Security bounds for the eavesdropping collective attacks on general CV-QKD protocols

Transcription

1 Security bounds for the eavesdropping collective attacks on general CV-QKD protocols. ecir 1,, M. R.. Wahiddin 1, 1 Faculty of Science, International Islamic University of Malaysia (IIUM), P.O. ox 141, 5710 Kuantan, Pahang Darul Makmur, Malaysia Information Security Cluster, MIMOS erhad, echnology Park Malaysia, Kuala Lumpur, Malaysia bstract: We introduce a new method to quantify the eavesdropper s accessible on CV-QKD for protocols implementing homodyne and erodyne detections, respectively. For this purpose, we derive upper bound for the eavesdropping collective attacks on general CV-QKD protocols. he derived bounds are tight for all CV-QKD protocols that involve two-mode entangled state. We show that the eavesdropper s accessible information is independent of the initial correlation between lice and ob modes in reverse reconciliation scheme, while in direct reconciliation scheme, Eve information is given as a function of lice-ob initial correlation. PCS classification codes: Hk; Dd Keywords: Continuous Variable, Quantum Key Distribution, Iwasawa decomposition, Mutual Information, Holevo bound. Electronic address: idir.becir@gmail.com 1

2 I.Introduction Quantum key distribution (QKD) systems [1] make use of optical quantum fluctuations to establish shared secret keys between two legitimate parties (lice and ob) such that an eavesdropper (Eve) who makes optimal physical measurements can know, on average, none of the bits of the secret key. Systems that measure arrivals of single photons are called discrete variable systems, while those that use homodyne or erodyne detection to measure the continuous-valued electromagnetic field and are called continuous variable systems. fter the first demonstration of quantum teleportation using continuous variable (CV) [], QKD protocols based on quantum CV systems via have become highly interesting for achieving the secret key sharing [3 7]. Unlike photon counters, homodyne and erodyne detectors do not require dead times and thus continuous variable QKD (CVQKD) systems [3-7] are in principle scalable to standard telecom rates, such as 10 GHz. However, homodyne and erodyne measurements result at minimum in vacuum noise manifesting its self as Gaussian distributed randomness with noise power that remains constant as signals attenuate with length. his limits the achievable secure link length to a smaller distance than is achievable for discrete QKD. hus CVQKD may be preferable at short and medium distances. he security of the Gaussian CVQKD protocol with homodyne detection was first proven against individual Gaussian eavesdropping attacks [3, 4, 7]. Security proofs were then obtained against general collective attacks [9-11]. For the individual attacks a tight bound for the eavesdropper Eve was introduced in [1], and were later improved in [13, 14], while the case of collective attacks was analysed in [15]. Recently, unconditional security of both homodyne and erodyne protocols has also been proven [16].

3 For CV- QKD protocols that use bipartite entangled states, the secret key rate in the presence of collective attacks and reverse reconciliation is given by: Holevo I = β I χ E (1) where β 1refers to the factor of information that can be extracted from lice and ob correlated symbols in the reconciliation stages. he first term of the right hand side of Eq. (1), is directly observed in a given implementation of the protocol. he main problem is therefore how to determine the term χ E (or to put an upper bound on the information accessible to the eavesdropper Eve). he answer for this problem can be explained as follow: First, we assume that χe is a function of the quantum state ρ shared by lice and ob. Eve is without loss of generality supposed to purify the system ofρ, that is, the state can be considered pure state. Unfortunately, in practice, ρe ρ is never a pure entangled state and it is always seems as noisy (mixed) entangled state due to the imperfection of modulation. herefore, deriving bounds on the eavesdropper accessible information based on the fact of Eve purifies lice-ob state yields upper bounds, but those bounds are not tight. More illustratively, χ is always greater than zero even in the case of perfect implementation E of protocol (zero of losses and excess noises). he problem arises again in CV-QKD protocols involving mixed non-maximally entangled state (i.e. two-mode thermal squeezed state), and CV-QKD protocols involving discrete modulation (non-gaussian modulation) [17]. he Holevo boundχ of these protocols is always greater than zero, and therefore assuming that Eve purifies lice-ob state yields upper bounds on the eavesdropping accessible information, but those bounds are not tight. Leverrier et al in their work [17] have considered small values for the modulation so that the Holevo bound of their state approaches the Gaussian s Holevo bound (i.e. χ E χ ( ) ). E G E 3

