We consider the security of practical continuous-variable quantum key distribution implementation with the local oscillator (LO) fluctuating in time, which opens a loophole for Eve to intercept the secret key. We show that Eve can simulate this fluctuation to hide her Gaussian collective attack by reducing the intensity of the LO. Numerical simulations demonstrate that, if Bob does not monitor the LO intensity and does not scale his measurements with the instantaneous intensity values of LO, the secret key rate will be compromised severely.

We present the wavelength attack on a practical continuous-variable quantum-key-distribution system with a heterodyne protocol, in which the transmittance of beam splitters at Bob's station is wavelength-dependent. Our strategy is proposed independent of but analogous to that of Huang et al. [arXiv: 1206.6550v1 [quant-ph]], but in that paper the shot noise of the two beams that Eve sends to Bob, transmitting after the homodyne detector, is unconsidered. However, shot noise is the main contribution to the deviation of Bob's measurements from Eve's when implementing the wavelength attack, so it must be considered accurately. In this paper, we firstly analyze the solutions of the equations specifically that must be satisfied in this attack, which is not considered rigorously by Huang et al. Then we calculate the shot noise of the homodyne detector accurately and conclude that the wavelength attack can be implemented successfully in some parameter regime.

Measurement-device-independent quantum key distribution (MDI-QKD), leaving the detection procedure to the third partner and thus being immune to all detector side-channel attacks, is very promising for the construction of high-security quantum information networks. We propose a scheme to implement MDI-QKD, but with continuous variables instead of discrete ones, i.e., with the source of Gaussian-modulated coherent states, based on the principle of continuous-variable entanglement swapping. This protocol not only can be implemented with current telecom components but also has high key rates compared to its discrete counterpart; thus it will be highly compatible with quantum networks.

The security of source has become an increasingly important issue in quantum cryptography. Based on the framework of measurement-device-independent quantum key distribution (MDI-QKD), the source becomes the only region exploitable by a potential eavesdropper (Eve). Phase randomization is a cornerstone assumption in most discrete-variable (DV) quantum communication protocols (e.g., QKD, quantum coin tossing, weakcoherent-state blind quantum computing, and so on), and the violation of such an assumption is thus fatal to the security of those protocols. In this paper, we show a simple quantum hacking strategy, with commercial and homemade pulsed lasers, by Eve that allows her to actively tamper with the source and violate such an assumption, without leaving a trace afterwards. Furthermore, our attack may also be valid for continuous-variable (CV) QKD, which is another main class of QKD protocol, since, excepting the phase random assumption, other parameters (e.g., intensity) could also be changed, which directly determine the security of CV-QKD.