## Abstract

We analyze homodyne detection of macroscopically bright multimode nonclassical states of light and propose their application in quantum communication. We observe that the homodyne detection is sensitive to a mode-matching of the bright light to the highly intense local oscillator. Unmatched bright modes of light result in additional noise which technically limits detection of Gaussian entanglement at macroscopic level. When the mode-matching is sufficient, we show that multimode quantum key distribution with bright beams is feasible. It finally merges the quantum communication with classical optical technology of visible beams of light.

© 2015 Optical Society of America

## 1. Introduction

Quantum physics revealed many advantages overcoming the limits of classical physics. While classical physics deals with large macroscopic systems, quantum physics describes various non-classical effects in microscopic systems. During the last decades, the control of microscopic quantum systems, like photons and atoms [1], allowed to test the potential of quantum physics in communication, metrology and computing. In many cases the control remains quite challenging because of sensitive and tiny character of microscopic systems. The key solution can be found in macroscopic quantum states of light which are easy to handle like in classical optics, but still keep relevant quantum features, which are needed for a given task. A macroscopic nature however simultaneously means that large number of atoms or optical modes cannot be precisely controlled. It is contradictory to existence of many very sensitive quantum phenomena. A loss of single particle or mode can often cause a large reduction of quantum nonclassical effects, which could bring quantum states closer to classical ones.

As an example of the macroscopic nonclassical quantum states, bright twin beams and entangled states of large numbers of atoms have been generated during the last decades [2–8]. The bright photonic twin beams represent an empirical evidence of non-classical states visible by a naked eye, they are therefore easy to manipulate like the classical light beams. The twin beams are non-classical because they are highly correlated in energy, which contradicts classical wave theory [9]. High energy of both beams arises from large number of the modes, which results in the macroscopic character of the beams. The photon number correlations are fortunately robust against a loss of few modes or receiving of a small number of unmatched modes in the detectors. Such robustness allows one to detect quantum features of macroscopic beams. A single pair of correlated modes inside the twin beam is also entangled in phase-sensitive continuous variables (CVs) of light [10]. It can be detected by a pair of single-mode homodyne detectors with strongly coherent local oscillators (LO), serving as the phase references. Such entangled states have interestingly a direct application, they can be used to generate a secure key between two distant parties in CV quantum key distribution (QKD) [11], which was previously also shown possible with the coherent states of light [12].

The symmetrical multimode entangled states with low energy can still be indistinguishably detected by multimode homodyne detectors, if the sufficiently large-amplitude LOs are matching all the modes of entangled states. The modes, which are not matched to the LO, are simply negligible, compared to the matched modes. Consequently, the multimode detectors allow to generate a secure key equivalently to the single-mode detection as it was recently shown in [13]. Now as a final step towards the use of classical beams, in the sense of their macroscopic character, for quantum communication, we consider the bright multimode states and waive the assumption of the weakness of the beams used for quantum communication.

In this paper we show that as the energy of multimode beams increases, the homodyne detector starts to be sensitive to the large incoming energy of the modes which are not matched to LO. This sensitivity in fact witnesses the macroscopically large intensity received by a homo-dyne detector. When the macroscopic modes do not match any mode of the LO, they directly contribute to the noise of the detector. Homodyne detection then becomes more noisy because of the detection of macroscopic very bright light. The homodyne measurements of weak states with additional unmatched signals was previously studied in the context of ultrafast detection [14]. In the current paper we show how the structure of the bright matched and unmatched signal and also how unbalancing of the homodyne detection influence the noise caused by the macroscopic character of the states, and then focus on the role of such noise in the detection of nonclassical properties of light as well as on the applicability of the macroscopic states to QKD. This type of noise can be small, however, it cannot be neglected since it comes from outside of the detector. It can be fully exploited by an eavesdropper to substantially reduce security of QKD. It therefore represents the most relevant limitation for the application of macroscopic nonclassical states of light in secure quantum communication.