4 In this paper, we derive upper bounds for the eavesdropping collective attacks based on different technique by taking into consideration all possible symplectic transformation characterizing Eve action on the QKD system. We consider general CV-QKD protocols that utilize two-mode entangled state and, and then derive upper bounds for the eavesdropping attacks. Our derivation will be applied to both homodyne (erodyne) protocols, and to reverse (direct) reconciliation schemes, respectively. he paper is organized as follows: In section II, we review the security proof of collective attacks on general CV-QKD protocols using the fact that Eve purifies lice-ob state ofρ, and derive upper bound on the information accessible to Eve. We show that those bounds are not tight for CV-QKD protocol that involves mixed entanglement. In sections III, we derive new tight bounds for the eavesdropping collective attacks in direct reconciliation scenario. In section IV, we discuss the practical implementation of general CV-QKD protocols in realistic setup and compare the secret key rate obtained with this new bound to the one derived according to the fact of Eve purifying lice-ob system s state. In appendix, we extend our derivation to the direct reconciliation scheme. II.he Protocol he general CV-QKD protocol that involves two-mode entangled state can be described as follow: First lice prepares a pair of EPR beams as shown in figure (1). She keeps the quadratures ( X ', P ') and sends the quadratures ( X, P ) to ob through quantum channel. he channel features are represented by transmission efficiency and excess noiseζ, resulting in a noise variance at ob s input of (1 + ζ ) N0. he total channel-added noise referred to the channel input, expressed in shot noise units, is defined asχ = 1/ 1+ ζ. line ob measures one of the two quadratures randomly (homodyne detection), or both quadratures simultaneously (erodyne detection). practical detector is characterized by 4

5 efficiency η and excess noise ζ ele (due to thermal noises induced by electronic circuit). he detection-added noise referred to ob s detection expressed in shot-noise units is given by the expressions χ = ( 1 + ζ ) / η 1 for homodyne detection and χ ( ) hom ele = + ζ / η1for erodyne detection. he total noise referred to the channel input can then be expressed as χ = χ + χ /. In the end, lice and ob proceed with classical data processing line ( hom) procedures, which include a reconciliation algorithm to extract an identical chain of bits from their correlated continuous data, and standard privacy amplification process to distil a final secret key from this chain. ele Figure (1): CV-QKD protocol using EPR source. he quantum channel is supposed to be controlled by Eve and it is represented by its transmission and total noise. he EPR source in ob N = ηχ η for homodyne station is used for modelling the excess noise of detection ( hom ( 1 ) and N = ( ηχ 1) ( 1 η) for erodyne), while the beam splitter of transmittanceη is used for representing the efficiency of measurement. 1. lice-ob mutual information: he two quadratures X ( X ') are entangled, and the measurement of one quadrature ( X ' ) gives lice information on the second quadrature X. he best estimate lice can have on X 5

6 knowing X ' is of the form X = κ X ', withκ = X ' X / X '. he value of κ is taken for what the variance of the error operatorδ X = X X is minimized. he conditional variance VX / X of X knowing X X ' is given by [18]: in the case of lice applying homodyne detection on the quadrature V X / X X X ' X = () X ' Using the commutation relation [ δ X, P] = [ X, P] κ[ X ', P] = i - κ (0) (3) which obeys the Heisenberg uncertainty, V P (4) X / X 1 and using the expression () and (3), yields X ' X ' X X ' X. (5) P For simplification, we consider the initial symmetry in the two quadratures, i.e. X ' = P ' = V X = P = V (6) hus, the Eq. (5) will have the form: X X ' V 1 ( with 1) V α α (7) In the limit ofα = 1, the two modes X ' and X become maximally entangled. lternatively, lice can have estimate on the quadrature P by measuring her quadrature which yields P ', 6

