Long-distance continuous-variable quantum key distribution using separable Gaussian states
LLong-distance continuous-variable quantum key distribution using separable Gaussianstates
Jian Zhou , Duan Huang , , and Ying Guo ∗ School of Information Science and Engineering,Central South University, Changsha , China State Key Laboratory of Advanced Optical Communication Systems and Networks,Department of Electronic Engineering, Shanghai Jiao Tong University, Shanghai , PR China. (Dated: December 5, 2018)Continuous-variable quantum key distribution (CVQKD) is considered to be an alternative toclassical cryptography for secure communication. However, its transmission distance is restricted tometropolitan areas, given that it is affected by the channel excess noise and losses. In this paper,we present a scheme for implementing long-distance CVQKD using separable Gaussian states. Thistunable QKD protocol requires separable Gaussian states, which are squeezed and displaced, alongwith the assistance of classical communication and available linear optics components. This protocoloriginates from the entanglement of one mode and the auxiliary mode used for distribution, whichis first destroyed by local correlated noises and restored subsequently by the interference of theauxiliary mode with the second distant separable correlated mode. The displacement matrix isorganized by two six-dimensional vectors and is finally fixed by the separability of the tripartitesystem. The separability between the ancilla and Alice and Bob’s system mitigates the enemy’seavesdropping, leading to tolerating higher excess noise and achieving longer transmission distance.
I. INTRODUCTION
Quantum key distribution (QKD) [1, 2] enables twodistant parties, conventionally called Alice and Bob, whohave access to an authenticated classical channel, to sharesecret keys in the presence of eavesdropper, Eve. The un-conditional security of an ideal QKD protocol has beenestablished even if it is exposed to an adversary, whopossesses unlimited computing power and technologicalcapabilities [3–6]. Normally, QKD is divided into twokinds: discrete-variable (DV) QKD [2, 7], which relieson photon counting techniques, and continuous-variable(CV) QKD [8–11], which relies on coherent detection.Equipped with the decoy state technique [12], DVQKDcan realize hundreds of kilometers of communication [13].With the help of a satellite, the transmission distance ofQKD has been extended to 1200 kilometers [14]. An-other branch of QKD, CVQKD, which has stable, reli-able light resources and high detection efficiency, is morecompatible with classical optical communications whencompared to DVQKD [9]. However, despite all the ad-vantages, CVQKD cannot yet replace DVQKD since itstransmission distance is too short [15, 16]. One reasonfor the short distance is the presence of the eavesdrop-per, Eve, who can perturb the quantum system using themost general strategies allowed by quantum mechanics.Another one is that CVQKD schemes require a far morecomplicated error correction procedure, which further re-stricts the secure transmission distance.Einstein associated entanglement with spooky action-at-a-distance [17], which is different from the currentview in quantum information theory that regards entan-glement as a physical resource. Entanglement [18] has ∗ Corresponding author:[email protected] been widely applied to QKD [19], quantum dense cod-ing [20], quantum teleportation [21], entanglement swap-ping [22] and beating classical communication complex-ity bounds [23]. For example, global quantum opera-tions can be implemented in quantum teleportation uti-lizing entanglement and classical communication. Greateffort has been devoted to distributing and manipulatingentanglement among separated parties. In addition, ascheme of entangling two distant parties based on com-munication via a quantum channel and local operationsand classical communication (LOCC) was proposed [24].Entanglement between distant parties can be created bysending a mediating particle between them via a quan-tum channel: swap the first particle with the