Using the homodyne detection of bright nonclassical light, we propose the feasible CV QKD implementation with the macroscopically bright nonclassical beams. Our proposal opposes the discrete-variable QKD (see [15] for review), based on the single photons and faint light beams, and represents the very natural extension of CV QKD on the macroscopic states. We suggest an optimal way of implementing QKD with bright beams, which are easy to handle since they can be visible by a naked eye. The homodyne detector noise caused by the macroscopic beams is nonlinear, it depends on intensity of impinging light. Due to this, a trade-off appears between security and macroscopic nature when entanglement increases. A distance of secure transmission is shorten by that noise, when intensity increases, but the security can be still guaranteed for. It is therefore possible to extend CV QKD to the macroscopic version. In this way, QKD can be finally realized by visible beams having the same features as the classical optical beams.

## 2. Homodyne detection of bright multimode states

In classical optics, light beams typically consist of large number of modes, which are not individually controllable and measurable. To demonstrate the delicate aspect of such macroscopic nature of the signal states we consider each of the beams consisting of *M* modes matched with the respective LO modes (which are shared between the communicating parties or are generated locally [16], and serve as a phase reference), and *N* unmatched modes which do not match any LO modes. We study the impact of the bright auxiliary modes, which are not matched by the LO modes, but can affect the quadrature measurement and contribute to the noise in the quadrature variance. The mode mismatch can be the result of the difference in the mode structures of the source and the LO, but it can also be imposed by the effects in the channel such as the mode dispersion, when some of the signal modes lose mutual coherence with the respective modes of the LO. In the multimode version of homodyne detection depicted in the Fig. 1, the coupling between the signal modes and the bright or vacuum modes of the LO modes is provided by a beamsplitter. One input of the beamsplitter is fed by the matched signal modes, characterized by the quantum operators *a*_{S1} ..*a*_{SM} and the auxiliary unmatched modes of the source, characterized by *b*_{S1} ..*b*_{SN}. The other port is fed by the very bright LO modes *a*_{LO1} ..*a*_{LOM}, being the classical phase reference for the homodyne detection, which are coupled to the modes *a*_{Si}. The modes *b*_{Sj} are coupled to the vacuum modes *b*_{Vj}, i.e., we assume that the modes *b*_{Sj} are not matched by any of the bright modes of the LO. We thus assume here that the signal modes are either matched to the strong modes of the LO or not. Furthermore, if modes *b*_{Sj} are weak, they do not play role in the detection since they are not amplified, but if they are strong they do play role and require no LO to be amplified. The coupling constants can be generally different for different modes entering the beamsplitter (i.e. the transmittance values of the coupling beam-splitter *T*_{ai} and *T*_{bj} are different for all the modes modes *a*_{Si} and *b*_{Sj}) and not exactly equal to 1/2, which we refer to as an imperfect (unbalanced) homodyne detection. Note that vacuum input modes can also match the LO modes, but their effect would be negligible and is therefore not considered.

The homodyne detection results in the photocurrent difference Δ* _{i}*, which is proportional to the difference of the photon numbers

*n*

_{1}−

*g*·

*n*

_{2}measured at the two mode-nondiscriminating detectors. Here

*g*is the coefficient applied during the measurement process to the data from one of the detectors, which is aimed at removing the contribution from the matched signal modes in the case of the unbalanced detection. This is the standard method in the homodyne detection and the role of the coefficient

*g*is discussed further in subsection 2.2. Each of the photon numbers consists of the contributions from the output modes of the coupling beamsplitter

*a′*

_{Si,LOi}and

*b′*

_{Sj,Vj}(where *′ indicates an output mode after the coupling), which are defined by the well known input-output relations of a beamsplitter:

*b′*

_{Sj},

*b′*

_{Vj}(and their conjugate), which are defined through the operators of the input modes

*b*

_{Sj},

*b*

_{Vj}(and respectively their conjugate) and are governed by the coupling ratios

*T*

_{bj}.