7 ( ) P' P V α with α 1 (8) Using the above results, the mutual information between lice and ob, I, therefore can be derived according to Shannon theorem [19], and it reads I 1 V 1 V + χ = log = log V / X χ 6 + α V (9). Eavesdropping accessible information: In collective attacks, Eve interacts individually with each pulse sent by lice but, instead of measuring immediately after sifting, she listens to the communication between lice and ob during the key distillation procedure, and only then applies the optimal collective measurement on her ensemble of stored ancillae. In this attack, the maximum information accessible to Eve is limited by the Holevo bound [11, 0]: E ( ) ( ( x, p ) E S E ) χ = S ρ ρ (10) x p represents the measurement of ob, ρ is the eavesdropper s state where ( ) conditional on ob s measurement result, and S is the Von Neumann entropy of the quantum state ρ. Using the fact that Eve s system purifies the system 1, that ob s measurement purifies x the system EFG as shown in figure (1), and that ( FG) Gaussian protocols, χe reads [11] 1 χe = ρ ρ = 5 x λ 1 i j S( ) S( ) 1 FG G G λ i= 1 j= 3 x E S ρ is independent of x for (11) 7

8 = + 1 log + 1 log ( ), 1, G x x x x x where ( ) ( ) ( ) λ are the symplectic eigenvalues of the covariance matrixγ, and λ 3,4,5 are the symplectic eigenvalues of the covariance matrix 1 x γ FG after ob`s projective measurement. he first term of Eq. (11) is independent of ob s measurement type, and it is completely described by the symplectic eigenvalues λ 1, of the covariance matrixγ : 1 ( D) 1 λ 1, = ± 4, with (1) ( χline α ) D= V + ( χline) ( α ) = V + V + V x he entropy S( γ FG ) is determined from the symplectic eigenvalues λ 3,4,5 of the (13) covariance matrix characterizing the state x ρ FG after ob's projective measurement. he symplectic eigenvalues λ3,4,5 are given by: where for homodyne detection we have hom ( ) λ 1 4,λ 1 3,4 = ± 5 = (14) ( V in ) ( V+ χ ) χ + +χ + V D = (15) hom hom l e ( line) D hom V( + χline) ( V + χ ) Dχhom+ V + χ D+ V χ + V D = (16) nd for erodyne detection we have ( ) ( ) χ + χ V D+ V + χ + D+ 1+ V α = line ( V + χ ) (17) 8

9 { } 4 3 Dχ + χ D( V + χline) + V D + χ ( V + χline) D+ V 3V = 4 { ( V + χ) } ( + ) + ( + ) + { ( + )} 4 { ( V + χ) } χ V V χ D V V χ V V χ + line line line (18) he parameters and D are given by (13). ased on the Eqs (11)-(18) we can calculate the Holevo Holevo boundχ and thus derive the Holevo secret information rate I = β I χ E for E both homodyne and erodyne detections (For erodyne detection protocol, the mutual information between lice and ob (E.q (9)) is multiplied by factor ). It is not difficult to show that the bounds derived above are actually not tight. Let us consider the perfect case so that we have a perfect detection and zeros of losses and access noises ( = 1, η = 1, χhom = χ line = 0 andχ = 1). he symplectic eigenvalues becomes: hom λ1, = α λ1, = λ3 = α and hom V + α λ4(5) = 1 λ3 =, λ4(5) = 1 V + 1 (19) It is clear that the Holevo bound, χ, is greater than zero even though we have considered an E ideal case of protocol implementation, which disagree with our initial assumption of using the word quantum to distil our the secrecy key (any attempt of intercepting the quantum channel by Eve will obviously induce some noises into the channel). herefore, the bound derived above are considered upper bounds for the eavesdropping collective attacks, but they are not tight. In the limit of α = 1(which is equivalent to lice and ob share two-mode maximally entangled state), the Holevo boundχ becomes zero and the bounds derived above becomes tight. E 9