ancilla, sendit through the channel and entangle it with the secondparticle. Besides the qubit protocol, distributing CV en-tanglement by separable Gaussian states has also beensuggested [25, 26]. Two separable modes A and B maybe entangled after interacting with the auxiliary mode C .Unfortunately, pure quantum states cannot achieve thistarget. Moreover, Alice and Bob usually apply squeezingand displacement operations on these modes to enhancethe practical quantum information processing. Recently,the aforementioned operations have been verified in ex-periment [27, 28].To lengthen the transmission distance of the CVQKDsystem, we develop an improved protocol which trans-mits a separable ancilla without sending the secret infor-mation directly as usual. It may entangle mode A , inAlice’s laboratory, with separable mode B , in Bob’s dis-tant laboratory, by sending an ancillary mode C which isseparable from the subsystem ( AB ) [24]. Normally, thequantum transmission channel is assumed to be underEve’s control in QKD. We exemplify the entanglementbetween Alice’s and Bob’s modes and the separability be-tween the ancilla and the kept particle by calculating the a r X i v : . [ qu a n t - ph ] D ec lowest eigenvalue. In previous fully Gaussian protocols,Eve’s system E purifies AB , so that, S ( E ) = S ( AB ).Fortunately, in this scheme, the transmitted particle C that may be attacked by Eve is separable from AB . Theeavesdropper cannot get access to Alice’s and Bob’s lab-oratories as well as the information transmitted in theclassical channel. In this case, it is impossible for theeavesdropper to recover the process of the protocol andhence she cannot extract any information. In such ascenario, the proposed scheme reduces the informationleaked to the eavesdropper, thus enables longer trans-mission distance.This paper is organized as follows: In Sec. II, we reviewthe distribution of entanglement with separable states.In Sec. III, we present the details of CVQKD scheme withseparable states. Sec. IV shows the performance of theproposed CVQKD scheme under general eavesdropping.Finally, we conclude this paper in Sec. V. II. ENTANGLEMENT DISTRIBUTION WITHSEPARABLE STATES
BSBS
Classical Communication
WCL WCLWCLS(X) S(P)D DD
QM QM
Discarded Q E n t a n g l e d Alice Bob
FIG. 1. (Color online) Alice’s particle and Bob’s particle in-teract with a mediating particle C continuously. Alice andBob get entangled while leaving C separable from the system AB . WCL denotes weak coherent laser, and S ( X ), S ( P ) arecompression operations on along position and momentum di-rections. D is a local displacement distributed according tothe Gaussian distribution with correlation matrix Q . Distributing entanglement with separable states is abreakthrough in the theory of quantum entanglement.It has been shown that separable Gaussian states can beused for implementing entanglement distribution [25, 26].As shown in Fig. 1, this process can be accomplished bycommunication via a quantum channel and LOCC.At the start of the original entanglement distributionprotocol, Alice prepares systems A and C in a Gaussianstate while Bob prepares system B in a Gaussian state.The three quantum systems are fully separable at thisstage. Alice squeezes her two systems: one along theposition quadrature and the other along the momentumquadrature. In order to keep the ancilla separable fromsystem AB , a displacement operation is applied to each of the three systems. Note that the displacement is de-pendent on the squeezing parameters r and r . Alicesends her two systems into a beam splitter. The beamsplitter operation on modes A and C results in a stateseparable with respect to two bipartitions: B − AC and C − AB . One of the outputs is stored in Alice’s quantummemory (QM). The other is sent to Bob via a quantumchannel. Bob also applies a beam splitter operation onmodes B and C . Mixing of modes B and C on a bal-anced beam splitter finally entangles A and B while C still remains separable from AB .In what follows, we recall how a displacement opera-tion may make the transmitted ancilla C separable