Department of Physics, Gakushuin University, Toshima, Tokyo 171-8588, Japan
Received January 16, 2017; Accepted July 4, 2017; Published August 10, 2017
We develop a physical model to describe the signal transmission for a continuous-variable quantum key distribution scheme and investigate its security against a couple of eavesdropping attacks assuming that the eavesdropper’s power is partly restricted owing to today’s technological limitations. We consider an eavesdropper performing quantum optical homodyne measurement on the signal obtained by a type of beamsplitting attack. We also consider the case in which the eavesdropper Eve is unable to access a quantum memory and she performs heterodyne measurement on her signal without performing a delayed measurement. Our formulation includes a model in which the receiver’s loss and noise are unaccessible by the eavesdropper. This setup enables us to investigate the condition that Eve uses a practical fiber differently from the usual beamsplitting attack where she can deploy a lossless transmission channel. The secret key rates are calculated in both the direct and reverse reconciliation scenarios.
Quantum key distribution (QKD) provides a possible option to achieve extremely secure communication networks by using a quantum mechanical feature of light.1–3) There has already been considerable research activity owing to its promising reliability and fundamental impact in quantum information science.4,5) Continuous-variable (CV) QKD schemes using coherent states6–12) may make it possible to realize QKD over fiber networks employing relatively accessible optical components available from the telecommunication industry, and potentially offer higher key rates compatible with most practical applications.13–16) There has been general interest in how to incorporate quantum technology in today's well-established technological infrastructure. The demonstration of QKD systems over optical fiber communication networks will be an important step toward the real-life application of quantum information science. Another topical approach is to develop hybrid key distribution schemes that work with other classical communication protocols.17–19)
Although establishing a stronger security statement with fewer physical assumptions is of fundamental importance, there has been practical interest in the availability of secret keys when an adversary's power is restricted owing to today's technology.2,3) Realistic security concerns also arise from various side information possibly available in practical situations.14) In this regard, it would be valuable to consider specific eavesdropping attacks, and investigate how to construct an optimal eavesdropper's attack, upon which one may establish more realistic and reliable assumptions to ensure a reasonable communication rate with a sound security agreement. Notably, it has been observed that security analysis against specific attacks stimulates important modifications of QKD protocols.3,20–24)
In this paper, we develop a transmission model for a CV QKD scheme and calculate the secret key rates assuming specific adversary's attacks.
This paper is organized as follows. In Sect. 2, we introduce our protocol and give a description of physical systems. In Sect. 3, we calculate the probability distribution of canonical quadratures and determine the mutual information. In Sect. 4, we investigate the secret key rates for a couple of different eavesdropper's strategies. Section 5 concludes this paper with remarks.
2. Basic Notions and Physical Model
Protocol
We consider a CV QKD protocol using four coherent states and homodyne detection.8) The sender, Alice, sends one of four coherent states \(|\alpha\rangle\) with \(\alpha =\sqrt{n} e^{ik\pi/2}\) and \(k\in \{0,1,2,3 \}\). The recipient, Bob, measures the position \(\hat{q}\) quadrature or the momentum \(\hat{p}\) quadrature of the light field. We assume the canonical commutation relation \([\hat{q},\hat{p}] = 2i\) and the quadratures can be related to the bosonic field operators \(\hat{a} = (\hat{q} + i\hat{p})/2\), by which the coherent state is defined as the eigenstate \(\hat{a} |\alpha\rangle =\alpha |\alpha\rangle\), and the mean photon number of the coherent state is given by \(n =\langle \alpha|\hat{a}^{\dagger}\hat{a} |\alpha\rangle\). Sifted keys can be obtained when Bob measures the \(\hat{q}\) (\(\hat{p}\)) quadrature for \(k\in \{0,2\}\) (\(k\in \{1,3\}\)) similarly to in the BB84 protocol. To be concrete, we introduce a threshold \(\lambda\geq 0\), and Bob's bit value is determined to be 1 or 0 according to the measured quadrature value \(x\geq \lambda\) or \(x\leq -\lambda\), while the slot is discarded if \(|x| <\lambda\). In our protocol, the bit error rate (BER) is a function of the absolute value of the quadratures \(|x|\). Therefore, a small error rate can be achieved by postselection of an appropriate range of the measured quadratures when the excess noise is small, although it could reduce the effective transmittance. For the error correction process, there are two options called direct reconciliation (DR) and reverse reconciliation (RR).10) In the DR scheme, Bob corrects his bit values so as to agree with Alice's bit sequence, whereas Alice corrects her bit sequence in order to reproduce Bob's sequence in the RR scheme. We will calculate the secret key rates both in the DR and RR scenarios.
In the previous works on this protocol,12,25,26) the length of the key rate for the case of the pure lossy channel was addressed, and it was pointed out that the transmission distance is limited owing to Gaussian excess noise.25,26) A possible modification of this protocol to reduce the probability of the basis mismatch has been reported.12) However, the length of the secret key in the presence of excess noise has not been reported.
Physical model and Eve's attack
The setup we hereafter deal with is shown in Fig. 1(a). The coherent state \(|\alpha\rangle\) of the mode \(\hat{a}_{1}\) propagates through a quantum channel and reaches Bob's homodyne detector. The quantum channel and Bob's detector are characterized by transmittance \(\eta_{i}\in [0,1]\) and excess noise \(\xi_{i}\geq 0\). Here the subscript is \(i=1\) for the quantum channel and \(i=2\) for Bob's detector. It is usual in the security analysis of QKD that all imperfections of the transmission channel and the detector are assumed to be induced by an eavesdropper, Eve, who can use any physically possible operation. This assumption is often called the conservative approach.
Figure 1. Physical model to describe the signal transmission. (a) The coherent state \(|\alpha\rangle\) Alice sends propagates through a symmetric Gaussian quantum channel with transmittance \(\eta_{1}\) and excess noise \(\xi_{1}\). Bob performs a homodyne measurement by a noisy detector with transmittance \(\eta_{2}\) and excess noise \(\xi_{2}\). (b) The beamsplitting attack. Eve emulates the quantum channel by using a phase-insensitive amplifier and a beam splitter. She obtains the information by an ideal homodyne measurement on the outgoing mode \(\hat{a}_{3}\). (c) Bob's non-ideal detector can be modeled by an amplifier followed by a beam splitter.
We consider Eve's attack based on the fact that the action of the quantum channel can be simulated by an action of an amplifier followed by a beamsplitter with vacuum initial modes [see Fig. 1(b)]. She replaces the quantum channel with a lossless fiber, and the channel's output can be mimicked by combining a phase-insensitive amplifier with gain \(g_{1}\) and a beamsplitter with transmittance \(t_{1}\).25,26) The signal field in the mode \(\hat{a}_{1}\) interacts with the mode \(\hat{a}_{2}\) at the amplifier. After this interaction, the signal is partially split into the mode \(\hat{a}_{3}\) at the beamsplitter. In this paper we assume that Eve uses the signal of the mode \(\hat{a}_{3}\) to obtain her information. The parameters \(g_{1}\) and \(t_{1}\) are chosen to reproduce the original behavior of the quantum channel. Thereby, Eve's attack induces no detectable disturbance.