10 III. Optimal bounds for the eavesdropping collective attacks: In the previous section, we have seen that the security bound derived based on the fact that Eve purifies lice-ob system s state are not tight for general CV-QKD protocols. More illustratively, they are not tight for those protocols involving the utilization of non-maximally (non pure) entangled state or protocols involving non-gaussian modulation. In the following, we derive new bounds for general CV-QKD protocols with respect to all possible collective Gaussian attacks that can be performed by Eve. We focus our study on the case of reverse reconciliation scheme. Similar derivation for the direct reconciliation scenario is given in appendix. Let us start by assuming that Eve needs two ancillae (vacuum states) in order to estimate either (, ) X P in direct reconciliation or( X, P ) in reverse reconciliation as shown in figure (). She performs her attack on the incoming mode 0 with the help of two vacuum states, then she stores the two modes E1 and E in quantum memory, while sends the third mode to ob. Figure (): Eavesdropping collective attacks he iwasawa theory says that any symplectic real matrix (here assumed to be the combination of any attacks) can be written as a product of the compact K, abelian and nilpotent N. 10

11 0 D 0 X Y S = 1 1 C ( ) 0 D Y X (0) where X + iy is a n n unitary, D is diagonal positive and is unit lower triangular matrices. From the fact that the channel of interest effects symmetric uncorrelated noise in x and p (i.e. fiber optics channel), the symplectic transformation matrix will have the form SX 0 S = 0 S P (1) Combining the equations (1) and (0) yields, C= Y = 0, and X orthogonal. herefore, the Eq. (0) and (1) can be written as: s1 0 0 x1 x x3 S a s 0 x x x X = b c s 3 x7 x8 x 9 () 1 1 a δ s1 0 0 x1 x x3 1 SP = 0 1 c 0 s 0 x4 x5 x s 3 x7 x8 x 9 (3) whereδ = ac b. Expanding S and using the orthogonality of X, one we can express the channel parameters as function of these symplectic parameters: he channel transmission parameters are given by [13] x ( ) = S = s x (4) 1,1 1 1 p x ax = S = + x ,4 δ s1 s s3 (5) and the channel added noise are given by 11

12 S + S χ = = 1 (6) x 1, 1,3 1 S1,1 x1 χ p S4,5+ S4.6 1 a δ 1 = = S4,4 s1 s s3 p (7) γ in V V, where 1 he input covariance matrix at Eve setup is a diagonal matrix (,1,1,,1,1) refers to the variance of vacuum in shot-noise limit (ancila added by Eve). he output covariance matrix after Eve operation reads γ out in = Sγ S (8) s we have discussed in previous section, the eavesdropping accessible information (in the case of collective attacks and reverse reconciliation) is determined by the Holevo bound: ( x, p ) ( ρ ) ( ρ ) χ = S dx p( x ) S, E E1E E1E ( ρe E ) S( ρe E ) = S 1 1. (9) he first part of expression (9) is only depending of Eve modes and therefore it is independent of ob measurement type (either homodyne or erodyne). It is completely described by the symplectic eigenvalues of the covariance matrix γ X E 0 X 1 E X 0 1 E 0 PE 0 P 1 E P 1 E E1E X E X E X E 0 PE P 0 1 E P E = (30) where 1

