-error rate for the two-dimensional protocol when
no fluctuation is applied (the mutual information is close to 1 bit as shown
in the figure). It however does not provide full information for the
17-dimensional protocol unless the input coherent states are in the same or
opposite phases. It thus generates lower mutual information for the
17-dimensional than the two-dimensional, although their overall key rates are
similar since the 17-dimensional has lower privacy leakage. Moreover, the
mutual information of the two-dimensional PM QKD decreases more rapidly than
that of the 17-dimensional. This is reasonable since the bit-error rate of the
two-dimensional is very low under no fluctuation. Yet when fluctuation adds to
its bit-error rate, the change rate in the term $H(\vec{E}_{bit})$ is
significantly higher since the derivative of the Shannon-entropy function
$H(p)$ is infinity when $p$ tends to 0. Hence, we see in Fig. 7(a) that the
mutual information of two-dimensional PM QKD drops more rapidly than that of
the 17-dimensional.

In order to cope with the drop in mutual information, the privacy leakage term
has to be lowered, which can be achieved through suppressing the intensity
$\mu$ of the source. Fig. 7(b) illustrates the effects of light intensity
$\mu$ on the mutual information and privacy leakage. The channel distance is
fixed at 300 km, and a phase fluctuation of range $\phi_{lim}=\pi/3$ is
applied. As expected from the encoding symmetry analysis, the mutual
information term generally does not relate with the light intensity. As the
light intensity drops, the single-photon fraction from the light source
increases, and so does the single-photon fraction in the detection. This
further lowers the uncertainty in the detection fraction of each photon number
state $\vec{q}_{\mu}$, i.e. it lowers the privacy leakage $H(\vec{q_{\mu}})$,
as shown in Fig. 7(b). In order to compensate the faster drop in mutual
information of two-dimensional PM QKD, its source intensity has to decrease
further than that of the 17-dimensional, as shown in Fig. 7(c).

The drop in the intensities results in a further drop in the overall gain
$Q_{\mu}\approx\eta\mu$. Hence, as shown in Fig. 7(d), under a small phase
fluctuation of range $\phi_{lim}=\pi/3$, the 17-dimensional PM QKD yields
higher secure key rates than the two-dimensional. Moreover, when fixed
misalignment is introduced, the key rate of two-dimensional PM QKD decreases
further, whilst that of the 17-dimensional remains. We thus conclude that the
high-dimensional PM QKD is more robust to small phase fluctuation than the
two-dimensional PM QKD.

(a)

(b)

(c)

(d)

Figure 7: High-dimensional PM QKD under phase fluctuation. (a) Mutual
information and privacy leakage against phase fluctuation range $\phi_{lim}$
for 2- and 17-PM, light intensity 0.2 and 0.03 respectively, communication
distance 300 km. The fluctuation does not affect the privacy as a result of
encoding symmetry. The mutual information of the 2-PM decreases faster than
that of the 17-PM. (b) Mutual information and privacy leakage against light
intensity $\mu$ for 2- and 17-PM, fluctuation range $\pi/3$, communication
distance 300 km. The light intensity does not affect the mutual information.
(c) Optimal light intensity $\mu$ against phase fluctuation range $\phi_{lim}$
for 2- and 17-PM, communication distance 300 km. The 2-PM light intensity
decreases rapidly as the fluctuation increases in order to compensate its
faster drop in mutual information. (d) Simulated key-rate performance: 17-PM
under both $\pi/6$ fixed misalignment and $\pi/3$ range fluctuation (red
line), 2-PM under the same scenario (blue dotted line), 2-PM under fluctuation
only, no fixed misalignment (gray dotted line). The 17-PM is superior than the
2-PM under small phase fluctuation.

##  V Concluding remarks

We generalize the two-dimensional PM QKD to any prime dimensions and analyze
their asymptotic performance. Under a reasonable fiber-optic simulation setup,
we demonstrate that when the protocol dimension is high enough, the key-rate
performance is almost completely immune to fixed phase-reference-mismatch and
robust to small phase fluctuation, i.e. it is reference-frame-independent. In
general, our work points out the feasibility of increasing protocol dimension
in order to combat misalignment. Our security argument provides the
theoretical cornerstone for the analysis of high-dimensional QKD protocols. As
possible extensions of this work, we discuss the following two remarks.

Although in the general security proof we cover all the systems of prime power
dimensions, we analyze only prime-dimensional PM QKD. This is due to the
incompatibility of the rotating encoding and the additive group of prime power
finite fields. For instance, the encoding operations of a four-dimensional PM
QKD form the order-4 cyclic group $\\{I,U,U^{2},U^{3}\\}\equiv Z_{4}$, where
$U$ is the $\pi/2-$rotation operator. In contrast, the additive group of GF(4)
is the Klein-4 group $\\{a,b|a^{2}=b^{2}=1\\}$. This incompatibility
invalidates Observation 1 for prime power dimensions. One possible solution is
to alter the encoding operations. For instance for four dimensions, the
encoding operations can be changed to $\\{I,U,V,UV\\}$, where $U$ is the
$\pi-$rotation operator, and $V$ satisfies:

$V\ket{x+ip}=\ket{p+ix}$ (12)

Clearly, this encoding operation set is also valid. Since $U^{2}=V^{2}=I$, the
encoding operation group is isomorphic to the Klein-4 group, and hence
compatible with the addition in GF(4). In fact, it can be verified that
Observation 1 holds under this encoding set. However, the caveat is that the
operation $V$, which essentially changes the two quadratures, is not unitary,
and hence arguably not physical. We thus do not include the ambiguous prime
power case in our security proof.

The phase-encoding protocols such as PM QKD bear similarity as the discrete
modulated MDI continuous-variable QKD (DM MDI CV QKD): replacing the
interference detector by the CV-Bell-like detector Pirandola  _et al._ (2015),
we obtain the DM MDI CV QKD introduced in Ref. Ma  _et al._ (2019b). Since in
the MDI setup, the detector does not affect the security, we can apply the
security analysis in this work directly to DM MDI CV QKD. This opens up the
prospective to prove CV-QKD security using DV methods, which is recently
discussed in Ref. Matsuura  _et al._ (2021).

###### Acknowledgements.

A.J. and R.V.P. acknowledge support from the UK EPSRC Quantum Communications
Hub, project EP/T001011/1. A.J. acknowledges funding from Cambridge Trust.
P.Z. and X. M. acknowledge funding from the National Natural Science
Foundation of China Grants No. 11875173 and No. 1217040781, the National Key
Research and Development Program of China Grant No. 2019QY0702 and No.
2017YFA0303903.

##  Appendix A Definitions and mathematical backgrounds

This section provides the essential mathematical tools, conventions and
specific techniques employed in the security proof of high-dimensional QKD.

###  A.1 Finite fields

The finite field, or Galois field, is the algebraic structure that lies in the
discrete-value information processing. In a general $d$ dimensional
information processing task, the set $\\{0,1,\cdots,d-1\\}$ are the symbols.
In order to construct an algebra on this set, we need to define properly
addition $\oplus$ and multiplication $\odot$ operations such that they follow
the usual associative, commutative and distributive laws and each has identity
and inverse. In other words, we need to make the symbol set a finite field,
denoted by GF($d$), by defining the addition and multiplication operations.

For prime dimension $p$, the set $\\{0,1,\cdots,p-1\\}$ can be made a finite
field trivially equipped with the usual modulus $p$ addition and
multiplication. This is the finite field $\mathbf{Z}_{p}$, and it can be seen
that every GF($p$) is isomorphic to $\mathbf{Z}_{p}$.

Next, consider the prime power dimension $d=p^{r}$. We define the canonical
addition on the set $\\{0,1,\cdots,d-1\\}$ such that:

$\displaystyle a=\sum_{m=0}^{r-1}a_{m}p^{m}\quad b=\sum_{m=0}^{r-1}b_{m}p^{m}$
(13) $\displaystyle a\oplus b=\sum_{m=0}^{r-1}(a_{m}\oplus_{p}b_{m})p^{m},$

where $\oplus_{p}$ is the $p$-modulus addition and $a_{m},b_{m}$ are the
$p$-ary decompositions of $a$ and $b$. This is a valid field addition for
GF($p^{r}$). In fact, the field multiplication can also be constructed for
GF($p^{r}$), and it can be shown that the set $\\{0,1,\cdots,d-1\\}$ can be
made a field if and only if $d=p^{r}$, i.e only prime power degree finite
fields exist Artin (2011).

The convenience of adopting the canonical addition defined above is its
compatibility with exponential operations. We will encounter frequently the
complex exponential $\gamma_{p}^{a}$, where $\gamma_{p}$ is the complex number
such that $\gamma_{p}^{p}=1$ and $a\in$GF($d$). The value of $\gamma_{p}^{a}$
is a complex number calculated as if $a$ were the usual integer. Note that the
exponential multiplication rule follows:

$\gamma_{p}^{a}\gamma_{p}^{b}=\gamma_{p}^{a+b}=\gamma_{p}^{a\oplus b},$ (14)

where $+$ is the integer addition and $\oplus$ is the canonical field
addition. It can also be seen that the canonical field addition is also
compatible with conjugation and distributive law in the way that:

$\displaystyle(\gamma_{p}^{a})^{*}=\gamma_{p}^{(-a)}=\gamma_{p}^{(\ominus a)}$
(15) $\displaystyle\gamma_{p}^{a\odot c}\gamma_{p}^{b\odot
c}=\gamma_{p}^{a\odot c+b\odot c}=\gamma_{p}^{a\odot c\oplus b\odot
c}=\gamma_{p}^{(a\oplus b)\odot c}$

Since we are always working with the complex exponential $\gamma_{p}^{a}$ in
the security proof next section, we will use $+$ in replace of $\oplus$ as
they are equivalent. The field multiplication is not compatible with complex
exponential in the sense that $(\gamma_{p}^{a})^{b}\neq\gamma_{p}^{a\odot b}$
(except for $\mathbf{Z}_{p}$). However, in the following discussions, we do
not need operations like $(\gamma_{p}^{a})^{b}$, and hence we will still
replace $a\odot b$ as $ab$.

