info.eps
Tight bound on coherent states quantum key distribution with heterodyne detection
Jérôme Lodewyck1, 2 and Philippe Grangier2
Thales Research and Technologies, RD 128, 91767 Palaiseau Cedex, France
Laboratoire Charles Fabry de l’Institut d’Optique, CNRS UMR 8501,
Campus Universitaire, bâtiment 503, 91403 Orsay Cedex, France
We propose a new upper bound for the eavesdropper’s information in the direct and reverse
reconciliated coherent states quantum key distribution protocols with heterodyne detection. This
bound is derived by maximizing the leaked information over the symplectic group of transformations
that spans every physical Gaussian attack on individual pulses. We exhibit four different attacks
that reach this bound, which shows that this bound is tight. Finally, we compare the secret key
rate obtained with this new bound to the homodyne rate.
I. INTRODUCTION
Continuous variable quantum key distribution
(CVQKD) is an alternative to single photon “discrete”
QKD that encodes key information in variables with
a continuum of degrees of freedom. Such variables
include the quadratures X and P of a mode of the
electromagnetic field. A CVQKD protocol using these
quadratures has been introduced in [1]. It consists in
sending a train of pulsed coherent states modulated in
X and P with a Gaussian distribution (Alice’s module),
and in quadrature measurements with an homodyne
detection upon reception (Bob’s module). Then, Bob’s
continuous data are used as the basis for constructing
a secret binary encryption key, in a classical informa-
tion process called “reverse reconciliation” (RR). The
security of the RRCVQKD homodyne protocol has first
been proven against individual Gaussian attacks [1], and
later extended to individual or finite-size non-Gaussian
attacks [2]. More recently, new security proofs covering
collective, Gaussian and non-Gaussian attacks [3, 4]
have appeared.
In the homodyne protocol [1], Bob randomly chooses
to measure either X or P , and then announces his choice.
Another possible approach, proposed in [5] by Weed-
brook and co-workers, is that Bob measures both X and
P quadratures of each incoming coherent state, by sepa-
rating them on a 50-50 beam-splitter TB. This detection,
called “heterodyne” is represented in Fig. 1. Notably, in
this protocol, Bob does not need to randomly switch his
measurement basis.
Alice
FIG. 1: Heterodyne protocol. Bob measure both quadratures
X and P of the incoming mode B′. A generic eavesdropping
strategy involves a transformation S on Alice’s mode and two
vacuum ancillary modes.
In [5], the authors proposed a bound on the informa-
tion acquired by the eavesdropper (Eve) in the hetero-
dyne protocol, under the hypothesis of individual Gaus-
sian attacks. They also considered a possible attack
based on feed-forward (see below for details), that they
however found to be suboptimal with respect to their
proposed bound. Therefore, a gap remained between the
apparently most stringent bound and the best known at-
tack, which is surprising in the simple scenario of individ-
ual Gaussian attacks. Later on, in [6], the same authors
conjectured that their proposed attack is indeed optimal,
and so that tighter bounds should apply to Eve’s infor-
mation. However, no such tighter bound was proposed
so far.
In this article, we propose a new bound for individual
Gaussian attacks on the CVQKD heterodyne protocols,
tighter than the bound of [5]. In addition, we explic-
itly present a series of attacks which are optimal with
respect to this bound, closing the gap between the best
known attacks and the tightest known bound. The ar-
ticle is organized as follows: after introducing notations
in section II, the new bounds are derived in section III.
In section IV, we extend the technique used to estab-
lish these bounds to obtain new results about the homo-
dyne protocols. Specifically, we will show that any ho-
modyne attack using quantum memory is optimal, and
that in some cases this optimality can be reached without
quantum memory. Section V is devoted to another tech-
nique, based on symplectic invariants, which allows us
to derive again the new heterodyne bounds from another
point of view. Then section VI describes four optimal
attacks with respect to the new heterodyne bound, and
section VII concludes our study by discussing practical
advantages of the heterodyne protocol.
II. NOTATIONS
In the case of Gaussian attacks, the channel linking
Alice to Bob is fully characterized by its transmission in
intensity T (possibly greater than 1 for amplifying chan-
nels), and its excess noise ǫ above the shot noise level [7],
such that the total noise measured by Bob is (1+T ǫ)N0,
where N0 is the shot noise variance appearing in the
http://arxiv.org/abs/0704.1371v1
Heisenberg relation 〈X2〉〈P 2〉 ≥ N20 . Alternatively we
will make use of the total added noise referred to the in-
put χ defined by χ = 1/T+ǫ−1. These parameters might
depend on the quadrature considered, in which case we
will add a subscript indicating this quadrature (e.g. χP ).
The quantum channel is considered to be probed
by Eve with the help of ancillary modes. To index
these modes, we will note XM and PM the quadra-
tures of mode M , and write down the 2n quadra-
tures of n modes M1, . . . ,Mn by the vector Q =
(XM1 , . . . , XMn , PM1 , . . . , PMn). The total Gaussian
state of the system is then represented by its covariance
matrix γ of components γi,j = 〈QiQj〉.
In the heterodyne protocol, we note B the modes mea-
sured by Bob, and B′ the incoming beam, on which we
will base our demonstrations. This mode is coupled with
two ancillas on which Eve respectively measures X and
P (Fig. 1). In [5], the authors bounded the conditional
variance VXB′ |XE1 and VPB′ |PE2 of the mode B
′ knowing
Eve’s measurement results by
V minB′|E =
T (1 + χV )
N0, (1)
where (V − 1)N0 is Alice’s modulation variance. This
is basically the homodyne RR bound derived in [1, 8]
applied to each quadrature X and P .
Assuming that Eve does not control the beam-splitter
TB, this bound then leads to the minimal conditional
variance of mode B knowing Eve’s measurement by
adding the shot noise unit and the intensity decrease in-
troduced by the beam-splitter TB:
VB|E =
VB′|E +N0
. (2)
Then the information acquired by Eve results from VB|E :
IBE = 2×
with VB =
T (V + χ) + 1
where the factor 2 reflects the double quadrature mea-
surement. A similar reasoning on IAB finally gives the
secret rate ∆I = IAB − IBE . This rate is shown to be
greater than the homodyne rate for any channel parame-
ter, giving advantage to the heterodyne detection scheme.
Several explicit attacks against the heterodyne proto-
col have been considered. In [5], the authors propose
an eavesdropping strategy based on heterodyne measure-
ment and feed-forward (Fig. 2-1), which they numeri-
cally show to be suboptimal with respect to bound (1).
In [9], Namiki et al. introduce an eavesdropping strat-
egy against the homodyne RRCVQKD protocol based
on a cloning machine (Fig. 2-2). In this attack, Eve
can measure both X and P quadratures of each coher-
ent state, then requiring no quantum memory. The price
to pay is that this attack is no more optimal with re-
spect to the homodyne bound (1). In fact, the search
for quantum-memory-less homodyne attacks is very sim-
ilar to finding attacks on the heterodyne protocol because
Alice
Alice
Alice
Alice Bob
EPR pair
EPR pair
1/2(4)
FIG. 2: Our general results are illustrated by considering four
optimal attacks against the heterodyne protocol. In the feed-
forward attack (1), Eve taps a fraction 1 − TE of the signal
on which she makes an heterodyne measurement. Then she
translates Bob’s quadratures according to her measurement
results modified by a gain gE. In the cloning attack (2), Eve
amplifies the signal sent by Alice with a phase insensitive am-
plifier, and taps the amplified beam. Quantum teleportation
(3) consist in a making the incoming beam interfere with a
part of an EPR pair. X and P are measured in the output
arms of the interferometer. Bob’s quadratures are then trans-
lated according to Eve’s results. Finally, in the entangling
cloner attack (4), Eve tap a fraction 1 − TE of the incoming
signal, while introducing some excess noise with the help of
an EPR pair. The joint measurement of the tapped signal
and the other part of the EPR pair optimally exploits both
tapped signal and EPR noise correlations.
both schemes require that Eve measuresX and P on each
channel symbol. Therefore, the cloning attack is yet an-
other sub-optimal attack against the heterodyne protocol
when considering bound (1). We shall prove in this ar-
ticle that these two attacks are optimal with respect to
the new bounds we derive for the heterodyne protocol, as
well as two other attacks based on EPR entanglement.
