The science of quantum information has arisen over the last two decades centered on the manipulation of individual quanta of information, known as quantum bits or qubits. Quantum computers, quantum cryptography and quantum teleportation are among the most celebrated ideas that have emerged from this new field. It was realized later on that using continuous-variable quantum information carriers, instead of qubits, constitutes an extremely powerful alternative approach to quantum information processing. This review focuses on continuous-variable quantum information processes that rely on any combination of Gaussian states, Gaussian operations, and Gaussian measurements. Interestingly, such a restriction to the Gaussian realm comes with various benefits, since on the theoretical side, simple analytical tools are available and, on the experimental side, optical components effecting Gaussian processes are readily available in the laboratory. Yet, Gaussian quantum information processing opens the way to a wide variety of tasks and applications, including quantum communication, quantum cryptography, quantum computation, quantum teleportation, and quantum state and channel discrimination. This review reports on the state of the art in this field, ranging from the basic theoretical tools and landmark experimental realizations to the most recent successful developments.

Quantum key distribution (QKD) allows two users to communicate with theoretically provable secrecy by encoding information on photonic qubits. Current encoders are complex, however, which reduces their appeal for practical use and introduces potential vulnerabilities to quantum attacks. Distributed-phase-reference (DPR) systems were introduced as a simpler alternative, but have not yet been proven practically secure against all classes of attack. Here we demonstrate the first DPR QKD system with information-theoretic security. Using a novel light source, where the coherence between pulses can be controlled on a pulse-by-pulse basis, we implement a secure DPR system based on the differential quadrature phase shift protocol. The system is modulator-free, does not require active stabilization or a complex receiver, and also offers megabit per second key rates, almost three times higher than the standard Bennett-Brassard 1984 (BB84) protocol. This enhanced performance and security highlights the potential for DPR protocols to be adopted for real-world applications. Quantum key distribution (QKD) has developed strongly since the proposal of the first protocol in 1984 1-3. The future could see widespread quantum networks similar to those in Tokyo 4 and Vienna 5 and global secure communication enabled by QKD over satellites 6. These advances depend on the development of simple, cost-effective and high performance implementations. Innovations in both protocols and system hardware are required to achieve this. Nearly two decades after the inception of Bennett-Brassard 1984 (BB84) 1 , distributed phase reference (DPR) QKD was proposed, allowing for much simpler experimental implementations. The class includes the differential phase shift 7,8 and coherent-one-way 9,10 protocols. One advantage is that the transmitters needed to realize these DPR protocols can be made using off-the-shelf telecom lasers and modulators. However the benefit of their simpler implementation is outweighed by a seriously degraded performance when full security is taken into account 3,11,12. To plug the security gap, two further DPR protocols were proposed: round-robin differential phase shift and differential quadrature phase shift (DQPS). The former simplifies the estimation of Eve's information, but requires an overly complicated QKD receiver setup 13-16 , making it impractical. The latter separates the signal from the differential phase shift protocol into blocks, each having a global phase that varies randomly, ensuring the protocol is immune against coherent attacks 17,18. It does, however, stray from the main goal of DPR protocols to provide simpler QKD implementations, due to the phase randomization requirement that would ordinarily require extra system components. a) Electronic mail: glr28@cam.ac.uk In this work we show it is possible to produce phase coherent and phase randomized pulses from a single device. This device is based on optical injection of one laser diode into another, removing the need for a phase-randomization component in D...

Quantum continuous variables [1] are being explored [2,3,4,5,6,7,8,9,10,11,12,13,14] as an alternative means to implement quantum key distribution, which is usually based on single photon counting [15]. The former approach is potentially advantageous because it should enable higher key distribution rates. Here we propose and experimentally demonstrate a quantum key distribution protocol based on the transmission of gaussian-modulated coherent states (consisting of laser pulses containing a few hundred photons) and shot-noise-limited homodyne detection; squeezed or entangled beams are not required [13]. Complete secret key extraction is achieved using a reverse reconciliation [14] technique followed by privacy amplification. The reverse reconciliation technique is in principle secure for any value of the line transmission, against gaussian individual attacks based on entanglement and quantum memories. Our table-top experiment yields a net key transmission rate of about 1.7 megabits per second for a loss-free line, and 75 kilobits per second for a line with losses of 3.1 dB. We anticipate that the scheme should remain effective for lines with higher losses, particularly because the present limitations are essentially technical, so that significant margin for improvement is available on both the hardware and software.

