text:
\section{Elementary facts and definitions}

\subsection{Subgroups of the symplectic group}

We start by fixing some notation. Remember that the symplectic form of an $n$-mode system takes the form
\begin{equation}
\Omega = \begin{pmatrix} 0 & \mathds{1} \\ -\mathds{1} & 0 \end{pmatrix} ,
\label{Omega}
\end{equation}
where all submatrices are $n\times n$. Let us also define
\begin{equation}
H\mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = \frac{1}{\sqrt2} \begin{pmatrix} \mathds{1} & \mathds{1} \\ i \mathds{1} & -i \mathds{1} \end{pmatrix}
\label{H}
\end{equation}
as the unitary matrix that diagonalises $\Omega$, i.e.\ such that
\begin{equation}
H^\dag \Omega H = \begin{pmatrix} i\mathds{1} & 0 \\ 0 & -i \mathds{1} \end{pmatrix} .
\end{equation}
The symplectic group $\mathbb{SP}(n)$ is formed by all those $2n\times 2n$ real matrices that preserve the symplectic form $\Omega$:
\begin{equation}
\mathbb{SP}(n) \mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = \left\{ S:\, S\Omega S^\intercal = \Omega \right\} .
\label{Sp}
\end{equation}
The $2n\times 2n$ symplectic orthogonal matrices form a subgroup $\mathbb{K}(n)\subset \mathbb{SP}(n)$ that is isomorphic to the unitary group $\mathbb{U}(n)$. The isomorphism is given by~\cite[\S~2.1.2]{GOSSON}
\begin{equation}
\mathbb{U}(n) \ni U \longleftrightarrow K = H \begin{pmatrix} U & 0 \\ 0 & U^* \end{pmatrix} H^\dag \in \mathbb{K}(n)\, .
\label{KU isomorphism}
\end{equation}
Another important subgroup of the symplectic group is isomorphic to $\mathbb{GL}(n)$, the group of $n\times n$ invertible real matrices~\cite[Example~2.5]{GOSSON}:
\begin{equation}
\mathbb{GL}(n) \simeq \left\{ \begin{pmatrix} M^{-1} & 0 \\ 0 & M^\intercal \end{pmatrix}:\ \text{$M$ invertible} \right\} \subset \mathbb{SP}(n) \, .
\label{GL isomorphism}
\end{equation}

\subsection{Matrices in $\boldsymbol{xp}$-form}

The phase space of an $m$-mode system is usually divided into its first $m$ and last $m$ components, called the $x$ and $p$ components, respectively. Let us denote by $\Pi^x:\mathds{R}^{2m}\to \mathds{R}^{m}$ and $\Pi^p:\mathds{R}^{2m}\to \mathds{R}^{m}$ the corresponding orthogonal projectors. Accordingly, we can write e.g.
\begin{equation*}
\Pi^x \Omega (\Pi^x)^\intercal = 0_n = \Pi^p \Omega (\Pi^p)^\intercal\, ,\qquad \Pi^x \Omega (\Pi^p)^\intercal = \mathds{1}_n = - \Pi^p \Omega (\Pi^x)^\intercal\, .
\end{equation*}
Observe that we think of $\Pi^x$ as the $m\times 2m$ rectangular matrix $\left(\begin{smallmatrix} \mathds{1} & 0 \end{smallmatrix}\right)$, and correspondingly of $(\Pi^x)^\intercal$ as the $2m\times m$ rectangular matrix $\left(\begin{smallmatrix} \mathds{1} \\ 0 \end{smallmatrix}\right)$. A matrix $V$ expressed as
\begin{equation}
V= \begin{pmatrix} \Pi^x V(\Pi^x)^\intercal & \Pi^x V(\Pi^p)^\intercal \\ \Pi^p V(\Pi^x)^\intercal & \Pi^p V(\Pi^p)^\intercal \end{pmatrix}
\end{equation}
is said to be written with respect to the $xp$ block partition. The representations in~\eqref{Omega} and~\eqref{H} are of this form.

This somehow pleonastic notation comes in handy when multiple systems are involved. In that case, we adopt the convention of indicating as subscripts the systems ($A$, $B$, and so on) and as superscripts the phase space components we want to project onto ($x$ and $p$). For example, the projector onto the $x$ component of the $B$ system will be denoted by $\Pi^x_B$.

Particularly simple matrices are those that have no $xp$ cross-terms. We say that a matrix $V$ is in \textbf{$\boldsymbol{xp}$-form} if
\begin{equation}
\Pi^x V (\Pi^p)^\intercal = 0\, .
\label{xp form}
\end{equation}
Observe that since $V$ is symmetric, from the above identity it also follows that $\Pi^p V (\Pi^x)^\intercal = 0$. With respect to an $xp$ block partition, a matrix in $xp$-form then reads
\begin{equation}
V = \begin{pmatrix} Q & 0 \\ 0 & P \end{pmatrix} .
\label{V xp}
\end{equation}
When $V$ is a QCM, it is not difficult to verify that the bona fide condition $V\geq i \Omega$ implies that $Q,P>0$ and $Q\geq P^{-1}$. Williamson's theorem~\cite{willy} states that all QCMs can be brought into a special kind of $xp$-form via symplectic congruence: a QCM is in Williamson's form if it can be written as in~\eqref{V xp}, with $Q=P=D$ diagonal. The diagonal entries of $D$, called symplectic eigenvalues of $V$, are uniquely determined by $V$ up to the order and no smaller than $1$ if $V$ is a QCM. They can be characterised as the positive eigenvalues of the matrix $i\Omega V$. Moreover, $D=\mathds{1}$ if and only if the QCM is pure. This also shows that a $2m\times 2m$ QCM $V$ is pure if and only if
\begin{equation}
\rk (V+i\Omega) = m\, ,
\label{rank condition pure}
\end{equation}
Note that upon taking the complex conjugate we can also rephrase this condition as $\rk (V-i\Omega)=m$. For more details, see the discussion below~\cite[Lemma~7]{LL-log-det}.

It is important to realise that if a QCM is in $xp$-form in the first place, it can be brought into Williamson's form by means of symplectics in the subgroup~\eqref{GL isomorphism}, as we argue below. Note that the subgroup in~\eqref{GL isomorphism} is also composed of matrices in $xp$-form!

\begin{lemma} \label{xp form Williamson lemma}
Let $V$ be a QCM in $xp$-form. Then there exists a symplectic matrix $S$ in $xp$-form (i.e.\ belonging to the subgroup~\eqref{GL isomorphism}) such that $SVS^\intercal$ is in Williamson's form.
\end{lemma}

\begin{proof}
Let $V$ be as in~\eqref{V xp}, and call $m$ the number of modes. Using the spectral theorem, choose an orthogonal $m\times m$ matrix $O$ with the property that $O^\intercal Q^{1/2} P Q^{1/2} O = D^2$ is diagonal. Set $M\mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = Q^{1/2} O D^{-1/2} $. We have that
\begin{align*}
M^{-1} Q M^{-\intercal} &= D^{1/2} O^\intercal Q^{-1/2}\, Q\, Q^{-1/2} O D^{1/2} = D\, ,\\
M^\intercal P M &= D^{-1/2} O^\intercal Q^{1/2}\, P\, Q^{1/2} O D^{-1/2} = D\, ,
\end{align*}
from which it follows that
\begin{equation*}
\begin{pmatrix} M^{-1} & 0 \\ 0 & M^\intercal \end{pmatrix} \begin{pmatrix} Q & 0 \\ 0 & P \end{pmatrix} \begin{pmatrix} M^{-\intercal} & 0 \\ 0 & M \end{pmatrix} = \begin{pmatrix} D & 0 \\ 0 & D \end{pmatrix}
\end{equation*}
is in Williamson's form.
\end{proof}

For more background on Williamson's  decomposition, we refer the reader to~\cite{GOSSON}. A particularly instructive case is that of pure QCMs: a pure QCM $\gamma$ is in $xp$-form if and only if
\begin{equation}
\gamma = \begin{pmatrix} Q & 0 \\ 0 & Q^{-1}  \end{pmatrix}
\label{pure in xp form}
\end{equation}
with respect to an $xp$ block partition, with $Q>0$. To see that this is the case, it suffices to remember that pure QCMs are symmetric symplectic matrices, and to use the relation that defines symplecticity. Observe that pure QCMs in $xp$-form are exactly those symmetric matrices that belong to the subgroup~\eqref{GL isomorphism} of the symplectic group.

We can now give the following definition.

\begin{Def} \label{normal def}
A bipartite QCM $V_{AB}$ is called \textbf{normal} if it can be brought into $xp$-form by local symplectic operations, i.e.\ if there are local symplectic matrices $S_A$, $S_B$ such that
\begin{equation}
\Pi^x_{AB} \left(S_A\oplus S_B\right) V_{AB} \left( S_A^\intercal \oplus S_B^\intercal\right) (\Pi^p_{AB})^\intercal = 0\, .
\end{equation}
\end{Def}

The following is an easy consequence of results of~\cite{giedkemode}.

\begin{lemma}[{\cite{giedkemode}}] \label{pure are normal}
All pure QCMs with arbitrary many modes on each side are normal.
\end{lemma}

The following result is due to Simon~\cite{Simon00} and independently to Duan et al.~\cite{Duan2000}.

\begin{lemma}[{\cite{Simon00, Duan2000}}] \label{2-mode are normal}
All two-mode QCMs are normal.
\end{lemma}

For a real parameter $t>0$, consider the QCMs on systems $A$ and $B$ defined by
\begin{equation}
\begin{aligned}
\Gamma_{\!A}(t) &\mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = t\, \big(\Pi^x_A\big)^{\!\intercal}\, \Pi^x_A + t^{-1} \big(\Pi^p_A\big)^{\!\intercal}\, \Pi^p_A = \begin{pmatrix} t\mathds{1}_A^x & 0 \\ 0 & t^{-1}\mathds{1}_A^p \end{pmatrix} \, ,\\
\Gamma_{\!B}(t) &\mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = t\, \big(\Pi^x_B\big)^{\!\intercal}\, \Pi^x_B + t^{-1} \big(\Pi^p_B\big)^{\!\intercal}\, \Pi^p_B = \begin{pmatrix} t\mathds{1}_B^x & 0 \\ 0 & t^{-1}\mathds{1}_B^p \end{pmatrix}\, ,
\end{aligned}
\label{seeds homodyne}
\end{equation}
where the block matrices on the r.h.s.\ are written with respect to an $xp$ block partition. In the limit $t\to 0^+$, these QCMs are the seeds of two measurements of the $x$ quadrature, while in the opposite limit $t\to \infty$ they identify measurements of the $p$ quadrature. Occasionally, if there is no ambiguity on the partition used, we will remove superscripts and subscripts from expressions like~\eqref{seeds homodyne}.

\subsection{Schur complements} \label{Schur_subsec}

Before we proceed further, let us discuss some applications of the notion of Schur complement. We have seen in the main text that for a $2\times 2$ block matrix
\begin{equation}
R=\begin{pmatrix} X & Z \\ Z^\intercal & Y \end{pmatrix}
\label{R}
\end{equation}
one sets
\begin{equation}
R/X\mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = Y -Z^\intercal X^{-1} Z\, ,
\label{Schur}
\end{equation}
provided that $X$ is invertible. The expression in~\eqref{Schur} is called the Schur complement of $R$ with respect to $X$. Schur complements are instrumental in matrix analysis~\cite{ZHANG}, and have found widespread applications in the context of continuous variable quantum information as well~\cite{Lami16, LL-log-det}. Here we limit ourselves to recalling a few notable properties of these objects, referring the interested reader to~\cite{ZHANG}.
\begin{enumerate}
\item[(i)] Schur determinant factorisation formula:
\begin{equation}
\det R = (\det X) \big(\det (R/X)\big)
\label{det fact}
\end{equation}
\item[(ii)] Inertia additivity formula:
\begin{equation}
\rk R = \rk X + \rk (R/X)\, .
\label{inertia additivity}
\end{equation}
\item[(iii)] Block inverse:
\begin{equation}
R^{-1} = \begin{pmatrix} (R/Y)^{-1} & & -X^{-1} Y (R/X)^{-1} \\[0.7ex] -(R/X)^{-1} Y^T X^{-1} && (R/X)^{-1} \end{pmatrix} ,
\label{inv}
\end{equation}
provided that $R$ as well as $X$ are invertible.
\item[(iv)] Block positivity conditions:
\begin{equation}
R>0\qquad \Longleftrightarrow\qquad X>0\quad \text{and}\quad R/X>0\, .
\label{Schur block positivity}
\end{equation}
\item[(v)] Covariance under congruences: for all invertible $M,N$, it holds that
\begin{equation}
\left((M\oplus N)\, R\, (M\oplus N)^\intercal \right) \big/ (MXM^\intercal) = N \left(R/X\right) N^\intercal\, .
\label{Schur covariance}
\end{equation}
\item[(vi)] Variational representation: when $R>0$ is positive definite, it holds that
\begin{equation}
R/X = \max\left\{ T:\, R\geq 0\oplus T \right\} .
\label{Schur variational}
\end{equation}
Note that the set on the right-hand side is a matrix set, hence it is not a priori guaranteed to have a maximum. What~\eqref{Schur variational} tells us is that such a maximum however does exist, and that it coincides with the Schur complement of $R$ with respect to $X$. From~\eqref{Schur variational} it is straightforward to deduce the following monotonicity property: if $R>0$ and $R'=\left(\begin{smallmatrix} X' & Z' \\ (Z')^\intercal & Y' \end{smallmatrix}\right)>0$, then
\begin{equation}
R\geq R' \quad \Longrightarrow\quad R/X \geq R'/X'\, .
\label{Schur monotonicity}
\end{equation}
\end{enumerate}

\subsection{Gaussian states} \label{Gaussian_states_subsec}

For a continuous-variable system made of $m$ modes, the displacement operator associated with a vector $\xi\in \mathds{R}^{2m}$ is defined by~\cite[Section~3.1]{BUCCO}
\begin{equation}
D(\xi)\mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = e^{i\xi^\intercal \Omega r}\, .
\label{displacement}
\end{equation}
Note that $D(\xi)$ is a unitary operator. Furthermore, for all $\xi$ it holds that $D(\xi)^\dag = D(-\xi)$. The canonical commutation relations can be rewritten in the so-called Weyl form in terms of the displacement operators. They read~\cite[Eq.~(3.11)]{BUCCO}
\begin{equation}
D(\xi_1) D(\xi_2) = e^{-\frac{i}{2}\, \xi_1^\intercal \Omega \xi_2} D(\xi_1+\xi_2)\, .
\label{Weyl}
\end{equation}

The characteristic function of an $m$-mode quantum state $\rho$ is the function $\chi_\rho:\mathds{R}^{2m}\to \mathds{C}$ defined by~\cite[Section~4.3]{BUCCO}
\begin{equation}
\chi_\rho(\xi)\mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = \Tr[\rho D(-\xi)]\, .
\label{chi}
\end{equation}
Its Fourier transform is the Wigner function, in formula
\begin{equation}
W_\rho(u) \mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = \frac{1}{2^m \pi^{2m}}\int d^{2m}\xi\, \chi_\rho(\xi)\, e^{-i \xi^\intercal \Omega u}\, .
\label{Wigner}
\end{equation}
The characteristic function as well as the Wigner function of Gaussian states are in fact Gaussian. More precisely,
\begin{align}
\chi_{\rho_\mathrm{\scriptscriptstyle \, G}[V,s]}(\xi) &= \exp\left[ -\frac14 \xi^\intercal \Omega^\intercal V \Omega \xi + i s^\intercal \Omega \xi \right] , \label{chi_Gaussian} \\
W_{\rho_\mathrm{\scriptscriptstyle \, G}[V,s]}(u) &= \frac{2^m}{\pi^m\sqrt{\det V}} \exp\left[ - (u-s)^\intercal V^{-1} (u-s) \right] . \label{Wigner_Gaussian}
\end{align}
Note that $W_{\rho_\mathrm{\scriptscriptstyle \, G}[V,s]}$ is a Gaussian with mean $s$ and covariance matrix $V/2$. In particular, the differential entropy $H\left( W_{\rho_\mathrm{\scriptscriptstyle \, G}[V,s]}\right) \mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = - \int d^{2m} u\, W_{\rho_\mathrm{\scriptscriptstyle \, G}[V,s]}(u) \log_2 W_{\rho_\mathrm{\scriptscriptstyle \, G}[V,s]}(u)$ of the Wigner function associated with a Gaussian state $\rho_\mathrm{\scriptscriptstyle \, G}[V,s]$ evaluates to
\begin{equation}
H\left( W_{\rho_\mathrm{\scriptscriptstyle \, G}[V,s]}\right) = \frac12 \log_2 \det V + m \log_2 (\pi e) = M(V) + m \log_2 (\pi e) \, ,
\label{Wigner_entropy_Gaussian}
\end{equation}
where we used the notation
\begin{equation}
M(V) \mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = \frac12 \log_2 \det V\, .
\label{M}
\end{equation}
If $V$ is a QCM, then $\det V = \prod_{j=1}^m \nu_j^2(V)$ is the squared product of the symplectic eigenvalues. Since these are no smaller than $1$, we conclude that $\det V\geq 1$ and hence $M(V)\geq 0$. Therefore, for all Gaussian states it holds that
\begin{equation}
H\left( W_{\rho_\mathrm{\scriptscriptstyle \, G}[V,s]}\right) \geq m \log_2 (\pi e) \, .
\label{lower_bound_M_Gaussian}
\end{equation}

\subsection{Gaussian measurements} \label{Gaussian_measurements_subsec}

As mentioned in the main text, a quantum Gaussian measurement with seed $\Gamma$ on an $m$-mode system is defined by the POVM
\begin{equation}
E(d^{2m} x) = \rho_G[\Gamma, x]\, \frac{d^{2m}x}{(2\pi)^m}
\label{Gaussian measurement POVM}
\end{equation}
on the measure space $\mathds{R}^{2m}$. We will sometimes represent this as the quantum--classical channel
\begin{equation}
\pazocal{M}_{\Gamma}^\mathrm{\scriptscriptstyle \, G} (\cdot) \mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = \int \frac{d^{2m}x}{(2\pi)^m}\, \Tr\left[ \rho_G[\Gamma, x] (\cdot) \right] \ketbra{x}\, ,
\label{G_meas_channel}
\end{equation}
where the vectors $\ket{x}$ are formally orthonormal. For a mathematically rigorous notion of quantum--classical channel, see Barchielli and Lupieri~\cite{Barchielli2006} and also Holevo and Kuznetsova~\cite{Holevo-Kuznetsova}.

On a Gaussian state $\rho_\mathrm{\scriptscriptstyle \, G}[V, s]$, the Gaussian measurement in~\eqref{Gaussian measurement POVM} yields as outcome a random variable $X\in \mathds{R}^{2m}$ whose probability density function reads~\cite[Section~5.4.4]{BUCCO}
\begin{equation}
p(x) = \frac{e^{-(x-s)^\intercal (V+\Gamma)^{-1}(x-s)}}{\pi^m \sqrt{\det (V+\Gamma)}}\, .
\label{Gaussian measurement PDF}
\end{equation}
In other words, $X$ is normally distributed with mean $s$ and covariance matrix $(V+\Gamma)/2$. The factor $1/2$ here depends on the different conventions chosen for QCMs and classical covariance matrices. For example, we have defined the first entry of the QCM of an $m$-mode state $\rho$ with vanishing displacement vector to be $V_{11} = 2 \Tr[x_1^2\rho]$, which is twice the variance of the observable $x_1$ on $\rho$.

If the measured system $A$ is part of a bipartite system $AB$ initially in a Gaussian state $\rho_\mathrm{\scriptscriptstyle \, G} [V_{AB},\, s_{AB}]$, the post-measurement state on $B$ conditioned on obtaining the outcome $x$ is again Gaussian, has QCM given by the Schur complement~\cite[Section~5.4.5]{BUCCO}
\begin{equation}
V'_B = (V_{AB}+\Gamma_A)/(V_A+\Gamma_A)\, ,
\label{post_measurement_QCM}
\end{equation}
and displacement vector that depends on $V_{AB}$, $s_{AB}$, and $x$ by means of an expression that we do not report. The interested reader can look it up in the monograph by Serafini~\cite[Section~5.4.5]{BUCCO}. Instead, here we want to remark on an important feature of Gaussian measurements: namely, the fact that the post-measurement state depends on the measurement outcome only through its mean vector and not through its QCM. Indeed, the expression~\eqref{post_measurement_QCM} is independent of $x$.

From the above interpretation of the expression~\eqref{post_measurement_QCM} as the QCM of the reduced post-measurement state it immediately follows that $V'_B\geq i\Omega_B$. Moreover, one can also conclude that $V'_B$ must be pure if such are both $V_{AB}$ and $\Gamma_A$. These important facts can also be established directly by exploiting the properties of Schur complements reviewed in Section~\ref{Schur_subsec}. Doing this is a useful exercise that the interested reader is encouraged to solve on their own. Its solution is as follows.

\begin{lemma} \label{elementary_pure_G_lemma}
If $V_{AB}\geq i\Omega_{AB}$ and $\Gamma_A\geq i\Omega_A$ are QCMs, then $V'_B$ as defined by~\eqref{post_measurement_QCM} is also a QCM, i.e.\ it satisfies that
\begin{equation}
V'_B\geq i\Omega_B\, .
\end{equation}
Moreover, if both $V_{AB}$ and $\Gamma_A$ are pure then so is $V'_B$.
\end{lemma}

\begin{proof}
In light of~\eqref{Schur variational}, it suffices to prove that
\begin{equation*}
V_{AB} + \Gamma_A \geq i\Omega_B\, .
\end{equation*}
Taking the complex conjugate of the inequality $\Gamma_A\geq i\Omega_A$ and using also $V_{AB}\geq i\Omega_{AB}$ yields
\begin{equation*}
V_{AB} + \Gamma_A \geq i \Omega_{AB} + (-i\Omega_A) = i\Omega_B\, ,
\end{equation*}
as claimed.

Now, let us assume that both $V_{AB}$ and $\Gamma_A$ are pure, and let us prove that the same is true for $V'_B$. Since $V'_B$ has just been shown to be a QCM, it suffices to prove that $\det V'_B = 1$. Let us write
\begin{align*}
\det V'_B &\texteq{1} \frac{\det (V_{AB}+\Gamma_A)}{\det (V_A+\Gamma_A)} \\
&\texteq{2} \frac{1}{\det (V_A+\Gamma_A)}\, \det (V_{AB}/V_B + \Gamma_A) \det (V_B) \\
&\texteq{3} \frac{1}{\det (V_A+\Gamma_A)}\, \det \left( \Omega_A V_A^{-1} \Omega_A^\intercal + \Gamma_A\right) \det (V_A) \\
&\texteq{4} \frac{1}{\det (V_A+\Gamma_A)}\, \det \left( V_A^{-1} + \Omega_A^\intercal \Gamma_A \Omega_A \right) \det (V_A) \\
&\texteq{5} \frac{1}{\det (V_A+\Gamma_A)}\, \det \left( V_A^{-1} + \Gamma_A^{-1} \right) \det (V_A) \\
&= \frac{1}{\det (V_A+\Gamma_A)}\, \det \left( V_A^{-1} (V_A+\Gamma_A) \Gamma_A^{-1} \right) \det (V_A) \\
&= \frac{1}{\det (V_A+\Gamma_A)}\, \det \left( V_A^{-1}\right) \det (V_A+\Gamma_A) \det\left(\Gamma_A^{-1} \right) \det (V_A) \\
&\texteq{6} 1\, .
\end{align*}
Here, 1~and~2 are applications of the Schur determinant factorisation formula~\eqref{det fact}; 3~follows from the fact that $\tau_{AB}/\tau_B=\Omega_A\tau_A^{-1}\Omega_A^\intercal$ for all pure QCMs $\tau_{AB}$~\cite[Eq.~(8)]{Lami16}; in~4 we used instead that $\det \Omega_A=1$; then, in~5 we noticed that $\gamma_A$, being a pure QCM and hence a symmetric symplectic matrix, satisfies that $\Gamma_A\Omega_A \Gamma_A = \Omega_A$ and hence that $\Omega_A^\intercal \Gamma_A \Omega_A =\Gamma_A^{-1}$~\cite{Lami16}; finally, in~6 we simplified the product and observed that $\det \left( \Gamma_A^{-1}\right) = \left( \det\Gamma_A \right)^{-1} = 1$ because $\Gamma_A$ is pure.
\end{proof}

\section{Secret key distillation with Gaussian operations: general definitions}

\begin{comment}
The most general protocol to distil secret key from a quantum state $\rho_{ABE}$ with Gaussian local operations assisted by public communication can be described as follows. The preliminary step involves Alice and Bob appending local ancillary systems $A'$ and $B'$ in uncorrelated Gaussian states. Without loss of generality, we will still denote the resulting state with $\rho_{ABE}$. The protocol then proceeds with the following steps:
\begin{enumerate}[(i)]
\item Conditioned on the value of some local random variable $U$, Alice applies a Gaussian unitary on $A$ and performs a Gaussian measurement with seed $\Gamma_{A_1}(U)$ on the first mode $A_1$, obtaining a random variable $X_1$.
\item $X_1$ is then stored by Alice, and used together with $U$ to prepare a message $M_1$, which is sent to Bob and Eve.
\item Knowing $M_1$, and conditioned on the value of some local random variable $V$, Bob applies a Gaussian unitary on his system $B$ and carries out a Gaussian measurement with seed $\Gamma_{B_1}(M_1V)$ on the first mode, obtaining a random variable $Y_1$.
\item $Y_1$ is then stored by Bob, and used together with $V$ and $M_1$ to prepare a message $M_2$, which is sent to Alice and Eve.
\item Steps (i)--(iv) are repeated an additional $n-1$ times, until all modes on both sides have been measured. Each time, Alice and Bob store locally the values of all random variables they process, to be used at later times to make decisions on the measurements to be applied or on the messages to be sent.
\item Finally, Alice and Bob process deterministically all their local random variables, to produce keys $S$ and $S'$, respectively.
\end{enumerate}
The additional conditions we impose are
\begin{align}
\Pr\left\{ S\neq S'\right\} &\leq \epsilon\, , \\
I(S:M_1\ldots M_{2n}E) &\leq \delta\, .
\end{align}
\end{comment}

Throughout this section, we precisely define the notion of secret key distillation with Gaussian operations and public communication.