###  A.2 The Heisenberg-Weyl group: high-dimensional Pauli operators

We introduce the Heisenberg-Weyl group as a generalization of the two-
dimensional Pauli group DURT  _et al._ (2010). For a prime-power-dimensional
space, i.e. $d=p^{r}$, with computational basis $\\{\ket{l}\\}_{l=0}^{d-1}$,
we define

$\displaystyle Z$
$\displaystyle=\sum_{l=0}^{d-1}\gamma_{p}^{l}\ket{l}\bra{l},$ (16)
$\displaystyle X$ $\displaystyle=\sum_{l=0}^{d-1}\ket{l+1}\bra{l},\text{ with
respect to GF($d$).}$

A natural mutually-unbiased basis (MUB) of $Z$-basis is given by the
eigenbasis of $X$,

$\displaystyle\ket{\tilde{l}}:=$
$\displaystyle\frac{1}{\sqrt{d}}\sum_{j=0}^{d-1}\gamma_{p}^{-lj}\ket{j},$ (17)
$\displaystyle\ket{j}=$
$\displaystyle\frac{1}{\sqrt{d}}\sum_{j=0}^{d-1}\gamma_{p}^{lj}\ket{\tilde{l}}.$

Note that $X\ket{\tilde{l}}=\gamma_{p}^{l}\ket{\tilde{l}}$. This is the basis
complementary to the computational basis.

The Heisenberg-Weyl operator $W(u,v)$ is defined to be

$W(u,v)=\sum_{l=0}^{d-1}\ket{l+u}\gamma_{p}^{lv}\bra{l},$ (18)

with $u,v=0,1,...,d-1$. It is easy to verify that

$W(u,0)W(0,v)=\gamma_{p}^{-uv}W(0,v)W(u,0)$ (19)

In prime dimension this reduces to the usual identity:

$X^{u}Z^{v}=\gamma_{p}^{-uv}Z^{v}X^{u}$ (20)

From the Heisenberg-Weyl operators, we can generate the Bell basis in prime
power dimensions. Define
$\ket{\Phi_{0,0}}=\ket{\Phi_{+}}=\dfrac{1}{\sqrt{d}}\sum_{j=0}^{d-1}\ket{jj}$.
Write $\Phi_{0,0}$ in $X$-basis,

$\displaystyle\ket{\Phi_{0,0}}$
$\displaystyle=\frac{1}{\sqrt{d}}\sum_{j=0}^{d-1}\ket{jj}$ (21)
$\displaystyle=\frac{1}{\sqrt{d}}\sum_{k,l=0}^{d-1}\sum_{j=0}^{d-1}\gamma_{p}^{j(k+l)}\ket{\tilde{k}\tilde{l}}$
$\displaystyle=\frac{1}{\sqrt{d}}\sum_{k=0}^{d-1}\ket{\tilde{k},\widetilde{-k}}.$

The generalized qudit Bell states Bennett  _et al._ (1993) are

$\displaystyle\ket{\Phi_{u,v}}$ $\displaystyle:=(I\otimes
W(u,v))\ket{\Phi_{+}}$ (22)
$\displaystyle=\frac{1}{\sqrt{d}}\sum_{l=0}^{d-1}\gamma_{p}^{lv}\ket{l}_{A}\otimes\ket{l+u}_{B},$

Denote $\Phi_{u,v}:=\ket{\Phi_{u,v}}\bra{\Phi_{u,v}}$. The qudit Bell states
$\\{\Phi_{u,v}\\}_{u,v=0}^{d-1}$ form an orthonormal basis,

$\displaystyle\braket{\Phi_{u,v}}{\Phi_{u^{\prime},v^{\prime}}}$
$\displaystyle=\frac{1}{d}\sum_{m,l=0}^{d-1}\gamma_{p}^{-lv}\gamma_{p}^{mv^{\prime}}\bra{l,l+u}\ket{m,m+u^{\prime}}$
(23)
$\displaystyle=\frac{1}{d}\sum_{l=0}^{d-1}\gamma_{p}^{-l(v-v^{\prime})}\delta_{u_{d},0}$
$\displaystyle=\delta_{u_{d},0}\delta_{v_{d},0}$

where $u_{d}:=u^{\prime}-u,v_{d}:=v^{\prime}-v$.

###  A.3 Parity check in GF(d)

We discuss the parity check operations for qudits since it plays a central
role in the security proof. A length-$N$ GF($d$) string $\mathbf{x}$ is an
ordered $N$-tuple:

$\mathbf{x}=[x_{0},x_{1},\cdots,x_{N-1}],$ (24)

where each element belongs to GF($d$). For two length-$N$ GF($d$) strings
$\mathbf{x}$ and $\mathbf{y}$, define the dot product as

$\mathbf{x}\cdot\mathbf{y}=\sum_{k=0}^{N-1}x_{k}y_{k},$ (25)

where the additions and multiplications are defined on GF($d$).

We focus on non-zero parity check as zero parity check would give a zero
result for sure. For a fixed non-zero $\mathbf{y}$, the dot product
$\mathbf{x}\cdot\mathbf{y}$ gives $d$ different results uniformly, i.e. there
are $d^{N-1}$ string $\mathbf{x}$ giving the same $\mathbf{x}\cdot\mathbf{y}$.
We call this dot product the parity check of $\mathbf{x}$, and it can be seen
that one praity-check equation divides the overall string space into $d$
cosets, each represented by the dot product result, which is a member of
GF($d$).

According to linear algebra, in order to completely determine an unknown
length-$N$ GF($d$) string $\mathbf{x}$, it takes $N$ linearly independent
praity-check equations. This idea can be extended to quantum systems. Define
the $Z$-parity measurement channel as the Kraus representation:

$\mathcal{M}_{Z}(\mathbf{v})\\{\rho\\}=\sum_{l=0}^{d-1}P_{l}(\mathbf{v})\rho
P_{l}(\mathbf{v})^{\dagger},$ (26)

where $\mathbf{v}$ is a length-$N$ GF($d$) string and $\rho$ is any density
operator on $\mathcal{H}_{d}^{\otimes N}$. The Kraus operator
$P_{l}(\mathbf{v})$ is given as the projector onto the space of parity check
result $\mathbf{z}\cdot\mathbf{v}=l$:

$P_{l}(\mathbf{v})=\sum_{\mathbf{z}\cdot\mathbf{v}=l}\ket{\mathbf{z}}\bra{\mathbf{z}}$
(27)

Similarly, we can define the $X$-parity measurement
$\mathcal{M}_{X}(\mathbf{v})$ with respect to the $X$ basis. The output of the
parity measurement is a mixture of $d$ parity states, i.e.

$\displaystyle\mathcal{M}_{Z}(\mathbf{v})\\{\rho\\}$
$\displaystyle=\sum_{l=0}^{d-1}P_{l}(\mathbf{v})\rho
P_{l}(\mathbf{v})^{\dagger}$ (28)
$\displaystyle=\sum_{l=0}^{d-1}\sum_{\mathbf{z},\mathbf{z^{\prime}}\cdot\mathbf{v}=l}\ket{\mathbf{z}}\bra{\mathbf{z}}\rho\ket{\mathbf{z^{\prime}}}\bra{\mathbf{z^{\prime}}}$
$\displaystyle=\sum_{l=0}^{d-1}p_{l}\rho_{l},$

where

$\displaystyle
p_{l}=\sum_{\mathbf{z}\cdot\mathbf{v}=l}\bra{\mathbf{z}}\rho\ket{\mathbf{z}}$
(29)
$\displaystyle\rho_{l}=\sum_{\mathbf{z},\mathbf{z^{\prime}}\cdot\mathbf{v}=l}\frac{\bra{\mathbf{z}}\rho\ket{\mathbf{z^{\prime}}}}{p_{l}}\ket{\mathbf{z}}\bra{\mathbf{z^{\prime}}}\text{,
having parity $l$.}$

It can be seen that it takes $N$ linearly independent $Z$/$X$-parity
measurements to determine the $Z$/$X$ measurement results of an unknown state
in $\mathcal{H}_{d}^{\otimes N}$.

##  Appendix B Security proof of high-dimensional QKD

In this section, we provide the rigorous security analysis of high-dimensional
QKD. Our proof follows the outline of Koashi’s complementarity approach Koashi
(2009), and extends it by generalizing the phase-error correction procedure to
high dimensions.

###  B.1 The squashing protocol

The core of Koashi’s qubit-based security proof is to reduce the two-body
private and random key distribution to a single-body private and random number
generation, i.e. to reduce entanglement distillation to coherence distillation
Ma  _et al._ (2019a). The security of the actual protocol can thus be proved
if the single body squashing protocol is secure.

Consider the entanglement-based actual protocol below. Note that its
equivalence to the prepare-and-measure protocol follows from the usual Shor-
Preskill arguments Shor and Preskill (2000). Also note that this protocol is
of prime power dimension $d=p^{r}$ rather than qubit-based (we use “digits” in
replace of “bits”).

Actual protocol

  1. 1.

State distribution Alice and Bob share a bipartite state $\rho_{AB}$ in the
space $(\mathcal{H}_{A}\otimes\mathcal{H}_{B})^{\otimes N}$ after $N$ runs of
quantum communications.

  2. 2.

Measurement Alice and Bob measure their systems $\mathcal{H}_{A}^{\otimes N}$
and $\mathcal{H}_{B}^{\otimes N}$ respectively. They obtain two $N$-digit
unreconciled key strings.

  3. 3.

Error correction They reconcile the key strings through an encrypted classical
channel consuming $l_{ec}$ digits of secret key. They agree on an $N$-digit
raw key string $\kappa_{rec}$ except for a small failure probability
$\epsilon_{cor}$.

  4. 4.

Privacy amplification Alice randomly chooses $(N-m)$ $N$-digit strings
$\\{V_{k}\\}_{k=1,\cdots,N-m}$, which are linearly independent, and announces
them to Bob. The final key length is $(N-m)$, where the $k$-th key digit is
$\kappa_{rec}\cdot V_{k}$, where the dot product is to be understood with
addition and multiplication in the finite field $GF(d)$. Denote the final key
as $\kappa_{fin}$.

