## 5 Imperfections and Side Channels in Practical CVQKD
### Detection  
The proposed side-channel attacks targeting the coherent detectors employed in CVQKD systems exploit either the nonlinear behavior of these detectors that can lead to their saturation [81] or the dependence of the beam splitter included in both homodyne and heterodyne detectors on the wavelength of the incoming signal [82, 83]. A wavelength filter is effective against the second attack, but a more general solution consists again in performing the real-time shot noise measurement analyzed in [78]. In fact, this countermeasure defeats all currently known attacks on the detection apparatus for CVQKD protocols with Gaussian modulation. The security issues that we have discussed highlight the importance of refining security proofs of CVQKD protocols to consider practical imperfections as a means to bypass attacks based on improperly-modeled devices and procedures. Although this approach is of great practical relevance, it may be difficult in practice to identify all possible side channels present in experimental systems. A more radical approach to overcome side-channel attacks is the so-called device-independent QKD [84, 85], where the security is guaranteed by the violation of a Bell inequality: intuitively, if [PERSON] and [PERSON] maximally violate the Clauser-Horne-Shimony-Holt (CHSH) inequality [86], then they necessarily share a maximally-entangled state, and the eavesdropper cannot have any information about their measurement results. Unfortunately, an implementation of device-independent QKD requires a loophole-free violation, a feat not yet achieved in the lab. Interestingly, a much more practical variant, named measurement device-independent (MDI) QKD, is available and offers protection against all side-channel attacks targeting the detectors of the QKD implementation; [87] considered an MDI-QKD protocol using weak coherent pulses and decoy states, while [88] considered a MDI-QKD protocol in the entanglement-based representation with general finite-dimensional systems. These results were recently extended to continuous variables in [89, 90], which provide an unconditional security proof in the asymptotic limit (see also [91, 92] for a more restricted security analysis). In MDI-QKD, [PERSON] and [PERSON] both prepare and send some states through quantum channels to a third party, [PERSON], who performs an entangled measurement and announces his measurement result publicly. Conditioned on this classical information, [PERSON] and [PERSON]'s data become correlated, and one might try to use them to extract a secure key. This scheme can be interpreted as a time-reversal of a QKD protocol, where [PERSON] would send bipartite entangled states to [PERSON] and [PERSON]. In particular, the security of the key does not require that [PERSON] is trusted: if [PERSON] sends erroneous data, the correlations between [PERSON] and [PERSON]'s data will not be sufficient to allow for the extraction of a key, and the protocol will simply abort. This means that a side-channel attack can only be applied against [PERSON] and [PERSON]'s preparation procedures, which are typically easier to model properly than the detection stage. In the continuous-variable version of MDI-QKD, [PERSON] and [PERSON] can, for instance, prepare coherent states with a Gaussian modulation and send them to [PERSON], who mixes them on a balanced beam splitter, measures a different quadrature for both output modes and publicly announces his measurement results. [PERSON] and [PERSON] can then update their data using [PERSON]'s information in order to obtain correlated continuous variables (see [89] for details). The security of CV MDI-QKD can be analyzed by considering the entanglement-based version of the protocol. In that case, both [PERSON] and [PERSON] prepare a two-mode squeezed vacuum state, keep one half of their state and send the second half to [PERSON]. Once [PERSON] has measured his two modes and communicated his measurement result, [PERSON] and [PERSON] can apply suitable displacements to their respective modes.