We consider two quantum cryptographic schemes relying on encoding the key into qudits, i.e., quantum states in a d-dimensional Hilbert space. The first cryptosystem uses two mutually unbiased bases (thereby extending the BB84 scheme), while the second exploits all d 1 1 available such bases (extending the six-state protocol for qubits). We derive the information gained by a potential eavesdropper applying a cloning-based individual attack, along with an upper bound on the error rate that ensures unconditional security against coherent attacks.

The adiabatic theorem has been recently used to design quantum algorithms of a new kind, where the quantum computer evolves slowly enough so that it remains near its instantaneous ground state which tends to the solution [1]. We apply this time-dependent Hamiltonian approach to the Grover's problem, i. e., searching a marked item in an unstructured database. We find that, by adjusting the evolution rate of the Hamiltonian so as to keep the evolution adiabatic on each infinitesimal time interval, the total running time is of order √ N , where N is the number of items in the database. We thus recover the advantage of Grover's standard algorithm as compared to a classical search, scaling as N . This is in contrast with the constant-rate adiabatic approach developed in [1], where the requirement of adiabaticity is expressed only globally, resulting in a time of order N .

A fully general approach to the security analysis of continuous-variable quantum key distribution (CV-QKD) is presented. Provided that the quantum channel is estimated via the covariance matrix of the quadratures, Gaussian attacks are shown to be optimal against all eavesdropping strategies, including collective and coherent attacks. The proof is made strikingly simple by combining a physical model of measurement, an entanglement-based description of CV-QKD, and a recent powerful result on the extremality of Gaussian states [Phys. Rev. Lett. 96, 080502 (2006)].PACS numbers: 03.67. Dd, 89.70.+c, Continuous-variables quantum information [1] has attracted a rapidly increasing interest over the past few years. Several QKD schemes based on a Gaussian modulation of coherent states of light combined with homodyne or heterodyne detection have been proposed [2,3] and experimentally demonstrated [4,5]. These protocols have the advantage of being based on standard optical telecom components and thereby of working at high repetition rates compared to the schemes based on singlephoton detectors. The first security proof of CV-QKD was restricted to Gaussian individuals attacks [2,3,4,6]. In such an attack, the eavesdropper (Eve) is assumed to interact individually -according to a Gaussian map -with each of the signal pulses sent over the line, and then to perform a Gaussian (homodyne or heterodyne) measurement on her probe after the basis information (if any) is disclosed but before the full classical post-processing. Later on, it was shown that non-Gaussian individual attacks cannot beat Gaussian attacks [7], so that studying the security against Gaussian individual attacks is quite justified. This proof extends to the case where Eve attacks finite-size blocks of pulses, but does not cover the important class of collective attacks, where Eve jointly measures all her probes (each having interacted with a signal pulse) after the classical post-processing has taken place [8,9,10]. The security versus Gaussian collective attacks was recently studied in [11,12], but a definitive proof of the optimality of Gaussian attacks was missing.In this Letter, we prove that the optimal collective attack reduces to a Gaussian attack that is completely characterized by the covariance matrix of the quadratures observed by the emitter (Alice) and receiver (Bob). This optimality is probably even stronger in view of the recent result that the most general attacks, namely coherent attacks (where Eve coherently interacts with all signal pulses and performs a joint measurement after the classical post-processing), cannot outperform collective attacks [8,9], implying that it is sufficient to check the security of QKD against collective attacks.One-way QKD protocols with Gaussian continuous variables are divided in two steps, a quantum communication part followed by a classical post-processing. In the quantum part, Alice sends either a displaced squeezed state encoding a random Gaussian variable or a coherent state encoding two Gaussian variables. The...