After the protocol, the overall state shared by Alice and Bob and Eve is

$\rho_{ABKE}^{fin}=\sum_{\kappa_{A},\kappa_{B},\kappa_{fin}}Pr_{A,B,K}(\kappa_{A},\kappa_{B},\kappa_{fin})\ket{\kappa_{A}}_{A}\bra{\kappa_{A}}\otimes\ket{\kappa_{B}}_{B}\bra{\kappa_{B}}\otimes\ket{\kappa_{fin}}_{K}\bra{\kappa_{fin}}\otimes\rho_{E}(\kappa_{A},\kappa_{B},\kappa_{fin}),$
(30)

where $K$ is the key generation system (it is taken as Alice’s system $A$
usually), and $Pr_{A,B,K}(\kappa_{A},\kappa_{B},\kappa_{rec})$ is the
probability of Alice and Bob holding an $(N-m)$-digit string $\kappa_{A}$ and
$\kappa_{B}$ respectively after the protocol whilst the correct reconciled key
string being $\kappa_{rec}$. On the other hand, the ideal state is

$\rho_{ABKE}^{ideal}=(d^{N-m})^{-1}\sum_{\kappa}\ket{\kappa}_{A}\bra{\kappa}\otimes\ket{\kappa}_{B}\bra{\kappa}\otimes\ket{\kappa}_{K}\bra{\kappa}\otimes\rho_{E},$
(31)

where Alice and Bob share the correct reconciled key string, which is
completely random and decoupled from Eve’s system.

In this way, a QKD protocol is defined to be $\epsilon$-secure, if the final
distilled state $\rho_{ABKE}^{fin}$ is close to the ideal state
$\rho_{ABKE}^{ideal}$ for a properly chosen $\rho_{E}$

$\min_{\rho_{E}}\frac{1}{2}||\rho_{ABKE}^{fin}-\rho_{ABKE}^{ideal}||_{1}\leq\epsilon,$
(32)

where $||A||_{1}\equiv Tr\\{\sqrt{A^{\dagger}A}\\}$ is the trace norm.

In the error correction step of the actual protocol, we claim that Alice and
Bob can correct their strings to $\kappa_{rec}$ except for a small failure
probability $\epsilon_{cor}$. This means the protocol is
$\epsilon_{cor}$-correct since

$Pr_{A,B,K}(\kappa_{A}\text{ or
}\kappa_{B}\neq\kappa_{rec})\leq\epsilon_{cor}$ (33)

This property simply states Alice and Bob would very likely be sharing the
same correct key strings. Hence intuitively, we can think Alice and Bob and
the reconciled key generation system $K$ as a single party, i.e. we squash
them into one system.

More precisely, if Alice and Bob can apply a squashing operation $\Lambda$ on
$(\mathcal{H}_{A}\otimes\mathcal{H}_{B})^{\otimes N}$ to convert it to a key
space $\mathcal{K}^{\otimes N}$ and an ancillary space $\mathcal{H}_{R}$, and
the key measurement statistics on $\mathcal{K}^{\otimes N}$ is the same as
$\kappa_{rec}$ in the actual protocol, we arrive at the following squashing
protocol

Squashing protocol

  1. 1.

State distribution Alice and Bob share a bipartite state $\rho_{AB}$ in the
space $(\mathcal{H}_{A}\otimes\mathcal{H}_{B})^{\otimes N}$ after $N$ runs of
quantum communications.

  2. 2.

Squashing They apply $\Lambda$ on $\rho_{AB}$ and convert it to a key space
$\mathcal{K}^{\otimes N}$ and an ancillary space $\mathcal{H}_{R}$, i.e.
$\Lambda(\rho_{AB})\in\mathcal{K}^{\otimes N}\otimes\mathcal{H}_{R}$.

  3. 3.

Measurement They measure $\mathcal{H}_{R}$ by $\mathcal{M}_{R}$ to obtain
result $\gamma$. They then measure $\mathcal{K}^{\otimes N}$ to obtain
$\kappa_{rec}$, with the same measurement statistics as that in the actual
protocol.

  4. 4.

Privacy amplification They randomly choose $(N-m)$ $N$-digit strings
$\\{V_{k}\\}_{k=1,\cdots,N-m}$, which are linearly independent. The final key
length is $(N-m)$, where the $k$-th key digit is $\kappa_{rec}\cdot V_{k}$.
Denote the final key as $\kappa_{fin}$.

Since the key space $\mathcal{K}^{\otimes N}$ measurement statistics is the
same as that of the actual protocol, the final state after the squashing
protocol is therefore

$\rho_{KE}^{fin}=\sum_{\kappa_{fin}}Pr_{K}(\kappa_{fin})\ket{\kappa_{fin}}_{K}\bra{\kappa_{fin}}\otimes\rho_{E}(\kappa_{fin}),$
(34)

where the probability distribution $Pr_{K}(\kappa_{fin})$ is the marginal
distribution of $Pr_{A,B,K}(\kappa_{A},\kappa_{B},\kappa_{fin})$ in the actual
final state (30), whilst the ideal squashed state is

$\rho_{KE}^{ideal}=(d^{N-m})^{-1}\sum_{\kappa}\ket{\kappa}_{K}\bra{\kappa}\otimes\rho_{E},$
(35)

Likewise, the squashing protocol is termed $\epsilon_{sec}$-secret if the
squashed state $\rho_{KE}$ is close to ideality, i.e.

$\min_{\rho_{E}}\frac{1}{2}||\rho_{KE}^{fin}-\rho_{KE}^{ideal}||_{1}\leq\epsilon_{sec}$
(36)

In Koashi (2009), it is proved that as long as the squashing protocol is
$\epsilon_{sec}$-secret with an $\epsilon_{cor}$-correct error correction, the
actual protocol is $(\epsilon_{sec}+\epsilon_{cor})$-secure. Notice that in
Ref. Koashi (2009) the quantum system is of dimension 2, but it can be
trivially generalized to arbitrary dimension.

###  B.2 The phase-error correction protocol

It now remains to show that the single-body squashing protocol is secure. We
do this by invoking phase-error correction, which bears intuitions from the
uncertainty principle of two complementary operators: if the $X$-basis
measurement of $\mathcal{K}^{\otimes N}$ is completely certain, the $Z$-basis
measurement of it, which is by convention the key generation measurement, is
completely random.

To be more specific, suppose $Z$-basis measurement on $\mathcal{K}^{\otimes
N}$ is used for key generation in the squashing protocol. If, before the key
generation measurement on $\mathcal{K}^{\otimes N}$, Alice and Bob are able to
determine the $X$-basis measurement result of $\mathcal{K}^{\otimes N}$ to be
$\mathbf{x}^{*}$ except for a small failure probability
$\epsilon_{T}^{\prime}$, we would have

$\bra{\tilde{\mathbf{x}^{*}}}\rho_{K}\ket{\tilde{\mathbf{x}^{*}}}=F(\rho_{K},\ket{\tilde{\mathbf{x}^{*}}}\bra{\tilde{\mathbf{x}^{*}}})\geq
1-\epsilon_{T}^{\prime},$ (37)

i.e. the state on $\mathcal{K}^{\otimes N}$ is close to the $X$ eigenstate
$\ket{\tilde{\mathbf{x}^{*}}}$ in terms of fidelity $F$. Following Ref. Fung
_et al._ (2010), it can be shown that there exists $\sigma_{E}$ on Eve’s
system such that

$F(\rho_{KE},\ket{\tilde{\mathbf{x}^{*}}}\bra{\tilde{\mathbf{x}^{*}}}\otimes\sigma_{E})\geq
1-\epsilon_{T}^{\prime}$ (38)

Hence, the overall state before the key generation measurement is
approximately a separate state if we can assure that the state on
$\mathcal{K}^{\otimes N}$ is close to a $X$ eigenstate, i.e. we can determine
its $X$-basis measurement result. Note that the state
$\ket{\tilde{\mathbf{x}^{*}}}\bra{\tilde{\mathbf{x}^{*}}}\otimes\sigma_{E}$
yields $\rho_{KE}^{ideal}$ after $Z$-basis measurements and privacy
amplification, and fidelity never decreases after quantum operations. Hence,
the squashing protocol is secure (and so is the actual protocol) as long as we
can determine the X-basis measurement result of the key generation system
$\mathcal{K}^{\otimes N}$.

In order to gain information of the $X$-basis measurement result of
$\mathcal{K}^{\otimes N}$, we make use of the ancillary system
$\mathcal{H}_{R}$ left after the squashing operation $\Lambda$. We measure
$\mathcal{H}_{R}$ by $\mathcal{M}_{R}$ and obtain a result $\gamma$, which
provides information of the $X$-basis measurement result of
$\mathcal{K}^{\otimes N}$. To be more specific, given each measurement result
$\gamma$ on $\mathcal{H}_{R}$, suppose the candidates of $\mathcal{K}^{\otimes
N}$ $X$-basis measurement result are summarized in the set $T_{\gamma}$.
Suppose the cardinality of the candidate sets, except for a small probability
$\epsilon_{T}$, can be bounded by:

$|T_{\gamma}|\leq d^{Ns}.$ (39)

In this case, suppose we make $m=N(s+\zeta)$ random $X$-parity checks, i.e.
phase-error correction (see Appendix A.3), we can derive the $X$-basis
measurement result of $\mathcal{K}^{\otimes N}$ with an exponentially small
failure probability $\epsilon_{T}^{\prime}\equiv\epsilon_{T}+d^{-N\zeta}$
Bennett  _et al._ (1996). Hence, we claim the
$\sqrt{\epsilon_{T}^{\prime}}$-secret of the following single-body phase-error
correction protocol:

phase-error correction protocol

  1. 1.

State distribution Alice and Bob share a bipartite state $\rho_{AB}$ in the
space $(\mathcal{H}_{A}\otimes\mathcal{H}_{B})^{\otimes N}$ after $N$ runs of
quantum communications.

  2. 2.

Squashing They apply $\Lambda$ on $\rho_{AB}$ and convert it to a key space
$\mathcal{K}^{\otimes N}$ and an ancillary space $\mathcal{H}_{R}$, i.e.
$\Lambda(\rho_{AB})\in\mathcal{K}^{\otimes N}\otimes\mathcal{H}_{R}$. The
$Z$-basis measurement statistics on $\mathcal{K}^{\otimes N}$ is the same as
$\kappa_{rec}$ in the actual protocol.

  3. 3.