\subsection{Classes of Gaussian protocols}

We start by defining general Gaussian measurement protocols.

\begin{Def} \label{G_meas_protocol_def}
For $A$ a CV quantum system and $U$ a random variable, a \textbf{Gaussian measurement protocol on $\boldsymbol{A}$ conditioned on $\boldsymbol{U}$} is a procedure of the following form:
\begin{itemize}
\item We append to $A$ a single-mode ancilla in the vacuum state; conditioned on $U$, we apply a Gaussian unitary to the entire system $AR_1$ and perform a Gaussian measurement with seed $\Gamma_{1}^U$ on the last $m_1$ modes of the resulting state (possibly, $m_1=0$), obtaining a random variable $X_1\in \mathds{R}^{2m_1}$. Note that both the Gaussian unitary and $\Gamma_1^U$ may depend on $U$. The modes remaining after the measurement form a system that we denote with $A_1$.
\item We then use $X_1$ together with $U$ to decide on a Gaussian unitary to apply to $A_1 R_2$, with $R_2$ being a single-mode system initially in the vacuum state, and on a Gaussian measurement with seed $\Gamma_2^{X_1U}$ to carry out on the last $m_2$-modes of the resulting state (possibly, $m_2=0$).
\item We continue in this way, until after $r$ rounds the protocol terminates. The output products are a random variable $X = (X_1,\ldots, X_r)\in \mathds{R}^{2\sum_{i=1}^r m_i}$ (hereafter referred to as the \textbf{measurement outcome}) and a quantum system $A_r$.
\end{itemize}
\end{Def}

\begin{rem}
Allowing general Gaussian states for the ancillae and general non-deterministic Gaussian operations instead of Gaussian unitaries in Definition~\ref{G_meas_protocol_def} does not lead to a wider set of protocols. In fact, remember that any Gaussian state can be prepared by applying a Gaussian unitary to the vacuum and discarding some modes, and that non-deterministic Gaussian operations can always be realised by appending ancillae in the vacuum state, acting with Gaussian unitaries, and performing Gaussian measurements on some of the modes~\cite[Sections~5.3--5.5]{BUCCO}.
\end{rem}

We now formalise the notion of protocol that is implementable with Gaussian local operations and two-way public communication.

\begin{Def} \label{GLOPC_def}
Let Alice and Bob hold a bipartite continuous-variable system $AB$. A \textbf{GLOPC protocol} on $AB$ is a quantum-to-classical channel $AB\to \pazocal{K} \pazocal{K}'\pazocal{C}$, where $\pazocal{K},\pazocal{K}',\pazocal{C}$ are classical alphabets, with $\pazocal{K}$ and $\pazocal{K}'$ finite and identical, constructed in the following way:
\begin{enumerate}[(i)]
\item Alice performs a Gaussian measurement protocol on $A$ conditioned on some local random variable $U$, which is assumed to be independent of everything else; she produces as output a quantum system $A_1$ and a measurement outcome $X_1$. She uses $X_1$ together with $U$ to prepare (without loss of generality, deterministically) a message $C_1$, which is sent to Bob and Eve.
\item Bob performs a Gaussian measurement protocol on $B$ conditioned on $C_1$ and on some other local random variable $V$, which is again assumed to be independent of everything else; he produces as output a quantum system $B_1$ and a measurement outcome $Y_1$. He uses $Y_1$ together with $V$ and $C_1$ to prepare (without loss of generality, deterministically) a message $C'_1$, which is sent to Alice and Eve.
\item Steps~(i) and~(ii) are repeated a finite number of times each. At the $k^{\text{th}}$ iteration, the Gaussian measurement protocol implemented by Alice (respectively, Bob) on $A_{k-1}$ ($B_{k-1}$) depends on the local random variable $U$ ($V$), on the measurement outcomes $X_1,\ldots X_{k-1}$ ($Y_1,\ldots Y_{k-1}$), and on Bob's (Alice's) messages $C'_1, \ldots, C'_{k-1}$ ($C_1, \ldots, C_{k-1}$). All these variables together with the obtained measurement outcome $X_k$ ($Y_k$) are used to prepare the message $C_k$ ($C'_k$) to be sent to Bob (Alice) and Eve. The local output quantum system is $A_k$ ($B_k$).
\item After $2r$ back-and-forth rounds the communication ceases. Alice uses her local random variable $U$ together with the measurement outcomes $X_1, \ldots, X_r$ and Bob's messages $C'_1,\ldots, C'_r$ to prepare a random variable $S$, stored in $\pazocal{K}$. Bob does the same with his local random variable $V$, his measurement outcomes $Y_1,\ldots, Y_r$, and Alice's messages $C_1,\ldots, C_r$, storing a variable $S'$ in $\pazocal{K}'$.
\item Eve stores the messages $C_1,C'_1,\ldots, C_r, C'_r$ into $\pazocal{C}$.
\end{enumerate}
\end{Def}

We are also interested in two restricted classes of GLOPC protocols. The first one is obtained by forcing public communication to take place in one direction only, say from Alice to Bob. Formally, the resulting class of $1$-GLOPC protocols is defined as follows.

\begin{Def} \label{1GLOPC_def}
Let Alice and Bob hold a bipartite continuous-variable system $AB$. A \textbf{1-GLOPC protocol} on $AB$ is a quantum-to-classical channel $AB\to \pazocal{K} \pazocal{K}'\pazocal{C}$, where $\pazocal{K},\pazocal{K}',\pazocal{C}$ are classical alphabets, with $\pazocal{K}$ and $\pazocal{K}'$ finite and identical, constructed in the following way:
\begin{enumerate}[(i)]
\item Alice performs a Gaussian measurement protocol on $A$ conditioned on some local random variable $U$, which is assumed to be independent of everything else. Let the obtained measurement outcome be denoted with $X$.
\item She uses $X$ together with $U$ to prepare (without loss of generality, deterministically) two random variables $S$ (secret key) and $C$ (message). $S$ is stored in $\pazocal{K}$ and $C$ is sent to Bob and Eve.
\item Eve stores $C$ in $\pazocal{C}$.
\item Bob performs a Gaussian measurement protocol on $B$ conditioned on $C$ and on some other local random variable $V$, which is again assumed to be independent of everything else. Let the obtained measurement outcome be denoted with $Y$.
\item Bob uses $Y$ together with $V$ and $C$ to prepare (without loss of generality, deterministically) a random variable $S'$ (his share of the secret key), stored in $\pazocal{K}'$.
\end{enumerate}
A pictorial representation of this protocol is provided in Figure~\ref{1GLOPC_fig}.
\end{Def}

\begin{figure}[ht]
\begin{tikzpicture}
\node (U) [draw, thick, circle, minimum size=1cm] at (0,0) {$U$};
\node (A) [fill=gray!30, draw, thick, circle, minimum size=1cm] at (2,0) {$A$};
\draw [fill=gray!30, thick] (1.5,-2) rectangle (2.5,-1);
\draw [thick] (-0.5,-5) rectangle (2.5,-4);
\node (X) [draw, thick, circle, minimum size=1cm] at (2,-3) {$X$};
\node (S) [draw, thick, circle, minimum size=1cm] at (0,-10.5) {$S$};
\node (C) [draw, thick, circle, minimum size=1cm] at (2,-6) {$C$};
\draw [arrow] (A) -- (2,-1);
\draw [arrow] (2,-2) -- (X);
\draw [arrow] (X) -- (2,-4);
\draw [arrow] (U) -- (0,-4);
\draw [arrow] (0,-1.5) -- (1.5,-1.5);
\draw [arrow] (2,-5) -- (2,-5.5);
\draw [arrow] (0,-5) -- (S);
\node (B) [fill=gray!30, draw, thick, circle, minimum size=1cm] at (10,0) {$B$};
\draw [thick, double] (6,-3.1) ellipse (1cm and 1.5cm);
\node (E) [fill=gray!30, draw, thick, circle, minimum size=1cm] at (6,-2.5) {$E$};
\node (C') [draw, thick, circle, minimum size=1cm] at (6,-3.7) {$C$};
\draw [decorate,decoration=snake,thick] (A) -- (B);
\draw [decorate,decoration=snake,thick] (A) -- (E);
\draw [decorate,decoration=snake,thick] (B) -- (E);
\node (V) [draw, thick, circle, minimum size=1cm] at (12,0) {$V$};
\draw [fill=gray!30, thick] (9.5,-6.5) rectangle (10.5,-5.5);
\draw [thick] (9.5,-9.5) rectangle (12.5,-8.5);
\node (S') [draw, thick, circle, minimum size=1cm] at (11,-10.5) {$S'$};
\node (Y) [draw, thick, circle, minimum size=1cm] at (10,-7.5) {$Y$};
\draw [arrow] (C) -- (9.5,-6);
\draw [arrow] (6,-6) -- (C');
\draw [arrow] (B) -- (10,-5.5);
\draw [arrow] (10,-6.5) -- (10,-7);
\draw [arrow] (10,-8) -- (10,-8.5);
\draw [arrow] (V) -- (12,-8.5);
\draw [arrow] (11,-9.5) -- (S');
\draw [arrow] (12,-6) -- (10.5,-6);
\draw [arrow] (8,-6) -- (8,-9) -- (9.5,-9);
\end{tikzpicture}
\caption{A pictorial representation of a generic $1$-GLOPC protocol as described in Definition~\ref{1GLOPC_def}. Here, white circles stand for classical random variables, grey circles for quantum systems, and wavy lines for correlations (possibly quantum entanglement). Processes are represented by rectangles, either grey, if they involve quantum systems, or white, if they are purely classical. Finally, the ellipse at the center is Eve's system, which may contain a quantum part $E$ correlated with the initial state of Alice and Bob.}
\label{1GLOPC_fig}
\end{figure}

The second class of GLOPC protocols we consider involves Alice and Bob making preliminary destructive Gaussian measurements on their entire local subsystems, after which they are allowed to exchange public messages.

\begin{Def} \label{GLMPC_def}
Let Alice and Bob hold a bipartite continuous-variable system $AB$. A \textbf{GLMPC protocol} on $AB$ is a quantum-to-classical channel $AB\to \pazocal{K} \pazocal{K}'\pazocal{C}$, where $\pazocal{K},\pazocal{K}',\pazocal{C}$ are classical alphabets, with $\pazocal{K}$ and $\pazocal{K}'$ finite and identical, constructed in the following way:
\begin{enumerate}[(i)]
\item Alice makes a Gaussian measurement with seed $\Gamma_A$ on her entire subsystem $A$, obtaining as outcome a random variable $X$. She retains only $X$ and discards the quantum system.
\item The same on Bob's side: he makes a Gaussian measurement with seed $\Gamma_B$ on his entire subsystem $B$, obtaining as outcome a random variable $Y$. He retains only $Y$ and discards the quantum system.
\item Alice and Bob exchange back-and-forth public messages $C_1,\ldots, C_r$ (Alice to Bob) and $C'_1,\ldots, C'_r$ (Bob to Alice). Each $C_k$ (respectively, $C'_k$) depends only on $U, X, C'_1,\ldots, C'_{k-1}$ ($V, Y,C_1,\ldots, C_{k-1}$), where $U$ ($V$) is a local random variable on Alice's (Bob's) side, assumed to be independent of everything else.
\item Alice uses $U, X, C'_1,\ldots, C'_{r}$ to prepare $S$ (her share of the key), stored in $\pazocal{K}$. Bob does the same with $V,Y,C_1,\ldots, C_r$, storing a variable $S'$ in $\pazocal{K}'$.
\item Eve stores the messages $C_1,C'_1,\ldots, C_r, C'_r$ into $\pazocal{C}$.
\end{enumerate}
\end{Def}

\begin{rem}
In Definition~\ref{GLMPC_def} we do \emph{not} allow Alice and Bob to start with arbitrary Gaussian measurement protocols, as described in Definition~\ref{G_meas_protocol_def}. Instead, we force them to decide on a destructive Gaussian measurement to be applied at the same time to their entire local quantum systems. We stress that the former looser constraint is perhaps more natural than the latter stricter one. We chose not to adopt it because doing so makes the analysis far less transparent.
\end{rem}

\subsection{Distillable secret key}

We now move on to the definition of the distillable secret key associated with any of the three classes of protocols GLOPC, $1$-GLOPC, and GLMPC.

\begin{Def} \label{SK_rate_def}
Let $\rho_{ABE}$ be a quantum state of a tripartite continuous-variable system. For a class of protocols $\mathcal{P}\in \left\{ \mathrm{GLOPC},\, \text{\emph{1-GLOPC}},\, \mathrm{GLMPC}\right\}$, we say that a number $R>0$ is an \textbf{$\boldsymbol{\mathcal{P}}$-achievable secret key distillation rate} if
\begin{equation}
\lim_{n\to\infty}\ \inf_{\substack{\Lambda_n: A^n B^n \to \pazocal{K}_n \pazocal{K}'_n \pazocal{C}_n,\\ \omega_{\pazocal{C}_n E^n}}} \left\| \Lambda_n \left( \rho_{ABE}^{\otimes n} \right) - \left(\kappa_{2^{\ceil{Rn}}} \right)_{\pazocal{K}_n \pazocal{K}'_n} \otimes \omega_{\pazocal{C}_n E^n} \right\|_1 = 0\, ,
\tag{\ref{achievable rate}}
\end{equation}
where $\Lambda_n: A^n B^n \to \pazocal{K}_n \pazocal{K}'_n \pazocal{C}_n$ is an arbitrary protocol of class $\mathcal{P}$, $\pazocal{K}_n, \pazocal{K}'_n$ are two copies of the same alphabet of size $2^{\ceil{Rn}}$, $\kappa_N \mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = \frac{1}{N} \sum_{i=1}^{N} \ketbra{ii}$ is an ideal secret key, and $\omega_{\pazocal{C}_n E^n}$ is an arbitrary state of the classical-quantum system $\pazocal{C}_n E^n$.
We then define the \emph{$\mathcal{P}$-distillable secret key} of the state $\rho_{ABE}$ as the supremum of all $\mathcal{P}$-achievable secret key distillation rates, in formula
\begin{equation}
K_{\mathcal{P}} (A:B\, \|\, E)_\rho \mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = \sup \left\{ R:\, \text{$R$ is a $\mathcal{P}$-achievable secret key distillation rate} \right\} .
\end{equation}
When Eve has access to the entire purification $\Psi_{ABE}$ of the reduced state $\rho_{AB}$ of Alice and Bob, this becomes
\begin{equation}
K_{\mathcal{P}} (\rho_{AB}) \mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = K_{\mathcal{P}} (A:B\,\|\, E)_\Psi\, .
\label{kg_AB}
\end{equation}
In all the above formulae, we will also use the shorthand notation
\begin{equation}
K_{\mathrm{GLOPC}} = \mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} K^{\G} \, ,\qquad K_{\text{\emph{1-GLOPC}}} = \mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} K^{\G}_\to\, ,\qquad K_{\mathrm{GLMPC}} = \mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} K^{\G,\mathrm{\scriptscriptstyle\, M}}_\leftrightarrow \, .
\label{shorthand}
\end{equation}
\end{Def}

Observe that for every (possibly mixed) state $\rho_{ABE}$ with local reduction $\rho_{AB}\mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = \Tr_E \rho_{ABE}$ and for all $\mathcal{P}\in \left\{ \text{GLOPC, 1-GLOPC, GLMPC}\right\}$ it holds that $K_{\mathcal{P}} (A:B\,\|\, E)_\rho\geq K_{\mathcal{P}} (\rho_{AB})$, because $\rho_{ABE}$ can always be obtained by applying a local quantum channel on $E$ to the purification $\Psi_{ABE}$ of $\rho_{AB}$.
If $\rho_{AB}=\rho_\mathrm{\scriptscriptstyle \, G}[V_{AB}, s_{AB}]$ is a Gaussian state, then the corresponding Gaussian one-way distillable key is easily seen not to depend on the displacement vector $s_{AB}$, but only on the QCM $V_{AB}$. We will therefore define
\begin{equation}
K_{\mathcal{P}} (V_{AB}) \mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = K_{\mathcal{P}} \left(\rho_\mathrm{\scriptscriptstyle \, G}[V_{AB}, 0]\right) \equiv K_{\mathcal{P}} \left(\rho_\mathrm{\scriptscriptstyle \, G}[V_{AB}, s_{AB}]\right) ,
\end{equation}
and use also in this case the shorthand notation $K^{\G}(V_{AB}),\, K^{\G}_\to (V_{AB}),\, K^{\G,\mathrm{\scriptscriptstyle\, M}}_\leftrightarrow (V_{AB})$ derived from~\eqref{shorthand}.

\subsection{Modified distillable secret key}

A particularly useful upper bound on $K_{\mathcal{P}} (V_{AB})$ is established by forcing Eve to apply a Gaussian measurement with pure seed of her choice before the beginning of the protocol, and to broadcast the obtained outcome to Alice and Bob together with the description of $\Gamma_E$.
At this point, thanks to the discussion in Section~\ref{Gaussian_measurements_subsec} we know that the state that Alice and Bob share is Gaussian and has QCM
\begin{equation}
\tau_{AB} = (\gamma_{ABE}+\Gamma_E)/(\gamma_E+\Gamma_E)\, ,
\label{protocol_eq0}
\end{equation}
where $\gamma_{ABE}$ is a purification of the QCM $V_{AB}$. Since Alice and Bob also know Eve's measurement outcome, they can easily apply local displacements and have their state's mean vanish. The protocols then proceed as in Definitions~\ref{GLOPC_def}--\ref{GLMPC_def}.
Note that Eve's measurement outcome is now independent of Alice and Bob's state and is thus useless. We summarise this discussion by giving the following definition.

\begin{Def} \label{modified_SK_rate_def}
For $\mathcal{P}\in \left\{ \text{\emph{GLOPC, 1-GLOPC, GLMPC}} \right\}$, the \textbf{modified $\boldsymbol{\mathcal{P}}$-distillable secret key} associated with a Gaussian state with QCM $V_{AB}$, denoted $\widetilde{K}_{\mathcal{P}} (V_{AB})$ --- or more succinctly $\widetilde{K}^\mathrm{\scriptscriptstyle \, G}(V_{AB}),\, \widetilde{K}^\mathrm{\scriptscriptstyle \, G}_\to (V_{AB}),\, \widetilde{K}^{\mathrm{\scriptscriptstyle \, G},\mathrm{\scriptscriptstyle\, M}}_\leftrightarrow(V_{AB})$, as per~\eqref{shorthand} --- is the supremum of all numbers $R>0$ such that
\begin{equation}
\lim_{n\to\infty}\ \sup_{\Gamma_{E^n}}\ \inf_{\substack{ \Lambda_n: A^n B^n \to \pazocal{K}_n \pazocal{K}'_n \pazocal{C}_n,\\ Q_{\pazocal{C}_n}}} \left\| \Lambda_n \left( \rho_\mathrm{\scriptscriptstyle \, G}\left[ (\gamma_{ABE}^{\oplus n}+\Gamma_{E^n})/(\gamma_E^{\oplus n}+\Gamma_{E^n}),\, 0\right] \right) - \left( \kappa_{2^{\ceil{Rn}}} \right)_{\pazocal{K}_n\pazocal{K}'_n} \otimes Q_{\pazocal{C}_n} \right\|_1 = 0\, ,
\label{modified_SK_rate}
\end{equation}
where $\Lambda_n: A^n B^n \to \pazocal{K}_n \pazocal{K}'_n \pazocal{C}_n$ is an arbitrary protocol of class $\mathcal{P}$, $\pazocal{K}_n, \pazocal{K}'_n$ are two copies of the same alphabet of size $2^{\ceil{Rn}}$, $\gamma_{ABE}$ is a purification of $V_{AB}$, $\kappa_N \mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = \frac{1}{N} \sum_{i=1}^{N} \ketbra{ii}$ is an ideal secret key, and $Q_{\pazocal{C}_n}$ is an arbitrary probability distribution over the alphabet $\pazocal{C}_n$.
\end{Def}

It should be clear that the new class of protocols in Definition~\ref{modified_SK_rate_def} allows for a secret key distillation rate that is never smaller than that corresponding to the protocols in Definition~\ref{SK_rate_def}, because in the former case Eve is forced to lose access to her quantum system at an early stage.
We give a formal proof of this below.

\begin{lemma} \label{K_tilde_ub_lemma}
For all $\mathcal{P}\in \left\{ \text{\emph{GLOPC, 1-GLOPC, GLMPC}} \right\}$ and all QCMs $V_{AB}$, it holds that
\begin{equation}
K_{\mathcal{P}} (V_{AB}) \leq \widetilde{K}_{\mathcal{P}}(V_{AB})\, ,
\label{K_tilde_ub}
\end{equation}
where $K_{\mathcal{P}} (V_{AB})$ and $\widetilde{K}_{\mathcal{P}} (V_{AB})$ are given in Definitions~\ref{SK_rate_def} and~\ref{modified_SK_rate_def}, respectively.
\end{lemma}

\begin{proof}
Let $R>0$ be an achievable rate for $K_{\mathcal{P}} (V_{AB})$. Construct a sequence of protocols $\Lambda_n: A^n B^n \to \pazocal{K}_n \pazocal{K}'_n \pazocal{C}_n$ of class $\mathcal{P}$, where $\pazocal{K}_n,\pazocal{K}'_n$ are two copies of an alphabet of size $2^{\ceil{Rn}}$, and a sequence of states $\omega_{\pazocal{C}_n E^n}$, such that
\begin{equation}
\lim_{n\to\infty}\ \left\| \Lambda_n \left( \rho_{ABE}^{\otimes n} \right) - \left(\kappa_{2^{\ceil{Rn}}} \right)_{\pazocal{K}_n \pazocal{K}'_n} \otimes \omega_{\pazocal{C}_n E^n} \right\|_1 = 0\, .
\label{K_tilde_ub_eq0}
\end{equation}
For a fixed $n$, consider an arbitrary QCM $\Gamma_{E^n}$. For a vector $x\in \pazocal{F}_n \mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = \mathds{R}^{2nm_E}$, with $m_E$ being the number of modes of $E$, let $p(x)$ denote the value on $x$ of the probability density function of the outcome of the Gaussian measurement with seed $\Gamma_{E^n}$ on Eve's share of the state $\rho_{ABE}^{\otimes n}$. Also, let $t_{A^nB^n}^x = (t_{A^n}^x,\, t_{B^n}^x)\in \mathds{R}^{2n(m_A+m_B)}$ be the displacement vector of the post-measurement state on $A^n B^n$ corresponding to the outcome $x$.

