SUPPLEMENTARY INFORMATION · follow the notation of Ref. [1], where [ˆq,pˆ]=2 i (i.e., ˜ = 2) so...

High-rate measurement-device-independent quantum cryptography

Stefano Pirandola,1, ∗ Carlo Ottaviani,1 Gaetana Spedalieri,1 Christian Weedbrook,2 SamuelL. Braunstein,1 Seth Lloyd,3 Tobias Gehring,4 Christian S. Jacobsen,4 and Ulrik L. Andersen4

1Computer Science and York Centre for Quantum Technologies,University of York, York YO10 5GH, United Kingdom

2Department of Physics, University of Toronto, Toronto M5S 3G4,Canada and QKD Corporation, 112 College St., Toronto M5G 1L6, Canada

3MIT – Department of Mechanical Engineering and Research Laboratory of Electronics, Cambridge MA 02139, USA4Department of Physics, Technical University of Denmark, Fysikvej, 2800 Kongens Lyngby, Denmark

Contents

I. Theoretical methods 1A. Security analysis of the protocol in the

entanglement-based representation 1B. Measurement-device independence and

Gaussian optimality 2C. General computation of the secret-key rate 2D. Realistic Gaussian attack against the links 3E. Analytical derivation of the secret-key rate 5

1. Alice and Bob’s mutual information 52. Eve’s Holevo information 63. Secret-key rate 64. Ideal secret-key rate 65. Minimization of the ideal rate at fixed

thermal noise 76. Minimization of the ideal rate at fixed

equivalent noise 87. Ideal rate in limit configurations 9

F. Computation of the post-relay CM 10

II. Experimental methods 11A. General description of the optical setup 11B. Detailed mathematical description of the

experiment and data post-processing 12

III. Discussion 14A. Network topologies 14B. Note added 14

References 15

I. THEORETICAL METHODS

In this section we provide full details of our theoreticalderivations, leaving the description of the experimentalsetup and the post-processing of data to Sec. II. Wefollow the notation of Ref. [1], where [q, p] = 2i (i.e., = 2) so that the vacuum noise is 1 and a = (q + ip)/2.

∗Electronic address: [email protected]

Adopting an entanglement-based representation of theprotocol (Sec. I A), we first show how a joint attack of therelay and the links can be reduced to a Gaussian attack ofthe links with a properly-working relay (Sec. I B). Herethe key-step is proving the measurement-device indepen-dence for our continuous-variable protocol, followed bythe application of the known result on the extremality ofGaussian states. In Sec. I C, we then describe how to de-rive the secret-key rate of the protocol in the presence ofan arbitrary two-mode Gaussian attack of the links. InSec. I D we make our analysis more specific consideringa realistic form of this attack, and deriving the corre-sponding secret-key rate in Sec. I E. This rate is suitablyminimized and studied in various configurations. Finally,Sec. I F contains the technical derivation of the post-relayquantum covariance matrix (CM) which is central for thecomputation of the rate.

A. Security analysis of the protocol in theentanglement-based representation

To study the security of the protocol, we adopt anentanglement-based representation where each source ofcoherent states is realized by an Einstein-Podolsky-Rosen(EPR) state subject to heterodyne detection. As in thetop panel of Fig. 1, at Alice’s station we take an EPRstate ρaA having zero mean and CM equal to

V =(

µI√

µ2 − 1Z√µ2 − 1Z µI

), Z :=

(1

−1

). (1)

By heterodyning mode a, Alice remotely prepares acoherent state |α〉 on mode A, whose amplitude is mod-ulated by a complex Gaussian with variance ϕ = µ − 1.The outcome of the measurement α is related to the pro-jected amplitude α by the relation

α = ηα∗, η := (µ + 1)(µ2 − 1)−1/2, (2)

which provides α α∗ for large modulation ϕ 1. Itis important to note that the two variables α and α areequivalent from a information-theoretical point of view,in the sense that they share the same mutual informationwith any third variable.






Contents











References 15







V =(

µI√

µ2 − 1Z√µ2 − 1Z µI

), Z :=

(1

−1

). (1)


α = ηα∗, η := (µ + 1)(µ2 − 1)−1/2, (2)







Contents











References 15







V =(

µI√

µ2 − 1Z√µ2 − 1Z µI

), Z :=

(1

−1

). (1)


α = ηα∗, η := (µ + 1)(µ2 − 1)−1/2, (2)


Supplementary Information on “High-rate measurement-device independent quantumcryptography: Theory and experiment”





Contents











References 15







V =(

µI√

µ2 − 1Z√µ2 − 1Z µI

), Z :=

(1

−1

). (1)


α = ηα∗, η := (µ + 1)(µ2 − 1)−1/2, (2)


SUPPLEMENTARY INFORMATIONDOI: 10.1038/NPHOTON.2015.83

NATURE PHOTONICS | www.nature.com/naturephotonics 1

© 2015 Macmillan Publishers Limited. All rights reserved

http://dx.doi.org/10.1038/nphoton.2015.83

2

On the other side, Bob’s coherent state |β〉 can be pre-pared using another EPR state ρbB whose mode b is het-erodyned with outcome β = ηβ∗ (with the limit β β∗

for ϕ 1). Again, we have that the outcome variable βis informationally equivalent to β.

FIG. 1: (Top). Entanglement-based representation of the pro-tocol, where Alice’s and Bob’s random coherent states aregenerated by local heterodyne detections on EPR states. Out-come variables α and β are informationally-equivalent to theamplitudes α and β of the coherent states. (Bottom) Condi-tional scenario after Eve’s detection with outcome γ.

In the top panel of Fig. 1 we see that, before the uni-tary U and the measurements, the global input state ofAlice, Bob, and Eve is pure and Gaussian (Eve’s ancillasare prepared in vacua). After U and before the mea-surements, their global output state is still pure, despitethe fact that it could be non-Gaussian. Since local mea-surements commute, we can postpone Alice’s and Bob’sheterodyne detections after Eve’s detection, whose out-come γ is obtained with probability p(γ). Thus, we havethe conditional scenario depicted in the bottom panelof Fig. 1, where Alice, Bob, and Eve share a conditionalstate ΦabE|γ with reduced states ρab|γ (for Alice and Bob)and ρE|γ (for Eve). Since Eve performs homodyne detec-tions, ΦabE|γ is pure, so that ρab|γ and ρE|γ have the sameentropy

S(ρab|γ) = S(ρE|γ). (3)

Considering homodyne detectors in Eve’s simulator isthe most natural way to generate continuous-variableoutcomes. In general, the simulator can be assumed toimplement an arbitrary Gaussian measurement, since anyGaussian operation can be decomposed into a sequenceof Gaussian channels (including Gaussian unitaries), to-gether with homodyne detections [1]. In such a case, anytransformation and extra ancilla can be moved from thesimulator and inserted into the global unitary U .

In the conditional post-relay scheme of Fig. 1 (bottompanel), Alice encodes information by heterodyning hermode a with result α. Since heterodyne is a rank-onemeasurement, it projects ΦabE|γ into a pure state ΦbE|γα

for Bob and Eve, so that the reduced states ρb|γα andρE|γα have the same entropy

S(ρb|γα) = S(ρE|γα). (4)

As a result we have that, conditioned on γ, Eve’s stoleninformation on Alice’s variable α is upperbounded by the

Holevo quantity

IE|γ := S(ρE|γ) − S(ρE|γα) = S(ρab|γ) − S(ρb|γα), (5)

which is fully determined by the state ρab|γ .To retrieve Alice’s encoding α, Bob heterodynes his

mode b whose output β is optimally postprocessed. Con-ditioned on γ, Alice and Bob’s mutual information isgiven by IAB|γ := I(α, β|γ) = I(α, β|γ), which is fullydetermined by ρab|γ . As a result, the secret-key rate ofthe protocol is given by the average

R =∫

d2γ p(γ)R|γ , R|γ := IAB|γ − IE|γ . (6)

This quantity only depends on the conditional state ρab|γand the statistics of Eve’s outcomes p(γ).

B. Measurement-device independence andGaussian optimality

Starting from the observed distribution p(α, β, γ) =p(α, β|γ)p(γ), Alice and Bob reconstruct a joint attackas in the top panel of Fig. 1, which is optimal and com-patible with their statistics. In particular, they computethe post-relay conditional state ρab|γ directly from theconditional probability p(α, β|γ).

Given p(α, β, γ), and therefore p(γ) and ρab|γ , the rateR is completely determined. This means that R remainsexactly the same if we arbitrarily change U while pre-serving the observed statistics p(α, β, γ). In particular,we can change U in such a way that the simulator repre-sents a properly-working relay. This can always be doneby adding the identity I = UBellU

†Bell, where U†

Bell is ab-sorbed by U , while UBell converts the homodynes of thesimulator into a Bell detection. Thus, compatibly withthe observed data, an arbitrary joint attack U of the linksand the relay can always be reduced to an attack of thelinks only, associated with a properly-working relay.

The next step is exploiting the optimality of Gaussianattacks for Gaussian protocols [1, 2]. For any outcomeγ, the conditional rate R|γ is minimized if we replace thepure state ΦabE|γ with a pure Gaussian state ΦG

abE|γ hav-ing the same mean value and CM. Note that, in the toppanel of Fig. 1, this is equivalent to considering U to bea Gaussian unitary, therefore generating joint Gaussianstatistics for the variables α, β and γ. Thus, Alice andBob can always replace p(α, β, γ) with a Gaussian dis-tribution pG(α, β, γ) having the same first- and second-order statistical moments. Adopting this new distribu-tion, they upperbound Eve’s performance replacing herattack with a Gaussian attack against the links.