III. NEW BOUNDS BASED ON THE IWASAWA
SYMPLECTIC DECOMPOSITION
To derive the new bounds on heterodyne detection pro-
tocols, we will use the symplectic formalism which de-
scribes all physically possible Gaussian individual trans-
formations on a set of n modes. The real symplectic
group is defined by the set of linear transformations of
the quadrature vectorQ, which 2n×2nmatrix S satisfies
SβST = β, with β =
−In 0
, (3)
where In is the n × n identity matrix. The main idea
of our demonstration is to use a proper parameterization
that spans all symplectic transformations applied to the
modes going through the quantum channel, hence all pos-
sible attacks, and to compute the best information Eve
can obtain when these parameters vary.
The real symplectic group is a n(2n + 1) parameters
space for which various parameterizations – or decom-
positions – exist. We choose the Iwasawa decomposi-
tion [10], which uniquely factorizes any 2n× 2n symplec-
tic matrix S as the product of 3 special matrices:
0 D−1
where B + iF is a n × n unitary matrix, D is diagonal
with strictly positive components, A is lower triangular
with all diagonal terms set to 1, and ATC is symmetric.
In our study, we consider 3 modes, depicted in Fig. 1.
The first one, noted B′ is send from Alice to Bob, who
performs an heterodyne measurement upon reception.
Eve makes this mode interact with two ancillary modes
E1 and E2 initially in the vacuum state, and then mea-
sures X on E1, and P on E2. To respect the symmetry
of this problem, we only consider symplectic transforma-
tions S that do not mix X and P quadratures:
. (5)
As B, D and A are invertible, expanding S yields F =
C = 0, and B orthogonal. We recall that the columns
of the orthogonal matrix B, as well as its rows, form an
orthonormal basis. With this form, the Iwasawa decom-
position has a physical meaning in terms of linear optical
components. Namely, any symplectic transformation is
composed of an orthogonal transformation which is it-
self a composition of rotations (i.e. beam-splitters) and
reflections (i.e. π-phase shifts), 1-mode squeezers, and
feed-forward.
Finally, we can write the Iwasawa decomposition cor-
responding to our attack model:
1 0 0
a 1 0
b c 1
s1 0 0
0 s2 0
0 0 s3
b1 b2 b3
b4 b5 b6
b7 b8 b9
 (6)
1 −a δ
0 1 −c
0 0 1
s−11 0 0
0 s−12 0
0 0 s−13
b1 b2 b3
b4 b5 b6
b7 b8 b9
with δ = ac − b. The orthogonal matrix B can be pa-
rameterized by 3 real parameters (Euler angles) plus a
binary parameter (the sign of the determinant). This
leaves 9 real and one discrete symplectic parameters to
characterize the matrix S. By expanding S and using
orthogonality properties of B, we can express channel
parameters as functions of these symplectic parameters:
TX = t
X with tX = S1,1 = s1b1
TP = t
P with tP = S4,4 =
− ab4
2 + S1,3
2 + S4,6
We note that s1 and b1 are equivalent to channel pa-
rameters TX and χX. As we are looking for the best
attack for given channel parameters, we will consider s1
and b1 fixed. Our attacks are then characterized by 7
real and one discrete parameters.
The input covariance matrix γi is diagonal with di-
agonal terms (V, 1, 1, V, 1, 1)N0. The output covariance
matrix is expressed as γ = SγiST. From S and γ, we
obtain Eve’s noises and conditional variances
2 + S2,3
r2 + 1
(rb1 + b4)2
2 + S6,6
1− b21 − b24
VXB′ |XE1
= γ1,1 −
γ1,2γ2,1
r2 + 1
(V χPE2
+ 1)(χXE1
(V + χXE1
)(χPE2
VPB′ |PE2
= γ4,4 −
γ4,6γ6,4
r2 + 1
(V χXE1
+ 1)(χPE2
(V + χPE2
)(χXE1
where r = as1/s2. All these quantities only depend on
parameters r and b4: our parameter space drops to 2
parameters.
Then, we will require that the attack leaves channel
parameters symmetric in X and P , i.e. TX = TP ≡ T
and χX = χP ≡ χ. The former relation univocally fixes
δ = s3(b1(s
1 − 1)/s1 + ab4/s2)/b7, and the later fixes r:
b1b4(1 − s21) + σ
(1− b21 − b24)ρ
1− b21
. (9)
where σ = ±1 and ρ = (s21 − 1)(1 − s21(2b21 − 1)). In
terms of channel parameters, ρ = (Tχ)2 − (1− T )2. For
a symmetric channel, the Heisenberg inequality requires
that ρ ≥ 0 [11], therefore r is well defined for any attack
that can be made symmetric. Finally, we are left with
only one parameter, b4, such that b
4 < 1−b21 = χ/(1+χ),
and the sign σ.
For RR, the information Eve acquires is given by
IBE =
VXB |XE1
VPB |PE2
IBE is maximum when (VXB′ |XE1 + 1)(VPB′ |PE2 + 1) is
minimum. For direct reconciliation (DR), for which the
key is distilled from Alice’s data, the information Eve
acquires is given by the Shannon formula:
IAE =
V + χXE1
1 + χXE1
V + χPE2
1 + χPE2
We find that both mutual informations IAE and IBE
have an extremum at
b4 = σ
1− s21(2b21 − 1)−
b21(s
1 − 1)
s21 + 1
We check numerically that in the quantum regime de-
fined by ǫ ≤ 2, this extremum is indeed the absolute
maximum. For this value of b4, we compute Eve’s noise
and conditional variance as functions of channel param-
eters:
= χPE2
≡ χmin
T (2− ǫ)2
2− 2T + T ǫ+
+1 (11)
VXB′ |XE1 = VPB′ |PE2 ≡ V
B′|E =
V χE + 1
V + χE
N0 (12)
These expressions form the new bounds for direct and
reverse reconciliated heterodyne protocols. As they are
obtained for the same value of b4, any attack that reaches
bound (11) (i.e. optimal for DR) also reaches bound (12)
(i.e. optimal for RR).
IV. APPLICATION TO THE HOMODYNE
DETECTION PROTOCOL
In this section, we will show that bound (1) on the
homodyne protocol can also be derived from the Iwa-
sawa symplectic decomposition. In the homodyne pro-
tocol, Eve stores the quantum states of mode E1 and
mode E2 in quantum memories, waiting for Bob’s mea-
surement basis disclosure. After this, Eve can measure
the same quadrature Q = X or P chosen by Bob on
both modes. The information acquired by Eve in the RR
homodyne protocol is deduced from the conditional vari-
ance on Bob’s measurement knowing the quadrature Q
of modes E1 and E2, which can be computed from the
output covariance matrix γ:
VQB′ |QE1 ,QE2 =
det(γQ)
det(γE)
, (13)
where γQ is the restriction of γ to the quadrature Q, and
γE is the restriction of γ to the quadrature Q of Eve’s
modes E1 and E2. By expanding the Iwasawa decompo-
sition of the symplectic transformation S decribing the
attack, and by using orthogonality properties of matrix
B, we can express this conditional variance as:
VQB′ |QE1 ,QE2 =
TQ′(V χQ′ + 1)
N0, (14)
where Q′ = P or X is the quadrature not measured by
Bob. This conditional variance coincides with the homo-
dyne bound (1). It is important to note that contrary
to the heterodyne conditional variance which depends
on symplectic parameters r and b4 as shown by equa-
tions (8), the homodyne conditional variance (14) only
depends on channel parameters, but no other symplectic
parameter characterizing the attack
The DR case is treated similarly, by considering the
covariance matrix γAE that gathers the modulation value
chosen by Alice (XA, PA) and modes E1 and E2 owned
by Eve. By expanding the Iwasawa decomposition of S,
we find
VQA|QE1 ,QE2 =
det(γAEQ )
det(γE)
(V − 1)(1 + χQ′)
V χQ′ + 1
N0, (15)
which yields
IAE =
(V − 1)N0
VQA|QE1 ,QE2
V + χhom
1 + χhom
with χhom
= 1/χQ′. This expression matches the highest
bound for the information acquired by Eve in the DR
homodyne protocol established in [12]. It depends only
on channel parameters, and not on the other symplectic
parameters.