from AB [25]. Before the displacement operation, modes A and C are in a two-mode squeezed vacuum state andmode B is in a vacuum state. The output of the firstbeam splitter is a two-mode squeezed vacuum state withthe following covariance matrix (CM): γ AC = (cid:20) cosh (2 τ ) I sinh (2 τ ) σ z sinh (2 τ ) σ z cosh (2 τ ) I (cid:21) , (1)where τ ≥ A and C are entangled when the lower symplectic eigenvalue ν min of the partial transpose of CM γ AC is less than one [25].The CM of the three-mode system ABC is given by γ ABC = cosh (2 τ ) I τ ) σ z I τ ) σ z τ ) I . (2)We add an excess non-negative matrix P to γ ABC γ ABC = γ ABC + xP, (3)to entangle mode A and modes BC , while leaving theother two bipartitions separable. We follow the methodfor the construction of three-mode entangled Gaussianstates in [29] to build matrix P . The entanglement be-tween modes A and C can be destroyed by adding apositive multiple of sum of the projectors onto the sub-space spanned by two six-dimensional vectors [25, 29].The negative eigenvalue of the CM is λ = − (1 − e − τ )with its eigenvector p λ = p + ip for p = (0 , , , T and p = (1 , , − , T . We extend p and p tothe six-dimensional vectors q = (0 , , , − , , T and q = (1 , , , , − , T with the displacement matrix P = q q T + q q T . In order to smear the entanglementbetween modes A and C , we add a sufficiently large, non-negative multiple xP to the CM as shown in Eq. (3) andobtain γ ABC = aI xσ z bσ z xσ z (1 + 4 x ) I − xI bσ z − xI aI . (4)where a = cosh(2 t ) + x and b = sinh(2 t ) − x . Then thelowest symplectic eigenvalue of matrix ( γ ABC ) ( T C ) canbe derived as [30], ν min = (cid:112) (1 + 6 x + e − τ ) − x − (1 + 2 x − e − τ )2 . (5) S y m p l e c t i c e i gen v a l ue (a) - - S y m p l e c t i c e i gen v a l ue (b) FIG. 2. The eigenvalues, ν min and κ min , as a function dis-placement parameter x , for different compression parameters τ , correspond to the dashed and full lines. The compressionparameter τ = 0 . τ = 1 in (b). The dotted linesdenote the boundary of separability. The separable bound of C and AB is e τ − , wherethe parameter x should be equal or greater than thisvalue. On the other hand, the lowest eigenvalue of ma-trix ( γ ABC ) ( T A ) can be calculated as κ min = 1 + 6 x + e − τ − (cid:112) (1 + 2 x − e τ ) + 32 x . (6)Taking x ≥ τ ≥ A and BC . Fig. 2 shows the lowest symplec-tic eigenvalue of matrix ( γ ABC ) ( T C ) and ( γ ABC ) ( T A ) . Tosatisfy the separability of C − AB , the lowest symplec-tic eigenvalue corresponding to the dashed line should begreater than one. Similarly, the lowest symplectic eigen-value corresponding to the full line ought to be less thanone to ensure the entanglement between A and BC . Fi-nally, after applying reverse operation of the beam split-ter on γ ABC , the covariance matrix of the random dis-placement distributed according to Gaussian distribution is fixed. The beam splitter transforms the CM in (4) toCM γ ABC that is as follow: γ ABC = aI x + b √ σ z x − b √ σ z x + b √ σ z a I x − a I x − b √ σ z x − a I x + a I . (7)The symplectic eigenvalue of CM γ AB can be calculatedas ν = 0 . e τ = 10, and the entanglement can beobtained as E N = − log ν ≈ .
33 ebits.According to the entanglement distribution with sep-arable Gaussian states, we find that the entanglementis firstly destroyed by displacement operations, whichmakes the auxiliary mode separable from sender’s mode.After that, the auxiliary mode is sent to Bob who par-tially restores the entanglement by mixing it with hissuitably classically correlated mode, leading to the entan-glement enhancement. Using this elegant characteristics,we propose an improved CVQKD scheme to lengthen themaximum transmission distance with separable Gaussianstates.
III. CONTINUOUS VARIABLE QUANTUMKEY DISTRIBUTION WITH SEPARABLEGAUSSIAN STATES
This section is divided into three parts: the first partgives the CVQKD protocol using separable Gaussianstates, the second part analyses the security of normalCVQKD protocol, while the third subsection states themerit of the protocol based on separable Gaussian states.