C. General computation of the secret-key rate

According to the previous analysis, Alice and Bob con-sider the worst-case scenario where the two links are sub-

2 NATURE PHOTONICS | www.nature.com/naturephotonics

SUPPLEMENTARY INFORMATION DOI: 10.1038/NPHOTON.2015.83



3

ject to a Gaussian attack, while the relay is properly op-erated by Eve. In this case, for any outcome γ, the con-ditional Gaussian state ρab|γ has always the same CMVab|γ while its mean value varies with γ. As typical inGaussian entanglement swapping [3], this random shiftin the first moments can be automatically compensatedfor by Bob’s postprocessing.

As a result we have that IAB|γ depends only on theinvariant CM Vab|γ , so that we can write

IAB = IAB|γ (7)

for any γ. Similarly, the entropies in Eq. (5) dependsonly on the invariant CM Vab|γ , so that

IE = IE|γ (8)

for any γ. As a result, the conditional rate R|γ is invari-ant and coincides with the actual (average) rate of theprotocol, i.e., R = R|γ for any γ. Equivalently, we maywrite

R = IAB − IE . (9)

Thus, we can theoretically compute the rate R from thequantum CM Vab|γ of the post-relay state ρab|γ .

More precisely, the previous Eq. (9) represents anasymptotic rate, which is derived assuming infiniterounds of the protocol. For large but still finite num-ber of rounds, one has to consider the effect of non-unitreconciliation efficiency, which means that Eq. (9) has tobe modified into

R = ξIAB − IE (10)

with reconciliation parameter ξ ≤ 1 [1].Now it is important to note that the quantum CM

Vab|γ can always be determined by the parties duringthe data comparison at the end of the protocol. In par-ticular, it can be derived from the second-order statisticalmoments of the observed data. In fact, from the empiricaldistribution p(α, β, γ) or its Gaussian version pG(α, β, γ),Alice and Bob derive the relation matrix Γ(α, β, γ) andthe complex CM V(α, β, γ) [4]. Setting α = (qA + ipA)/2and β = (qB + ipB)/2, these matrices are equivalent to areal CM for the quadratures

V(qA, pA, qB , pB , q−, p+) =(

VA⊕B CCT R

), (11)

where VA⊕B := V(qA, pA)⊕V(qB , pB) is Alice and Bob’sreduced CM, R is the CM of the outcomes at the relay,and C accounts for the correlations. Given the outcomeγ, the conditional CM of Alice and Bob can be computedby Gaussian elimination and reads

V(qA, pA, qB , pB |γ) = VA⊕B − CR−1CT . (12)

In the entanglement-based representation of the proto-col, we can easily put the previous CM in terms of Alice’sand Bob’s measurement outcomes, respectively,

α = (qA + ipA)/2, β = (qB + ipB)/2. (13)

In fact, we can write

V(qA, pA, qB , pB |γ) = η−2V(qA, pA, qB , pB |γ), (14)

where parameter η is defined in Eq. (2) and accountsfor the fact that the modulation is finite. Finally, theconnection with the quantum CM is given by

V(qA, pA, qB , pB |γ) = Vab|γ + I, (15)

where I is the vacuum shot-noise introduced by the het-erodyne detections. The latter relation can be derivedmodelling each heterodyne detector as a quantum-limitedamplifier (with gain 2) followed by a balanced beam split-ter (with vacuum environment) which is conjugately ho-modyned at the output ports (one in the position andthe other in the momentum quadrature).

Note that for the specific computation of the condi-tional entropy of Eq. (4), which enters in Eve’s Holevoinformation and therefore the rate, one has to derive theconditional quantum CM Vb|γα of Bob’s state ρb|γα af-ter Alice’s heterodyne detection with outcome α. Forthis calculation, we write Vab|γ in the block form

Vab|γ =(

a ccT b

), (16)

and we apply the formula [1]

Vb|γα = b − cT (a + I)−1c, (17)

or equivalently [5]

Vb|γα = b − ζ−1cT (ΩaΩT + I)c, (18)

where ζ is defined in terms of trace and determinant asζ := det(a) + Tr(a) + 1, and

Ω =(

0 1−1 0

). (19)

Alternatively, we may compute

Vb|γα = V(qB , pB |γα) − I, (20)

where V(qB , pB |γα) comes from V(qA, pA, qB , pB |γ) af-ter Gaussian elimination of Alice’s outcome variables.

To derive an explicit formula for the secret-key rate,we consider a realistic form for the coherent Gaussianattack. The mathematical details of this attack are fullydiscussed in the next section. Then, in Sec. I E we willexplicitly compute the analytical expression of the rate.

D. Realistic Gaussian attack against the links

Consider the scenario depicted in Fig. 2, which is theentanglement-based representation of our protocol sub-ject to a realistic Gaussian attack against the two links.This two-mode Gaussian attack is characterized by two





4

beam splitters with transmissivities τA (for Alice’s link)and τB (for Bob’s link). Using these beam splitters, Evemixes the incoming modes, A and B, with two ancillarymodes, E1 and E2, extracted from a reservoir of ancillas.After the beam splitters, the output ancillas, E′

1 and E′2,

are stored in a quantum memory (together with all theother ancillas in the reservoir).

FIG. 2: Protocol in the entanglement-based representation.Continuous-variable Bell relay is correctly operated while atwo-mode Gaussian attack is performed against the two quan-tum links (see text for more details).

The reduced state σE1E2 of E1 and E2 is Gaussian withzero mean-value and CM in the normal form

VE1E2 =(

ωAI GG ωBI

),

I := diag(1, 1),G := diag(g, g′). (21)

Here ωA ≥ 1 is the variance of the thermal noise intro-duced by E1 in Alice’s link, while ωB ≥ 1 is the varianceof the thermal noise introduced by E2 in Bob’s link. Thecorrelations between E1 and E2 are determined by theblock G whose elements, g and g′, must satisfy a set ofbona-fide conditions [6, 7]. Note that the previous nor-mal form is very general since any two-mode CM can beput in this form by local Gaussian operations [1].

For given values of thermal noise ωA, ωB ≥ 1, Eve’sCM VE1E2 is fully determined by the correlation param-eters g and g′, which can be represented as a point ina ‘correlation plane’. To better describe this plane, weneed to write the bona-fide conditions for g and g′, whichare derived by imposing the uncertainty principle [6]

VE1E2 > 0, ν2− ≥ 1, (22)

where ν− is the least symplectic eigenvalue of VE1E2 . Inparticular, we have [1]

2ν2− = ∆ −

√∆2 − 4 detVE1E2 , (23)

where ∆ = ω2A + ω2

B + 2gg′.The positivity VE1E2 > 0 provides the constraints

|g| <√

ωAωB , |g′| <√

ωAωB , (24)

while ν2− ≥ 1 provides an inequality f(ωA, ωB , g, g′) ≥ 1

which is symmetric with respect to the origin and the

bisector g′ = −g. On the bisector g′ = −g we have thatf ≥ 1 corresponds to |g′| ≤ φ where

φ := min√

(ωA − 1)(ωB + 1),√

(ωA + 1)(ωB − 1)

.

(25)The previous bona-fide conditions must be satisfied by

g and g′ for any ωA, ωB ≥ 1. They imply that the corre-lation plane is accessible only in a limited region aroundits origin, whose border is determined by ωA and ωB . Anumerical example for ωA = 5 and ωB = 2 is provided inFig. 3. The accessible region always forms a continuousand convex set, apart from the singular case ωA = 1 orωB = 1, where it collapses into its origin g′ = g = 0.

g

g' Separable

Entangle

d

Entangle

d

FIG. 3: Correlation plane (g, g′) for ωA = 5 and ωB = 2.Points in the external white area are not accessible (hav-ing correlations too strong to be compatible with quantummechanics). Accessible points (i.e., satisfying the bona-fideconditions) are represented by the delimited region, which isfurther divided in sub-regions. The inner darker area corre-sponds to separable attacks, while the two peripheral areascorrespond to entangled attacks. The two dashed lines repre-sent the two bisectors g′ = g and g′ = −g.

The accessible region of the correlation plane can befurther divided into sub-regions, corresponding to attacksperformed with separable or entangled ancillas E1 andE2. In fact, we can easily write the separability conditionfor Eve’s reduced state σE1E2 by considering the leastpartially-transposed symplectic eigenvalue ν− of its CMVE1E2 . This positive eigenvalue is determined by

2ν2− = ∆ −

√∆2 − 4 detVE1E2 , (26)

where ∆ = ω2A + ω2

B − 2gg′. Then, we have σE1E2 sepa-rable if and only if ν2

− ≥ 1. This corresponds to anotherinequality f(ωA, ωB , g, g′) ≥ 1 which is now symmetricwith respect to the origin and the bisector g′ = g. Thus,within the accessible region, we have an inner area of at-tacks performed with separable ancillas (ν2

− ≥ 1), thatwe call ‘separable attacks’, and two peripheral areas ofattacks performed with entangled ancillas (ν2

− < 1), thatwe call ‘entangled attacks’ (see Fig. 3).





