Continuous-Variable Quantum Key Distribution with Gaussian Modulation -- The Theory of Practical Implementations

TL;DR

This paper reviews the theoretical foundations of continuous-variable quantum key distribution with Gaussian modulation, emphasizing practical implementation considerations, hardware imperfections, and introducing new noise models for real-world performance estimation.

Contribution

It provides a comprehensive, self-contained theoretical review of CV-QKD with Gaussian modulation, including new noise models for assessing hardware performance in practical settings.

Findings

Introduction of new noise models for hardware performance estimation

Pedagogical rederivation of CV-QKD relations

Analysis of hardware imperfections in practical CV-QKD implementations

Abstract

Quantum key distribution using weak coherent states and homodyne detection is a promising candidate for practical quantum-cryptographic implementations due to its compatibility with existing telecom equipment and high detection efficiencies. However, despite the actual simplicity of the protocol, the security analysis of this method is rather involved compared to discrete-variable QKD. In this article we review the theoretical foundations of continuous-variable quantum key distribution (CV-QKD) with Gaussian modulation and rederive the essential relations from scratch in a pedagogical way. The aim of this paper is to be as comprehensive and self-contained as possible in order to be well intelligible even for readers with little pre-knowledge on the subject. Although the present article is a theoretical discussion of CV-QKD, its focus lies on practical implementations, taking into account various kinds of hardware imperfections and suggesting practical methods to perform the security analysis subsequent to the key exchange. Apart from a review of well known results, this manuscript presents a set of new original noise models which are helpful to get an estimate of how well a given set of hardware will perform in practice.

Tables

Table 1. Table 1 : Comparison of shot-noise units (SNU), natural units (NU) and SI-units.

	SNU	NU	SI
$\hat{a}=$	$\frac{1}{2}\left(\hat{q}+i\hat{p}\right)$	$\frac{1}{\sqrt{2}}\left(\hat{q}+i\hat{p}\right)$	$\frac{1}{\sqrt{2\hslash \omega }}\left(\omega \hat{q}+i\hat{p}\right)$
${\hat{a}}^{†}=$	$\frac{1}{2}\left(\hat{q}-i\hat{p}\right)$	$\frac{1}{\sqrt{2}}\left(\hat{q}-i\hat{p}\right)$	$\frac{1}{\sqrt{2\hslash \omega }}\left(\omega \hat{q}-i\hat{p}\right)$
$\hat{q}=$	$\hat{a}+{\hat{a}}^{†}$	$\frac{1}{\sqrt{2}}\left(\hat{a}+{\hat{a}}^{†}\right)$	$\sqrt{\frac{\hslash }{2\omega }}\left(\hat{a}+{\hat{a}}^{†}\right)$
	$\left(=\sqrt{2}{\hat{q}}_{\text{NU}}=\sqrt{\frac{2\omega }{\hslash }}{\hat{q}}_{\text{SI}}\right)$	$\left(=\frac{1}{\sqrt{2}}{\hat{q}}_{\text{SNU}}=\sqrt{\frac{\omega }{\hslash }}{\hat{q}}_{\text{SI}}\right)$	$\left(=\sqrt{\frac{\hslash }{2\omega }}{\hat{q}}_{\text{SNU}}=\sqrt{\frac{\hslash }{\omega }}{\hat{q}}_{\text{NU}}\right)$
$\hat{p}=$	$-i\left(\hat{a}-{\hat{a}}^{†}\right)$	$\frac{-i}{\sqrt{2}}\left(\hat{a}-{\hat{a}}^{†}\right)$	$-i\sqrt{\frac{\hslash \omega }{2}}\left(\hat{a}-{\hat{a}}^{†}\right)$
	$\left(=\sqrt{2}{\hat{p}}_{\text{NU}}=\sqrt{\frac{2}{\hslash \omega }}{\hat{p}}_{\text{SI}}\right)$	$\left(=\frac{1}{\sqrt{2}}{\hat{p}}_{\text{SNU}}=\frac{1}{\sqrt{\hslash \omega }}{\hat{p}}_{\text{SI}}\right)$	$\left(=\sqrt{\frac{\hslash \omega }{2}}{\hat{p}}_{\text{SNU}}=\sqrt{\hslash \omega }{\hat{p}}_{\text{NU}}\right)$
$[\hat{q},\hat{p}]=$	$2i$	$i$	$i\hslash$
$\hat{n}=$	$\frac{1}{4}\left({\hat{q}}^2+{\hat{p}}^2\right)-\frac{1}{2}$	$\frac{1}{2}\left({\hat{q}}^2+{\hat{p}}^2\right)-\frac{1}{2}$	$\frac{1}{2\hslash \omega }\left({\omega }^2{\hat{q}}^2+{\hat{p}}^2\right)-\frac{1}{2}$
$\delta \hat{q}\delta \hat{p}\ge$	$1$	$\frac{1}{2}$	$\frac{\hslash }{2}$

Equations

$$K=f_{\text{sym}}\cdot r,$$

$$r_{\text{coll}}^{\text{asympt}}\ge I_{AB}-\chi .$$

$$r_{\text{coll,DR}}^{\text{asympt}}\ge I_{AB}-{\chi }_{EA},$$

$$r_{\text{coll,RR}}^{\text{asympt}}\ge I_{AB}-{\chi }_{EB},$$

$$r_{\text{coll}}^{\text{asympt}}\ge (1-\text{FER})(1-\nu )(\beta I_{AB}-{\chi }_{EB}).$$

$$R=\beta I_{AB}$$

$$R{\log }_{2}q=\beta I_{AB}.$$

$$\mathcal{Q}\sim \mathcal{P}\sim \mathcal{N}(0,{\tilde{V}}_{\text{mod}})$$

$$|{\alpha }_j⟩=|q_j+i{p}_j⟩,$$

$$\hat{a}|{\alpha }_j⟩$$

$$\frac{1}{2}\left(\hat{q}+i\hat{p}\right)|{\alpha }_j⟩$$

$$⟨n_j⟩=⟨{\alpha }_j⟩\hat{n}{\alpha }_j=|{\alpha }_j{|}^2=q_j^2+p_j^2.$$

$$⟨n⟩=⟨{\mathcal{Q}}^2⟩+⟨{\mathcal{P}}^2⟩=2{\tilde{V}}_{\text{mod}}.$$

$$V(\hat{q})=V(\hat{p})-:V=4{\tilde{V}}_{\text{mod}}+1-:V_{\text{mod}}+1,$$

$$⟨n⟩=\frac{1}{2}(V-1)=\frac{1}{2}{V}_{\text{mod}}.$$

$${\Xi }_{\text{ch}}=\frac{1-T_{\text{ch}}}{T_{\text{ch}}}+{\xi }_A,$$

$${\xi }_A={\xi }_{\text{modul},A}+{\xi }_{\text{Raman},A}+{\xi }_{\text{quant},A}+{\xi }_{\text{phase},A}+\dots$$

$${\Xi }_{\text{det}}=\frac{1-{\eta }_{\text{det}}}{{\eta }_{\text{det}}}+\frac{{\nu }_{\text{el}}}{{\eta }_{\text{det}}}.$$

$$\Xi ={\Xi }_{\text{ch}}+\frac{1}{T_{\text{ch}}}{\Xi }_{\text{det}},$$

$$V_B=T_{\text{ch}}{\eta }_{\text{det}}(V+\Xi ).$$

$$V_B$$

$$=T_{\text{ch}}{\eta }_{\text{det}}\left(V+\frac{1-T_{\text{ch}}}{T_{\text{ch}}}+{\xi }_A+\frac{1}{T_{\text{ch}}}\left(\frac{1-{\eta }_{\text{det}}}{{\eta }_{\text{det}}}+\frac{{\nu }_{\text{el}}}{{\eta }_{\text{det}}}\right)\right)$$

$$=T_{\text{ch}}{\eta }_{\text{det}}V-T_{\text{ch}}{\eta }_{\text{det}}+T_{\text{ch}}{\eta }_{\text{det}}{\xi }_A+1+{\nu }_{\text{el}}$$

$$-:TV-T+T{\xi }_A+1+{\nu }_{\text{el}}$$

$$=T(V-1)+T{\xi }_A+1+{\nu }_{\text{el}},$$

$$T{\xi }_A+{\xi }_{\text{det}}$$

$$=$$

$$-:$$

$$\xi :-{\xi }_{\text{tot},B}=T{\xi }_{\text{tot},A}.$$

$$V_B$$

$$=T{V}_{\text{mod}}+1+\xi ,$$

$$T=T_{\text{ch}}\cdot {\eta }_{\text{coup}}\cdot {\eta }_{\text{det}},$$

$$\xi ={\xi }_{\text{modul}}+{\xi }_{\text{Raman}}+{\xi }_{\text{quant}}+{\xi }_{\text{phase}}+{\xi }_{\text{det}}+{\xi }_{\text{RIN}}+{\xi }_{\text{CMRR}}+\dots$$

$$\Sigma_{AB}=\bordermatrix{&\hat{q}_{A}&\hat{p}_{A}&\hat{q}_{B}&\hat{p}_{B}\cr\hat{q}_{A}&V&0&\sqrt{V^{2}-1}&0\cr\hat{p}_{A}&0&V&0&-\sqrt{V^{2}-1}\cr\hat{q}_{B}&\sqrt{V^{2}-1}&0&V&0\cr\hat{p}_{B}&0&-\sqrt{V^{2}-1}&0&V}=\begin{pmatrix}V\mathbb{1}_{2}&\sqrt{V^{2}-1}\sigma_{z}\\ \sqrt{V^{2}-1}\sigma_{z}&V\mathbb{1}_{2}\end{pmatrix},$$

Full text

1. 0 Introduction

2. 1 Notions of Security and Secure-Key Rate

3. 1 Asymptotic Security against Collective Attacks

4. 2 Basics of a Coherent-State Protocol

5. 1 Gaussian Modulation

6. 2 Classical Post-Processing

7. 3 Transmittance and Noise

8. 4 Covariance Matrix

9. 1 Homodyne and Heterodyne Detection

10. 2 Prepare-and-Measure vs. Entanglement-Based Protocols

11. 5 Signal-to-Noise Ratio and Mutual Information

12. 1 Relation to Normalised SNR

13. 6 Holevo Information

14. 1 Entangling Cloner Attack

15. 1 Homodyne Detection

16. 2 Heterodyne Detection

17. 2 Universal Analysis of Purification Attacks

18. 1 Homodyne Detection

19. 2 Heterodyne Detection

20. 3 Strict and Loose Security Assumptions

21. 7 Practical Parameter Estimation

22. 1 Introduction

23. 2 Calibration of the Measurement Setup

24. 3 Estimation of the Covariance Matrix

25. 8 Noise Models

26. 1 Relative Intensity Noise – Signal

27. 2 Relative Intensity Noise – Local Oscillator

28. 3 Modulation Noise

29. 4 Phase-Recovery Noise

30. 5 Raman Noise

31. 6 Common-Mode Rejection Ratio

32. 7 Detection Noise

33. 8 ADC Quantisation Noise

34. 9 Experimental Implications

35. Acknowledgements

36. A Prerequisites on Coherent States

37. B Prerequisites on Gaussian Quantum Information

38. 1 Displacement Vector and Covariance Matrix

39. 2 Symplectic Operations

40. 3 Composite States

41. 4 Von Neumann entropy

42. 5 Partial Measurements

43. C Derivation of the Covariance Matrix

44. 1 Initial Covariance Matrix

45. 1 $\Sigma_{11}$, $\Sigma_{22}$, $\Sigma_{33}$, $\Sigma_{44}$

46. 2 $\Sigma_{12}$, $\Sigma_{21}$, $\Sigma_{34}$, $\Sigma_{43}$

47. 3 $\Sigma_{13}$, $\Sigma_{31}$, $\Sigma_{24}$, $\Sigma_{42}$

48. 4 $\Sigma_{14}$, $\Sigma_{41}$, $\Sigma_{32}$, $\Sigma_{23}$

49. 5 Final $\Sigma$

50. 2 Channel Transmission

51. 3 Channel Transmission including Excess Noise

52. 4 Bob Heterodyning

53. D Quantum Homodyne Detection

54. E Principles of a $q/p$-Modulator

55. F SI-, Natural- and Shot-Noise Units

56. References

Chapter 0 Introduction

Continuous-variable quantum key distribution (CV-QKD) with Gaussian modulation (GM) of quantum coherent states is regarded as an auspicious contender for deployment in widely-used applications. The aim of this tutorial is to provide an overview of the protocol, its security against eavesdropping and some aspects of its experimental implementation. We try to derive the fundamental relations from scratch in most detail while assuming as little pre-knowledge on the topic as possible. In this regard, the present article might serve as an introduction for beginners in the field or as a reference for experimentalists who want to deepen their theoretical understanding of CV-QKD. In addition to a pedagogical review of long-established relations, we present a detailed derivation of our own analytical noise models. The purpose of these models is to link the rather abstract formalism of continuous-variable quantum information theory to the specifications on actual hardware datasheets.

Quantum key distribution [1, 2] is a method to generate a secret key between two distant parties, Alice and Bob, based on transmitting non-orthogonal quantum states. After the transmission and measurement of these quantum states, Alice and Bob exchange classical messages and perform post-processing to generate a secure key. In order to prevent a man-in-the-middle attack, Alice and Bob need to authenticate these classical messages in advance (so strictly speaking QKD is a key-growing protocol).

QKD was first introduced with single photons acting as information carrier [3, 4], sometimes referred to as discrete-variable (DV) QKD. The exchanged quantum states are encoded into the polarisation, phase or time bin of the transmitted qubits and the secret key is established upon detection of the individual photons. With a delay of fifteen years after the first DV-QKD protocol, QKD with continuous variables was introduced as a promising alternative. Firstly proposed with discrete [5, 6, 7] and Gaussian [8] encoding of squeezed states, the concept was soon developed further to Gaussian-modulated CV-QKD with coherent states [9, 10, 11, 12]. The advantage of CV-QKD over DV-QKD lies in the efficient, high-rate and cost-effective detection using homodyne receivers as opposed to single-photon counters; the advantage of CV-QKD with coherent states over squeezed-state protocols lies mainly in the avoidance of the technologically challenging generation of squeezed light. A comprehensive theoretical overview of CV-QKD (including squeezed-state protocols) is provided in [13].