Bob's homodyne detector with transmittance \(\eta_{2}\) and excess noise \(\xi_{2}\) can also be modeled by using a pair comprising an amplifier and a beamsplitter similar to Eve's strategy [Fig. 1(c)]: The mode \(\hat{a}_{1}\) before the detector is amplified by a phase-insensitive amplifier with gain \(g_{2}\), and its amplitude is reduced by the action of the beamsplitter with transmittance \(t_{2}\). At the amplifier and the beamsplitter, the signal field is coupled with the mode \(\hat{a}_{4}\) and the mode \(\hat{a}_{5}\), respectively. After these interactions, Bob performs noiseless and lossless homodyne measurement on the outgoing mode \(\hat{a}_{1}\). The parameters \(g_{2}\) and \(t_{2}\) are determined so as to emulate the actual detector's parameters \((\eta_{2},\xi_{2})\). Note that the amplification parameters \(g_{i}\) and the transmittance of the beamsplitters \(t_{i}\) satisfy \begin{equation} g_{i} \geq 1,\quad t_{i} \in [0,1]. \end{equation} (1) For notational simplicity we may use \begin{equation} g_{i}^{\prime} = g_{i}-1,\quad t_{i}^{\prime} = 1-t_{i}. \end{equation} (2)
Quadrature amplitudes and covariance matrix
In the above setup, all the states and operations are Gaussian, and it is convenient to work with the mean values of the canonical variables and the covariance matrices.27,28) Let us write the canonical variables associated with the modes \(\hat{a}_{i}\) as \(\hat{q}_{i}=\hat{a}_{i}+\hat{a}_{i}^{\dagger}\) and \(\hat{p}_{i}=(\hat{a}_{i}-\hat{a}_{i}^{\dagger})/i\). We collectively define their mean values in a given state \(\hat{\rho}\) by \begin{equation} \bar{\boldsymbol{{x}}} = \text{Tr}(\hat{\rho}\,\hat{\boldsymbol{{x}}}), \end{equation} (3) where \begin{equation} \hat{\boldsymbol{{x}}} = (\hat{x}_{1},\hat{x}_{2},\ldots, \hat{x}_{10})^{T} := (\hat{q}_{1}, \hat{p}_{1},\ldots, \hat{q}_{5}, \hat{p}_{5})^{T}. \end{equation} (4) Note that we hereafter use the bar placed above a letter to denote the mean value, for example, \(\bar{q}_{1}\) is the expectation value of the canonical variable \(\hat{q}_{1}\). The \((j,k)\)-element of the covariance matrix V is given by \begin{equation} V_{jk} = \frac{1}{2}\text{Tr}(\{\Delta \hat{x}_{j}, \Delta \hat{x}_{k}\}\,\hat{\rho}), \end{equation} (5) with \(\{\hat{A},\hat{B}\}=\hat{A}\hat{B}+\hat{B}\hat{A}\) and \begin{equation} \Delta \hat{x}_{j} = \hat{x}_{j}-\bar{x}_{j}. \end{equation} (6) The pair of the mean vector and the covariance matrix \((\bar{\boldsymbol{{x}}},V)\) for the initial state \(|\alpha\rangle|0\rangle^{\otimes 4}\) is determined to be \begin{equation} \bar{\boldsymbol{{x}}}^{\text{in}} = (2\alpha,0,\ldots,0)^{T},\quad V^{\text{in}} = \text{diag}(1,1,\ldots,1). \end{equation} (7) Note that the \((i,i)\)-component of V is the variance of the variable \(\hat{x}_{i}\).
The amplifier \(g_{1}\) acting on the modes \(\hat{a}_{1}\) and \(\hat{a}_{2}\) can be described by the matrix
(8)
which acts on the subspace spanned by \(\{q_{j}, p_{j}\}_{j=1,2}\). Here, \(=\text{diag}(1,1)\) and \(Z=\text{diag}(1,-1)\). The amplifier \(g_{1}\) transforms the mean values and correlation matrix of the initial state as \begin{equation} \bar{\boldsymbol{{x}}}^{\text{in}} \rightarrow A(g_{1})\bar{\boldsymbol{{x}}}^{\text{in}},\quad V^{\text{in}} \rightarrow A(g_{1})V^{\text{in}}A(g_{1})^{T}. \end{equation} (9) Here and hereafter we omit the identity operator on the matrices describing the two-mode coupling interactions. Similar to the amplifier, the beam splitter \(t_{1}\) acting on the modes \(\hat{a}_{1}\) and \(\hat{a}_{3}\) can be described by the matrix
(10)
which acts on the subspace spanned by \(\{q_{i},p_{i}\}_{i=1,3}\). Thus, the pair \((\bar{\boldsymbol{{x}}}, V)\) after the channel's action is written as \begin{align} \bar{\boldsymbol{{x}}}^{\text{mid}} &= B(t_{1})A(g_{1})\bar{\boldsymbol{{x}}}^{\text{in}}\notag\\ &= 2\alpha(\sqrt{g_{1}t_{1}},0,\sqrt{g_{1}^{\prime}},0,-\sqrt{g_{1}t_{1}^{\prime}},0,\ldots,0)^{T} \end{align} (11) and
(12)
We can also write the pair \((\bar{\boldsymbol{{x}}}, V)\) after the beam splitter \(t_{2}\) as \begin{equation} \bar{\boldsymbol{{x}}}^{\text{out}} = 2\alpha(\sqrt{g_{1}t_{1}g_{2}t_{2}},0,\sqrt{g_{1}^{\prime}},0,-\sqrt{g_{1}t_{1}^{\prime}},0,\sqrt{g_{1}t_{1}g_{2}^{\prime}},0,-\sqrt{g_{1}t_{1}g_{2}t_{2}^{\prime}},0)^{T} \end{equation} (13) and
For Gaussian states, quadrature distributions are readily determined once the Wigner function is known. From the mean vector \(\bar{\boldsymbol{{x}}}\) and the covariance matrix V, the Wigner function of the Gaussian state is given by28) \begin{equation} W(\boldsymbol{{x}}) = \frac{1}{(2 \pi)^{m} \sqrt{\det V}} e^{-\frac{1}{2} (\boldsymbol{{x}}-\bar{\boldsymbol{{x}}})^{T} V^{-1} (\boldsymbol{{x}}-\bar{\boldsymbol{{x}}})}, \end{equation} (16) where m is the total number of the optical modes. Since the pair comprising the mean vector and the covariance matrix for a subsystem can be simply determined by taking the corresponding elements from the pair \((\bar{\boldsymbol{{x}}},V)\), we can use Eq. (16) to determine the Wigner function of subsystems.