Therefore, we have shown any attack against the DR
or RR homodyne protocols
1. that do not mix quadratures X and P
2. that can be performed with two ancillary modes
3. in which all ancillas are initially vacuum states
4. in which Eve measures the same quadrature as Bob
on all of her ancillary modes with the help of quan-
tum memories
is optimal for the channel parameters it can reproduce.
In particular, the entangling cloner attack introduced
in [1] and the assymetric cloning attack studied in [9]
are optimal homodyne attacks ; for channels with no ex-
cess noise (ǫ = 0), the beam-splitting attack is optimal.
Equations (14) and (15) show that the optimality of any
attack that verify conditions 1–4 holds even for attacks
yielding dissymmetric channel parameters (i.e. TX 6= TP
and χX 6= χP ).
In fact, conditions 1–3 do not hamper the generality
of the attacks we consider. Indeed, condition 1. is not
restrictive as one can reduce any symplectic matrix to
the block diagonal form (5) by means of local Gaussian
operations [13]. We will see in section VII that numerical
simulations show that condition 2. is in fact not neces-
sary. Finally, condition 3. is also not restrictive because
one can include the preparation of a non-vacuum initial
state from vacuum states inside the symplectic transfor-
mation describing the attack, eventually by making use
of extra ancillary modes.
The fact that the heterodyne attack scheme breaks
condition 4. is the reason why, in general, the hetero-
dyne bound (12) is higher than the homodyne bound (1),
thus imposing more stringent constraints on Eve’s infor-
mation. However, for some particular values of the chan-
nel parameters, these two bounds coincide. Namely, this
happens when χ =
1− T + T/V 2/T − 1/V for RR.
For DR, bound (11) is equal to its homodyne counterpart
= 1/χ when χ =
1− 1/T with T ≥ 1. For these
channel parameters, an optimal heterodyne attack is also
an optimal homodyne attack, but without the need for
quantum memories, therefore lowering the technological
requirements for the eavesdropper.
We recall that like all the results presented in this pa-
per, the optimality of any homodyne attack is to be un-
derstood in the context of individual Gaussian attacks.
However, since the homodyne bound (1) is proven secure
against the larger class of individual and finite-size Gaus-
sian and non-Gaussian attacks [2], we can say that any
Gaussian individual attack that fulfills conditions 1–4 is
optimal among that extended class of attacks. Security
proofs of the homodyne protocol against collective at-
tacks require the use of the Holevo entropy [3, 4], then
the results presented here do not apply to this general
class of attacks.
V. PROOF BASED ON SYMPLECTIC
INVARIANTS
It is possible to derive the heterodyne bound (12)
from another technique that does not require the Iwa-
sawa decomposition. This technique is based on the fact
that the output covariance matrix γ issues from some
symplectic transformation S applied to the initial co-
variance matrix γi. Since γi is diagonal with diagonal
terms (V, 1, 1, V, 1, 1)N0, this property simply states that
(V, 1, 1)N0 are the symplectic eigenvalues of the output
covariance matrix γ. In other word, finding the best at-
tack for RR amounts to minimizing the conditional vari-
ance of Bob’s measurement knowing Eve’s measurement
over the set of covariance matrices with symplectic eigen-
values (V, 1, 1)N0. In terms of symplectic transforma-
tions, Heisenberg relations on the three modes we con-
sider require that all symplectic eigenvalues are greater
than N0. Therefore, covariance matrices with eigenval-
ues (V, 1, 1)N0 are covariance matrices that are compat-
ible with Heisenberg relations and an input modulation
of variance V N0.
Since symplectic eigenvalues are usually hard to ex-
press analytically, we will rather use symplectic invari-
ants, which are totally equivalent to symplectic eigenval-
ues. For a three mode state, there exist three symplectic
invariants ∆j,3 with j = 1, 2, 3 defined as the sum of the
determinant of all 2j × 2j sub-matrices of γ which diag-
onal is on the diagonal of γ [14]. Applied to the input
covariance matrix γi, these invariants read
∆1,3 = V
2 + 2 (16)
∆2,3 = 2V
2 + 1 (17)
∆3,3 = V
2 (18)
We will now express the symplectic invariants as func-
tions of the components of the output covariance matrix
γ. For this purpose, we write this matrix as
VB′ cm cn 0 0 0
cm VEm c 0 0 0
cn c VEn 0 0 0
0 0 0 VB′ cn cm
0 0 0 cn VEn c
0 0 0 cm c VEm
N0 (19)
where m stands for “measured” and n for “not mea-
sured”, and VB′ = T (V + χ). This notation assumes
that the attack does not mix quadratures X and P , and
that swapping measurements of modes E1 and E2 would
not change Eve’s information. The later assumption is
backed by results of section III where we found that the
optimal heterodyne attack yields to equal variances for
X and P measurements. From equation (19) we can
compute symplectic invariants as
∆1,3 = 2c
2 + V 2B′ + 4x+ 2y
∆2,3 = c
4 + 2c2V 2B′ + 4c
2x− 4cVB′x+ 4x2 − 2c2y
+2V 2B′y + 4xy + y
2 − 4cz − 2VB′z
∆3,3 = (−2cx+ VB′(c2 − y) + z)2,
where we introduced variables
x = cmcn, y = VEmVEn, z = VEmc
n + VEnc
With these variables, Eve’s conditional variance yields
VB′|E =
VB′ −
VB′ −
z + σ′
z2 − 4yx2
N0, σ
′ = ±1
Since y > 0, we will only consider σ′ = 1 because it
gives more information to Eve. Using the invariance of
symplectic invariants, we univocally fix x and z
2(1− c2 − y) + V 2 − V 2B′
z = VB′y − V − c2(VB′ + c) +
2(1− y) + V 2 − V 2B′
as well as c, as a function of channel parameters
V − VB′
. (20)
Consequently, the heterodyne conditional variance VB′|E
only depends on channel parameters and y. Then, we
notice that y appears in the homodyne conditional vari-
VB′|E1,E2 =
y − c2
N0. (21)
Therefore, the homodyne bound (1) contraints y by
c2 ≤ y ≤ c2 + T (V χ+ 1) (22)
We numerically find that VB′|E is a decreasing function
of y, therefore the highest value for y must be considered
to bound Eve’s information. In fact, using the results
of section IV stating that any attack on the homodyne
protocole is optimal (the covariance matrix (19) fulfills
conditions 1–4), we can say that the only possible value
for y is indeed c2+T (V χ+1). Now, VB′|E only depends
on channel parameters, and we can check that it coincides
with bound (12).
In conclusion, we have shown another technique for de-
riving bound (12). This technique is slightly less general
than the Iwasawa decomposition because it assumes that
the optimal attack respects the symmetry of the prob-
lem. Furthermore, it does not cover the DR protocol.
Yet, it enables to find bound (12) from more fundamen-
tal Heisenberg-like properties.
VI. OPTIMAL ATTACKS
We shall now exhibit four optimal attacks against the
heterodyne protocol with repect to bounds (11) and (12),
depicted in Fig. 2. The existence of such optimal attacks
show that the bounds we derived are tight: it is not pos-
sible to further reduce the estimation Alice and Bob can
make about Eve’s information. The first optimal attack
we consider is the feed forward attack introduced in [5].
The symplectic matrix associated with this attack is
1 gE 0
0 1 0
0 0 1
1 0 0
0 −1√
1−TE 0√
0 0 1
and S
is obtained from S
by replacing the first line
in the leftmost matrix by [1, 0,−gE]. Using equations (7)
which link coefficients of the symplectic transformation
matrix to channel parameters T and ǫ, we can see that to
faithfully reproduce these channel parameters, Eve must
choose:
g2E = ǫT, TE = 4
ǫ(2− 2T + T ǫ))
(2 + T ǫ)2/T
(2− ǫ)
(2 + T ǫ)
With these parameters, we can check from the compo-
nents of S
injected in equations (8) that this attack
reaches bounds (11) and (12).