By now, many experimental demonstrations underlined the feasibility of CV-QKD with coherent states [14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25]. The experimental performance of these works has to be evaluated in the context of the various settings and assumptions that the respective authors applied and are therefore difficult to compare. After all, a CV-QKD setup is primarily appraised by the secure-key rate that can be achieved over a given transmission distance. The key rate, however, as elaborated in the present article, crucially depends on a number of assumptions, e.g. on the power of a potential eavesdropper, the reconciliation efficiency, the consideration of finite-key effects, the classification of so-called trusted noise, the security of a given modulation alphabet and others. Moreover, different experimental demonstrations exhibit different degrees of vulnerability to side-channel attacks. For example, a few papers so far successfully demonstrated long-distance CV-QKD with a non-zero key over a channel length of $80$ to $100\text{\,}\mathrm{k}\mathrm{m}$ [17, 21]. On the other hand, in these implementations the local oscillator (a strong laser signal required to measure the quantum signals) is transmitted to the receiver over the quantum channel and is therefore accessible to possible manipulations by an eavesdropper – a deficiency which opens a number of severe security loopholes [26, 27, 28, 29, 30, 31, 32, 33]. This is why recent works are focusing on different methods to avoid the transmission of the local oscillator and to generate it at the receiver lab instead (often referred to as “true local oscillator” or “local local oscillator” [LLO]) [19, 20, 18, 22, 24, 34, 25]. Some of the latest papers demonstrated the feasibility of a secure-key rate of a few Mbit/s over a channel length of some tens of kilometres using a LLO scheme [24, 25].

A good overview of the state-of-the-art in GM CV-QKD and the security of various protocols is given in [35], however that review does not provide any detailed calculations. While discrete-variable QKD (photon counting instead of homodyne detection) has been proven secure against an eavesdropper Eve who has infinite classical and/or quantum computational power and memory,111All reported attacks against QKD attacked imperfections in the implementation, i.e. deviations from the theoretical model. security proofs for CV-QKD with Gaussian modulation of coherent states are, up to now, less advanced. Unconditional security against the strongest (the so-called coherent) attack is established only for the cases of infinitely or unpractically long keys [35, Table 1] (see Section 1). However, a recent work suggests a proof yielding non-vanishing secure-key rates even for practical block sizes [36]. In order not to undermine the introductory purpose of this tutorial, the present work is restricted to the less complex security analysis of keys with infinite length. Still, the formalism derived in this article remains valid also when finite-key effects are taken into account, albeit of course under some adequate extensions.

In this article we first introduce the information-theoretic notions of security and describe under which assumptions a QKD protocol can be considered secure (Section 1). Subsequently, in Section 2, we describe the Gaussian-modulated coherent-state protocol. The very fundamental notions of transmittance and noise are introduced in Section 3. We then discuss the covariance matrix with respect to Alice and Bob in Section 4, which is used to calculate Eve’s information (the Holevo information) in Section 6. The mutual information between Alice and Bob which represents the amount of information that can be transmitted from one party to the other is calculated in Section 5. These two informational quantities are needed to compute the final asymptotic secret-key rate. In Section 7 we describe how an estimate on the secret-key rate can be obtained in practice. In Section 8, we analyse the various noise sources in realistic implementations of the protocol. The noise models derived in this section allow to get a preview on the experimental performance of a CV-QKD system by simulating the impact of certain of hardware choices [37]. Finally, in Section 9 we discuss some experimental implications of the basic relations and noise models derived in this article. While Sections 1–6, the better part of Section 7 as well as the entire appendix represent an introduction to and derivation of well-known established relations in CV-QKD, the noise models and their evaluation for practical implementations (Sections 8 and 9) represent our own original research.

Chapter 1 Notions of Security and Secure-Key Rate

Generally, in our assumptions we allow Eve to have full access to the quantum channel which she is free to control and manipulate. She can monitor the public channel but cannot intervene in the conversation between Alice and Bob which introduces the important requirement of an authenticated channel. For her eavesdropping attack, Eve is allowed to prepare arbitrary ancillary states that she gets to interact with the transmitted signal states and subsequently performs measurements on. Very importantly, she might be in possession of a quantum memory which allows her to store her states and perform her measurement at a later time according to what she learned during the classical post-processing (see Section 2). The actual degree of information-theoretic security of a given QKD protocol depends strongly on the assumed technological capabilities a potential eavesdropper might have. Classified by her powers, we distinguish three different types of eavesdropping attacks (i.e. attempts to obtain information on the secret key) that are typically considered in security proofs [2]:

individual attack

Eve performs an independent and identically distributed (i.i.d.) attack on all signals, i.e. she prepares separable ancilla states each of which interacts individually with one signal pulse in the quantum channel. The states are stored in a quantum memory until the end of the sifting procedure (but until before the post-processing step) and subsequently measured independently from one another.

collective attack

Eve performs an i.i.d. attack with separable ancilla states, stores her state in a quantum memory and performs an optimal collective measurement on all quantum states at any later time (in particular, after post-processing).

coherent attack

The most general attack where no (i.i.d.) assumption is made. In particular, Eve may prepare an optimal global ancilla state whose (possibly mutually dependent) modes interact with the signal pulses in the channel and are then stored and collectively measured after the classical post-processing.

In addition, security can be proven either in the asymptotic limit in which an infinite number of symbols is transmitted or for the case of a finite number of transmitted symbols. Naturally, the study of the asymptotic limit does not directly apply to any realistic system. Nonetheless, it is useful to analyse since it provides an upper bound on the corresponding non-asymptotic result and because it can typically be derived more easily.

Initial security proofs focused on individual attacks [11, 38], followed by collective attacks [39]. Further efforts to prove the security against coherent attacks (the strongest possible attack) have been eased by two ideas: The first is the reduction of coherent attacks to collective attacks using the de Finetti representation theorem for infinite dimensions [40]. The second is the optimality of Gaussian attacks [41, 42, 43] which states that for a given covariance matrix, the state that minimises the key rate is Gaussian. Subsequently, the security of Gaussian-modulated CV-QKD against coherent attacks was proved based on computing covariance matrices assuming Gaussian channels [44, 15, 45]. While these proofs only hold in the asymptotic limit, the security of CV-QKD with finite block sizes is much more involved and, to this date, a vital field of ongoing research [46, 47, 48, 49].

A non-asymptotic composable111Composability is an important property of cryptographic protocols. A protocol is called universally composable if its outcome is (almost) indistinguishable from that of an ideal protocol. Any protocol that uses a composable QKD key is (almost) as secure as if it would use an ideal key instead. See [50, 51] for a discussion of composable security of quantum key distribution. security proof against collective attacks was first introduced for continuous-variable quantum key distribution with squeezed-states [52], finally followed by a proof for coherent-state CV-QKD [53]. Unfortunately, the author notes that both the usual de Finetti method and the post-selection method (another method to derive security against coherent attacks from security against collective attacks, see [54]) fall short on providing useful finite-size key estimates against coherent (general) attacks. However, a more recent result seems to overcome this problem by exploitation of a new kind of Gaussian de Finetti reduction [36].

1 Asymptotic Security against Collective Attacks

To avoid a lot of complications and in order to keep the text at an introductory level, we will consider only the asymptotic secure-key rate in the case of collective attacks in the remainder of this tutorial. Since it comes almost for free, we will, however, take the non-asymptotic behaviour of the information reconciliation algorithm into account.

In general, the secure-key rate $K$ is given by

[TABLE]

where $f_{\text{sym}}$ is the symbol rate (in units of symbols/s) and $r$ is the secret fraction (i.e. key rate per symbol; in bits/symbol) [2]. The asymptotic secret fraction for an CV-QKD system with ideal post-processing in the case of collective attacks is given by the Devetak-Winter formula [55, 2]:

[TABLE]

It is lower-bounded by the difference between the mutual information $I_{AB}$ (in bits/symbol) between Alice and Bob and a bound on Eve’s possible information on the key, the Holevo information $\chi$. The actual representation of $\chi$ will depend on the error-correction protocol carried out by Alice and Bob (see Section 2). When Bob corrects his data according to information he receives from Alice and Alice’s data remains unmodified, we speak of direct reconciliation and the asymptotic secret fraction reads

[TABLE]

where $\chi_{EA}$ represents Eve’s potential information on Alice’s key. In the opposite case of reverse reconciliation (Bob’s key is unmodified, Alice corrects her key according to Bob’s) the secret fraction reads

[TABLE]

where $\chi_{EB}$ is the Holevo bound representing Eve’s possible information on Bob’s key. In the remainder of this review we will restrict our analysis to the case of reverse reconciliation. Equation (4) is valid for an ideal system; however, if we take into account that information reconciliation does not operate at the (asymptotic) Shannon limit, that a fraction of blocks (frames) will fail to reconcile, and that a fraction of the symbols is used for error estimation we obtain the asymptotic secure-key fraction of a practical CV-QKD system [15]:222See [56] for a critical discussion of this equation.

[TABLE]

Here $\text{FER}\in[0,1]$ and $\beta\in[0,1]$ represent the frame-error rate and the efficiency of information reconciliation, respectively, and $\nu\in[0,1]$ is the fraction of the symbols which has to be disclosed in order to estimate the entries of the covariance matrix. The efficiency $\beta$ measures how closely an information reconciliation method approaches the theoretical limit. Note that the inequation (5) describes a lower bound for the inherent secret fraction because $\chi_{EB}$ represents an upper bound. In actual implementations of CV-QKD protocols, however, we always assume Eve to perform an optimal attack and therefore maximise $\chi_{EB}$ right to its upper bound. Therefore, the achievable secret fraction $r$ is defined by the lower bound of the above inequation and the left and right side become equal.

If a binary error-correcting code with code rate $R$ is used, the relation

[TABLE]

holds. If an error-correcting code over an alphabet of size $q$ is used, every symbol of the code corresponds to $\log_{2}q$ bits (typically $q$ is an integer power of 2) and the previous relation can be generalized to

[TABLE]

Within the subsequent chapters we will derive in detail the mutual information $I_{AB}$ and the Holevo information $\chi_{EB}$ addressing the scenario of coherent-state CV-QKD with Gaussian modulation and reverse reconciliation.

Chapter 2 Basics of a Coherent-State Protocol

Any QKD protocol consists of two subsequent phases: first the preparation, transmission and measurement of non-orthogonal quantum states in order to distribute the raw key, followed by classical post-processing in which Alice and Bob perform sifting (reconciling the measurement bases, if required by the protocol), error correction and privacy amplification. The transmission of the quantum states is performed through a possibly insecure quantum channel [57, 58, 59, 60] whereas the error-correction is conducted using an authenticated classical channel.

The next sections describe in which way these steps are carried out in coherent-state CV-QKD with Gaussian modulation.

1 Gaussian Modulation

In a Gaussian-modulated scenario [9] Alice prepares displaced coherent states with quadrature components $q$ and $p$ that are realisations of two independent and identically distributed (i.i.d.) random variables $\mathcal{Q}$ and $\mathcal{P}$. The random variables $\mathcal{Q}$ and $\mathcal{P}$ obey the same zero-centred normal distribution

[TABLE]

where $\tilde{V}_{\text{mod}}$ is referred to as modulation variance (cf. Figure 1). Alice prepares a sequence $\ket{\alpha_{1}},\dots\ket{\alpha_{j}},\dots,\ket{\alpha_{N}}$ of displaced coherent states

[TABLE]

obeying the usual eigenvalue equation:

[TABLE]

where $\hat{a}=\frac{1}{2}(\hat{q}+i\hat{p})$ is the annihilation operator and $\hat{q}$ and $\hat{p}$ are the quadrature operators, defined in the framework of shot-noise units111See Appendix F for a definition of shot-noise units and a direct comparison to other conventions. (SNU). Each individual state $\ket{\alpha_{j}}$ has a mean photon number of

[TABLE]

Considering that $q_{j}$ and $p_{j}$ are sampled from the distribution in (1), the mean photon number of the state ensemble that Alice prepares reads

[TABLE]

The variance of the quadrature operators applied to the state ensemble relates to the modulation variance by222For a derivation see the footnote in Appendix A.

[TABLE]

where $\tilde{V}_{\text{mod}}$ represents the modulation variance of the quadrature components $q$ and $p$, and $V_{\text{mod}}=4\tilde{V}_{\text{mod}}$ is the modulation variance of the quadrature operators $\hat{q}$ and $\hat{p}$. Note that even in the case of $\tilde{V}_{\text{mod}}=V_{\text{mod}}=0$, the quadrature operators still carry a variance of $V_{0}=1$ due to the uncertainty relation. $V_{0}$ is usually referred to as shot noise and it can be simply added to the modulation variance because of mutual stochastic independence of the modulation and the shot noise. Combining (5) and (6), the mean photon number in terms of the quadrature operators’ variance reads

[TABLE]

After preparation of each coherent state Alice transmits $\ket{\alpha_{j}}$ to Bob through a Gaussian quantum channel. Bob uses homodyne or heterodyne detection (see Section 1) to measure the eigenvalue of either one or both of the quadrature operators.

2 Classical Post-Processing

Here we briefly mention the individual steps during the classical data post-processing (see e.g. [2]) that transform Alice’s modulation data and Bob’s measurement results into a universally composable (see footnote 1 on page 1) secure key.

(Sifting)

In some variants of CV-QKD Alice and Bob select the bases which they use to prepare and measure states, resp., by using independently and uniformly generated random bits. In these cases the sifting step eliminates all (uncorrelated) signals where different bases have been used for preparation and measurement. In variants of CV-QKD where Alice and Bob use both bases simultaneously no sifting is performed.

Parameter Estimation

After transmitting a sequence of states Alice and Bob will reveal and compare a random subset of the data that was sent and the corresponding measurements. This comparison allows them to estimate the total transmission and excess noise (see Section 3) of the channel by which they are able to compute their mutual information $I_{AB}$ and bound Eve’s information $\chi$. If $\chi$ turns out to be greater than $\beta I_{AB}$ the protocol aborts at this point.