A. Design of the CVQKD protocol using separableGaussian states
Two normal parties, Alice and Bob aim to share secretkey. For the sake of simplifying the process, we add thedisplacement operation in the form of matrix while thepractical displacement is not complex. The prepare andmeasure description of the CVQKD based on entangle-ment distribution protocol using Gaussian states is shownin Fig. 3 and is described as follows. • Alice prepares two squeezed vacuum states whichare position-squeezed and momentum-squeezedvacuum states, respectively. Displacement oper-ations are added on these squeezed states. Theoutput of the first beam splitter is a two-modesqueezed vacuum state if we ignore the displace-ment operation. • Alice detects one of the outputs with homodyne de-tection and sends another one to Bob via a quan-tum channel. • After receiving Alice’s mode, Bob interferes his vac-uum state with the received state at a balancedbeam splitter. • Bob heterodynes one of the beam splitter’s outputswith the self-referenced strategy, whereas anotherone is discarded directly.In Alice’s laboratory, she prepares two states, oneposition-squeezed vacuum state and one momentum-squeezed vacuum state given by γ A = (cid:20) e τ e − τ (cid:21) , γ C = (cid:20) e − τ e τ (cid:21) . (8)The CM of the beam splitter’s output can be expressedas γ AC = (cid:20) V I √ V − σ z √ V − σ z V I (cid:21) , (9)with V = e τ + e − τ , σ Z = (cid:2) − (cid:3) and I = [ ]. TheCM of ABC before transmission without displacement is γ = V I √ V − σ z I √ V − σ z V I . (10)Taking the displacement into consideration, the corre-sponding CM becomes γ = aI bσ z xσ z bσ z aI − xI xσ z − xI (1 + 4 x ) I , (11)with a = V + x and b = √ V − − x . The linear channelcan be equivalent to a beam splitter with transmittance η , the function of transmission distance η = 10 − L . Theequivalent CM of the channel is B η = I I √ ηI √ − ηI −√ − ηI √ ηI . (12)After the attenuation of the channel, the CM of the wholesystem ABC becomes γ = aI b √ ησ z xσ z b √ ησ z ( aη + (1 − η ) N ) I − x √ ηI xσ z − x √ ηI (1 + 4 x ) I , (13)where N is the variance of channel thermal noise. Innormal QKD protocols, Bob performs homodyne or het-erodyne detection on the received signals. However, thedirect-detection scheme may leave the attacker loopholeto eavesdrop information. Instead, Bob prepares a vac-uum state and applies a displacement operation on it.Using a balanced beam splitter, Bob mixes the incomingmode with his own mode. The second balanced beamsplitter transforms the CM into γ = B BC · γ · B TBC .After the beam splitter, one of the outputs is detected with homodyne detection using the self-reference tech-nique, while another one is discarded directly. The CMof the system AB is γ AB = (cid:34) aI x + b √ η √ σ z x + b √ η √ σ z N +4 x (1 −√ η )+ aη − N η (cid:35) , (14)which can be used for calculating the secret key rate ofthe protocol. B. Attacking strategy with general eavesdropping
A QKD protocol is secure against general attack whenit is secure against Gaussian collective attack [4, 5]. Thispart performs an asymptotic security analysis based oninfinitely-many uses of the channel under Gaussian col-lective attack. In each transmission, Eve may interceptthe mode and make it interact with an ensemble of ancil-lary vacuum modes via a general unitary operation. Oneof the output modes is sent to Bob while another oneis stored in Eve’s quantum memory (QM). These statesin QM will be measured at the end of the protocol col-lectively. Taking reverse reconciliation into account, thefinal key rate can be derived as R = ξI AB − χ BE , (15)where ξ denotes the reconciliation efficiency. We cancompute the mutual information in terms of signal-to-noise ratio as I AB = log ϕ + 1 ω . (16) ϕ is the modulation variance in shot-noise units and ω represents the equivalent noise. In the previous CVQKDprotocols, Eve’s system E purifies AB , so that S ( E ) = S ( AB ), and S ( AB ) can be calculated from the symplec-tic eigenvalues of the covariance matrix V AB . In order tocalculate the Holevo bound between Alice and Bob withthe simplification of the expression, we denote the CM ofthe reduced state of systems AB as [31] γ AB = (cid:20) aI cσ z cσ z bI (cid:21) . (17)The symplectic eigenvalues can be calculated as [32] ν , = 12 [∆ ± (cid:112) ∆ − D ] , (18)where ∆ = a + b − c and D = ab − c . Moreover, thesymplectic eigenvalue of the conditional CM V B | A is ν = b ( b − c /a ). Therefore, we have S ( AB ) = G ( ν ) + G ( ν )and S ( B | A ) = G ( ν ) with G ( x ) = (cid:18) x + 12 (cid:19) log (cid:18) x + 12 (cid:19) − (cid:18) x − (cid:19) log (cid:18) x − (cid:19) . (19)Consequently, the information eavesdropped by Eve canbe bounded by χ BE = S ( AB ) − S ( B | A ). WCL WCLWCLS(X) S(P)