13 E1 E E1 E ( ) ( 1) 4 1 X = a + s x V + a s + s ( ) ( 1) X = b + cs x + s x V + b s + cs + s ( )( 1)( ) X X = a + s x V b + cs x + s x + abs + cs (31) and E1 P E P P P E1 E x4 cx 7 1 c = ( V 1) s s s s3 7 1 ( V 1) 3 s3 x = + s x cx ( V 1) 4 7 = s s 3 x s c 7 3 s3 (3) he expressions (31) and (3) can be deduced from output covariance matrix (8) and using the orthogonal matrix properties. We have considered also that the channel of interest distributes the noises on both quadratures equally (i.e. = = and χ = χ = χ ). x p x p line he symplectic eigenvalues λ 1, of the covariance matrix (31) are then given by: ( D) 1 λ 1, = ± 4, with (33) D= ( Vχ + 1) line ( 1 ) ( χline ) + ( χ line ) = V + V + (34) he second part of Eq. (9) is depending on which measurement ob applies, either homodyne or erodyne. For homodyne detection protocol, the estimated covariance matrix knowing ob measurement is given by: ( X X) MP E1E = E1E E1 E E1E γ = γ σ γ σ (35) 13

14 where X = diag( 1,0) and MP stands for the inverse on the range For erodyne detection protocol, the estimated covariance matrix knowing ob measurement is given by: ( ) 1 E1E = E 1E E1E + E1E γ = γ σ γ + σ (36) where given by: σ indicates the correlation covariance matrix (between ob and Eve) and it is E1E σ E1E X E X X E X = 0 PE P 0 1 PE P (37) with E1 E E1 ( ( 1) ( ) ) 4 1 ( 1) ( ) X X = η V a + s x + as ( ) X X = η V b + cs x + s x + bs P P x4 cx7 a ac bc = η ( V 1) + s s3 s1 s3 s 3 x7 δ PE P ( 1) = η V + s 3 s 3 (38) We note that: In the case of erodyne detection protocol, the elements of Eq. (38) are multiplied by the factor 1/. It is long but straightforward, the symplectic eigenvaluesλ 3,4 are given by: ( ) 1 λ 3,4 = ± 4, (39) where for homodyne protocol we have 14

15 hom hom D V D ( V χline) ( V + χ) [ χ V + ] χ + D( V + χ ) + V χ + V( V + χ ) χhom+ + + = = line hom line hom line ( + χ ) V (40) and for erodyne we have ( χ ) ( V D ( V )) D ( V ) ( V + χ ) line χ χ χ = = D + V ( ) ( ) + + line line Dχ V χ D V χ V V χ ( + χ ) V 3 (41) he parameters and D are given by (34). Using the Eqs. (33), (34) and (39)-(40) allow us calculating the Holevo boundχ and therefore deriving the Holevo secret information rate E = β χ. Holevo I I E he Holevo bounds, χ, derived above matches the one derived for protocols that utilize E two-mode maximally entanglement [11, 1]. It depends only on channel parameters, and not on the other symplectic parameters. It is independent also of the correlation type between lice and ob modes (either maximally or non-maximally entangled). In appendix, we derive bound for the eavesdropping collective attacks and show that Eve information is strongly depending on lice-ob correlation. III.Practical realistic setup: In this section, we apply the results derived in sections II and III to practical QKD system, in which we investigate the security of general CV-QKD protocol against the distance of fibre-optic implementations. Let us consider a subclass of Gaussian states that plays relevant role in quantum information constituted by symmetric two-mode squeezed thermal states. Let 15

16 1 1 Sr = exp raˆ 1aˆ raˆ aˆ be two-mode squeezed operator with real number r, and let ρ1 ρ be tensor product of thermal states with identical Gaussian distribution( 0,α ). hen +, r r 1 S α r the symmetric two-mode thermal squeezed state is defined as ξ = S ( ρ ρ ) corresponding to standard form with =, 1 α cosh α sinh X = X = r + r V 1 ( α ) X X = + cosh r sinh r V α (4) In the pure case, withα = 1, one recovers the two-mode vacuum state. Note that any twomode entangled state can be reduced to two-mode vacuum state by a unitary transformation. In the following, we make comparisons of the resulting key between different classes of two-mode CV-QKD protocols. We show the advantages of the bound derived in this article over those derived according to the assumption of Eve purifying lice-ob system. Our simulation is illustrated in figures (3) and (4) ccording to figures (1) and (), it is obvious that our new bounds are tight, and therefore offer higher key rate, and tolerate much excess noises. It is worth pointing out that we have considered the same reconciliation efficiency for both configurations, i.e. homodyne and erodyne detections. herefore, the homodyne protocol gives higher key rate. Nonetheless, in practice the erodyne detection protocol can give better reconciliation than that of the homodyne detection protocol. 16