5

Among the separable attacks, the simplest one is theorigin of the plane, where Eve’s state is a tensor prod-uct σE1 ⊗ σE2 . This attack consists of two independententangling cloners, i.e., two beam splitters mixing thetravelling modes with two independent thermal modes,part of two EPR states. Apart from this singular case,all other separable attacks have correlated noise, withthe two ancillary modes E1 and E2 possessing quantumcorrelations (non-zero quantum discord) and possibly en-tangled with extra ancillas e in the reservoir.

For the entangled attacks, it is essential to distinguishbetween the two peripheral regions. For attacks in thebottom-right region (g > 0 and g′ < 0), Eve injects‘good’ entanglement. She injects EPR correlations of thetype qE1 ≈ qE2 and pE1 ≈ −pE2 , helping the Bell de-tection (which projects on the same kind of correlationsqA′ ≈ qB′ and pA′ ≈ −pB′). We call the ‘positive EPRattack’ the most entangled attack in this region, which isthe bottom-right point with g = φ and g′ = −φ.

By contrast, for attacks in the top-left region (g < 0and g′ > 0), Eve injects ‘bad’ entanglement with EPRcorrelations of the type qE1 ≈ −qE2 and pE1 ≈ pE2 .These correlations tend to destroy those established bythe Bell detection. In particular, we call the ‘negativeEPR attack’ the most entangled state σE1E2 in this re-gion, which is the top-left point with g = −φ and g′ = φ.

E. Analytical derivation of the secret-key rate

Having completely characterized the description of therealistic Gaussian attack against the two links, we cannow derive the corresponding secret-key rate of the pro-tocol under such an attack. As previously discussed inSec. I C, this rate is completely determined by the quan-tum CM Vab|γ of Alice’s and Bob’s remote modes a andb after the action of the relay. The first step is thereforethe computation of the post-relay CM Vab|γ coming fromthe scenario in Fig. 2.

In Sec. I F we explicitly compute

Vab|γ =(

µI 00 µI

)− (µ2 − 1)×

×

τA

θ 0 −√

τAτB

θ 00 τA

θ′ 0√

τAτB

θ′

−√

τAτB

θ 0 τB

θ 00

√τAτB

θ′ 0 τB

θ′

, (27)

where we have set

θ := (τA + τB) µ + λ, θ′ := (τA + τB) µ + λ′, (28)

and the lambdas are defined as

λ := κ − ug > 0, λ′ := κ + ug′ > 0, (29)

with

κ := (1 − τA)ωA + (1 − τB)ωB , (30)

u := 2√

(1 − τA)(1 − τB). (31)

For the next calculations it is useful to compute theCMs of Bob’s reduced state ρb|γ and Bob’s state ρb|γα

conditioned on Alice’s detection. These CMs can easilybe derived from Vab|γ . In particular, we have

Vb|γ =

(µ − (µ2−1)τB

θ 00 µ − (µ2−1)τB

θ′

), (32)

Vb|γα =

(µ − (µ2−1)τB

τA+τBµ+λ 0

0 µ − (µ2−1)τB

τA+τBµ+λ′

). (33)

1. Alice and Bob’s mutual information

Having determined the post-relay CM, we can now pro-ceed with the derivation of the rate. First, let us com-pute the mutual information of Alice and Bob IAB =I(α, β|γ). The outcomes α and β of Alice’s and Bob’sdetectors are associated with the classical CM given inEq. (15). In particular, Bob’s reduced CM is equal to

VB|γ := V(qB , pB |γ) = Vb|γ + I. (34)

Then, Bob’s CM conditioned to Alice’s outcome α is

VB|γα := V(qB , pB |γα) = Vb|γα + I. (35)

The previous CMs are all diagonal V = diag(V q, V p).Since the two quadratures are modulated independently,the mutual information IAB is given by the sum of thetwo terms, one for each quadrature. Explicitly, we have

IAB =12

log2

V qB|γ

V qB|γα

+12

log2

V pB|γ

V pB|γα

=12

log2 Σ, (36)

where

Σ :=1 + detVb|γ + TrVb|γ

1 + detVb|γα + TrVb|γα. (37)

We can always re-write the mutual information interms of a signal-to-noise ratio as

IAB = log2

µ

χ= log2

ϕ + 1χ

, (38)

where the equivalent noise χ = µΣ−1/2 can be computedfrom Σ, which in turn depends on the post-relay CMVab|γ , known to the parties from the observed statisticsp(a, β|γ). Clearly, the equivalent noise depends on all pa-rameters of the attack, i.e., χ = χ(τA, τB , ωA, ωB , g, g′).

The equivalent noise can always be decomposed as

χ = χloss + ε, (39)

where the pure-loss noise

χloss := χ(τA, τB , 1, 1, 0, 0) (40)

corresponds to the noise contribution which only comesfrom the loss (i.e., τA and τB), while

ε := χ − χloss = ε(τA, τB , ωA, ωB , g, g′) (41)

is the so-called ‘excess noise’, i.e., the extra contributionabove the pure-loss noise.





6

2. Eve’s Holevo information

In order to bound Eve’s stolen information on Alice’soutcome variable α, we use the Holevo quantity

IE = S(ρab|γ) − S(ρb|γα). (42)

The first entropy term S(ρab|γ) can be computed from thesymplectic spectrum [1] ν1, ν2 of Vab|γ . In particular,we have

S(ρab|γ) = h(ν1) + h(ν2), (43)

where the h-function is defined as

h(x) :=(

x+12

)log2

(x+12

) − (x−1

2

)log2

(x−1

2

). (44)

For the second entropy term in Eq. (42), we have

S(ρb|γα) = h(ν), (45)

where

ν =√

detVb|γα. (46)

3. Secret-key rate

At finite modulation ϕ and arbitrary reconciliation ef-ficiency ξ, we write the rate in terms of all parameters ofthe attack, i.e.,

Rϕ,ξ = ξIAB − IE := Rϕ,ξ(τA, τB , ωA, ωB , g, g′). (47)

We can simplify the situation by expressing the rate interms of fewer parameters, which means that it must beminimized on the degrees of freedom of the parametersto be discarded. This procedure is useful also becausethe two parties may not be able to reconstruct all theparameters of the attack from the channel tomography.

The first possibility is to minimize the rate at fixedtransmissivities, τA and τB , and thermal noise, ωA andωB . This means to consider the minimum rate

Rϕ,ξ(τA, τB , ωA, ωB) := ming,g′

Rϕ,ξ(τA, τB , ωA, ωB , g, g′).

(48)The second possibility is to minimize the rate at fixedtransmissivities, τA and τB , and equivalent noise χ. Inother words, we can define the constrained minimum rate

Rϕ,ξ(τA, τB , χ) := minωA,ωB ,g,g′

s.t. χ is fixed


(49)Equivalently, we can define the minimum rate in terms

of the transmissivities and the excess noise, i.e.,

Rϕ,ξ(τA, τB , ε) := minωA,ωB ,g,g′

s.t. ε is fixed


(50)The analytical expressions of these rates are cumbersome.In the following, we show their simple form in the ideallimit of ideal reconciliation and large modulation.

4. Ideal secret-key rate

As anticipated, here we consider ideal reconciliation(ξ = 1) and large modulation (ϕ 1). The second limitϕ 1 (or equivalently µ 1) is particularly useful since:

(i) It simplifies the expression of the equivalent noise;

(ii) It simplifies the symplectic eigenvalues involved inthe entropic h-terms;

(iii) It allows us to exploit the expansion

h(x) log2

(ex

2

)+ O

(1x

)for x 1. (51)

For large modulation and τAτB = 0 (we exclude thesingular trivial case where one of the two links has exactlyzero transmissivity), we can derive

χ =τA + τB

τAτB

√(τA + τB + λ)(τA + τB + λ′), (52)

so that

χloss(τA, τB) =2(τA + τB)

τAτB. (53)

The symplectic spectrum of Vab|γ takes the asymptoticexpressions

ν1, ν2 =

|τA − τB |τA + τB

µ,

√λλ′

|τA − τB |

for τA = τB ,

(54)and

ν1, ν2 =

√λµ

2τB,

√λ′µ2τB

for τA = τB . (55)

As a result, we have the following asymptotic formula forthe entropy

S(ρab|γ) =

S = for τA = τB ,

S= for τA = τB ,(56)

where

S = := h

( √λλ′

|τA − τB |

)+ log2

[e|τA − τB |µ2(τA + τB)

], (57)

S= := log2

(e2√

λλ′µ8τB

). (58)

Here it is important to note that S(ρab|γ) is continuousin τA = τB . In other words, we have

S= → S=, for τA → τB . (59)

This continuity is inherited by the Holevo information IE

in Eq. (42) and therefore by the rate.





7

Then, the conditional CM Vb|γα has the asymptoticsymplectic eigenvalue

ν = τ−1B

√(τA + λ)(τA + λ′), (60)

which provides the asymptotic expression of the condi-tional entropy S(ρb|γα) = h(ν). From the eigenvalue inEq. (60), we see that the conditional entropy is clearlyasymmetric in the transmissivities, τA and τB . Indeed ifwe swap Alice and Bob in all previous formulas, this isthe only term to be affected. In other words, the condi-tional entropy is the term responsible for the asymmetricbehavior of the rate.