Discarded
LO LOclassicalinformation
Alice Bob
LOSignal ¦Ð/2 opticalhybrid
OSC
FIG. 3. (Color online) Scheme of CVQKD by sending separable Gaussian states. Alice and Bob apply displacement operationon their state at the stage of preparation. The displacement ensures the separability between C and AB . These modes emergerandomly in phase space obey Gaussian distribution as shown in the left part. The right part gives the detection scheme.WCL denotes weak coherent laser, and S ( X ), S ( P ) are compression operations along momentum and position directions.Double-headed arrow is local displacement distributed according to the correlation matrix. C. Secret key rate of the separable-state CVQKD
It is necessary to note that the proposed protocol is dif-ferent from the traditional protocol as the above-involvedstates are displaced before being mixed on the beam split-ter. Without the displacement, the output of the firstbeam splitter is equivalent to a two-mode squeezed vac-uum state. Another difference from the entanglement-based scheme is that Bob injects the received mode andhis own mode into one beam splitter instead of perform-ing homodyne or heterodyne detection directly. As an-alyzed in Sec. II, all these efforts are to keep the ancil-lary mode separable from system AB while completingthe task of distribution entanglement between Alice andBob. Whereas, in the traditional CVQKD system, theinformation is encoded on the mode that is sent to thechannel under Eve’s control. Eve may hide her attack inthe channel noise. It has been assumed that Eve’s systempurifies AB , which implies that S ( E ) = S ( AB ).In the proposed protocol, the auxiliary mode usedfor distributing information is separable from AB . Al-ice’s and Bob’s labs as well as the classical commu-nication are out of Eve’s touch. Namely, Eve cannotsteal any information by attacking the ancilla, leading to S E = 0. A problem about upper bound arises. In [33–35], it has been proved that the secret key rate cannotbe unbounded with increasing signal energy for normalCVQKD protocol [8]. The secret key rate satisfying thecondition R ≤ I AB − χ BE ≤ G ( ϕ ) − G ( ν ) − G ( ν ) . (20)The limit for ϕ → + ∞ for the right part of the inequationis regular and finite [33–35]. The secret key rate will notbe unbounded with increasing signal energy even though χ BE is removed. A positive multiple of sum of the pro-jectors is added to smear the entanglement between the C and AB before transmission. The displacement whichis proportional to the modulation variance also appearsin the noise. The secret key rate of this scheme will notbe unbounded as the signal-to-noise ratio is bounded re-gardless of the increasing signal energy. The advantageof keeping the ancillary state separable is the displace-ment before beam splitter. Bob uses a displaced state tointeract with the ancilla rather than detects it directly.This operation is just to cut off Eve’s disturbance. Thenthe secret key rate can be expressed as R = ξI AB , where ξ is the negotiation efficiency and I AB can be calculatedfrom the CM of system AB in Eq. (14). IV. SIMULATION RESULTS η E qu v a l en t e xc e ss no i s e ω FIG. 4. (Color online) Equivalent excess noise as a function ofchannel transmission η . The dashed lines are the equivalentexcess noise of original protocol while the full lines denote theproposed one. From bottom to top, N = 1 , , As discussed above, Alice and Bob can get the reducedCM γ AB , from which they can calculate the secret keyrate R in Eq.