The photon numbers detected by the photodetectors at the outputs of the coupling taking into account the suppression of the auxiliary modes then read ${n}_{1}={\sum}_{i}^{M}{a}_{{S}_{i}}^{\prime \u2020}{a}_{{S}_{i}}^{\prime}+\epsilon {\sum}_{j}^{N}{b}_{{S}_{j}}^{\prime \u2020}{b}_{{S}_{j}}^{\prime}$ and ${n}_{2}={\sum}_{i}^{M}{a}_{{\mathit{LO}}_{i}}^{\prime \u2020}{a}_{{\mathit{LO}}_{i}}^{\prime}+\epsilon {\sum}_{j}^{N}{b}_{{V}_{j}}^{\prime \u2020}{b}_{{V}_{j}}^{\prime}$. They can be obtained from the input-output relations Eq. (1) as

*ε*, which is applied to the contribution from the auxiliary modes

*b′*

_{Sj},

*b′*

_{Vj}. Such inefficiency can vary in different detectors therefore in our analysis we consider it to be an unknown parameter of a particular set-up. Based on the estimation of

*ε*for a given detector the possibility to filter out the unmatched signal can be estimated. We therefore use

*ε*to characterize the robustness of the homodyne measurement of the macroscopic bright light and describe the ability of a homodyne detector to measure the macroscopic states on a microscopic level.

The LO in a *k*-th mode is a sufficiently strong coherent beam which can be approximated by a classical complex amplitude as *a*_{LOk} = *α* · *e ^{iϕ}*, where

*α*is the real amplitude and

*ϕ*defines the phase (both

*α*and

*ϕ*assumed to be the same for all the LO modes). Although the bright states are measured, the LO modes are still needed to be much brighter in order to reach effective and robust homodyne detection. Therefore the homodyne detection is measuring the observable proportional to ${a}_{{S}_{k}}^{\u2020}{e}^{i\varphi}+{a}_{{S}_{k}}{e}^{-i\varphi}$ in the matched modes. If

*ϕ*= 0, the homodyne detection measures the quadrature ${x}_{k}={a}_{{S}_{k}}^{\u2020}+{a}_{{S}_{k}}$ of the signal, while for

*ϕ*=

*π*/2 the conjugate quadrature ${P}_{k}=i\left({a}_{{S}_{k}}^{\u2020}-{a}_{{S}_{k}}\right)$ is measured. Further with no loss of generality we put

*ϕ*to zero thus assuming that x-quadrature is measured in each of the signal modes.

#### 2.1. Balanced detection

We first consider the optimal and simplest case of the balanced detection, i.e. *T*_{ai} = *T*_{bj} = 1/2 for any *i*, *j* and *g* = 1. In this case the photon numbers read
${n}_{1}={\sum}_{i}{a}_{{S}_{i}}^{\u2020}{a}_{{S}_{i}}^{\prime}+\epsilon {\sum}_{j}{b}_{{S}_{j}}^{\prime \u2020}{b}_{{S}_{j}}^{\prime}$ and
${n}_{2}={\sum}_{i}{a}_{{\mathit{LO}}_{i}}^{\prime \u2020}{a}_{{\mathit{LO}}_{i}}^{\prime}+\epsilon {\sum}_{j}{b}_{{V}_{j}}^{\prime \u2020}{b}_{{V}_{j}}^{\prime}$ and the photon-number difference expressed through the operators of the incoming modes taking into account the parametrization of the LO is

*a*

_{Si}and the self-energy detection in the auxiliary signal modes

*b*

_{Sj}resulting in the noise contribution.

The noise arising from the brightness and multimode structure of the states becomes present in the quadrature variance measured by a homodyne detector. The quadrature variance is obtained from the variance of the difference photocurrent
$\mathit{Var}({\mathrm{\Delta}}_{i})=\u3008{\mathrm{\Delta}}_{i}^{2}\u3009-{\u3008{\mathrm{\Delta}}_{i}\u3009}^{2}$, where averaging is performed on the incoming states, namely the vacuum states in modes *b*_{Vj} and thermal states (twin beams with one of the beams being traced out after measurement at Alice, or Gaussian-modulated squeezed states) in modes *a*_{Si} and *b*_{Sj}. The quadrature variance is essential when studying Gaussian nonclassical properties and their application in CV QKD. Taking this into account and tracing out the vacuum modes *b*_{Sj} we arrive at
$\u3008{\mathrm{\Delta}}_{i}^{2}\u3009={\alpha}^{2}{\sum}_{i}\u3008{x}_{i}^{2}\u3009+{\epsilon}^{2}{\sum}_{j}\u3008{b}_{{S}_{j}}^{\u2020}{b}_{{S}_{j}}\u3009$ and 〈Δ* _{i}*〉 =