Now, let us determine the relation between the interaction parameters \((g_{i},t_{i})\) and the parameters of the channel and detector \((\eta_{i},\xi_{i})\). Recall that the transmittance is defined by the square of the ratio between the expectation values of the annihilation operator for the input state and the output state. This implies the following condition: \begin{equation} \left| \frac{\bar{x}_{1}^{\text{mid}}+i\bar{x}_{2}^{\text{mid}}}{\bar{x}_{1}^{\text{in}}+i\bar{x}_{2}^{\text{in}}} \right| = \sqrt{\eta_{1}}. \end{equation} (17) The excess noises \(\xi_{i}\) can be defined as the ratio between the variance for the input states and the output states. From this condition, we have \begin{equation} \frac{V^{\text{mid}}_{11}}{V^{\text{in}}_{11}} = 1+\xi_{1}. \end{equation} (18) Solving Eqs. (17) and (18) for \(g_{1}\) and \(t_{1}\) with the help of Eqs. (2), (7), (11), and (12), we obtain \begin{equation} t_{1} = \eta_{1}-\frac{\xi_{1}}{2},\quad g_{1} = \frac{\eta_{1}}{t_{1}}. \end{equation} (19) Similarly, \(g_{2}\) and \(t_{2}\) are determined by \(\eta_{2}\) and \(\xi_{2}\) as \begin{equation} t_{2} = \eta_{2}-\frac{\xi_{2}}{2},\quad g_{2} = \frac{\eta_{2}}{t_{2}}. \end{equation} (20) Note that from the first component of \(\bar{\boldsymbol{{x}}}^{\text{out}}\) in Eq. (13), the net transmittance observed by Bob can be written as \begin{equation} \eta_{\text{tot}} = \eta_{1}\eta_{2}. \end{equation} (21) On the other hand, from the first diagonal element of Eq. (14) [\(v_{11}\) of Eq. (15)], the net excess noise observed by Bob is given by \begin{equation} \xi_{\text{tot}} = \xi_{1} \eta_{2} + \xi_{2}. \end{equation} (22) The expressions in Eqs. (21) and (22) are consistent with the composition rule of Gaussian channels (see, Sect. III of Ref. 29). In practical situations, we may associate the transmission of the detector \(\eta_{2}\) with the product of the quantum efficiency of the detector \(\eta_{\text{eff}}\) and the other coupling efficiency \(\eta_{C}\) as \begin{equation} \eta_{2} = \eta_{C}\eta_{\text{eff}}. \end{equation} (23) In the conservative approach, all observed loss and noises are assumed to be induced by the channel, and Bob's detector is assumed to be an ideal one. To be concrete, we set the condition \((\eta_{2},\xi_{2}) =(1,0)\) for the conservative scenario. This implies \begin{equation} (\eta_{\text{tot}},\xi_{\text{tot}}) = (\eta_{1}, \xi_{1}). \end{equation} (24) In principle, one can measure the channel's parameters \((\eta_{1},\xi_{1})\) and the detector's parameters \((\eta_{2},\xi_{2})\) separately. Therefore, we can avoid an unnecessary overassessment that the detector's noise is controlled by Eve.
Supposing that Eve has a quantum memory, she can measure the mode \(\hat{a}_{3}\) on the correct quadrature basis by delaying her measurement until Bob announces his measurement basis. On the other hand, it is difficult to demonstrate a quantum memory with a long coherence time and quality comparable to currently used classical memories. In this regard, it is interesting to study possible effects on the security of QKD when Eve is unable to access a perfect quantum memory.30) In such a case, Eve's information could be substantially limited because she has to measure her signal before she knows the basis information. Her possible eavesdropping strategy is to monitor both the quadratures simultaneously so that she can observe some signal independent of Bob's measurement basis. A simple model for this can be described by considering a type of simultaneous measurement31) as in Fig. 2.
Figure 2. When Eve is unable to access a quantum memory, she may further split the output signal in the mode \(\hat{a}_{3}\) of Fig. 1(c) by a \(50:50\) beamsplitter and measure one half to monitor the \(\hat{q}\) quadrature and the other half to monitor the \(\hat{p}\) quadrature.
Let us introduce another mode \(\hat{a}_{6}\) with quadrature \((\hat{x}_{11},\hat{x}_{12})\) and a \(50:50\) beamspliter, so that Eve's signal is equally split into the modes \(\hat{a}_{3}\) and \(\hat{a}_{6}\), where the initial state of the mode \(\hat{a}_{6}\) is a vacuum. The mean quadrature values for the three modes \((\hat{a}_{1},\hat{a}_{3},\hat{a}_{6})\) in the setup of Fig. 2 can be written as
(25)
where in the second line we use the subvector of \(\bar{\boldsymbol{{x}}}^{\text{out}}\) of Eq. (13) and \(B(1/2)\) is associated with the \(50:50\) beamsplitter acting on the pair of the modes \((\hat{a}_{3},\hat{a}_{6})\), and its expression is given by Eq. (10). Another essential element for the following analysis is the covariance matrix for the three modes \((\hat{a}_{1},\hat{a}_{3},\hat{a}_{6})\) given by
(26)
3. Quadrature Correlations and Mutual Information
In this section we calculate quadrature distributions over sets of quantum modes, and determine the mutual information between Alice, Bob, and Eve. These information quantities are essentially determined by the BERs of binary symmetric channels. Owing to the symmetry of the protocol, we consider the case where the binary signal is associated with real quadratures, i.e., \(\alpha =\pm \sqrt{n}\), without loss of generality.
In Sect. 3.1, we present a formula for the mutual information between Alice and Bob, \(I_{\text{AB}}\). After that we estimate Eve's knowledge for four different scenarios, denoted by \(I_{\text{AE}}\), \(\tilde{I}_{\text{AE}}\), \(I_{\text{BE}}\), and \(I_{\text{BE}}^{\prime}\). In Sects. 3.2 and 3.3, we assume that Eve has a quantum memory which can retain the mode \(\hat{a}_{3}\) until she gets the announcement of Bob's measurement basis, \(\hat{q}\) or \(\hat{p}\), so that she can measure the correct quadrature using her homodyne detector. In Sects. 3.4 and 3.5, we assume that she is unable to use a good quantum memory to delay her measurement, and executes heterodyne (double homodyne) measurement on the modes \(\hat{a}_{3}\) and \(\hat{a}_{6}\) under the setup of Fig. 2. Although she can monitor both quadratures, one of them is irrelevant to Alice's displacement of the coherent state, and Eve observes relatively small amplitude modulation compared with the case that she can access a perfect quantum memory.
Mutual information between Alice and Bob
Let us derive the formula for the mutual information between Alice and Bob, \(I_{\text{AB}}\). In order to do this we first construct the Wigner function with respect to the mode \(\hat{a}_{1}\) for the input coherent state \(|\alpha\rangle\). Then, we find the quadrature distribution of Bob. From this distribution, we can readily calculate the BER between Alice and Bob. Finally, this rate determines the form of \(I_{\text{AB}}\).