Information Reconciliation

Otherwise, if $\beta I_{AB}>\chi$, Alice and Bob will perform information reconciliation which is a form of error correction. One-way information reconciliation where one party sends information on her key to the other party can be carried out in two different ways: Either Bob corrects his bits according to Alice’s data (direct reconciliation) or Alice corrects her bits according to Bob’s data (reverse reconciliation) [11]. In the case of forward reconciliation, for a total transmittance of $T_{\text{tot}}<0.5$ ($\approx$ -3 dB), Eve potentially has more information on what Alice prepared than Bob has, hence no secret key can be distilled (assuming that Eve can use the entire loss for her own benefit). This $3\text{\,}\mathrm{d}\mathrm{B}$ loss limit can be overcome by using reverse reconciliation, where Bob sends the correction information to Alice who thereupon corrects her bit string according to Bob’s. In this scenario Bob’s data is primary, and since Alice’s information on Bob’s measurement results is always greater than Eve’s, the mutual information $I_{AB}$ can remain greater than $\chi$ for any total transmission $T$ (of course, the lower $T$ is the more critical will the excess noise $\xi$ become).

For CV-QKD with Gaussian modulation different reconciliation schemes have been proposed. Two important schemes are slice reconciliation [61] and multidimensional reconciliation [62]. Both schemes can employ low-density parity-check (LDPC) codes [63] for the actual error correction. In the reverse reconciliation scheme one or several LDPC codes are used to calculate a compressed version of Bob’s data. This compressed version is then transmitted over a classical channel to Alice and fed into her decoder. Since 2011, the state-of-the art of LDPC codes for CV-QKD in the high-loss (low SNR) regime are multi-edge-type (MET) LDPC codes [64].

Confirmation

After information reconciliation Alice and Bob perform a confirmation step using a family of (almost) universal hash functions [65] to bound the probability that error correction has failed: Alice or Bob choose with uniform probability one particular hash function from the family and transmits the choice to the partner. Both apply that hash function to their key to obtain a hash value. Subsequently, Alice and Bob exchange and compare their hash values. If the hash values are different the keys must be different and they abort; if the hash values are equal they continue and know that they have obtained an upper bound on the probability that the keys are not identical. This error probability depends on the length of the hash values and of the type of hashing functions used.

Privacy Amplification

After successful confirmation Alice and Bob will share the same bit string with very high probability. However, Eve has a certain amount of information on the key. In order to reduce Eve’s probability to successfully guess (a part of) the key to a tolerable value, Alice and Bob will perform a privacy amplification protocol by applying a seeded randomness extractor (algorithm) to their bit strings. Again a family of universal hash functions is typically used for that purpose.

Authentication

To avoid a man-in-the-middle attack by Eve (cf. [66] for a related discussion) Alice and Bob need to authenticate their classical communication using a family of strongly universal hash functions.

Chapter 3 Transmittance and Noise

Apart from the specifications on signal modulation, any CV-QKD system is primarily characterised by the transmittance (channel transmission, detection efficiency, coupling losses) and the noise. Both undermine the experimental performance, lowering the signal-to-noise ratio and raising the advantage of a possible eavesdropper. Unlike in this present article, many references include the transmittance $T$ into the definition of noise, summarising transmission and noise in one noise parameter $\Xi$.111In most references these noise parameters are represented by the symbol $\chi$ instead of $\Xi$. However, we decided to deviate from this convention in order to avoid confusion with the Holevo information $\chi_{EA}$ and $\chi_{EB}$. Literature often distinguishes between channel noise $\Xi_{\text{ch}}$ and detection noise $\Xi_{\text{det}}$. The channel noise reads [2]

[TABLE]

decomposing $\Xi_{\text{ch}}$ into a term caused by channel losses $(1-T_{\text{ch}})/T_{\text{ch}}$ and the so-called excess noise $\xi_{A}$, an additional contribution to the noise variance of the quadrature operators (on top of the inherent vacuum noise $V_{0}\stackrel{{\scriptstyle\text{SNU}}}{{=}}1$). The subscript $A$ indicates that $\xi_{A}$ is referring to the channel input (hence to Alice), just like $\Xi_{\text{ch}}$ itself. The excess noise may originate from multiple sources such as from imperfect modulation, Raman scattering, quantisation, phase fluctuations and so on. Assuming all excess-noise sources to be stochastically independent from one another, they can be summed up due to the additivity of variances:

[TABLE]

Very similarly to the channel noise, the detection noise is represented as [2]

[TABLE]

Again, this expression for the noise is composed of losses $(1-\eta_{\text{det}})/\eta_{\text{det}}$ and an additional variance $\nu_{\text{el}}$, this time caused by the electronic noise of the detector. Conversely to the channel noise, the detection noise $\Xi_{\text{det}}$ is referring to the channel output, hence to Bob’s lab. The total noise is given by the sum:

[TABLE]

where the detection noise is divided by $T_{\text{ch}}$ in order for it to refer to the channel input just like $\Xi_{\text{ch}}$ and, consequentially, $\Xi$. After transmission of Alice’s signal through a lossy and noisy channel, Bob will measure a total quadrature variance of [2]

[TABLE]

Decomposing $\Xi$ into its constituents yields

[TABLE]

where we defined $T\coloneq T_{\text{ch}}\eta_{\text{det}}$. Since $\nu_{\text{el}}$ represents a noise variance in shot-noise units and can be assumed to be stochastically independent from the other noise sources, we can treat it as just another constituent of the excess noise, $\nu_{\text{el}}\eqcolon\xi_{\text{det}}$, which allows us to write

[TABLE]

Unlike most of the literature on CV-QKD, in the present article, we have the excess noise defined at the place where it is observed by measurement, hence at the channel output in Bob’s lab. We therefore introduce the definition

[TABLE]

This and the integration of $\nu_{\text{el}}$ into the excess noise lead to a reexpression of Bob’s variance (3) to222This relation is rigorously derived, using the covariance-matrix formalism, in Section 3.

[TABLE]

where, in a realistic setup, the transmittance $T$ comprises not only channel- and detection losses but also the coupling efficiency:

[TABLE]

and the excess noise is the sum of the variances of all possible noise sources:

[TABLE]

In Section 8 we derive analytic models for the various kinds of excess-noise constituents.

Chapter 4 Covariance Matrix

Bosonic multi-mode states can conveniently be described by covariance matrices whose diagonal entries represent the variances of the quadrature operators and whose off-diagonal terms represent the mutual covariance functions of two quadratures.111Find more details on the covariance-matrix formalism in Appendix B. Knowledge about the covariance matrix $\Sigma$ and its transformations is helpful to understand the behaviour of the particular bosonic modes and their correlations. However, in CV-QKD the knowledge of $\Sigma$ is not only helpful but vital in order to compute the Holevo information $\chi$.

In the protocol discussed in this article, Alice prepares displaced coherent states whose quadrature components are measured by Bob after transmission through a Gaussian channel (prepare-and-measure, PM). This is equivalent to a scenario where Alice prepares a two-mode squeezed vacuum state (TMSVS), performs a measurement of both quadratures of one mode and sends the other mode to Bob (entanglement-based, EB), as for example explained in [11]. In shot-noise units the TMSVS is described by the covariance matrix222See Appendix 1 for a derivation of the covariance matrix of a TMSVS.

[TABLE]

where $\sigma_{z}$ is the Pauli matrix $\left(\begin{smallmatrix}1&0\\ 0&-1\end{smallmatrix}\right)$ and $V$ is the variance of the quadrature operators:

[TABLE]

In our case the expectation values of the operators are zero and both quadratures $\hat{q}$ and $\hat{p}$ carry the same variance (as opposed to a squeezed state)

[TABLE]

This variance can be understood as the sum of the actual variance Alice is modulating with and the vacuum shot-noise variance:

[TABLE]

Hence the covariance matrix can be rewritten as

[TABLE]

The variance relates to the mean photon number per pulse as follows:333Derived in Appendix A.

[TABLE]

After transmission of Bob’s mode and influence of the various noise sources the covariance matrix transforms to444See Appendix 3 for a derivation of this matrix.

[TABLE]

Note that the matrix (7) represents a quadrature modulation according to a continuous Gaussian distribution $\mathcal{Q}\sim\mathcal{P}\sim\mathcal{N}(0,\tilde{V}_{\text{mod}})$. Other modulation alphabets like phase-shift keying (PSK) or quadrature amplitude modulation (QAM) are not discussed in this review. Those alphabets are represented by their own covariance matrices which distinguish from (7) only in the off-diagonal term, replacing $\sqrt{T(V_{\text{mod}}^{2}+2V_{\text{mod}})}$ by an appropriate covariance function of $A$ and $B$.

1 Homodyne and Heterodyne Detection

During the key transmission phase Bob receives noisy coherent states with a given symbol rate $f_{\text{sym}}$. These subsequent modes each carry randomly modulated quadrature components $q$ and $p$. The quadratures can be measured using the technique of homodyne detection where the signal mode is mixed with a reference laser (the local oscillator, LO) at a balanced beamsplitter. Depending on the relative phase $\theta$ of signal mode and LO, the photon number difference at the output ports of the BS is proportional to either the $q$- or $p$ quadrature:555See Appendix D for a derivation of the homodyne-detection law.

[TABLE]

Depending on the protocol, Bob can either measure one quadrature component at a time by randomly selecting between $\theta=0$ and $\theta=\pi/2$ for each incoming mode, or he measures both quadratures of each mode simultaneously, which is sometimes referred to as “no-switching protocol” [12]. The two variations of the protocol are illustrated in Figure 1. For the second approach Bob will separate the incoming states with a balanced BS and then measure the two quadratures by homodyne detection on each half of the signal – one with $\theta=0$ to measure $q$ and one with $\theta=\pi/2$ to measure $p$. Although this convention is misleading in more than just one way, we are speaking of homodyne detection when Bob measures only one quadrature component at a time and of heterodyne detection when Bob uses a BS and two homodyne detectors to measure both quadrature components simultaneously.666Note that in the telecommunication jargon, heterodyne detection denotes a differing optical frequency of transmitted signal and local oscillator. Using heterodyne instead of homodyne detection will double the mutual information for each symbol for the price of additional $3\text{\,}\mathrm{d}\mathrm{B}$ loss introduced by the heterodyning BS.

Splitting Bob’s mode for heterodyne detection will transform the covariance matrix to777This covariance matrix describing a heterodyne measurement setup is in detail derived in Appendix 4.

[TABLE]

Note that Bob now has two modes $B_{1}$, $B_{2}$ since he split his signal into half. The covariance matrix between Alice’s mode and one of Bob’s two modes is then represented as

[TABLE]

which is the equivalent to the case of homodyne detection (7) up to a factor of $1/2$ at transmission $T$ and excess noise $\xi$. The above matrix illustrates nicely the impact of heterodyne detection on Bob’s measurement outcome. However, even in case of heterodyne detection, the Holevo information can already be derived from (7), i.e. the matrix describing the TMSVS before action of Bob’s measurement apparatus (see Section 6).

2 Prepare-and-Measure vs. Entanglement-Based Protocols

In practical implementations of coherent-state CV-QKD protocols, Alice will, instead of generating two-mode squeezed states, prepare coherent states using $q/p$ modulation according to a given probability distribution with variance $V_{\text{mod}}$. However, for the sake of a simplified security analysis, it is convenient to assume that Alice and Bob are sharing an entangled TMSVS to which Eve holds a purification. The equivalence of both pictures, prepare-and-measure (PM) and entanglement-based (EB), is discussed in the present section. Assume Alice prepares her coherent state with quadrature operators $\hat{q}$ and $\hat{p}$ according to a probability distribution with variance $V_{A}=V_{\text{mod}}$ (or equivalently, quadrature components $q$ and $p$ with variance $V_{\text{mod}}/4$). Due to the minimal uncertainty of 1 shot-noise unit, described by a normal distribution $\mathcal{N}(0,1)$, Bob will receive coherent states with variance $V_{B}=V_{\text{mod}}+1$ (neglecting for now transmission losses and excess noise):

[TABLE]

Assuming the quadratures to be zero-centred ($\braket{\hat{q}}=\braket{\hat{p}}=0$), the covariance of Alice’s and Bob’s data reads

[TABLE]

This allows us to write down the covariance matrix of a prepare-and-measure protocol:

[TABLE]

Suppose now that Alice and Bob share a two-mode squeezed vacuum state with variance $V$:

[TABLE]

Alice, in order to collapse Bob’s mode into a coherent state, will perform a measurement of both quadratures of her mode. Therefore she has to split her mode into half using a balanced beamsplitter on whose output ports she will determine $\hat{q}$ and $\hat{p}$ respectively. The covariance matrix is then represented as

[TABLE]

Since both Alice’s modes are exactly equivalent, we reduce the matrix to the familiar $4\times 4$ dimensions, representing only one of Alice’s modes and Bob’s mode:

[TABLE]

If Alice rescales her measurement operators according to the transformations

[TABLE]

the variance $V_{A}$ and the covariance $\operatorname{Cov}(A,B)$ will change accordingly:

[TABLE]

This will transform the covariance matrix (16) as follows:

[TABLE]

So by rescaling the data obtained by her heterodyne measurement, Alice can simulate a prepare-and-measure scenario without Bob or Eve taking any notice of it. In other words, the prepare-and-measure scenario is equivalent to the entanglement-based version after Alice has rescaled her measurement outcomes by a factor of $\kappa=\pm\sqrt{2(V-1)/(V+1)}$. Conversely, in the experimentally more realistic scenario where Alice actively modulates the coherent states instead of measuring one mode of a TMSVS, she will rescale the values of the prepared quadratures with $\kappa^{-1}$ in order to simulate an entanglement-based scenario:

[TABLE]

This will of course transform the prepare-and-measure matrix to the entanglement-based one for which the security analysis is significantly more simple.

[TABLE]

Rescaling Alice’s values is therefore a crucial procedure in order to properly determine the Holevo bound and has to be taken into account for the parameter-estimation procedure, as will be described in Section 3.

