5.

Covariance Matrix
Bosonic multi-mode states can conveniently be described by covariance matrices whose diagonal entries represent
the variances of the quadrature operators and whose off-diagonal terms represent the mutual covariance functions
of two quadratures.8 Knowledge about the covariance matrix Σ and its transformations is helpful to understand
the behaviour of the particular bosonic modes and their correlations. However, in CV-QKD the knowledge of
Σ is not only helpful but vital in order to compute the Holevo information χ.
In the protocol discussed in this article, Alice prepares displaced coherent states whose quadrature compo-
nents are measured by Bob after transmission through a Gaussian channel (prepare-and-measure, PM). This is
equivalent to a scenario where Alice prepares a two-mode squeezed vacuum state (TMSVS), performs a mea-
surement of both quadratures of one mode and sends the other mode to Bob (entanglement-based, EB), as for
example explained in [11]. In shot-noise units the TMSVS is described by the covariance matrix9

q̂A p̂A q̂B p̂B

 √   
q̂A V 0 V2−1 √ 0 √
p̂A  − V 2 − 1 V 12 V 2 − 1σz 
√ 0 V 0 
ΣAB = = ,
q̂B  V 2 − 1 √ 0 V 0  √ 
p̂B 0 − V2−1 0 V V 2 − 1σz V 12
(5.1)
1 0


where σz is the Pauli matrix 0 −1 and V is the variance of the quadrature operators:

2
V (q̂) = hq̂ 2 i − hq̂i , (5.2a)
2 2
V (p̂) = hp̂ i − hp̂i . (5.2b)

In our case the expectation values of the operators are zero and both quadratures q̂ and p̂ carry the same
variance (as opposed to a squeezed state)

V := V (q̂) = V (p̂) = hq̂ 2 i = hp̂2 i . (5.3)

This variance can be understood as the sum of the actual variance Alice is modulating with and the vacuum
shot-noise variance:

SNU
V = Vmod + V0 = Vmod + 1. (5.4)

Hence the covariance matrix can be rewritten as

 
p
2
 (Vmod + 1)12 Vmod + 2Vmod σz 
ΣAB = 
p
.
 (5.5)
2
Vmod + 2Vmod σz (Vmod + 1)12

The variance relates to the mean photon number per pulse as follows:10

1
1
hn̂A i = hq̂ 2 i + hp̂2 i −
4 2
1 1
= (V − 1) = Vmod . (5.6)
2 2
8 Find more details on the covariance-matrix formalism in Appendix B.
9 See Appendix C.1 for a derivation of the covariance matrix of a TMSVS.
10 Derived in Appendix A.

14
After transmission of Bob’s mode and influence of the various noise sources the covariance matrix transforms
to11

   
p p
V 12 2
T (V − 1)σz (Vmod + 1)12 2
T (Vmod
+ 2Vmod )σz 
  
ΣAB = 
p
=
 p
.

T (V 2 − 1)σz (T [V − 1] + 1 + ξ)12 2
T (Vmod + 2Vmod )σz (T Vmod + 1 + ξ)12
(5.7)
Note that the matrix (5.7) represents a quadrature modulation according to a continuous Gaussian distribution
Q ∼ P ∼ N (0, Ṽmod ). Other modulation alphabets like phase-shift keying (PSK) or quadrature amplitude
modulation (QAM) are not discussed in this review. Those alphabets are represented p by their own covari-
2
ance matrices which distinguish from (5.7) only in the off-diagonal term, replacing T (Vmod + 2Vmod ) by an
appropriate covariance function of A and B.

5.1. Homodyne and Heterodyne Detection

During the key transmission phase Bob receives noisy coherent states with a given symbol rate fsym . These
subsequent modes each carry randomly modulated quadrature components q and p. The quadratures can be
measured using the technique of homodyne detection where the signal mode is mixed with a reference laser (the
local oscillator, LO) at a balanced beamsplitter. Depending on the relative phase θ of signal mode and LO, the
photon number difference at the output ports of the BS is proportional to either the q- or p quadrature:12

∆n̂ = |αLO |(q̂ cos θ + p̂ sin θ). (5.8)