At the output instance in Eqs. (13) and (14) for the input state \(|\alpha\rangle\), the mean vector and the covariance matrix for the mode \(\hat{a}_{1}\) are given as \begin{equation} \bar{\boldsymbol{{y}}} = (\bar{x}_{1},\bar{x}_{2})^{T} = 2\alpha(\sqrt{g_{1}t_{1}g_{2}t_{2}},0)^{T} \end{equation} (27) and
(28)
By using the relation in Eq. (16) with \(m=1\), we obtain the Wigner function
(29)
Integrating \(W_{\bar{\boldsymbol{{y}}}}\) over the variable \(x_{2}\), we obtain the probability distribution conditioned on α: \begin{equation} p(x_{1}|\alpha) = \frac{1}{\sqrt{2\pi v_{11}}}\exp\left[-\frac{(x_{1}-2\alpha\sqrt{g_{1}t_{1}g_{2}t_{2}})^{2}}{2v_{11}}\right], \end{equation} (30) where \(v_{11}\) is given in Eq. (15) and the quantities for the amplifiers and the beamsplitters \((g_{i},t_{i})_{i\in\{1,2\}}\) can be expressed in terms of \((\eta_{i},\xi_{i})_{i\in\{1,2\}}\) with the help of Eqs. (2), (19), and (20). The expression in Eq. (30) immediately leads to \begin{equation} p(x_{1}|\alpha) = p(-x_{1}|-\alpha),\quad p(x_{1}|-\alpha) = p(-x_{1}|\alpha). \end{equation} (31) This shows that the process we are considering can be seen as a binary symmetric channel, when \(x_{1}\) is fixed [see Fig. 3(a)]. Since the BER for the fixed \(x_{1}>0\) is \begin{equation} q = \frac{p(-x_{1}|\alpha)}{p(x_{1}|\alpha)+p(-x_{1}|\alpha)} = \frac{1}{1+e^{4x_{1}\alpha\sqrt{g_{1}t_{1}g_{2}t_{2}}/v_{11}}}, \end{equation} (32) we obtain the mutual information between Alice and Bob for outcome \(x_{1}\) as \(1- h(q)\), where \begin{equation} h(x) = - x \log_{2} x -(1-x) \log_{2} (1-x) \end{equation} (33) is the binary entropy function. For later convenience, we define \begin{equation} I_{\text{AB}}(x_{1}) = 1 - f h(q), \end{equation} (34) where \(f\geq 1\) is the efficiency of error correction. The total mutual information between Alice and Bob with the postselection threshold \(\lambda\geq 0\) can be calculated from the average of \(I_{\text{AB}}(x_{1})\) over \(x_{1}\): \begin{equation} I_{\text{AB}} = \frac{1}{2}\int_{|x_{1}|\geq\lambda} dx_{1}\,p(x_{1})I_{\text{AB}}(x_{1}), \end{equation} (35) where the factor 1/2 is the probability that Alice and Bob used the correct basis and \begin{equation} p(x_{1}) = \frac{p(x_{1}|\alpha)+p(x_{1}|-\alpha)}{2} \end{equation} (36) is the probability that Bob's measurement outcome is \(x_{1}\).
Figure 3. The bit correlation can be characterized by binary symmetric channels for Alice and Bob (a) as well as for Alice and Eve (b). (c) Conditioned on Bob's outcome \(x =\pm x_{1}\), there are essentially four possible processes that determine Alice and Eve's bit correlation.
Mutual information between Alice and Eve when Eve has a quantum memory
Let us determine the mutual information between Alice and Eve. Similar to the case of \(I_{\text{AB}}\), we can understand the physical process based on a binary symmetric channel with the BER r as in Fig. 3(b). Furthermore we can consider that the signal transmission is composed of four paths of the process associated with the Bob's measurement outcome \(x_{1}\) as in Fig. 3(c). Hence, we can determine the BER r by considering the probabilities of the paths.
Suppose that Eve's measurement outcome of her homodyne measurement is \(x_{5}\). When the slot is postselected, Bob announces the absolute value \(|x_{1}|\) of his outcome. This does not reveal his bit information since it is determined by the sign of the measured value. Eve determines her bit value from the sign of her measurement outcome. She assigns her bit value depending on whether \(x_{5}\in [0,\infty)\) or \(x_{5}\in (-\infty, 0)\). Recalling that she can correctly read the bit information when \(x_{5}\) is negative for Alice's preparation \(\alpha > 0\) (this is because the beam splitter transformation induces a minus sign for her quadrature), her BER can be written as \begin{align} r(|x_{1}|) &= \frac{\displaystyle\int_{0}^{\infty} p(x_{5}|\alpha,|x_{1}|)\,dx_{5}}{\displaystyle\int_{0}^{\infty} (p(x_{5}|\alpha,|x_{1}|)+p(x_{5}|-\alpha,|x_{1}|))\,dx_{5}}\notag\\ &= \frac{\displaystyle\int_{0}^{\infty} (p(x_{1}, x_{5}|\alpha) + p(- x_{1}, x_{5}|\alpha))\,dx_{5}}{\displaystyle\int_{-\infty}^{\infty} (p(x_{1}, x_{5}|\alpha) + p(- x_{1}, x_{5}|\alpha))\,dx_{5}}, \end{align} (37) where the conditional probability distribution \(p(x_{1}, x_{5}|\alpha)\) will be determined later in Eq. (45). The final expression in Eq. (37) can be associated with the portion that Alice's \(|\alpha\rangle\) results in Eve's positive quadrature value in the four possible paths in Fig. 3(c). Then, we may write the mutual information between Alice and Eve for the given \(|x_{1}|\) as \begin{equation} I_{\text{AE}}(|x_{1}|) = 1 - h(r(|x_{1}|)), \end{equation} (38) where \(h(x)\) is given in Eq. (33). Integration of \(I_{\text{AE}}(x_{5})\) multiplied by the probability that Alice's and Bob's measurement bases coincide gives the total mutual information: \begin{equation} I_{\text{AE}} = \frac{1}{2}\int_{|x_{1}|\geq \lambda} dx_{1}\,p(x_{1})I_{\text{AE}}(|x_{1}|), \end{equation} (39) where λ is a postselection threshold and the prior distribution \(p(x_{1})\) is given in Eq. (36).
In order to determine the conditional probability distribution in Eq. (37), we use the Wigner function of the modes \((\hat{a}_{1},\hat{a}_{3})\). Let \(\boldsymbol{{z}}=(x_{1},x_{2},x_{5},x_{6})^{T}\) and take a subvector of the mean-value vector \(\bar{\boldsymbol{{x}}}^{\text{out}}\) in Eq. (13) as \begin{equation} \bar{\boldsymbol{{z}}} = (\bar{x}_{1}, \bar{x}_{2}, \bar{x}_{5}, \bar{x}_{6})^{T} = 2\alpha(\sqrt{g_{1}t_{1}g_{2}t_{2}},0,-\sqrt{g_{1}t_{1}^{\prime}},0)^{T}. \end{equation} (40) Let us define a submatrix of \(V^{\text{out}}\) in Eq. (14) as
(41)
This implies \begin{equation} \det N = (v_{11}v_{33}-v_{13}^{2})^{2} \end{equation} (42) and
(43)
Using Eqs. (16), (40), (42), and (43), the Wigner function of the modes \((\hat{a}_{1},\hat{a}_{3})\) is given by \begin{equation} W_{\bar{\boldsymbol{{z}}}}(\boldsymbol{{z}}) = \frac{\exp[-(1/2)(\boldsymbol{{z}}-\bar{\boldsymbol{{z}}})^{T}N^{-1}(\boldsymbol{{z}}-\bar{\boldsymbol{{z}}})]}{(2\pi)^{2}\sqrt{\det N}}. \end{equation} (44) Thus, the joint quadrature distribution between Bob and Eve conditioned on the input \(|\alpha\rangle\) can be written as \begin{equation} p(x_{1},x_{5}| \alpha) = \iint_{\mathbb{R}^{2}} W_{\bar{\boldsymbol{{z}}}}(\boldsymbol{{z}})\,dx_{2}\,dx_{6}. \end{equation} (45) From this expression, we can determine the BER r of Eq. (37) and hence the mutual information \(I_{\text{AE}}\) of Eq. (39).