Chapter 5 Signal-to-Noise Ratio and Mutual Information

The signal-to-noise ratio (SNR) is simply described by

[TABLE]

where $P_{S}$ is the total signal power and $P_{N}$ is the total noise power arriving at the channel output. As seen in (7) and (10), the variance of Bob’s quadratures is

[TABLE]

where $T$ is the total transmittance (including coupling- and detection efficiency) and $\mu=1$ in case of homodyne detection and $\mu=2$ in case of heterodyne detection. The damped modulation variance corresponds to the signal whereas vacuum noise 1 and excess noise $\xi$ add up to the total noise, hence

[TABLE]

The mutual information between Alice and Bob (and hence the maximal code rate) is given by

[TABLE]

As the equation indicates, measuring both quadratures at the same time seemingly doubles the mutual information: $\log_{2}(1+\text{SNR})$ instead of $\log_{2}(1+\text{SNR})/2$. This advantage is, however, compromised by the fact that the SNR is decreased by roughly a factor of 1/2 (not exactly 1/2 since also the excess noise $\xi$ will be halved by the heterodyning beamsplitter, as shown in (3)).

1 Relation to Normalised SNR

Say, $n$ raw bits are needed to transmit $k$ information bits. Then $k<n$ and the fraction of the two defines the code rate:

[TABLE]

So when $E_{r}$ and $E_{b}$ are the energies required in order to transmit a raw bit and information bit respectively, then they two are related to each other by the code rate as well:

[TABLE]

Rewriting the SNR in terms of energy per bit yields

[TABLE]

where $N_{0}$ is the spectral noise density, $\tau$ is the pulse duration of signal and LO, $B$ is the frequency bandwidth and we assumed $\tau B\approx 1$. Using the above relation and (4), we obtain an implicit function for the code rate:

[TABLE]

Here $0\leq\beta<1$ is the efficiency that the error correcting code with rate $R$ achieves for the mutual information $I_{AB}$.

Chapter 6 Holevo Information

The upper bound on an eavesdropper’s information, the Holevo information $\chi_{EB}$, (assuming reverse reconciliation) reads [67]

[TABLE]

where $S_{E}$ is the von Neumann entropy (14) of the state accessible to Eve for collective measurement and $S_{E|B}$ is the von Neumann entropy of the same state after a projective (homodyne or heterodyne) measurement has been performed by Bob. The entropies $S_{E}$ and $S_{E|B}$ are determined by the symplectic eigenvalues111See Appendix 4 for a definition of the von Neumann entropy and symplectic eigenvalues. of the covariance matrices describing these states. The actual quantum state from which $S_{E}$ are $S_{E|B}$ derived depends on which kind of eavesdropping attack is assumed. For a simplified security analysis it is very convenient to assume that Eve holds a purification of Alice’s and Bob’s mutual state $\rho_{AB}$. Fortunately there don’t need to be made any kinds of assumptions on what purification exactly Eve holds. This is due to the freedom-in-purifications theorem [68] which states that for any two ancillary states $\rho_{E_{1}}$ and $\rho_{E_{2}}$ which purify $\rho_{AB}$ such that $\rho_{ABE_{1}}$ and $\rho_{ABE_{2}}$ are both pure, there exists a unitary transformation $U_{E_{1}}$ acting on $\rho_{E_{1}}$ which transforms $\rho_{ABE_{1}}$ into $\rho_{ABE_{2}}$:

[TABLE]

Since the von Neumann entropy is invariant under unitary transformations:

[TABLE]

any purification of $\rho_{AB}$ that Eve may possess will result in the same entropy and hence the same Holevo information $\chi_{EB}$.

The next section will discuss the entangling cloner attack which represents a concrete example of how Eve can use a purification of $\rho_{AB}$ in order to gain information on the key. Section 2 presents a convenient way to compute the Holevo bound $\chi_{EB}$ regardless of the actual attack carried out by Eve. Although computed from entirely different covariance matrices, the resulting $\chi_{EB}$ in the next two sections will – due to the freedom in purifications – turn out exactly the same.

1 Entangling Cloner Attack

This attack is nicely described in [69]. Suppose Alice generates a two-mode squeezed vacuum state with variance $V$ and covariance matrix

[TABLE]

She keeps one mode to perform heterodyne detection on it (which is equivalent to preparing a coherent state) and sends the other one to Bob through a Gaussian channel. Eve generates a TMSVS herself with variance $W$ and covariance matrix

[TABLE]

so the overall covariance matrix reads

[TABLE]

Now suppose Eve replaces the quantum channel with a lossless channel in which she inserts a beamsplitter with transmission $T$. The beamsplitter mixes Bobs mode $B$ with one of Eve’s modes $E_{1}$. Eve keeps one of the outputs to herself and passes the other one to Bob. The symplectic beamsplitter operator BS acting on the modes $B$ and $E_{1}$ of the state (6) is represented as222See Appendix 2 for more details on the transformation laws of Gaussian states.

[TABLE]

Action of the beamsplitter operator on the total state shared between Alice, Bob and Eve yields

[TABLE]

Given the above total state, Alice’s and Bob’s substate reads

[TABLE]

When Eve chooses the variance of her TMSVS to be

[TABLE]

we obtain the covariance matrix

[TABLE]

which coincides exactly with (7), a covariance matrix that represents a transmission through a lossy channel and excess noise $\xi$ without the presence of an eavesdropper. In order to obtain Eve’s information we compute the symplectic eigenvalues of the covariance matrix describing her substate of (1):

[TABLE]

When a matrix is of the form

[TABLE]

its symplectic eigenvalues can be obtained by [67]

[TABLE]

with

[TABLE]

These two eigenvalues can be used to calculate the entropy $S_{E}$. In order to obtain the conditional entropy $S_{E|B}$ based on Bob’s measurement, we need to find the symplectic eigenvalues of Eve’s covariance matrix after Bob has performed a (homodyne or heterodyne) measurement on his mode.

1 Homodyne Detection

The covariance matrix shared between Eve and Bob reads

[TABLE]

According to (19), a homodyne measurement of Bob’s mode will transform Eve’s substate to333See Appendix 5 for detailed considerations on partial measurements on $N$-mode Gaussian states.

[TABLE]

where $\Sigma_{E}$ is given by (16), $V_{B}=TV+[1-T]W=T(V-1)+1+\xi$ and

[TABLE]

So we obtain

[TABLE]

The symplectic eigenvalues of this matrix can be obtained by finding the eigenvalues of $\tilde{\Sigma}_{E|B}=i\Omega\Sigma_{E|B}$ (where $\Omega$ is defined as in (3)) and taking their modulus.

2 Heterodyne Detection

When Bob performs heterodyne measurement on his mode, Eve’s state transforms according to (26)

[TABLE]

where $\Sigma_{E}$, $V_{B}$ and $\Sigma_{C}$ are defined as in the previous section. Straightforward calculation yields the matrix

[TABLE]

whose symplectic eigenvalues can be computed using (18) and (19).

2 Universal Analysis of Purification Attacks

Making no assumptions on how a specific attack might be carried out concretely, all we presume is Eve holding a purification of Alice’s and Bob’s shared quantum state $\rho_{AB}$. This means that the total state $\rho_{\text{tot}}=\rho_{ABE}$ can be represented as a pure state

[TABLE]

which, when Eve’s subspace is traced out, will deliver Alice’s and Bob’s mixed state:

[TABLE]

The von Neumann entropy of a mixed state $\rho=\sum_{i}p_{i}\ket{i}\bra{i}$ is defined as [68]

[TABLE]

We consider $\ket{\psi}$ a bipartite state with Alice’s and Bob’s joint substate making up one part and Eve’s one the other. Any pure bipartite state can be written in terms of a Schmidt decomposition, hence

[TABLE]

Tracing out either of the subsystems then yields

[TABLE]

The von Neumann entropy depends only on the components $\lambda_{i}$ which are – thanks to the Schmidt representation of $\ket{\psi}$ – coinciding for $\rho_{AB}$ and $\rho_{E}$. Therefore the assumption that Eve holds a purification of $\rho_{AB}$ leads to the fact that her von Neumann entropy coincides with the one shared by Alice and Bob:

[TABLE]

which drastically simplifies the computation of the Holevo information:

[TABLE]

The entropy $S_{AB}$ can be obtained by (14), using Alice’s and Bob’s covariance matrix (7) and its symplectic eigenvalues $\nu_{1}$ and $\nu_{2}$, obtained by (18) and (19). However, similar to the case of an entangling cloner attack, the computation of $S_{A|B}$ is a bit more involved and depends on whether Bob performs a homodyne or heterodyne measurement.

1 Homodyne Detection

Using the covariance matrix

[TABLE]

and the relation describing the effect of a partial homodyne measurement (19)

[TABLE]

where $\Sigma_{A}=a\mathbb{1}_{2}$, $\Sigma_{C}=c\sigma_{z}$ and $V(q_{B})=V_{B}=b$, we obtain

[TABLE]

Again, the symplectic eigenvalues of $\Sigma_{A|B}$ are given by the modulus of the eigenvalues of $\tilde{\Sigma}_{A|B}=i\Omega\Sigma_{A|B}$. We obtain

[TABLE]

The eigenvalue $\nu_{3}$ of this matrix can be derived obtained in the well-known fashion:

[TABLE]

And therefore

[TABLE]

2 Heterodyne Detection

In case of heterodyne detection we use (26)

[TABLE]

where again $\Sigma_{A}=a\mathbb{1}_{2}$, $\Sigma_{C}=c\sigma_{z}$, $V_{B}=b$ and $a$, $b$ and $c$ are defined as in (42). Using these definitions we obtain

[TABLE]

The eigenvalue is computed in analogous fashion to the previous section and yields

[TABLE]

3 Strict and Loose Security Assumptions

Consider the assumption that an eavesdropper might have access to the quantum channel but not to the instruments in Bob’s lab (“trusted-device scenario”, see [70] for a detailed discussion). This would be beneficial for the key rate since not the entire noise and transmission are attributed to Eve. For example, detection noise and quantisation noise, as well as the detection efficiency might not contribute to the Holevo information (although they of course still influence Bob’s measurement results and therefore the SNR and mutual information $I_{AB}$). Decomposing $\xi$ and $T$ into constituents associated to the channel and the receiver yields

[TABLE]

where $\xi_{\text{rec}}$ and $T_{\text{rec}}$ might be composed as follows:

[TABLE]

This allows us to rewrite the covariance matrix (42) as

[TABLE]

This matrix will be used to compute $\chi_{EB}$ under the strict assumptions that Eve has access not only to the channel but also to Bob’s apparatus. Therefore, the entire noise and transmittance are attributed to Eve. However, under the trusted-device scenario, the covariance matrix would be modified to

[TABLE]

It is easy to show that this representation of the covariance matrix under loose assumptions is equivalent to the one often used in CV-QKD literature [15]:

[TABLE]

which uses the notation introduced in Section 3:

[TABLE]

Bob’s variance in (55) can be multiplied out to obtain

[TABLE]

where we used this article’s convention that the parameter $\xi$ refers to the channel output:

[TABLE]

Note that in addition to the trusted-receiver assumption discussed in this section, one might tend to classify the preparation noise as trusted as well. After all, it originates in Alice’s lab from her well-known devices. This assumption, however, was shown to open the door to severe side-channel attacks [71, 72] and is therefore not further considered in this article.

Chapter 7 Practical Parameter Estimation

The estimation of the channel parameters is an important task in any QKD protocol. In this work we avoid security problems related to attacks against a co-transmitted local oscillator (see e.g. [30, 73]) and concentrate on the estimation procedure for the case of a true or local local oscillator (LLO).

1 Introduction

A lower bound to the asymptotic secret-key rate of a CV-QKD protocol, according to (1) and (5), reads:

[TABLE]

where $f_{\text{sym}}$ is the symbol rate, FER represents the frame-error rate, $\nu$ is the key fraction disclosed for parameter estimation, $\beta$ is the post-processing efficiency, $I_{AB}$ represents the mutual information between Alice and Bob (upper-bounded by the channel capacity/Shannon limit) and $\chi_{EB}$ is the Holevo bound, i.e. an upper bound to the mutual information between Eve and Bob The mutual information between Alice and Bob $I_{AB}$ depends uniquely on the signal-to-noise ratio, which is given by (3)

[TABLE]

where T is the total channel transmittance, $V_{\text{mod}}$ is the modulation variance, $\xi$ is the total excess noise and $\mu=1$ for homodyne and $\mu=2$ for heterodyne detection. The Holevo bound is derived from the covariance matrix (7)

[TABLE]

where $\sigma_{z}$ is the Pauli-$z$ matrix. In order to estimate a secret-key rate from a given measurement of $N$ displaced states in phase space, the SNR and Holevo bound need be obtained from the measurement results, as derived in Section 3.

However, prior to the actual parameter estimation, the measurement apparatus needs to be calibrated in order for Bob’s experimental results to be mapped from voltages to shot-noise units (SNU). A possible procedure for this conversion is presented in the following section.

2 Calibration of the Measurement Setup

We describe briefly how to obtain the proper conversion factor $\phi$ which relates experimental measurement data to the language of Gaussian quantum information, hence shot-noise units. In order to keep track of possibly varying calibration parameters, this procedure should be carried out repeatedly during the key-exchange phase.

The total variance of the quadrature operator $\hat{q}$ at the receiver side is, according to (7) and (10),

[TABLE]

We divide the excess noise into one part originating from the quantum channel $\xi_{\text{ch}}$ and one part related to the receiver $\xi_{\text{rec}}=\xi_{\text{det}}+\xi_{\text{ADC}}$. With this we reexpress the above equation as

[TABLE]

However, what Bob actually measures is a voltage variance:

[TABLE]

where $\phi$ is the conversion factor specific to the measurement setup in units of $\text{V}^{2}/\text{SNU}$. The maximum likelihood estimator (MLE) for the voltage variance is given by

[TABLE]

where $U_{i}$ are the voltages measured during $N$ samples. In the current framework of an asymptotic analysis we ignore the fact that the actual variance might deviate from the MLE and refer to [53] for the detailed estimation procedure that involves the calculation of confidence intervals.