Ancillary measurement They measure $\mathcal{H}_{R}$ by $\mathcal{M}_{R}$ to
obtain result $\gamma$. The candidate sets cardinality $|T_{\gamma}|\leq
d^{Ns}$ except for a small probability $\epsilon_{T}$.

  4. 4.

phase-error correction For $m=N(s+\zeta)$, they randomly choose $m$ $N$-digit
strings $\\{W_{j}\\}_{j=1,\cdots,m}$ and perform X-parity measurements
$\\{\mathcal{M}_{X}(W_{j})\\}$ on $\mathcal{K}^{\otimes N}$ to determine its
$X$-basis measurement result.

  5. 5.

Key generation They choose an arbitrary linearly independent set
$\\{V_{k}\\}_{k=1,\cdots,N-m}$ satisfying $V_{k}\cdot W_{j}=0$ for any
($j$,$k$). They perform $Z$-parity check measurements
$\\{\mathcal{M}_{Z}(V_{k})\\}$ to obtain the ($N-m$)-digit final key
$\kappa_{fin}$.

It only remains to show the equivalence of the phase-error correction protocol
and the squashing protocol. Observe that this can be done if we can, just like
that in Ref. Koashi (2009), swap the key generation step with the phase-error
correction step and omit the latter as well. However, this is the point where
the two-dimensional proof cannot be extended trivially to higher dimensions.
In the two-dimensional proof, $X$ and $Z$ operators are also observables, and
thus the parity check measurements have decent observable forms. In this case,
the commuting argument is guaranteed by the commutation of $X$-parity check
observables and $Z$-parity check observables. However, in high dimensions, the
parity check measurements with multiple outcomes cannot be easily expressed as
Pauli operators, so here we describe the parity check measurements with
measurement (Kraus) operators. In the section below, we show that this
commuting argument is still valid: as long as $W_{j}$ is orthogonal with
$V_{k}$, the statistics of the $Z$-parity measurement
$\\{\mathcal{M}_{Z}(V_{k})\\}$ would not change even if we perform in prior an
$X$-parity measurement $\\{\mathcal{M}_{X}(W_{j})\\}$ (42). In this way, we
manage to show the security of the actual protocol:

######  Theorem 1.

If the actual protocol can be converted into a squashing protocol with
squashing operation $\Lambda$ and ancillary measurement $\mathcal{M}_{R}$ such
that:

  1. 1.

The $Z$-basis measurement statistics on $\mathcal{K}^{\otimes N}$ is the same
as $\kappa_{rec}$ in the actual protocol.

  2. 2.

Given each measurement outcome $\gamma$ on $\mathcal{H}_{R}$, the size of
$X$-basis measurement outcome on $\mathcal{K}^{\otimes_{N}}$ is bounded by
$|T_{\gamma}|\leq d^{Ns}$, except for a small probability $\epsilon_{T}$,

then the squashing protocol is $\sqrt{\epsilon_{T}^{\prime}}$-secret, and the
actual protocol is $(\sqrt{\epsilon_{T}^{\prime}}+\epsilon_{cor})$-secure,
where $\epsilon_{T}^{\prime}=\epsilon_{T}+d^{-N\zeta}$ and $m=N(s+\zeta)$.

It is useful to derive the key-rate formula based on phase error of high-
dimensional QKD. Our goal is to determine the X-basis measurement outcome
$X^{*}$ on $\mathcal{K}^{\otimes_{N}}$, and we infer $X^{*}$ based on the
ancillary measurement result $\gamma$. Based on each $\gamma$, suppose we make
an estimation of $X^{*}$ as $X_{\gamma}$. Denote the phase error number vector
of a given $\gamma$ as $\vec{N}_{ph}:=\vec{wt}(X_{\gamma}-X^{*})$, where the
subtraction is defined for GF($d$) strings, and the vector weight function for
GF($d$) is defined as:

$\vec{wt}(\mathbf{a})=\begin{bmatrix}\text{No. of 0 in $\mathbf{a}$}\\\
\text{No. of 1 in $\mathbf{a}$}\\\ \cdots\\\ \text{No. of $d$-1 in
$\mathbf{a}$}\end{bmatrix}$ (40)

Hence, the phase error number vector $\vec{N}_{ph}$ counts the numbers of
different types of phase error of our estimation $X_{\gamma}$. Denote the
average phase error number vector for all $\gamma$ as $\vec{N}_{ph}$, and the
phase-error rate vector as $\vec{E}_{ph}:=\vec{N}_{ph}/N$, i.e. it counts the
phase-error rate of different types of phase error. Based on Shannon’s typical
sequences arguments, taking the reconciliation cost as $l_{ec}$ bits, the key
generation length of a $d$-dimensional QKD is

$\displaystyle R$ $\displaystyle=N-m-l_{ec}/\log_{2}d\text{ (dits)}$ (41)
$\displaystyle\leq N(1-H_{d}(\vec{E}_{ph}))-l_{ec}/\log_{2}d\text{ (dits)}$
$\displaystyle=N(\log_{2}d-H_{2}(\vec{E}_{ph}))-l_{ec}\text{ (bits)},$

where $H_{2}$ and $H_{d}$ are the $\log_{2}$ and $\log_{d}$ based Shannon-
entropy functions respectively.

###  B.3 The commuting argument in high dimension

Denote $N$ as the number of digits of the raw key, i.e. the rounds of quantum
communication. $d$ is the dimension of the primitive Hilbert space
$\mathcal{H}_{d}$, i.e. we are operating on qudits. We confine $d$ to be a
prime power, i.e. $d=p^{r}$, where $p$ is a prime number, so that we can
define the finite field GF($d$). Denote $\gamma_{p}$ as the complex number
satisfying $\gamma_{p}^{p}=1$. In the arguments below, the addition,
multiplication and dot product are to be understood within GF($d$).

Given two $N$-digit GF($d$) strings $\mathbf{a}$ and $\mathbf{b}$ such that
$\mathbf{a}\cdot\mathbf{b}=0$, we would like to show that

$\mathcal{M}^{\mathbf{a}}_{Z}\circ\mathcal{M}^{\mathbf{b}}_{X}=\mathcal{M}^{\mathbf{a}}_{Z}\text{
in terms of measurement statistics.}$ (42)

If $\mathbf{a}=0$, the argument follows trivially as the measurement result is
always zero. For non-zero $\mathbf{a}$ and an arbitrary state $\rho$, the
probability that it falls into the $l$-th eigenspace of
$\mathcal{M}_{Z}(\mathbf{a})$ is:

$\sum_{\mathbf{z}\cdot\mathbf{a}=l}\bra{\mathbf{z}}\rho\ket{\mathbf{z}}$ (43)

On the other hand, the state after $\mathcal{M}_{X}(\mathbf{b})$ is:

$\sum_{j=0}^{d-1}\sum_{\mathbf{x_{j}}\text{,}\mathbf{x_{j}^{\prime}}\cdot\mathbf{b}=j}\ket{\tilde{\mathbf{x_{j}}}}\bra{\tilde{\mathbf{x_{j}}}}\rho\ket{\tilde{\mathbf{x_{j}^{\prime}}}}\bra{\tilde{\mathbf{x_{j}^{\prime}}}}$
(44)

The probability that its $\mathcal{M}_{Z}(\mathbf{a})$ result falls into the
$l$-th eigenspace is thus:

$\sum_{\mathbf{z}\cdot\mathbf{a}=l}\bra{\mathbf{z}}\left(\sum_{j=0}^{d-1}\sum_{\mathbf{x_{j}}\text{,}\mathbf{x_{j}^{\prime}}\cdot\mathbf{b}=j}\ket{\tilde{\mathbf{x_{j}}}}\bra{\tilde{\mathbf{x_{j}}}}\rho\ket{\tilde{\mathbf{x_{j}^{\prime}}}}\bra{\tilde{\mathbf{x_{j}^{\prime}}}}\right)\ket{\mathbf{z}}$
(45)

Our task is to show that (43) = (45).

We first examine three lemmas. In the argument below, we ignore the scaling
constants to simplify the notations.

######  Lemma 1.

$\sum_{\mathbf{z}}\gamma_{p}^{\mathbf{z}\cdot\mathbf{x}}=\begin{cases}1\quad&\mathbf{x}=\mathbf{0}\\\
0\quad&\mathbf{x}\neq\mathbf{0}\end{cases}$ (46)

where $\mathbf{z}$ traverses all GF(d) strings with some fixed length.

######  Lemma 2.

If $\mathbf{x}$ is 0 at one of the non-zero positions of $\mathbf{a}$, then
for any GF(d) member $l$:

$\sum_{\mathbf{z}\cdot\mathbf{a}=l}\gamma_{p}^{\mathbf{z}\cdot\mathbf{x}}=\begin{cases}1\quad&\mathbf{x}=\mathbf{0}\\\
0\quad&\mathbf{x}\neq\mathbf{0}\end{cases}$ (47)

Proof: Since $\mathbf{x}$ is 0 at one of the non-zero positions of
$\mathbf{a}$, that digit is essentially redundant in the summation. Denote the
($N-1$)-digit sub-string of $\mathbf{z}$ with that digit removed as
$\mathbf{z^{\prime}}$. Since $\mathbf{z}$ traverses all $N$-digit strings that
satisfy $\mathbf{z}\cdot\mathbf{a}=l$, $\mathbf{z^{\prime}}$ actually takes
values of all ($N-1$)-digit strings. To see this, observe that for any
($N-1$)-digit string $\mathbf{z^{\prime}}$, there is one and only one
$N$-digit string $\mathbf{z}$ that satisfies $\mathbf{z}\cdot\mathbf{a}=l$
corresponds to it. This is guaranteed as we are working with a field
structure. Hence, we transformed the summation to the case of Lemma 1.