Mutual information between Bob and Eve when Eve has a quantum memory
We proceed to the evaluation of the mutual information between Bob and Eve, which is responsible for the key rate in the case of the RR schemes. From the Wigner distribution in Eq. (44), the joint quadrature distribution between Bob and Eve can be written as \begin{equation} p(x_{1},x_{5}) = \frac{1}{2}\iint_{\mathbb{R}^{2}}(W_{\bar{\boldsymbol{{z}}}}(\boldsymbol{{z}}) +W_{-\bar{\boldsymbol{{z}}}}(\boldsymbol{{z}}))\,dx_{2}\,dx_{6}. \end{equation} (46)
Given the absolute value of Bob's quadrature \(|x_{1}|\), the correlation between Bob and Eve can be characterized by a binary symmetric channel with error probability \begin{equation} r (x_{1}) = \frac{\displaystyle\int_{0}^{\infty} p(x_{1},x_{5})\,dx_{5}}{\displaystyle\int_{-\infty}^{\infty} p(x_{1},x_{5})\,dx_{5}}. \end{equation} (47) This implies that the mutual information between Bob and Eve for Bob's outcome \(x =\pm x_{1}\) is \begin{equation} I_{\text{BE}}(x_{1}) = 1 - h (r(x_{1})), \end{equation} (48) where the binary entropy function \(h(x)\) is defined in Eq. (33). The total mutual information between Bob and Eve with the postselection threshold \(\lambda>0\) is the average of \(I_{\text{BE}}(x_{1})\) over \(x_{1}\): \begin{equation} I_{\text{BE}} = \frac{1}{2}\int_{|x_{1}|\geq\lambda}dx_{1}\,p(x_{1})I_{\text{BE}}(x_{1}), \end{equation} (49) where \(p(x_{1})\) is given in Eq. (36).
Mutual information between Alice and Eve assuming Eve is heterodyning
Suppose that Eve does not have a quantum memory, and executes heterodyne measurement as in Fig. 2. Suppose that Eve measures \(\hat{q}\) for the mode \(\hat{a}_{3}\) and \(\hat{p}\) for the mode \(\hat{a}_{6}\). When Alice sends \(\alpha =\pm \sqrt{n}\), the \(\hat{p}\) quadrature conveys no signal information and Eve will use her measurement result on the mode \(\hat{a}_{3}\). Hence, relevant mutual information can be determined by the joint state of the modes \(\hat{a}_{1}\) and \(\hat{a}_{3}\). From Eqs. (26) and (25), the covariance matrix and mean values of the modes \(\hat{a}_{1}\) and \(\hat{a}_{3}\) are respectively given by
(50)
and \begin{align} \bar{\boldsymbol{{z}}}^{\prime} &= (\bar{x}_{1}, \bar{x}_{2}, \bar{x}_{5}, \bar{x}_{6})^{T} \notag\\ &= 2\alpha(\sqrt{g_{1}t_{1}g_{2}t_{2}},0,-\sqrt{g_{1}t_{1}^{\prime}/2},0)^{T}. \end{align} (51) This implies the Wigner function \begin{equation} W_{\bar{\boldsymbol{{z}}}}^{(h)}(\boldsymbol{{z}}) = \frac{\exp[-(1/2)(\boldsymbol{{z}}-\bar{\boldsymbol{{z}}}^{\prime})^{T}{N^{\prime}}^{-1}(\boldsymbol{{z}}-\bar{\boldsymbol{{z}}}^{\prime})]}{(2\pi)^{2}\sqrt{\det N^{\prime}}}, \end{equation} (52) where we use the relation in Eq. (16).
From this Wigner function, we can determine the joint quadrature distribution by straightforwardly reusing the relation in Eq. (45), namely, the joint distribution between Bob and Eve conditioned on the input \(|\alpha\rangle\) becomes \begin{equation} \tilde{p}(x_{1},x_{5}| \alpha) = \iint_{\mathbb{R}^{2}} W_{\bar{\boldsymbol{{z}}}}^{(h)}(\boldsymbol{{z}})\,dx_{2}\,dx_{6}. \end{equation} (53) Then, we can find the mutual information between Alice and Eve by repeating the flow of Eqs. (37), (38), and (39). To be concrete, instead of Eq. (37) we have \begin{equation} \tilde{r}(|x_{1}|) = \frac{\displaystyle\int_{0}^{\infty} (\tilde{p}(x_{1}, x_{5}|\alpha) + \tilde{p}(- x_{1}, x_{5}|\alpha))\,dx_{5}}{\displaystyle\int_{-\infty}^{\infty} (\tilde{p}(x_{1}, x_{5}|\alpha) + \tilde{p}(- x_{1}, x_{5}|\alpha))\,dx_{5}}. \end{equation} (54) Then, similarly to Eqs. (38) and (39), we obtain the total mutual information in the following form: \begin{equation} \tilde{I}_{\text{AE}} = \frac{1}{2}\int_{|x_{1}|\geq \lambda} dx_{1}\,p(x_{1})(1- h(\tilde{r}(|x_{1}|))), \end{equation} (55) where λ is a postselection threshold and the prior distribution \(p(x_{1})\) is given in Eq. (36).
Mutual information between Bob and Eve assuming Eve is heterodyning
Let us determine the mutual information between Bob and Eve in the case Eve is heterodyning. We can essentially repeat the argument in Sect. 3.3 with the Wigner function given in Eq. (52). Similar to Eq. (46), the joint quadrature distribution can be written as \begin{equation} p^{\prime}(x_{1},x_{5}) = \frac{1}{2}\iint_{\mathbb{R}^{2}}(W_{\bar{\boldsymbol{{z}}}}^{(h)}(\boldsymbol{{z}}) +W_{-\bar{\boldsymbol{{z}}}}^{(h)}(\boldsymbol{{z}}))\,dx_{2}\,dx_{6}, \end{equation} (56) where \(W_{\bar{\boldsymbol{{z}}}}^{(h)}\) is given in Eq. (52) with \(N^{\prime}\) and \(\bar{\boldsymbol{{z}}}^{\prime}\) in Eqs. (50) and (51).