*α*∑

*〈*

_{i}*x*〉. The variance of the difference photocurrent must be normalized by the vacuum variance corresponding to the measurement taken with the input signal being blocked which is typically done in the experiment. For the detector being considered such variance would be $\mathit{Var}\left({\mathrm{\Delta}}_{i}^{0}\right)=M{\alpha}^{2}$, thus the normalized variance becomes

_{i}*n̄*is the mean number of photons in a signal mode,

*Var*(

*X*) is the quadrature variance of a signal mode, and Thus the quadrature variance even in the case of the perfectly balanced homodyne detection involves the noise term which is proportional to the mean photon-number in the additional signal modes. Clearly this inefficiency of the modes selection can be reduced by decreasing

*N*using better mode matching or by increasing amplitude

*α*of the LO. By reducing the inefficiency

*ε*the noise term concerned with the macroscopic brightness of the signal can be strongly reduced. However it does not vanish as long as the bright unmatched modes are present. Therefore the homodyne detection of the multimode bright light becomes equivalent to the homodyne detection on the single-mode signal with the excess noise proportional to the mean photon number of a signal mode.

_{tot}#### 2.2. Unbalanced detection

If the homodyne detection of the macroscopic multimode signal is unbalanced, then the normalized photocurrent difference involves an additional term, proportional to the photon-number variance in the signal mode, *Var*(*n*), so that in the two-mode case the normalized photocurrent difference reads

*g*applied to the contribution

*n*

_{2}from the second detector is $g=\frac{{T}_{a}}{1-{T}_{a}}$ so that the term proportional to ${a}_{s}^{\u2020}{a}_{s}$ vanishes. This way the impact of the photon number fluctuations in the main signal mode

*a*related to the unbalanced detection

_{s}*T*≠ 1/2 is compensated, but the effect of the unbalancing remains present in the contribution from the unmatched modes.

_{a}In the non-macroscopic regime the noise related to the unmatched signal modes can be also present in the results of the homodyne detection, but its amount is very small due to the low mean photon number and therefore can be typically neglected especially if the intensity of the beam is additionally decreased by the channel attenuation. However in the macroscopic case, when the states are heavily multimode and intense, the noise arising from the macroscopic character must be taken into account as it can become crucial for transmission of the entanglement or for the secure key distribution as we show in the next Section. The limitations imposed by such the detection noise get more strict as the beams get closer to the macroscopic character.

## 3. Effects of macroscopic character on quantum resource and security

We consider the effect of the noise concerned with the homodyning of macroscopic bright states on the detection of nonclassical resources contained in the states as well as on the application to secure CV QKD. To do so we consider two main quantum communication scenarios used to share a nonclassical resource or a secure key: prepare-and-measure (P&M) and entanglement-(EPR-) based as depicted in the Fig. 2. In the case of P&M scenario (Fig. 2, left) Alice possesses a source of the multimode bright squeezed light with quadrature variance *V _{S}* < 1 in each mode, and applies modulation (random Gaussian-distributed displacement) to a signal up to the thermal state with variance 1/

*V*. The signal then travels through a quantum channel to a remote party Bob, who applies homodyne detection on the signal. The channel is characterized by transmittance

_{S}*η*and quadrature excess noise

*χ*, given in shot-noise units (SNU) of vacuum quadrature fluctuations. In the case of the EPR-based scenario (Fig. 2, right) Alice prepares the bright multimode entangled states, being the combination of twin beam states in each of the pairs of modes, and measures one of the beams by a local homodyne detector, while the other beam travels through the channel and is measured by Bob. We characterize the states by the mean photon number per mode