A framework for a quantum mechanical information theory is introduced that is based entirely on density operators, and gives rise to a unified description of classical correlation and quantum entanglement. Unlike in classical (Shannon) information theory, quantum (von Neumann) conditional entropies can be negative when considering quantum entangled systems, a fact related to quantum nonseparability. The possibility that negative (virtual) information can be carried by entangled particles suggests a consistent interpretation of quantum informational processes. [S0031-9007(97) [4] have been obtained recently, quantum information is still puzzling in many respects. This is especially true for quantum teleportation and superdense coding, two purely quantum communication schemes devised recently [5]. Indeed, these dual processes which rely on the quantum correlation between the two members of a spatially separated Einstein-PodolskyRosen (EPR) pair are difficult to interpret in terms of information theory. We show in this Letter that these processes can be understood in a consistent way by exploiting a fundamental difference between Shannon theory [6] and an extended information theory that accounts for quantum entanglement. As we shall see, the latter allows for negative conditional entropy even though this is forbidden classically. This leads us to propose that such quantum informational processes can be described by diagramsmuch like particle physics reactions-involving particles carrying negative (virtual) information. By analogy with antiparticles, we refer to them as antiqubits.Previous attempts to describe quantum informational processes have generally relied on the formulas of classical information theory supplemented with quantum probabilities, not amplitudes. However, it has been realized since Schumacher [3] that the von Neumann entropy has an information-theoretical meaning, characterizing (asymptotically) the minimum amount of quantum resources required to code an ensemble of quantum states. This suggests that an extended information theory can be defined that explicitly takes quantum phases into account, as attempted in this Letter. The theory described here characterizes multipartite quantum systems using only density operators and von Neumann entropies. It includes Shannon theory as a special case but describes quantum entanglement as well, thereby providing a unified treatment of classical and quantum information. To be specific, let us consider a composite system consisting of two (classical or quantum) variables, A and B, and outline in parallel the classical and our quantum informationtheoretic treatment of it. In classical information theory, we define the Shannon entropy of A [6],where the variable A takes on value a with probability p͑a͒. It is interpreted as the uncertainty about A [an analogous definition holds for H͑B͒]. The quantum analog is the von Neumann entropy S͑r A ͒ of a quantum source A described by the density operator r A ,where Tr A denotes the trace over the degrees of freedom ...

A continuous key distribution scheme is proposed that relies on a pair of canonically conjugate quantum variables. It allows two remote parties to share a secret Gaussian key by encoding it into one of the two quadrature components of a single-mode electromagnetic field. The resulting quantum cryptographic information vs disturbance tradeoff is investigated for an individual attack based on the optimal continuous cloning machine. It is shown that the information gained by the eavesdropper then simply equals the information lost by the receiver.PACS numbers: 03.67. Dd, 03.65.Bz, 89.70.+c Quantum cryptography-or, more precisely, quantum key distribution-is a technique that allows two remote parties to share a secret chain of random bits (a secret key) that can be used for exchanging encrypted information [1][2][3]. The security of this process fundamentally relies on the Heisenberg uncertainty principle, or on the fact that any measurement of incompatible variables inevitably affects the state of a quantum system. Any leak of information to an eavesdropper necessarily induces a disturbance of the system, which is, in principle, detectable by the authorized receiver.In most quantum cryptosystems proposed so far, a single photon (or, in practice, a weak coherent state with an average photon number lower than one) is used to carry each bit of the key. Mathematically, the security is based on the use of a pair of non-commuting observables such as the x-and z-projections of a spin-1/2 particle, σ x and σ z , whose eigenstates are used to encode the key. The sender (Alice) randomly chooses to encode the key using either σ z (0 is encoded as | ↑ and 1 as | ↓ ) or σ x (0 is encoded as 2 −1/2 (| ↑ + | ↓ ) and 1 as 2 −1/2 (| ↑ − | ↓ )), the choice of the basis being disclosed only after the receiver (Bob) has measured the photon. This guarantees that an eavesdropper (Eve) cannot read the key without corrupting the transmission. Such a procedure, known as BB84 [1], is at the heart of most of the quantum cryptographic schemes that have been experimentally demonstrated in the past few years, which are based either on the polarization (e. g. [4,5]) or the optical phase (e. g. [6]) of single photons. An alternative scheme, realized experimentally only a year ago [7-9], can also be used based on a pair of polarization-entangled photons instead of single photons [10]. It is, however, fundamentally equivalent to BB84 (see [11]) and it again relies on the algebra of spin-1/2 particles.Recently, it has been shown that another protocol for quantum key distribution can be devised based on continuous variables, where squeezed coherent light modes are used to carry the key [12][13][14]. In these techniques, one exploits a pair of (continuous) canonical variables such as the two quadratures X 1 and X 2 of the amplitude of a mode of the electromagnetic field, which be-have just as position and momentum. The uncertainty relation ∆X 1 ∆X 2 ≥ 1/4 then implies than Eve cannot read both quadrature components without degrading the state. Even ...