We now construct a modified protocol $\Lambda'_n: A^n B^n\to \pazocal{K}_n \pazocal{K}'_n \pazocal{C}_n \pazocal{F}_n$ of class $\mathcal{P}$, where the measurable space $\pazocal{F}_n = \mathds{R}^{2n m_E}$ pertains to Eve. To do this, we distinguish two separate cases. If $\mathcal{P}\in \left\{\text{GLOPC, 1-GLOPC}\right\}$, then $\Lambda'_n$ proceeds as follows:
\begin{itemize}
\item Alice draws a local random variable $X$ on $\pazocal{F}_n$ distributed according to $p$, applies to $A^n$ the displacement unitary $D\left(t_{A^n}^X\right)$, and then continues with her (first) Gaussian measurement protocol as prescribed by $\Lambda_n$.
\item During the (first) round of communication, Alice sends to Bob and Eve not only the message originally prescribed by $\Lambda_n$, but also the random variable $X$.
\item Before continuing with his (first) Gaussian measurement protocol dictated by $\Lambda_n$, Bob applies a displacement unitary $D\left(t_{B^n}^X\right)$ to his share of the system.
\item The protocol continues with further communication rounds (if $\mathcal{P}=\text{GLOPC}$) or directly with key generation (if $\mathcal{P}=\text{1-GLOPC}$) as prescribed by $\Lambda_n$.
\end{itemize}

If instead $\mathcal{P} = \text{GLMPC}$, the modified protocol $\Lambda'_n$ is even simpler:
\begin{itemize}
\item Alice and Bob apply global Gaussian measurements to their entire subsystems as dictated by $\Lambda_n$, obtaining measurement outcomes $Z_n$ and $W_n$, respectively.
\item Before preparing her first message for Bob, Alice draws a local random variable $X$ on $\pazocal{F}_n$ distributed according to $p$ and translates $Z_n$ by $t_{A^n}^X$.
\item Alice then sends to Bob not only the message originally prescribed by $\Lambda_n$, but also $X$.
\item Before preparing his first message for Alice, Bob translates $W_n$ by $t_{B^n}^X$.
\item The protocol continues with further communication rounds and then with key generation as prescribed by $\Lambda_n$.
\end{itemize}

It is not too difficult to verify that in all three cases
\begin{equation}
\begin{aligned}
\Lambda'_n(\cdot) =&\ \int d^{2nm_E}x\ p(x)\, \left(\Lambda_n\circ \mathcal{D}(t_{A^nB^n}^x)\right) \left( \cdot \right) \otimes \ketbra{x}_{\pazocal{F}_n}\, , \\
\mathcal{D}(t_{A^nB^n}^x) (\cdot) \mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} =&\ D(t_{A^n}^x) \otimes D(t_{B^n}^x)\, (\cdot)\, D(-t_{A^n}^x) \otimes D(-t_{B^n}^x)\, ,
\end{aligned}
\label{K_tilde_ub_eq1}
\end{equation}
with the system $\pazocal{F}_n$ storing $X$ being on Eve's side.
Let us now estimate the figure of merit in~\eqref{modified_SK_rate} for this protocol. We have that
\begin{equation}
\begin{aligned}
&\inf_{Q_{\pazocal{C}_n \pazocal{F}_n}} \left\| \Lambda'_n \left( \rho_\mathrm{\scriptscriptstyle \, G}\left[ \left(\gamma_{ABE}^{\oplus n}\!+\!\Gamma_{E^n}\right)\Big/\left(\gamma_E^{\oplus n}\!+\!\Gamma_{E^n}\right),\, 0\right] \right) - \kappa_{2^{\ceil{Rn}}} \otimes Q_{\pazocal{C}_n\pazocal{F}_n} \right\|_1 \\
&\qquad \texteq{1} \inf_{Q_{\pazocal{C}_n \pazocal{F}_n}} \left\| \int d^{2nm_E}x\ p(x) \left(\Lambda_n\!\circ\! \mathcal{D}(t_{A^nB^n}^x)\right) \left( \rho_\mathrm{\scriptscriptstyle \, G}\left[ \left(\gamma_{ABE}^{\oplus n}\!+\!\Gamma_{E^n}\right)\Big/\left(\gamma_E^{\oplus n}\!+\!\Gamma_{E^n}\right),\, 0\right] \right) \otimes \ketbra{x}_{\pazocal{F}_n} - \kappa_{2^{\ceil{Rn}}} \otimes Q_{\pazocal{C}_n \pazocal{F}_n} \right\|_1 \\
&\qquad \textleq{2} \bigg\| \int d^{2nm_E}x\, \Big( p(x)\, \Lambda_n \left( \rho_\mathrm{\scriptscriptstyle \, G}\left[ \left(\gamma_{ABE}^{\oplus n}\!+\!\Gamma_{E^n}\right)\Big/\left(\gamma_E^{\oplus n}\!+\!\Gamma_{E^n}\right),\, t_{A^nB^n}^x \right] \right) \otimes \ketbra{x}_{\pazocal{F}_n} - \kappa_{2^{\ceil{Rn}}} \otimes \Tr_{E^n}\! \left[ \omega_{\pazocal{C}_n E^n} \rho_\mathrm{\scriptscriptstyle \, G}\!\left[ \Gamma_{\!E^n}, x\right] \right] \otimes \ketbra{x}_{\pazocal{F}_n} \Big) \bigg\|_1 \\
&\qquad \textleq{3} \left\| \Lambda_n \left( \rho_\mathrm{\scriptscriptstyle \, G}\left[ \gamma_{ABE}^{\oplus n},\, 0 \right] \right) - \kappa_{2^{\ceil{Rn}}} \otimes \omega_{\pazocal{C}_n E^n} \right\|_1\, .
\end{aligned}
\label{K_tilde_ub_eq2}
\end{equation}
Here: in~1 we used~\eqref{K_tilde_ub_eq1}; in~2 we let the displacement act on the Gaussian state and considered the ansatz
\begin{equation*}
Q_{\pazocal{C}_n\pazocal{F}_n} = \int d^{2nm_E}x\ \Tr_{E^n}\! \left[ \omega_{\pazocal{C}_n E^n} \rho_\mathrm{\scriptscriptstyle \, G}\!\left[ \Gamma_{\!E^n}, x\right] \right] \otimes \ketbra{x}_{\pazocal{F}_n}\, ,
\end{equation*}
which is nothing but the probability distribution obtained by making the Gaussian measurement with seed $\Gamma_{E^n}$ on $\omega_{\pazocal{C}_n\pazocal{F}_n}$; finally, 3~follows from the data processing inequality for the trace norm. Taking the supremum over $\Gamma_{E^n}$ in \eqref{K_tilde_ub_eq2} yields
\begin{equation}
\begin{aligned}
&\sup_{\Gamma_{E^n}} \inf_{Q_{\pazocal{C}_n \pazocal{F}_n}} \left\| \Lambda'_n \left( \rho_\mathrm{\scriptscriptstyle \, G}\left[ \left(\gamma_{ABE}^{\oplus n}\!+\!\Gamma_{E^n}\right)\Big/\left(\gamma_E^{\oplus n}\!+\!\Gamma_{E^n}\right),\, 0\right] \right) - \kappa_{2^{\ceil{Rn}}} \otimes Q_{\pazocal{C}_n\pazocal{F}_n} \right\|_1 \\
&\qquad \leq \sup_{\Gamma_{E^n}}\ \inf_{\substack{ \Lambda'_n: A^n B^n \to \pazocal{K}_n \pazocal{K}'_n \pazocal{C}'_n,\\ Q_{\pazocal{C}'_n}}} \left\| \Lambda_n \left( \rho_\mathrm{\scriptscriptstyle \, G}\left[ (\gamma_{ABE}^{\oplus n}+\Gamma_{E^n})/(\gamma_E^{\oplus n}+\Gamma_{E^n}),\, 0\right] \right) - \left( \kappa_{2^{\ceil{Rn}}} \right)_{\pazocal{K}_n\pazocal{K}'_n} \otimes Q_{\pazocal{C}'_n} \right\|_1 \\
&\qquad \leq \left\| \Lambda_n \left( \rho_\mathrm{\scriptscriptstyle \, G}\left[ \gamma_{ABE}^{\oplus n},\, 0 \right] \right) - \kappa_{2^{\ceil{Rn}}} \otimes \omega_{\pazocal{C}_n E^n} \right\|_1\, .
\end{aligned}
\label{K_tilde_ub_eq3}
\end{equation}
The combination of~\eqref{K_tilde_ub_eq3} and~\eqref{K_tilde_ub_eq0} shows that $R$ is also an achievable rate for $\widetilde{K}_{\mathcal{P}}(V_{AB})$, thus concluding the proof.
\end{proof}

\section{Secret key distillation with 1-GLOPC: proof of Theorem~\ref{KG_ub_thm}}

We are now ready to prove Theorem~\ref{KG_ub_thm} from the main text, which establishes an upper bound on the secret key obtainable from Gaussian states with Gaussian local operations and one-way public communication in terms of the R\'enyi-$2$ Gaussian entanglement of formation.

\subsection{Gaussian entanglement measures}

We start by reviewing some entanglement measures for Gaussian states. In general, operationally motivated correlation quantifiers for quantum states are usually based on the von Neumann entropy
\begin{equation}
S_1(\rho)\mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = -\Tr[\rho \log_2 \rho]\, ,
\label{entropy}
\end{equation}
which is the correct quantum generalisation of the Shannon entropy for classical random variables. Other R\'enyi-$\alpha$ entropies, given for $\alpha\geq 1$ by
\begin{equation}
S_\alpha(\rho) \mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = \frac{1}{1-\alpha}\log_2 \Tr[\rho^\alpha]\, ,
\label{Renyi_entropy}
\end{equation}
although mathematically important, are commonly thought not to have such a direct operational meaning. However, in the constrained Gaussian setting we study here our interest lies not in the correlations possessed by the state per se, but rather in that part of them that can be accessed by the local parties. Since we also assume that these are restricted to Gaussian measurements, we in fact want to look at the correlations displayed by the classical random variables that constitute the outcomes of those measurements. When the random variable $X$ models the outcome of a Gaussian measurement with seed $\sigma$ performed on the Gaussian state $\rho_\mathrm{\scriptscriptstyle \, G}[V,s]$, its Shannon differential entropy, generally defined by the formula $H(X) = - \int d^{2n}x\, p_X(x) \log_2 p_X(x)$, takes the form (cf.~\eqref{Wigner_entropy_Gaussian})
\begin{equation}
H(X) = \frac12 \log_2 \det (V+\sigma) + n \log_2 (\pi e)\, .
\label{differential entropy G outcomes}
\end{equation}
This kind of expression, basically the log-determinant of a QCM, up to additive constants, resembles that appearing in the formula for the R\'enyi-$2$ entropy of the state,
\begin{equation}
S_2\left(\rho_\mathrm{\scriptscriptstyle \, G}[V,s]\right) = \frac12 \log_2 \det V = M(V)\, ,
\label{Renyi-2}
\end{equation}
where $M$ has already been defined in \eqref{M}. Although~\eqref{differential entropy G outcomes} and~\eqref{Renyi-2} are not identical, their share the same functional form. Hence, in some sense it is the R\'enyi-$2$ entropy, and not the von Neumann entropy, that is connected to the Shannon entropy of the experimentally accessible measurement outcomes, when those measurements are also Gaussian. For this precise reason, one can expect the R\'enyi-$2$ entropy to play a role in quantifying those correlations of Gaussian states that can be extracted via Gaussian measurements~\cite{LL-log-det}. In fact, quantifiers based on the R\'enyi-$2$ entropy and their applications have been extensively investigated~\cite{AdessoSerafini, Kor, Simon16, Lami16, GIE, LL-log-det}.

Let us start by introducing a simple correlation quantifier known as the \textbf{classical mutual information} of the quantum state $\rho$~\cite{Terhal-Ep, locking}. It is formally given by
\begin{equation}
I^c(A:B)_\rho \mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = \sup_{\pazocal{M}_A,\pazocal{M}_B} I(X:Y)\, ,
\end{equation}
where $\pazocal{M}_A,\pazocal{M}_B$ are measurements on $A$ and $B$ with outcomes being the classical random variables $X$ and $Y$. When $\rho_{AB}=\rho_\mathrm{\scriptscriptstyle \, G}[V_{AB}, s_{AB}]$ is Gaussian, and $\pazocal{M}_A,\pazocal{M}_B$ are also restricted to be Gaussian measurements with seeds $\Gamma_A, \Gamma_B$, the maximal mutual information between the local outcomes becomes the \textbf{Gaussian mutual information}, given by~\cite{Lada2011}
\begin{equation}
\begin{aligned}
I_M^c(A : B)_V &\mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = \sup_{\Gamma_A,\Gamma_B} I(X:Y)_Q = \sup_{\Gamma_A,\Gamma_B} I_M(A:B)_{V_{AB}+\Gamma_A\oplus \Gamma_B}\, , \\
Q_{XY} &\mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = \left( \pazocal{M}_{\Gamma_A}^\mathrm{\scriptscriptstyle \, G},\pazocal{M}_{\Gamma_B}^\mathrm{\scriptscriptstyle \, G} \right) \left(\rho_\mathrm{\scriptscriptstyle \, G}\left[ V_{AB}, 0\right] \right) .
\end{aligned}
\label{IMc}
\end{equation}
where the log-determinant mutual information of a bipartite QCM $V_{AB}$ is given by~\cite{LL-log-det}
\begin{equation}
I_M(A:B)_V \mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = M(V_A) + M(V_B) - M(V_{AB}) = \frac12 \log_2 \frac{(\det V_A) (\det V_B)}{\det V_{AB}}\, .
\label{IM}
\end{equation}
Proving~\eqref{IMc} using~\eqref{Gaussian measurement PDF} and~\eqref{differential entropy G outcomes} is an elementary exercise that is left to the reader. Its solution rests upon the fact that the conditional mutual information is a balanced entropic expression, and hence the `spurious' constant terms in~\eqref{differential entropy G outcomes} cancel out, exactly as we saw in~\eqref{KW_ub_proof_eq2}.

While~\eqref{IMc} is difficult to compute in general, it is known that~\cite{giedkemode, Lada2011, GIE-PRA}
\begin{equation}
I_M^c(A:B)_\gamma = \frac12 I_M(A:B)_\gamma = M(\gamma_A)
\label{IMc pure states}
\end{equation}
for all pure bipartite QCMs $\gamma_{AB}$. We present a self-contained proof of this fact in Lemma~\ref{classical_mutual_info_pure_lemma}. Furthermore, if $\gamma$ is in $xp$-form, the optimal measurements in~\eqref{IMc} are identical homodynes. Note that the last equality simply follows from the fact that the local reductions of a pure state all have the same R\'enyi entropies. Moving on from total correlations to entanglement, we can rely on~\eqref{Renyi-2} and~\eqref{M} to form a version of the entanglement of formation called the \textbf{R\'enyi-2 Gaussian entanglement of formation}~\cite{AdessoSerafini}:
\begin{equation}
E_{F,2}^\G (V_{AB}) \mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = \inf_{\substack{\\ i\Omega_{AB}\leq \gamma_{AB}\leq V_{AB},\\[0.3ex] \text{$\gamma_{AB}$ pure}}} M(\gamma_{\!A})\, .
\label{reof_SM}
\end{equation}
This quantity obeys several properties, most notably it is monogamous: for all QCMs $V_{ABC}$, it holds that~\cite[Corollary~7]{Lami16}
\begin{equation}
E_{F,2}^\G(V_{A:BC}) \geq E_{F,2}^\G(V_{A:B}) + E_{F,2}^\G(V_{A:C})\, ,
\label{reof monogamy}
\end{equation}
where we use colons to signify the partition we are referring to. When combined with the fact that it comes from a convex roof construction, this implies that it is additive~\cite[Corollary~17]{LL-log-det}:
\begin{equation}
E_{F,2}^\G \left( V_{AB}^{\oplus n} \right) = n\, E_{F,2}^\G (V_{AB})\qquad \forall\ n\, .
\label{reof additivity}
\end{equation}
Incidentally, both~\eqref{reof monogamy} and~\eqref{reof additivity} are easy corollaries of the identity~\cite[Theorem~15]{LL-log-det}
\begin{equation}
E_{F,2}^\G (V_{AB}) =\frac12 \inf_{V_{ABC}} I_M(A:B|C)_V\, ,
\label{reof = sq}
\end{equation}
where
\begin{equation}
I_M(A:B|C)_V \mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = M(V_{AC}) + M(V_{BC}) - M(V_C) - M(V_{ABC}) = \frac12 \log_2 \frac{(\det V_{AC})(\det V_{BC})}{(\det V_C)(\det V_{ABC})}
\label{IM_conditional}
\end{equation}
is the log-determinant conditional mutual information~\cite{LL-log-det}, and the infimum ranges over all extensions $V_{ABC}$ of $V_{AB}$, i.e.\ over all QCMs $V_{ABC}$ such that $\Pi_{AB}V_{ABC}\Pi_{AB}^\intercal=V_{AB}$.

Following an entirely different path, a new entanglement quantifier for Gaussian states has been recently introduced~\cite{GIE, GIE-PRA, GIE-PRA2}. The \textbf{Gaussian intrinsic entanglement} $E^\G_\downarrow(V_{AB})$ of a bipartite Gaussian state with QCM $V_{AB}$ is defined as the minimal intrinsic information of the classical random variables obtained upon measuring it with Gaussian measurements, assuming that Eve holds a purification of it but her measurement and classical post-processing are also Gaussian. Denoting with $\gamma_{ABE}$ a purification of $V_{AB}$, we set
\begin{equation}
E^\G_\downarrow( V_{AB}) \mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = \sup_{\Gamma_A, \Gamma_B} \inf_{\Gamma_E} I_M\left(A:B|E\right)_{\gamma_{ABE} + \Gamma_A\oplus \Gamma_B\oplus \Gamma_E}\, ,
\label{gie_SM}
\end{equation}
where $\Gamma_A$, $\Gamma_B$, and $\Gamma_E$ are arbitrary QCM on systems $A$, $B$, and $E$, respectively. It is an easy exercise to show that the objective function on the right-hand side of~\eqref{gie_SM} coincides with the conditional mutual information of the triple of random variables generated by carrying out Gaussian measurements with seeds $\Gamma_A, \Gamma_B, \Gamma_E$ on the Gaussian state with QCM $V_{ABE}$. In formula,
\begin{equation}
\begin{aligned}
I_M\left(A:B|E\right)_{\gamma_{ABE} + \Gamma_A\oplus \Gamma_B\oplus \Gamma_E} &= I(X:Y|Z)_Q\, , \\
Q_{XYZ} &= \left( \pazocal{M}_{\Gamma_A}^\mathrm{\scriptscriptstyle \, G} \otimes \pazocal{M}_{\Gamma_B}^\mathrm{\scriptscriptstyle \, G} \otimes \pazocal{M}_{\Gamma_E}^\mathrm{\scriptscriptstyle \, G} \right) \left( \rho_\mathrm{\scriptscriptstyle \, G}\left[ V_{ABE},\, 0\right] \right) .
\end{aligned}
\label{daje}
\end{equation}
The proof of~\eqref{daje} is entirely analogous to that of~\eqref{IMc}. One can show that~\eqref{gie_SM} does not depend on the choice of the purification~$\gamma_{ABE}$ of~$V_{AB}$~\cite{GIE, GIE-PRA, GIE-PRA2}. In order to investigate the asymptotic setting, we will consider the regularisation of~\eqref{gie_SM} as well, given by
\begin{equation}
E^{\G,\infty}_\downarrow(V_{AB}) \mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = \liminf_{n\to\infty} \frac1n E^\G_\downarrow\left( V_{AB}^{\oplus n} \right) .
\label{gier_SM}
\end{equation}

It is also worth noticing that~\eqref{IM_conditional} can be cast into the form of an unconditional log-determinant mutual information~\eqref{IM} with the help of Schur complements. Namely, by iteratively applying Schur's determinant factorisation formula~\eqref{det fact} one can easily verify that~\cite[Eq.~(28)]{LL-log-det}
\begin{equation}
I_M(A:B|E)_{V_{ABE}} = I_M(A:B)_{V_{ABE}/V_E}\, .
\label{IM_conditional_Schur}
\end{equation}

\subsection{Proof of Theorem~\ref{KG_ub_thm}}

We are finally ready to re-state and prove Theorem~\ref{KG_ub_thm} from the main text.

\begin{manualthm}{\ref{KG_ub_thm}}
For all QCMs $V_{AB}$, it holds that
\begin{equation}
K^{\G}_\to (V_{AB}) \leq \widetilde{K}^\mathrm{\scriptscriptstyle \, G}_\to(V_{AB}) \leq E_{F,2}^\G(V_{AB})\, .
\tag{\ref{KG_ub}}
\end{equation}
If $V_{AB}=\gamma_{AB}$ is pure, then~\eqref{KG_ub} is tight, i.e.
\begin{equation}
K^{\G}_\to(\gamma_{AB}) = \widetilde{K}^\mathrm{\scriptscriptstyle \, G}_\to(V_{AB}) = E_{F,2}^\G(\gamma_{AB}) = M(\gamma_A)\, .
\tag{\ref{reof=KG_pure}}
\end{equation}
\end{manualthm}

\begin{proof}[Proof of Theorem~\ref{KG_ub_thm}]
Let $\gamma_{ABE}$ denote a purification of $V_{AB}$, and let us consider a 1-GLOPC protocol applied on the corresponding Gaussian state.
Let us look at the situation right before step~(iv), i.e.\ Bob's measurement, in Definition~\ref{1GLOPC_def}. Almost all `quantumness' has disappeared, in the sense that the only party still holding a quantum state is Bob. From the point of view of Alice, who knows the value of $U$, the Gaussian measurement protocol she has applied in~(i), and the associated outcome $X$, Bob's state $\rho_{B|U,X}$ is Gaussian.

We now claim that this situation can be simulated by an entirely classical system. Namely, let $W_B$ be a random variable on the phase space $\mathds{R}^{2m_B}$ of Bob's system whose probability distribution conditioned on the values of $U$ and $X$ coincides with the Wigner function of $\rho_{B|U,X}$, which is everywhere positive because $\rho_{B|U,X}$ is Gaussian. Noting that: (a)~the vacuum itself has positive Wigner function; (b)~any Gaussian unitary amounts to a linear transformation at the phase space level, and thus preserves the positivity of the Wigner function; and (c)~the POVM elements describing Gaussian measurements also have positive Wigner function, by inspecting the definition of Gaussian measurement protocol (Definition~\ref{G_meas_protocol_def}) we see that step~(iv) can be simulated by purely classical operations on $W_B$, $C$, and $V$. We are therefore in the situation depicted in Figure~\ref{1GLOPC_modified_fig}.

\begin{figure}[ht]
\begin{tikzpicture}
\draw [fill=gray!10, thick, dashed] (-1,0.5) rectangle (3,4);
\node (U) [draw, thick, circle, minimum size=1cm] at (0,3) {$U$};
\node (A) [fill=gray!30, draw, thick, circle, minimum size=1cm] at (2,3) {$A$};
\draw [fill=gray!30, thick] (1.5,1) rectangle (2.5,2);
\node (X) [draw, thick, circle, minimum size=1cm] at (2,-1) {$X$};
\node (U') [draw, thick, circle, minimum size=1cm] at (0,-1) {$U$};
\draw [thick] (-0.5,-5) rectangle (2.5,-4);
\node (S) [draw, thick, circle, minimum size=1cm] at (0,-7.5) {$S$};
\node (C) [draw, thick, circle, minimum size=1cm] at (2,-6) {$C$};
\draw [arrow] (A) -- (2,2);
\draw [arrow] (2,1) -- (X);
\draw [arrow] (X) -- (2,-4);
\draw [arrow] (U) -- (0,-0.5);
\draw [arrow] (0,-1.5) -- (0,-4);
\draw [arrow] (0,1.5) -- (1.5,1.5);
\draw [arrow] (2,-5) -- (2,-5.5);
\draw [arrow] (0,-5) -- (S);
\node (WB) [draw, thick, circle, minimum size=1cm] at (10,-1) {$W_B$};
\draw [thick, double] (6,-3.2) circle (1cm);
\node (C') [draw, thick, circle, minimum size=1cm] at (6,-3.2) {$C$};
\node (V) [draw, thick, circle, minimum size=1cm] at (12,-1) {$V$};
\draw [thick] (9.5,-6.5) rectangle (12.5,-5.5);
\node (S') [draw, thick, circle, minimum size=1cm] at (11,-7.5) {$S'$};
\draw [arrow] (C) -- (9.5,-6);
\draw [arrow] (6,-6) -- (C');
\draw [arrow] (WB) -- (10,-5.5);
\draw [arrow] (V) -- (12,-5.5);
\draw [arrow] (11,-6.5) -- (S');
\draw [decorate,decoration=snake,thick] (X) -- (WB);
\draw [decorate,decoration=snake,thick] (X) -- (U');
\end{tikzpicture}
\caption{The modified protocol used in the proof of Theorem~\ref{KG_ub_thm}. Once the Gaussian protocol on $A$ has been carried out, we can think of the $B$ system as formally simulated by the classical random variable $W_B$ whose distribution conditioned on $UX$ coincides with the Wigner function of the (Gaussian) reduced state on $B$ corresponding to the recorded values of $U$ and $X$.}
\label{1GLOPC_modified_fig}
\end{figure}