*n̄*or by total mean photon number per beam

*n̄*= (

_{tot}*M*+

*N*)

*n̄*. The channel transforms a quadrature of a given i-th mode as ${x}_{i}^{\prime}=\sqrt{\eta}\left({x}_{i}+{x}_{N}\right)+\sqrt{1-\eta}{x}_{0}$ (similarly for

*p*-quadrature), where

*x*stands for the random displacement introduced by the channel excess noise with variance

_{N}*Var*(

*x*) =

_{N}*χ*, and

*x*

_{0}represents a vacuum quadrature, corresponding to the pure channel loss, with

*Var*(

*x*

_{0}) = 1. Importantly, the channel transmittance degrades the signal by attenuating it, but also affects the noise arising from the macroscopic character of the signal, since the mean photon number

*n̄*in a signal mode is scaled as

*ηn̄*. This improves the applicability of the macroscopically bright nonclassical light in the practical communication scenarios over lossy channels. Further we consider the particular cases and the role of macroscopic structure of the states on the resources and security of CV QKD with such states.

#### 3.1. Homodyne detection of squeezing and entanglement

Before the detailed discussion of applicability of macroscopically bright light to secure quantum communication, we study the detection of basic nonclassical resources, contained in such light beams. It is easy to see, that the bright multimode quadrature squeezing *V _{S}* < 1 with mean mode photon number

*n̄*(defined by the squeezing and the possible displacement of a squeezed state) prepared by Alice and measured by the homodyne detector at the remote side in the P&M scenario (Fig. 2, left) will be degraded by the noise concerned with macroscopic structure (contrary to a low energy case, when residual squeezing can be in principle observed upon any channel transmittance). The squeezing will become absent in the measurement independently of the channel transmittance when the mean photon number in a signal mode reaches $\overline{n}=\left(1-{V}_{S}\right)/{\epsilon}_{\mathit{tot}}^{2}$. For example,

*V*= −10 dB of quadrature squeezing at

_{S}*ε*= 10

_{tot}^{−2}would be undetectable at

*n̄*≈ 10

^{4}photons per mode.

Similarly the noise concerned with the homodyne detection of macroscopic states degrades the quantum entanglement resource of the states in the entanglement sharing scheme (Fig. 2, right). We analyze the effect of such noise on the entanglement resource in terms of the logarithmic negativity [18], being the computable measure of entanglement. The entanglement is then lost independently of the pure channel loss (*χ*= 0) at
$\overline{n}=\frac{1}{{\epsilon}_{\mathit{tot}}^{2}+\left(1+{\epsilon}_{\mathit{tot}}^{2}/4\right)}$ being approximately
$\overline{n}={\epsilon}_{\mathit{tot}}^{-2}$. Therefore the proper suppression of the auxiliary modes can improve the detection of entanglement of the macroscopic states by the homodyne detectors. The dependence of the entanglement in the terms of the logarithmic negativity on the total mean photon number of the beams is given in Fig. 3, left. It is evident from the plots, that for the given parameters of the detection and of the channel there is an optimal energy of the states that maximizes the entanglement.

#### 3.2. Effect on security of CV QKD

We consider the P&M CV QKD scheme using macroscopic squeezed states as depicted in the Fig. 2, left. Such a scheme is equivalent to the EPR-based one [19] (Fig. 2, right) if the detection on the Alice’s side is ideal (i.e., does not contain the noise arising from the macroscopic character), this equivalence will be used further. The security of CV QKD is analyzed using the covariance matrix formalism applied to the entangled state shared between the trusted parties, which is sufficient due to the extremality of Gaussian states [20] and subsequent optimality of Gaussian collective attacks [21, 22] in the assumption that an eavesdropper holds the purification of the untrusted noise. In our security analysis we therefore consider the effect of the macroscopic character of the signal on the covariance matrix of the state shared between the trusted parties. Since covariance matrices fully describe the Gaussian states, our approach complies with the optimal collective Gaussian attacks, while purification assumption allows us to analyze the security of the protocol not relying on a particular possible design of an eavesdropping attack. Note, however, that implementation-specific attacks on CV QKD [23–25] (also referred to as quantum hacking) can be also possible in the macroscopic case. An eavesdropper can potentially explore e.g. the nonlinear response of the detectors in the strong energy regime, which would affect the calibration of the noise. Such attacks require a separate study based on the particular properties of the detectors. In the following study we focus on the general effects of the macroscopic character of the beams, which will unavoidably be present in any realization of CV QKD with macroscopic light and homodyne detection.