Using the previous formulas, we can derive a simpleanalytical expression for the ideal secret-key rate of theprotocol R = IAB − IE := R(τA, τB , ωA, ωB , g, g′). ForτA = τB , we find

R = h(ν) − h

( √λλ′

|τA − τB |

)+ log2

[2(τA + τB)e|τA − τB |χ

], (61)

with continuous limit in τA = τB := τ , where it becomes

R = h(ν) + log2

(8τ

e2χ√

λλ′

). (62)

Here the lambda parameters λ and λ′ are given inEq. (29), the eigenvalue ν is expressed by Eq. (60), andthe equivalent noise χ is given in Eq. (52).

The general formula in Eq. (61) is given in terms of allparameters of the attack τA, τB , ωA, ωB , g, and g′. WhileτA and τB are easily accessible from the first-order mo-ments, the remaining parameters could be inaccessible tothe parties, since they generally mix in determining theCM Vab|γ of Eq. (27). For this practical reason, it is im-portant to express the rate in terms of fewer parameters.

5. Minimization of the ideal rate at fixed thermal noise

Let us start by assuming that Alice and Bob only knowthe transmissivities (τA and τB) and the thermal noiseaffecting each link (ωA and ωB). Given these four pa-rameters, we minimize the rate R(τA, τB , ωA, ωB , g, g′)of Eq. (61) over all physical values of the correlation pa-rameters, i.e., over all accessible points in the correlationplane (g, g′). In other words, we explicitly compute theminimum rate of Eq. (48) in the ideal case of ξ = 1 andϕ 1. In our analysis, it is sufficient to assume τA = τB ,since we can extend the result to the symmetric configu-ration τA = τB by continuity.

First it is important to note that the rate R in Eq. (61)depends on the correlation parameters (g, g′) only viathe lambdas, λ and λ′, specified by Eq. (29). Since Ris invariant under permutation λ ↔ λ′, it is symmetricwith respect to the bisector g′ = −g. This symmetry isalso shown in the numerical example given in Fig. 4.

In the correlation plane, the set of accessible points isa convex set and symmetric with respect to the bisector

g′ = −g. Combining this topology with the symmetryof the rate R allows us to restrict its minimization tothe accessible points along the bisector g′ = −g. Settingg′ = −g corresponds to setting λ′ = λ = κ + ug′ in therate of Eq. (61), which gives

R(g′ = −g) = H(τA, τB , λ) + L(τA, τB , λ), (63)

where

H(τA, τB , λ) := h

(τA + λ

τB

)− h

(λ

|τA − τB |)

, (64)

L(τA, τB , λ) := log2

[2τAτB

e|τA − τB |(τA + τB + λ)

]. (65)

It is easy to check that H and L are minimized bymaximizing λ which, in turn, corresponds to maximizingg′. As we know from Sec. ID, the maximal accessiblevalue of g′ along the bisector g′ = −g is given by φ inEq. (25). Thus, at fixed transmissivities (τA and τB) andthermal noise (ωA and ωB), the optimal coherent attackis given by g′ = −g = φ, which is the extremal top-leftpoint in the accessible region of the correlation plane. Asalready discussed in Sec. ID, this entangled attack is a‘negative EPR attack’ where Eve injects EPR correla-tions in the links which tend to destroy the effect of theBell detection. By contrast, H and L are maximized byminimizing g′, whose minimum accessible value along thebisector g′ = −g is given by −φ. Thus, the rate is maxi-mum in the extremal bottom-right point of the accessibleregion, corresponding to the ‘positive EPR attack’, whereEve injects EPR correlations helping the Bell detection.

Assuming that Eve performs the optimal attack, i.e.,the negative EPR attack, the minimum ideal rate of ourprotocol at fixed transmissivities and thermal noise isgiven by

R(τA, τB , ωA, ωB) = h

(τA + λopt

τB

)− h

(λopt

|τA − τB |)

+ log2

[2τAτB

e|τA − τB |(τA + τB + λopt)

], (66)

where

λopt := κ + uφ, (67)

with κ and u defined in Eqs. (30) and (31). This rate iscontinuous in τA = τB := τ , where it becomes

R(τ, ωA, ωB) = h

(τ + λopt

τ

)+log2

[4τ2

e2(2τ + λopt)λopt

].

(68)As evident from Fig. 4, the negative EPR attack clearly

outperforms the collective entangling-cloner attack (cor-responding to the origin of the plane g′ = g = 0). Fromthis point of view, the security analysis of our protocolis clearly more complex compared to previous literatureon continuous-variable quantum cryptography.





8

FIG. 4: Minimization at fixed thermal noise. The gen-eral rate R of Eq. (61) is plotted in the correlation plane(g, g′) for τA = 0.9, τB = 0.5, and ωA = ωB = 2.5. Thenon-white area is the set of accessible points, which is convexand symmetric with respect to the bisector g′ = −g. Withinthe accessible set, darker regions correspond to lower valuesof the rate. The rate is symmetric with respect to the bi-sector g′ = −g, and decreasing towards the extremal top-leftpoint of the accessible set (behavior is generic for any choiceof the parameters τA, τB , ωA and ωB). Minimization atfixed equivalent noise. We compare the iso-noise curves(χ=const) with the more concave iso-rate curves (R=const).

6. Minimization of the ideal rate at fixed equivalent noise

Despite the complexity of the protocol, it is remark-able that we can further simplify its rate by expressingit in terms of three parameters only, i.e., the transmis-sivities (τA and τB) and the equivalent noise χ. Thisminimal knowledge on the attack is always guaranteed.In fact, as discussed in Sec. I E and specifically regardingEq. (38), we have that the equivalent noise is uniquelydetermined by the chosen modulation ϕ and the post-relay CM Vab|γ which is, in turn, reconstructed fromthe empirical statistics p(α, β|γ). Thus, given the threeaccessible parameters τA, τB and χ, we minimize the gen-eral rate R of Eq. (61), finding a simple formula for theminimum rate R(τA, τB , χ). In other words, we explicitlycompute Eq. (49) in the ideal case of ξ = 1 and ϕ 1.

For this constrained minimization we can construct aLagrangian and look for its critical points (procedure isinvolved and not reported here). More intuitively, we canfind the minimum by directly comparing the rate andthe equivalent noise on the correlation plane. On thisplane, we plot the curves with the same rate R=const(iso-rate curves) and the curves with the same equivalentnoise χ=const (iso-noise curves). As we can see from thenumerical example in Fig. 4, the iso-rate curves are moreconcave than the iso-noise curves.

Combining this different concavity with the fact thatthe rate is decreasing from the bottom-right point to thetop-left point of the accessible region, we find that therate is minimized at the intersection of each iso-noise

curve with the bisector g′ = −g. In other words, movingalong an iso-noise curve (χ=const) the rate is minimizedat the point where g′ = −g. Therefore we set g′ = −g inthe rate R(τA, τB , ωA, ωB , g, g′) and we express the resultin terms of the three basic parameters τA, τB and χ.

Given these parameters the minimum ideal rate isequal to

R(τA, τB , χ) = h(

τAχτA+τB

− 1)− h

[τAτBχ−(τA+τB)2

|τA−τB |(τA+τB)

]

+ log2

[2(τA + τB)e|τA − τB |χ

], (69)

which is continuous in τA = τB , where it becomes

R(χ) = h(χ

2− 1

)+ log2

[16

e2χ(χ − 4)

]. (70)

Using the decomposition of the equivalent noise χ =χloss(τA, τB) + ε with the asymptotic χloss given inEq. (53), we can easily re-write the latter formulas andderive the analytical expression of the ideal rate at fixedtransmissivities and excess noise R(τA, τB , ε), which isthe solution of Eq. (50) in the ideal case. This analyticalderivation provides the ideal rate given in Eq. (2) of themain paper.

For the specific case ε = 0, we have a pure-loss attackof the links, where Eve’s beam splitters mix the incomingmodes with vacuum modes. The study of this simpleattack is useful to estimate the maximum performanceof the protocol (which worsens for ε > 0). In a pure-lossattack, the minimum rate R(τA, τB , 0) simplifies to

R(τA, τB) = h

(2 − τB

τB

)− h

(2 − τA − τB

|τA − τB |)

+ log2

(τAτB

e|τA − τB |)

, (71)

which is continuous in τA = τB := τ , where it becomes

R(τ) = h

(2 − τ

τ

)+ log2

[τ2

e2(1 − τ)

]. (72)

One can easily check that Eq. (71) can also be achievedby specifying the previous rates of Eqs. (61) and (66) tothe specific case of pure-loss (ωA = ωB = 1).

In the top panel of Fig. 5, we have plotted R(τA, τB) asa function of the two transmissivities. We see that R > 0occurs above a certain threshold which is asymmetric inthe plane. In particular, for τA close to 1 we see thatτB can be close to zero, identifying the optimal configu-ration of the protocol. Assuming standard optical fibres(0.2 dB/km), this corresponds to having Alice close tothe relay while Bob can be very far away as also shownin Fig. 3 of the main paper. These results are provento be robust with respect to the presence of excess noiseε > 0. This can be seen in the bottom panel of Fig. 5,where we plot R(τA, τB , ε) for the high numerical valueε = 0.1. Note that this value of the excess noise is higherthan that considered in the main paper (ε = 0.05).