######  Lemma 3.

$\sum_{\mathbf{z}\cdot\mathbf{a}=l}\gamma_{p}^{\mathbf{z}\cdot\mathbf{x}}=\begin{cases}\gamma_{p}^{x_{0}l}\quad&\mathbf{x}=x_{0}\mathbf{a},\quad
x_{0}=0,1,\cdots,d-1\\\ 0\quad&\text{otherwise}\end{cases}$ (48)

Proof: Assume $\mathbf{a}$ is non-zero at digit $n$. As we are working with a
field structure, there always exists $x_{0}\in\\{0,1,\cdots,d-1\\}$ such that
$\mathbf{x}_{n}=x_{0}\mathbf{a}_{n}$. We make the following decomposition:

$\sum_{\mathbf{z}\cdot\mathbf{a}=l}\gamma_{p}^{\mathbf{z}\cdot\mathbf{x}}=\sum_{\mathbf{z}\cdot\mathbf{a}=l}\gamma_{p}^{x_{0}(\mathbf{z}\cdot\mathbf{a})}\gamma_{p}^{\mathbf{z}\cdot(\mathbf{x}-x_{0}\mathbf{a})}=\gamma_{p}^{x_{0}l}\sum_{\mathbf{z}\cdot\mathbf{a}=l}\gamma_{p}^{\mathbf{z}\cdot(\mathbf{x}-x_{0}\mathbf{a})}$
(49)

Note that $(\mathbf{x}-x_{0}\mathbf{a})$ is guaranteed to be zero at digit
$n$, where $\mathbf{a}$ is non-zero. We can then apply Lemma 2 to arrive at
the desired result.

We are ready to prove the main claim that (43) = (45):

$\displaystyle\sum_{\mathbf{z}\cdot\mathbf{a}=l}\bra{\mathbf{z}}\left(\sum_{j=0}^{d-1}\sum_{\mathbf{x_{j}}\text{,}\mathbf{x_{j}^{\prime}}\cdot\mathbf{b}=j}\ket{\tilde{\mathbf{x_{j}}}}\bra{\tilde{\mathbf{x_{j}}}}\rho\ket{\tilde{\mathbf{x_{j}^{\prime}}}}\bra{\tilde{\mathbf{x_{j}^{\prime}}}}\right)\ket{\mathbf{z}}$
(50) $\displaystyle=$
$\displaystyle\sum_{\mathbf{z}\cdot\mathbf{a}=l}\sum_{j=0}^{d-1}\sum_{\mathbf{x_{j}}\text{,}\mathbf{x_{j}^{\prime}}\cdot\mathbf{b}=j}\bra{\tilde{\mathbf{x_{j}}}}\rho\ket{\tilde{\mathbf{x_{j}^{\prime}}}}\gamma_{p}^{-\mathbf{z}\cdot\mathbf{x_{j}}+\mathbf{z}\cdot\mathbf{x_{j}^{\prime}}}$
$\displaystyle=$
$\displaystyle\sum_{\mathbf{z}\cdot\mathbf{a}=l}\sum_{j=0}^{d-1}\sum_{\mathbf{x_{j}}\text{,}\mathbf{x_{j}^{\prime}}\cdot\mathbf{b}=j}\sum_{\mathbf{k}\text{,}\mathbf{k^{\prime}}}\bra{\mathbf{k}}\rho\ket{\mathbf{k^{\prime}}}\gamma_{p}^{-\mathbf{z}\cdot\mathbf{x_{j}}+\mathbf{z}\cdot\mathbf{x_{j}^{\prime}}-\mathbf{x_{j}^{\prime}}\cdot\mathbf{k^{\prime}}+\mathbf{x_{j}}\cdot\mathbf{k}}$
$\displaystyle=$
$\displaystyle\sum_{\mathbf{k}\text{,}\mathbf{k^{\prime}}}\sum_{j=0}^{d-1}\sum_{\mathbf{x_{j}}\text{,}\mathbf{x_{j}^{\prime}}\cdot\mathbf{b}=j}\bra{\mathbf{k}}\rho\ket{\mathbf{k^{\prime}}}\gamma_{p}^{-\mathbf{x_{j}^{\prime}}\cdot\mathbf{k^{\prime}}+\mathbf{x_{j}}\cdot\mathbf{k}}\sum_{\mathbf{z}\cdot\mathbf{a}=l}\gamma_{p}^{\mathbf{z}\cdot(\mathbf{x_{j}^{\prime}}-\mathbf{x_{j}})}$
$\displaystyle=$
$\displaystyle\sum_{\mathbf{k}\text{,}\mathbf{k^{\prime}}}\sum_{j=0}^{d-1}\sum_{x_{0}=0}^{d-1}\sum_{\begin{subarray}{c}\mathbf{x_{j}}\text{,}\mathbf{x_{j}^{\prime}}\cdot\mathbf{b}=j\\\
\mathbf{x_{j}^{\prime}}-\mathbf{x_{j}}=x_{0}\mathbf{a}\end{subarray}}\bra{\mathbf{k}}\rho\ket{\mathbf{k^{\prime}}}\gamma_{p}^{x_{0}l}\gamma_{p}^{\mathbf{x_{j}}\cdot(\mathbf{k}-\mathbf{k^{\prime}})}\gamma_{p}^{-x_{0}\mathbf{k^{\prime}}\cdot\mathbf{a}}$
$\displaystyle=$
$\displaystyle\sum_{\mathbf{k}\text{,}\mathbf{k^{\prime}}}\sum_{x_{0}=0}^{d-1}\sum_{\mathbf{x_{j}}}\bra{\mathbf{k}}\rho\ket{\mathbf{k^{\prime}}}\gamma_{p}^{x_{0}(l-\mathbf{k^{\prime}}\cdot\mathbf{a})}\gamma_{p}^{\mathbf{x_{j}}\cdot(\mathbf{k}-\mathbf{k^{\prime}})}$
$\displaystyle=$
$\displaystyle\sum_{\mathbf{k^{\prime}}\cdot\mathbf{a}=l}\bra{\mathbf{k}}\rho\ket{\mathbf{k^{\prime}}}\delta_{\mathbf{k}=\mathbf{k^{\prime}}}$
$\displaystyle=$
$\displaystyle\sum_{\mathbf{k}\cdot\mathbf{a}=l}\bra{\mathbf{k}}\rho\ket{\mathbf{k}},$

which is exactly the $\mathcal{M}^{\mathbf{a}}_{Z}$ statistics without
$\mathcal{M}^{\mathbf{b}}_{X}$ in (43). Lemma 1 and Lemma 3 are applied in the
6-th and 4-th equalities. Notice that in the summation we require
$\mathbf{x_{j}}\text{,}\mathbf{x_{j}^{\prime}}\cdot\mathbf{b}=j$ for any
GF($d$) member $j$, which is equivalent to
$(\mathbf{x_{j}^{\prime}}-\mathbf{x_{j}})\cdot\mathbf{b}=0$. Hence,
$\mathbf{x_{j}^{\prime}}-\mathbf{x_{j}}=x_{0}\mathbf{a}$ is within the
summation range since we picked $\mathbf{a}\cdot\mathbf{b}=0$. Therefore, the
swapping argument that performing $X$ parity checks and then $Z$ hashed key
generation is equivalent to the latter on its own can be extended to higher-
dimensional cases.

##  Appendix C Symmetry-based security analysis of high-dimensional PM QKD

###  C.1 symmetric encoding protocols

Based on the security proof of high-dimensional QKD developed above and the
symmetric encoding security analysis of PM QKD Zeng  _et al._ (2020), we
provide the security analysis of $d$-dimensional PM QKD where $d$ is a prime
number. We introduce the entanglement-based symmetric encoding QKD protocol,
as shown in Fig. 8 below. Alice and Bob share the state $\rho_{AB}$ on system
$A$ and $B$, and each holds an ancillary $d$-dimensional qudit system
$A^{\prime}$ and $B^{\prime}$ initially on the state
$\ket{+}_{d}:=\frac{1}{\sqrt{d}}\sum_{j=0}^{d-1}\ket{j}$.

Figure 8: Schematic diagram of the entanglement-based $d$-dimensional PM QKD,
where $\rho_{AB}$ is a bipartite state on two optical modes, and the encoding
operation $U$ rotates the coherent state by $2\pi/d$. The optical mode is
phase-rotated by $2\pi k/d$ if the $k$-th control dit is triggered. Same as
Fig. 3 in the main text.

Alice and Bob send the shared state $\rho_{AB}$ through a controlled encoding
operation, where

$C_{A^{\prime}A}(U)=\sum_{j=0}^{d-1}\ket{j}_{A^{\prime}}\bra{j}\otimes
U_{A}^{j},$ (51)

and similarly for $C_{B^{\prime}B}(U)$. The unitary encoding operation is
$d$-rotation symmetric, i.e., $U^{d}=I$. They then send the systems $A$ and
$B$ further to Eve for detection. At the end of the quantum communications,
they share $N$ pairs of qudit systems for key generation.

Following the security proof of high-dimensional QKD given above, taking
$A^{\prime}$ as the key generation system and $B^{\prime}$ as the ancillary
system, we need to determine the X-measurement results of $A^{\prime}$ with
the knowledge of that of $B^{\prime}$. This can be done as long as the
originally separate $\ket{+}_{A^{\prime}}$ and $\ket{+}_{B^{\prime}}$ are now
entangled after the symmetric encoding operations. In other words, we need the
shared state $\rho_{AB}$ to give the same encoded state after different
encoding operations, i.e. $\rho_{AB}$ being the eigenstate of $U_{A}\otimes
U_{B}$.

Since we have $(U\otimes U)^{d}=I$, the eigenvalues of $(U\otimes U)$ are
$\\{\gamma_{d}^{j}:=\exp(i\frac{2\pi}{d}l)\\}_{l=0}^{d-1}$. The eigenspace of
$\gamma_{d}^{l}$ is denoted by $\mathcal{H}^{(l)}$. Denote a generic state
$\ket{\psi}\in\mathcal{H}^{(l)}$ as $\ket{\psi_{l}}$, hence

$(U\otimes U)\ket{\psi_{l}}=\gamma_{d}^{l}\ket{\psi_{l}}.$ (52)

High-dimensional symmetric encoding protocol

  1. 1.

State preparation: Alice and Bob share a state $\rho_{AB}$ at the beginning of
each run. They initialize their qudits $A^{\prime}$ and $B^{\prime}$ in
$\ket{+}_{d}$. They apply the control gate $C_{A^{\prime}A}(U)$ and
$C_{B^{\prime}B}(U)$ respectively.

  2. 2.

Measurement: Alice and Bob send $\sigma_{AB}$ to an untrusted party, Eve, who
is supposed to perform joint measurement and announce the detection results.

  3. 3.