The lower bound on the secure key in the case of collective attacks in the asymptotic regime and reverse reconciliation scenario (being stable against channel loss) is given by

where*β*∈ (0, 1) is the post-processing efficiency (we further use

*β*= 97% following the efficiency of the existing error correcting codes [26]),

*I*is the mutual (Shannon) information between the trusted parties, and

_{AB}*χ*is the Holevo bound, which upper limits the information leakage from the given channel. The information quantities involved in Eq. (8) are obtained from the elements of covariance matrix of the state effectively shared between Alice and Bob [27], taking into account the state and the channel parameters, and the noise arising from the macroscopic character of the beams. Such noise should be attributed to the channel (i.e., considered untrusted) since photon number in the auxiliary modes can be controlled by a potential eavesdropper who may thus hold the purification of the noise. Therefore, similarly to the distribution of entanglement, the trade-off between brightness or degree of entanglement of the source and the security of CV QKD appears. Indeed, the excess noise due to macroscopic structure can lead to the security break already in the case of a highly transmitting (even perfect) channel and perfectly balanced homodyne detection. Similarly to transmission of entanglement, it requires optimization of the total mean photon number for the given number of modes and

_{BE}*ε*, which effectively characterizes the imperfection of the homodyne detector, as shown in the Fig. 3, right, where the key rate has the similar profile as the Gaussian entanglement given in the Fig. 3, left (but contrary to entanglement the security is lost at different mean photon numbers for different transmittance values).

_{tot}We show, that when the unmatched modes are properly suppressed by mode selection and/or power of the LO and when the number of modes is large (so that individually modes are not bright), the Gaussian CV QKD with bright multimode states is possible at the reasonably long distances, as depicted in the Fig. 4 (left), where the key rate versus channel attenuation for *ε _{tot}* = 10

^{−2}and for different mean photon numbers per mode is given. If the number of modes is high enough and the proper wavelength is chosen, such beams can be visible by a naked eye and become easier to handle.

The unbalanced detection in the macroscopic regime slightly reduces the range of CV QKD with macroscopic states as shown in the Fig. 4, right, but still enables the secure key distribution in the long-distance channels (the negative effect of the detection unbalancing becomes negligible for a better mode selection, i.e. lower *ε _{tot}* or for lower mean photon number per mode). Note that the additional noise arising from the generally unbalanced detection is scaled down by the square of the channel transmittance

*η*

^{2}, which reduces the negative effect.

The limitation on the post-processing efficiency reduces the applicability of the protocol and requires stronger control over the number of modes (which need to be increased) or equivalently the mean photon number per mode (which must be reduced). Nevertheless, the CV QKD can be still deployed over strongly attenuating channels, corresponding to middle-range distances in a telecom fiber (with attenuation of −0.2 dB/km) or free space. This justifies the possibility to build CV QKD using experimentally generated bright macroscopic entangled states containing e.g. up to 10^{5} photons per pulse distributed by 10^{4} modes [6]. Assuming conversion to a telecom wavelength, presence of 5% SNU of channel noise, realistic post-processing, and total auxiliary mode suppression inefficiency *ε _{tot}* = 10

^{−2}, the CV QKD can be therefore implemented in the asymptotic limit at up to 180 km with

*n̄*= 10, at up to 60 km with

*n̄*= 10

^{2}, and at up to 40 km with

*n̄*= 10

^{3}. The distances, however, would strongly depend on the particular implementation. Note that if the bright multimode coherent states are used instead (i.e.,

*V*= 1), the CV QKD can be still implemented, but the tolerable loss would be reduced by few dB. Therefore, with the strongly multimode states we can reach security using bright optical beams, which are easier to handle. Moreover, if the LO is reconstructed locally [16], the quantum signal appears to be the only state of light propagating through the channel and the brightness of the signal beams becomes crucial for handling the beams, which then waives the necessity in using additional bright pulses for beam pointing. Also the channel estimation with the stronger beams can be more efficient. This suggests the promising application of macroscopically bright nonclassical light in quantum communication.