According to our model, the factor $\phi$ can be approximated by

[TABLE]

where $P_{\text{LO}}$ is the local-oscillator power, $\rho$ is the PIN diodes’ responsivity (in A/W), $g$ is the total amplification of the receiver (in V/A), $B$ is the electronic bandwidth (in Hz), $h$ is Planck’s constant and $f$ is the optical frequency. However, instead of relying on this model, the factor $\phi$ must be determined experimentally. In order to do so, Bob will disconnect the signal input ($TV_{\text{mod}}=\xi_{\text{ch}}=0$) and measure the quadratures of a vacuum state instead. This reduces (5) and (6) to

[TABLE]

Note that $\phi$ scales linearly with the local-oscillator power while the receiver noise scales with the inverse $P_{\text{LO}}$, as seen in (94) and (108). Therefore the product of the two is constant with respect to $P_{\text{LO}}$:

[TABLE]

So in the case of $P_{\text{LO}}=0$, the conversion factor $\phi$ will become zero but $N_{\text{rec}}$ will stay unaffected since it is independent from $P_{\text{LO}}$. Therefore, when not only the signal input but also the local oscillator is disconnected (9c) becomes

[TABLE]

which can easily be obtained by measurement, using (7). Now for a given voltage variance $V(U)$, obtained with a given non-zero local-oscillator power $P_{\text{LO}}$, we can rewrite (9c) as follows:

[TABLE]

which is the voltage-square measure of exactly one unit of shot noise (still provided that only a vacuum input is measured, hence $TV_{\text{mod}}=0$). For the subsequent parameter estimation (as described in the following two sections) Bob will divide his the measured voltages, representing $q$ and $p$, by $\sqrt{\phi}$ and any computed voltage variance by $\phi$, so all his data will be given in shot-noise units.

3 Estimation of the Covariance Matrix

The Holevo bound and the characteristic parameters $T$ and $\xi$ are determined by an estimation of the covariance matrix $\Sigma$. This procedure requires for Alice and Bob to reveal a certain fraction of their raw key, say $n$ samples which will later be omitted and not used for the generation of the secure key. In practical CV-QKD Alice prepares a sequence of randomly distributed coherent states which are transmitted to Bob which is referred to as prepare-and-measure (PM) scenario. On the other hand, the entire security analysis is based on the distribution of two-mode squeezed vacuum states, referred to as entanglement-based (EB) picture. Therefore, in order to satisfy the requirements of a sound security analysis, Alice and Bob have to rescale their experimental quadrature values, transferring their prepare-and-measure covariance matrix $\Sigma^{\text{PM}}$ to an entanglement-based version $\Sigma^{\text{EB}}$. The prepare-and-measure covariance matrix, after transmission through a lossy ($T$) and noisy ($\xi$) channel into Bob’s lab who performs a homodyne ($\mu=1$) or heterodyne ($\mu=2$) measurement, is represented as (10)

[TABLE]

On the other hand, the covariance matrix of a TMSVS, after transmission of one mode, looks as follows:

[TABLE]

Alice determines the coefficients $a^{\text{EB}}$, $b^{\text{EB}}$ and $c^{\text{EB}}$ which she will use to compute the Holevo bound $\chi_{EB}$ (see Section 6):

The coefficient $a^{\text{EB}}$ is easily obtained, since the modulation variance is well known ahead of the raw-key transmission:

[TABLE] 2. 2.

The computation of $b^{\text{EB}}$ is straightforward as well, since it is distinguished from $b^{\text{PM}}$ only in the case of heterodyne detection where the factor $\mu=2$ needs to be taken into account.

[TABLE]

where $b^{\text{PM}}$, the variance of Bob’s quadratures in SNU, is either announced by Bob or computed by Alice using the $n$ disclosed samples. The above transformation will leave $b^{\text{PM}}$ unchanged in case of homodyne detection ($\mu=1$) and change $b^{\text{PM}}=TV_{\text{mod}}/2+1+\xi/2$ to $b^{\text{EB}}=TV_{\text{mod}}+1+\xi$ in case of heterodyne detection ($\mu=2$). 3. 3.

For the computation of $c^{\text{EB}}$, Alice’s and Bob’s values need to rescale their values as follows in order to adhere to the entanglement-based picture:

[TABLE]

where the conversion factor $\phi$ had been used to convert Bob’s measurements from volts to SNU. This allows us to write

[TABLE]

A quick check is sufficient to confirm this result:

[TABLE]

So in order to obtain $c^{\text{EB}}$, Alice will use the disclosed fraction of $n$ samples to compute the mean values $\braket{q_{A}^{\text{PM}}q_{B}^{\text{PM}}}$ and $\braket{p_{A}^{\text{PM}}p_{B}^{\text{PM}}}$ and multiply the result with $\sqrt{\mu(V_{\text{mod}}+2)/V_{\text{mod}}}$.

The knowledge of the three coefficients $a^{\text{EB}}$, $b^{\text{EB}}$ and $c^{\text{EB}}$ is sufficient to compute the Holevo information $\chi_{EB}$. However, if required, the parameters $T$ and $\xi$ can quickly be obtained by

[TABLE]

and

[TABLE]

The signal-to-noise ratio (and therefore the mutual information $I_{AB}$) can be either be determined using the parameters $T$ and $\xi$, or alternatively, the total variance and the conditional variance of Bob’s data:

[TABLE]

where $V_{B}=\frac{T}{\mu}V_{\text{mod}}+1+\frac{\xi}{\mu}$ is the total variance of Bob’s measurement in one basis and $V_{B|A}=V(\hat{q}_{B}|A)=1+\frac{\xi}{\mu}$ is the conditional variance, i.e. the variance of Bob’s measurements conditioned on Alice’s data. It is equivalent to the variance of the difference $\sqrt{T/\mu}\ \hat{q}_{A}-\hat{q}_{B}$:

[TABLE]

where we used $\braket{\hat{q}_{A}}=\braket{\hat{q}_{B}}=0$. Note that in the case of discrete modulation (e.g. QPSK or 16-QAM, as opposed to continuous Gaussian modulation reviewed in this article) the conditional variance is easier to obtain since it corresponds to the variance of the subset of samples that are associated to one and the same (discrete) modulation symbol.

Chapter 8 Noise Models

In addition to the obligatory shot-noise, various experimental imperfections will contribute to the total noise and undermine the system’s performance.111Note that the augmentation of excess noise is not the only way for experimental imperfections to manifest. For example, when the transmitted quantum states are generated digitally (as it is usually the case in the prepare-and-measure scheme) they deviate from a truly continuous Gaussian distribution due to the finite bit resolution of any digital-to-analog converter. The effects of the discretised Gaussian modulation go beyond the mere occurrence of quantisation noise. In fact, since the standard security analysis of CV-QKD assumes continuous Gaussian states, this imperfection has to be taken into account on a more fundamental level [74, 75]. We refer to this additional noise as excess noise $\xi$, describing a variance of the quadrature operators and given in shot-noise units. The constituents of $\xi$ may originate from noisy detection, from a noisy preparation [76, 77, 78] due to intensity fluctuations of the used lasers or imperfect modulation, from quantisation of the measurement results, from Raman scattering caused by classical channels in the fibre and others. We assume all these noise sources to be stochastically independent which makes the variances they cause to the quadratures additive:

[TABLE]

In the present chapter we are providing mathematical models for some of the possible noise components. These models may serve as guidance for the design of actual CV-QKD implementations as they provide estimates of the impact that particular hardware choices (e.g. lasers, modulators, detectors, analog-to-digital converters, etc.) on the total noise and, consequently, the expected secure-key rate. Section 9 discusses some practical conclusions and identifies the most crucial hardware specifications based on the noise models derived in this chapter.

1 Relative Intensity Noise – Signal

Power fluctuations of a laser are quantified by the so-called relative intensity noise (RIN), which is given by

[TABLE]

where $\braket{P}$ represents the average optical power and $(\delta p)^{2}$ the spectral density of the power-fluctuation, given in units of $[\text{W}^{2}/\text{Hz}]$. Therefore, the absolute power variance, given a bandwidth $B$, can be written as

[TABLE]

In order to obtain a measure for how the RIN of the signal laser contributes to the excess noise, we first investigate in which way a certain laser-power variance $V(P)$ influences the variance of the quadrature operator $V(\hat{q})$:

[TABLE]

where we used (A) in the second and third line. Assuming variance symmetry of the quadrature operators, $V(\hat{p}^{2})=V(\hat{q}^{2})$, we obtain

[TABLE]

If a Gaussian random variable has expected value of zero, then the variance of its square is twice the square of its variance:

[TABLE]

which leads to

[TABLE]

Using (3) we obtain the expression for the quadrature variance caused by the RIN of the signal laser:

[TABLE]

The above expression describes the quadrature variance directly at the transmitter, hence at the channel input. However, when the excess noise is defined with respect to the channel output (as in this article), it needs to be multiplied by a factor $T$, the total channel transmittance. Moreover, according to (7), the mean photon number $\braket{n_{\text{sig}}}$ is $V_{\text{mod}}/2$, which yields the final result:

[TABLE]

2 Relative Intensity Noise – Local Oscillator

When a signal beam is mixed with a local oscillator at a balanced beamsplitter the difference of the number operators at both output ports is proportional to the local-oscillator amplitude times the signal’s quadrature components (D):

[TABLE]

Obviously, a power fluctuation of the local oscillator will introduce an additional contribution to the excess noise. For simplicity we assume $\theta=0$, hence

[TABLE]

The variance of $\Delta\hat{n}$ is the variance of a product of two independent random variables which can be written as

[TABLE]

where we used $\braket{\hat{q}}=0$ and the subscript $\neg\text{RIN,LO}$ indicates that $V_{\neg\text{RIN,LO}}(\hat{q})$ describes the variance of $\hat{q}$ without taking the local-oscillator’s RIN into account. In order to find an expression for the variance caused by the LO’s RIN we rewrite $V(\Delta\hat{n})$ in a different way, assuming a constant LO amplitude $\alpha_{\text{LO}}$ and the RIN noise being already contained in $V(\hat{q})$:

[TABLE]

Equalising (2) and (2) yields

[TABLE]

and therefore

[TABLE]

The expression $V(|\alpha_{\text{LO}}|)$ is clearly determined by the RIN. In order to understand the relation between $V(|\alpha_{\text{LO}}|)$ and the RIN, note that the mean photon number is given by the amplitude squared:

[TABLE]

with the derivative

[TABLE]

from which the relation between the deviations and variances of $\braket{n}$ and $|\alpha|$ and follow:

[TABLE]

Using this result, $V(|\alpha|)$ can be reexpressed as follows:

[TABLE]

Inserting this result into (15) yields

[TABLE]

which leads to the final expression

[TABLE]

3 Modulation Noise

In this section we will model the excess noise caused by Alice’s modulation of a coherent state.222Note that in this section we will only derive the excess noise caused by modulation-voltage noise of the signal generator. Further noise sources such as the quantisation error of the DAC, phase deviations of the $q/p$-modulator, the ripple in the electro-optic modulation and detection responses are not investigated at this point. We assume the following experimental setup:

• •

A signal generator – say, a digital-to-analog converter (DAC) or, alternatively, an arbitrary-waveform generator (AWG) – translates a certain signal-bit information into a voltage $U_{\text{DAC}}$ with a specific deviation $\delta U_{\text{DAC}}$.

• •

This voltage and its deviation are amplified by a factor of $g$ to the voltage required to drive the $q/p$-modulator. The amplified voltage is

[TABLE]

• •

A pulsed laser emits a coherent state $\ket{\tilde{\alpha}}$ which is subsequently injected into the $q/p$-modulator.

• •

Depending on the voltage $U$ applied to the modulator, the quadratures of $\ket{\tilde{\alpha}}$ are adjusted according to Alice’s choice of random numbers. The modulator consists of a Mach-Zehnder interferometer (MZI) with another nested MZI in each arm to which the phase rotations $\pm\phi_{1}$ and $\pm\phi_{2}$ are applied respectively. The output state of the modulator is a coherent state $\ket{\tilde{\alpha}^{\prime}}$ with the eigenvalue333See Appendix E for the principles of a $q/p$-modulator and a derivation of its output state.

[TABLE]

The initial input state $\ket{\tilde{\alpha}}$ can be arbitrary. However, for simplicity we assume the eigenvalue to be real-valued: $\tilde{\alpha}\in\mathbb{R}$. Under this assumption the real and imaginary part of $\tilde{\alpha}^{\prime}$, hence the $q$- and $p$-quadrature are

[TABLE]

• •

Followed by the modulator, an attenuator damps the coherent state by a factor of $\sqrt{t}$ such that its photon number corresponds to the modulation variance $\braket{n}=V_{\text{mod}}/2$. The attenuated state is then

[TABLE]

• •

Alice sends $\ket{\alpha}$ to Bob who receives the state $\ket{\sqrt{T}\alpha}$, where $T$ is the total transmission (including channel transmission, detection- and coupling efficiency).