Sifting: Given a specific announcement of Eve, Alice and Bob keep or discard
the qudits of systems $A^{\prime}$ and $B^{\prime}$. Alice and Bob perform the
above steps for many rounds and end up with a joint $2N$-qudits state
$\rho_{A^{\prime}B^{\prime}}\in(\mathcal{H}_{A}^{\prime}\otimes\mathcal{H}_{B}^{\prime})^{\otimes
N}$.

  4. 4.

Key generation: Alice and Bob perform local $Z$-measurements on
$\rho_{A^{\prime}B^{\prime}}$ to obtain two correlated raw key strings
$\kappa_{A}$ and $\kappa_{B}$. They reconcile the key string to $\kappa_{rec}$
by an encrypted classical channel, consuming $l_{ec}$-bit keys.

We first consider the case when a $l$-symmetric state $\ket{\psi_{l}}_{AB}$ is
the input state of the entanglement-based protocol. The initial state is

$\displaystyle\ket{++}_{A^{\prime},B^{\prime}}\ket{\psi_{l}}_{A,B}$
$\displaystyle=\frac{1}{d}\sum_{j,k=0}^{d-1}\ket{jk}_{A^{\prime},B^{\prime}}\ket{\psi_{l}}_{A,B}$
(53)
$\displaystyle=\frac{1}{\sqrt{d}}\sum_{u=0}^{d-1}\ket{\Phi_{u,0}}_{A^{\prime},B^{\prime}}\ket{\psi_{l}}_{A,B}.$

After the encoding unitary operation, $C_{A^{\prime}A}(U)$ and
$C_{B^{\prime}B}(U)$, the state becomes

$\ket{\Psi}_{A^{\prime},B^{\prime},A,B}=\frac{1}{\sqrt{d}}\sum_{u=0}^{d-1}\ket{\Phi_{u,l}}_{A^{\prime},B^{\prime}}\ket{\psi_{l}^{u}}_{A,B},$
(54)

here $\ket{\psi_{l}^{u}}:=(I\otimes U^{u})\ket{\psi_{l}}$. To derive Eq. (54),
we have applied the following property

$[C_{A^{\prime}A}(U)\otimes
C_{B^{\prime}B}(U)]\ket{\Phi_{u,v}}_{A^{\prime},B^{\prime}}\ket{\psi_{l}}_{A,B}=\ket{\Phi_{u,v+l}}_{A^{\prime},B^{\prime}}\ket{\psi_{l}^{u}}_{A,B}.$
(55)

In this case, the space of $A1,B1$ is spanned by
$\\{\Phi_{u,l}\\}_{u=0}^{d-1}$. Note that

$\mathrm{Tr}\left[\Phi_{u,l}\ket{\tilde{j},\tilde{k}}_{A1,B1}\bra{\tilde{j},\tilde{k}}\right]=\frac{1}{d}\delta_{j,l-k},$
(56)

which is irrelevant of $u$. Therefore, if Alice and Bob perform
$X$-measurement on $A^{\prime}$ obtaining result $l_{a}$, the $X$-measurement
result $l_{b}$ is directly related as $l_{a}=l-l_{b}\text{ mod }d$. This
implies that the protocol is completely secure as long as Alice and Bob share
$l$-symmetric states for a fixed $l$. Hence, we arrive at the security of the
prime-dimensional symmetric encoding QKD for symmetric states:

######  Theorem 2.

In the prime-dimensional symmetric encoding protocol, the X-measurement result
on $A^{\prime}$ can be determined exactly with the X-measurement result on
$B^{\prime}$ if Alice and Bob share a mixture of $l$-symmetric states, for
fixed $l$, at the beginning of each run. Hence, in that case, the protocol is
completely secure.

However, in the general setup, the shared state $\rho_{AB}$ is usually not a
mixture of pure symmetric states, but a mixture of different symmetric states,
that is,

$\rho_{AB}=\sum_{l=0}^{d-1}\sum_{j}p_{l}^{(j)}\ket{\psi_{l}^{(j)}}\bra{\psi_{l}^{(j)}},$
(57)

where $\ket{\psi_{l}^{(j)}}$ are the $l$-symmetric states and
$\sum_{l=0}^{d-1}\sum_{j}p_{l}^{(j)}=1$. This mixture source is equivalent to
Alice and Bob preparing $l$-symmetric states for probability of
$\sum_{j}p_{l}^{(j)}$ for each run. However, the parity information, i.e.
which symmetric state is sent each round, is not known to Alice and Bob (and
known by Eve in the worst case scenario). Hence, they cannot deal with each
symmetric state separately, and thus there is no longer perfect privacy. We
define the phase-error rate vector as

$\vec{E}_{ph}=\left[\frac{N_{0}}{N},\frac{N_{1}}{N},\cdots,\frac{N_{d-1}}{N}\right],$
(58)

where $N_{l}$ is the number of detections caused by $l$-symmetric states.
According to the key-rate formula of high-dimensional QKD, the asymptotic key
rate of the $d$-dimensional symmetric encoding protocol is

$r=\log_{2}d-H_{2}(\vec{E}_{bit})-H_{2}(\vec{E}_{ph})\text{ bits}$ (59)

###  C.2 High-dimensional PM QKD with continuous randomization

The high-dimensional entanglement-based PM QKD given below falls into the
category of symmetric encoding protocol discussed above, and hence its key
rate is given by Eq. (59). The encoding operation $U$ is given by

$U=e^{i\frac{2\pi}{d}a^{\dagger}a},$ (60)

where $a$ is the annihilation operator. It is clear that $U$ is $d$-rotation
symmetric, i.e. $U^{d}=I$. It can be seen that, when applied on the Fock state
$\ket{n}$, this operation adds an additional phase $e^{\frac{2\pi i}{d}n}$.
Hence, we intend to generate mixture of Fock states as input through
continuous randomization.

High-dimensional entanglement-based PM QKD

with continuous randomization

  1. 1.

State preparation: Alice and Bob prepare the coherent state
$\ket{\sqrt{\mu/2}~{}e^{i\phi_{a}}}_{A}\otimes\ket{\sqrt{\mu/2}~{}e^{i\phi_{b}}}_{B}$
on two optical modes $A$ and $B$, where $\phi_{a}$ and $\phi_{b}$ are selected
randomly from $[0,2\pi)$, and $\mu$ taken from multiple values as in decoy
methods. They initialize their qudits $A^{\prime}$ and $B^{\prime}$ in
$\ket{+}_{d}:=\frac{1}{\sqrt{d}}\sum_{j=0}^{d-1}\ket{j}$. They apply the
control gate $C_{A^{\prime}A}(U)$ and $C_{B^{\prime}B}(U)$ respectively, where
$U$ rotates a coherent state by $2\pi/d$.

  2. 2.

Measurement: Alice and Bob send the two optical modes $AB$ to an untrusted
party, Eve, who is supposed to perform joint measurement and announce the
detection results: no-click, double-click, $L$-click or $R$-click.

  3. 3.

Sifting: After many rounds of quantum communications, Alice and Bob keep only
the rounds with $L$ or $R$ click. They announce the random phases $\phi_{a}$
and $\phi_{b}$ publicly and keep only the rounds where
$|\phi_{a}-\phi_{b}|\in\\{k\frac{2\pi}{d}\\}_{k=0}^{d-1}$. They end up with a
joint $2N$-qudits state
$\rho_{A^{\prime}B^{\prime}}\in(\mathcal{H}_{A}^{\prime}\otimes\mathcal{H}_{B}^{\prime})^{\otimes
N}$.

  4. 4.

Parameter estimation: Alice and Bob estimate the phase-error vector
$\vec{E}_{ph}$ with decoy states.

  5. 5.

Key generation: Alice and Bob perform local $Z$-measurements on
$\rho_{A^{\prime}B^{\prime}}$ to obtain two correlated raw key strings
$\kappa_{A}$ and $\kappa_{B}$. They reconcile the key string to $\kappa_{rec}$
by an encrypted classical channel, consuming $l_{ec}$-bit keys. They perform
privacy amplification according to the phase-error vector to generate the
final keys.

For states with $\phi_{a}-\phi_{b}=\delta$, the continuous randomization in
fact generates the input state:

$\frac{1}{2\pi}\int_{0}^{2\pi}d\phi\ket{\sqrt{\mu/2}~{}e^{i\phi}}_{A}\bra{\sqrt{\mu/2}~{}e^{i\phi}}\otimes\ket{\sqrt{\mu/2}~{}e^{i(\phi+\delta)}}_{B}\bra{\sqrt{\mu/2}~{}e^{i(\phi+\delta)}}=\sum_{k=0}^{\infty}P_{\mu}(k)\ket{\bar{k}^{\delta}}_{AB}\bra{\bar{k}^{\delta}},$
(61)

where $P_{\mu}(k)=e^{-\mu}\frac{\mu^{k}}{k!}$ is the Poisson distribution. The
$k$-photon state $\ket{\bar{k}^{\delta}}_{AB}$ is

$\ket{\bar{k}^{\delta}}_{AB}=\frac{(a^{\dagger}+e^{i\delta}b^{\dagger})^{k}}{\sqrt{2^{k}k!}}\ket{00}_{AB},$
(62)

which is a $k$-symmetric state. We can thus define the phase-error rate vector
with entries:

$\vec{E}_{ph}(k)=\sum_{n=0}^{\infty}q_{nd+k},\quad k\in\\{0,\cdots,d-1\\},$
(63)

where $q_{k}$ is the fraction of detection events caused by
$\ket{\bar{k}^{\delta}}_{AB}$.

Since Fock states are invariant with intensity $\mu$, their yields do not vary
with $\mu$, and we can apply the decoy methods given the overall gain
$Q_{\mu}$ Lo  _et al._ (2005); Ma  _et al._ (2005):

$Q_{\mu}=\sum_{k=0}^{\infty}P_{\mu}(k)Y_{k},$ (64)

and the fraction of detection is given by

$q^{\mu}_{k}=P_{\mu}(k)\frac{Y_{k}}{Q_{\mu}}.$ (65)

###  C.3 High-dimensional PM QKD with discrete randomization

It is a common practice to approximate the ideal continuous randomization with
discrete randomization Lo  _et al._ (2005); Cao  _et al._ (2015); Ma  _et al._
(2018). In the state preparation stage of the $d$-dimensional entanglement-
based PM QKD, instead of continuously randomizing the phase of the coherent
states, Alice and Bob apply a $D$-slice discrete phase randomization for a
large $D$, and postselect phase-matched rounds similarly.