(15). Based on the Eq. (14), the equivalentexcess noise can be expressed as ω = 1 + (1 − η ) N + 4 x (2 − √ η )2 , (21)which is plotted in Fig. 4. Compared with the tradi-tional CVQKD protocol, the proposed protocol has anextra noise that is caused by the displacement operation.The displacement may decrease the key rate I AB . Fortu-nately, it can also remove the entanglement between theancillary particle and the kept particles.To demonstrate the performance of the protocol, weconsider both direct reconciliation and reverse reconcil-iation. In Fig. 5, we show the secret key rate of the - ( km ) S e c r e t k e y r a t e ( b i t s / pu l s e ) FIG. 5. (Color online) Secret key rates versus transmissiondistance from Alice to Bob of the direct reconciliation case.The secret key rate decreases as the grow of the transmissiondistance. Simulation results refer to V = 2 (blue dashed line), V = 10 (red full line), V = 30 (blue dashed line) and V = 100(green dot-dashed line). proposed protocol with direct reconciliation. From topto bottom, the dashed, full, dotted and dot-dashed linesrefer to the modulation variances 2 , ,
30 and 100, re-spectively. With current technology, the 15dB squeezedstates of light has already been detected in [36]. Thetransmission can exceed 15km, which corresponds to the3dB restriction in direct reconciliation. Moreover, the ex-cess noise has been taken into consideration with (cid:15) = 0 . β = 0 .
95 for all numer-ical simulations.The simulation result in Fig. 6 is the secret key rateof the direct reconciliation case. The difference betweenthin lines and thick lines shows that modulation varianceplays a positive role in the secret key rate. However, thedisplacement term limits the continued increase of thesecret key rate. The full line, dot-dashed line and dottedline show channel noise has a negative effect on the secretkey rate. We find that there is little effect of the noiseon the secret key rate of the CVQKD system when thetransmittance approaches to one. - - - - - - η S e c r e t k e y r a t e ( b i t s / pu l s e ) FIG. 6. (Color online) Secret key rates versus channel trans-mission, η . The full lines are under the ideal condition withzero excess noise while the dot-dashed and dotted lines corre-spond to N = 2 and 4, respectively. The thick and thin linesare under the condition that modulation variance V = 10 and100. - - - ( km ) S e c r e t k e y r a t e ( b i t s / pu l s e ) FIG. 7. (Color online) Secret key rates versus transmissiondistance, L . The full lines correspond to the condition withexcess noise N = 1 .
01 while the dashed lines correspondto N = 2. The thin lines represent the proposed protocolwith separable Gaussian states while the thick lines are thethe traditional protocols. In the simulation, the modulationvariance V = 30. Fig. 7 demonstrates the secret key rates of the pro-posed protocol using a separable ancilla in the reversereconciliation case. The traditional CVQKD system canonly transmit 30km due to the existence of the eavesdrop-per, whereas the proposed protocol achieves the trans-mission distance 200km at rate of 10 − bits per pulse.The transmission distance of the separable-state CVQKDprotocol is lower than that of the traditional one. Thisphenomenon may result from the abandon of the ancil-lary particle. Moreover, we can also find that the protocolhas a better tolerance to noise than the traditional one.In Fig. 8, we make a comparison between the secret keyrate of our protocol and the fundamental limit [35, 37].[35] proved the PLOB bound, while [34] later discussed - - - ( km ) S e c r e t k e y r a t e ( b i t s / pu l s e ) FIG. 8. (Color online) Secret key rates of CVQKD with sep-arable states versus the upper bound of CVQKD. The thickgreen line is the upper bound of the traditional CVQKD. Thedotted, dashed and thin full lines are the proposed CVQKDprotocols with N = 1 , ,
3, respectively. the strong convergence of this bound. The top greenline is the fundamental limit of general CVQKD proto-col, which is given by − log (1 − η ). η is channel trans-mittance of the pure-loss channel. As shown in [34, 35],the protocols whose secret key rate is based on the lowerbound cannot come up with the upper bound when thetransmittance η is less than 0 .