Quantum teleportation is represented by the symplec-
tic matrix
1 gE 0
0 1 0
0 0 1
0 0 1
0 1 0
1 0 0
0 0 1
SEPRX
with SEPRX =
1 0 0
1 0 0
0 s−1 0
0 0 s
Here, S
is obtained by using [1, 0, gE] as the first line of
the leftmost matrix, and changing s → 1/s. The second
from left matrix simply swaps the 1st and 3rd modes to
respect our mode order convention. Channel parameters
fix s and gE :
g2E = 2T, s
1− T + T ǫ−
T ǫ(2− 2T + T ǫ)
and noise computation shows that this attack is optimal.
Then, the entangling cloner attack is represented by
the symplectic matrix
SecX =
1 0 0
1−TE 0√
0 0 1
SEPRX
To fake channel parameters, Eve must choose
TE = T and
s4 + 1
Once again, noise and conditional variance computations
from the components of this matrix yield bounds (11)
and (12).
Finally, the cloning attack studied in [9] is also op-
timal. This can be checked by verifying that the con-
ditional variance of equation (44) in [9] coincides with
bound (12). For this attacks, the authors show that in
order to reproduce channel parameters, Eve must choose
TE = T (1− ǫ/2) and G =
1− ǫ/2
For no excess noise (ǫ = 0), all these attacks are equiv-
alent to beam-splitting attacks.
VII. DISCUSSION
We first discuss the generality of the model shown on
Fig. 1, on which we built our proofs. This model assumes
that Eve’s attack only involves two modes, but one can
imagine that Eve could use and measure more modes,
also carrying some information about Alice and Bob’s
 0  0.2  0.4  0.6  0.8  1
β = 0.87
Previous heterodyne
New heterodyne
Homodyne
 0  0.2  0.4  0.6  0.8  1
β = 1.0
Previous heterodyne
New heterodyne
Homodyne
 0  0.05 0.1 0.15 0.2
FIG. 3: Effective information rate for typical experimental
parameters: V = 11, ǫ = 0.02 and a perfect error correction
β = 1 (top) or a constant reconciliation efficiency β = 0.87
(bottom). The new bound on heterodyne protocol provides
more secret information than the homodyne protocol or the
previous heterodyne bound. We can see from the bottom
graph inlet that with these parameters, the new heterodyne
provides secret information for every channel transmission.
However, in practice, the reconciliation efficiency β drops as
the distance rises, then limiting the range of the protocol.
transmission. To tackle this problem, we can imagine
that Eve concentrates all the information her modes bear
into a single mode for each quadratures, by iterative con-
structive interferences between her modes using beam-
splitters. Since local operations using beam-splitters on
Eve’s modes do not alter the conditional variance VB′|E ,
any attack on n modes for each quadrature X and P can
be mapped to an equivalent attack, where Eve only needs
to measure one mode for each quadrature. Therefore, it
seems reasonable to assess that it is useless for Eve to
introduce extra modes that in the end do not provide
any information about Alice and Bob’s data. This tech-
nique is illustrated in [9], where the authors consider the
interference of the two modes owned by Eve in the assy-
metric attack against the homodyne protocol, and show
that this interference enables Eve to measure only one
mode without loosing information.
To back this argument, we performed numerical sim-
ulations that give 2n modes to Eve, with n = 1, 2, 5.
In these simulations, 107 attacks are tested by generat-
ing random symplectic transformations parameterized by
the Iwasawa decomposition. It shows that the two main
results of this paper hold with more that two modes for
Eve, namely that any attack using quantum memories on
the homodyne protocol is optimal, and that the informa-
tion Eve can get on the heterodyne protocol is bounded
by (12).
We complete our study by discussing practical ad-
vantages of the heterodyne scheme over the homodyne
scheme, when considering that a classical error correction
with limited efficiency β has to be applied to experimen-
tal data to obtain a secret key [15]. In this picture, the
practical key rate becomes ∆Ieff = βIAB − IBE , result-
ing in a bit loss of ∆I −∆Ieff = (1− β)IAB . Because for
a given efficiency β the mutual information IAB of the
heterodyne scheme is higher, this protocols suffers from
greater key loss than the homodyne scheme. When con-
sidering bound (1), this loss was rapidly fatal. However,
with the new bound (12), we can see from Fig. 3 that the
heterodyne scheme recovers its advantage.
Still, there are two other practical drawbacks to the
heterodyne protocol. First, for a given distance, the sig-
nal to noise ratio (SNR) of the transmission is lower be-
cause of Bob’s heterodyning beam-splitter. Since the rec-
onciliation efficiency is an increasing function of the SNR,
this effect lowers the final key rate. Because of this, both
heterodyne and homodyne protocols feature an equiva-
lent key rate. For example, for T = 0.25 (corresponding
to 25 km), ǫ ≃ 0, 02 and V ≃ 11N0 [16], the homodyne
scheme achieves β = 0.87 and the heterodyne scheme
β = 0.80, both yielding to a few 0.01 bits per symbol.
Second, Alice and Bob need to reconcile twice as much
data as for the homodyne case. This effect also low-
ers the final key rate when, as experimentally observed,
computing speed limits the experimental repetition rate.
However, on-going work on reconciliation at low SNR
may take advantage of the high effective key rate of the
heterodyne protocol.
In conclusion, we have derived new bounds for individ-
ual attacks on the direct and reverse reconciliated QKD
protocols with heterodyne detection. These new bounds
offer a higher secret key rate than previous bounds. We
have shown that the feed-forward attack, the cloning
attack, the quantum teleportation and the entangling
cloner all achieve these bounds, then closing the gap be-
tween best known bounds and best known attacks. On
the other hand, the behaviour of these new bounds with
respect to non-Gaussian [2] and collective attacks [3, 4]
remains an open question.
We thank Frédéric Grosshans, Raul Garćıa-Patrón and
Nicolas Cerf for fruitfull discussions. We acknowledge
support from the SECOQC European Integrated Project.
J.L. acknowledges support from IFRAF.
[1] F. Grosshans, G. V. Assche, J. Wenger, R. Brouri,
N. Cerf, and P. Grangier, Nature 421, 238 (2003).
[2] F. Grosshans and N. J. Cerf, Phys. Rev. Lett. 92, 047905
(2004).
[3] M. Navascues, F. Grosshans, and A. Aćın, Phys. Rev.
Lett. 97, 190502 (2006).
[4] R. Garcia-Patron and N. J. Cerf, Phys. Rev. Lett. 97,
190503 (2006).
[5] C. Weedbrook, A. M. Lance, W. P. Bowen, T. Symul,
T. C. Ralph, and P. K. Lam, Phys. Rev. Lett. 93, 170504
(2004).
[6] C. Weedbrook, A. M. Lance, W. P. Bowen, T. Symul,
T. C. Ralph, and P. K. Lam, Phys. Rev. A 73, 022316
(2006).
[7] J. Lodewyck, T. Debuisschert, R. Tualle-Brouri, and
P. Grangier, Phys. Rev. A 72, 050303(R) (2005).
[8] F. Grosshans, N.Cerf, J. Wenger, R. Tualle-Brouri, and
P. Grangier, Quantum Inf. Comput. 3, 535 (2003).
[9] R. Namiki, M. Koashi, and N. Imoto, Phys. Rev. A 73,
032302 (2006).
[10] Arvind, B. Dutta, N. Mukunda, and R.Simon, e-print
quant-ph/9509002 (1995).
[11] C. M. Caves, Phys. Rev. D 26, 1817 (1982).
[12] F. Grosshans and P. Grangier, Phys. Rev. Let. 88,
057902 (2002).
[13] L.-M. Duan, G. Giedke, J. I. Cirac, and P. Zoller, Phys.
Rev. Lett. 84, 2722 (2000).
[14] G. Adesso, A. Serafini, and F. Illuminati, Phys. Rev. A
73, 032345 (2006).
[15] M. Bloch, A. Thangaraj, and S. W. McLaughlin (2005),
e-print cs.IT/0509041.
[16] A higher modulation variance V could be used to in-
crease the SNR, thus compensating for the SNR decrease
due to Bob’s heterodyne measurement. However, a higher
modulation variance also increases the information IBE .
Then, the effective secret rate ∆Ieff features a maximum
for a certain value of V , which turns out to be compara-
ble for both heterodyne and homodyne protocols for the
given channel parameters.

  We propose a new upper bound for the eavesdropper's information in the direct
and reverse reconciliated coherent states quantum key distribution protocols
with heterodyne detection. This bound is derived by maximizing the leaked
information over the symplectic group of transformations that spans every
physical Gaussian attack on individual pulses. We exhibit four different
attacks that reach this bound, which shows that this bound is tight. Finally,
we compare the secret key rate obtained with this new bound to the homodyne
rate.