Given the absolute value of Bob's quadrature \(|x_{1}|\), the correlation between Bob and Eve can be characterized by a binary symmetric channel with error probability \begin{align} r^{\prime}(x_{1}) &= \frac{\displaystyle\int_{0}^{\infty} p^{\prime}(x_{1},x_{5})\,dx_{5}}{\displaystyle\int_{0}^{\infty} (p^{\prime}(x_{1},x_{5})+p^{\prime}(-x_{1},x_{5}))\,dx_{5}}\notag\\ &= \frac{\displaystyle\int_{0}^{\infty} p^{\prime}(x_{1},x_{5})\,dx_{5}}{\displaystyle\int_{-\infty}^{\infty} p^{\prime}(x_{1},x_{5})\,dx_{5}}. \end{align} (57) Therefore, the mutual information between Bob and Eve for Bob's outcome \(x =\pm x_{1}\) is \begin{equation} I_{\text{BE}}^{\prime}(x_{1}) = 1 - h (r^{\prime}(x_{1})), \end{equation} (58) where the binary entropy function \(h(x)\) is given in Eq. (33). The total mutual information between Alice and Bob with the postselection threshold \(\lambda>0\) is the average of \(I_{\text{BE}}^{\prime} (x_{1})\) over \(x_{1}\): \begin{equation} I_{\text{BE}}^{\prime} = \frac{1}{2}\int_{|x_{1}|\geq\lambda} dx_{1}\,p(x_{1})I_{\text{BE}}(x_{1}), \end{equation} (59) where \(p(x_{1})\) is given in Eq. (36).
4. Secret Key Rates
In this section we show the secret key rates based on the mutual information derived in the previous section. We argue that if Eve cannot access a perfect quantum memory, she is also unable to access a lossless optical fiber. Then, we show key rates given that Eve's attack is based on a realistic optical fiber.
Ideal detector
For the DR schemes, the key rate is given by \begin{equation} R^{\text{(DR)}} = \begin{cases} I_{\text{AB}} - I_{\text{AE}} &\text{for Eve's homodyne}\\ I_{\text{AB}} - \tilde{I}_{\text{AE}} &\text{for Eve's heterodyne}\end{cases}, \end{equation} (60) where \(I_{\text{AB}}\) is the information quantity for Alice and Bob given in Eq. (35). Moreover, \(I_{\text{AE}}\) and \(\tilde{I}_{\text{AE}}\) are the mutual information between Alice and Eve given in Eqs. (39) and (55), respectively.
On the other hand, the key rate for the RR schemes is given by \begin{equation} R^{\text{(RR)}} = \begin{cases} I_{\text{AB}} - I_{\text{BE}} &\text{for Eve's homodyne}\\ I_{\text{AB}} - I_{\text{BE}}^{\prime} &\text{for Eve's heterodyne}\end{cases}, \end{equation} (61) where \(I_{\text{BE}}\) and \(I_{\text{BE}}^{\prime}\) are the mutual information between Bob and Eve given in Eq. (49) and Eq. (59), respectively.
Figure 4 shows key rates \(R^{\text{(DR)}}\) and \(R^{\text{(RR)}}\) for the photon number \(n= |\alpha |^{2} =1.0\) in the cases of both Eve's homodyne measurement and her heterodyne measurement with the perfect detector \((\eta_{2},\xi_{2}) =(1,0)\). We can see that the RR schemes typically give better key rates than the DR schemes. In particular, the key rates for the RR schemes are shown to be substantially higher than those for the DR schemes for \(l\geq 50\) km. In order to determine the key rates \(R^{\text{(DR)}}\) and \(R^{\text{(RR)}}\) numerically, we need to assign a couple of parameters. We set the error correction efficiency \(f =1.08\) in \(I_{\text{AB}}\) of Eq. (35), which is based on the working error correction scheme in Ref. 19. The threshold λ was determined to maximize the key rates for each scenario. This means that the regime to be integrated is \(\{x | I_{\text{AB}}(x)- I_{\text{AE}}(x)\geq 0 \}\) for the DR schemes, and \(\{x | I_{\text{AB}}(x)- I_{\text{BE}}(x)\geq 0 \}\) for the RR scheme, for instances. The transmission loss is set to \(\gamma_{1} = 0.2\) dB/km. The distance l in the unit of km is related to the transmittance as \(\eta_{1} = 10^{-\gamma_{1} l/10}\). In the case of the ideal detector, \((\eta_{2},\xi_{2})= (1,0)\), the total transmittance \(\eta_{\text{tot}}\) in Eq. (21) and the total excess noise \(\xi_{\text{tot}}\) in Eq. (22) are given by Eq. (24). As we have already mentioned, this corresponds to the conservative scenario in our setup in the sense that the actual loss and noise of the detector are utilized to increase Eve's signal. In principle, we can determine the channel's parameter and detector's parameter, independently, and the detector's side can be decoupled with Eve's strategy.
Figure 4. (Color online) Key rates \(R^{\text{(DR)}}\) in Eq. (60) and \(R^{\text{(RR)}}\) in Eq. (61) for the mean photon number \(n= |\alpha |^{2}=1.0\) are shown as functions of the transmission distance for the four different setups of Sects. 3.2, 3.3, 3.4, and 3.5. Squares represent the key rates for the reverse reconciliation (RR) scheme with Eve's Heterodyne measurement. Circles represent the key rates for the RR scheme with Eve's homodyne measurement. Triangles represent the key rates for the direct reconciliation (DR) scheme with Eve's heterodyne measurement. Diamonds represent the key rates for the DR scheme with Eve's homodyne measurement. The transmission loss is set to \(\gamma_{1} = 0.2\) dB/km. The distance l in the unit of km is related to the channel's transmittance \(\eta_{1}\) as \(\eta_{1} = 10^{-\gamma_{1} l/10}\). The other parameters are set to be \(\xi_{1}=0.001\), \(\eta_{2}=1\), \(\xi_{2}=0\), and \(f =1.08\). We can observe that the RR schemes typically give better key rates than the DR schemes for the transmission distance \(l\geq 50\) km.
As in the literature,25,32,33) one can optimize the mean photon number \(n = |\alpha |^{2}\) so as to maximize the key rate for each distance. Figure 5 shows optimized key rates for the excess noise \(\xi_{1} =0.01\) and the optimal photon number for the four different scenarios. As an optimization, the key rates \(R^{\text{(DR)}}\) and \(R^{\text{(RR)}}\) are calculated by tweaking the mean photon number n by steps of 0.05 or 0.025 for a given set of transmission distances. Then, the maximum of the key rates and the optimal photon number are determined numerically. Figure 6 shows optimized key rates for the excess noise \(\xi_{1} =0.1\) and the optimal mean photon number for the four different scenarios. We can see that RR schemes are more stable under an increase in the excess noise and are thought to be valuable for long-distance QKD. In addition, Fig. 6(c) shows the mutual information between Alice and Eve with the mean photon number \(|\alpha |^{2}= 1.0\) and with a BER of 0.03 for the DR scheme, i.e., \(I_{\text{AE}}\) in Eq. (60).
Figure 5. (Color online) (a) The key rates \(R^{\text{(DR)}}\) in Eq. (60) and \(R^{\text{(RR)}}\) in Eq. (61) are maximized with regard to the mean photon number \(n = |\alpha |^{2}\) for each distance given that the excess noise is \(\xi_{1} =0.01\). (b) The optimal mean photon number that maximizes the key rates.
Figure 6. (Color online) (a) The key rates \(R^{\text{(DR)}}\) in Eq. (60) and \(R^{\text{(RR)}}\) in Eq. (61) are maximized with regards to the mean photon number \(n = |\alpha |^{2}\) for each distance given that the excess noise is \(\xi_{1} =0.1\). (b) The optimal mean photon number that maximizes the key rates. (c) The mutual information between Alice and Eve with the mean photon number \(|\alpha |^{2} =1.0\) and with the BER 0.03 for the DR scheme.