We can proceed by following to a certain extent the technique introduced by Maurer~\cite{Maurer1993}. In what follows, we will compute conditional entropies and mutual informations between random variables that are both discrete ($U$, $S$, $C$, $S'$, $V$) and continuous ($X$ and $W_B$). In the latter case it is understood that we employ the differential entropy (measured in bits) instead of the discrete one, although we will denote both with the symbol $H$ for simplicity. Remember that a linear entropy inequality involving differential entropies is valid if and only if its discrete counterpart is `balanced' and valid~\cite{Chan-balanced}. Our derivation rests only upon balanced inequalities. We start by writing
\begin{equation}
H(S) = I(S:C) + H(S|C)\, .
\label{protocol_eq1}
\end{equation}
Now,
\begin{equation}
\begin{aligned}
H(S|C) &= H(SUX|C) - H(UX|SC) \\
&= H(UX|C) - H(UX|SC) \\
&\textleq{1} H(UX|C) - H(UX|SCVW_B) \\
&= H(UX|C) - H(UXS|CVW_B) + H(S|CVW_B) \\
&\texteq{2} H(UX|C) - H(UX|CVW_B) + H(S|CVW_B) \\
&= I(UX:VW_B|C) + H(S|CVW_B) \\
&\textleq{3} I(UX:VW_B|C) + H(S|S') \\
&\texteq{4} I(UX:W_B|C) + H(S|S')\, .
\end{aligned}
\label{protocol_eq2}
\end{equation}
Here: 1~comes from data processing; 2~is a consequence of the fact that $S$ is a deterministic function of $U$ and $X$; 3~is again data processing, using the fact that $S'$ is a deterministic function of $C$, $V$, and $W_B$; finally, 4~uses that $V$ is independent of $U$, $X$, and $W_B$, even conditioned on $C$. Now, observe that
\begin{equation}
\begin{aligned}
I(UX:W_B|C) &= H(W_B|C) - H(W_B|UXC) \\
&= H(W_B|C) - H(W_B|UX) \\
&\textleq{5} H(W_B) - H(W_B|UX) \\
&\textleq{6} H(W_B) - m_B \log_2 (\pi e) \\
&\texteq{7} M(\tau_B)\, .
\end{aligned}
\label{protocol_eq3}
\end{equation}
Note that 5~is just the positivity of the mutual information $I(W_B:C)\geq 0$, 6~is a rephrase of~\eqref{lower_bound_M_Gaussian}, and 7~comes from~\eqref{Wigner_entropy_Gaussian}. Combining~\eqref{protocol_eq1}--\eqref{protocol_eq3} yields
\begin{equation}
H(S) \leq I(S:C) + H(S|S') + M(\tau_B) \, .
\label{protocol_eq4}
\end{equation}

We now consider a sequence of $1$-GLOPC protocols $\Lambda_n: A^n B^n \to \pazocal{K}_n \pazocal{K}'_n \pazocal{C}_n$ with rate $R$ as in Definition~\ref{modified_SK_rate_def}. Pick numbers $\epsilon_n>0$ such that
\begin{equation}
\epsilon_n > \sup_{\Gamma_{E^n}}\ \inf_{Q_{\pazocal{C}_n}} \left\| \Lambda_n \left( \rho_\mathrm{\scriptscriptstyle \, G}\left[ \left(\gamma_{ABE}^{\oplus n}+\Gamma_{E^n}\right)\Big/ \left(\gamma_E^{\oplus n}+\Gamma_{E^n}\right),\, 0\right] \right) - \left( \kappa_{2^{\ceil{Rn}}} \right)_{\pazocal{K}_nK'_n} \otimes Q_{\pazocal{C}_n} \right\|_1
\label{protocol_eq5}
\end{equation}
and
\begin{equation}
\lim_{n\to\infty} \epsilon_n =0\, .
\label{protocol_eq6}
\end{equation}
Now, consider a fixed sequence of QCMs $\Gamma_{E^n}$. Set
\begin{equation}
\tau_{A^n B^n} \mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = \left(\gamma_{ABE}^{\oplus n}+\Gamma_{E^n}\right)\Big/\left(\gamma_E^{\oplus n}+\Gamma_{E^n}\right) ,
\label{protocol_eq7}
\end{equation}
denote by $S_n,S'_n$ the keys produced by the protocol $\Lambda_n$ run with input $\rho_\mathrm{\scriptscriptstyle \, G}\left[  \tau_{A^nB^n},\, 0\right]$, and let $C_n$ be the message exchanged. Applying~\eqref{protocol_eq4}, we see that
\begin{equation}
H(S_n) \leq I(S_n:C_n) + H(S_n|S'_n) + M\left(\tau_{B^n}\right) .
\label{protocol_eq8}
\end{equation}

By tracing away $E_n$, from~\eqref{protocol_eq5} we deduce that the probability distribution $P_{S_n S'_n}$ is at least $\epsilon_n$-close in total variation norm to that of two perfectly correlated copies of the key. In turn, this ensures that $\Pr\{S_n\neq S'_n\} < \epsilon_n$. Hence, Fano's inequality~\cite{FANO} gives
\begin{equation}
H(S_n|S'_n) < h_2(\epsilon_n) + \epsilon_n \log_2 \left(|S_n|-1\right) \leq h_2(\epsilon_n) + \ceil{R n} \epsilon_n ,
\label{protocol_eq9}
\end{equation}
where $h_2(x)\mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = -x\log_2 x - (1-x) \log_2 (1-x)$ is the binary entropy, and we remembered that $|S_n|=2^{\ceil{Rn}}$.

The same reasoning guarantees that $P_{S_n}$ is at least $\epsilon_n$-close in total variation norm to the uniform distribution over an alphabet of size $2^{\ceil{Rn}}$, whose entropy (measured in bits, as usual) is naturally given by $\ceil{Rn}$. The Fannes--Auedenaert inequality~\cite{Fannes1973, Audenaert2007} thus guarantees that
\begin{equation}
H(S_n) \geq \ceil{Rn} - \frac{\epsilon_n}{2} \log_2 \left( 2^{\ceil{Rn}} - 1\right) - h_2\left(\frac{\epsilon_n}{2}\right) \geq \ceil{Rn} - \frac{\epsilon_n}{2} \ceil{Rn} - h_2\left(\frac{\epsilon_n}{2}\right) .
\label{protocol_eq10}
\end{equation}

The last consequence of~\eqref{protocol_eq5} we are interested in can be deduced by tracing away the $K'$ system. By doing so we see that the joint random variable $S_n C_n$ is at least $\epsilon_n$-close in total variation norm to a pair $\widetilde{S}_n \widetilde{C}_n$ of independent random variables such that $\widetilde{S}_n$ is uniformly distributed over an alphabet of size $2^{\ceil{Rn}}$. We deduce that
\begin{equation}
\begin{aligned}
I(S_n:C_n) &= H(S_n) - H(S_n|C_n) \\
&\textleq{8} H\big(\widetilde{S}_n\big) - H(S_n|C_n) \\
&\texteq{9} H\big(\widetilde{S}_n \big| \widetilde{C}_n\big) - H(S_n|C_n) \\
&\textleq{10} \frac{\epsilon_n}{2} \log_2 \left(2^{\ceil{Rn}}-1\right) + h_2\left(\frac{\epsilon_n}{2}\right) \\
&\leq \frac{\epsilon_n}{2} \ceil{Rn} + h_2\left(\frac{\epsilon_n}{2}\right) .
\end{aligned}
\label{protocol_eq11}
\end{equation}
The above derivation is justified as follows: in~8 we observed that $H\big(\widetilde{S}_n\big)=\ceil{Rn} \geq H(S_n)$; in~9 we used the fact that $\widetilde{S}_n$ and $\widetilde{C}_n$ are independent; finally, in~10 we exploited the asymptotic continuity of the conditional entropy~\cite{Alicki-Fannes, tightuniform, Alhejji2019, Mark2020}.

Combining~\eqref{protocol_eq7}--\eqref{protocol_eq11} yields the bound
\begin{equation}
\ceil{Rn} < 2\epsilon_n \ceil{Rn} + 2\, h_2\left( \frac{\epsilon_n}{2} \right) + h_2(\epsilon_n) + M\left( \left(\gamma_{AE}^{\oplus n}+\Gamma_{E^n}\right)\Big/\left(\gamma_E^{\oplus n}+\Gamma_{E^n}\right) \right) .
\label{protocol_eq12}
\end{equation}
Since this holds for all pure QCMs $\Gamma_{E^n}$, we can optimise the bound by taking the infimum of the last addend over $\Gamma_{E^n}$. Note that
\begin{equation}
\begin{aligned}
\inf_{\text{$\Gamma_{E^n}$ pure QCM}} M\left( \left(\gamma_{AE}^{\oplus n}+\Gamma_{E^n}\right)\Big/\left(\gamma_E^{\oplus n}+\Gamma_{E^n}\right) \right) &\texteq{11} \frac12\, \inf_{\text{$\Gamma_{E^n}$ pure QCM}} I_M\left(A^n:B^n\right)_{\left(\gamma_{ABE}^{\oplus n}+\Gamma_{E^n}\right)\big/\left(\gamma_E^{\oplus n}+\Gamma_{E^n}\right)} \\
&\texteq{12} E_{F,2}^\G\left(V_{AB}^{\oplus n}\right) \\
&\texteq{13} n\, E_{F,2}^\G\left(V_{AB}\right) .
\end{aligned}
\label{protocol_eq13}
\end{equation}
Here, 11~is a consequence of~\eqref{IM pure}, while 12~is an application of the non-trivial fact that the R\'enyi-$2$ Gaussian entanglement of formation coincides with the R\'enyi-2 Gaussian squashed entanglement for all Gaussian states~\cite[Theorem~5 and Remark~2]{LL-log-det} (cf.~\eqref{reof = sq}; remember that $\gamma_{ABE}$ is a purification of $V_{AB}$). Finally, 13~follows from the recently established additivity of the R\'enyi-2 Gaussian entanglement of formation~\cite[Corollary~1]{LL-log-det}.

Therefore, optimising~\eqref{protocol_eq12} over pure QCMs $\Gamma_{E^n}$ and using~\eqref{protocol_eq13} yields
\begin{equation}
\ceil{Rn} < 2\epsilon_n \ceil{Rn} + 2\, h_2\left( \frac{\epsilon_n}{2} \right) + h_2(\epsilon_n) + n\, E_{F,2}^\G\left(V_{AB}\right) .
\label{protocol_eq14}
\end{equation}
Diving by $n$, taking the limit $n\to\infty$ and using the continuity of the binary entropy together with the fact that $\epsilon_n\tendsn{}0$ finally gives that
\begin{equation}
R < E_{F,2}^\G(V_{AB})\, .
\label{protocol_eq15}
\end{equation}
Taking the supremum over achievable rates $R$, we then see that
\begin{equation}
\widetilde{K}^\mathrm{\scriptscriptstyle \, G}_\to \left( V_{AB} \right) \leq E_{F,2}^\G (V_{AB})\, ,
\label{protocol_eq16}
\end{equation}
which together with~\eqref{K_tilde_ub} proves~\eqref{KG_ub}.

It remains to prove~\eqref{reof=KG_pure}. Fortunately, this is much easier to do: indeed, it suffices to exhibit a protocol that starting with an arbitrary number of copies of a pure QCM $\gamma_{AB}$ achieves a secret key distillation rate that is arbitrarily close to $M(\gamma_A)$. To do this, fix $\epsilon>0$, and apply Lemma~\ref{classical_mutual_info_pure_lemma} to select two Gaussian measurements with seeds $\Gamma_A$ and $\Gamma_B$ such that
\begin{equation}
I_M(A:B)_{\gamma_{AB}+\Gamma_A\oplus \Gamma_B} \geq M(\gamma_A) - \frac{\epsilon}{3}\, .
\label{protocol_eq17}
\end{equation}
Calling $X$ and $Y$ the outcomes of those measurements, we know that $I(X:Y) = I_M(A:B)_{\gamma_{AB}+\Gamma_A\oplus \Gamma_B}$. Hence, $I(X:Y)\geq M(\gamma_A)-\frac{\epsilon}{3}$ also holds. If Alice and Bob carry out the aforementioned Gaussian measurements separately on every single copy of $\gamma_{AB}$ they share, by applying the above procedure they obtain $n$ independent copies of the jointly Gaussian random variables $X$ and $Y$. Now, let Alice and Bob `bin' the continuous variables $X$ and $Y$ so as to obtain discrete random variables $X'$ and $Y'$ with the property that $I(X':Y') \geq I(X:Y) - \epsilon/3 \geq M(\gamma_A) - 2\epsilon/3$. This is known to be possible~\cite{Kraskov2004}, and indeed can be verified by elementary means, e.g.\ exploiting the uniform continuity of Gaussian distributions.

At this point, we can use a special case of a result proved by Maurer~\cite[Theorem~4]{Maurer1994} (see also previous works by Maurer himself~\cite{Maurer1993} as well as Ahlswede and Csiszar~\cite[Proposition~1]{AhlswedeCsiszar1}), and later generalised to the classical-quantum case in the fundamental work by Devetak and Winter~\cite[Theorem~1]{devetak2005}. For the case where Eve has no prior information, it states that the secret key distillation rate that one can achieve from i.i.d.\ copies of a correlated pair $(X',Y')$ of discrete random variables by means of one-way public communication\footnote{Actually, Maurer's result~\cite[Theorem~4]{Maurer1994} as stated holds for two-way public communication. However, a quick glance at the proof reveals that the two bounds in~\cite[Eq.~(10)]{Maurer1994} require only one-way communication --- either from Alice to Bob or vice versa. Devetak and Winter are more explicit in clarifying that they only need one-way communication~\cite{devetak2005}.} coincides with the mutual information $I(X':Y')$.\footnote{Remember that in our case the variable $Z$, representing Eve's prior information, is absent. Then our claim follows by combining Theorem~4 and the unnumbered equation above~(10) in Maurer's paper~\cite{Maurer1994}.}

To show that we can indeed apply Maurer's achievability result, we need to verify that his security criterion is stronger than ours. Writing out everything for the case where Eve has no prior information, a side-by-side comparison of the two security criteria is as follows:
\begin{align}
&\text{Maurer~\cite[Definition~2]{Maurer1994}:} &\Pr\{S\neq S'\}\leq \epsilon\, ,\quad I(S:C)\leq \epsilon\, ,\quad H(S) \geq \ceil{Rn} - \epsilon\, . \label{Maurer's security criterion} \\[2ex] &\text{Us (Definition~\ref{SK_rate_def}):} &\inf_{Q_C} \left\| P_{SS'C} - \frac{\delta_{SS'}}{2^{\ceil{Rn}}} \otimes Q_C \right\|_1\leq \epsilon'\, .  \label{our security criterion}
\end{align}
Here, $|S|$ is the size of the alphabet of $S$, and $\delta_{SS'}/N$ is the perfectly correlated uniform distribution of size $N$. We now verify that~\eqref{Maurer's security criterion} implies~\eqref{our security criterion} for some $\epsilon'$ universally related to $\epsilon$. For the sake of simplicity, we write out the argument in the case where the random variable $C$ ranges over a discrete alphabet. We have that
\begin{align*}
\inf_{Q_C} \left\| P_{SS'C} - \frac{\delta_{SS'}}{2^{\ceil{Rn}}} \otimes Q_C \right\|_1 &\leq \left\| P_{SS'C} - \frac{\delta_{SS'}}{2^{\ceil{Rn}}} \otimes P_C \right\|_1 \\
&= \sum_{s,s',c} \left| P_{SS'C}(s,s',c) - \frac{\delta_{s,s'}}{2^{\ceil{Rn}}} P_C(c) \right| \\
&= \sum_{s\neq s',\, c} P_{SS'C}(s,s',c) + \sum_{s,c} \left| P_{SS'C}(s,c) - \frac{\delta_{s,s'}}{2^{\ceil{Rn}}} P_C(c) \right| \\
&= \Pr\{S\neq S'\} + \sum_{s,c} \left| P_{SS'C}(s,c) - \frac{1}{2^{\ceil{Rn}}} P_C(c) \right| \\
&\leq \Pr\{S\neq S'\} + \sum_{s,c} \left| P_{SS'C}(s,s,c) - P_{SC}(s,c)\right| + \sum_{s,c} \left| P_{SC}(s,c) - P_S(s) P_C(c)\right| \\
&\qquad + \sum_{s,c} \left| P_S(s) P_C(c) - \frac{1}{2^{\ceil{Rn}}} P_C(c) \right| \\
&= 2 \Pr\{S\neq S'\} + \left\| P_{SC} - P_S\otimes P_C\right\|_1 + \left\|P_S - \frac{\mathds{1}}{2^{\ceil{Rn}}}\right\|_1 \\
&\leq 2 \Pr\{S\neq S'\} + \sqrt{2\ln 2 \, I(S:C)} + \sqrt{2\ln 2\left( \ceil{Rn} - H(S)\right)} \\
&\leq 2 \left( \epsilon + \sqrt{2\ln 2\, \epsilon}\right) .
\end{align*}
Here, in the second to last line we applied twice Pinsker's inequality~\cite{Pinsker, Csiszar1967, Kullback1967}, while the last line follows directly from~\eqref{Maurer's security criterion}.

The above argument shows that $I(X':Y')$ is indeed the supremum of all achievable secret key rates for the random variables $(X',Y')$. Therefore, any rate of the form $I(X':Y')-\epsilon/3\geq M(\gamma_A)-\epsilon$ is achievable. Since this holds for an arbitrary $\epsilon>0$, we see that in fact
\begin{equation}
M(\gamma_A) \geq \sup \left\{ \text{$R$: $R$ is an achievable rate} \right\} = K^{\G}_\to (\gamma_{AB})\, .
\label{protocol_eq18}
\end{equation}
Together with~\eqref{KG_ub}, this establishes~\eqref{reof=KG_pure} and concludes the proof.
\end{proof}

\begin{rem}
In the last part of the above proof, we could have equally well leveraged the result of Devetak and Winter instead of that by Maurer.
Verifying that their security criterion is stronger than ours is elementary, and has already been observed e.g.\ by Christandl et al.~\cite{Christandl2007}.
\end{rem}

\section{Secret key distillation with GLOPC: proof of Theorem~\ref{KW_ub_thm}}

We now turn to the proof of Theorem~\ref{KW_ub_thm}, which establishes an upper bound on the amount of secret key that can be extracted from a Gaussian state by means of Gaussian local operations and two-way public communication in terms of \emph{twice} the R\'enyi-$2$ Gaussian entanglement of formation.

\begin{manualthm}{\ref{KW_ub_thm}}
For all QCMs $V_{AB}$, it holds that
\begin{equation}
K^{\G}_\leftrightarrow (V_{AB}) \leq \widetilde{K}_\leftrightarrow^\mathrm{\scriptscriptstyle \, G}(V_{AB}) \leq 2 E_{F,2}^\G(V_{AB})\, .
\tag{\ref{KW_ub}}
\end{equation}
\end{manualthm}

\begin{proof}[Proof of Theorem~\ref{KW_ub_thm}]
The first inequality follows as usual from the case $\mathcal{P}=\mathrm{GLOPC}$ of Lemma~\eqref{K_tilde_ub_lemma}. To establish the second one, consider as usual a sequence of GLOPC protocols $\Lambda_n: A^n B^n \to \pazocal{K}_n \pazocal{K}'_n \pazocal{C}_n$ with rate $R$ as in Definition~\ref{modified_SK_rate_def}. Pick numbers $\epsilon_n>0$ such that~\eqref{protocol_eq5} and~\eqref{protocol_eq6} hold, consider an arbitrary sequence of QCMs $\Gamma_{E^n}$, and define the QCM $\tau_{A^nB^n}$ by~\eqref{protocol_eq7}.

Similarly to what we saw in the proof of Theorem~\ref{KG_ub_thm}, since the global input state is Gaussian and all measurements, ancillary states, and unitaries are Gaussian, the whole protocol can be simulated by a purely classical process. The input of this simulation is the pair of correlated random variables $\left(W_{A^n}, W_{B^n}\right)$, whose joint distribution coincides with the Wigner function of $\rho_\mathrm{\scriptscriptstyle \, G}\left[\tau_{A^nB^n},\, 0 \right]$. Let $S_n,S'_n$ be the pair of keys generated by Alice and Bob, and let $C_n$ the messages exchanged. By a result of Maurer, we have that~\cite[Theorem~1]{Maurer1993}
\begin{equation}
H(S_n) \leq I\left(W_{A^n} \!: W_{B^n}\right) + H(S_n|S'_n) + I\left(S_n:C_n\right) .
\label{KW_ub_proof_eq1}
\end{equation}
Employing~\eqref{Wigner_entropy_Gaussian} we see immediately that
\begin{equation}
\begin{aligned}
I\left(W_{A^n} \!: W_{B^n}\right) &= H(W_{A^n}) + H(W_{B^n}) - H(W_{A^n}W_{B^n}) \\
&= M(\tau_{A^n}) + nm_A \log_2(\pi e) + M(\tau_{B^n}) + nm_B \log_2(\pi e) - M(\tau_{A^nB^n}) - n(m_A+m_B)\log_2(\pi e) \\
&= M(\tau_{A^n}) + M(\tau_{B^n}) - M(\tau_{A^nB^n}) \\
&= 2M(\tau_{A^n}) \, ,
\end{aligned}
\label{KW_ub_proof_eq2}
\end{equation}
where the last identity follows because thanks to Lemma~\ref{elementary_pure_G_lemma} we know that $\tau_{A^nB^n}$ is a pure QCM. Plugging~\eqref{KW_ub_proof_eq2},~\eqref{protocol_eq9},~\eqref{protocol_eq10}, and~\eqref{protocol_eq11} inside~\eqref{KW_ub_proof_eq1} yields
\begin{equation}
\ceil{Rn} < 2\epsilon_n \ceil{Rn} + 2\, h_2\left( \frac{\epsilon_n}{2} \right) + h_2(\epsilon_n) + 2\, M\left( \left(\gamma_{AE}^{\oplus n}+\Gamma_{E^n}\right)\Big/\left(\gamma_E^{\oplus n}+\Gamma_{E^n}\right) \right) ,
\end{equation}
and in turn
\begin{equation}
\ceil{Rn} < 2\epsilon_n \ceil{Rn} + 2\, h_2\left( \frac{\epsilon_n}{2} \right) + h_2(\epsilon_n) + 2n\, E_{F,2}^\G(V_{AB})
\end{equation}
upon taking the infimum over $\Gamma_{E^n}$ as in~\eqref{protocol_eq13}. Diving by $n$ and taking the limit for $n\to\infty$ gives
\begin{equation}
R < 2 E_{F,2}^\G(V_{AB})\, ,
\end{equation}
and then
\begin{equation}
\widetilde{K}^\mathrm{\scriptscriptstyle \, G}_\leftrightarrow \left( V_{AB} \right) \leq 2 E_{F,2}^\G (V_{AB})
\end{equation}
upon an optimisation over all achievable rates $R$.
\end{proof}

\section{Secret key distillation with GLMPC: proof of Theorem~\ref{KGM_ub_thm}}

Throughout this section we present a complete proof of Theorem~\ref{KGM_ub_thm} from the main text. We start by recalling some useful notions.

\subsection{Intrinsic information}

The argument in the proof below is very close in spirit to those proposed by Maurer~\cite{Maurer1993}, Ahlswede and Csiszar~\cite{AhlswedeCsiszar1}, and Maurer and Wolf~\cite{MaurerWolf} to upper bound the secret key capacity of a tripartite probability distribution. In the latter two papers, in particular, the notion of \textbf{intrinsic information} was introduced and discussed at length (see~\cite[Theorem~1]{AhlswedeCsiszar1} and~\cite[\S~II]{MaurerWolf}). For a triple of random variables $(X,Y,Z)$, this is defined by
\begin{equation}
I(X:Y\downarrow Z) \mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = \inf_{Z\to Z'} I\left( X:Y|Z' \right) ,
\label{intrinsic}
\end{equation}
where the infimum is over all channels transforming $Z$ into $Z'$. Among the most notable properties of this object is the fact that it upper bounds the secret key rate of the triple $(X,Y,Z)$, in formula
\begin{equation}
S(X:Y \,\|\, Z)\leq I(X:Y \downarrow Z)\, .
\label{intrinsic_ub_K}
\end{equation}
Since Maurer already proved that the conditional mutual information $I(X:Y|Z)$ is an upper bound on the secret key rate of the triple~\cite[Theorem~2]{Maurer1993}, the bound in~\eqref{intrinsic_ub_K} --- first established by Ahlswede and Csiszar~\cite[Theorem~1]{AhlswedeCsiszar1} and later found by Maurer and Wolf as well~\cite[Theorem~2]{MaurerWolf} --- follows by optimising over all channels on Eve's side and noticing that none of them can ever decrease the secret key rate. Renner and Wolf showed that~\eqref{intrinsic_ub_K} is not tight in general~\cite{RennerWolf}, and together with Christandl they proved that the infimum in~\eqref{intrinsic} can be restricted to variables $Z'$ with the same range as that of $Z$, provided that this is finite~\cite{Christandl2003-proceedings}. The intrinsic information has been conjectured to bear a direct operational meaning as the secret key rate in the so-called `public Eve' scenario~\cite{ChristandlRenner}.

The concept of intrinsic information proved to be a very fruitful one. It played an important role in the study of quantum entanglement from a cryptographic perspective~\cite{GisinRennerWolf2002, Christandl2007, Curty04, Moroder06} and inspired the construction of many entanglement measures~\cite{GisinRennerWolf2002, Christandl-Master, Christandl2007}, most notably the \emph{squashed entanglement}~\cite{Tucci1999, squashed, Christandl2005, faithful, Takeoka14b}. In turn, progress on the quantum front inspired the investigation of new questions in the purely classical setting. These include the notion of `information of formation'~\cite{Gisin1999, GisinWolf, GisinRennerWolf2002, VV2005, ChitambarHsiehVV} and the existence of bound information~\cite{GisinWolf,GisinRennerWolf2001,GisinRennerWolf2002}.