Depending on the protocol, Bob can either measure one quadrature component at a time by randomly selecting
between θ = 0 and θ = π/2 for each incoming mode, or he measures both quadratures of each mode simulta-
neously, which is sometimes referred to as “no-switching protocol” [12]. The two variations of the protocol are
illustrated in Figure 5.1. For the second approach Bob will separate the incoming states with a balanced BS
and then measure the two quadratures by homodyne detection on each half of the signal – one with θ = 0 to
measure q and one with θ = π/2 to measure p. Although this convention is misleading in more than just one
way, we are speaking of homodyne detection when Bob measures only one quadrature component at a time and
of heterodyne detection when Bob uses a BS and two homodyne detectors to measure both quadrature compo-
nents simultaneously.13 Using heterodyne instead of homodyne detection will double the mutual information
for each symbol for the price of additional 3 dB loss introduced by the heterodyning BS.
Splitting Bob’s mode for heterodyne detection will transform the covariance matrix to14

A B1 B2
 q q 
T 2 T 2
A (Vmod + 1)12 2 (Vmod + 2Vmod )σz − 2 (Vmod + 2Vmod )σz
 q 
ΣAB = B1  T
(V 2 + 2Vmod )σz ( T2 Vmod + 1 + 2ξ )12 − 12 (T Vmod + ξ)12 . (5.9)
 
 q2 mod 
ξ
B2 − T2 (Vmod2 + 2Vmod )σz − 21 (T Vmod + ξ)12 T
( 2 Vmod + 1 + 2 )12

Note that Bob now has two modes B1 , B2 since he split his signal into half. The covariance matrix between
Alice’s mode and one of Bob’s two modes is then represented as
 q 
T 2
 (Vmod + 1)12 ± 2 (Vmod + 2Vmod )σz 
ΣAB1,2 = 
 q
,
 (5.10)
± T2 (Vmod
2 + 2Vmod )σz ( T2 Vmod + 1 + 2ξ )12

which is the equivalent to the case of homodyne detection (5.7) up to a factor of 1/2 at transmission T and
excess noise ξ. The above matrix illustrates nicely the impact of heterodyne detection on Bob’s measurement
outcome. However, even in case of heterodyne detection, the Holevo information can already be derived from
(5.7), i.e. the matrix describing the TMSVS before action of Bob’s measurement apparatus (see Section 7).
11 See Appendix C.3 for a derivation of this matrix.
12 See Appendix D for a derivation of the homodyne-detection law.
13 Note that in the telecommunication jargon, heterodyne detection denotes a differing optical frequency of transmitted signal and

local oscillator.
14 This covariance matrix describing a heterodyne measurement setup is in detail derived in Appendix C.4.

15
 (a)

(b)

Figure 5.1.: Distinction between the (a) homodyne- and (b) heterodyne-detection protocol. In the first case a
random-number generator (RNG) is used to select the phase of the local oscillator: 0 or π/2 to
measure q or p, respectively. Only one homodyne detector is used, measuring one quadrature at a
time. In the case of heterodyne detection the quantum signal is split using a balanced beamsplitter.
One arm is used to measure q, the other one – after a LO-phase shift of π/2 – to measure p.

5.2. Prepare-and-Measure vs. Entanglement-Based Protocols

In practical implementations of coherent-state CV-QKD protocols, Alice will, instead of generating two-mode
squeezed states, prepare coherent states using q/p modulation according to a given probability distribution
with variance Vmod . However, for the sake of a simplified security analysis, it is convenient to assume that
Alice and Bob are sharing an entangled TMSVS to which Eve holds a purification. The equivalence of both
pictures, prepare-and-measure (PM) and entanglement-based (EB), is discussed in the present section. Assume
Alice prepares her coherent state with quadrature operators q̂ and p̂ according to a probability distribution
with variance VA = Vmod (or equivalently, quadrature components q and p with variance Vmod /4). Due to the
minimal uncertainty of 1 shot-noise unit, described by a normal distribution N (0, 1), Bob will receive coherent
states with variance VB = Vmod + 1 (neglecting for now transmission losses and excess noise):

q̂B ∼ q̂A + N (0, 1),

VB = V (q̂A + N (0, 1)) = V (q̂A ) + 1 = Vmod + 1. (5.11)
Assuming the quadratures to be zero-centred (hq̂i = hp̂i = 0), the covariance of Alice’s and Bob’s data reads

2 2
Cov(q̂A , q̂B ) = hq̂A q̂B i = h(q̂B − q̂A ) q̂A i + hq̂A i = 0 + hq̂A i = VA = Vmod . (5.12)
| {z }
N (0,1)

This allows us to write down the covariance matrix of a prepare-and-measure protocol:

   
VA 12 Cov(A, B)12  Vmod 12 Vmod 12
ΣPM = 
 
=  (5.13)
   
Cov(A, B)12 VB 12 . Vmod 12 (Vmod + 1)12 .