info.eps
Tight bound on coherent states quantum key distribution with heterodyne detection
Jérôme Lodewyck1, 2 and Philippe Grangier2
Thales Research and Technologies, RD 128, 91767 Palaiseau Cedex, France
Laboratoire Charles Fabry de l’Institut d’Optique, CNRS UMR 8501,
Campus Universitaire, bâtiment 503, 91403 Orsay Cedex, France
We propose a new upper bound for the eavesdropper’s information in the direct and reverse
reconciliated coherent states quantum key distribution protocols with heterodyne detection. This
bound is derived by maximizing the leaked information over the symplectic group of transformations
that spans every physical Gaussian attack on individual pulses. We exhibit four different attacks
that reach this bound, which shows that this bound is tight. Finally, we compare the secret key
rate obtained with this new bound to the homodyne rate.
I. INTRODUCTION
Continuous variable quantum key distribution
(CVQKD) is an alternative to single photon “discrete”
QKD that encodes key information in variables with
a continuum of degrees of freedom. Such variables
include the quadratures X and P of a mode of the
electromagnetic field. A CVQKD protocol using these
quadratures has been introduced in [1]. It consists in
sending a train of pulsed coherent states modulated in
X and P with a Gaussian distribution (Alice’s module),
and in quadrature measurements with an homodyne
detection upon reception (Bob’s module). Then, Bob’s
continuous data are used as the basis for constructing
a secret binary encryption key, in a classical informa-
tion process called “reverse reconciliation” (RR). The
security of the RRCVQKD homodyne protocol has first
been proven against individual Gaussian attacks [1], and
later extended to individual or finite-size non-Gaussian
attacks [2]. More recently, new security proofs covering
collective, Gaussian and non-Gaussian attacks [3, 4]
have appeared.
In the homodyne protocol [1], Bob randomly chooses
to measure either X or P , and then announces his choice.
Another possible approach, proposed in [5] by Weed-
brook and co-workers, is that Bob measures both X and
P quadratures of each incoming coherent state, by sepa-
rating them on a 50-50 beam-splitter TB. This detection,
called “heterodyne” is represented in Fig. 1. Notably, in
this protocol, Bob does not need to randomly switch his
measurement basis.
Alice
FIG. 1: Heterodyne protocol. Bob measure both quadratures
X and P of the incoming mode B′. A generic eavesdropping
strategy involves a transformation S on Alice’s mode and two
vacuum ancillary modes.
In [5], the authors proposed a bound on the informa-
tion acquired by the eavesdropper (Eve) in the hetero-
dyne protocol, under the hypothesis of individual Gaus-
sian attacks. They also considered a possible attack
based on feed-forward (see below for details), that they
however found to be suboptimal with respect to their
proposed bound. Therefore, a gap remained between the
apparently most stringent bound and the best known at-
tack, which is surprising in the simple scenario of individ-
ual Gaussian attacks. Later on, in [6], the same authors
conjectured that their proposed attack is indeed optimal,
and so that tighter bounds should apply to Eve’s infor-
mation. However, no such tighter bound was proposed
so far.
In this article, we propose a new bound for individual
Gaussian attacks on the CVQKD heterodyne protocols,
tighter than the bound of [5]. In addition, we explic-
itly present a series of attacks which are optimal with
respect to this bound, closing the gap between the best
known attacks and the tightest known bound. The ar-
ticle is organized as follows: after introducing notations
in section II, the new bounds are derived in section III.
In section IV, we extend the technique used to estab-
lish these bounds to obtain new results about the homo-
dyne protocols. Specifically, we will show that any ho-
modyne attack using quantum memory is optimal, and
that in some cases this optimality can be reached without
quantum memory. Section V is devoted to another tech-
nique, based on symplectic invariants, which allows us
to derive again the new heterodyne bounds from another
point of view. Then section VI describes four optimal
attacks with respect to the new heterodyne bound, and
section VII concludes our study by discussing practical
advantages of the heterodyne protocol.
II. NOTATIONS
In the case of Gaussian attacks, the channel linking
Alice to Bob is fully characterized by its transmission in
intensity T (possibly greater than 1 for amplifying chan-
nels), and its excess noise ǫ above the shot noise level [7],
such that the total noise measured by Bob is (1+T ǫ)N0,
where N0 is the shot noise variance appearing in the
http://arxiv.org/abs/0704.1371v1
Heisenberg relation 〈X2〉〈P 2〉 ≥ N20 . Alternatively we
will make use of the total added noise referred to the in-
put χ defined by χ = 1/T+ǫ−1. These parameters might
depend on the quadrature considered, in which case we
will add a subscript indicating this quadrature (e.g. χP ).
The quantum channel is considered to be probed
by Eve with the help of ancillary modes. To index
these modes, we will note XM and PM the quadra-
tures of mode M , and write down the 2n quadra-
tures of n modes M1, . . . ,Mn by the vector Q =
(XM1 , . . . , XMn , PM1 , . . . , PMn). The total Gaussian
state of the system is then represented by its covariance
matrix γ of components γi,j = 〈QiQj〉.
In the heterodyne protocol, we note B the modes mea-
sured by Bob, and B′ the incoming beam, on which we
will base our demonstrations. This mode is coupled with
two ancillas on which Eve respectively measures X and
P (Fig. 1). In [5], the authors bounded the conditional
variance VXB′ |XE1 and VPB′ |PE2 of the mode B
′ knowing
Eve’s measurement results by
V minB′|E =
T (1 + χV )
N0, (1)
where (V − 1)N0 is Alice’s modulation variance. This
is basically the homodyne RR bound derived in [1, 8]
applied to each quadrature X and P .
Assuming that Eve does not control the beam-splitter
TB, this bound then leads to the minimal conditional
variance of mode B knowing Eve’s measurement by
adding the shot noise unit and the intensity decrease in-
troduced by the beam-splitter TB:
VB|E =
VB′|E +N0
. (2)
Then the information acquired by Eve results from VB|E :
IBE = 2×
with VB =
T (V + χ) + 1
where the factor 2 reflects the double quadrature mea-
surement. A similar reasoning on IAB finally gives the
secret rate ∆I = IAB − IBE . This rate is shown to be
greater than the homodyne rate for any channel parame-
ter, giving advantage to the heterodyne detection scheme.
Several explicit attacks against the heterodyne proto-
col have been considered. In [5], the authors propose
an eavesdropping strategy based on heterodyne measure-
ment and feed-forward (Fig. 2-1), which they numeri-
cally show to be suboptimal with respect to bound (1).
In [9], Namiki et al. introduce an eavesdropping strat-
egy against the homodyne RRCVQKD protocol based
on a cloning machine (Fig. 2-2). In this attack, Eve
can measure both X and P quadratures of each coher-
ent state, then requiring no quantum memory. The price
to pay is that this attack is no more optimal with re-
spect to the homodyne bound (1). In fact, the search
for quantum-memory-less homodyne attacks is very sim-
ilar to finding attacks on the heterodyne protocol because
Alice
Alice
Alice
Alice Bob
EPR pair
EPR pair
1/2(4)
FIG. 2: Our general results are illustrated by considering four
optimal attacks against the heterodyne protocol. In the feed-
forward attack (1), Eve taps a fraction 1 − TE of the signal
on which she makes an heterodyne measurement. Then she
translates Bob’s quadratures according to her measurement
results modified by a gain gE. In the cloning attack (2), Eve
amplifies the signal sent by Alice with a phase insensitive am-
plifier, and taps the amplified beam. Quantum teleportation
(3) consist in a making the incoming beam interfere with a
part of an EPR pair. X and P are measured in the output
arms of the interferometer. Bob’s quadratures are then trans-
lated according to Eve’s results. Finally, in the entangling
cloner attack (4), Eve tap a fraction 1 − TE of the incoming
signal, while introducing some excess noise with the help of
an EPR pair. The joint measurement of the tapped signal
and the other part of the EPR pair optimally exploits both
tapped signal and EPR noise correlations.
both schemes require that Eve measuresX and P on each
channel symbol. Therefore, the cloning attack is yet an-
other sub-optimal attack against the heterodyne protocol
when considering bound (1). We shall prove in this ar-
ticle that these two attacks are optimal with respect to
the new bounds we derive for the heterodyne protocol, as
well as two other attacks based on EPR entanglement.