\subsection{Proof of Theorem~\ref{KGM_ub_thm}}

We are now ready to re-state and prove Theorem~\ref{KGM_ub_thm} from the main text.

\begin{manualthm}{\ref{KGM_ub_thm}}
For all QCMs $V_{AB}$, it holds that
\begin{equation}
K^{\G,\mathrm{\scriptscriptstyle\, M}}_\leftrightarrow (V_{AB}) \leq E^{\G,\infty}_\downarrow(V_{AB}) \leq E_{F,2}^\G(V_{AB})
\tag{\ref{KGM_ub}}
\end{equation}
and moreover
\begin{equation}
E^\G_\downarrow(V_{AB}) \leq E_{F,2}^\G(V_{AB})\, .
\tag{\ref{gie_ub_reof}}
\end{equation}
\end{manualthm}

\begin{proof}[Proof of Theorem~\ref{KGM_ub_thm}]
We start by proving the first inequality in~\eqref{KGM_ub}. Let Alice, Bob and Eve start with $n$ copies of the pure Gaussian state with QCM $\gamma_{ABE}$, so that the global QCM reads $\gamma_{ABE}^{\oplus n}$. Consider a sequence of GLMPC protocols $\Lambda_n: A^n B^n \to \pazocal{K}_n \pazocal{K}'_n \pazocal{C}_n$ such that
\begin{equation}
\inf_{\omega_{\pazocal{C}_n E^n}} \left\| \Lambda_n \left( \rho_\mathrm{\scriptscriptstyle \, G}\left[\gamma_{ABE}^{\otimes n}, 0\right] \right) - \left(\kappa_{2^{\ceil{Rn}}} \right)_{\pazocal{K}_n \pazocal{K}'_n} \otimes \omega_{\pazocal{C}_n E^n} \right\|_1 < \epsilon_n\, , \qquad
\lim_{n\to\infty} \epsilon_n = 0
\label{KGM_ub_proof_eq1}
\end{equation}
for some rate $R>0$, as per Definition~\ref{SK_rate_def}. According to Definition~\ref{GLMPC_def}, the GLMPC protocol $\Lambda_n$ can be decomposed as
\begin{equation}
\Lambda_n = \Lambda^c_n\circ \left( \pazocal{M}_{\Gamma_{A^n}}^\mathrm{\scriptscriptstyle \, G} \otimes \pazocal{M}_{\Gamma_{B^n}}^\mathrm{\scriptscriptstyle \, G} \right) ,
\label{KGM_ub_proof_eq2}
\end{equation}
where $\pazocal{M}_{\Gamma_{A^n}}^\mathrm{\scriptscriptstyle \, G}$ and $\pazocal{M}_{\Gamma_{B^n}}^\mathrm{\scriptscriptstyle \, G}$ are complete destructive Gaussian measurements with seeds $\Gamma_{A^n}$ and $\Gamma_{B^n}$ on Alice's and Bob's side, respectively, and $\Lambda^c_n$ is a classical protocol involving only local operations and public communication. For a formal representation of the quantum--classical channels $\pazocal{M}_{\Gamma_{A^n}}^\mathrm{\scriptscriptstyle \, G}, \pazocal{M}_{\Gamma_{B^n}}^\mathrm{\scriptscriptstyle \, G}$, see~\eqref{G_meas_channel}.

Now, consider an arbitrary Gaussian measurement $\pazocal{M}_{\Gamma_{E^n}}^\mathrm{\scriptscriptstyle \, G}$ with seed $\Gamma_{E^n}$ on Eve's subsystem; denote the corresponding output alphabet with $\pazocal{Z}_n = \mathds{R}^{2nm_E}$. Employing first the data processing inequality for the trace norm and then~\eqref{KGM_ub_proof_eq2} yields
\begin{equation}
\begin{aligned}
\epsilon_n &> \inf_{\omega_{\pazocal{C}_n E^n}} \left\| \Lambda_n \left( \rho_\mathrm{\scriptscriptstyle \, G}\left[\gamma_{ABE}^{\otimes n}, 0\right] \right) - \left(\kappa_{2^{\ceil{Rn}}} \right)_{\pazocal{K}_n \pazocal{K}'_n} \otimes \omega_{\pazocal{C}_n E^n} \right\|_1 \\
&\geq \inf_{Q_{\pazocal{C}_n \pazocal{Z}_n}} \sup_{\Gamma_{E^n}} \left\| \left(\Lambda_n \otimes \pazocal{M}_{\Gamma_{E^n}}^\mathrm{\scriptscriptstyle \, G} \right) \left( \rho_\mathrm{\scriptscriptstyle \, G}\left[\gamma_{ABE}^{\otimes n}, 0\right] \right) - \left(\kappa_{2^{\ceil{Rn}}} \right)_{\pazocal{K}_n \pazocal{K}'_n} \otimes Q_{\pazocal{C}_n \pazocal{Z}_n} \right\|_1 \\
&= \inf_{Q_{\pazocal{C}_n \pazocal{Z}_n}} \sup_{\Gamma_{E^n}} \left\| \Lambda_n^c\left(\left(\pazocal{M}_{\Gamma_{A^n}}^\mathrm{\scriptscriptstyle \, G} \otimes \pazocal{M}_{\Gamma_{B^n}}^\mathrm{\scriptscriptstyle \, G} \otimes \pazocal{M}_{\Gamma_{E^n}}^\mathrm{\scriptscriptstyle \, G} \right) \left( \rho_\mathrm{\scriptscriptstyle \, G}\left[\gamma_{ABE}^{\otimes n}, 0\right] \right)\right) - \left(\kappa_{2^{\ceil{Rn}}} \right)_{\pazocal{K}_n \pazocal{K}'_n} \otimes Q_{\pazocal{C}_n \pazocal{Z}_n} \right\|_1\, .
\end{aligned}
\label{KGM_ub_proof_eq3}
\end{equation}

Now, the probability distribution $\left(\pazocal{M}_{\Gamma_{A^n}}^\mathrm{\scriptscriptstyle \, G} \otimes \pazocal{M}_{\Gamma_{B^n}}^\mathrm{\scriptscriptstyle \, G} \otimes \pazocal{M}_{\Gamma_{E^n}}^\mathrm{\scriptscriptstyle \, G} \right) \left( \rho_\mathrm{\scriptscriptstyle \, G}\left[\gamma_{ABE}^{\otimes n}, 0\right] \right)$ defines a triple of random variables $X_n,Y_n,Z_n$. Denoting with $C_n$ the message exchanged during the execution of $\Lambda_n^c$ and with $S_n,S'_n$ the locally generated secret keys, the celebrated result of Maurer~\cite[Theorem~1]{Maurer1993} that we have already used multiple times states that
\begin{equation}
H(S_n) \leq I(X_n:Y_n|Z_n) + H(S_n|S'_n) + I(S_n:C_n Z_n)\, .
\label{KGM_ub_proof_eq4}
\end{equation}
It is now an elementary exercise to verify that analogous conditions to~\eqref{protocol_eq9}--\eqref{protocol_eq11} apply to our case. The only one which needs a very slight modification is~\eqref{protocol_eq11}. Construct the triple of random variables $\widetilde{S}_n, \widetilde{C}_n, \widetilde{Z}_n$ such that: $\widetilde{S}_n$ and $\widetilde{C}_n, \widetilde{Z}_n$ are independent; $\widetilde{S}_n$ is uniformly distributed over $\left\{1,\ldots, 2^{\ceil{Rn}}\right\}$; and $\widetilde{C}_n, \widetilde{Z}_n$ has probability distribution $Q_{\pazocal{C}_n \pazocal{Z}_n}$, where
\begin{equation}
\left\| \Lambda_n^c\left(\left(\pazocal{M}_{\Gamma_{A^n}}^\mathrm{\scriptscriptstyle \, G} \otimes \pazocal{M}_{\Gamma_{B^n}}^\mathrm{\scriptscriptstyle \, G} \otimes \pazocal{M}_{\Gamma_{E^n}}^\mathrm{\scriptscriptstyle \, G} \right) \left( \rho_\mathrm{\scriptscriptstyle \, G}\left[\gamma_{ABE}^{\otimes n}, 0\right] \right)\right) - \left(\kappa_{2^{\ceil{Rn}}} \right)_{\pazocal{K}_n \pazocal{K}'_n} \otimes Q_{\pazocal{C}_n \pazocal{Z}_n} \right\|_1 \leq \epsilon_n\, .
\end{equation}
Then,
\begin{equation}
\begin{aligned}
I(S_n:C_n Z_n) &= H(S_n) - H(S_n|C_n Z_n) \\
&\leq H\big(\widetilde{S}_n\big) - H(S_n|C_nZ_n) \\
&= H\big(\widetilde{S}_n \big| \widetilde{C}_n \widetilde{Z}_n \big) - H(S_n|C_nZ_n) \\
&\leq \frac{\epsilon_n}{2} \log_2 \left(2^{\ceil{Rn}}-1\right) + h_2\left(\frac{\epsilon_n}{2}\right) \\
&\leq \frac{\epsilon_n}{2} \ceil{Rn} + h_2\left(\frac{\epsilon_n}{2}\right) .
\end{aligned}
\label{KGM_ub_proof_eq5}
\end{equation}
Also, observe that
\begin{equation}
I(X_n:Y_n|Z_n) = I_M \left(A^n : B^n \big| E^n \right)_{\gamma_{ABE}^{\oplus n} + \Gamma_{A^n}\oplus \Gamma_{B^n}\oplus \Gamma_{E^n}}
\label{daje_adapted}
\end{equation}
by~\eqref{daje}. Plugging~\eqref{protocol_eq10},~\eqref{daje_adapted},~\eqref{protocol_eq9}, and~\eqref{KGM_ub_proof_eq5} inside~\eqref{KGM_ub_proof_eq4} yields
\begin{equation}
\ceil{Rn} < 2\epsilon_n \ceil{Rn} + 2\, h_2\left( \frac{\epsilon_n}{2} \right) + h_2(\epsilon_n) + I_M \left(A^n : B^n \big| E^n \right)_{\gamma_{ABE}^{\oplus n} + \Gamma_{A^n}\oplus \Gamma_{B^n}\oplus \Gamma_{E^n}} \, .
\end{equation}
Since this holds for all QCMs $\Gamma_{E^n}$,
\begin{equation}
\ceil{Rn} < 2\epsilon_n \ceil{Rn} + 2\, h_2\left( \frac{\epsilon_n}{2} \right) + h_2(\epsilon_n) + \inf_{\Gamma_{E^n}} I_M \big(A^n : B^n \big| E^n \big)_{\gamma_{ABE}^{\oplus n} + \Gamma_{A^n}\oplus \Gamma_{B^n}\oplus \Gamma_{E^n}} \, .
\label{KGM_ub_proof_eq6}
\end{equation}
Taking a further supremum on $\Gamma_{A^n}, \Gamma_{B^n}$ and remembering the definition of the Gaussian intrinsic entanglement~\eqref{gie_SM} gives
\begin{equation}
\ceil{Rn} < 2\epsilon_n \ceil{Rn} + 2\, h_2\left( \frac{\epsilon_n}{2} \right) + h_2(\epsilon_n) + E^\G_\downarrow\left(\gamma_{ABE}^{\oplus n}\right) .
\label{KGM_ub_proof_eq7}
\end{equation}
Dividing by $n$ and taking the liminf for $n\to\infty$ produces
\begin{equation}
R < E^{\G,\infty}_\downarrow\left(V_{AB}\right) .
\label{KGM_ub_proof_eq8}
\end{equation}
Since this holds for all achievable rates $R$, we also obtain that
\begin{equation}
K^{\G,\mathrm{\scriptscriptstyle\, M}}_\leftrightarrow (V_{AB}) \leq E^{\G,\infty}_\downarrow(V_{AB})\, ,
\label{KGM_ub_proof_eq9}
\end{equation}
which proves the first inequality in~\eqref{KGM_ub}.

We now move on to the proof of~\eqref{gie_ub_reof}. To start off, we massage the expression~\eqref{gie_SM} thanks to~\eqref{IM_conditional_Schur}, obtaining
\begin{equation}
E^\G_\downarrow(V_{AB}) = \sup_{\Gamma_A, \Gamma_B} \inf_{\Gamma_E} I_M\left(A:B\right)_{(\gamma_{ABE} + \Gamma_E)/(\gamma_E + \Gamma_E) + \Gamma_A\oplus \Gamma_B}\, .
\label{gie massaged}
\end{equation}
Before we proceed further, let us define one more quantity via a slight modification of~\eqref{gie massaged}. More precisely, we set
\begin{equation}
\widetilde{E}^\G_\downarrow(V_{AB}) \mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = \inf_{\text{$\Gamma_E$ pure}}\, \sup_{\Gamma_A,\Gamma_B} I_M(A:B)_{(\gamma_{ABE} + \Gamma_E)/(\gamma_E + \Gamma_E) + \Gamma_A\oplus \Gamma_B}\, .
\label{gie tilde}
\end{equation}
Let us show that $E^\G_\downarrow(V_{AB}) \leq \widetilde{E}^\G_\downarrow(V_{AB})$. We have that
\begin{equation}
\begin{aligned}
E^\G_\downarrow \left( V_{AB}\right) &\textleq{1} \sup_{\Gamma_A, \Gamma_B} \inf_{\text{$\Gamma_E$ pure}} I_M(A:B)_{(\gamma_{ABE} + \Gamma_E)/(\gamma_E + \Gamma_E) + \Gamma_A\oplus \Gamma_B} \\
&\textleq{2} \inf_{\text{$\Gamma_E$ pure}} \sup_{\Gamma_A, \Gamma_B} I_M(A:B)_{(\gamma_{ABE} + \Gamma_E)/(\gamma_E + \Gamma_E) + \Gamma_A\oplus \Gamma_B} \\
&= \widetilde{E}^\G_\downarrow(V_{AB})\, .
\end{aligned}
\label{KGM_ub_proof_eq10}
\end{equation}
Here, in~1 we restricted the infimum in~\eqref{gie massaged} to pure QCMs $\Gamma_{\!E}$, while in~2 we exchanged supremum and infimum according to the max-min inequality $\sup_{x\in \pazocal{X}}\inf_{y\in \pazocal{Y}}f(x,y)\leq \inf_{y\in \pazocal{Y}} \sup_{x\in \pazocal{X}} f(x,y)$~\cite{BOYD}. We now show that in fact $\widetilde{E}^\G_\downarrow(V_{AB}) = E_{F,2}^\G (V_{AB})$ holds:
\begin{equation}
\begin{aligned}
\widetilde{E}^\G_\downarrow(V_{AB}) &\texteq{3} \inf_{\text{$\Gamma_E$ pure}} I_M^c(A:B)_{(\gamma_{ABE} + \Gamma_E)/(\gamma_E + \Gamma_E)} \\
&\texteq{4} \frac12 \inf_{\text{$\Gamma_E$ pure}}\ I_M (A:B)_{(\gamma_{ABE} + \Gamma_E)/(\gamma_E + \Gamma_E)} \\
&\texteq{5} \frac12 \inf_{\text{$\Gamma_E$ pure}}\ I_M (A:B|E)_{\gamma_{ABE} + \Gamma_E} \\
&\texteq{6} E_{F,2}^\G( V_{AB}) .
\end{aligned}
\label{KGM_ub_proof_eq11}
\end{equation}
In~3 we recalled the definition~\eqref{IMc}, in~4 we used~\eqref{IMc pure states}, in~5 we exploited~\eqref{IM_conditional_Schur}, and finally in~6 we leveraged a recently established result on the equality between R\'enyi-$2$ Gaussian squashed entanglement and R\'enyi-$2$ Gaussian entanglement of formation~\cite[Theorem~5 and especially Remark~2]{LL-log-det}.

We have therefore established~\eqref{gie_ub_reof}. Applying it to the QCM $V_{AB}^{\oplus n}$ and taking the liminf for $n\to\infty$ yields
\begin{equation}
E^{\G,\infty}_\downarrow(V_{AB}) = \liminf_{n\to\infty} \frac1n E^\G_\downarrow \left( V_{AB}^{\oplus n}\right) \leq \liminf_{n\to\infty} \frac1n E_{F,2}^\G \left( V_{AB}^{\oplus n}\right) = E_{F,2}^\G(V_{AB})\, ,
\end{equation}
where the last identity is a consequence of the additivity~\eqref{reof additivity} of the R\'enyi-$2$ Gaussian entanglement of formation. This establishes the second inequality in~\eqref{KGM_ub} and concludes the proof.
\end{proof}

\begin{rem}
The upper bound on $K^{\G,\mathrm{\scriptscriptstyle\, M}}_\leftrightarrow$ provided by Lemma~\ref{K_tilde_ub_lemma} would lead straight to the inequality $K^{\G,\mathrm{\scriptscriptstyle\, M}}\leq E_{F,2}^\G$. However, this is a priori less tight than the estimate $K^{\G,\mathrm{\scriptscriptstyle\, M}}_\leftrightarrow \leq E^{\G,\infty}_\downarrow$ established in Theorem~\ref{KGM_ub_thm}. This discrepancy is due to the type of constraints we impose on Eve's action: in Lemma~\ref{K_tilde_ub_lemma} we assumed that she performs a destructive Gaussian measurement at the very beginning of the protocol, subsequently broadcasting the obtained outcome to Alice and Bob; in Theorem~\ref{KGM_ub_thm}, instead, we assumed that \emph{first} Alice and Bob make their destructive Gaussian measurements, and \emph{then} Eve makes hers, keeping the outcome secret.
\end{rem}

\section{Equality between the Gaussian intrinsic entanglement and the R\'enyi-2 Gaussian entanglement of formation: proof of Theorem~\ref{equality normal thm}}

Throughout this section we present a complete proof of Theorem~\ref{equality normal thm}. Before we do that, we need to have a closer look at the log-determinant mutual information defined in~\eqref{IM}.

\subsection{Some properties of the log-determinant mutual information} \label{sec properties IM}

Here we summarise the known properties of the log-determinant mutual information~\eqref{IM} and establish some new ones --- such as a type of uniform continuity --- that will play an important role in the proof of Theorem~\ref{equality normal thm}. A list of basic properties is as follows.
\begin{enumerate}[(i)]
\item Invariance under local symplectics: for all pairs of symplectic matrices $S_A, S_B$, it holds that
\begin{equation}
I_M(A:B)_{(S_A\oplus S_B)\, V_{AB}\, (S_A^\intercal \oplus S_B^\intercal)} \equiv I_M(A:B)_{V_{AB}}\, .
\label{IM invariance symplectics}
\end{equation}
\item Invariance under rescaling: whenever $t>0$, we have that
\begin{equation}
I_M(A:B)_{V} \equiv I_M(A:B)_{tV} \, .
\label{IM invariance rescaling}
\end{equation}
\item Data processing inequality: for every positive semidefinite matrix $K_A\geq 0$ on system $A$, it holds that
\begin{equation}
I_M(A:B)_{V_{AB} + K_A} \leq I_M(A:B)_{V_{AB}}\, ,
\label{data processing}
\end{equation}
where $K_A$ is a shorthand for $K_A\oplus 0_B$. This is clear if one thinks of $I_M(A\!:\!B)_V$ as the Shannon mutual information of a Gaussian random variable with covariance matrix $V$. Adding a local positive semidefinite matrix corresponds to adding an independent and normal local random variable.
\item For every pure QCM $\gamma_{AB}$, it holds that
\begin{equation}
I_M(A:B)_\gamma = 2M(\gamma_A)=2M(\gamma_B)\, .
\label{IM pure}
\end{equation}
This follows trivially from the fact that the local reduced states corresponding to the pure Gaussian state with QCM $\gamma_{AB}$ have the same R\'enyi-$2$ entropies, and moreover $M(\gamma_{AB})=0$ as $\det \gamma_{AB}=1$.
\item For all positive matrices $V>0$, it holds that~\cite[Eq.~(29)]{LL-log-det}
\begin{equation}
I_M(A:B)_V = I_M(A:B)_{V^{-1}}\, .
\label{IM inversion}
\end{equation}
\end{enumerate}

We now explore some further properties of the log-determinant mutual information~\eqref{IM}. Consider a bipartite QCM $V_{AB}$, and define
\begin{align}
V_{AB}^x &\mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = \Pi_{AB}^x V_{AB} (\Pi_{AB}^x)^\intercal\, , \label{x_proj} \\
V_{AB}^p &\mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = \Pi_{AB}^p V_{AB} (\Pi_{AB}^p)^\intercal\, . \label{p_proj}
\end{align}
Since $V_{AB}^x$ and $V_{AB}^p$ are principal submatrices of $V_{AB}$, we can take Schur complements with respect to them. Also, since they still retain formally a block form with respect to the partition $A|B$, we can also compute their log-determinant mutual information, which we denote for instance by $I_M(A_x\!:\!B_x)_{V_{AB}^x}$. With this notation in mind, we start by showing the following.

\begin{lemma} \label{I M decomposition xp lemma}
For all bipartite QCMs $V_{AB}$, the log-determinant mutual information admits the decomposition
\begin{equation}
I_M(A:B)_{V_{AB}} = I_M(A_x:B_x)_{V_{AB}^x} + I_M(A_p:B_p)_{V_{AB}/V_{AB}^x}\, .
\label{I M decomposition xp}
\end{equation}
\end{lemma}

\begin{proof}
It suffices to apply repeatedly the Schur determinant factorisation formula~\eqref{det fact}
\begin{align*}
I_M(A:B)_{V_{AB}} &= \frac12 \log_2 \frac{(\det V_A) (\det V_B)}{\det V_{AB}} \\
&= \frac12 \log_2 \frac{(\det V_{A}^x) (\det V_A/V_A^x) (\det V_B^x) (\det V_B/V_B^x)}{(\det V_{AB}^x) (\det V_{AB}/V_{AB}^x)} \\
&= \frac12 \log_2 \frac{(\det V_{A}^x) (\det V_B^x) }{(\det V_{AB}^x)} + \frac12 \log_2 \frac{(\det V_A/V_A^x) (\det V_B/V_B^x)}{ (\det V_{AB}/V_{AB}^x)} \\
&= I_M(A_x:B_x)_{V_{AB}^x} + I_M(A_p:B_p)_{V_{AB}/V_{AB}^x}\, .
\end{align*}
This concludes the proof.
\end{proof}

\begin{cor} \label{pure_xp_IM_cor}
Let $\gamma_{AB}$ be a pure QCM in $xp$-form, i.e.\ let it be as in~\eqref{pure in xp form}. Then
\begin{equation}
I_M(A_x:B_x)_{\gamma_{AB}^x} = I_M(A_p:B_p)_{\gamma_{AB}^p} = \frac12 I_M(A:B)_{\gamma_{AB}} = M(\gamma_A) \, .
\label{pure_xp_IM}
\end{equation}
\end{cor}

\begin{proof}
Remembering~\eqref{pure in xp form} and~\eqref{IM inversion}, we see that
\begin{equation*}
I_M(A_x:B_x)_{\gamma_{AB}^x} = I_M(A_p:B_p)_{\left(\gamma_{AB}^p\right)^{-1}} = I_M(A_p:B_p)_{\gamma_{AB}^p}\, .
\end{equation*}
Also, since $\gamma_{AB}$ has no off-diagonal terms, it holds that $\gamma_{AB}/\gamma_{AB}^x = \gamma_{AB}^p$. Combining this with~\eqref{I M decomposition xp} and~\eqref{IM pure} yields
\begin{equation*}
2M(\gamma_A) = I_M(A:B)_{\gamma_{AB}} = I_M(A_x:B_x)_{\gamma_{AB}^x} + I_M(A_p:B_p)_{\gamma_{AB}^p} = 2 I_M(A_x:B_x)_{\gamma_{AB}^x}\, ,
\end{equation*}
completing the proof.
\end{proof}

\begin{lemma}[(Uniform continuity of log-determinant mutual information)] \label{continuity mutual information lemma}
Let $\kappa\geq 1$, and consider two matrices $V_{AB},W_{AB}$ such that $V_{AB},W_{AB}\geq \kappa^{-1} \mathds{1}_{AB}$. Then it holds that
\begin{equation}
\left| I_M(A:B)_V - I_M(A:B)_W\right| \leq \kappa \log_2(e)\,\|V_{AB} - W_{AB}\|_1\, ,
\label{continuity mutual information}
\end{equation}
where $\|\cdot\|_1$ denotes the trace norm.
\end{lemma}

\begin{proof}
Let us start by proving that for any two matrices $M,N\geq \kappa^{-1} \mathds{1}$, it holds that
\begin{equation}
\left|\log_2 \det (MN^{-1})\right| \leq \kappa \log_2(e)\, \|M-N\|_1\, .
\label{inequality M,N}
\end{equation}
To see this, we write
\begin{align*}
\left|\log_2 \det (MN^{-1})\right| &= \left|\log_2 \det (M) - \log_2 \det (N)\right| \\
&\texteq{1} \left|\sum\nolimits_i \left(\log_2 \mu_i - \log_2 \nu_i\right)\right| \\
&\leq \sum\nolimits_i \left|\log_2 \mu_i - \log_2 \nu_i\right| \\
&\textleq{2} \kappa \log_2(e)\, \sum\nolimits_i |\mu_i - \nu_i| \\
&\textleq{3} \kappa \log_2(e)\, \|M-N\|_1\, .
\end{align*}
Here, in~1 we called $\mu_i,\nu_i$ the eigenvalues of $M,N$, sorted in descending order. To justify~2, instead, start by applying Lagrange's theorem to a continuously differentiable function $f:[a,b]\to \mathds{R}$:
\begin{equation*}
\frac{\left|f(\mu)-f(\nu)\right|}{|\mu-\nu|} \leq \max_{a\leq \xi\leq b} \left| f'(\xi)\right| .
\end{equation*}
Setting $f(x)= \log_2 x$, $a=\kappa^{-1}$, and $b=\infty$, we obtain the desired inequality $\left|\log_2 \mu_i - \log_2 \nu_i\right| \leq \kappa \log_2(e)\, |\mu_i - \nu_i|$. Finally, in~3 we used the well-known estimate $\|M-N\|_1\geq \sum\nolimits_i |\mu_i-\nu_i|$, which is due to Mirsky~\cite[Theorem~5]{Mirsky1960} (see also~\cite[Eq.~(IV.62)]{BHATIA-MATRIX}).