Suppose now that Alice and Bob share a two-mode squeezed vacuum state with variance V :
 
p
V 12 2
(V − 1)σz 
ΣEB = 

. (5.14)
p 
(V 2 − 1)σz V 12

16
Alice, in order to collapse Bob’s mode into a coherent state, will perform a measurement of both quadratures of
her mode. Therefore she has to split her mode into half using a balanced beamsplitter on whose output ports
she will determine q̂ and p̂ respectively. The covariance matrix is then represented as

 q 
V +1 V −1 1 2
 2 12 2 12 2 (V − 1)σz 
 
0 q
Σ EB
 
= V −1 V +1 1 2 − . (5.15)
 2 12 2 12 2 (V 1)σ z 
 
q q 
1 2 1 2
2 (V − 1)σz 2 (V − 1)σz V 12

Since both Alice’s modes are exactly equivalent, we reduce the matrix to the familiar 4 × 4 dimensions, repre-
senting only one of Alice’s modes and Bob’s mode:

 q 
V +1 1 2
00 2 12 2 (V − 1)σz 
EB

Σ =
q
.
 (5.16)
1 2
2 (V − 1)σz V 12

If Alice rescales her measurement operators according to the transformations

r
2(V − 1)
q̂A −→ q̂A , (5.17a)
V +1
r
2(V − 1)
p̂A −→ − p̂A , (5.17b)
V +1
the variance VA and the covariance Cov(A, B) will change accordingly:

2(V − 1)
V (q̂A ) −→ V (q̂A ),
V +1
2(V − 1)
V (p̂A ) −→ V (p̂A ),
V +1
r
2(V − 1)
Cov(q̂A , q̂B ) −→ Cov(q̂A , q̂B ), (5.18a)
V +1
r
2(V − 1)
Cov(p̂A , p̂B ) −→ − Cov(p̂A , p̂B ). (5.18b)
V +1
This will transform the covariance matrix (5.16) as follows:

 q q 
2(V −1) V +1 2(V −1) 1 2
00 V +1 2 12 V +1 2 (V − 1)12 
EB

Σ −→ 
q q


2(V −1) 1 2
V +1 2 (V − 1)12 V 12
 
(V − 1)12 (V − 1)12 
=



(V − 1)12 V 12
 
Vmod 12 Vmod 12
 = ΣPM .

=
  (5.19)
Vmod 12 (Vmod + 1)12

So by rescaling the data obtained by her heterodyne measurement, Alice can simulate a prepare-and-measure
scenario without Bob or Eve taking any notice of it. In other words, the prepare-and-measure scenario is
equivalentpto the entanglement-based version after Alice has rescaled her measurement outcomes by a factor
of κ = ± 2(V − 1)/(V + 1). Conversely, in the experimentally more realistic scenario where Alice actively

17
modulates the coherent states instead of measuring one mode of a TMSVS, she will rescale the values of the
prepared quadratures with κ−1 in order to simulate an entanglement-based scenario:

s
EB V + 1 PM
q̂A = q̂ , (5.20a)
2(V − 1) A
s
V + 1 PM
p̂EB
A =− p̂ . (5.20b)
2(V − 1) A

This will of course transform the prepare-and-measure matrix to the entanglement-based one for which the
security analysis is significantly more simple.

 
(V − 1)12 (V − 1)12 
ΣPM = 



(V − 1)12 V 12
 
1 1
 κ2 (V − 1)12 κ (V− 1)12 
−→ 



1
κ (V − 1)12 V 12
 q 
V +1 1 2
2 12 2 (V − 1)σz 
 = ΣEB .

=
q  (5.21)
1 2
2 (V − 1)σz V 12

Rescaling Alice’s values is therefore a crucial procedure in order to properly determine the Holevo bound and
has to be taken into account for the parameter-estimation procedure, as will be described in Section 8.3.

18