# what is the motivation behind quantum key distribution with Continuous variable?

Quantum Key Distribution protocol is a technique that allow two parties to share common secret key for cryptographic purpose and defined as being secure, by definition. But I am still wondering what is the motivation behind quantum key distribution with Continuous variable ?

• @FrédéricGrosshans I totally agree. Your specialist input seems highly desirable. – Paul Uszak Aug 31 '17 at 14:10

Since the question was labelled unclear, I’ll first clarify my understanding of the question, and then give various motivations (academics, then practical). This answer turned out to be quite long

Full disclosure: I am an academic who has worked on continuous variable quantum cryptography since my PhD thesis (defended in 2003), so I am biased towards this subject.

## 0. The Question: Why use Continuous Variable in Quantum Key Distribution ?

I understand the main principles and goals of quantum key distribution (QKD) (extract an informationally secure secret key from a quantum channel and an authenticated classical channel), but all this seems to be very well done by the BB84 protocol and other single photon protocols. Why doing the things differently, using continuous variable instead of single photons ?

# 1. Academic Motivations : Doing the different things with the usual tools / doing the same thing with different tools.

I’ll start with an historical motivation, as I perceived it as a young PhD student from informal discussions held in a 2001 conference, which can be rephrased a doing different things with known tools, which is a common way scientific progress occurs in academia: the scientists try to apply the (theoretical or experimental) tools they know well to new problems. Around 2000, the new interesting problems in the field of view of quantum opticians where quantum computing and quantum key distribution. The latter already had a few single photon based experimental implementations, while the former promised to be much more harder to implement (and still is). Over the previous decade, interesting quantum optics effect (entanglement, squeezing, quantum non-demolition measurements, quantum teleportation) had been shown with continuous variable systems, and the leaders of groups working with such systems knew there was no physical obstacle to adapt QKD to it. However, while the mapping betweens key bits and single photon are natural, the way to encode bits in continuous variables was less natural, leading to complex, “ugly” and a bit artificial security analysis for such protocols, as witnessed by these 1999 CV QKD Protocols by Tim Ralph (paywalled,arxiv) and Mark Hillery (paywalled,arxiv). The solution to this problem was found by Nicolas J. Cerf (with his students Marc Lévy and Gilles Van Assche paywalled/arxiv paper) with the use of information theory and, more specifically, differential entropy.

This leads to the related reason why academics like me still finds CV QKD interesting after almost two decades, which can be seen as a kind of dual to the one mentioned above: it is the use of different tools (CV instead of discrete variables) for the same problems. This leads to a deeper understanding of quantum cryptography, splitting the essential “quantum” aspects from the technicalities of dimension-2 Hilbert space describing single photon states. For example, it helped the community gain a better understanding of information theoretical aspect of QKD, but also lead to better experimental understanding of time resolved homodyne detection.

A downside of this, is CV QKD protocol have no choice but use really efficient error correction codes, even in ideal settings, while single photon QKD protocols do not really need them. Their theoretical analysis is also more complex, since they live in a high dimensional Hilbert space.

## 2. Practical Motivation: Faster, Cheaper and more Robust Detectors

Better performances are expected than for discrete variable QKD for various reasons.

Single Photon Cryptography is based on single photon detectors, and these are expensive pieces of equipment (a few k\$/k€/k£), and slow ($<$MHz). Unless you use the more recent superconducting detectors, which are fast, but more expensive, an require cryogenic cooling. Continuous variable systems, allows to use standard photodiodes in a homo- or heterodyne set-up, which is more cheaper (a few €/\$/£) and can be much faster ($>$ GHz): usually CV set-ups are bandwidth is limited by the electronics and the processing, not the detectors.

Furthermore, it was shown in the last decade that the filtering effect of the interferometric detection makes CV protocol much more robust to classical traffic in the same optical fibre, which can allow a much lower operating cost (no need to monopolize a fibre for the quantum channel).

Furthermore, theoretically, CV QKD protocols are closer to the ideal key rate for a given lossy channel. For low loss channel, they can achieve rates > 1 bit/pulse.

It's easier to work with a lot of photons in a stream than to work with a single photon at once. This is explained in the paper introducing continuous-variable quantum key distribution. (With apologies for the paywall. Ms. Greene, tear down this wall! Or read the arXiv preprint if you're not a rebel.)

P.S. I originally answered the question as follows, with the above paragraph at the end, and the answer was accepted. It spawned a long discussion in comments and chat, but, while it represents my perspective on the market for quantum key distribution products today in the context of information security and cryptography, it wasn't appropriate as an answer to the question as asked, about continuous-variable quantum key distribution in the context of the basic research program of quantum key distribution in physics. I am leaving it here for context of the discussion:

One word: money.

Quantum key distribution networks serve no useful cryptographic purpose.

But because rich governments are apparently easily bedazzled with mumbo-jumbo about laws of physics guaranteeing security, it is highly profitable for companies like ID Quantique and MagiQ Technologies to sell packages of snake oil at hundreds of thousands of dollars a pop.

As for the specific case of continuous-variable systems...

(Financial disclosure: I'm not getting a piece of the pie that ID Quantique and MagiQ Technologies are splitting. But then I'm also not getting a piece of any pie in classical cryptography either. In fact I'm pretty bereft of pie at the moment.)

• I neglected to add another item about QKD's uselessness: that as of a couple years ago, all commercial implementations were vulnerable to eavesdropping attacks on the wire because the error bounds were wrong. I didn't add that because I lost track of the citation for it and got bored trying to dig it up. If anyone wants to dig it up, I'd be happy to add that to the list. – Squeamish Ossifrage Aug 28 '17 at 22:39
• That's a cool trick—asserting that authentication is implicit and moving on so I don't have to worry about it! Has this trick been proven secure in the delphic oracle model, or does it work only if you carry guns with you like the military? I'll make sure to remind the author of the next paper I read that they need to have at least 37 pieces of formula flair in their paper or else it won't pass Paul Uszak's standards. (But if you think that paper seeks to ‘debunk quantum mechanics’, I think you didn't bother to read a word of it, not even the abstract.) – Squeamish Ossifrage Aug 29 '17 at 4:08
• @Paul Uszak: would you please care to explain what you mean by Authentication is implicit during deployment as in military field systems. How does it resist an equipment being stolen, or copied after having been temporarily diverted? If that does not fit an answer to the present question, you might make a separate How does authentication work in QKD? question (which I'll upvote), and answer it. – fgrieu Aug 30 '17 at 6:13
• The arXiv version (therefore legal) paper of Raph’s 1999 paper is here : arxiv.org/abs/quant-ph/9907073 – Frédéric Grosshans Aug 31 '17 at 13:00
• I added the arXiv link. (But the only illegal activity is on the part of Sci-Hub, not on the part of someone merely reading what is hosted by Sci-Hub, at least in the United States—and whether laws enabling extortion by academic publishing cartels for access to scientific knowledge are moral is another question altogether.) – Squeamish Ossifrage Aug 31 '17 at 14:19