Realistic beamsplitting attacks
Thus far, we have assumed that Eve has lossless optical fibers and is able to replace the transmission channel so that she can obtain the portion of the signal corresponding to the net channel loss. Similar to the possible limitation that quantum memories are unavailable for Eve, it may be plausible to assume that Eve is unable to deploy a lossless fiber. In fact, if one has a lossless fiber, one can demonstrate a perfect quantum memory for light by using a lossless loop to store an optical signal. Suppose that Eve is unable to use a lossless fiber but she can use a good optical fiber, for instance, the transmission loss is \(\gamma_{2}=0.15\) dB/km.34,35) For the transmission distance l, this implies the transmittance \(\eta_{s} = 10^{-\gamma_{2} l/10}\), and Eve can gain the portion \(P_{\text{Eve}}=10^{(\gamma_{2} -\gamma_{1})l/10}\) by using this fiber instead of the original fiber with transmission loss \(\gamma_{1}\). This situation can be described by inserting a pure loss channel with transmittance \(\eta_{s}\) between the channel and the detector in Fig. 1(a). This setup results in the following transformation: \begin{equation} (\eta_{1}, \xi_{1},\eta_{2}) \to (\eta_{1}/\eta_{s}, \xi_{1}/\eta_{s}, \eta_{s} \eta_{2}). \end{equation} (62) Note that the net transmittance \(\eta_{\text{tot}}\) and the net excess noise \(\xi_{\text{tot}}\) in Eqs. (21) and (22) are invariant under this transformation. Consequently, we can investigate the key rate taking Eve's practical fiber loss into account based on the replacement in Eq. (62).
Figure 7 shows key rates calculated for the excess noises \(\xi_{1} =\xi_{2}= 0.01\), a practical detector efficiency of \(\eta_{2} =\eta_{C}\eta_{\text{eff}}=0.7\), and \(\eta_{s} = 10^{-\gamma_{2} l/10}\) based on the transformation in Eq. (62). Compared with Fig. 5, the key rate for the DR schemes does not change significantly, although there is finite noise and loss at the detector.
Figure 7. (Color online) (a) The key rates \(R^{\text{(DR)}}\) and \(R^{\text{(RR)}}\) when Eve uses a practical fiber for her beamsplitting, where we set \(\xi_{1} =0.01\), \(\xi_{2} =0.01\), \(\eta_{2} = 0.7\), and \(\eta_{s} = 10^{-\gamma_{2} l/10}\) with the distance l in the unit of km and the transmission loss \(\gamma_{2} = 0.15\) dB/km [see Eq. (62)]. (b) The optimal mean photon number that maximizes the key rates.
Note that our key rates were determined by assuming a set of specific setups for Eve's attacks. This does not preclude the possibility that the key rates become substantially small when a different setup is assigned. The security for a general attack will be addressed elsewhere.36,37)
5. Summary
In this paper, we have developed a physical model to describe the signal transmission for a continuous-variable quantum key distribution scheme and investigated its security against a couple of eavesdropping attacks assuming that the eavesdropper's power is partly restricted owing to today's technological limitations. In our model, we can separate the channel's action and the detector's imperfection, whereas both effects are considered to be controlled by the eavesdropper in the conservative approach. We considered beamsplitting attacks with two different measurement scenarios of the eavesdropper. One is that Eve performs homodyne measurement on her signal in the correct basis assuming that she can keep her signal coherently for an arbitrarily long time to delay her measurement until she learns Bob's measurement basis. The other scenario is that Eve performs heterodyne measurement on her signal before she learns the correct basis assuming that she is unable to access a perfect quantum memory. The secret key rates were calculated both in the DR and RR schemes for each of Eve's measurement scenarios. It was observed that the RR schemes typically give better key rates than the DR schemes. The assumption that Eve is unable to access a perfect quantum memory suggests that she is unable to use a lossless optical fiber. The property of our model that the receiver's loss and noise are inaccessible by the eavesdropper enables us to investigate the key rate under the condition that Eve uses a practical fiber differently from usual beamsplitting attacks where she can deploy a lossless transmission channel. The key rates achieved in this case with optimization of the mean signal photon number were also reported.
Although we have assumed substantially restricted power of the eavesdropper, who only accesses the mode \(\hat{a}_{3}\) and performs specific quantum optical measurements, in general, in individual attacks Eve could utilize the mode \(\hat{a}_{2}\) and optimize her measurement.38) The condition that Eve is unable to access the mode \(\hat{a}_{2}\) is regarded as the case that the channel's excess noise is induced by Alice's device or as the case that Alice is sending mixed coherent states as in the protocol proposed in Ref. 6. It remains possible to explicitly take into account Alice's imperfect state preparation step. In other words, one can further develop the setup to establish a finer model that consists of three blocks associated with the (i) state preparation, (ii) channel, and (iii) detector. An estimation of the key rate for a general attack will be presented elsewhere.36,37)
Acknowledgments
This work was supported by ImPACT Program of Council for Science, Technology and Innovation (Cabinet Office, Government of Japan), and the National Institute of Information and Communications Technology (NICT).