9

0.75 0.80 0.85 0.90 0.95 1.000.0

0.2

0.4

0.6

0.8

1.0

0.75 0.80 0.85 0.90 0.95 1.000.0

0.2

0.4

0.6

0.8

1.0

τΒ

τΑ

τΑ

Threshold

Threshold

(R>0)

(R>0)

0.2

0.2

0.5

0.5

1

1

1.5

1.5

1.9

τΒ

FIG. 5: Secret-key rate R (bits per relay use) as a function ofthe two transmissivities τA and τB . (Top) Rate R(τA, τB) fora pure-loss attack (ε = 0). (Bottom) Rate R(τA, τB , ε) for acoherent Gaussian attack with high excess noise ε = 0.1.

7. Ideal rate in limit configurations

According to Fig. 5, the most interesting scenario iswhen the protocol is implemented in an asymmetric fash-ion with small loss in Alice’s link (τA 1). Therefore, letus analyze what happens in the limit for τA → 1. Assum-ing a fixed loss rate (e.g., 0.2dB/km), this corresponds toAlice approaching the relay. Taking the limit τA → 1 inEq. (66), we find

RτA→1 = h

[1 + (1 − τB)ωB

τB

]− h(ωB) (73)

+ log2

2τB

e(1 − τB)[1 + τB + (1 − τB)ωB ]

.

This is a function of τB and ωB only, as expected sincethe coherent Gaussian attack collapses into an entanglingcloner attack affecting Bob’s link only (with transmissiv-ity τB and thermal noise ωB).

It is important to note that the rate of Eq. (73) is iden-tical to the reverse-reconciliation rate of a point-to-point‘no-switching’ protocol from Alice to Bob which is basedon random coherent states and heterodyne detection [8](see the Supplementary Information of Ref. [9] for check-ing the asymptotic analytical expression of this rate). Itis remarkable that the security performance of such apowerful protocol can be realized in the absence of a di-rect link between Alice and Bob by exploiting the inter-

mediation of an untrusted relay in the proximity of Alice,i.e., the encoder of the secret information. Thanks to theequivalence with reverse reconciliation, we can achieveremarkably long distances for Bob. Ideally, if Bob’s linkwere affected by pure loss only (ωB = 1), then we wouldhave

RlossτA→1 = h

(2 − τB

τB

)+ log2

[τB

e(1 − τB)

], (74)

which goes to zero only for τB → 0, corresponding toBob being arbitrarily far from the relay.

We can also explain why the other asymmetric con-figuration with τB 1 is not particularly profitable (atfixed loss rate this corresponds to Bob approaching therelay). Taking the limit τB → 1 in Eq. (66), we find

RτB→1 = h [τA + (1 − τA)ωA] − h(ωA) (75)

+ log2

2τA

e(1 − τA)[1 + τA + (1 − τA)ωA]

,

which depends on τA and ωA only, as expected, since theattack must reduce to an entangling cloner attack versusAlice’s link. Here it is important to note that Eq. (75)coincides with the direct-reconciliation rate of the point-to-point no-switching protocol [8] (whose asymptotic an-alytical expression can be found in the SupplementaryInformation of Ref. [9]). As we know this rate has alimited range. For instance, in the presence of pure loss(ωA = 1), we have

RlossτB→1 = log2

[τA

e(1 − τA)

], (76)

which is zero at τA 0.73, therefore limiting Alice’s dis-tance from the relay to about 6.8km in standard opticalfibres (0.2dB/km).

It is clear that the symmetric configuration τA = τB :=τ has a performance which must be somehow intermedi-ate between the previous limit cases. More precisely theperformance of the symmetric configuration is compara-ble with that of Bob approaching the relay. In fact, forpure-loss attacks (ωA = ωB = 1), we have the rate inEq. (72), which goes to zero for τ 0.84, therefore re-stricting Alice’s and Bob’s distances from the relay toabout 3.8km in optical fibres (0.2dB/km). This meansthat the overall distance between Alice and Bob cannotexceed 7.6km when the relay is perfectly in the middle.

Finally, it is interesting to note how the Bell detectionreverses the role of the two types of reconciliations. Infact, suppose to have an EPR source very close to Al-ice, who heterodynes one mode in order to encode thesignal variable in the other mode being sent to Bob whois far away. In this scheme, Bob guessing Alice corre-sponds to direct reconciliation. If we now replace theEPR source with a relay performing a Bell detection onincoming modes, the situation is reversed and Bob guess-ing Alice becomes equivalent to reverse reconciliation.





10

F. Computation of the post-relay CM

In this technical section we explicitly compute the for-mula of Eq. (27) for the post-relay CM Vab|γ corre-sponding to the scenario depicted in Fig. 2. At the in-put, Alice’s modes a and A, Bob’s modes b and B, andEve’s modes E1 and E2 are in a tensor-product stateρaA⊗ρbB ⊗σE1E2 , where ρaA = ρbB = ρ is an EPR statewith CM

V(µ) =(

µI µ′Zµ′Z µI

),

µ′ :=√

µ2 − 1,Z := diag(1,−1),

(77)

and σE1E2 is Eve’s zero-mean Gaussian state with CMVE1E2 in the normal form of Eq. (21). The global stateis then a zero-mean Gaussian state with CM

VaAbBE1E2 = V(µ) ⊕ V(µ) ⊕ VE1E2 . (78)

It is helpful to permute the modes so as to have the or-dering abAE1E2B, where the upper-case modes are thosetransformed by the beam splitters. After reordering, theinput CM has the explicit form

VabAE1E2B =

µI 0 µ′Z 0 0 00 µI 0 0 0 µ′Z

µ′Z 0 µI 0 0 00 0 0 ωAI G 00 0 0 G ωBI 00 µ′Z 0 0 0 µI

,

(79)where 0 is the 2 × 2 zero matrix. Now the action ofthe two beam splitters with transmissivities τA and τB isdescribed by the symplectic matrix

S = I ⊕ I ⊕ S(τA) ⊕ S(τB)T, (80)

where the identity matrices I⊕I act on the remote modesa and b, the beam splitter matrix

S(τA) =( √

τAI√

1 − τAI−√

1 − τAI√

τAI

)(81)

acts on modes A and E1, and the transposed beam split-ter matrix S(τB)T acts on modes E2 and B.

The state describing the output modes abA′E′1E

′2B

′

after the beam splitters is a Gaussian state with zeromean and CM equal to

VabA′E′1E′

2B′ = S VabAE1E2B ST . (82)

After some algebra, we get

VabA′E′1E′

2B′ =

Vab W1 W2

WT1 VA′E′

1W3

WT2 WT

3 VE′2B′

, (83)

where the blocks along the diagonal correspond to thereduced CMs Vab = µ(I ⊕ I),

VA′E′1

=(

xAI x′′AI

x′′AI x′

AI

), VE′

2B′ =(

x′BI x′′

BIx′′

BI xBI

), (84)

where we have set (for k = A,B)

xk := τkµ + (1 − τk)ωk, (85)x′

k := τkωk + (1 − τk)µ, (86)

x′′k :=

√τk(1 − τk)(ωk − µ). (87)

The off-diagonal blocks are given by

W1 =(

µ′√τAZ −µ′√1 − τAZ0 0

), (88)

W2 =(

0 0−µ′√1 − τBZ µ′√τBZ

), (89)

and

W3 =( √

(1 − τA)τBG√

(1 − τA)(1 − τB)G√τAτBG

√τA(1 − τB)G

).

(90)Since we are interested in the output CM of Alice and

Bob, we trace out E′1 and E′

2, which corresponds to delet-ing the corresponding rows and columns in the CM ofEq. (83). As a result, we get the following reduced CMfor modes abA′B′

VabA′B′ =

Vab C1 C2

CT1 A D

CT2 DT B

, (91)

where the various blocks are given by

A = xAI, B = xBI, (92)

D =√

(1 − τA)(1 − τB)G, (93)

and

C1 =(

µ′√τAZ0

), C2 =

(0

µ′√τBZ

). (94)

From the CM of Eq. (91) we derive the CM Vab|γ ofthe conditional remote state ρab|γ after the Bell measure-ment on modes A′ and B′. For this derivation, we use thetransformation rules for CMs under Bell-like measure-ments given in Ref. [5]. From the blocks of the CM (91),we construct the following theta matrix

Θ :=12

(ZAZ + B − ZD − DT Z

). (95)

After some simple algebra, we find

Θ =12

(θ 00 θ′

), (96)

whose diagonal elements are given in Eq. (28).Then the conditional CM is given by the formula [5]

Vab|γ = Vab − 12 detΘ

2∑

i,j=1

Ci(XTi ΘXj)CT

j , (97)

where

X1 :=(

0 11 0

), X2 :=

(0 1−1 0

). (98)

After some algebra, we find the expression in Eq. (27).





11

II. EXPERIMENTAL METHODS

In this section we start by providing a general descrip-tion of the experimental setup, discussing the main opti-cal elements involved in the implementation (Sec. II A).Then, in Sec. II B, we give a more detailed mathemati-cal interpretation of the experiment, and we discuss thedata post-processing together with finite-size effects as-sociated with the protocol.

A. General description of the optical setup

In our proof-of-principle experiment we used a highlystable laser at 1064nm which is split in equal portions anddirected to the stations of Alice and Bob, providing themwith a common local oscillator. In a full-field implemen-tation of our protocol, the intensity of the local oscillatorcan be monitored in real-time [10] and suitably filtered soto avoid potential “side-channel” attacks [11]. More gen-erally, in future implementations of continuous variableprotocols, phase-locking of the beams could be achievedby atom-clock synchronization and classical communica-tion between the honest parties. Recently, other poten-tial approaches have also become available [12].