We now come to the proof of~\eqref{continuity mutual information}:
\begin{align*}
\left| I_M(A:B)_V - I_M(A:B)_W\right| &= \left| \frac12 \log_2 \frac{\det(V_A) \det (V_B)}{\det (V_{AB})} - \frac12 \log_2 \frac{\det(W_A) \det (W_B)}{\det (W_{AB})} \right| \\[1ex]
&= \left| \frac12 \log_2 \det\left(V_AW_A^{-1}\right) + \frac12 \log_2 \det \left(V_BW_B^{-1}\right) - \frac12 \log_2 \det \left(V_{AB}W_{AB}^{-1}\right) \right| \\[1ex]
&\textleq{3} \frac{\kappa \log_2(e)}{2} \left( \|V_A-W_A\|_1 + \|V_B-W_B\|_1 + \|V_{AB} - W_{AB}\|_1\right) \\[1ex]
&\textleq{4} \kappa \log_2(e)\, \left\|V_{AB} - W_{AB}\right\|_1\, .
\end{align*}
Here,~3 comes from inequality~\eqref{inequality M,N} applied to $M=V_A, V_B, V_{AB}$ and $N=W_A,W_B, W_{AB}$, respectively. Note that under the operation of taking principal submatrices the minimal eigenvalue never decreases, hence $V_A, W_A\geq \kappa^{-1}\mathds{1}_{A}$ and $V_B, W_B\geq \kappa^{-1} \mathds{1}_{B}$. Finally,~4 descends from the observation that since the `pinching' operation that maps $V_{AB}\mapsto V_A\oplus V_B$ and $W_{AB}\mapsto W_A\oplus W_B$ is a quantum channel, it never increases the trace norm, and hence
\begin{equation*}
\left\| V_{AB} - W_{AB}\right\|_1\geq \left\| V_A\oplus V_B - W_A\oplus W_B\right\|_1 = \| V_A-W_A\|_1 + \| V_B - W_B\|_1\, .
\end{equation*}
This concludes the proof.
\end{proof}

\subsection{Classical mutual information of pure states in the Gaussian setting}

For the sake of completeness, here we present a simple justification of the known fact~\cite{giedkemode, Lada2011, GIE-PRA} that in the Gaussian setting the classical mutual information of Gaussian pure states coincides with the local R\'enyi-$2$ entropy, as claimed in~\eqref{IMc pure states}.

\begin{lemma} \label{classical_mutual_info_pure_lemma}
For all pure QCMs $\gamma_{AB}$, it holds that $I^c_M(A:B)_\gamma = \frac12 I_M(A:B)_\gamma = M(\gamma_A)$. Moreover, if $\gamma_{AB}$ is in $xp$-form, the optimal Gaussian measurements in~\eqref{IMc} are identical homodynes.
\end{lemma}

\begin{proof}
Start by employing~\eqref{data processing} to deduce that
\begin{equation*}
I_M(A:B)_{\gamma_{AB} + \Gamma_A\oplus \Gamma_B}\leq I_M(A:B)_{\gamma_{AB} + \Gamma_B}\, ,
\end{equation*}
for all $\Gamma_A\geq 0$. Using the determinant factorisation formula~\eqref{det fact}, it is not difficult to show that
\begin{equation*}
I_M(A:B)_{\gamma_{AB} + \Gamma_B} = M(\gamma_A) - M\left( (\gamma_{AB} + \Gamma_B) / (\gamma_B + \Gamma_B) \right) \leq M(\gamma_A)\, ,
\end{equation*}
where the last inequality follows because $(\gamma_{AB} + \Gamma_B) / (\gamma_B + \Gamma_B)$ is a QCM by Lemma~\ref{elementary_pure_G_lemma}, and hence the corresponding log-determinant entropy must be non-negative. Consequently, one obtains that $I_M(A:B)_{\gamma_{AB} + \Gamma_A \oplus \Gamma_B} \leq M(\gamma_A)$. Since $\Gamma_A, \Gamma_B$ were arbitrary, we conclude that
\begin{equation}
I_M^c(A:B)_{\gamma} \leq M(\gamma_A)\, ,
\end{equation}
To prove the converse inequality, we can use the normality of pure QCMs (Lemma~\ref{pure are normal}) to find local symplectics $S_A,S_B$ such that
\begin{equation}
\gamma_{AB} = (S_A\oplus S_B)\, \gamma_{AB}^{(0)}\, (S_A\oplus S_B)^\intercal\, ,
\end{equation}
where $\gamma_{AB}^{(0)}$ is in $xp$-form. Observe that because of~\eqref{pure in xp form} we have that $\gamma_{AB}^{(0)} = \left(\begin{smallmatrix} Q & 0 \\ 0 & Q^{-1} \end{smallmatrix}\right)$ with respect to an $xp$ block partition, where $Q>0$. Obviously, if $\gamma$ is in $xp$-form we can set $S_A=\mathds{1}_A$ and $S_B=\mathds{1}_B$ in the first place. Now, construct
\begin{align*}
\widetilde{\Gamma}_A(t) &= S_{A} \Gamma_A(t) S_{A}^\intercal\, ,\\
\widetilde{\Gamma}_B(t) &= S_{B} \Gamma_B(t) S_{B}^\intercal\, ,
\end{align*}
where $\Gamma_A(t), \Gamma_B(t)$ are the seeds of a homodyne as given by~\eqref{seeds homodyne}. With respect to an $xp$ block partition, one has that
\begin{equation*}
\gamma_{AB}^{(0)} = \begin{pmatrix} Q+ t\mathds{1} & 0 \\ 0 & Q^{-1}+t^{-1}\mathds{1} \end{pmatrix} ,
\end{equation*}
and hence that
\begin{align*}
\lim_{t\rightarrow \infty} I_M(A:B)_{\gamma_{AB} + \widetilde{\Gamma}_A (t) \oplus \widetilde{\Gamma}_B (t)} &\texteq{1} \lim_{t\rightarrow \infty} I_M(A:B)_{\gamma_{AB}^{(0)} + \Gamma_A (t) \oplus \Gamma_B (t)} \\
&\texteq{2} \lim_{t\rightarrow \infty} \left( I_M(A_x:B_x)_{Q+t\mathds{1}} + I_M(A_p:B_p)_{Q^{-1}+t^{-1}\mathds{1}} \right) \\
&\texteq{3} \lim_{t\rightarrow \infty} \left( I_M(A_x:B_x)_{Q+t\mathds{1}} + I_M(A_p:B_p)_{\mathds{1}+tQ^{-1}} \right) \\
&\texteq{4} I_M(A_x:B_x)_Q \\
&\texteq{5} M\big(\gamma^{(0)}_A\big) \\
&= M(\gamma_A)\, .
\end{align*}
The above identities can be justified as follows: 1~descends from~\eqref{IM invariance symplectics}; 2~is an application of~\eqref{I M decomposition xp}; 3~uses the identity~\eqref{IM invariance rescaling}; 4~comes from Lemma~\ref{continuity mutual information lemma}, which implies that
\begin{equation*}
I_M(A_p:B_p)_{\mathds{1} + t Q^{-1}} = \left| I_M(A_p:B_p)_{\mathds{1} + t Q^{-1}}- I_M(A:B)_\mathds{1}\right| \leq t \log_2(e)\, \|Q^{-1}\|_1 \tends{}{t\to\infty} 0
\end{equation*}
and that
\begin{equation*}
\left| I_M(A_p:B_p)_{Q + t \mathds{1}} - I_M(A_p:B_p)_Q\right| \leq t \log_2(e)\, \|\mathds{1}_p\|_1 \|Q^{-1}\|_1 \tends{}{t\to\infty} 0\, ;
\end{equation*}
finally, 5~is a consequence of Corollary~\ref{pure_xp_IM_cor}.
\end{proof}

\subsection{A few more technical lemmata}

Before we present a rigorous proof of Theorem~\ref{equality normal thm}, we need to establish a couple of technical lemmata.

\begin{lemma} \label{measured QCMs compact}
Let $V_{AB}$ be any bipartite QCM, and let $\gamma_{ABE}$ be any extension of it, i.e.\ let it satisfy $\gamma_{AB}=V_{AB}$. For some QCM $\Gamma_E$, define
\begin{equation}
W_{AB} \mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = \left( \gamma_{ABE} + \Gamma_E\right) \big/ \left(\gamma_{E} +\Gamma_E\right) .
\end{equation}
Then
\begin{equation}
\lambda_{\max}(V_{AB})^{-1} \mathds{1}_{AB} \leq \Omega_{AB}^\intercal V_{AB}^{-1} \Omega_{AB} \leq W_{AB}\leq V_{AB} \, ,
\end{equation}
where $\lambda_{\max}(V_{AB})$ denotes the maximal eigenvalue of $V_{AB}$.
\end{lemma}

\begin{proof}
The very definition of Schur complement implies that $W_{AB}\leq \gamma_{AB} = V_{AB}$. As for the opposite inequality, since $\Gamma_{\!E}\geq 0$ is positive semidefinite and the Schur complement is monotonic~\eqref{Schur monotonicity}, one has that
\begin{equation*}
\left( \gamma_{ABE} + \Gamma_{\!E}\right) \big/ \left(\gamma_{E} +\Gamma_{\!E}\right) \geq \gamma_{ABE}/\gamma_{E} \geq \Omega_{AB}^\intercal \gamma_{AB}^{-1}\Omega_{AB} = \Omega_{AB}^\intercal V_{AB}^{-1}\Omega_{AB}\, ,
\end{equation*}
where the second inequality is an application of~\cite[Theorem~3]{Lami16}.
\end{proof}

\begin{prop} \label{homodyne limit prop}
Let $\Gamma_{\!A}(t)$ and $\Gamma_{\!B}(t)$ be the seeds of homodyne measurements defined by~\eqref{seeds homodyne}. For some $0<\kappa\leq 1$, let $\pazocal{W}_{AB} \geq \kappa^{-1} \mathds{1}_{AB}$ be a compact set of bipartite QCMs that is bounded away from zero \footnote{Here we mean that every element $W_{AB}\in \pazocal{W}_{AB}$ satisfies $W_{AB}\geq \kappa^{-1}\mathds{1}_{AB}$}. Then
\begin{equation}
\lim_{t\to 0^+} \inf_{W_{AB}\in \pazocal{W}_{AB}} I_M(A:B)_{W_{AB} + \Gamma_A(t)\oplus \Gamma_B(t)} = \inf_{W_{AB}\in \pazocal{W}_{AB}} I_M(A_x:B_x)_{W^x_{AB}}\, ,
\label{homodyne limit}
\end{equation}
where $W^x_{AB}$ is defined analogously to~\eqref{x_proj}.
\end{prop}

\begin{proof}
Let us define the functions $F_t:\pazocal{W}_{AB}\to \mathds{R}$ and $F:\pazocal{W}_{AB}\to \mathds{R}$ via
\begin{align}
F_t(W_{AB}) &\mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = I_M(A\!:\!B)_{W_{AB} + \Gamma_{\!A}(t)\oplus \Gamma_{\!B}(t)}\, , \label{F t} \\
F(W_{AB}) &\mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = I_M(A_x\!:\!B_x)_{W^x_{AB}}\, . \label{F}
\end{align}
Then~\eqref{homodyne limit} becomes
\begin{equation}
\lim_{t\to 0^+} \inf_{W_{AB}\in \pazocal{W}_{AB}} F_t(W_{AB}) = \inf_{W_{AB}\in \pazocal{W}_{AB}} F(W_{AB})\, .
\label{homodyne limit F}
\end{equation}
To prove~\eqref{homodyne limit F}, it suffices to show that $F_t \tends{u}{t\to 0^+} F$ \emph{uniformly}, i.e.\ that
\begin{equation}
\lim_{t\to 0^+} \|F_t - F\|_\infty = 0\, ,
\label{uniform convergence F t}
\end{equation}
where
\begin{align}
\|F_t - F\|_\infty \mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} =&\ \sup_{W_{AB}\in\pazocal{W}_{AB}} \left| F_t(W_{AB}) - F(W_{AB}) \right| \label{sup norm W 1}
\\
=&\ \sup_{W_{AB}\in\pazocal{W}_{AB}} \left| I_M(A\!:\!B)_{W_{AB} + \Gamma_{\!A}(t)\oplus \Gamma_{\!B}(t)} - I_M(A_x\!:\!B_x)_{W^x} \right| . \label{sup norm W 2}
\end{align}
The fact that~\eqref{uniform convergence F t} implies~\eqref{homodyne limit F} is well known, see for instance~\cite[Chapter~7]{RUDIN-PRINCIPLES}. We reproduce the argument here for the reader's convenience. One starts by observing that for all $W_{AB}\in \pazocal{W}_{AB}$ it holds that
\begin{equation*}
F(W_{AB}) - \|F_t - F\|_\infty \leq F_t(W_{AB}) \leq F(W_{AB}) + \|F_t - F\|_\infty\, .
\end{equation*}
Upon taking the infimum over $W_{AB}$, this entails that
\begin{equation*}
\inf_{W_{AB}\in \pazocal{W}_{AB}} F(W_{AB}) - \|F_t - F\|_\infty \leq \inf_{W_{AB}\in \pazocal{W}_{AB}} F_t(W_{AB}) \leq \inf_{W_{AB}\in \pazocal{W}_{AB}} F(W_{AB}) + \|F_t - F\|_\infty\, ,
\end{equation*}
i.e.\ that
\begin{equation*}
\left| \inf_{W_{AB}\in \pazocal{W}_{AB}} F(W_{AB}) - \inf_{W_{AB}\in \pazocal{W}_{AB}} F_t(W_{AB})\right| \leq \|F_t - F\|_\infty\, .
\end{equation*}
Therefore,~\eqref{uniform convergence F t} clearly implies~\eqref{homodyne limit F}.

We now proceed to prove~\eqref{uniform convergence F t}. Note that we are not in the position to apply Lemma~\ref{continuity mutual information lemma} on the continuity of mutual information, for example because the QCMs $W_{AB} + \Gamma_{\!A}(t)\oplus \Gamma_{\!B}(t)$ do not converge to anything as $t\to 0^+$, due to the presence of the diverging term $t^{-1}$ in~\eqref{seeds homodyne}. To proceed further, let us write down an explicit decomposition of an arbitrary matrix $W_{AB}\in\pazocal{W}_{AB}$ with respect to an $xp$ block partition as
\begin{equation}
W_{AB} = \begin{pmatrix} W_{AB}^x & Z_{AB} \\ Z_{AB}^\intercal & W_{AB}^p \end{pmatrix} .
\label{W AB blocks}
\end{equation}
Observe that according to the same splitting one has that
\begin{equation}
\Gamma_A(t) \oplus \Gamma_B(t) = \begin{pmatrix} t\, \mathds{1}_{AB}^x & 0 \\ 0 & t^{-1} \mathds{1}_{AB}^p \end{pmatrix} .
\label{seeds homodyne blocks}
\end{equation}
We now massage~\eqref{F t} as follows:
\begin{align*}
F_t(W_{AB}) &= I_M(A:B)_{W_{AB} + \Gamma_A(t)\oplus \Gamma_B(t)} \\
&\texteq{1} I_M(A_x:B_x)_{W_{AB}^x + \Gamma_{\!A}^x(t)\oplus \Gamma_B^x(t)} + I_M(A_p:B_p)_{\big(W_{AB} + \Gamma_A(t)\oplus \Gamma_B(t)\big)\big/ \big(W_{AB}^{x} + \Gamma_A^x(t)\oplus \Gamma_B^x(t)\big)} \\
&\texteq{2} I_M(A_x:B_x)_{W_{AB}^x + t\, \mathds{1}_{AB}^x} + I_M(A_p:B_p)_{W_{AB}^p + t^{-1} \mathds{1}_{AB}^p - Z_{AB}^\intercal \left(W_{AB}^x + t\, \mathds{1}_{AB}^x\right)^{-1} Z_{AB}} \\
&\texteq{3} I_M(A_x:B_x)_{W_{AB}^x + t\, \mathds{1}_{AB}^x} + I_M(A_p:B_p)_{\mathds{1}_{AB}^p + t\left( W_{AB}^p  - Z_{AB}^\intercal \left(W_{AB}^x + t\, \mathds{1}_{AB}^x\right)^{-1} Z_{AB}\right)}
\end{align*}
Note that in~1 we applied Lemma~\ref{I M decomposition xp lemma}, in~2 we made use of~\eqref{W AB blocks} and~\eqref{seeds homodyne blocks}, and in~3 we employed~\eqref{IM invariance rescaling}.
Now, we see that
\begin{align*}
\left| F_t(W_{AB}) - F(W_{AB})\right| &\textleq{4} \left| I_M(A_x:B_x)_{W_{AB}^x + t\, \mathds{1}_{AB}^x} - I_M(A_x:B_x)_{W_{AB}^x} \right| \\
&\quad + \left| I_M(A_p:B_p)_{\mathds{1}_{AB}^p + t\left( W_{AB}^p  - Z_{AB}^\intercal \left(W_{AB}^x + t\, \mathds{1}_{AB}^x\right)^{-1} Z_{AB}\right)} - I_M(A_p:B_p)_{\mathds{1}_{AB}^p}\right| \\
&\textleq{5} \kappa \log_2(e) \left\|W_{AB}^x + t\, \mathds{1}_{AB}^x - W_{AB}^x \right\|_1 \\
&\quad + \log_2(e) \left\| \mathds{1}_{AB}^p + t\left( W_{AB}^p  - Z_{AB}^\intercal \left(W_{AB}^x + t\, \mathds{1}_{AB}^x\right)^{-1} Z_{AB}\right) - \mathds{1}_{AB}^p\right\|_1 \\
&\texteq{6} t \log_2(e) \left(\kappa (m_A+m_B) + \max_{W_{AB} \in \pazocal{W}_{AB}} \Tr \left[W_{AB}^p\right]\right) .
\end{align*}
Note that the inequality in~4 comes directly from the definitions~\eqref{F t} and~\eqref{F}, together with the observation that $I_M(A_p\!:\!B_p)_{\mathds{1}_{AB}^p}=0$. For~5, instead, we applied Lemma~\ref{continuity mutual information lemma} twice, which is possible because: (i)~$W_{AB}\geq \kappa^{-1}\mathds{1}_{AB}$ and hence $W_{AB}^x\geq \kappa^{-1}\mathds{1}_{AB}^x$ (also, $t>0$); and (ii)~from the block positivity conditions~\eqref{Schur block positivity} for $W_{AB}+t\, \mathds{1}_{AB}$ it follows that
\begin{equation*}
W_{AB}^p  - Z_{AB}^\intercal \left(W_{AB}^x + t\, \mathds{1}_{AB}^x\right)^{-1} Z_{AB} = (W_{AB} + t\,\mathds{1}_{AB}^x) \big/ (W_{AB}^x + t\, \mathds{1}_{AB}^x) > 0\, .
\end{equation*}
To justify~6, note that exploiting again positivity one has that
\begin{equation*}
\left\| (W_{AB} + t\,\mathds{1}_{AB}^x) \big/ (W_{AB}^x + t\, \mathds{1}_{AB}^x)\right\|_1 = \Tr\left[(W_{AB} + t\,\mathds{1}_{AB}^x) \big/ (W_{AB}^x + t\, \mathds{1}_{AB}^x)\right] \leq \Tr[W_{AB}^p]\, .
\end{equation*}
The quantity $\max_{W_{AB} \in \pazocal{W}_{AB}} \Tr \left[W_{AB}^p\right]$ is finite thanks to the compactness of $\pazocal{W}_{AB}$. Also, we denoted with $m_A$ and $m_B$ the number of modes on systems $A$ and $B$, respectively. From the above estimate it is clear that $\lim_{t\to 0^+} \sup_{W_{AB} \in \pazocal{W}_{AB}} \left| F_t(W_{AB}) - F(W_{AB})\right| = 0$, completing the argument.
\end{proof}

\subsection{Proof of Theorem~\ref{equality normal thm}}

We are finally ready to present the complete proof of Theorem~\ref{equality normal thm}.

\begin{manualthm}{\ref{equality normal thm}}
For a normal QCM $V_{AB}$, it holds that
\begin{equation}
E^{\G,\infty}_\downarrow( V_{AB} ) = E^\G_\downarrow( V_{AB} ) = E_{F,2}^\G (V_{AB}) .
\tag{\ref{equality normal}}
\end{equation}
In particular,~\eqref{equality normal} holds for all two-mode QCMs.
\end{manualthm}

\begin{proof}[Proof of Theorem~\ref{equality normal thm}]
In the proof of Theorem~\ref{KGM_ub_thm}, and more precisely in~\eqref{gie tilde}, we introduced an auxiliary quantity $\widetilde{E}^\G_\downarrow$. In~\eqref{KGM_ub_proof_eq10} and~\eqref{KGM_ub_proof_eq11} we also showed that $E^\G_\downarrow\leq \widetilde{E}^\G_\downarrow = E_{F,2}^\G$ on all QCMs.
We now prove that the opposite inequality $E^\G_\downarrow (V_{AB})\geq \widetilde{E}^\G_\downarrow (V_{AB})$ holds as well, at least for normal QCMs $V_{AB}$.

Since $V_{AB}$ is normal and both $E^\G_\downarrow$ and $\widetilde{E}^\G_\downarrow$ are invariant under local symplectics, we can assume directly that $V_{AB}=\left(\begin{smallmatrix} Q & 0 \\ 0 & P \end{smallmatrix}\right)$ is in $xp$-form~\eqref{V xp}. Using Lemma~\ref{xp form Williamson lemma}, we construct a symplectic matrix
\begin{equation}
S_{AB} = \begin{pmatrix} M^{-1} & 0 \\ 0 & M^\intercal \end{pmatrix} ,
\label{SAB blocks}
\end{equation}
here written with respect to an $xp$ block partition, such that
\begin{equation}
S_{AB} V_{AB} S_{AB}^\intercal = \Lambda_{AB} = \begin{pmatrix} D & 0 \\ 0 & D \end{pmatrix} ,
\label{Williamson VAB normal}
\end{equation}
again with respect to the same partition. This is useful because we can now construct very conveniently a purification $\gamma_{ABE}$ of $V_{AB}$:
\begin{equation}
\gamma_{ABE} = (S_{AB}\oplus \mathds{1}_E) \,\gamma_{ABE}^{(0)}\, (S_{AB}\oplus \mathds{1}_E)^\intercal\, .
\label{gamma ABE 1}
\end{equation}
Here, with respect to an $AB|E$ block partition we have that
\begin{equation}
\gamma_{ABE}^{(0)} = \begin{pmatrix} \Lambda & \sqrt{\Lambda^2-\mathds{1}}\, \Sigma \\ \sqrt{\Lambda^2-\mathds{1}}\, \Sigma & \Lambda \end{pmatrix} .
\label{gamma ABE 2}
\end{equation}
where $\Sigma\mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = (\Pi^x)^\intercal \Pi^x - (\Pi^p)^\intercal \Pi^p $. An important observation to make is that $\gamma_{ABE}^{(0)}$, $S_{AB}$, and hence also $\gamma_{ABE}$ are all in $xp$-form.

Let us now go back to the sought inequality $E^\G_\downarrow (V_{AB})\geq \widetilde{E}^\G_\downarrow (V_{AB})$. Since the left-hand side is defined by a supremum over Gaussian measurements, parametrised by $\Gamma_A, \Gamma_B$, we estimate it as
\begin{equation}
\begin{aligned}
E^\G_\downarrow (V_{AB}) &\texteq{1} \sup_{\Gamma_A, \Gamma_B} \inf_{\Gamma_E} I_M \left(A:B\right)_{(\gamma_{ABE} + \Gamma_E)/(\gamma_E + \Gamma_E) + \Gamma_A\oplus \Gamma_B} \\
&\textgeq{2} \lim_{t\to\infty} \inf_{\Gamma_E} I_M\left(A:B\right)_{(\gamma_{ABE} + \Gamma_E)/(\gamma_E + \Gamma_E) + \Gamma_A(t) \oplus \Gamma_B(t)} \\
&\texteq{3} \inf_{\Gamma_E} I_M\left(A_x:B_x\right)_{((\gamma_{ABE} + \Gamma_E)/(\gamma_{E} + \Gamma_E))^x}\, .
\end{aligned}
\label{intermediate_lb_gie}
\end{equation}
In the above derivation, the equality in~1 is simply~\eqref{gie massaged}, the inequality in~2 follows by choosing $\Gamma_A(t), \Gamma_B(t)$ as defined in~\eqref{seeds homodyne}, and the inequality in~3, which is the real technical hurdle here, follows by combining Lemma~\ref{measured QCMs compact} and Proposition~\ref{homodyne limit prop}.