_{S}## 4. Conclusion

We shown that the impact of macroscopic character of light on the realistic homodyne detection of the macroscopically bright multimode signal results in the additional noise, which depends on photon numbers in the unmatched signal modes. Such noise reduces the entanglement and applicability of the states in secure quantum communication. However, if the mode-matching is efficient and/or brightness of the individual modes is reduced, the entanglement and squeezing can be observed by a homodyne detector. Based on this observation, we proposed the quantum communication scheme based on the macroscopic nonclassical light. We shown that QKD can be implemented with the macroscopically bright light. We therefore demonstrated the theoretical possibility of building secure quantum communication channels with the macroscopically bright nonclassical states of light.

## Acknowledgments

The research leading the these results has received funding from the EU FP7 under Grant Agreement No. 308803 (project BRISQ2). V.C.U. and L.R. acknowledge the project 13-27533J of GAČR.

## References and links

**1. **N. J. Cerf, G. Leuchs, and E. S. Polzik, *Quantum Information with Continuous Variables of Atoms and Light* (Imperial College Press, 2007).

**2. **J. Hald, J. Sørensen, C. Schori, and E. Polzik, “Spin squeezed atoms: a macroscopic entangled ensemble created by light,” Phys. Rev. Lett. **83**, 1319 (1999). [CrossRef]

**3. **T. Fernholz, H. Krauter, K. Jensen, J. F. Sherson, A. S. Sørensen, and E. S. Polzik, “Spin squeezing of atomic ensembles via nuclear-electronic spin entanglement,” Phys. Rev. Lett. **101**, 073601 (2008). [CrossRef] [PubMed]

**4. **T. Iskhakov, M. V. Chekhova, and G. Leuchs, “Generation and direct detection of broadband mesoscopic polarization-squeezed vacuum,” Phys. Rev. Lett. **102**, 183602 (2009). [CrossRef] [PubMed]

**5. **G. Tóth and M. W. Mitchell, “Generation of macroscopic singlet states in atomic ensembles,” New J. Phys. **12**, 053007 (2010). [CrossRef]

**6. **T. S. Iskhakov, I. N. Agafonov, M. V. Chekhova, and G. Leuchs, “Polarization-entangled light pulses of 10 5 photons,” Phys. Rev. Lett. **109**, 150502 (2012). [CrossRef]

**7. **N. Behbood, F. M. Ciurana, G. Colangelo, M. Napolitano, G. Tóth, R. Sewell, and M. Mitchell, “Generation of macroscopic singlet states in a cold atomic ensemble,” Phys. Rev. Lett. **113**, 093601 (2014). [CrossRef] [PubMed]

**8. **G. Vasilakis, H. Shen, K. Jensen, M. Balabas, D. Salart, B. Chen, and E. S. Polzik, “Generation of a squeezed state of an oscillator by stroboscopic back-action-evading measurement,” Nat. Phys. **11**, 389–392 (2015). [CrossRef]

**9. **M. Vasilyev, S.-K. Choi, P. Kumar, and G. M. D’Ariano, “Tomographic measurement of joint photon statistics of the twin-beam quantum state,” Phys. Rev. Lett. **84**, 2354 (2000). [CrossRef] [PubMed]

**10. **S. L. Braunstein and P. Van Loock, “Quantum information with continuous variables,” Rev. Mod. Phys. **77**, 513 (2005). [CrossRef]

**11. **L. S. Madsen, V. C. Usenko, M. Lassen, R. Filip, and U. L. Andersen, “Continuous variable quantum key distribution with modulated entangled states,” Nat. Commun. **3**, 1083 (2012). [CrossRef] [PubMed]