For the rounds where Alice and Bob share a phase reference difference of
$\delta$, they generate the input state as a mixture of “pseudo”-Fock states:

$\frac{1}{D}\sum_{j=0}^{D-1}\ket{\sqrt{\mu/2}~{}e^{i\frac{2\pi
j}{D}}}_{A}\bra{\sqrt{\mu/2}~{}e^{i\frac{2\pi
j}{D}}}\otimes\ket{\sqrt{\mu/2}~{}e^{i(\frac{2\pi
j}{D}+\delta)}}_{B}\bra{\sqrt{\mu/2}~{}e^{i(\frac{2\pi
j}{D}+\delta)}}=\sum_{k=0}^{\infty}P^{\mu}_{D}(k)\ket{\bar{\lambda}_{k}^{\delta}}_{AB}\bra{\bar{\lambda}_{k}^{\delta}}$
(66)

where

$\displaystyle\ket{\bar{\lambda}_{k}^{\delta}}=\frac{e^{-\mu/2}}{\sqrt{P_{\mu}(k)}}\sum_{n=0}^{\infty}\frac{(\sqrt{\mu})^{nD+k}}{\sqrt{(nD+k)!}}\ket{\overline{nD+k}^{\delta}}$
(67) $\displaystyle
P_{D}^{\mu}(k)=\sum_{n=0}^{\infty}\frac{\mu^{nd+k}e^{-\mu}}{(nd+k)!},$

with $k$-photon state $\ket{\bar{k}^{\delta}}$ defined in Eq. (62).

The $k$-pseudo Fock state $\ket{\bar{\lambda}_{k}^{\delta}}$ is also a
$k$-symmetric state of $U\otimes U$, so the security analysis still applies.
It is however less favoured than Fock states since for moderate $D$ it varies
with intensity $\mu$, thus enabling Eve to discriminate signal states with
decoy states, cracking the decoy method Lo  _et al._ (2005). We therefore
require $D$ to be large so that the yield of
$\ket{\bar{\lambda}_{k}^{\delta}}$ approximates the yield of
$\ket{\bar{k}^{\delta}}$, which is invariant with intensity. Denote the yield
and the detection fraction of the non-ideal $k$-th symmetric state as
$Y_{\lambda_{k}}$ and $q_{\lambda_{k}}$. In Ref. Zeng  _et al._ (2020), a
bound between the deviation of $Y_{\lambda_{1}}$ and $q_{\lambda_{1}}$ from
$Y_{1}$ and $q_{1}$ is given, and can be straightforwardly extended to general
$k$-photon states:

$\displaystyle|Y_{k}-Y^{\mu}_{\lambda_{k}}|\leq\sqrt{\frac{\mu^{D}k!}{(D+k)!}}$
(68)
$\displaystyle|q^{\mu}_{k}-q^{\mu}_{\lambda_{k}}|\leq\frac{\mu^{D/2+k}e^{-\mu}}{Q_{\mu}\sqrt{(D+k)!/k!}},$

A straightforward calculation reveals that Eq. (LABEL:approximate_continuous)
gives a tighter bound for multi-photon fractions than single-photon fraction.
Hence it is sufficient to check the accuracy of single-photon fraction
estimation. Denote the transmittance from Alice or Bob to Eve as $\eta$. In
the first-order limit where the gain $Q_{\mu}\approx\eta\mu$ and yield
$Y_{l}\approx l\eta$, Table 2 below illustrates the estimation inaccuracy of
single photon components in terms of
$|q^{\mu}_{1}-q^{\mu}_{\lambda_{1}}|/q^{\mu}_{1}$ at transmittance
$\eta=10^{-6}$ for 8 to 16 phase slices. The light intensity $\mu$ is taken as
0.1, which is a moderate value around the optimal values given in the
simulations in Section IV. The $10^{-6}$ transmittance is chosen since PM QKD
can reach at most around 500 km for a $-0.2$ dB/km attenuating fiber and
$20\%$ detectors. The minimum transmittance from Alice to Eve is therefore:

$\eta=10^{-0.2*250/10}\times 0.2=2\times 10^{-6}$ (69)

From Table 2, it can be seen that more than 10-phase randomization is
sufficient for an estimation of single-photon fraction with less than
$10^{-3}$ inaccuracy. The 16-phase randomization in the original two-
dimensional PM QKD is conservative.

Table 2: Estimation inaccuracy of single-photon fraction with discrete randomization at $\eta=10^{-6}$ | $D=8$ | $D=10$ | $D=12$ | $D=14$ | $D=16$
---|---|---|---|---|---
$\Delta q_{1}/q_{1}$ | $0.17$ | $1.6\times 10^{-3}$ | $1.3\times 10^{-5}$ | $8.7\times 10^{-8}$ | $5.3\times 10^{-10}$

The final key-rate formula can therefore be expressed as:

$r=\frac{d}{D}Q_{\mu}[\log_{2}d-H_{2}(\vec{E}^{\mu}_{bit})-H_{2}(\vec{q}_{\mu})],$
(70)

where all the parameters can be retrieved from experiments.

##  Appendix D Simulation formulae of high-dimensional PM QKD

We present the formulae used to simulate the key rate performance of high-
dimensional PM QKD in Fig. 6 and 7. The channel is assumed to be pure-loss and
symmetric for Alice and Bob with transmittance $\eta$ (with detector
efficiency taken into account). The single-photon detectors have dark count
rate $p_{d}$. The calculations below are for single $L$-click events, and can
be easily altered for $R$-click events.

To calculate the bit-error rate vector $\vec{E}^{\mu}_{bit}$, assume Alice and
Bob send coherent states of amplitude $\mu/2$ with phase difference
$\phi+\delta$, where $\phi$ is the encoding difference and $\delta$ is the
reference-frame misalignment. As computed in Ref. Ma  _et al._ (2018), the
single-click probabilities of the $L$ and $R$ detector given phase difference
$\phi+\delta$ are

$\begin{split}&P_{\mu}^{\phi+\delta}(L)=1-(1-p_{d})\exp(-\eta\mu\cos^{2}((\phi+\delta)/2))\\\
&P_{\mu}^{\phi+\delta}(R)=1-(1-p_{d})\exp(-\eta\mu\sin^{2}((\phi+\delta)/2)).\end{split}$
(71)

Given reference misalignment $\delta$, when Alice and Bob have encoding
difference $\phi_{k}=\frac{2\pi}{d}k$, the probability of a single $L$-click
is

$P_{\mu}(L|\phi_{k},\delta)=P_{\mu}^{\phi_{k}+\delta}(L)[1-P_{\mu}^{\phi_{k}+\delta}(R)].$
(72)

Since the misalignment is independent of the encoding, by the Bayesian
formula, the probability of encoding difference $\phi_{k}$ given a single
$L$-click event with misalignment $\delta$ is

$P_{\mu}(\phi_{k}|L,\delta)=\frac{P_{\mu}(L|\phi_{k},\delta)P(\phi_{k})}{Q_{\mu}^{\delta}},$
(73)

where $P(\phi_{k})=\frac{1}{d}$ for uniform encoding. The gain
$Q_{\mu}^{\delta}$ given misalignment $\delta$ can be calculated by

$Q_{\mu}^{\delta}=\sum_{k=0}^{d-1}P_{\mu}(L|\phi_{k},\delta)P(\phi_{k}).$ (74)

The $k$-th entry of the bit-error rate vector is therefore given by

$\vec{E}^{\mu}_{bit}(k)=P_{\mu}(\phi_{k}|L)=\mathbb{E}_{\delta}[P_{\mu}(\phi_{k}|L,\delta)],$
(75)

where the expectation is taken over the distribution of misalignment $\delta$,
which is deterministic for fixed misalignment and uniform for fluctuating
misalignment. The total gain is the expectation

$Q_{\mu}=\mathbb{E}_{\delta}[Q_{\mu}^{\delta}].$ (76)

To calculate the phase-error rate vector $\vec{q}_{\mu}$, given encoding
difference $\phi_{k}$ and misalignment $\delta$, when Alice and Bob send the
$n$-photon state, the probability of a single $L$-click is Ma  _et al._ (2018)

$P_{n}(L|\phi_{k},\delta)=(1-p_{d})(1-\eta\cos^{2}((\phi_{k}+\delta)/2))^{n}-(1-p_{d})^{2}(1-\eta)^{n}.$
(77)

Averaging over the encoding, the yield of $n$-photon states under misalignment
$\delta$ is given by

$Y_{n}^{\delta}=\sum_{k=0}^{d-1}P_{n}(L|\phi_{k},\delta)P(\phi_{k}).$ (78)

The total yield is therefore the expectation

$Y_{n}=\mathbb{E}_{\delta}[Y_{n}^{\delta}].$ (79)

We can therefore calculate the detection fraction $q_{n}^{\mu}$ of the
$n$-photon states by Eq. (65) with yield $Y_{n}$ and gain $Q_{\mu}$.