7. The protocol based ontransmission of separable Gaussian states via a quantumchannel and LOCC operation has a good performanceon the aspect of transmission distance. This scheme hasa good tolerance for excess noise and the transmissiondistance achieves 200km.
V. CONCLUSION
We have proposed an improved continuous-variablequantum key distribution protocol that is immune to Eve’s attack. This separable-state CVQKD protocol isdifferent from the traditional protocol because the ancil-lary particle is separable from Alice and Bobs system.In previous protocols, the information is encoded on theparticles which will pass through a quantum channel con-trolled by Eve. Eve can purify the whole system and ex-tracted as much information as the Holevo bound of thesystem. In addition, after the two respective particles in-teract continuously with an ancilla, they get entangled,leaving the ancilla separable all the time. The displace-ment operation in the preparation course plays a crucialrole in smearing the entanglement between the ancillaand Alice and Bob’s system. The secret key rate of theseparable-state CVQKD will not be unbounded with in-creasing signal energy. The proposed protocol has goodtolerance to extra noise and is able to keep abreast of theupper bound until 200km. We note that the proposedCVQKD protocol can be practically implemented usingseparable Gaussian states as entanglement preparationprocesses based on separable Gaussian states have beendemonstrated in experiment [27, 28].
ACKNOWLEDGEMENTS
We would like to thank L. Miˇsta for helpful discussion.This work is supported by the National Natural ScienceFoundation of China (Grant Nos. 61572529) and theFundamental Research Funds for the Central Universitiesof Central South University (2017zzts144). [1] H. Bennett Ch and G. Brassard, in
Conf. on Computers,Systems and Signal Processing (Bangalore, India, Dec.1984) (1984) pp. 175–9.[2] A. K. Ekert, Phys. Rev. Lett. , 661 (1991).[3] D. Mayers, Journal of the Acm , 351 (2001).[4] A. Leverrier, Phys. Rev. Lett. , 070501 (2015).[5] A. Leverrier, Physical Review Letters , 200501(2017).[6] V. Scarani, H. Bechmann-Pasquinucci, N. J. Cerf,M. Duˇsek, N. L¨utkenhaus, and M. Peev, Rev. Mod.Phys. , 1301 (2009).[7] A. Ac´ın, N. Gisin, and V. Scarani, Phys. Rev. A ,012309 (2004).[8] F. Grosshans and P. Grangier, Phys. Rev. Lett. ,057902 (2002).[9] C. Weedbrook, S. Pirandola, R. Garc´ıa-Patr´on, N. J.Cerf, T. C. Ralph, J. H. Shapiro, and S. Lloyd, Rev. Mod. Phys. , 621 (2012).[10] Y. Guo, C. Xie, Q. Liao, W. Zhao, G. Zeng, andD. Huang, Phys. Rev. A , 022320 (2017).[11] Y. Guo, Q. Liao, D. Huang, and G. Zeng, Phys. Rev. A , 042326 (2017).[12] H.