III. NEW BOUNDS BASED ON THE IWASAWA
SYMPLECTIC DECOMPOSITION
To derive the new bounds on heterodyne detection pro-
tocols, we will use the symplectic formalism which de-
scribes all physically possible Gaussian individual trans-
formations on a set of n modes. The real symplectic
group is defined by the set of linear transformations of
the quadrature vectorQ, which 2n×2nmatrix S satisfies
SβST = β, with β =
−In 0
, (3)
where In is the n × n identity matrix. The main idea
of our demonstration is to use a proper parameterization
that spans all symplectic transformations applied to the
modes going through the quantum channel, hence all pos-
sible attacks, and to compute the best information Eve
can obtain when these parameters vary.
The real symplectic group is a n(2n + 1) parameters
space for which various parameterizations – or decom-
positions – exist. We choose the Iwasawa decomposi-
tion [10], which uniquely factorizes any 2n× 2n symplec-
tic matrix S as the product of 3 special matrices:
0 D−1
where B + iF is a n × n unitary matrix, D is diagonal
with strictly positive components, A is lower triangular
with all diagonal terms set to 1, and ATC is symmetric.
In our study, we consider 3 modes, depicted in Fig. 1.
The first one, noted B′ is send from Alice to Bob, who
performs an heterodyne measurement upon reception.
Eve makes this mode interact with two ancillary modes
E1 and E2 initially in the vacuum state, and then mea-
sures X on E1, and P on E2. To respect the symmetry
of this problem, we only consider symplectic transforma-
tions S that do not mix X and P quadratures:
. (5)
As B, D and A are invertible, expanding S yields F =
C = 0, and B orthogonal. We recall that the columns
of the orthogonal matrix B, as well as its rows, form an
orthonormal basis. With this form, the Iwasawa decom-
position has a physical meaning in terms of linear optical
components. Namely, any symplectic transformation is
composed of an orthogonal transformation which is it-
self a composition of rotations (i.e. beam-splitters) and
reflections (i.e. π-phase shifts), 1-mode squeezers, and
feed-forward.
Finally, we can write the Iwasawa decomposition cor-
responding to our attack model:
1 0 0
a 1 0
b c 1
s1 0 0
0 s2 0
0 0 s3
b1 b2 b3
b4 b5 b6
b7 b8 b9
 (6)
1 −a δ
0 1 −c
0 0 1
s−11 0 0
0 s−12 0
0 0 s−13
b1 b2 b3
b4 b5 b6
b7 b8 b9
with δ = ac − b. The orthogonal matrix B can be pa-
rameterized by 3 real parameters (Euler angles) plus a
binary parameter (the sign of the determinant). This
leaves 9 real and one discrete symplectic parameters to
characterize the matrix S. By expanding S and using
orthogonality properties of B, we can express channel
parameters as functions of these symplectic parameters:
TX = t
X with tX = S1,1 = s1b1
TP = t
P with tP = S4,4 =
− ab4
2 + S1,3
2 + S4,6
We note that s1 and b1 are equivalent to channel pa-
rameters TX and χX. As we are looking for the best
attack for given channel parameters, we will consider s1
and b1 fixed. Our attacks are then characterized by 7
real and one discrete parameters.
The input covariance matrix γi is diagonal with di-
agonal terms (V, 1, 1, V, 1, 1)N0. The output covariance
matrix is expressed as γ = SγiST. From S and γ, we
obtain Eve’s noises and conditional variances
2 + S2,3
r2 + 1
(rb1 + b4)2
2 + S6,6
1− b21 − b24
VXB′ |XE1
= γ1,1 −
γ1,2γ2,1
r2 + 1
(V χPE2
+ 1)(χXE1
(V + χXE1
)(χPE2
VPB′ |PE2
= γ4,4 −
γ4,6γ6,4
r2 + 1
(V χXE1
+ 1)(χPE2
(V + χPE2
)(χXE1
where r = as1/s2. All these quantities only depend on
parameters r and b4: our parameter space drops to 2
parameters.
Then, we will require that the attack leaves channel
parameters symmetric in X and P , i.e. TX = TP ≡ T
and χX = χP ≡ χ. The former relation univocally fixes
δ = s3(b1(s
1 − 1)/s1 + ab4/s2)/b7, and the later fixes r:
b1b4(1 − s21) + σ
(1− b21 − b24)ρ
1− b21
. (9)
where σ = ±1 and ρ = (s21 − 1)(1 − s21(2b21 − 1)). In
terms of channel parameters, ρ = (Tχ)2 − (1− T )2. For
a symmetric channel, the Heisenberg inequality requires
that ρ ≥ 0 [11], therefore r is well defined for any attack
that can be made symmetric. Finally, we are left with
only one parameter, b4, such that b
4 < 1−b21 = χ/(1+χ),
and the sign σ.
For RR, the information Eve acquires is given by
IBE =
VXB |XE1
VPB |PE2
IBE is maximum when (VXB′ |XE1 + 1)(VPB′ |PE2 + 1) is
minimum. For direct reconciliation (DR), for which the
key is distilled from Alice’s data, the information Eve
acquires is given by the Shannon formula:
IAE =
V + χXE1
1 + χXE1
V + χPE2
1 + χPE2
We find that both mutual informations IAE and IBE
have an extremum at
b4 = σ
1− s21(2b21 − 1)−
b21(s
1 − 1)
s21 + 1
We check numerically that in the quantum regime de-
fined by ǫ ≤ 2, this extremum is indeed the absolute
maximum. For this value of b4, we compute Eve’s noise
and conditional variance as functions of channel param-
eters:
= χPE2
≡ χmin
T (2− ǫ)2
2− 2T + T ǫ+
+1 (11)
VXB′ |XE1 = VPB′ |PE2 ≡ V
B′|E =
V χE + 1
V + χE
N0 (12)
These expressions form the new bounds for direct and
reverse reconciliated heterodyne protocols. As they are
obtained for the same value of b4, any attack that reaches
bound (11) (i.e. optimal for DR) also reaches bound (12)
(i.e. optimal for RR).
IV. APPLICATION TO THE HOMODYNE
DETECTION PROTOCOL
In this section, we will show that bound (1) on the
homodyne protocol can also be derived from the Iwa-
sawa symplectic decomposition. In the homodyne pro-
tocol, Eve stores the quantum states of mode E1 and
mode E2 in quantum memories, waiting for Bob’s mea-
surement basis disclosure. After this, Eve can measure
the same quadrature Q = X or P chosen by Bob on
both modes. The information acquired by Eve in the RR
homodyne protocol is deduced from the conditional vari-
ance on Bob’s measurement knowing the quadrature Q
of modes E1 and E2, which can be computed from the
output covariance matrix γ:
VQB′ |QE1 ,QE2 =
det(γQ)
det(γE)
, (13)
where γQ is the restriction of γ to the quadrature Q, and
γE is the restriction of γ to the quadrature Q of Eve’s
modes E1 and E2. By expanding the Iwasawa decompo-
sition of the symplectic transformation S decribing the
attack, and by using orthogonality properties of matrix
B, we can express this conditional variance as:
VQB′ |QE1 ,QE2 =
TQ′(V χQ′ + 1)
N0, (14)
where Q′ = P or X is the quadrature not measured by
Bob. This conditional variance coincides with the homo-
dyne bound (1). It is important to note that contrary
to the heterodyne conditional variance which depends
on symplectic parameters r and b4 as shown by equa-
tions (8), the homodyne conditional variance (14) only
depends on channel parameters, but no other symplectic
parameter characterizing the attack
The DR case is treated similarly, by considering the
covariance matrix γAE that gathers the modulation value
chosen by Alice (XA, PA) and modes E1 and E2 owned
by Eve. By expanding the Iwasawa decomposition of S,
we find
VQA|QE1 ,QE2 =
det(γAEQ )
det(γE)
(V − 1)(1 + χQ′)
V χQ′ + 1
N0, (15)
which yields
IAE =
(V − 1)N0
VQA|QE1 ,QE2
V + χhom
1 + χhom
with χhom
= 1/χQ′. This expression matches the highest
bound for the information acquired by Eve in the DR
homodyne protocol established in [12]. It depends only
on channel parameters, and not on the other symplectic
parameters.