At each of the stations (see Fig. 6), the laser beamsare modulated using amplitude and phase electro-opticalmodulators that are fed by Gaussian modulated sig-nals from independent electronic signal generators. TheGaussian modulations are white within the measurementbandwidth. Prior to modulation, the laser fields werepolarized to a very high degree to ensure pure amplitude(phase) modulation produced by the amplitude (phase)modulator. Furthermore, the transverse profiles of thelaser beams were made as large as possible in the mod-ulator to ensure preservation of their Gaussian profiles.

At the relay, the two beams interfere at a balancedbeam splitter with a very high visibility (99 ÷ 99.5%)and their relative phase is actively controlled with apiezo mounted mirror to produce equally intense out-put beams. These beams are focused onto two balancedhigh-efficiency detectors and the resulting currents aresubtracted and added in order to produce the differenceof the amplitude quadratures and the sum of the phasequadratures, respectively. The overall quantum efficiencyof the relay is around 98%. Note that this method isa simple alternative to the standard eight-port measure-ment setup needed for the continuous-variable Bell detec-tion and is enabled by the brightness of the carrier [13].As the subtraction and addition processes are performedin a software program, an imbalanced hardware-systemcan be compensated during the post-processing (See thenext section for more details).

The measurements are carried out at the sideband fre-quency of 10.5MHz which is well separated from the car-rier frequency thereby avoiding low frequency noise andthus ensuring quantum noise limited performance of the

FIG. 6: Experimental setup (same as Fig. 4 of the maintext). Alice and Bob apply amplitude and phase modulatorsto a pair of identical classical phase-locked bright coherentbeams, providing a common local oscillator and coming froma highly stable laser (not shown). At the output, the twomodes emerge randomly-displaced in the phase space accord-ing to a Gaussian distribution. Alice’s and Bob’s modula-tions are suitably attenuated to simulate loss in their links.Bob’s mode is then phase-shifted and merged with Alice’smode at the relay’s balanced beam splitter. The two outputports are photodetected and processed to realize an equivalentcontinuous-variable Bell measurement.

protocol. The power of the individual laser beams was1.4mW. The signal is mixed down to DC from 10.5MHz,low pass filtered at 100kHz and digitized with a samplingrate of 500kHz and 14bit resolution. As we discuss af-terwards, data blocks are long enough for our secret-keyrate to converge to its asymptotic value.

The modulation depth in Alice’s and Bob’s links wasreduced to simulate the transmission loss. A reductionin modulation is equivalent to a beam splitter inducedtransmission loss because both reduce the power in thesidebands. The difference is that a reduction in modula-tion depth keeps the power of the carrier (with respectto the sidebands) laser beam constant, which was ex-perimentally convenient. This allows us to accuratelysimulate the transmission through the channels and thustest different communication realizations (see the nextsection for more details on this method).

It is important to remark an advantage of our setupwith respect to standard continuous variable protocolswhere systems are unidirectionally transmitted from Al-ice to Bob [10, 14, 15]. In our setup, both Alice and Bobprepare quantum states in their private stations whereloss and noise can be trusted (this assumption of trustednoise is at the basis of measurement-device independentQKD, and guarantees security in the absence of entangle-ment according to Ref. [16]). For this reason, the signalmodulations of Alice and Bob can be set at the outputlevels from their stations, which means that the internal





12

losses can be neglected. Untrusted loss and noise onlyaffect the links and the measurement at the relay, whichhas extremely high efficiencies ( 0.98). These are indeedthe typical efficiencies achievable in teleportation-basedexperiments [17, 18].

By contrast, in standard one-way protocols [10, 14, 15],Alice prepares outgoing quantum states while Bob de-tects incoming states from the channel. As a result,only the loss within Alice’s station can be trusted andtherefore neglected by setting the signal level at Alice’soutput [10]. The loss within Bob’s station cannot be ne-glected, since it is added on top of channel loss and noise:Any re-scaling will affect both Alice’s signal and chan-nel noise without any signal-to-noise advantage. Notethat the internal loss in Bob’s station is typically high,corresponding to a transmissivity of 0.6 according toRef. [10].

B. Detailed mathematical description of theexperiment and data post-processing

Consider the schematic of Fig. 6. The two input classi-cal beams are identical and phase-locked, each providinga bright coherent state with amplitude iL (L 1). Notethat we have complete freedom in choosing the globalphase of this oscillator, which is here set to π just forconvenience of notation.

At the output of the modulators, Alice’s and Bob’sannihilation operators can be written as A = iL + a

and B = iL + b, respectively. Before entering the sec-ond balanced beam splitter at the relay, Bob’s mode isphase-shifted by π/2, so that the two output ports haveroughly the same intensity. This is equivalent to trans-form Alice’s mode as A → iA (since this is a relativeshift, it can be mathematically applied to Alice or Bob).The output ports of the beam splitter are then describedby the following annihilation operators

D0 =iA + B√

2, D1 =

iA − B√2

. (99)

Each output port (k = 0, 1) is measured by a photode-tector with photocurrent ik = ckNk, where Nk = D†

kDk

is the number operator, and ck is an optical-to-currentconversion factor. This factor is different for the two de-tectors, so that they have different levels of electronicshot-noise. To counterbalance this asymmetry, we canre-scale one of the currents by a real factor g. Thus, byre-scaling the currents and taking their sum and differ-ence, we get

Σ± := i0 ± g i1 = c0

(N0 ± rN1

), (100)

where r := gc1/c0. By expanding at the first order in the

local oscillator L, we derive

Σ+

c0= (1 + r)L2 +

L

2[(1 − r)q− + (1 + r)p+] , (101)

Σ−c0

= (1 − r)L2 +L

2[(1 + r)q− + (1 − r)p+] . (102)

The next step is subtracting the offset of the local oscil-lator which is equivalent to subtracting the mean values〈Σ±〉 = c0(1 ± r)L2. The result is normalized dividingby the standard deviation of the vacuum fluctuations

σ± =√⟨

Σ2±⟩vac

− 〈Σ±〉2vac = c0L

√1 + r2

2. (103)

Thus, we get

Σ+ − 〈Σ+〉σ+

= x+r,Σ− − 〈Σ−〉

σ−= x−r, (104)

where

x+r := κ1q− + κ2p+ (105)

is a linear combination q− and p+, with coefficients

κ1 =1 − r√

2(1 + r2), κ2 =

1 + r√2(1 + r2)

. (106)

We can rewrite the linear combination of Eq. (105) as

x+r =1 − r

1 + rκ2q− + κ2p+, (107)

and include the factor κ2 in Alice’s and Bob’s classicalmodulations. In fact, the quantum variables can alwaysbe decomposed as

q− = q− + qvac− , p+ = p+ + pvac

+ , (108)

where q− and p+ are the classical parts, with qvac− and

pvac+ accounting for vacuum noise. Then, we can write

x+r =1 − r

1 + rq− + p+ + δvac

+ , (109)

where δvac+ is vacuum noise and the classical variables

have been re-scaled as

κ2q− → q−, κ2p+ → p+. (110)

This is equivalent to re-scaling Alice’s and Bob’s classicalvariables

κ2

qA

pA

qB

pB

→

qA

pA

qB

pB

, (111)

so that their new variables are Gaussianly-modulatedwith a re-scaled variance κ2

2ϕ → ϕ. Similarly toEq. (109), we derive

x−r = q− +1 − r

1 + rp+ + δvac

− . (112)





13

Thus, the outcome of the relay is generally given by thepair (x−r, x+r) or equivalently γr := (x−r + ix+r)/

√2,

where r is a parameter which can be optimized. Notethat, for r = 1, we have x+1 = p+ and x−1 = q−. Ingeneral, for the presence of quadrature asymmetries andq-p correlations (coming from the cross-talk between theamplitude and phase modulators), the optimal value of rmay be different from 1, e.g., in the range 0.45 ÷ 0.75 inour experiment. This optimization is a simple operationwhich enables us to counterbalance some of the technicalimperfections in our setup. Similar optimizations couldalso be exploited in potential in-field implementations ofthe protocol (given an observed statistics, Alice and Bobcan always assume an optimized relay and ascribe all thenoise to the coherent attack of the links.)

In order to use Eqs. (109) and (112), we need to ac-cess the experimental values of Alice’s and Bob’s opti-cal displacements (qA, pA, qB , pB)T . Therefore we haveto compute the electro-optical gains of the modulators,for both amplitude and phase (i.e., position and mo-mentum on top of the bright local oscillator). Thesegains t1, t2, t3, t4 convert the applied electronic dis-placements Aq,Bq,Ap,Bp into the optical quadraturedisplacements. For their computation, we minimize thefollowing variances

⟨[x−r − t1Aq − t2Bq√

2

]2⟩

, (113)

⟨[x+r − t3Ap + t4Bp√

2

]2⟩

. (114)

Once these gains are known, we can experimentally de-termine the optical displacements of Alice and Bob as

qA = t1Aq, qB = t2Bq, (115)pA = t3Ap, pB = t4Bp. (116)

The classical modulations in the optical quadraturesare approximately equal, with a maximal variance of ϕ 60 vacuum shot-noise units. Note that the experimentalvalue of the modulation must be sufficiently high so thatEve cannot eavesdrop information from her knowledge ofthe outcome of the Bell detection. In our experiment, weare actually not far from the asymptotic limit of largemodulation. This is also evident from the value of theparameter η of Eq. (2) which accounts for the effect of thefinite modulation in the remote state preparation (η 1.01 in the experiment, where η = 1 for ϕ = +∞).