17 ( a ) ( b ) Fig 3: Secret key generation rate as a function of distance for a protocol with homodyne detection. In the numerical simulation, the quantum channel is replaced by fibre optics with transmission efficiency, where is the loss coefficient for the standard optical fibres, and is the length of the fibre optics. he efficiency of detection has the value and the electrical noise induced by the homodyne detection circuits is [11]. he channel excess noise is fixed to [11]. he reconciliation efficiency is strongly depending on the signal-to-noise ratio. However, here and for simplicity we choose β = 0.8 for different SNR values [11]. he squeezing parameter is chosen to be r =.3. he graphs (a) represent the actual key rate derived according to the assumption that Eve purifies lice-ob system, while (b) represent the actual key rate with eavesdropping new bounds derived in this article. 17

18 ( a ) ( b ) Fig 4: Secret key generation rate as a function of distance for a protocol with erodyne detection. In the numerical simulation, the quantum channel is replaced by fibre optics with transmission efficiency, where is the loss coefficient for the standard optical fibres, and is the length of the fibre optics. he efficiency of detection has the value and the electrical noise induced by the erodyne detection circuits is [11]. he channel excess noise is fixed to [11]. he reconciliation efficiency isβ = 0.8 and the squeezing parameter is chosen to be r =.3. he graphs (a) represent the actual key rate derived according to the assumption that Eve purifies lice-ob system, while (b) represent the actual key rate with eavesdropping new bounds derived in this article. 18

19 IV.Conclusion We have derived new on the eavesdropper s accessible information general CV-QKD with homodyne and erodyne detections protocols, respectively. he new bounds are tight and cannot be tighter than that. his new bounds offer higher key rate and tolerate much excess noises than those derived according to the fact Eve purifies lice-ob system. We have shown also that the eavesdropping collective attacks are independent of the choices of symplectic transformation, and only depending of the quantum channel parameters. hey also independent of the correlation between lice and ob modes in RR scheme, while in direct reconciliation scheme are strongly depending on it as shown in appendix. Similar technique for deriving the eavesdropper individual attacks bound was used in [13] by considering twomode vacuum state, while bounds for general two-mode state can be easily deduced by using same technique. 19

20 REFERENCES [1] C. H. ennett et al, Phys. Rev. Lett. 70 (1993) 1895 [] F. kira, J. L. Sorensen, L.. Samuel, C.. Fuchs, H. J. Kimble and E. S. Polzik Science 8 (1998)706 [3]. Hirano, H. Yamanaka, M. shikaga,. Konishi, and R. Namiki, Phys. Rev. 68 (003) 4331: R. Namiki and. Hirano, Phys. Rev (003) 308 [4] F. Grosshans and P. Grangier, Phys. Rev. Lett. 88 (00) [5] Ch. Silberhorn,. C. Ralph, and G. Leuchs, Phys. Rev. Lett. 89 (00) [6] F. Grosshans, G.V. ssche, J. Wenger, R. rouri, N.J. Cerf, and P. Grangier, Nature 41 (003) 38 [7] C. Weedbrook,. M. Lance, W.P. owen,. Symul,. C. Ralph, and P. K. Lam, Phys. Rev. Lett. 93 (004) [8] Grosshans F and Cerf N J Phys. Rev. Lett. 9 (004) [9] M. Navascu es, F. Grosshans and. cín Phys. Rev.Lett. 97 (006) [10] R. García-Patrón and N. J. Cerf Phys. Rev. Lett. 97 (006) [11] J. Lodewyck, M. loch, R. García-Patrón, S. Fossier, E. Karpov, E. Diamanti,. Debuisschert, N. J. Cerf, R. ualle-rouri, S. W. McLaughlin and P. Grangier Phys.Rev. 76 (007)04305 [1] C. Weedbrook, W. Lance,. Symul,. Ralph and P. Lam Phys. Rev. 73(006) 0316 [13] J. Lodewyck and P. Grangier Phys. Rev. 76 (007)033 [14] J. Sudjana, L. Magnin, R. García-Patrón and N. J. Cerf Phys. Rev. 76 (007)05301 [15] R. García-Patrón 007 Ph.D. thesis, Universit e Libre de ruxelles [16] R. Renner and J. I. Cirac 008 arxiv: [quant-ph] [17]. Leverrier and P. Grangier Phys. Rev. Lett 10 (009) [18] F. Grosshans and J. Nicolas, Cerf, Quantum Information and Computation, 3 (003) 535 [19] Shannon, ell System echnical Journal 8 (1949) 656 [0] S. Fossier, E. Diamanti,. Debuisschert, R. ualle-rouri and P. Grangier Mol. Opt. Phys. 4 (009)