Therefore, we have shown any attack against the DR
or RR homodyne protocols
1. that do not mix quadratures X and P
2. that can be performed with two ancillary modes
3. in which all ancillas are initially vacuum states
4. in which Eve measures the same quadrature as Bob
on all of her ancillary modes with the help of quan-
tum memories
is optimal for the channel parameters it can reproduce.
In particular, the entangling cloner attack introduced
in [1] and the assymetric cloning attack studied in [9]
are optimal homodyne attacks ; for channels with no ex-
cess noise (ǫ = 0), the beam-splitting attack is optimal.
Equations (14) and (15) show that the optimality of any
attack that verify conditions 1–4 holds even for attacks
yielding dissymmetric channel parameters (i.e. TX 6= TP
and χX 6= χP ).
In fact, conditions 1–3 do not hamper the generality
of the attacks we consider. Indeed, condition 1. is not
restrictive as one can reduce any symplectic matrix to
the block diagonal form (5) by means of local Gaussian
operations [13]. We will see in section VII that numerical
simulations show that condition 2. is in fact not neces-
sary. Finally, condition 3. is also not restrictive because
one can include the preparation of a non-vacuum initial
state from vacuum states inside the symplectic transfor-
mation describing the attack, eventually by making use
of extra ancillary modes.
The fact that the heterodyne attack scheme breaks
condition 4. is the reason why, in general, the hetero-
dyne bound (12) is higher than the homodyne bound (1),
thus imposing more stringent constraints on Eve’s infor-
mation. However, for some particular values of the chan-
nel parameters, these two bounds coincide. Namely, this
happens when χ =
1− T + T/V 2/T − 1/V for RR.
For DR, bound (11) is equal to its homodyne counterpart
= 1/χ when χ =
1− 1/T with T ≥ 1. For these
channel parameters, an optimal heterodyne attack is also
an optimal homodyne attack, but without the need for
quantum memories, therefore lowering the technological
requirements for the eavesdropper.
We recall that like all the results presented in this pa-
per, the optimality of any homodyne attack is to be un-
derstood in the context of individual Gaussian attacks.
However, since the homodyne bound (1) is proven secure
against the larger class of individual and finite-size Gaus-
sian and non-Gaussian attacks [2], we can say that any
Gaussian individual attack that fulfills conditions 1–4 is
optimal among that extended class of attacks. Security
proofs of the homodyne protocol against collective at-
tacks require the use of the Holevo entropy [3, 4], then
the results presented here do not apply to this general
class of attacks.
V. PROOF BASED ON SYMPLECTIC
INVARIANTS
It is possible to derive the heterodyne bound (12)
from another technique that does not require the Iwa-
sawa decomposition. This technique is based on the fact
that the output covariance matrix γ issues from some
symplectic transformation S applied to the initial co-
variance matrix γi. Since γi is diagonal with diagonal
terms (V, 1, 1, V, 1, 1)N0, this property simply states that
(V, 1, 1)N0 are the symplectic eigenvalues of the output
covariance matrix γ. In other word, finding the best at-
tack for RR amounts to minimizing the conditional vari-
ance of Bob’s measurement knowing Eve’s measurement
over the set of covariance matrices with symplectic eigen-
values (V, 1, 1)N0. In terms of symplectic transforma-
tions, Heisenberg relations on the three modes we con-
sider require that all symplectic eigenvalues are greater
than N0. Therefore, covariance matrices with eigenval-
ues (V, 1, 1)N0 are covariance matrices that are compat-
ible with Heisenberg relations and an input modulation
of variance V N0.
Since symplectic eigenvalues are usually hard to ex-
press analytically, we will rather use symplectic invari-
ants, which are totally equivalent to symplectic eigenval-
ues. For a three mode state, there exist three symplectic
invariants ∆j,3 with j = 1, 2, 3 defined as the sum of the
determinant of all 2j × 2j sub-matrices of γ which diag-
onal is on the diagonal of γ [14]. Applied to the input
covariance matrix γi, these invariants read
∆1,3 = V
2 + 2 (16)
∆2,3 = 2V
2 + 1 (17)
∆3,3 = V
2 (18)
We will now express the symplectic invariants as func-
tions of the components of the output covariance matrix
γ. For this purpose, we write this matrix as
VB′ cm cn 0 0 0
cm VEm c 0 0 0
cn c VEn 0 0 0
0 0 0 VB′ cn cm
0 0 0 cn VEn c
0 0 0 cm c VEm
N0 (19)
where m stands for “measured” and n for “not mea-
sured”, and VB′ = T (V + χ). This notation assumes
that the attack does not mix quadratures X and P , and
that swapping measurements of modes E1 and E2 would
not change Eve’s information. The later assumption is
backed by results of section III where we found that the
optimal heterodyne attack yields to equal variances for
X and P measurements. From equation (19) we can
compute symplectic invariants as
∆1,3 = 2c
2 + V 2B′ + 4x+ 2y
∆2,3 = c
4 + 2c2V 2B′ + 4c
2x− 4cVB′x+ 4x2 − 2c2y
+2V 2B′y + 4xy + y
2 − 4cz − 2VB′z
∆3,3 = (−2cx+ VB′(c2 − y) + z)2,
where we introduced variables
x = cmcn, y = VEmVEn, z = VEmc
n + VEnc
With these variables, Eve’s conditional variance yields
VB′|E =
VB′ −
VB′ −
z + σ′
z2 − 4yx2
N0, σ
′ = ±1
Since y > 0, we will only consider σ′ = 1 because it
gives more information to Eve. Using the invariance of
symplectic invariants, we univocally fix x and z
2(1− c2 − y) + V 2 − V 2B′
z = VB′y − V − c2(VB′ + c) +
2(1− y) + V 2 − V 2B′
as well as c, as a function of channel parameters
V − VB′
. (20)
Consequently, the heterodyne conditional variance VB′|E
only depends on channel parameters and y. Then, we
notice that y appears in the homodyne conditional vari-
VB′|E1,E2 =
y − c2
N0. (21)
Therefore, the homodyne bound (1) contraints y by
c2 ≤ y ≤ c2 + T (V χ+ 1) (22)
We numerically find that VB′|E is a decreasing function
of y, therefore the highest value for y must be considered
to bound Eve’s information. In fact, using the results
of section IV stating that any attack on the homodyne
protocole is optimal (the covariance matrix (19) fulfills
conditions 1–4), we can say that the only possible value
for y is indeed c2+T (V χ+1). Now, VB′|E only depends
on channel parameters, and we can check that it coincides
with bound (12).
In conclusion, we have shown another technique for de-
riving bound (12). This technique is slightly less general
than the Iwasawa decomposition because it assumes that
the optimal attack respects the symmetry of the prob-
lem. Furthermore, it does not cover the DR protocol.
Yet, it enables to find bound (12) from more fundamen-
tal Heisenberg-like properties.
VI. OPTIMAL ATTACKS
We shall now exhibit four optimal attacks against the
heterodyne protocol with repect to bounds (11) and (12),
depicted in Fig. 2. The existence of such optimal attacks
show that the bounds we derived are tight: it is not pos-
sible to further reduce the estimation Alice and Bob can
make about Eve’s information. The first optimal attack
we consider is the feed forward attack introduced in [5].
The symplectic matrix associated with this attack is
1 gE 0
0 1 0
0 0 1
1 0 0
0 −1√
1−TE 0√
0 0 1
and S
is obtained from S
by replacing the first line
in the leftmost matrix by [1, 0,−gE]. Using equations (7)
which link coefficients of the symplectic transformation
matrix to channel parameters T and ǫ, we can see that to
faithfully reproduce these channel parameters, Eve must
choose:
g2E = ǫT, TE = 4
ǫ(2− 2T + T ǫ))
(2 + T ǫ)2/T
(2− ǫ)
(2 + T ǫ)
With these parameters, we can check from the compo-
nents of S
injected in equations (8) that this attack
reaches bounds (11) and (12).