In order to derive the noise parameter $\xi_{\text{mod}}$ we go back to the expression for the $q$-quadrature of the modulated state $\ket{\tilde{\alpha}^{\prime}}$:

[TABLE]

The phase rotation $\varphi_{1}$ is equal to the product of the applied voltage $U$ and some conversion factor $\nu$ which describes in rad/V the amount of phase rotation per applied voltage:

[TABLE]

This conversion factor can be expressed in terms of the entity $U_{\pi}$ which describes the voltage required to achieve a phase rotation of $\pi$. In our setup, where the applied voltage is the amplified DAC voltage $U=gU_{\text{DAC}}$, the quadrature $\tilde{q}^{\prime}$ can be reexpressed in the following way:

[TABLE]

However, when a noisy voltage, amplified by a factor $g$ as shown in (22), is applied the modulated quadrature will become noisy as well:

[TABLE]

We define $A\coloneq\pi g\ U_{\text{DAC}}/U_{\pi}$ and $\lambda\coloneq\pi g\ \delta U_{\text{DAC}}/U_{\pi}$ and make a Taylor expansion of the above equation around $\lambda=0$:

[TABLE]

By cancelling $\tilde{q}^{\prime}=1/2\ \tilde{\alpha}\cos A$ on both sides we obtain the expression for the quadrature noise:

[TABLE]

The sine and cosine function obey of course $-1\leq\sin A,\cos A\leq 1$ for any argument $A$. Therefore we obtain an upper bound for the quadrature modulation noise

[TABLE]

Damping by the attenuator and the channel yields

[TABLE]

The modulation-caused variance of the quadrature is then

[TABLE]

If we compute the square of the modulated state $\tilde{\alpha}^{\prime}$ (23),

[TABLE]

we see that the square of the input state $\tilde{\alpha}$ and the square of the modulated state $\tilde{\alpha}^{\prime}$ are related by a factor of 2. Moreover, due to (25) we can write $t|\tilde{\alpha}^{\prime}|^{2}=|\alpha|^{2}$, where $\alpha$ represents the state sent from Alice to Bob. Using this and the fact that $|\alpha|^{2}=\braket{n}=V_{\text{mod}}/2$ we arrive at

[TABLE]

The above expression describes the variance of the quadrature component $q$. Knowing that $V_{\xi}(\hat{q})=4V_{\xi}(q)$ we obtain the variance of the quadrature operator $\hat{q}$:

[TABLE]

Note that in the case of QPSK modulation this expression simplifies drastically: In this scheme all four points in phase space can be obtained by phase rotations of $\varphi_{1},\varphi_{2}\in\{0,\pi\}$. Therefore the voltage gain factor will adjust the DAC voltage such that it matches $U_{\pi}$, the voltage required for a phase rotation of $\pi$:

[TABLE]

Inserting into (37) yields the final expression for the excess noise caused by modulation voltage noise in the QPSK scheme:444Note that in the case of an applied phase $\pi$ (hence $g=U_{\pi}/U_{\text{DAC}}$) the variable $A$ in (31) will become $\pi$, therefore erasing the term proportional to $\sin A$ in the error $\delta\tilde{q}^{\prime}$. In this case the error will only depend on the second and higher orders of $\lambda=\pi\ \delta U_{\text{DAC}}/U_{\text{DAC}}$. However, in order to take other modulator models into account (e.g. $\alpha^{\prime}=1/2\alpha[\cos\varphi_{1}+i\sin\varphi_{2}]$ instead of $\alpha^{\prime}=1/2\alpha[\cos\varphi_{1}+i\cos\varphi_{2}]$) we stick to the very generous upper bound (3) which is valid for any modulation scheme, any phase angle $\varphi$ and both quadratures $q$ and $p$.

[TABLE]

4 Phase-Recovery Noise

Coherent detection of the quantum signal requires a well-known phase- and frequency relation between the transmitter laser and the local oscillator. Moreover, the transmitter laser will carry a specific amount of phase noise $\delta\varphi$. This phase noise as well as phase offsets between signal laser and LO can be compensated using a strong reference signal sent by Alice, the pilot tone [19, 20, 22, 24]. The pilot tone carries a well-known phase $\omega t$ with a fixed phase relation to the signal pulse. Bob performs heterodyne detection of the pilot tone, measuring its $q$- and $p$-quadrature. If he makes his measurements periodically in a rate of exactly $\omega$, he can determine the deviation from a fixed and temporarily constant reference phase. Any such measured drift from this phase is used to readjust the measured phase of the quantum signal accordingly. Since relative phase deviations of the signal laser and LO can be compensated as accurately as the quadratures of the pilot tone can be measured, the remaining phase noise after recovery can be described in terms of the variance of the pilot-tone quadratures. However, the pilot-tone is influenced by various noise sources, very similar to the signal itself:

[TABLE]

where the pilot tone’s phase noise is determined by the accuracy of the sampling time:

[TABLE]

In order to translate this angle deviation into a variance of the quadratures, we note that

[TABLE]

Hence a deviation of $\delta t$ will cause the quadrature to deviate according to

[TABLE]

Expanding around $\omega\delta t=0$ yields

[TABLE]

Therefore the error in the quadrature reads

[TABLE]

Using the fact that the modulus of sine and cosine is always smaller than or equal to one, we obtain the upper bound

[TABLE]

which, when squared, yields the variance

[TABLE]

However, this is only the variance of the quadrature component $q$. In order to get $\xi_{\text{PT,phase}}$, hence the variance of the quadrature operator, we need to multiply by a factor four:

[TABLE]

The other noise components of the pilot tone, $\xi_{\text{PT,modul}}$, $\xi_{\text{PT,Ram}}$, $\xi_{\text{PT,det}}$ and $\xi_{\text{PT,ADC}}$, are computed exactly as the ones of the actual quantum signal, described in the other sections of this chapter. When the total noise of the pilot tone $V(\hat{q}_{\text{PT}})\eqcolon V_{\text{PT}}$ is determined, it needs to be related to the phase-recovery noise (PR noise) of the quantum signal by putting them in proportion to their mean photon numbers:

[TABLE]

where $\braket{n_{\text{qu}}}$ represents the mean photon number of the quantum signal. The above equation is true for a case where one single pilot-tone measurement is used to recover the phase of one signal state. In experiment it is common to sample several, say $N$, pilot-tone measurements, each with a photon number $\braket{n_{\text{PT}}}$, and then take the average. We will briefly discuss how numerous measurements influence $V_{\text{PT}}$ and the above equation. Say the quadratures of the pilot tone carry, by virtue of various noise components, the variance $V_{\text{PT}}=V(\hat{q}_{\text{PT}})$. A number of $N$ subsequent measurements of the quadrature $\hat{q}_{\text{PT}}$ will yield the average

[TABLE]

The variance of this mean value is computed as follows:

[TABLE]

However, the variance of a single measurement of $\hat{q}_{\text{PT}}^{i}$ is $V_{\text{PT}}$, so we can rewrite the above expression to obtain

[TABLE]

Therefore, sampling over $N$ pilot-tone states with each $\braket{n_{\text{PT}}}$ mean photons transforms 49 to

[TABLE]

Rearranging the above equation and using the relation $\braket{n}=V_{\text{mod}}/2$ yields the final expression for the phase noise of the quantum signal:

[TABLE]

5 Raman Noise

When the quantum channel is wavelength-multiplexed with a classical channel, this classical channel will generate very broadband noise photons by Raman scattering. We assume the state represented by the Raman photons to be a thermal state.

In shot-noise units the photon-number operator is given by555Find a derivation of the number operator in terms of quadrature operators in SNU in Appendix A.

[TABLE]

When the quadratures have a mean of zero ($\braket{\hat{q}}=\braket{\hat{p}}=0$) then their variance is given by the mean of their square: $V(\hat{q})=\braket{\hat{q}^{2}}$ (and analogous for $\hat{p}$). This allows us to write the expectation value of the number operator as

[TABLE]

Further assuming that the $q$- and $p$-quadrature carry the same total variance $V(\hat{q})=V(\hat{p})\eqcolon V$, this expression simplifies to

[TABLE]

Let the above expression describe the total photon number of an incoming pulse, contaminated by Raman photons. The total photon number $\braket{\hat{n}_{\text{tot}}}$ will then be the sum of attenuated signal photons and Raman photons; and the total variance $V_{\text{tot}}$ will be the sum of the damped modulation variance, one shot noise and the variance of the Raman noise:

[TABLE]

Knowing that $\braket{\hat{n}_{A}}=V_{\text{mod}}/2$ we obtain the simple result

[TABLE]

The mean photon number can be reexpressed as optical power times integration time divided by energy per photon:

[TABLE]

When the Raman noise is measured in terms of spectral noise density $N_{\text{Ram}}$ in units of dBm/nm, the linear spectral density is

[TABLE]

Therefore the Raman noise power in linear scale is

[TABLE]

with $\Delta\lambda$ being the filter bandwidth (e.g. $\Delta\lambda\approx$8\text{,}\mathrm{pm} at $B=$1\text{\,}\mathrm{GHz} and $f=$193.4\text{,}\mathrm{T}\mathrm{H}\mathrm{z} for $\lambda=$1550\text{\,}\mathrm{nm}). Inserting the above expression into (60) and using (59), we arrive at the final expression for the Raman noise in SNU:666Note that in case of a polarisation-multiplexed reference signal a polarised beamsplitter (PBS) is used to separate the quantum signal from the reference signal. Assuming unpolarised Raman photons, this BS will divide the optical Raman power, and hence the excess noise $\xi_{\text{Ram}}$, in half. However, due to mixing of the quantum signal with the local oscillator, giving rise to sum- and difference frequency terms, the signal’s bandwidth $B$ is increased by a factor $2$, therefore compensating the effect of the PBS and leaving the expression (63) unchanged.

[TABLE]

6 Common-Mode Rejection Ratio

In a typical balanced homodyne receiver two PIN diodes convert, by their responsivity $\rho$, the optical input power into electric currents $I_{1}$ and $I_{2}$ whose difference $\Delta I$ is proportional to the quadrature of the input signal. The current difference is subsequently amplified to a measurable voltage $U$ by a large transimpedance $g$. However, a realistic differential amplifier will not only amplify the current difference but, to a small portion, also their mean value:

[TABLE]

The ratio of differential gain $g$ and common-mode gain $g_{s}$ is referred to as common-mode rejection ratio (CMRR):

[TABLE]

Favourably $g_{s}$ is very small and the CMRR therefore very high. In order to model the effect of the CMRR, we go to the expression for the photon numbers at the output ports of the homodyne beamsplitter (5):

[TABLE]

Taking the difference of the two operators yields (D)

[TABLE]

where $\theta$ is the phase of the LO. On the other hand, adding the two operators yields

[TABLE]

which is independent of the LO phase $\theta$. A photon number $n$ corresponds to the optical power by $P=hfn/\tau$. So the amplified voltage, given the above photon numbers and a PIN responsivity $\rho$, can be written as

[TABLE]

Again, we simplify to the case $\theta=0$. Furthermore, we express $g_{s}$ in terms of $g$ and the CMRR, so we obtain

[TABLE]

Since for any random variable $X$: $V(X+\text{const.})=V(X)$, the CMRR does not contribute to the variance of the measurement outcome if the photon numbers $\braket{\hat{n}_{\text{sig}}}$ and $\braket{n_{\text{LO}}}$ are constant.777Note that, even if the CMRR term does not contribute to the excess noise, it still produces a voltage offset which has to be subtracted from the measurement before post-processing. However, if $\braket{\hat{n}_{\text{sig}}}$ and/or $\braket{n_{\text{LO}}}$ are random variables themselves, then the CMRR term does contribute to the excess noise and the variance of the total voltage is given by

[TABLE]

For now we want to focus on the CMRR contribution only, so we write

[TABLE]

We assume the fluctuations of the photon numbers to be dominantly caused by relative intensity noise (RIN) of the signal and local oscillator respectively. Therefore we reexpress the variances of the photon numbers in terms of optical laser powers which can then be written in terms of RIN:

[TABLE]

Back-transforming the voltage variance through the receiver setup into a variance of the quadrature operator $\hat{q}$ yields

[TABLE]

and therefore

[TABLE]

By inserting (6) we obtain

[TABLE]

which brings us to the expression:

[TABLE]

Note that, by Equation (10), heterodyne detection will halve the transmittance and the excess noise with all it’s constituents:

[TABLE]

However, the measured CMRR noise will (similar to the detection- and ADC noise) not halve since there will be two balanced receivers (and ADCs) in the measurement setup – one at each output port of the beamsplitter. Due to our convention that the excess noise $\xi$ is defined at the channel output before the heterodyning beamsplitter, and because Equation (77) represents the CMRR noise per detector, the CMRR-noise parameter has to doubled in case of heterodyne detection:

[TABLE]

Therefore we arrive at the final expression

[TABLE]

where $\mu=1$ in case of homodyne detection and $\mu=2$ in case of heterodyne detection.

7 Detection Noise

As derived in Appendix D, the number-difference operator at the output ports of a homodyning beamsplitter is (in SNU) represented as

[TABLE]

with $\theta$ being the phase of the local oscillator. Consider WLOG a measurement of the $q$-quadrature, i.e. $\theta=0$. So the above expression simplifies to

[TABLE]

The variance of this operator is

[TABLE]

where $P_{\text{LO}}$ is the optical local-oscillator power, $\tau$ is the LO’s pulse duration, $h$ represents Planck’s constant and $f$ the optical LO frequency. Since we assume all excess-noise components to be stochastically independent, we can regard the variance caused by detection noise to be independent from other noise sources and therefore express it on its own:

[TABLE]

Now consider a balanced homodyne receiver with a given voltage noise density at its output

[TABLE]

where NEP is the noise-equivalent power (in $\text{W}/\sqrt{\text{Hz}}$), $\rho$ is the responsivity of the PIN diodes (in A/W) and $g$ is the gain factor of the amplifier (in V/A). The unit of the voltage-noise density $u_{\text{det}}$ is therefore $\text{V}/\sqrt{\text{Hz}}$. At a given electronic bandwidth $B$ the receiver’s voltage noise is then

[TABLE]

The excess-noise parameter $\xi$, as it appears in the covariance matrix, refers to an additional variance at the channel output before Bob’s measurement apparatus. So in order to understand how the voltage noise at the receiver’s output will affect the excess noise, we will translate it – walking backwards through the receiver – into a variance $\xi_{\text{det}}$ of the input signal. This is equivalent to a noisy signal with variance $\xi$ being detected by a noiseless receiver. The voltage output $U$ of a balanced receiver is the amplification of the current difference $\Delta I$ of the PIN diodes by the gain factor $g$. So a voltage noise $U_{\text{det}}$ relates to a certain deviation $\delta$ of the current difference:

[TABLE]

The optical-power difference $\Delta P$ at the input of the diodes relates linearly to the current difference $\Delta I$ by the diode’s responsivity $\rho$ and the same goes for their deviations:

[TABLE]

The next step is to translate the deviation of the optical-power difference into a deviation of the photon-number difference:

[TABLE]

Using $V_{\text{det}}(\Delta n)=\delta_{\text{det}}^{2}(\Delta n)$, we obtain

[TABLE]

Equalising the above expression with (7) yields

[TABLE]

which allows us to find the required expression for the detection noise in shot-noise units:

[TABLE]

Since in case of heterodyne detection, there will be two noisy detectors – one at each output of the heterodyning beamsplitter – the measured detection noise does not halve by action of the beamsplitter. Therefore (as explained in Section 6 on the CMRR noise) we get

[TABLE]

This yields the final expression

[TABLE]

where $\mu=1$ ($\mu=2$) for homodyne (heterodyne) detection.