-K. Lo, X. Ma, and K. Chen, Phys. Rev. Lett. ,230504 (2005).[13] H.-L. Yin, T.-Y. Chen, Z.-W. Yu, H. Liu, L.-X. You,Y.-H. Zhou, S.-J. Chen, Y. Mao, M.-Q. Huang, W.-J.Zhang, H. Chen, M. J. Li, D. Nolan, F. Zhou, X. Jiang,Z. Wang, Q. Zhang, X.-B. Wang, and J.-W. Pan, Phys.Rev. Lett. , 190501 (2016).[14] S. K. Liao, W. Q. Cai, W. Y. Liu, L. Zhang, Y. Li, J. G.Ren, J. Yin, Q. Shen, Y. Cao, and Z. P. Li, Nature ,43 (2017).[15] S. Pirandola, C. Ottaviani, G. Spedalieri, C. Weedbrook,S. L. Braunstein, S. Lloyd, T. Gehring, C. S. Jacobsen, and U. L. Andersen, Nature Photonics , 397 (2015).[16] Y. Wu, J. Zhou, X. Gong, Y. Guo, Z.-M. Zhang, andG. He, Phys. Rev. A , 022325 (2016).[17] A. Einstein, B. Podolsky, and N. Rosen, Phys. Rev. ,777 (1935).[18] R. Horodecki, P. Horodecki, M. Horodecki, andK. Horodecki, Rev. Mod. Phys. , 865 (2009).[19] M. Epping, H. Kampermann, C. Macchiavello, andD. Brubß, New Journal of Physics (2017).[20] T. Das, R. Prabhu, A. Sen(De), and U. Sen, Phys. Rev.A , 052330 (2015).[21] J. G. Ren, P. Xu, H. L. Yong, L. Zhang, S. K. Liao,J. Yin, W. Y. Liu, W. Q. Cai, M. Yang, and L. Li,Nature , 70 (2017).[22] P. Xu, H.-L. Yong, L.-K. Chen, C. Liu, T. Xiang, X.-C.Yao, H. Lu, Z.-D. Li, N.-L. Liu, L. Li, T. Yang, C.-Z.Peng, B. Zhao, Y.-A. Chen, and J.-W. Pan, Phys. Rev.Lett. , 170502 (2017).[23] P. Trojek, C. Schmid, M. Bourennane, i. c. v. Brukner,M. ˙Zukowski, and H. Weinfurter, Phys. Rev. A ,050305 (2005).[24] T. S. Cubitt, F. Verstraete, W. D¨ur, and J. I. Cirac,Phys. Rev. Lett. , 037902 (2003).[25] L. Miˇsta and N. Korolkova, Phys. Rev. A , 050302(2008). [26] L. Miˇsta and N. Korolkova, Phys. Rev. A , 032310(2009).[27] C. Peuntinger, V. Chille, L. Miˇsta, N. Korolkova,M. F¨ortsch, J. Korger, C. Marquardt, and G. Leuchs,Phys. Rev. Lett. , 230506 (2013).[28] A. Fedrizzi, M. Zuppardo, G. G. Gillett, M. A. Broome,M. P. Almeida, M. Paternostro, A. G. White, and T. Pa-terek, Phys. Rev. Lett. , 230504 (2013).[29] G. Giedke, B. Kraus, M. Lewenstein, and J. I. Cirac,Phys. Rev. A , 052303 (2001).[30] G. Vidal and R. F. Werner, Phys. Rev. A , 032314(2002).[31] A. Holevo, Probl. Inf. Transm. , 177 (1973).[32] A. Serafini, F. Illuminati, and S. De Siena, Journal ofPhysics B (2004).[33] M. Takeoka, S. Guha, and M. M. Wilde, Nature Com-munications , 5235 (2014).[34] M. M. Wilde, M. Tomamichel, and M. Berta, IEEETransactions on Information Theory , 1792 (2017).[35] S. Pirandola, R. Laurenza, C. Ottaviani, and L. Banchi,Nature Communications , 15043 (2017).[36] H. Vahlbruch, M. Mehmet, K. Danzmann, and R. Schn-abel, Phys. Rev. Lett. , 110801 (2016).[37] S. Pirandola, R. Garc´ıa-Patr´on, S. L. Braunstein, andS. Lloyd, Phys. Rev. Lett.102