Quantum teleportation is represented by the symplec-
tic matrix
1 gE 0
0 1 0
0 0 1
0 0 1
0 1 0
1 0 0
0 0 1
SEPRX
with SEPRX =
1 0 0
1 0 0
0 s−1 0
0 0 s
Here, S
is obtained by using [1, 0, gE] as the first line of
the leftmost matrix, and changing s → 1/s. The second
from left matrix simply swaps the 1st and 3rd modes to
respect our mode order convention. Channel parameters
fix s and gE :
g2E = 2T, s
1− T + T ǫ−
T ǫ(2− 2T + T ǫ)
and noise computation shows that this attack is optimal.
Then, the entangling cloner attack is represented by
the symplectic matrix
SecX =
1 0 0
1−TE 0√
0 0 1
SEPRX
To fake channel parameters, Eve must choose
TE = T and
s4 + 1
Once again, noise and conditional variance computations
from the components of this matrix yield bounds (11)
and (12).
Finally, the cloning attack studied in [9] is also op-
timal. This can be checked by verifying that the con-
ditional variance of equation (44) in [9] coincides with
bound (12). For this attacks, the authors show that in
order to reproduce channel parameters, Eve must choose
TE = T (1− ǫ/2) and G =
1− ǫ/2
For no excess noise (ǫ = 0), all these attacks are equiv-
alent to beam-splitting attacks.
VII. DISCUSSION
We first discuss the generality of the model shown on
Fig. 1, on which we built our proofs. This model assumes
that Eve’s attack only involves two modes, but one can
imagine that Eve could use and measure more modes,
also carrying some information about Alice and Bob’s
 0  0.2  0.4  0.6  0.8  1
β = 0.87
Previous heterodyne
New heterodyne
Homodyne
 0  0.2  0.4  0.6  0.8  1
β = 1.0
Previous heterodyne
New heterodyne
Homodyne
 0  0.05 0.1 0.15 0.2
FIG. 3: Effective information rate for typical experimental
parameters: V = 11, ǫ = 0.02 and a perfect error correction
β = 1 (top) or a constant reconciliation efficiency β = 0.87
(bottom). The new bound on heterodyne protocol provides
more secret information than the homodyne protocol or the
previous heterodyne bound. We can see from the bottom
graph inlet that with these parameters, the new heterodyne
provides secret information for every channel transmission.
However, in practice, the reconciliation efficiency β drops as
the distance rises, then limiting the range of the protocol.
transmission. To tackle this problem, we can imagine
that Eve concentrates all the information her modes bear
into a single mode for each quadratures, by iterative con-
structive interferences between her modes using beam-
splitters. Since local operations using beam-splitters on
Eve’s modes do not alter the conditional variance VB′|E ,
any attack on n modes for each quadrature X and P can
be mapped to an equivalent attack, where Eve only needs
to measure one mode for each quadrature. Therefore, it
seems reasonable to assess that it is useless for Eve to
introduce extra modes that in the end do not provide
any information about Alice and Bob’s data. This tech-
nique is illustrated in [9], where the authors consider the
interference of the two modes owned by Eve in the assy-
metric attack against the homodyne protocol, and show
that this interference enables Eve to measure only one
mode without loosing information.
To back this argument, we performed numerical sim-
ulations that give 2n modes to Eve, with n = 1, 2, 5.
In these simulations, 107 attacks are tested by generat-
ing random symplectic transformations parameterized by
the Iwasawa decomposition. It shows that the two main
results of this paper hold with more that two modes for
Eve, namely that any attack using quantum memories on
the homodyne protocol is optimal, and that the informa-
tion Eve can get on the heterodyne protocol is bounded
by (12).
We complete our study by discussing practical ad-
vantages of the heterodyne scheme over the homodyne
scheme, when considering that a classical error correction
with limited efficiency β has to be applied to experimen-
tal data to obtain a secret key [15]. In this picture, the
practical key rate becomes ∆Ieff = βIAB − IBE , result-
ing in a bit loss of ∆I −∆Ieff = (1− β)IAB . Because for
a given efficiency β the mutual information IAB of the
heterodyne scheme is higher, this protocols suffers from
greater key loss than the homodyne scheme. When con-
sidering bound (1), this loss was rapidly fatal. However,
with the new bound (12), we can see from Fig. 3 that the
heterodyne scheme recovers its advantage.
Still, there are two other practical drawbacks to the
heterodyne protocol. First, for a given distance, the sig-
nal to noise ratio (SNR) of the transmission is lower be-
cause of Bob’s heterodyning beam-splitter. Since the rec-
onciliation efficiency is an increasing function of the SNR,
this effect lowers the final key rate. Because of this, both
heterodyne and homodyne protocols feature an equiva-
lent key rate. For example, for T = 0.25 (corresponding
to 25 km), ǫ ≃ 0, 02 and V ≃ 11N0 [16], the homodyne
scheme achieves β = 0.87 and the heterodyne scheme
β = 0.80, both yielding to a few 0.01 bits per symbol.
Second, Alice and Bob need to reconcile twice as much
data as for the homodyne case. This effect also low-
ers the final key rate when, as experimentally observed,
computing speed limits the experimental repetition rate.
However, on-going work on reconciliation at low SNR
may take advantage of the high effective key rate of the
heterodyne protocol.
In conclusion, we have derived new bounds for individ-
ual attacks on the direct and reverse reconciliated QKD
protocols with heterodyne detection. These new bounds
offer a higher secret key rate than previous bounds. We
have shown that the feed-forward attack, the cloning
attack, the quantum teleportation and the entangling
cloner all achieve these bounds, then closing the gap be-
tween best known bounds and best known attacks. On
the other hand, the behaviour of these new bounds with
respect to non-Gaussian [2] and collective attacks [3, 4]
remains an open question.
We thank Frédéric Grosshans, Raul Garćıa-Patrón and
Nicolas Cerf for fruitfull discussions. We acknowledge
support from the SECOQC European Integrated Project.
J.L. acknowledges support from IFRAF.
[1] F. Grosshans, G. V. Assche, J. Wenger, R. Brouri,
N. Cerf, and P. Grangier, Nature 421, 238 (2003).
[2] F. Grosshans and N. J. Cerf, Phys. Rev. Lett. 92, 047905
(2004).
[3] M. Navascues, F. Grosshans, and A. Aćın, Phys. Rev.
Lett. 97, 190502 (2006).
[4] R. Garcia-Patron and N. J. Cerf, Phys. Rev. Lett. 97,
190503 (2006).
[5] C. Weedbrook, A. M. Lance, W. P. Bowen, T. Symul,
T. C. Ralph, and P. K. Lam, Phys. Rev. Lett. 93, 170504
(2004).
[6] C. Weedbrook, A. M. Lance, W. P. Bowen, T. Symul,
T. C. Ralph, and P. K. Lam, Phys. Rev. A 73, 022316
(2006).
[7] J. Lodewyck, T. Debuisschert, R. Tualle-Brouri, and
P. Grangier, Phys. Rev. A 72, 050303(R) (2005).
[8] F. Grosshans, N.Cerf, J. Wenger, R. Tualle-Brouri, and
P. Grangier, Quantum Inf. Comput. 3, 535 (2003).
[9] R. Namiki, M. Koashi, and N. Imoto, Phys. Rev. A 73,
032302 (2006).
[10] Arvind, B. Dutta, N. Mukunda, and R.Simon, e-print
quant-ph/9509002 (1995).
[11] C. M. Caves, Phys. Rev. D 26, 1817 (1982).
[12] F. Grosshans and P. Grangier, Phys. Rev. Let. 88,
057902 (2002).
[13] L.-M. Duan, G. Giedke, J. I. Cirac, and P. Zoller, Phys.
Rev. Lett. 84, 2722 (2000).
[14] G. Adesso, A. Serafini, and F. Illuminati, Phys. Rev. A
73, 032345 (2006).
[15] M. Bloch, A. Thangaraj, and S. W. McLaughlin (2005),
e-print cs.IT/0509041.
[16] A higher modulation variance V could be used to in-
crease the SNR, thus compensating for the SNR decrease
due to Bob’s heterodyne measurement. However, a higher
modulation variance also increases the information IBE .
Then, the effective secret rate ∆Ieff features a maximum
for a certain value of V , which turns out to be compara-
ble for both heterodyne and homodyne protocols for the
given channel parameters.