In order to simulate loss in the links, we equiva-lently attenuate the classical modulations ϕA = V (qA) V (pA) and ϕB = V (qB) V (pB). In fact, an ensembleof Gaussianly-modulated coherent states is described byan average state which is thermal with quantum varianceµ = ϕ + 1, where ϕ is the classical modulation and 1 isthe variance of the vacuum noise. By sending a thermalstate with such a variance through a lossy channel withtransmissivity τ , we get the output variance

V = τ(ϕ + 1) + 1 − τ = τϕ + 1. (117)

This is perfectly equivalent to considering a thermalstate with quantum variance τϕ + 1, i.e., Gaussianly-modulated coherent states with reduced modulation τϕ.Our technique is therefore equivalent to the use of beam-splitters for the simulation of lossy channels.

Thus, Alice’s and Bob’s signal output modulations arerespectively taken to be ϕA = τAϕ and ϕB = τBϕ, whereτA and τB are equivalent channel transmissivities. Asexplained in the main text, we have fixed three peculiarconfigurations for Alice (with corresponding transmissiv-ities τA = 0.98, 0.975, and 0.935), and we have suitablyvaried Bob’s transmissivity τB .

Mathematically, in our experiment we realize the con-ditions

x−r √

τAqA −√τBqB√

2+

1 − r

1 + r

√τApA +

√τBpB√

2+ δvac

− ,

(118)

x+r 1 − r

1 + r

√τAqA −√

τBqB√2

+√

τApA +√

τBpB√2

+ δvac+ ,

(119)

which connect Alice’s amplitude α := (qA+ipA)/2, Bob’samplitude β := (qB + ipB)/2, and the relay outcomeγr := (x−r + ix+r)/

√2. One can easily check that, for

r = 1, the previous Eqs. (118) and (119) become

q− √

τAqA −√τBqB√

2+ δvac

− , (120)

p+ √

τApA +√

τBpB√2

+ δvac+ . (121)

For any experimental value of τA and τB , we have con-sidered an optimized relay (with optimal r published)and collected 108 values of α, β and γr. Numerically,we have found that the asymptotic value of the rate isreached at 106 rounds (which means that the partiesrapidly reach the asymptotic regime, where the finite-sizeeffects can be considered to be small). The values of τA

and τB are accessible to Alice and Bob by computing andcomparing the first moments of their data which must fol-low Eqs. (118) and (119). The parties can also derive theglobal classical CM V(qA, pA, qB , pB , x−r, x+r) by com-paring a subset of their data. Once this is known, theycan derive the secret key rate of the protocol.

Let us show the details for deriving the experimentalkey rate from the global CM V(qA, pA, qB , pB , x−r, x+r).The first step is to perform the Gaussian elimination ofthe relay variables in order to construct the conditionalCM Vcond := V(qA, pA, qB , pB |γr) according to Eqs. (11)and (12). This conditional matrix has still some asym-metries in the quadratures plus residual q-p correlations.These imperfections can be counterbalanced by Alice andBob by performing local rotations and re-scalings of theirclassical data α and β. By means of these local sym-plectic transformations, the conditional matrix is trans-formed into a normal form

Vcond =(

A CCT B

)→

(aI cZcZ bI

), (122)





14

where a =√

detA, b =√

detB and c is determinedby computing the other two symplectic invariants detVand detA+detB+2detC. It is important to note thatthis symmetrization does not require any further classi-cal communication between Alice and Bob, since it is adeterministic operation to be applied to the experimen-tal data that the parties have already acquired duringthe noise estimation (typical step in any QKD protocol).Since this is a one-to-one deterministic transformationoccurring in Alice’s and Bob’s private spaces, there is noadvantage or disadvantage in security.

Once Alice and Bob have symmetrized the conditionalCM, they derive the quantum CM Vab|γr

in the equiv-alent entanglement-based representation of the protocol.According to Eq. (14) and (15), this is given by

Vab|γr= η2Vcond − I, (123)

where η is the parameter of Eq. (2). From Vab|γrthey

can easily extract the reduced CM Vb|γrand compute

the doubly-conditional CM Vb|γrα via Eq. (17) or (18).These matrices provide Alice and Bob’s mutual informa-tion IAB according to Eqs. (36) and (37). Then, we com-pute Eve’s Holevo information IE using Eq. (42), wherethe entropies of ρab|γr

and ρb|γrα are computed from thesymplectic spectra of Vab|γr

and Vb|γrα, respectively. Fi-nally, we can derive the experimental rate R = ξIAB−IE ,where the reconciliation efficiency ξ is chosen to have dif-ferent values: ξ = 1 for ideal reconciliation, ξ 97% forachievable reconciliation [19], and ξ 95%.

The corresponding experimental rates are plotted inthe main text and compared with the theoretical curves.According to these final results, our experimental datais affected by an excess noise ε 0.01, coming from in-evitable imperfections of the setup which are not underour control. This excess noise must be ascribed to theeavesdropper who is therefore assumed to perform a gen-eral two-mode Gaussian attack against the protocol.

III. DISCUSSION

A. Network topologies

In this section we better explain how our protocolcan be used in a quantum network topology. It is un-derstood that we are considering metropolitan networkswith fibre-links of intracity lengths (overall limited toaround 25 km). It is also clear, from our study, thatthe optimal configurations are asymmetric, i.e., with oneof the parties relatively closer to a relay (within a radiusof 4 km in standard optical fibre). In these conditions,the key rates achievable are very high compared to qubit-based implementations (as explained in the main paper).

One simple application is the star network, where Al-ice connects to the untrusted relay (e.g., a public accesspoint) with a short fibre-link ( 4 km) or a free-spaceoptical link. The relay is then the hub of a star network

with longer fibre-links ( 25 km) which are connectedwith different possible recipients or ‘Bobs’, as shown inFig. 7(a). More generally, we may think a metropolitannetwork composed by a backbone of untrusted relays, asshown in Fig. 7(b). Here, two end-users may decide whichrelay is better to be connected to in order to exchange asecret key.

As shown in the example of Fig. 7(b), each party isclose to a different untrusted relay. If they choose Relay1

(close to Alice), then our protocol must be run with Al-ice being the encoder and Bob the decoder of the secretinformation. By contrast, if they choose Relay2 (close toBob), then Bob must be the encoder and Alice the de-coder. Potentially, both the relays could be used by theparties running two parallel sessions of the protocol withthe correct reconciliation directions.

In general, our protocol could also be exploited inlarge quantum networks, where the intermediate nodesbetween the two end-users are partly trusted and partlyuntrusted. Let us assume that the chain of nodes be-tween Alice and Bob can be decomposed into trustednodes (Charlies) alternated by untrusted relays, as shownin Fig. 7(c). Let us assume that n is the number of relays,so that we have a total of n − 1 Charlies between Aliceand Bob (total number of nodes of the chain is 2n + 1).

Our protocol can be run between the following npairs: (Alice, Charlie1), (Charlie1, Charlie2), (Charlie2,Charlie3), . . . , (Charlien−1, Bob). This means that wecan extract n temporary keys

KAC1 , KC1C2 , KC2C3 , . . . , KCn−1B,between the trusted parties. Such keys can progressivelybe composed to derive a final secret key for Alice andBob. For instance, Charlie1 sends KAC1 ⊕ KC1C2 toCharlie2, who therefore decrypts KAC1 . The latter isthen encrypted with KC2C3 and sent to Charlie3 and soon, reaching Bob in n − 1 steps.

Note that, assuming a fully-trusted network with 2n+1nodes performing point-to-point sessions, the number oftemporary keys would be 2n, followed by 2n − 1 furthersteps to connect the end-users. Thus, the use of ournetwork protocol not only allows one to remove the trustfrom about half of the nodes of a large network, but alsoto halve the number of temporary keys and the amountof post-processing needed to extract the final shared key.

B. Note added

After the posting of our manuscript on public preprintservers (arXiv:1312.4104), other papers were posted [20,21]. These papers are theoretical-only and do not rigor-ously extend measurement-device independence to con-tinuous variables. In fact, this extension requires anexplicit proof suitable for infinite-dimensional Hilbertspaces, which includes the use of results valid for Gaus-sian states. Furthermore, these papers [20, 21] erro-





15

FIG. 7: Network topologies of interest for our protocol. Panel a shows the star network topology where Alice connects to anearby untrusted relay (e.g., a public access point or proxy server) to securely communicate with one of the remote Bobs. Panelb shows a network with a backbone of untrusted relays that two users may exploit to securely communicate. The exampleshows two possibilities for communicating: If the parties connect to Relay1 close to Alice (solid lines), then Alice’s variable isthe secret variable to be estimated (i.e., Alice is the encoder and Bob is the decoder); otherwise, if they connect to Relay2 closeto Bob (dashed lines), then Bob’s is the secret variable to be estimated (i.e., Bob is the encoder and Alice is the decoder). Panelc shows the two end-users, Alice and Bob, connected by a chain of nodes, partly untrusted (the relays) and partly trusted (theCharlies). See text for more explanations.

neously restrict their security analysis to a very specificeavesdropping strategy, i.e., the use of two independententangling-cloners.