We now look at the set of matrices $((\gamma_{ABE} + \Gamma_E)/(\gamma_E + \Gamma_E))^x$, where $\Gamma_E$ is an \emph{arbitrary} QCM on $E$, not necessarily in $xp$-form. With respect to an $xp$ block partition, let us parametrise it as
\begin{equation}
\Gamma_E = \begin{pmatrix} K & J \\ J^\intercal & L \end{pmatrix} .
\label{Gamma E blocks}
\end{equation}
We now compute:
\begin{align*}
((\gamma_{ABE} + \Gamma_E)/(\gamma_E + \Gamma_E))^x &= \Pi^x \big((\gamma_{ABE} + \Gamma_E)/(\gamma_E + \Gamma_E)\big) (\Pi^x)^\intercal \\[0.5ex]
&\texteq{4} \Pi^x (S_{AB}\oplus \mathds{1}_E) \left(\big(\gamma_{ABE}^{(0)} + \Gamma_E\big)\big/\big(\gamma_E^{(0)} + \Gamma_E\big)\right) (S_{AB}\oplus \mathds{1}_E)^\intercal (\Pi^x)^\intercal \\[0.5ex]
&\texteq{5} M^{-1} \Pi^x \left(\big(\gamma_{ABE}^{(0)} + \Gamma_E\big)\big/\big(\gamma_E^{(0)} + \Gamma_E\big)\right) (\Pi^x)^\intercal M^{-\intercal} \\[0.5ex]
&\texteq{6} M^{-1} \Pi^x \left( \Lambda - \sqrt{\Lambda^2-\mathds{1}}\, \Sigma\, (\Lambda+\Gamma_E)^{-1} \Sigma\, \sqrt{\Lambda^2-\mathds{1}} \right) (\Pi^x)^\intercal M^{-\intercal} \\[0.5ex]
&\texteq{7} M^{-1} \left( D - \sqrt{D^2-\mathds{1}}\, \Pi^x\, (\Lambda+\Gamma_E)^{-1} (\Pi^x)^\intercal\, \sqrt{D^2-\mathds{1}} \right) M^{-\intercal} \\[0.5ex]
&\texteq{8} M^{-1} \left( D - \sqrt{D^2-\mathds{1}} \left( K + D - J (L+D)^{-1} J^\intercal \right)^{-1} \sqrt{D^2-\mathds{1}} \right) M^{-\intercal}\, .
\end{align*}
The justification of the above derivation is as follows. 4: We made use of~\eqref{gamma ABE 1} and of the covariance property~\eqref{Schur covariance}. 5: We applied~\eqref{SAB blocks}. 6: We computed the Schur complement with the help of~\eqref{gamma ABE 2}. 7: We used the fact that $\Lambda$ and $\Sigma$ are all in $xp$-form. 8: We calculated
\begin{equation*}
(\Lambda+\Gamma_{\!E})^{-1} = \begin{pmatrix} D + K & J \\ J^\intercal & D + L \end{pmatrix}  = \begin{pmatrix} \left( K + D - J (L+D)^{-1} J^\intercal \right)^{-1} & * \\ * & * \end{pmatrix}
\end{equation*}
thanks to the block inversion formulae~\eqref{inv}. Here, the symbols $*$ indicate unspecified matrices of appropriate size.

By the above calculation, the function on the right-hand side of~\eqref{intermediate_lb_gie} depends only on the combination $K-J(L+D)^{-1}J^\intercal$, which is a rather special function of the free variable $\Gamma_E$. Now, on the one hand
\begin{equation*}
K-J(L+D)^{-1}J^\intercal = (\Gamma_E + 0\oplus D)/(L+D) \geq \Gamma_E/L >0\, ,
\end{equation*}
where we applied the monotonicity of Schur complements~\eqref{Schur monotonicity}, and then observed that $\Gamma_E/L>0$ follows from the block positivity conditions~\eqref{Schur block positivity}, once one remembers that $\Gamma_E>0$ as $\Gamma_E$ is a QCM. On the other hand, every positive definite matrix $T>0$ can be written as $T=K-J(L+D)^{-1}J^\intercal$ for some $K,J,L$ forming --- according to~\eqref{Gamma E blocks} --- a \emph{pure QCM $\Gamma_E$ in $xp$-form}. In fact, it suffices to set $K=T=L^{-1}$ and $J=0$; this makes the corresponding $\Gamma_E$ pure, as can be seen e.g.\ by comparing it with~\eqref{pure in xp form}, and clearly in $xp$-form. We have just proved that
\begin{equation}
\left\{ K-J(L+D)^{-1}J^\intercal:\, \Gamma_E\geq i\Omega_E \right\} = \left\{T:\, T>0\right\} = \left\{ K-J(L+D)^{-1}J^\intercal:\, \text{$\Gamma_E$ pure QCM in $xp$-form} \right\} ,
\end{equation}
which can be rephrased as
\begin{equation}
\left\{ ((\gamma_{ABE} + \Gamma_E)/(\gamma_E + \Gamma_E))^x:\, \Gamma_E\geq i\Omega_E \right\} = \left\{ ((\gamma_{ABE} + \Gamma_E)/(\gamma_{E} + \Gamma_E))^x:\, \text{$\Gamma_E$ pure QCM in $xp$-form} \right\} .
\label{crucial identity}
\end{equation}
We make use of this crucial fact to further massage the right-hand side of~\eqref{intermediate_lb_gie}, obtaining that
\begin{equation}
\begin{aligned}
E^\G_\downarrow (V_{AB}) &\geq\, \inf_{\Gamma_E} I_M\left(A_x:B_x\right)_{((\gamma_{ABE} + \Gamma_E)/(\gamma_E + \Gamma_E))^x} \\
&\texteq{9} \inf_{\substack{\\ \text{$\Gamma_E$ pure} \\ \text{in $xp$-form}}} I_M(A_x : B_x)_{((\gamma_{ABE} + \Gamma_E)/(\gamma_E + \Gamma_E))^x} \\
&\texteq{10} \frac12 \inf_{\substack{\\ \text{$\Gamma_E$ pure} \\ \text{in $xp$-form}}} I_M(A : B)_{(\gamma_{ABE} + \Gamma_E)/(\gamma_E + \Gamma_E)} \\
&\texteq{11} \inf_{\substack{\\ \text{$\Gamma_E$ pure} \\ \text{in $xp$-form}}} \sup_{\Gamma_A, \Gamma_B} I_M(A: B)_{(\gamma_{ABE} + \Gamma_E)/(\gamma_E + \Gamma_E) + \Gamma_A\oplus \Gamma_B} \\
&\textgeq{12} \inf_{\text{$\Gamma_E$ pure}} \sup_{\Gamma_A, \Gamma_B} I_M(A : B)_{(\gamma_{ABE} + \Gamma_E)/(\gamma_E + \Gamma_E) + \Gamma_A\oplus \Gamma_B} \\
&= \widetilde{E}^\G_\downarrow(V_{AB})\, .
\end{aligned}
\label{basically_done}
\end{equation}
Here: in~9 we used~\eqref{crucial identity}; in~10 we observed that both $\gamma_{ABE},\Gamma_E$, and hence also the pure QCM $(\gamma_{ABE} + \Gamma_E)/(\gamma_E + \Gamma_E)$, are in $xp$-form, which allowed us to apply Corollary~\ref{pure_xp_IM_cor}; in~11 we recalled~\eqref{IMc pure states}, and finally~12 follows elementarily from enlarging the set over which we compute the infimum. Combining the above inequality with~\eqref{KGM_ub_proof_eq10} and~\eqref{KGM_ub_proof_eq11} proves that $E^\G_\downarrow(V_{AB})=E_{F,2}^\G(V_{AB})$ for all normal QCMs $V_{AB}$.

To complete the proof, it suffices to observe that the direct sum $V_{AB}^{\oplus n}$ of normal matrices $V_{AB}$ is still normal. Hence,
\begin{equation*}
E^{\G,\infty}_\downarrow(V_{AB}) = \liminf_{n\to\infty} \frac1n E^\G_\downarrow\left( V_{AB}^{\oplus n} \right) = \liminf_{n\to\infty} \frac1n E_{F,2}^\G\left( V_{AB}^{\oplus n} \right) = E_{F,2}^\G(V_{AB})\, ,
\end{equation*}
where the last equality comes from~\eqref{reof additivity}. This concludes the proof.
\end{proof}

\subsection{Saddle-point property of the log-determinant conditional mutual information}

As a side remark, we now show that our proof of Theorem~\ref{equality normal thm} implies the following variant of the strong saddle-point property of the log-determinant conditional mutual information.

\begin{prop}[(Saddle-point property of log-determinant conditional mutual information)]
Let $V_{AB}$ be a normal QCM with purification $\gamma_{ABE}$. Then
\begin{equation*}
\inf_{\Gamma_E}\sup_{\Gamma_A, \Gamma_B} I_M\left(A:B|E\right)_{\gamma_{ABE} + \Gamma_A\oplus \Gamma_B\oplus \Gamma_E} = \sup_{\Gamma_A, \Gamma_B} \inf_{\Gamma_E} I_M\left(A:B|E\right)_{\gamma_{ABE} + \Gamma_A\oplus \Gamma_B\oplus \Gamma_E}\, .
\end{equation*}
\end{prop}

\begin{proof}
The left-hand side is obviously greater or equal to the right-hand one, owing to the max-min inequality $\sup_{x\in \pazocal{X}}\inf_{y\in \pazocal{Y}}f(x,y)\leq \inf_{y\in \pazocal{Y}} \sup_{x\in \pazocal{X}} f(x,y)$.
For the opposite inequality, let us write
\begin{align*}
    \sup_{\Gamma_A, \Gamma_B} \inf_{\Gamma_E} I_M\left(A:B|E\right)_{\gamma_{ABE} + \Gamma_A\oplus \Gamma_B\oplus \Gamma_E} &= E^\G_\downarrow(V_{AB}) \\
    &\textgeq{1} \widetilde{E}^\G_\downarrow(V_{AB}) \\
    &= \inf_{\text{$\Gamma_E$ pure}}\, \sup_{\Gamma_A,\Gamma_B} I_M(A:B)_{(\gamma_{ABE} + \Gamma_E)/(\gamma_E + \Gamma_E) + \Gamma_A\oplus \Gamma_B} \\
    &\textgeq{2} \inf_{\Gamma_E}\, \sup_{\Gamma_A,\Gamma_B} I_M(A:B)_{(\gamma_{ABE} + \Gamma_E)/(\gamma_E + \Gamma_E) + \Gamma_A\oplus \Gamma_B}
\end{align*}
Here, 1~follows from \eqref{basically_done}, while 2~can be deduced by noting that infimum has been enlarged. The proof is then complete.
\end{proof}

\subsection{A non-normal quantum covariance matrix} \label{sec non-normal}

The reader could wonder whether Definition~\ref{normal def} actually identifies a truly proper class of QCMs. Here we show that this is indeed the case. We do so by constructing an explicit example of a non-normal QCM over a $(1+2)$-mode system. Let us start by recalling a well-known result in symplectic geometry.

\begin{lemma}[{\cite[Proposition~8.12]{GOSSON}}] \label{Gosson lemma}
Let $A>0$ be a $2n\times 2n$ positive definite matrix. Let $S_1,S_2$ be two symplectic matrices that bring $A$ into Williamson's form, i.e.\ let them satisfy
\begin{equation}
A = S_1 \begin{pmatrix} D & 0 \\ 0 & D \end{pmatrix} S_1^\intercal = S_2 \begin{pmatrix} D & 0 \\ 0 & D \end{pmatrix} S_2^\intercal \, ,
\end{equation}
where $D = \sum_{j=1}^n d_j \ketbra{j} > 0$ is diagonal. Then
\begin{equation}
S_2=S_1K\, , \qquad K = H \begin{pmatrix} U & 0 \\ 0 & U^* \end{pmatrix} H^\dag \in \mathbb{K}(n)\, ,\qquad [U,D]=0\, .
\end{equation}
The last condition means that $U$ only mixes vectors $\ket{j}$ with the same coefficients $d_j$. If these are all distinct, then necessarily $U=\sum_j e^{i\theta_j} \ketbra{j}$ for some phases $\theta_j\in\mathds{R}$.
\end{lemma}

\begin{cor} \label{xp Williamson cor}
Let $D>0$ be an $n\times n$ diagonal matrix. A $2n\times 2n$ symplectic matrix $S$ is such that $S\left( \begin{smallmatrix} D & 0 \\ 0 & D \end{smallmatrix} \right) S^\intercal$ is in xp-form, i.e.
\begin{equation}
S \begin{pmatrix} D & 0 \\ 0 & D \end{pmatrix} S^\intercal = \begin{pmatrix} X & 0 \\ 0 & P \end{pmatrix} ,
\end{equation}
if and only if
\begin{equation}
S = \begin{pmatrix} M^{-1} & 0 \\ 0 & M^\intercal  \end{pmatrix} H \begin{pmatrix} U & 0 \\ 0 & U^* \end{pmatrix} H^\dag ,
\label{xp Williamson}
\end{equation}
where $M$ is an arbitrary $n\times n$ invertible matrix, $H$ is given by~\eqref{H}, and $[U,D]=0$.
\end{cor}

\begin{proof}
By Lemma~\ref{xp form Williamson lemma}, we can find an invertible matrix $M$ such that
\begin{equation*}
\begin{pmatrix} M & 0 \\ 0 & M^{-\intercal} \end{pmatrix} S \begin{pmatrix} D & 0 \\ 0 & D \end{pmatrix} S^\intercal \begin{pmatrix} M^{\intercal} & 0 \\ 0 & M^{-1} \end{pmatrix} = \begin{pmatrix} \widetilde{D} & 0 \\ 0 & \widetilde{D} \end{pmatrix} ,
\end{equation*}
where $M^{-\intercal}\mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = \big(M^{-1}\big)^\intercal$, and $\left( \begin{smallmatrix} M & 0 \\ 0 & M^{-\intercal} \end{smallmatrix} \right)$ is symplectic by~\eqref{GL isomorphism}. Thanks to the uniqueness of symplectic eigenvalues, we must have that $\widetilde{D}=D$, up to an immaterial permutation that can always be absorbed into $M$. We can then apply Lemma~\ref{Gosson lemma}, guaranteeing that
\begin{equation*}
\begin{pmatrix} M & 0 \\ 0 & M^{-\intercal} \end{pmatrix} S = H \begin{pmatrix} U & 0 \\ 0 & U^* \end{pmatrix} H^\dag\, ,
\end{equation*}
with $[U,D]=0$. Multiplying by $\left( \begin{smallmatrix} M^{-1} & 0 \\ 0 & M^{\intercal} \end{smallmatrix} \right)$ from the left proves~\eqref{xp Williamson}.
\end{proof}

\begin{prop}[(A family of non-normal QCMs)]
Consider a bipartite $3$-mode system composed by modes $A$ on one side and $B_1,B_2$ on the other. Construct the QCM
\begin{equation}
V_{AB}\mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = \begin{pmatrix} a\mathds{1} & F & G \\ F^\intercal & b_1\mathds{1} & 0 \\ G^\intercal & 0 & b_2\mathds{1} \end{pmatrix} ,
\end{equation}
where the first and second rows and columns refer to $A$, the third and fourth to $B_1$, and the fifth and sixth to $B_2$. Assume that $\|F\|_\infty,\|G\|_\infty\leq 1$, $a\geq 3$, and $b_1,b_2\geq 2$, so that $V_{AB}\geq \mathds{1}_{AB}$ is a valid QCM. Further assume that $b_1\neq b_2$ and that $\left[ FF^\intercal,GG^\intercal \right]\neq 0$. Then $V_{AB}$ is not normal.
\end{prop}

\begin{proof}
Assume by contradiction that
$(S_A\oplus S_B)\, V_{AB}\, (S_A\oplus S_B)^\intercal$ is in $xp$-form. Then there are scalars $x,p>0$ and $2\times 2$ matrices $X',P'>0$ such that
\begin{equation*}
S_A \begin{pmatrix} a & 0 \\ 0 & a \end{pmatrix} S_A^\intercal = \begin{pmatrix} x & 0 \\ 0 & p \end{pmatrix},\qquad S_B \begin{pmatrix} b_1 & 0 & 0 & 0 \\ 0 & b_2 & 0 & 0 \\ 0 & 0 & b_1 & 0 \\ 0 & 0 & 0 & b_2 \end{pmatrix} S_B^\intercal = \begin{pmatrix} X' & 0 \\ 0 & P' \end{pmatrix} .
\end{equation*}
If $b_1\neq b_2$, any unitary $U$ satisfying $\left[ U, \left( \begin{smallmatrix} b_1 & 0 \\ 0 & b_2 \end{smallmatrix}\right) \right]=0$ must be of the form $U = \left( \begin{smallmatrix} e^{i\theta_1} & 0 \\ 0 & e^{i\theta_2}\end{smallmatrix} \right)$. Hence, Corollary~\ref{xp Williamson cor} tells us that
\begin{align*}
S_A &= \begin{pmatrix} m^{-1} & 0 \\ 0 & m \end{pmatrix} H \begin{pmatrix} e^{i\varphi} & 0 \\ 0 & e^{-i\varphi} \end{pmatrix} H^\dag \\[1ex]
&= \begin{pmatrix} m^{-1} & 0 \\ 0 & m \end{pmatrix} \begin{pmatrix} \cos \varphi & \sin \varphi \\ -\sin\varphi & \cos\varphi \end{pmatrix} \\[1ex]
&= \begin{pmatrix} m^{-1} & 0 \\ 0 & m \end{pmatrix} R(\varphi)
\end{align*}
and
\begin{align*}
S_B &= \begin{pmatrix} N^{-1} & 0 \\ 0 & N^\intercal \end{pmatrix} H \begin{pmatrix} e^{i\theta_1} & 0 & 0 & 0 \\ 0 & e^{i\theta_2} & 0 & 0 \\ 0 & 0 & e^{-i\theta_1} & 0 \\ 0 & 0 & 0 & e^{-i\theta_2} \end{pmatrix} H^\dag \\[1ex]
&= \begin{pmatrix} N^{-1} & 0 \\ 0 & N^\intercal \end{pmatrix} \begin{pmatrix} \cos \theta_1 & 0 & \sin\theta_1 & 0 \\ 0 & \cos \theta_2 & 0 & \sin\theta_2 \\ -\sin\theta_1 & 0 & \cos\theta_1 & 0 \\ 0 & -\sin \theta_2 & 0 & \cos\theta_2 \end{pmatrix} \\[1ex]
&= \begin{pmatrix} N^{-1} & 0 \\ 0 & N^\intercal \end{pmatrix} (R_{B_1}(\theta_1) \oplus R_{B_2}(\theta_2))\, ,
\end{align*}
where $\varphi,\theta_1,\theta_2\in \mathds{R}$, $m\neq 0$, and $N$ is $2\times 2$ and invertible. In order for the $AB_1$ and $AB_2$ off-diagonal blocks to be brought into $xp$-form as well, we must also request that
\begin{equation*}
R(\varphi) F R_{B_1}(\theta_1)^\intercal = D_1\, ,\qquad R(\varphi) G R_{B_2}(\theta_2)^\intercal = D_2
\end{equation*}
be both diagonal. This would imply that
\begin{align*}
0 &= \left[D_1^2, D_2^2\right] \\
&= \left[ R(\varphi)FF^\intercal R(\varphi)^\intercal,\, R(\varphi)GG^\intercal R(\varphi)^\intercal\right] \\
&= R(\varphi) \left[ FF^\intercal,\, GG^\intercal \right] R(\varphi)^\intercal\, ,
\end{align*}
so that $\left[ FF^\intercal,\, GG^\intercal \right]=0$, contrary to the hypotheses.
\end{proof}

\section{Application: secret key from noisy two-mode squeezed states}

Throughout this section, we show how to apply our results to bound the amount of secret key that can be distilled from a class of two-mode Gaussian states by means of Gaussian local operations and public communication. The states we will look at are obtained by sending one half of a two-mode squeezed vacuum across a pure loss channel (a.k.a.\ a quantum-limited attenuator). We remind the reader that a two-mode squeezed vacuum is defined by
\begin{equation}
\begin{aligned}
\ket{\psi_s} &\mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = \frac{1}{\cosh(r_s)} \sum_{n=0}^\infty \tanh^n r_s \ket{nn}\, , \\
r_s &\mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = \frac{s \ln 10}{20}\, ,
\end{aligned}
\label{tmsv}
\end{equation}
where $s\geq 0$ is the squeezing intensity measured in $\si{\decibel}$, $r_s$ is the squeezing parameter, and $\ket{n}$ denotes the $n^{\text{th}}$ Fock state. Although it may not be immediately apparent,~\eqref{tmsv} is a Gaussian state with zero mean and QCM
\begin{equation}
\tau_s = \begin{pmatrix} \cosh (2r_s) & & \sinh (2r_s) & \\ & \cosh (2r_s) & & - \sinh (2r_s) \\ \sinh (2r_s) & & \cosh (2r_s) & \\ & - \sinh (2r_s) & & \cosh (2r_s) \end{pmatrix} = \begin{pmatrix} \cosh(2r_s) \mathds{1}_2 & \sinh(2r_s) \sigma_z \\ \sinh(2r_s) \sigma_z & \cosh(2r_s) \mathds{1}_2 \end{pmatrix} ,
\label{tmsv_QCM}
\end{equation}
where we chose a representation based on a mode-wise splitting, and the second expression is a block matrix, with $\sigma_z\mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = \left( \begin{smallmatrix} 1 & 0 \\ 0 & -1 \end{smallmatrix} \right)$ being the third Pauli matrix. Note that~\eqref{tmsv_QCM} is already in $xp$-form.

We now provide the reader with a self-contained review of Gaussian channels. For more details, we refer them to the excellent monograph by Serafini~\cite[\S~5.3]{BUCCO}. A \textbf{Gaussian channel} from an $m$-mode system to an $m'$-mode system is uniquely described by a pair of real matrices $X,Y$, such that $X$ is of size $2m'\times 2m$ and $Y$ is of size $2m'\times 2m'$, and the complete positivity condition
\begin{equation}
Y + i\Omega - i X \Omega X^\intercal \geq 0
\label{CP_G_channels}
\end{equation}
holds. In \eqref{CP_G_channels}, it is understood that the first symplectic form $\Omega$ is of size $2m'\times 2m'$, and the second of size $2m \times 2m$. In the simplest case $m=m'=1$, using the fact that $M\Omega M^\intercal = (\det M) \Omega$ for all $2\times 2$ matrices $M$ one can show that~\eqref{CP_G_channels} reduces to
\begin{equation}
\sqrt{\det Y} \geq \left| 1-\det X\right| .
\label{CP_G_channels_single_mode}
\end{equation}
The action of a general Gaussian channel $\Phi^\mathrm{\scriptscriptstyle \, G}_{X,Y}$ with parameters $X,Y$ on a generic state $\rho$ can be effectively described by giving the transformation law of the corresponding characteristic functions~\eqref{chi}. For all $\xi\in \mathds{R}^{2m'}$, we have that
\begin{equation}
\chi_{\Phi^\mathrm{\scriptscriptstyle \, G}_{X,Y}(\rho)}(\xi) \mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = \chi_\rho\left( \Omega^\intercal X^\intercal \Omega\, \xi\right) e^{-\frac14 \xi^\intercal \Omega^\intercal Y \Omega \xi}\, .
\label{G_channel_chi}
\end{equation}
Comparing this to~\eqref{chi_Gaussian} we see that the effective transformation rule on Gaussian states is
\begin{equation}
\Phi^\mathrm{\scriptscriptstyle \, G}_{X,Y} \left( \rho_\mathrm{\scriptscriptstyle \, G}[V,s] \right) = \rho_\mathrm{\scriptscriptstyle \, G}\left[ XVX^\intercal + Y,\, Xs\right] .
\label{G_channel_QCM}
\end{equation}
Gaussian channels are special examples of `Gaussian dilatable channels'~\cite{KK-VV, G-dilatable}, and hence are also `linear bosonic'~\cite{holwer}.