## References

  * Lo and Chau (1999) H. K. Lo and H. F. Chau, “Unconditional security of quantum key distribution over arbitrarily long distances,” Science 283, 2050 (1999).
  * Shor and Preskill (2000) P. W. Shor and J Preskill, “Simple proof of security of the bb84 quantum key distribution protocol,” Phys. Rev. Lett. 85, 441 (2000).
  * Koashi (2009) M Koashi, “Simple security proof of quantum key distribution based on complementarity,” New Journal of Physics 11, 045018 (2009).
  * Bennett and Brassard (1984) C. H. Bennett and G. Brassard, “Quantum Cryptography: Public Key Distribution and Coin Tossing,” in  _Proceedings of the IEEE International Conference on Computers, Systems and Signal Processing_ (IEEE Press, New York, 1984) pp. 175–179.
  * Bennett (1992) Charles H. Bennett, “Quantum cryptography using any two nonorthogonal states,” Phys. Rev. Lett. 68, 3121–3124 (1992).
  * Takeoka  _et al._ (2014) Masahiro Takeoka, Saikat Guha, and Mark M Wilde, “Fundamental rate-loss tradeoff for optical quantum key distribution,” Nat. Commun. 5, 5235 (2014).
  * Pirandola  _et al._ (2017) Stefano Pirandola, Riccardo Laurenza, Carlo Ottaviani, and Leonardo Banchi, “Fundamental limits of repeaterless quantum communications,” Nat. Commun. 8, 15043 (2017).
  * Lo  _et al._ (2012) Hoi-Kwong Lo, Marcos Curty, and Bing Qi, “Measurement-device-independent quantum key distribution,” Phys. Rev. Lett. 108, 130503 (2012).
  * Lucamarini  _et al._ (2018) M. Lucamarini, Z.L. Yuan, J.F. Dynes, and A.J. Shields, “Overcoming the rate–distance limit of quantum key distribution without quantum repeaters,” Nature 557, 400–403 (2018).
  * Pfleegor and Mandel (1967) R. L. Pfleegor and L. Mandel, “Interference of independent photon beams,” Physical Review 159, 1084–1088 (1967).
  * Ma  _et al._ (2018) Xiongfeng Ma, Pei Zeng, and Hongyi Zhou, “Phase-matching quantum key distribution,” Phys. Rev. X 8, 031043 (2018).
  * Lin and Lütkenhaus (2018) Jie Lin and Norbert Lütkenhaus, “Simple security analysis of phase-matching measurement-device-independent quantum key distribution,” Physical Review A 98, 042332 (2018).
  * Curty  _et al._ (2019) Marcos Curty, Koji Azuma, and Hoi-Kwong Lo, “Simple security proof of twin-field type quantum key distribution protocol,” npj Quantum Information 5, 1–6 (2019).
  * Fang  _et al._ (2020) Xiao-Tian Fang, Pei Zeng, Hui Liu, Mi Zou, Weijie Wu, Yan-Lin Tang, Ying-Jie Sheng, Yao Xiang, Weijun Zhang, Hao Li, _et al._ , “Implementation of quantum key distribution surpassing the linear rate-transmittance bound,” Nature Photonics 14, 422–425 (2020).
  * Zeng  _et al._ (2020) Pei Zeng, Weijie Wu, and Xiongfeng Ma, “Symmetry-protected privacy: Beating the rate-distance linear bound over a noisy channel,” Phys. Rev. Applied 13, 064013 (2020).
  * Santarelli  _et al._ (1994) G. Santarelli, A. Clairon, S.N. Lea, and G.M. Tino, “Heterodyne optical phase-locking of extended-cavity semiconductor lasers at 9 GHz,” Optics Communications 104, 339–344 (1994).
  * Minder  _et al._ (2019) M Minder, M Pittaluga, GL Roberts, M Lucamarini, JF Dynes, ZL Yuan, and AJ Shields, “Experimental quantum key distribution beyond the repeaterless secret key capacity,” Nature Photonics 13, 334–338 (2019).
  * Zhong  _et al._ (2019) Xiaoqing Zhong, Jianyong Hu, Marcos Curty, Li Qian, and Hoi-Kwong Lo, “Proof-of-principle experimental demonstration of twin-field type quantum key distribution,” Phys. Rev. Lett. 123, 100506 (2019).
  * Wang  _et al._ (2019) Shuang Wang, De-Yong He, Zhen-Qiang Yin, Feng-Yu Lu, Chao-Han Cui, Wei Chen, Zheng Zhou, Guang-Can Guo, and Zheng-Fu Han, “Beating the fundamental rate-distance limit in a proof-of-principle quantum key distribution system,” Phys. Rev. X 9, 021046 (2019).
  * Liu  _et al._ (2019) Yang Liu, Zong-Wen Yu, Weijun Zhang, Jian-Yu Guan, Jiu-Peng Chen, Chi Zhang, Xiao-Long Hu, Hao Li, Cong Jiang, Jin Lin, Teng-Yun Chen, Lixing You, Zhen Wang, Xiang-Bin Wang, Qiang Zhang, and Jian-Wei Pan, “Experimental twin-field quantum key distribution through sending or not sending,” Phys. Rev. Lett. 123, 100505 (2019).
  * Mao  _et al._ (2021) Yingqiu Mao, Pei Zeng, and Teng-Yun Chen, “Recent advances on quantum key distribution overcoming the linear secret key capacity bound,” Advanced Quantum Technologies 4, 2000084 (2021).
  * Ma and Razavi (2012) Xiongfeng Ma and Mohsen Razavi, “Alternative schemes for measurement-device-independent quantum key distribution,” Phys. Rev. A 86, 062319 (2012).
  * Laing  _et al._ (2010) Anthony Laing, Valerio Scarani, John G. Rarity, and Jeremy L. O’Brien, “Reference-frame-independent quantum key distribution,” Phys. Rev. A 82, 012304 (2010).
  * Lee  _et al._ (2020) Donghwa Lee, Seongjin Hong, Young-Wook Cho, Hyang-Tag Lim, Sang-Wook Han, Hojoong Jung, Sung Moon, Kwang Jo Lee, and Yong-Su Kim, “Reference-frame-independent, measurement-device-independent quantum key distribution using fewer quantum states,” Optics Letters 45, 2624 (2020).
  * Chau (2005) H.F. Chau, “Unconditionally secure key distribution in higher dimensions by depolarization,” IEEE Transactions on Information Theory 51, 1451–1468 (2005).
  * Gottesman  _et al._ (2004) Daniel Gottesman, Hoi-Kwong Lo, Norbert Lütkenhaus, and John Preskill, “Security of quantum key distribution with imperfect devices,” Quantum Info. Comput. 4, 325–360 (2004).
  * Ma (2008) Xiongfeng Ma,  _Quantum cryptography: from theory to practice_ , Ph.D. thesis, University of Toronto (2008), also available in arXiv:0808.1385.
  * Currás-Lorenzo  _et al._ (2021) Guillermo Currás-Lorenzo, Lewis Wooltorton, and Mohsen Razavi, “Twin-field quantum key distribution with fully discrete phase randomization,” Physical Review Applied 15, 014016 (2021).
  * Wang  _et al._ (2020) Rong Wang, Zhen-Qiang Yin, Feng-Yu Lu, Shuang Wang, Wei Chen, Chun-Mei Zhang, Wei Huang, Bing-Jie Xu, Guang-Can Guo, and Zheng-Fu Han, “Optimized protocol for twin-field quantum key distribution,” Communications Physics 3, 149 (2020).
  * Ma  _et al._ (2019a) Jiajun Ma, You Zhou, Xiao Yuan, and Xiongfeng Ma, “Operational interpretation of coherence in quantum key distribution,” Physical Review A 99, 062325 (2019a).
  * Nikolopoulos and Alber (2005) Georgios M. Nikolopoulos and Gernot Alber, “Security bound of two-basis quantum-key-distribution protocols using qudits,” Phys. Rev. A 72, 032320 (2005).
  * Sheridan and Scarani (2010) Lana Sheridan and Valerio Scarani, “Security proof for quantum key distribution using qudit systems,” Phys. Rev. A 82, 030301 (2010).
  * Lo  _et al._ (2005) Hoi-Kwong Lo, Xiongfeng Ma, and Kai Chen, “Decoy state quantum key distribution,” Phys. Rev. Lett. 94, 230504 (2005).
  * Wang (2005) Xiang-Bin Wang, “Beating the photon-number-splitting attack in practical quantum cryptography,” Phys. Rev. Lett. 94, 230503 (2005).
  * Maeda  _et al._ (2019) Kento Maeda, Toshihiko Sasaki, and Masato Koashi, “Repeaterless quantum key distribution with efficient finite-key analysis overcoming the rate-distance limit,” Nature communications 10, 3140 (2019).
  * Cao  _et al._ (2015) Zhu Cao, Zhen Zhang, Hoi-Kwong Lo, and Xiongfeng Ma, “Discrete-phase-randomized coherent state source and its application in quantum key distribution,” New J. Phys. 17, 053014 (2015).
  * Pirandola  _et al._ (2015) Stefano Pirandola, Carlo Ottaviani, Gaetana Spedalieri, Christian Weedbrook, Samuel L. Braunstein, Seth Lloyd, Tobias Gehring, Christian S. Jacobsen, and Ulrik L. Andersen, “High-rate measurement-device-independent quantum cryptography,” Nature Photonics 9, 397–402 (2015).
  * Ma  _et al._ (2019b) Hong-Xin Ma, Peng Huang, Dong-Yun Bai, Tao Wang, Shi-Yu Wang, Wan-Su Bao, and Gui-Hua Zeng, “Long-distance continuous-variable measurement-device-independent quantum key distribution with discrete modulation,” Phys. Rev. A 99, 022322 (2019b).
  * Matsuura  _et al._ (2021) Takaya Matsuura, Kento Maeda, Toshihiko Sasaki, and Masato Koashi, “Finite-size security of continuous-variable quantum key distribution with digital signal processing,” Nat. Comm. 12, 1–13 (2021).
  * Artin (2011) M. Artin,  _Algebra_ (Pearson Prentice Hall, New Jersey, 2011).
  * DURT  _et al._ (2010) THOMAS DURT, BERTHOLD-GEORG ENGLERT, INGEMAR BENGTSSON, and KAROL ŻYCZKOWSKI, “ON MUTUALLY UNBIASED BASES,” International Journal of Quantum Information 08, 535–640 (2010).
  * Bennett  _et al._ (1993) Charles H. Bennett, Gilles Brassard, Claude Crépeau, Richard Jozsa, Asher Peres, and William K. Wootters, “Teleporting an unknown quantum state via dual classical and einstein-podolsky-rosen channels,” Phys. Rev. Lett. 70, 1895–1899 (1993).
  * Fung  _et al._ (2010) Chi-Hang Fred Fung, Xiongfeng Ma, and H. F. Chau, “Practical issues in quantum-key-distribution postprocessing,” Phys. Rev. A 81, 012318 (2010).
  * Bennett  _et al._ (1996) Charles H. Bennett, David P. DiVincenzo, John A. Smolin, and William K. Wootters, “Mixed-state entanglement and quantum error correction,” Phys. Rev. A 54, 3824–3851 (1996).
  * Ma  _et al._ (2005) Xiongfeng Ma, Bing Qi, Yi Zhao, and Hoi-Kwong Lo, “Practical decoy state for quantum key distribution,” Phys. Rev. A 72, 012326 (2005).