**12. **F. Grosshans, G. Van Assche, J. Wenger, R. Brouri, N. J. Cerf, and P. Grangier, “Quantum key distribution using gaussian-modulated coherent states,” Nature **421**, 238–241 (2003). [CrossRef] [PubMed]

**13. **V. C. Usenko, L. Ruppert, and R. Filip, “Entanglement-based continuous-variable quantum key distribution with multimode states and detectors,” Phys. Rev. A **90**, 062326 (2014). [CrossRef]

**14. **M. Raymer, J. Cooper, H. Carmichael, M. Beck, and D. Smithey, “Ultrafast measurement of optical-field statistics by dc-balanced homodyne detection,” J. Opt. Soc. Am. B **12**, 1801–1812 (1995). [CrossRef]

**15. **N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, “Quantum cryptography,” Rev. Mod. Phys. **74**, 145 (2002). [CrossRef]

**16. **B. Qi, P. Lougovski, R. Pooser, W. Grice, and M. Bobrek, “Generating the local oscillator” locally” in continuous-variable quantum key distribution based on coherent detection,” arXiv preprint arXiv:1503.00662 (2015).

**17. **M. Collett, R. Loudon, and C. Gardiner, “Quantum theory of optical homodyne and heterodyne detection,” J. Mod. Opt. **34**, 881–902 (1987). [CrossRef]

**18. **G. Vidal and R. F. Werner, “Computable measure of entanglement,” Phys. Rev. A **65**, 032314 (2002). [CrossRef]

**19. **F. Grosshans, N. J. Cerf, J. Wenger, R. Tualle-Brouri, and P. Grangier, “Virtual entanglement and reconciliation protocols for quantum cryptography with continuous variables,” Quantum Info. Comput. **3**, 535–552 (2003).

**20. **M. M. Wolf, G. Giedke, and J. I. Cirac, “Extremality of gaussian quantum states,” Phys. Rev. Lett. **96**, 080502 (2006). [CrossRef] [PubMed]

**21. **M. Navascués, F. Grosshans, and A. Acin, “Optimality of gaussian attacks in continuous-variable quantum cryptography,” Phys. Rev. Lett. **97**, 190502 (2006). [CrossRef] [PubMed]

**22. **R. Garcia-Patron and N. J. Cerf, “Unconditional optimality of gaussian attacks against continuous-variable quantum key distribution,” Phys. Rev. Lett. **97**, 190503 (2006). [CrossRef] [PubMed]

**23. **X.-C. Ma, S.-H. Sun, M.-S. Jiang, and L.-M. Liang, “Wavelength attack on practical continuous-variable quantum-key-distribution system with a heterodyne protocol,” Phys. Rev. A **87**, 052309 (2013). [CrossRef]

**24. **J.-Z. Huang, C. Weedbrook, Z.-Q. Yin, S. Wang, H.-W. Li, W. Chen, G.-C. Guo, and Z.-F. Han, “Quantum hacking of a continuous-variable quantum-key-distribution system using a wavelength attack,” Phys. Rev. A **87**, 062329 (2013). [CrossRef]

**25. **J.-Z. Huang, S. Kunz-Jacques, P. Jouguet, C. Weedbrook, Z.-Q. Yin, S. Wang, W. Chen, G.-C. Guo, and Z.-F. Han, “Quantum hacking on quantum key distribution using homodyne detection,” Phys. Rev. A **89**, 032304 (2014). [CrossRef]

**26. **P. Jouguet, S. Kunz-Jacques, and A. Leverrier, “Long-distance continuous-variable quantum key distribution with a gaussian modulation,” Phys. Rev. A **84**, 062317 (2011). [CrossRef]

**27. **J. Lodewyck, M. Bloch, R. García-Patrón, S. Fossier, E. Karpov, E. Diamanti, T. Debuisschert, N. J. Cerf, R. Tualle-Brouri, and S. W. McLaughlin *et al.*, “Quantum key distribution over 25 km with an all-fiber continuous-variable system,” Phys. Rev. A **76**, 042305 (2007). [CrossRef]