Distributing secret keys with informationtheoretic security is arguably one of the most important achievements of the field of quantum information processing and communications [1]. The rapid progress in this field has enabled quantum key distribution (QKD) in real-world conditions [2, 3] and commercial devices are now readily available. QKD systems based on continuous variables [4] present the major advantage that they only require standard telecommunication technology, and in particular, that they do not use photon counters. However, these systems were considered up till now unsuitable for longdistance communication [5][6][7]. Here, we overcome all previous limitations and demonstrate for the first time continuous-variable quantum key distribution over 80 km of optical fibre. The demonstration includes all aspects of a practical scenario, with real-time generation of secret keys, stable operation in a regular environment, and use of finite-size data blocks for secret information computation and key distillation. Our results correspond to an implementation guaranteeing the strongest level of security for QKD reported to date for such long distances and pave the way to practical applications of secure quantum communications.

We designed high-efficiency error correcting codes allowing to extract an errorless secret key in a Continuous-Variable Quantum Key Distribution (CVQKD) protocol using a Gaussian modulation of coherent states and a homodyne detection. These codes are available for a wide range of signalto-noise ratios on an Additive White Gaussian Noise Channel (AWGNC) with a binary modulation and can be combined with a multidimensional reconciliation method proven secure against arbitrary collective attacks. This improved reconciliation procedure considerably extends the secure range of CVQKD with a Gaussian modulation, giving a secret key rate of about 10 −3 bit per pulse at a distance of 120 km for reasonable physical parameters.

Establishing an information-theoretic secret key between two parties using a quantum key distribution (QKD) system is only possible when an accurate characterization of the quantum channel and proper device calibration routines are combined. Indeed, security loopholes due to inappropriate calibration routines have been shown for discrete-variable QKD. Here, we propose and provide experimental evidence of an attack targeting the local oscillator calibration routine of a continuousvariable QKD system. The attack consists in manipulating the classical local oscillator pulses during the QKD run in order to modify the clock pulses used at the detection stage. This allows the eavesdropper to bias the shot noise estimation usually performed using a calibrated relationship. This loophole can be used to perform successfully an intercept-resend attack. We characterize the loophole and suggest possible countermeasures.

As quantum key distribution becomes a mature technology, it appears clearly that some assumptions made in the security proofs cannot be justified in practical implementations. This might open the door to possible side-channel attacks. We examine several discrepancies between theoretical models and experimental setups in the case of continuous-variable quantum key distribution. We study in particular the impact of an imperfect modulation on the security of Gaussian protocols and show that approximating the theoretical Gaussian modulation with a discrete one is sufficient in practice. We also address the issue of properly calibrating the detection setup, and in particular the value of the shot noise. Finally, we consider the influence of phase noise in the preparation stage of the protocol and argue that taking this noise into account can improve the secret key rate because this source of noise is not controlled by the eavesdropper. PACS numbers: 03.67.-a, 03.67.DdQuantum Key Distribution (QKD) is a cryptographic primitive allowing two distant parties, Alice and Bob, to distill secret keys in an untrusted environment controlled by an eavesdropper, Eve [1]. Among quantum information technologies, QKD is one of the most advanced, and reaches already commercial applications. The main argument in favor of QKD is its provable security based on the laws of quantum mechanics; it is therefore particularly important to make sure that the security proofs derived for theoretical protocols can be applied to real-world implementations. This is unfortunately never really the case because the security proofs usually assume idealized implementations, which do not take into account all possible experimental imperfections. This opens the door to potential security loopholes [2] that might be successfully exploited by an attacker. Such side-channel attacks have already been demonstrated against commercial QKD systems [3,4].There are basically two ways around side-channel attacks. A drastic solution consists in deciding that the systems held by Alice and Bob should not be trusted: this is the device-independent paradigm, based on the violation of a Bell inequality [5]. While being appealing in theory, this paradigm does not offer a practical solution since violating a Bell inequality in a loophole-free fashion has not been achieved until now. A more practical way to address side-channel attacks aims at refining the theoretical models used for security proofs in order to include various sources of experimental imperfections. This involves, for instance, developing better models for the state preparation, including the light source, the modulation, and the noise, and for the detection, including the quantum efficiency and the calibration of the noise.In this paper, we follow the second approach in the case of Continuous-Variable (CV) QKD protocols. The main specificity of these protocols is that they use a homodyne detection instead of single-photon counters, which makes them attractive from a practical perspective. Moreover, they are c...

Here, we demonstrate that a practical continuous-variable quantum key distribution (QKD) protocol relying on the Gaussian modulation of coherent states features secret key rates that cannot be achieved with standard qubit discrete-variable QKD protocols. Notably, we report a practical postprocessing that allows us to extract more than 1 bit of secret key per channel use.