21 ppendix We introduce here new bound for the eavesdropping collective attacks in DR scheme, and show that in the opposite of RR scheme, Eve information here is depending on lice-ob correlation. he eavesdropping accessible information in DR is determined by the Holevo bound: ( x, p) ( ρ ) ( ρ ) χ = S dx p( x ) S, E E1E E1E ( ρe E ) S( ρe E ) = S 1 1. (43) he first part of expression (43) is only depending of Eve modes and it is given by similar form derived in section III (Eq. (33-34)). he second part of Eq. (43) is depending on which measurement lice applies, either homodyne or erodyne. For homodyne detection protocol, the estimated covariance matrix knowing lice measurement is given by: ( X X) MP E1E = E1E E1 E E1E γ = γ σ γ σ (44) For erodyne detection protocol, the estimated covariance matrix knowing lice measurement is given by: ( ) 1 E1E = E 1E E1E + E1E γ = γ σ γ + σ (45) where σ indicates the correlation covariance matrix (between lice and Eve) and it is E1E given by: 1

22 σ E1E X E X X E X = 0 PE P 0 1 PE P (46) where E1 E E1 E ( 4)( α ) ( 4 3 7)( α ) X X = η a + s x V X X = η b + cs x + s x V P P P P 3 ( V α ) cx7 x4 = η s3 s x7 = η ( V α ) s (47) he symplectic eigenvaluesλ 3,4 therefore are given by: ( ) 1 λ 3,4 = ± 4, (48) where for homodyne protocol we have hom hom ( ) ( ) χhom+ α 1 V 1 + χ line + +ϒ = = D hom ( V+ χ ) hom ( 1) line ( line 1) Dχ + α χ + V χ + ( V + χ ) hom (49) and for erodyne we have ( α ) ( ) {( )( V( ) ) } ( ) 4 line χ + χ α χ + +ϒ + α = + = ( V + χ ) { χline} ( ) 1 V Κ ( V + χ ) ( ) ( 1) ( V + χ ) Dχ + Vχline+ V χline α (50)

23 he parameters and D are given by (9), whileϒ and Κ are given by: ( V χline χlinev) V ( 1 χline) ( 4 χline) ϒ = ( ) ( ) Κ = V χline χline + 1 6V χline 1 3 χline 6 (51) It is evidence from the expressions (48)-(50) that Eve information is strongly depending on the correlation between lice and ob modes. In the limit of perfect implementation (zero of losses and excess noises), the symplectic eigenvalues λ3,4 tends to 1. Combining this result with the result derived in section II ( λ 1, = 1), yieldingχ = 0. herefore, the bound derived here are also tight for the eavesdropping collective attacks in direct reconciliation scheme. E 3