Alternatively, the detection noise can be conveniently expressed in terms of the clearance $C$ which is defined as the ratio of the experimental shot-noise variance and the variance caused by the receiver’s electronic noise:

[TABLE]

The shot-noise variance scales linearly with the optical power of the local oscillator which is, however, confined by the saturation limit of the receiver’s PIN diodes. Experimentally, the numerator of the above equation can be determined by measuring the quadrature variance of the LO when it is mixed with a vacuum input. The denominator is the remaining quadrature variance after the LO is disconnected from the receiver. In shot-noise units we have by definition $V_{0}(\hat{q})=1$ and the above equation becomes

[TABLE]

The detection noise with respect to the clearance is therefore (taking into account the factor $\mu=2$ in case of heterodyne detection)

[TABLE]

8 ADC Quantisation Noise

An incoming signal pulse will be detected and amplified by Bob’s balanced receiver where the voltage at the receiver output will be proportional to the measured quadrature. However, if the output voltage is quantised by an analog-to-digital converter, this ADC will introduce an additional error to the measured signal, therefore contributing to the excess noise $\xi$. Like in the previous chapter on detection noise we will back-transform the ADC noise to the channel output where the noise in the covariance matrix is defined. A given error caused by the ADC is equivalent to a certain voltage noise $\delta U$ at the receiver output, quantised by a noiseless ADC. Reusing the considerations of the previous section, we know that this voltage noise translates into a deviation of the photon number difference of

[TABLE]

where the subscript ADC is meant to indicate the source of the deviation. The variance of the photon number difference in terms of $\delta_{\text{ADC}}$ is then

[TABLE]

Similar to the previous section, we express the variance of the number-difference at the output port of the homodyning BS in terms of the excess-noise parameter we want to find:

[TABLE]

Comparing the above two equations yields

[TABLE]

We assume $V_{\text{ADC}}$ to consist of two parts: the intrinsic ADC voltage noise variance $V_{\text{ADC,intr}}$ and the quantisation error variance $V_{\text{ADC,quant}}$: This allows to reexpress the ADC-caused excess noise as

[TABLE]

In order to derive the quantisation error variance $V_{\text{ADC,quant}}$ consider a continuous random variable $x$ falling into a specific interval $[-q/2,q/2]$. The probability of $x$ being smaller than $-q/2$ or greater than $q/2$ is, trivially, zero. On the other hand, the probability density function for $x$ in the interval $[-q/2,q/2]$ is $1/q$. So the overall probability density function is

[TABLE]

The variance of a random variable is well known:

[TABLE]

where in our case the mean value of $x$ is zero: $\braket{x}=0$. So the variance of a uniformly distributed random variable, quantised in the interval $[-q/2,q/2]$, is

[TABLE]

In the case of a random voltage, quantised by an ADC with full voltage range $R_{U}$ and $n$ bits (hence $2^{n}$ voltage intervals) one single interval is referred to as the least significant bit (LSB) and given by

[TABLE]

Therefore, comparing with (105), we obtain the voltage variance caused by the quantisation of an analog-to-digital converter

[TABLE]

Reinserting into (102) and considering the effect of having $two$ ADCs in case of heterodyne detection (see previous section) yields

[TABLE]

Chapter 9 Experimental Implications

Any experimental implementation of CV-QKD (or DV-QKD for that matter) needs to overcome a number of technological challenges in order to establish a satisfying secure-key rate over a given distance [79]. The fundamental equations and noise models derived in this article allow us to simulate various experimental setups, test specific hardware choices and identify bottlenecks prior to the experiment [37]. In this concluding section we try to obtain an estimate in which way actual experimental parameters influence the performance of a CV-QKD setup.

Ultimately, the secure-key rate is proportional to the symbol rate $f_{\text{sym}}$ times the secret fraction $r$ (i.e. the secure key per transmitted symbol)

[TABLE]

where $r$ is defined as before:

[TABLE]

A natural first approach in the attempt to increase the key rate would be to go to a higher symbol rate. In fact, this is where the compatibility of CV-QKD with the highly advanced and ultrafast telecom technology strikes. State-of-the-art waveform generators, $q/p$-modulators and coherent receivers render symbol rates in the order of magnitude $\sim$10\text{,}\mathrm{G}\mathrm{b}\mathrm{a}\mathrm{u}\mathrm{d}$$ feasible. However, even arbitrarily high symbol rates cannot increase the achievable transmission distance since the amount of symbols per second will have no effect on the secure bits one symbol can carry and therefore cannot compensate for $r=0$. Furthermore, high rates require high-bandwidth detectors which, by (94), will increase the detection noise linearly with the bandwidth $B$. As illustrated below in the present section, the detection noise already makes up the better part of the total noise in a realistic CV-QKD implementation. Therefore, under the strict assumption that the noise generated at the receiver is accessible to Eve, the setup is extremely sensitive to detection noise – and consequently to the increase of bandwidth and symbol rate. On the other hand, when the detection noise is classified as trusted noise, fast and high-bandwidth receivers are less problematic. Experimental implementations of CV-QKD protocols demonstrated symbol rates in the regime of kbaud up to $250\text{\,}\mathrm{M}\mathrm{b}\mathrm{a}\mathrm{u}\mathrm{d}$ [24].

The secret fraction (2) depends on merely four parameters, i.e. the modulation variance (directly related to the mean photon number per symbol), the transmittance, the excess noise and the reconciliation efficiency. Since the modulation variance $V_{\text{mod}}$ is basically variable and can (by optical attenuation) be easily adjusted to the given security requirements, the key parameters that primarily characterise a CV-QKD setup are the transmittance $T$, the excess noise $\xi$ and the reconciliation efficiency $\beta$. Figure 1 illustrates the secure-key rate (i.e. secure key per symbol) with respect to transmittance and noise. As the indicated by Fig. 1(a), lower excess noise allows for higher loss tolerance and therefore longer transmission distances. Accordingly, as depicted by Fig. 1(b), the channel length defines an upper bound on the excess noise beyond which no secure key can be established. For instance, the graph shows that for a channel length of $l=$40\text{,}\mathrm{k}\mathrm{m}$$ the threshold excess noise is lower than one percent of the shot noise which constitutes a considerable experimental challenge. Further investigations of the robustness of CV-QKD under the influence of channel loss and noise can be found in [80, 81].

The excess noise $\xi$ is the figure of merit when it comes to appraising the experimental performance of a CV-QKD setup. It may have multiple origins which are discussed in all detail in Section 8. Figure 2 depicts a representation of the total excess noise $\xi_{\text{tot}}$ corresponding to a typical exemplary setup and the decomposition into its constituents according to our noise models. The pie chart illustrates the dominance of the detection noise $\xi_{\text{det}}$ over the other noise sources. Other significant noise contributors are Raman scattering, caused by classical DWDM channels in the fibre, imperfect phase recovery and the quantisation of the measurement results by analog-to-digital converters. On the other hand, the modulation noise, the relative intensity noise as well as the common-mode-rejection ratio of the detectors have a rather minor effect.

The relative magnitude of the detection noise $\xi_{\text{det}}$ undermines the performance discrepancy depending on whether receiver-related noise sources are classified as trusted or not. Figure 3(a) emphasises to which extent the security assumptions determine the requirements on the balanced detectors: Under the strict assumption that the detection noise contributes to an eavesdropper’s information, a low noise-equivalent power (NEP) is critical in order to establish a non-zero secure key (blue curve, $\text{NEP}<$4\text{,}\mathrm{p}\mathrm{W}\mathrm{/}\sqrt{HZ} for $T=0.1$ and $P_{\text{LO}}=$8\text{\,}\mathrm{m}\mathrm{W}, neglecting all other noise sources). On the other hand, in the trusted-detector scenario the requirements on the NEP are far more relaxed (green curve) since it only influences the SNR but not the Holevo bound. According to our model (94), the detection noise can be mitigated by increasing the local oscillator power. Figure 3(b) indicates the minimal LO power with respect to the NEP under strict assumptions. Most low-noise balanced detectors, however, suffer from the low optical saturation limit of the PIN diodes which confines the LO power to the order of magnitude $\sim$10\text{,}\mathrm{m}\mathrm{W}$$. Attempts to increase the performance of CV-QKD in the untrusted-receiver scenario must primarily go into the direction of decreasing the intrinsic detector noise (NEP) or increasing the saturation limit of the PIN diodes.

The quantisation noise caused by the analog-to-digital (ADC) converter can, under loose security assumptions, also be classified as trusted and therefore not be attributed to Eve. For the pie chart in Fig. 2 we assumed the ADC to have a resolution of $8\text{\,}\mathrm{b}\mathrm{i}\mathrm{t}$. According to our model (108), the quantisation noise is proportional to the inverse of $2^{2n}$ where $n$ is the bit resolution of the ADC. Therefore, increasing $n$ by one bit reduces $\xi_{\text{ADC}}$ by a factor of $4$, increasing $n$ by two bits will improve $\xi_{\text{ADC}}$ by factor of $16$. We conclude that, unlike the detection noise, the quantisation noise does not constitute a serious impediment in practical CV-QKD implementations, even under strict security assumptions. This is also illustrated by Fig. 4(a) where we depict the secret fraction with respect to the ADC’s bit resolution in the untrusted-receiver scenario. The graph shows that even for a lossy channel with $T=0.1$ a six-bit resolution is sufficient to establish a non-zero key.

As one of its main advantages, CV-QKD allows for the integration into existing telecom networks and does not require the deployment of dedicated dark fibres. However, the co-existence of the quantum channel with several wavelength-multiplexed classical channels will be a source of detrimental crosstalk. In particular, Raman scattering caused by the classical channel will increase the channel noise of the CV-QKD transmission. The Raman noise is modelled in Section 5. Figure 4(b) depicts the mutual information, the code rate and the Holevo bound with respect to the spectral Raman-noise density.

Next to the excess noise which originates from various hardware imperfections, efficient software algorithms turn out to be a serious bottleneck in CV-QKD. While imperfect reconciliation $\beta<1$ is detrimental for Alice’s and Bob’s mutual information, it does not affect Eve’s information on the secret key (2). Figure 5 depicts the secret fraction with respect to the reconciliation efficiency for various excess-noise parameters and channel lenghts. Figure 6(a) shows that in the idealised case of $\beta=1$ the modulation variance (and therefore the SNR) can be increased to an arbitrary level since Alice and Bob can use the full mutual information for their key and do not leave any information advantage to Eve.

Using variable optical attenuation the modulation variance $V_{\text{mod}}=2\braket{n}$ can be tuned arbitrarily and optimised to the other characteristic parameters $T$, $\xi$ and $\beta$. The dependence of the optimal modulation variance and its tolerance on the reconciliation efficiency and excess noise are illustrated in Fig. 6.

Acknowledgements

We thank Martin Suda for proofreading and contributing valuable remarks. Moreover, we gratefully acknowledge the time and effort the anonymous reviewers have dedicated to profoundly study and improve this lengthy manuscript. Their recommendations and additional references significantly contributed to the quality, integrity and thoroughness of the final article.

Appendix A Prerequisites on Coherent States

Coherent states $\ket{\alpha}$ are eigenstates of the annihilation operator, hence

[TABLE]

where $\alpha$ is a complex number whose real and imaginary part can be understood as the quadrature components in phase space:

[TABLE]

The ladder operators $\hat{a}$ and $\hat{a}^{\dagger}$ are uniquely defined by their action on a Fock state $\ket{n}$:

[TABLE]

where $\hat{n}$ is the boson-number operator and $n$ is its eigenvalue; and their commutation relations:

[TABLE]

Moreover, from the above relation immediately follows the result

[TABLE]

The ladder operators can be reexpressed in terms of quadrature operators (given in shot-noise units):

[TABLE]

which immediately leads to

[TABLE]

The two quadrature operators then fulfil the commutation relation

[TABLE]

In a coherent state both quadratures carry the same uncertainty (standard deviation), hence the same variance:

[TABLE]

By definition of a coherent state the uncertainty product $\delta\hat{q}\delta\hat{p}$ is minimal. In order to derive the uncertainty of the quadrature operators of a coherent state, we begin with the definition of the variance:

[TABLE]

The expectation value $\braket{\hat{q}}$ can be obtained very quickly:

[TABLE]

To compute the expectation value of the squared operator we proceed similarly:111We can use the result (A) to relate the modulation variance of quadrature operators and components in Gaussian modulated coherent-state CV-QKD. Taking $\braket{\hat{q}^{2}}=4q^{2}+1$ and assuming $q$ to be a realization of a random variable $\mathcal{Q}$ that is distributed as $\mathcal{Q}\sim\mathcal{N}(0,\tilde{V}_{\text{mod}})$, we obtain $\braket{\hat{q}^{2}}=4\braket{\mathcal{Q}^{2}}+1$ or $V(\hat{q})=4\tilde{V}_{\text{mod}}+1$.

[TABLE]

Reinserting (A) and (A) into (10) yields

[TABLE]

which is the minimal uncertainty in shot-noise units, often referred to as shot noise. $V(\hat{p})$ is computed analogously yielding the same result. Thus the uncertainty relation in SNU is given by

[TABLE]

The expectation value of the number operator $\hat{n}$ is

[TABLE]

or in terms of the quadrature operators

[TABLE]

with the expectation value

[TABLE]

Appendix B Prerequisites on Gaussian Quantum Information

1 Displacement Vector and Covariance Matrix

This section summarises, in an eclectic way, the basic theoretic tools required to analyse, interpret and transform Gaussian quantum states. We will restrict ourselves to what is essential for the analysis of continuous-variable QKD. These tools are selected from the arsenal of the Gaussian-quantum-information formalism which is comprehensively described in [67]. In this formalism an $N$-mode Gaussian state is represented by a displacement vector $\mathbf{\hat{x}}$ of dimension $2N$ and a covariance matrix $\Sigma$ of dimension $2N\times 2N$. The displacement vector reads

[TABLE]

and its elements fulfil the commutation relation

[TABLE]

where $\Omega$ is the $2N\times 2N$ matrix

[TABLE]

The elements of the covariance matrix are given by

[TABLE]

Note that along the diagonal we have

[TABLE]

In matrix notation we get

[TABLE]

The covariance matrix describes the mutual correlations of the mode quadratures. If the cross terms $\mathbb{E}(\hat{x}^{j},\hat{x}^{k})$ are zero for the $q$- and $p$-quadratures of two modes, then these two modes are uncorrelated to each other, i.e. separable.