References
1 V. Scarani, H. Bechmann-Pasquinucci, N. J. Cerf, M. Dusek, N. Lütkenhaus, and M. Peev, Rev. Mod. Phys. 81, 1301 (2009). 10.1103/RevModPhys.81.1301 Crossref, Google Scholar
2 H.-K. Lo, M. Curty, and K. Tamaki, Nat. Photonics 8, 595 (2014). 10.1038/nphoton.2014.149 Crossref, Google Scholar
3 E. Diamanti, H.-K. Lo, B. Qi, and Z. Yuan, npj Quantum Information 2, 16025 (2016). 10.1038/npjqi.2016.25 Crossref, Google Scholar
4 M. Sasaki, M. Fujiwara, H. Ishizuka, W. Klaus, K. Wakui, M. Takeoka, S. Miki, T. Yamashita, Z. Wang, A. Tanaka, K. Yoshino, Y. Nambu, S. Takahashi, A. Tajima, A. Tomita, T. Domeki, T. Hasegawa, Y. Sakai, H. Kobayashi, T. Asai, K. Shimizu, T. Tokura, T. Tsurumaru, M. Matsui, T. Honjo, K. Tamaki, H. Takesue, Y. Tokura, J. F. Dynes, A. R. Dixon, A. W. Sharpe, Z. L. Yuan, A. J. Shields, S. Uchikoga, M. Legré, S. Robyr, P. Trinkler, L. Monat, J.-B. Page, G. Ribordy, A. Poppe, A. Allacher, O. Maurhart, T. Länger, M. Peev, and A. Zeilinger, Opt. Express 19, 10387 (2011). 10.1364/OE.19.010387 Crossref, Google Scholar
5 D. Stucki, M. Legre, F. Buntschu, B. Clausen, N. Felber, N. Gisin, L. Henzen, P. Junod, G. Litzistorf, P. Monbaron, L. Monat, J.-B. Page, D. Perroud, G. Ribordy, A. Rochas, S. Robyr, J. Tavares, R. Thew, P. Trinkler, S. Ventura, R. Voirol, N. Walenta, and H. Zbinden, New J. Phys. 13, 123001 (2011). 10.1088/1367-2630/13/12/123001 Crossref, Google Scholar
6 C. Silberhorn, T. C. Ralph, N. Lütkenhaus, and G. Leuchs, Phys. Rev. Lett. 89, 167901 (2002). 10.1103/PhysRevLett.89.167901 Crossref, Google Scholar
7 S. Lorenz, N. Korolkova, and G. Leuchs, Appl. Phys. B 79, 273 (2004). 10.1007/s00340-004-1574-7 Crossref, Google Scholar
8 T. Hirano, H. Yamanaka, M. Ashikaga, T. Konishi, and R. Namiki, Phys. Rev. A 68, 042331 (2003). 10.1103/PhysRevA.68.042331 Crossref, Google Scholar
9 C. Weedbrook, A. M. Lance, W. P. Bowen, T. Symul, T. C. Ralph, and P. K. Lam, Phys. Rev. Lett. 93, 170504 (2004). 10.1103/PhysRevLett.93.170504 Crossref, Google Scholar
10 F. Grosshans, G. Van Assche, J. Wenger, R. Tualle-Brouri, N. Cerf, and P. Grangier, Nature 421, 238 (2003). 10.1038/nature01289 Crossref, Google Scholar
11 D. Sych and G. Leuchs, New J. Phys. 12, 053019 (2010). 10.1088/1367-2630/12/5/053019 Crossref, Google Scholar
12 R. Namiki and T. Hirano, Phys. Rev. A 74, 032302 (2006). 10.1103/PhysRevA.74.032302 Crossref, Google Scholar
13 S. Fossier, E. Diamanti, T. Debuisschert, A. Villing, R. Tualle-Brouri, and P. Grangier, New J. Phys. 11, 045023 (2009). 10.1088/1367-2630/11/4/045023 Crossref, Google Scholar
14 P. Jouguet, S. Kunz-Jacques, T. Debuisschert, S. Fossier, E. Diamanti, R. Alléaume, R. Tualle-Brouri, P. Grangier, A. Leverrier, P. Pache, and P. Painchault, Opt. Express 20, 14030 (2012). 10.1364/OE.20.014030 Crossref, Google Scholar
15 P. Jouguet, S. Kunz-Jacques, A. Leverrier, P. Grangier, and E. Diamanti, Nat. Photonics 7, 378 (2013). 10.1038/nphoton.2013.63 Crossref, Google Scholar
16 D. Huang, P. Huang, H. Li, T. Wang, Y. Zhou, and G. Zeng, Opt. Lett. 41, 3511 (2016). 10.1364/OL.41.003511 Crossref, Google Scholar
17 M. Nakazawa, M. Yoshida, T. Hirooka, and K. Kasai, Opt. Express 22, 4098 (2014). 10.1364/OE.22.004098 Crossref, Google Scholar
18 M. Yoshida, T. Hirooka, K. Kasai, and M. Nakazawa, Opt. Express 24, 652 (2016). 10.1364/OE.24.000652 Crossref, Google Scholar
19 M. Nakazawa, M. Yoshida, T. Hirooka, K. Kasai, T. Hirano, T. Ichikawa, and R. Namiki, IEEE J. Quantum Electron. 53, 1 (2017).10.1109/JQE.2017.2708523 Crossref, Google Scholar
20 W.-Y. Hwang, Phys. Rev. Lett. 91, 057901 (2003). 10.1103/PhysRevLett.91.057901 Crossref, Google Scholar
21 X.-B. Wang, Phys. Rev. Lett. 94, 230503 (2005). 10.1103/PhysRevLett.94.230503 Crossref, Google Scholar
22 K. Inoue, E. Waks, and Y. Yamamoto, Phys. Rev. A 68, 022317 (2003). 10.1103/PhysRevA.68.022317 Crossref, Google Scholar
23 H.-K. Lo, X. Ma, and K. Chen, Phys. Rev. Lett. 94, 230504 (2005). 10.1103/PhysRevLett.94.230504 Crossref, Google Scholar
24 T. Sasaki, Y. Yamamoto, and M. Koashi, Nature 509, 475 (2014). 10.1038/nature13303 Crossref, Google Scholar
25 R. Namiki and T. Hirano, Phys. Rev. Lett. 92, 117901 (2004). 10.1103/PhysRevLett.92.117901 Crossref, Google Scholar
26 R. Namiki and T. Hirano, Phys. Rev. A 72, 024301 (2005). 10.1103/PhysRevA.72.024301 Crossref, Google Scholar
27 C. Weedbrook, S. Pirandola, R. García-Patrón, N. J. Cerf, T. C. Ralph, J. H. Shapiro, and S. Lloyd, Rev. Mod. Phys. 84, 621 (2012). 10.1103/RevModPhys.84.621 Crossref, Google Scholar
28 S. Olivares, Eur. Phys. J.: Spec. Top. 203, 3 (2012). 10.1140/epjst/e2012-01532-4 Crossref, Google Scholar
29 R. Namiki, O. Gittsovich, S. Guha, and N. Lütkenhaus, Phys. Rev. A 90, 062316 (2014). 10.1103/PhysRevA.90.062316 Crossref, Google Scholar
30 R. König, U. Maurer, and R. Renner, IEEE Trans. Inf. Theory 51, 2391 (2005). 10.1109/TIT.2005.850087 Crossref, Google Scholar
31 U. Leonhardt, in Measuring the Quantum State of Light, ed. P. L. Knight and A. Miller (Cambridge University Press, Cambridge, U.K., 1997) Chap. 6. Google Scholar
32 M. Heid and N. Lütkenhaus, Phys. Rev. A 76, 022313 (2007). 10.1103/PhysRevA.76.022313 Crossref, Google Scholar
33 Y.-B. Zhao, M. Heid, J. Rigas, and N. Lütkenhaus, Phys. Rev. A 79, 012307 (2009). 10.1103/PhysRevA.79.012307 Crossref, Google Scholar
34 H. Kanamori, H. Yokota, G. Tanaka, M. Watanabe, Y. Ishiguro, I. Yoshida, T. Kakii, S. Itoh, Y. Asano, and S. Tanaka, J. Lightwave Technol. 4, 1144 (1986). 10.1109/JLT.1986.1074837 Crossref, Google Scholar
35 K. Nagayama, M. Kakui, M. Matsui, I. Saitoh, and Y. Chigusa, Electron. Lett. 38, 1168 (2002). 10.1049/el:20020824 Crossref, Google Scholar
36 T. Ichikawa and T. Hirano, presented at Qcrypt, 2014. Google ScholarT. Ichikawa and T. Hirano, presented at Qcrypt, 2014. Google Scholar
37 T. Hirano, T. Ichikawa, T. Matsubara, M. Ono, Y. Oguri, R. Namiki, K. Kasai, R. Matsumoto, and T. Tsurumaru, Quantum Sci. Technol. 2, 024010 (2017). 10.1088/2058-9565/aa7230 Crossref, Google Scholar
38 R. Namiki, M. Koashi, and N. Imoto, Phys. Rev. A 73, 032302 (2006). 10.1103/PhysRevA.73.032302 Crossref, Google Scholar