We have also noticed attempts to improve the per-formances of discrete-variable measurement-device inde-

pendent QKD by resorting to a different strategy calleddetector-device independent QKD [22–24]. However, thisis again a point-to-point scheme and, moreover, seems tobe vulnerable to a powerful trojan-horse attack [25].

[1] Weedbrook, C. et al. Gaussian quantum information.Rev. Mod. Phys. 84, 621 (2012).

[2] Garcıa-Patron, R. & Cerf, N. J. Unconditional optimalityof gaussian attacks against continuous-variable quantumkey distribution. Phys. Rev. Lett., 97, 190503 (2006).

[3] Pirandola, S., Vitali, D., Tombesi, P. & Lloyd, S. Macro-scopic entanglement by entanglement swapping. Phys.Rev. Lett. 97, 150403 (2006).

[4] Picinbono, B. Second-order complex random vectors andnormal distributions. IEEE Trans. Sig. Proc. 44, 2637–2640 (1996).

[5] Spedalieri, G., Ottaviani, C. & Pirandola, S. Covariancematrices under Bell-like detections. Open Syst. Inf. Dyn.20, 1350011 (2013).

[6] Pirandola, S., Serafini, A. & Lloyd, S. Correlation ma-trices of two-mode bosonic systems. Phys. Rev. A 79,052327 (2009).

[7] Pirandola, S. Entanglement reactivation in separable en-vironments. New J. Phys. 15, 113046 (2013).

[8] Weedbrook, C. et al. Quantum cryptography withoutswitching. Phys. Rev. Lett. 93, 170504 (2004).

[9] Pirandola, S., Mancini, S., Lloyd, S. & Braunstein,S. L. Continuous-variable quantum cryptography withtwo-way quantum communication. Nature Phys. 4, 726(2008).

[10] Lodewyck, J. et al. Quantum key distribution over 25 kmwith an all-fiber continuous-variable system. Phys. Rev.

A 76, 042305 (2007).[11] Braunstein, S. L. & Pirandola, S. Side-channel-free quan-

tum key distribution. Phys. Rev. Lett. 108, 130502(2012).

[12] Qi, B., Lougovski, P., Pooser, R., Grice, W. & Bobrek,M. Generating the local oscillator locally in continuous-variable quantum key distribution based on coherent de-tection. Preprint arXiv :1503.00662 (2015).

[13] Niset, J. et al. Superiority of entangled measurementsover all local strategies for the estimation of product co-herent states. Phys. Rev. Lett. 98, 260404 (2007).

[14] Grosshans, F. et al. High-rate quantum cryptography us-ing Gaussian-modulated coherent states. Nature (Lon-don) 421, 238 (2003).

[15] Jouguet, P., Kunz-Jacques, S., Leverrier, A., Grangier,P. & Diamanti, E. Experimental demonstration of long-distance continuous-variable quantum key distribution.Nature Photon. 7, 378–381 (2013).

[16] Pirandola, S. Quantum discord as a resource for quantumcryptography. Sci. Rep. 4, 6956 (2014).

[17] Yonezawa, H., Braunstein, S. L. and Furusawa, A. Ex-perimental demonstration of quantum teleportation ofbroadband squeezing. Phys. Rev. Lett. 99, 110503 (2007).

[18] Yokoyama, S. et al. Ultra-large-scale continuous-variablecluster states multiplexed in the time domain. NaturePhoton. 7, 982–986 (2013).

[19] Jouguet, P., Kunz-Jacques, S., & Leverrier, A. Long-

15

FIG. 7: Network topologies of interest for our protocol. Panel a shows the star network topology where Alice connects to anearby untrusted relay (e.g., a public access point or proxy server) to securely communicate with one of the remote Bobs. Panelb shows a network with a backbone of untrusted relays that two users may exploit to securely communicate. The exampleshows two possibilities for communicating: If the parties connect to Relay1 close to Alice (solid lines), then Alice’s variable isthe secret variable to be estimated (i.e., Alice is the encoder and Bob is the decoder); otherwise, if they connect to Relay2 closeto Bob (dashed lines), then Bob’s is the secret variable to be estimated (i.e., Bob is the encoder and Alice is the decoder). Panelc shows the two end-users, Alice and Bob, connected by a chain of nodes, partly untrusted (the relays) and partly trusted (theCharlies). See text for more explanations.

neously restrict their security analysis to a very specificeavesdropping strategy, i.e., the use of two independententangling-cloners.

We have also noticed attempts to improve the per-formances of discrete-variable measurement-device inde-

pendent QKD by resorting to a different strategy calleddetector-device independent QKD [22–24]. However, thisis again a point-to-point scheme and, moreover, seems tobe vulnerable to a powerful trojan-horse attack [25].

[1] Weedbrook, C. et al. Gaussian quantum information.Rev. Mod. Phys. 84, 621 (2012).

[2] Garcıa-Patron, R. & Cerf, N. J. Unconditional optimalityof gaussian attacks against continuous-variable quantumkey distribution. Phys. Rev. Lett., 97, 190503 (2006).

[3] Pirandola, S., Vitali, D., Tombesi, P. & Lloyd, S. Macro-scopic entanglement by entanglement swapping. Phys.Rev. Lett. 97, 150403 (2006).

[4] Picinbono, B. Second-order complex random vectors andnormal distributions. IEEE Trans. Sig. Proc. 44, 2637–2640 (1996).

[5] Spedalieri, G., Ottaviani, C. & Pirandola, S. Covariancematrices under Bell-like detections. Open Syst. Inf. Dyn.20, 1350011 (2013).

[6] Pirandola, S., Serafini, A. & Lloyd, S. Correlation ma-trices of two-mode bosonic systems. Phys. Rev. A 79,052327 (2009).

[7] Pirandola, S. Entanglement reactivation in separable en-vironments. New J. Phys. 15, 113046 (2013).

[8] Weedbrook, C. et al. Quantum cryptography withoutswitching. Phys. Rev. Lett. 93, 170504 (2004).

[9] Pirandola, S., Mancini, S., Lloyd, S. & Braunstein,S. L. Continuous-variable quantum cryptography withtwo-way quantum communication. Nature Phys. 4, 726(2008).

[10] Lodewyck, J. et al. Quantum key distribution over 25 kmwith an all-fiber continuous-variable system. Phys. Rev.

A 76, 042305 (2007).[11] Braunstein, S. L. & Pirandola, S. Side-channel-free quan-

tum key distribution. Phys. Rev. Lett. 108, 130502(2012).

[12] Qi, B., Lougovski, P., Pooser, R., Grice, W. & Bobrek,M. Generating the local oscillator locally in continuous-variable quantum key distribution based on coherent de-tection. Preprint arXiv :1503.00662 (2015).

[13] Niset, J. et al. Superiority of entangled measurementsover all local strategies for the estimation of product co-herent states. Phys. Rev. Lett. 98, 260404 (2007).

[14] Grosshans, F. et al. High-rate quantum cryptography us-ing Gaussian-modulated coherent states. Nature (Lon-don) 421, 238 (2003).

[15] Jouguet, P., Kunz-Jacques, S., Leverrier, A., Grangier,P. & Diamanti, E. Experimental demonstration of long-distance continuous-variable quantum key distribution.Nature Photon. 7, 378–381 (2013).

[16] Pirandola, S. Quantum discord as a resource for quantumcryptography. Sci. Rep. 4, 6956 (2014).

[17] Yonezawa, H., Braunstein, S. L. and Furusawa, A. Ex-perimental demonstration of quantum teleportation ofbroadband squeezing. Phys. Rev. Lett. 99, 110503 (2007).

[18] Yokoyama, S. et al. Ultra-large-scale continuous-variablecluster states multiplexed in the time domain. NaturePhoton. 7, 982–986 (2013).

[19] Jouguet, P., Kunz-Jacques, S., & Leverrier, A. Long-





16

distance continuous-variable quantum key distributionwith a Gaussian modulation. Phys. Rev. A 84, 062317(2011).

[20] Li, Z., Zhang, Y.-C., Xu, F., Peng, X. & Guo, H.Continuous-Variable Measurement-Device-IndependentQuantum Key Distribution. Preprint arXiv :1312.4655(2013).

[21] Ma, X.-C., Sun S.-H., Jiang, M.-S., Gui, M. & LiangL.-M. Gaussian-modulated coherent-state measurement-device-independent quantum key distribution. PreprintarXiv :1312.5025 (2013).

[22] Gonzalez P. et al., Quantum key distribution with un-trusted detectors. Preprint arXiv :1410.1422 (2014).

[23] Lim, C. C. W. et al. Detector-Device-Independent Quan-tum Key Distribution. Preprint arXiv :1410.1850 (2014).

[24] Cao, W.-F. et al. Highly Efficient Quantum Key Dis-tribution Immune to All Detector Attacks. PreprintarXiv :1410.2928 (2014).

[25] Qi, B. Trustworthiness of detectors in quantumkey distribution with untrusted detectors. PreprintarXiv :1410.3685 (2014).





SUPPLEMENTARY INFORMATION · follow the notation of Ref. [1], where [ˆq,pˆ]=2 i (i.e., ˜ = 2) so...

Documents

Transcript of SUPPLEMENTARY INFORMATION · follow the notation of Ref. [1], where [ˆq,pˆ]=2 i (i.e., ˜ = 2) so...