2 Symplectic Operations

Unitary operators in Hilbert-space notation correspond to symplectic operators in the formalism of Gaussian quantum information. An operator, represented by a matrix $S$ is symplectic if the relation

[TABLE]

holds. A symplectic operation transforms a Gaussian state as follows:

[TABLE]

The most important symplectic operator in the realm of this paper is the beamsplitter (BS), represented as

[TABLE]

3 Composite States

In Hilbert-space representation, two states $A$ and $B$ constitute a total state by action of the direct product:

[TABLE]

In Gaussian quantum information two states $A$ and $B$ with $M$ and $N$ modes respectively combine to a displacement vector of dimension $2(M+N)$:

[TABLE]

and the covariance matrix describing the total state will be

[TABLE]

with dimension $2(M+N)\times 2(M+N)$. Reversely, a state Gaussian state is separable if and only if it can be written as a direct sum in the above fashion. Otherwise, if there are non-zero off-diagonal terms in $\Sigma_{\text{tot}}$ between $\Sigma_{A}$ and $\Sigma_{B}$ (like it is the case for a TMSVS) we speak of an entangled state.

4 Von Neumann entropy

The von Neumann entropy of a Gaussian state is described in terms of the symplectic eigenvalues of its covariance matrix. The symplectic eigenvalues of a matrix $\Sigma$ are defined as the modulus of the ordinary eigenvalues of the matrix

[TABLE]

with $\Omega$ defined as in (3). Since only the modulus of the eigenvalues is considered, an $2N\times 2N$ covariance matrix has exactly $N$ symplectic eigenvalues. A Gaussian state with covariance matrix $\Sigma$ has a von Neumann entropy, given by

[TABLE]

with

[TABLE]

and $\nu_{i}$ being the symplectic eigenvalues of $\Sigma$.

5 Partial Measurements

Consider an $N$-mode Gaussian state, described by a covariance matrix of dimension $2N\times 2N$ (two quadratures per mode). A measurement on one mode will modify the Gaussian state of the remaining modes, depending on their correlations to the measured one. Let $B$ be the mode on which a measurement is performed, $A$ be the $N-1$ remaining modes and $C$ the correlations between $B$ and $A$. Then the covariance matrix of the total state before the measurement can be written as:

[TABLE]

where $\Sigma_{A}\in\mathbb{R}^{2(N-1)\times 2(N-1)}$, $\Sigma_{B}\in\mathbb{R}^{2\times 2}$ and $\Sigma_{C}\in\mathbb{R}^{2(N-1)\times 2}$. The impact of a partial measurement of mode $B$ on the covariance matrix of the other ones, $\Sigma_{A}\stackrel{{\scriptstyle B}}{{\longrightarrow}}\Sigma_{A|B}$, depends on whether homodyne or heterodyne measurement is performed, i.e. on whether only one or both of $B$’s quadratures are measured. In case of homodyne detection of $q$ or $p$, a partial measurement of $B$ transforms $A$ as follows:

[TABLE]

where $\Pi_{q}=\operatorname{diag}(1,0)$ (in case $q$ is measured) and $\Pi_{p}=\text{diag}(0,1)$ (in case $p$ is measured). So

[TABLE]

The expression -1 in (17) indicates a pseudoinverse. However, if a matrix is diagonal, as it’s the case for $\Pi\Sigma_{B}\Pi$ (for any $\Sigma_{B}$), the pseudoinverse is just an inversion of the elements: $\operatorname{diag}(a_{1},\dots,a_{n})^{-1}=\operatorname{diag}(a_{1}^{-1},\dots,a_{n}^{-1})$. Using this and (18), we can reexpress (17) in the convenient form

[TABLE]

A heterodyne detection of the mode $B$ will affect the other modes as follows:

[TABLE]

The addition of the unit matrix $\mathbb{1}_{2}$ can be intuitively understood as a portion of shot-noise, added to the variances of $q$ and $p$ through the vacuum input of the balanced beamsplitter. This equation can be nicely derived using only some basic considerations and the relation for a partial homodyne measurement (19): Consider a balanced beamsplitter, splitting the mode $B$ in half in order to allow for a subsequent simultaneous measurement of both quadratures $q$ and $p$. According to the methods described in Appendix 2, this BS transforms the covariance matrix (16) to

[TABLE]

So we added an additional (vacuum) mode to the total system and performed a BS operation, mixing the vacuum mode with the mode $B$. Since $B$ is now split in half, we can perform two homodyne measurements, one on each half of the initial $B$. Say we are measuring the $q$-quadrature on mode $B_{2}$. According to (19), Alice’s mode, conditioned on a homodyne measurement on $B_{2}$, is represented by the covariance matrix

[TABLE]

Now let a second partial measurement take place, i.e. let the quadrature $p$ be measured on the mode $B_{1}$. This will affect the $A$ mode a second time in a similar way:

[TABLE]

Putting the above two equations together, we obtain

[TABLE]

and since $\Sigma_{\beta}=(\Sigma_{B}+\mathbb{1})/2$ and $\Sigma_{\gamma}=\Sigma_{C}/\sqrt{2}$,

[TABLE]

which coincides exactly with (20). When $B$ is a coherent state with $V(\hat{q}_{B})=V_{B}(\hat{p}_{B})\eqcolon V_{B}$, (20) simplifies to

[TABLE]

Appendix C Derivation of the Covariance Matrix

In this chapter we will derive the initial covariance matrix of a two-mode squeezed vacuum state (TMSVS) which is in ket-notation represented as [67]

[TABLE]

The expectation values will be calculated according to

[TABLE]

Some useful relations, helpful at deriving the elements of the covariance matrix, are

[TABLE]

(with $*=A,B$ respectively) due to exclusively orthogonal Fock states in the scalar product. These results turn out useful when we try for example to find the expectation value of the quadrature operators of the TMSVS:

[TABLE]

We quickly make sure the normalisation condition is fulfilled:

[TABLE]

1 Initial Covariance Matrix

A TMSVS is described by a $4\times 4$-matrix $\Sigma$. In the following sections we will derive its 16 components individually.

1 $\Sigma_{11}$, $\Sigma_{22}$, $\Sigma_{33}$, $\Sigma_{44}$

The diagonal terms are given by the variances of the quadrature operators $\hat{q}_{A}$, $\hat{p}_{A}$, $\hat{q}_{B}$ and $\hat{p}_{B}$. The variance of an operator can be expressed in terms of the expectation values of the operator and its square; and the expectation values are computed by reexpressing the quadrature operators in terms of ladder operators:

[TABLE]

In analogous fashion we get $\Sigma_{22}=\Sigma_{33}=\Sigma_{44}=V$.

2 $\Sigma_{12}$, $\Sigma_{21}$, $\Sigma_{34}$, $\Sigma_{43}$

We proceed similarly as in the previous section and compute the required expectation values of the quadrature operators by reexpressing them in terms of creation and annihilation operators:

[TABLE]

with

[TABLE]

Thus we get

[TABLE]

and analogously for $\Sigma_{34}=\Sigma_{43}=0$.

3 $\Sigma_{13}$, $\Sigma_{31}$, $\Sigma_{24}$, $\Sigma_{42}$

[TABLE]

where

[TABLE]

Therefore we obtain

[TABLE]

and analogously

[TABLE]

4 $\Sigma_{14}$, $\Sigma_{41}$, $\Sigma_{32}$, $\Sigma_{23}$

[TABLE]

and similarly $\Sigma_{32}=\Sigma_{23}=0$.

5 Final $\Sigma$

Collecting all the components computed in the previous sections we obtain the final expression for the covariance matrix of a TMSVS:

[TABLE]

2 Channel Transmission

In this section we will investigate how transmission of one TMSVS-mode through a lossy channel will affect the covariance matrix. First we rewrite the covariance matrix of a TMSVS:

[TABLE]

with $v=V\mathbb{1}_{2}$ and $w=\sqrt{V^{2}-1}\sigma_{z}$. The channel loss can be modelled with a beamsplitter of transmittance $T$. In order to take the vacuum input of the beamsplitter into account we add another mode to the covariance matrix. The additional vacuum mode is represented by a $2\times 2$ unit matrix and we integrate it to our total state using direct summation:

[TABLE]

The beamsplitter matrix in symplectic expression is

[TABLE]

with $t=\sqrt{T}\mathbb{1}_{2}$, $r=\sqrt{1-T}\mathbb{1}_{2}$. In order for this matrix to match with the dimensions of our covariance matrix (18), we add a $2\times 2$ unitary representing the action of the BS on Alice’s mode:

[TABLE]

In this expression the beamsplitter act on Bob’s mode and the vacuum input but will leave Alice’s mode unchanged. A Gaussian state, represented by a covariance matrix $\Sigma$, transforms by action of a symplectic operator $S$ according to

[TABLE]

where the prime indicates the state after channel transmission of Bob’s mode. Therefore we obtain

[TABLE]

where Alice’s and Bob’s substate reads

[TABLE]

3 Channel Transmission including Excess Noise

In order to model the insertion of excess noise, we proceed in a similar fashion as in the previous section. But this time the vacuum input of the channel-transmission beamsplitter is exchanged by a noisy input:

[TABLE]

where we assume the quadratures of the noise input $\Sigma_{\text{noise}}$ to carry the same variance $N$. Action of the beamsplitter on the total covariance matrix (TMSVS plus noise input) yields

[TABLE]

So the variance of the quadratures in Bob’s mode reads

[TABLE]

If we define the noise input $N$ as follows:

[TABLE]

we obtain

[TABLE]

which yields the covariance matrix in its final form:

[TABLE]

4 Bob Heterodyning

In order for Bob to measure both quadrature components simultaneously, he needs to insert a balanced beamsplitter to split the signal in half. The second input of the beamsplitter adds an additional vacuum mode to the system:

[TABLE]

A balanced BS acts on Bob’s mode and the vacuum mode, not on Alice; therefore it is described by

[TABLE]

The action of the BS operator on the total state, including Bob’s additional vacuum mode, yields

[TABLE]

Appendix D Quantum Homodyne Detection

This chapter describes the quantum theory of homodyne detection. The derivation is leaning towards [82]. Consider a quantum coherent state with quadrature operators $\hat{q}$ and $\hat{p}$. In shot-noise units its annihilation operator is given by

[TABLE]

Furthermore, consider a classical optical field, represented by

[TABLE]

where the subscript LO stands for local oscillator. Let $\hat{a}$ and $\alpha_{\text{LO}}$ each enter a balanced beamsplitter, represented by

[TABLE]

The action of the beamsplitter on the quantum field $\hat{a}$ and the classical field $\alpha_{\text{LO}}$ yields

[TABLE]

where $\hat{a}_{1}$ and $\hat{a}_{2}$ represent the annihilation operators at the respective output ports of the beamsplitter. The photon-number operators at each output of the BS are easily evaluated by

[TABLE]

Subtraction of the two yields the number-difference operator:

[TABLE]

Substituting (1) and (2) we arrive at

[TABLE]

So depending on the local-oscillator phase $\theta$, the number-difference operator is either proportional to the $\hat{q}$ or $\hat{p}$ quadrature operator:

[TABLE]

Appendix E Principles of a $q/p$-Modulator

In our model, sketched in Figure 1, we assume our modulator to consist of a double Mach-Zehnder interferometer (MZI), hence an MZI with another nested MZI in each arm. The working principle of the modulator can be described by the following steps:

• •

A coherent state $\alpha$ and a vacuum enter the ports of a balanced beamsplitter (BS). The output states are

[TABLE]

and each output corresponds to one arm of the outer MZI.

• •

Each arm of the MZI is again mixed with the vacuum by another balanced BS yielding the state

[TABLE]

where the upper two components correspond two the respective arms of the first inner MZI and the lower two to the second inner MZI.

• •

Now a voltage is applied to the nonlinear waveguides in the four arms of the inner MZI’s. This voltage, by the electro-optic effect, causes a drift of the waveguide’s refractive index, therefore changing the phase to rotate proportionally to the applied voltage. We apply a phase rotation of $+\varphi_{1}$ and $-\varphi_{1}$ respectively to the two arms of the first inner MZI and a phase rotation of $+\varphi_{2}$ and $-\varphi_{2}$ to the arms of the second one:

[TABLE]

• •

The arms of the inner two MZI’s are now combined again using balanced beamsplitters, yielding

[TABLE]

We use only one output port of each beamsplitter, omitting the second and the fourth component of the above state vector. So we are left with

[TABLE]

• •

Now, as the arms of the inner MZI’s are recombined, we add a phase of $\pi/2$ to the second arm of the outer MZI:

[TABLE]

• •

Finally we recombine the two arms of the outer MZI and obtain

[TABLE]

We omit one of the two BS outputs and are left with the final state

[TABLE]

Appendix F SI-, Natural- and Shot-Noise Units

Coherent states can entirely be described in terms of annihilation and creation operators which fulfil the well-known relations listed in Appendix A. However, depending on notational or computational convenience, one is free to define in which way the quadrature operators $\hat{q}$ and $\hat{p}$ are given with respect to the ladder operators. Depending on the definition of choice, one obtains according expressions for the commutator $[\hat{q},\hat{p}]$, the photon number operator $\hat{n}$ and minimal uncertainty product $\delta\hat{q}\delta\hat{p}$. A direct comparison of shot-noise units [67] (SNU, used in this paper), natural units [82] (NU) and SI-units [83] can be found in Table 1.