A particularly simple example of Gaussian channel is the \textbf{pure loss channel}, defined by
\begin{equation}
\pazocal{E}_\lambda \mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = \Phi^\mathrm{\scriptscriptstyle \, G}_{\sqrt{\lambda}\mathds{1}_2,\, (1-\lambda)\mathds{1}_2}
\label{pure_loss_XY}
\end{equation}
Its action can also be described at the level of density operators as
\begin{align}
\pazocal{E}_\lambda (\rho) &\mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = \Tr_2 \left[ U_\lambda\left( \rho\otimes \ketbra{0}\right) U_\lambda^\dag \right] , \label{rho_lambda_s_pure_loss} \\
U_\lambda &\mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = e^{i\arccos\sqrt\lambda\, \left(x_1 p_2 - x_2 p_1\right)}\, , \label{beam_splitter}
\end{align}
where $U_\lambda$ is the Gaussian unitary that represents the action of a beam splitter with transmissivity $\lambda$, $\Tr_2$ stands for the partial trace over the second mode, and as usual $x_j,p_j$ denote the canonical operators pertaining to the $j^{\text{th}}$ mode.

The state under examination is constructed as
\begin{equation}
\rho_{\lambda, s} \mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = \left( \pazocal{E}_\lambda \otimes I \right) (\psi_s) = \mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} \rho_\mathrm{\scriptscriptstyle \, G} \left[ V_{\lambda,s},\, 0\right] ,
\label{rho_lambda_s}
\end{equation}
where the QCM $V_{\lambda,s}$ is
\begin{equation}
V_{\lambda,s} \mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = \begin{pmatrix} \left(\lambda \cosh (2r_s) + (1-\lambda)\right) \mathds{1}_2 & \sqrt{\lambda} \sinh (2r_s) \sigma_z \\ \sqrt{\lambda} \sinh (2r_s) \sigma_z & \cosh (2r_s) \mathds{1}_2 \end{pmatrix} .
\label{V_lambda_s}
\end{equation}

The R\'enyi-$2$ Gaussian entanglement of formation of the state $\rho_{\lambda,s}$ in~\eqref{rho_lambda_s} can be deduced easily from the corresponding standard (i.e.\ von Neumann) Gaussian entanglement of formation, which has already been computed~\cite[Eq.~(4) and~(5)]{Tserkis18}. This is possible because in the two-mode case all Gaussian entanglement measures are monotonically increasing function of the minimal squeezing factor of a two-mode squeezed state that can yield, upon the addition of Gaussian noise, the target state, and hence are also monotonically increasing function of each other. In practice, this implies that $E_{F,2}^\G(V_{\lambda,s})= \log_2 \cosh(2r_0)$, where $r_0$ is given by~\cite[Eq.~(5)]{Tserkis18} with the substitutions $\tau\mapsto \lambda$, $v\mapsto 1-\lambda$, and $r\mapsto r_s$. All we did is to change the function in~\cite[Eq.~(4)]{Tserkis18}, suitable for computing the standard entanglement of formation, with its R\'enyi-$2$ counterpart $\log_2 \cosh(2r_0)$. The resulting expression simplifies considerably, and one obtains that
\begin{equation}
E_{F,2}^\G\left( V_{\lambda,s} \right) = \log_2 \left(\frac{1+(1+\lambda)\sinh^2 r_s}{1+(1-\lambda)\sinh^2 r_s} \right) .
\tag{\ref{reof_ex}}
\end{equation}
Incidentally, it can be seen that the pure QCM achieving the minimum in~\eqref{reof} for the particular QCM in~\eqref{V_lambda_s} is that of a two-mode squeezed vacuum, in formula $\tau_{s'}$~\eqref{tmsv_QCM}, with parameter $s'$ satisfying that $\tanh(r_{s'}) = \sqrt\lambda\, \tanh(r_s)$.

As established by Theorem~\ref{KG_ub_thm}, the expression in~\eqref{reof_ex} will be our upper bound for the one-way Gaussian secret key $K^{\G}_\to(\rho_{\lambda,s})$, where with a slight abuse of notation we took as argument of $K^{\G}_\to$ the state $\rho_{\lambda,s}$ instead of its QCM $V_{\lambda,s}$. Hereafter, we will assume that the one-way public communication goes from the first system to the second. Note that, if the state $\rho_{\lambda,s}$ has been distributed by Alice by sending one half of a locally prepared two-mode squeezed vacuum to Bob across a pure loss channel, then the first system belongs to Bob and the second to Alice. This also means that in our example public communication goes \emph{from Bob to Alice}. This seemingly byzantine scenario is however not contrived, simply because we do not assume that Alice and Bob are connected with a quantum channel that allows them to distribute states. Our model, instead, is entirely state-based: Alice and Bob start off with many copies of the state $\rho_{\lambda,s}$, and we do not make any supposition on how they got them in the first place.

To assess the severity of the Gaussian restriction and at the same time the tightness of our bound, we would need to compare this to the standard $1$-LOPC secret key $K_\to(\rho_{\lambda,s})$. As mentioned in the main text, we are not aware of any closed or computable expression for such a quantity, and we will therefore need to content ourselves with lower bounds. A particularly simple one is given by the one-way distillable entanglement $D_\to (\rho_{\lambda,s})$. This is nothing but the maximum yield of Bell pairs that can be obtained per copy of $\rho_{\lambda,s}$ by means of local operations and one-way classical communication with asymptotically vanishing error~\cite{Bennett96a, devetak2005, Horodecki-review}. A general albeit computationally intractable formula for $D_\to$ has been found by Devetak and Winter~\cite[Theorem~13]{devetak2005}. In our case, we are able to obtain a closed expression thanks to a recent result by Leditzky, Datta, and Smith~\cite{Leditzky-Nila}.

To discuss our method, we need to recall the notion of degradable state~\cite[Definition~2.2]{Leditzky-Nila}. A bipartite quantum state $\rho_{AB}$ with purification $\ket{\Psi}_{ABE}$ is \textbf{$\boldsymbol{A\to B}$ degradable} if there exists a quantum channel $\pazocal{N}_{B\to E}$ such that
\begin{equation}
\Psi_{AE} = \pazocal{N}_{B\to E}(\rho_{AB})\, ,
\label{degradable}
\end{equation}
where $\Psi_{AE}\mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = \Tr_B \ketbra{\Psi}_{ABE}$. This notion is a generalisation of that of degradable channel, introduced by Devetak and Shor~\cite{Devetak-Shor}. Its importance in our context descends from the following result.

\begin{lemma}[{\cite[Proposition~2.4]{Leditzky-Nila}}]
For all $A\to B$ degradable states $\rho_{AB}$, the one-way distillable entanglement (with communication direction $A\to B$) evaluates to
\begin{equation}
D_\to (\rho_{AB}) = I(A\rangle B)_\rho = S_1(\rho_B) - S_1(\rho_{AB})\, ,
\label{D_degradable}
\end{equation}
where $S_1(\omega) = -\Tr \omega \log_2 \omega$ is as usual the von Neumann entropy.
\end{lemma}

We can exploit~\eqref{D_degradable} to compute the one-way distillable entanglement for the states $\rho_{\lambda,s}$ in~\eqref{rho_lambda_s}.

\begin{prop} \label{D_rho_lambda_s_prop}
The states $\rho_{\lambda,s}=\rho_{\lambda,s}^{AB}$ in~\eqref{rho_lambda_s}, with $A$ and $B$ standing for the first and second mode, respectively, are $A\to B$ degradable for all $0\leq \lambda\leq 1$ and $s\geq 0$. Consequently,
\begin{equation}
D_\to(\rho_{\lambda,s}) = I(A\rangle B)_{\rho_{\lambda,s}} = g\left(\sinh^2 r_s\right) - g\left((1-\lambda)\sinh^2 r_s \right) ,
\tag{\ref{Ed_ex}}
\end{equation}
where $g(x)\mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = (x+1)\log_2(x+1) - x \log_2(x)$ is the bosonic entropy function.
\end{prop}

\begin{proof}
Our first task is to construct a purification $\ket{\Psi}_{ABE}$ of $\rho_{\lambda,s}^{AB}$. Combining~\eqref{rho_lambda_s} and~\eqref{rho_lambda_s_pure_loss}, we obtain that
\begin{equation}
\rho_{\lambda,s}^{AB} = \Tr_E \left[ U_\lambda^{AE} \left( \psi_s^{AB} \otimes \ketbra{0}^E\right) \left(U_\lambda^{AE}\right)^\dag \right] .
\label{D_proof_eq1}
\end{equation}
From~\eqref{D_proof_eq1} we see immediately that
\begin{equation*}
\ket{\Psi_{\lambda,s}}^{ABE} \mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = U_\lambda^{AE} \left(\ket{\psi_s}^{AB} \otimes \ket{0}^E \right)
\end{equation*}
is indeed a purification of $\rho_{\lambda,s}^{AB}$. Now, since $U_\lambda^{AE}$ is a Gaussian unitary and $\ket{\psi_s}^{AB} \otimes \ket{0}^E$ is a Gaussian state, it does not take long to verify that also $\ket{\Psi_{\lambda,s}}^{ABE}$ is a Gaussian state. Its QCM can be shown to be
\begin{equation*}
\begin{aligned}
\gamma_{ABE} &= \begin{pmatrix} \sqrt\lambda\, \mathds{1}_2 & & \sqrt{1\!-\!\lambda}\,\mathds{1}_2 \\ & \mathds{1}_2 & \\ -\sqrt{1\!-\!\lambda}\, \mathds{1}_2 & & \sqrt\lambda\, \mathds{1}_2 \end{pmatrix} \begin{pmatrix} \cosh(2r_s) \mathds{1}_2 & \sinh(2r_s) \sigma_z & \\ \sinh(2r_s) \sigma_z & \cosh(2r_s) \mathds{1}_2 & \\ & & \mathds{1}_2 \end{pmatrix} \begin{pmatrix} \sqrt\lambda\, \mathds{1}_2 & & \sqrt{1\!-\!\lambda}\,\mathds{1}_2 \\ & \mathds{1}_2 & \\ -\sqrt{1\!-\!\lambda}\, \mathds{1}_2 & & \sqrt\lambda\, \mathds{1}_2 \end{pmatrix}^\intercal \\[2ex]
&= \begin{pmatrix} \left(\lambda \cosh(2r_s) + 1-\lambda\right) \mathds{1}_2 & \sqrt\lambda \sinh(2r_s) \sigma_z & \left(\cosh(2r_s)-1\right)\sqrt{\lambda(1-\lambda)}\, \mathds{1}_2 \\[1ex] \sqrt\lambda \sinh(2r_s) \sigma_z & \cosh(2r_s)\mathds{1}_2 & - \sqrt{1-\lambda} \sinh(2r_s) \sigma_z \\[1ex] \left(\cosh(2r_s)-1\right)\sqrt{\lambda(1-\lambda)}\, \mathds{1}_2 & - \sqrt{1-\lambda} \sinh(2r_s) \sigma_z & \left((1-\lambda) \cosh(2r_s) + \lambda\right) \mathds{1}_2 \end{pmatrix} .
\end{aligned}
\end{equation*}
Therefore, the reduced QCM on $AE$ reads
\begin{equation}
\gamma_{AE} = \begin{pmatrix} \left(\lambda \cosh(2r_s) + 1-\lambda\right) \mathds{1}_2 & \left(\cosh(2r_s)-1\right)\sqrt{\lambda(1-\lambda)}\, \mathds{1}_2 \\[1ex] \left(\cosh(2r_s)-1\right)\sqrt{\lambda(1-\lambda)}\, \mathds{1}_2 & \left((1-\lambda) \cosh(2r_s) + \lambda\right) \mathds{1}_2 \end{pmatrix} .
\label{purification_AE_QCM}
\end{equation}

Now, set
\begin{equation*}
X\mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = \sqrt{1-\lambda}\, \tanh(r_s)\, \sigma_z\, ,\qquad Y\mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = \frac{(2-\lambda)\cosh(2r_s)+ \lambda}{\cosh(2r_s)+1}\, \mathds{1}_2\, .
\end{equation*}
The matrices $X,Y$ turn out to define a Gaussian channel. In order to verify that this is the case, we just need to check that condition~\eqref{CP_G_channels_single_mode} is obeyed. Indeed,
\begin{equation*}
\sqrt{\det Y} - \left| 1-\det X\right| = \frac{(2-\lambda)\cosh(2r_s) + \lambda}{\cosh(2r_s)+1} - \left| 1 - (1-\lambda)\, \tanh^2(r_s) \right| = 2(1-\lambda) \tanh^2(r_s) \geq 0\, .
\end{equation*}
The Gaussian channel $\left(\Phi_{X,Y}^\mathrm{\scriptscriptstyle \, G}\right)_{B\to E}$ will be our ansatz for the `degrading' channel $\pazocal{N}_{B\to E}$ in~\eqref{degradable}. We now need to show that $\left(\Phi_{X,Y}^\mathrm{\scriptscriptstyle \, G}\right)_{B\to E}\left(\rho_{\lambda,s}^{AB}\right) = \Psi_{\lambda,s}^{AE}$. Since both states are Gaussian and have zero mean, it suffices to compute their QCMs and to verify that they are equal. Note that we already derived the QCM of $\Psi_{\lambda,s}^{AE}$, denoted $\gamma_{AE}$, in~\eqref{purification_AE_QCM}. To compute that of $\left(\Phi_{X,Y}^\mathrm{\scriptscriptstyle \, G}\right)_{B\to E}\left(\rho_{\lambda,s}^{AB}\right)$, call it $W_{AE}$, we resort to~\eqref{G_channel_QCM}, obtaining that
\begin{equation*}
W_{AE} = \begin{pmatrix} \mathds{1} & \\ & X \end{pmatrix} V_{\lambda,s}^{AB} \begin{pmatrix} \mathds{1} & \\ & X^\intercal \end{pmatrix} + \begin{pmatrix} \mathds{1} & \\ & Y \end{pmatrix} = \gamma_{AE}
\end{equation*}
after tedious but straightforward calculations.

We have therefore verified that the state $\rho_{\lambda,s}$ is degradable. To compute its coherent information we use the well-known formula~\cite[Eq.~(3.92)]{BUCCO}
\begin{equation*}
S_1\left(\rho_\mathrm{\scriptscriptstyle \, G}\left[V,s\right]\right) = \sum_{j=1}^m g\left( \frac{\nu_j-1}{2}\right)
\end{equation*}
for the von Neumann entropy of an $m$-mode Gaussian state, where $\nu_1,\ldots, \nu_m$ are the symplectic eigenvalues of its QCM $V$, i.e.\ the positive eigenvalues of $i\Omega V$, and $g$ is the bosonic entropy. Since the symplectic eigenvalues of $V_{\lambda,s}^{AB}$ are $1$ and $\lambda + (1-\lambda)\cosh(2r_s)$, and $V_{\lambda,s}^B = \cosh(2r_s)\mathds{1}_2$ has the unique symplectic eigenvalue $\cosh(2r_s)$, we see that
\begin{align*}
D_\to(\rho_{\lambda,s}) &= I(A\rangle B)_{\rho_{\lambda,s}} \\
&= S_1\left(\rho_{\lambda,s}^B\right) - S_1\left(\rho_{\lambda,s}^{AB}\right) \\
&= g\left( \frac{\cosh(2r_s)-1}{2}\right) - g\left( \frac{\lambda + (1-\lambda)\cosh(2r_s) - 1}{2} \right) \\
&= g\left(\sinh^2 r_s\right) - g\left((1-\lambda)\sinh^2 r_s \right) ,
\end{align*}
which completes the proof.
\end{proof}

The two functions $D_\to(\rho_{\lambda,s})$ and $E_{F,2}^\G(\rho_{\lambda,s})$ in \eqref{Ed_ex} are plotted in Figure~\ref{reof_vs_ed_fig_SM} against $\lambda$ for various values of the squeezing intensity $s$. It is not too difficult to verify that $E_{F,2}^\G(\rho_{\lambda,s}) \leq D_\to(\rho_{\lambda,s})$ holds for all $0\leq \lambda\leq 1$ when $r_s\leq r_0$, with $r_0\approx 0.255$ satisfying that $\cosh^2(r_0) \ln \coth(r_0)=1$, which translates precisely to $s\leq \SI{4.22}{\decibel}$.

\begin{reusefigure}[h!]{reof_vs_ed_fig}
  \centering\includegraphics[scale=1]{GIE-fig.pdf}
  \caption{A comparison between the one-way distillable entanglement (communication direction: first-to-second subsystem) and the R\'enyi-$2$ Gaussian entanglement of formation of the states $\left(\pazocal{E}_\lambda \otimes I\right)(\psi_s)$. Explicit formulae are reported in~\eqref{Ed_ex} and~\eqref{reof_ex}, respectively.}\label{reof_vs_ed_fig_SM}
\end{reusefigure}

\end{document}

\section{Comparison of the upper bounds on the secret key capacity} \label{sec capacity}

The last section is devoted to the comparison of the existing upper bounds on the secret key capacity of
the phase-insensitive Gaussian channels encompassing the thermal-loss channel, thermal-amplifier channel,
and the additive-noise Gaussian channel, with the R\'enyi-$2$ Gaussian entanglement of formation of a
Choi state of the channel.

We begin with the thermal-loss channel $\mathcalorig{L}$ (thermal-amplifier channel $\mathcalorig{A}$) with transmissivity (gain) $0<\tau<1$ ($\tau>1$)
and the mean number of thermal photons $\bar{n}<\frac{\tau}{1-\tau}$ $\left(\bar{n}<\frac{1}{\tau-1}\right)$, for which the R\'enyi-$2$ Gaussian entanglement
of formation of its Choi state reads as
\begin{equation}
E_{F,2}^\G (V_{\mathcalorig{L,A}})=\ln\left[\frac{(2\bar{n}+1)(\tau+1)-4\sqrt{\tau\bar{n}(\bar{n}+1)}}{|\tau-1|}\right],
\label{reofchoiA1}
\end{equation}
whereas $E_{F,2}^\G (V_{\mathcalorig{L,A}})=0$ otherwise.

Note first, that in the absence of noise ($\bar{n}=0$) formula~\eqref{reofchoiA1} simplifies as follows:
\begin{equation}
E_{F,2}^\G (V_{\mathcalorig{L_{\rm p},A_{\rm p}}})=\ln\left(\frac{\tau+1}{|\tau-1|}\right).
\label{reofLpAp}
\end{equation}
For the pure-loss channel ($0<\tau<1$) the latter formula is equal to
\begin{equation}
E_{F,2}^\G (V_{\mathcalorig{L_{\rm p}}})=\ln\left(\frac{1+\tau}{1-\tau}\right),
\label{reofLp}
\end{equation}
which is nothing but the upper bound on the secret key rate capacity~\cite{Takeoka14}, which was derived from
the squashed entanglement. This poses a question, what would be the relationship of the considered
quantities for the thermal-loss channel, for which the upper bound based on squashed entanglement is given by~\cite{Takeoka14b}
\begin{equation}
\mathcalorig{S}_{\mathcalorig{L}}(\tau,\bar{n})=\ln\left[\frac{(1-\tau)\bar{n}+1+\tau}{(1-\tau)\bar{n}+1-\tau}\right],
\label{calSLA1}
\end{equation}
where we took for convenience the logarithm with respect to the natural base.

In order to be able to compare the bound~\eqref{calSLA1} with the quantity~\eqref{reofchoiA1}, we introduce the following
more convenient parametrisation:
\begin{equation}
\bar{n}=\sinh^{2}(r),
\end{equation}
which allows us to express all expressions containing $\bar{n}$ in terms of $x=\tanh(r)$. More precisely, by setting
\begin{equation}
\bar{n}=\frac{x^{2}}{1-x^{2}},\quad \bar{n}+1=\frac{1}{1-x^{2}},\quad 2\bar{n}+1=\frac{1+x^{2}}{1-x^{2}},
\label{substitution}
\end{equation}
and $\sqrt{\tau}=z$, one finds the R\'enyi-$2$ Gaussian entanglement of formation of a Choi state of the thermal-loss channel
(thermal-amplifier channel) with  $0<z<1$ ($z>1$) and $x<z$ $(x<\frac{1}{z})$ to be
\begin{equation}
E_{F,2}^\G (V_{\mathcalorig{L,A}})=\ln\left[\frac{(1+x^{2})(1+z^2)-4x z}{(1-x^{2})|1-z^2|}\right].
\label{reofchoiA2}
\end{equation}

Similarly, the bound~\eqref{calSLA1} is transformed as
\begin{equation}
\tilde{\mathcalorig{S}}_{\mathcalorig{L}}(z,x)=\ln\left(\frac{1+z^2-2x^2z^2}{1-z^2}\right).
\label{calSLA2}
\end{equation}
If we now define the difference
\begin{equation}
\Lambda_{\mathcalorig{L}}(z,x)\mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} =\tilde{\mathcalorig{S}}_{\mathcalorig{L}}(z,x)-E_{F,2}^\G (V_{\mathcalorig{L}}),
\label{Lambda1}
\end{equation}
one finds immediately using~\eqref{reofchoiA2} and~\eqref{calSLA2} that
\begin{equation}
\Lambda_{\mathcalorig{L}}(z,x)=\ln\left[\frac{(1-x^2)(1+z^2-2x^2z^2)}{(1+x^{2})(1+z^2)-4x z}\right].
\label{Lambda2}
\end{equation}
For $x=0$ it holds that $\Lambda_{\mathcalorig{L}}(z,0)=0$. Assume now $0<z<1$ and $0<x<z$. Hence,
\begin{equation}
z<\frac{1}{x}\quad \wedge\quad z>\frac{x}{2-x^2}
\end{equation}
and therefore
\begin{equation}
(1-x^2)(1+z^2-2x^2z^2)-[(1+x^{2})(1+z^2)-4x z]=2x^2(2-x^2)\left(\frac{1}{x}-z\right)\left(z-\frac{x}{2-x^2}\right)>0.
\end{equation}
As a consequence, the argument of the logarithm in~\eqref{Lambda2} is strictly larger than one and thus $\Lambda_{\mathcalorig{L}}(z,x)>0$. Finally, it then follows that for $0<\tau<1$ and $\bar{n}<\frac{\tau}{1-\tau}$
\begin{equation}
\mathcalorig{S}_{\mathcalorig{L}}(\tau,\bar{n})\geq E_{F,2}^\G (V_{\mathcalorig{L}})
\end{equation}
and thus for the thermal-loss channel the squashed entanglement bound~\eqref{calSLA1} is greater than or equal to the R\'enyi-$2$ Gaussian entanglement of formation of a Choi state of the channel given by~\eqref{reofchoiA1}
with $0<\tau<1$.

Previous squashed entanglement bounds~\cite{Takeoka14,Takeoka14b} were obtained by using the pure-loss squashing channel in the definition of the squashed entanglement. In what follows, we compare the measure~\eqref{reofchoiA1} with an improved squashed entanglement bound~\cite{Goodenough16}
\begin{equation}
\mathcal{S}_{\mathcalorig{L,A}}(\tau,\bar{n})=\frac{\zeta(1+\nu+3\tau,1+\nu-\tau)-\tau\zeta(\tau+\nu+3,\tau+\nu-1)}{2(1+\nu+\tau)(1-\tau^2)},
\label{calSimp}
\end{equation}
where $\nu=|1-\tau|(2\bar{n}+1)$ and $\zeta(a,b)=\ln(\frac{a}{b})$, which was derived using a more generic Gaussian squashing channel. Due to the complexity of the latter bound, we resort to the graphical comparison of the considered bounds.
Like previously, we introduce into the bound~\eqref{calSimp} the parameters $z$ and $x$, thereby getting $\tilde{\mathcal{S}}_{\mathcalorig{L,A}}(z,x)$.
In the next step, we plot the difference
\begin{equation}
\delta_{\mathcalorig{L,A}}(z,x)\mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} =\tilde{\mathcal{S}}_{\mathcalorig{L,A}}(z,x)-E_{F,2}^\G (V_{\mathcalorig{L,A}})
\label{deltaLA}
\end{equation}
as a function of the variables $z$ and $x$. Figure~\ref{fig1} displays the graph of the difference~\eqref{deltaLA}
for the thermal-loss channel $\mathcalorig{L}$. We clearly see from the figure, that the difference is greater than or equal to zero.
The equality holds for the pure-loss channel ($x=0$), which is in accordance with the fact that in this case both the subtracted quantities are equal to~\eqref{reofLp}.

Now, let us investigate the difference~\eqref{deltaLA} for the thermal-amplifier channel $\mathcalorig{A}$. In Fig.~\ref{fig2} we plot the difference as a function of the transmission parameter $z$ and the noise parameter $x$. The figure reveals, that in the range of the parameters $z$ and $x$ displayed in the figure, the difference is non-negative and thus the squashed entanglement bound~\eqref{calSimp} upper bounds the measure~\eqref{reofchoiA1}. In addition, one can see from the figure that  in the absence of noise ($x=0$) the two quantities coincide, because then they both reduce to
\begin{equation}
E_{F,2}^\G (V_{\mathcalorig{A_{\rm p}}})=\ln\left(\frac{\tau+1}{\tau-1}\right).
\label{reofAp}
\end{equation}

Next, we proceed with the proof that the R\'enyi-$2$ Gaussian entanglement of formation of a Choi state of the thermal-loss channel, thermal-amplifier channel, and the additive-noise Gaussian channel upper bounds the upper bound on the secret key capacity derived from the relative entropy of entanglement~\cite{Pirandola17}. For the thermal-loss channel the relative entropy of entanglement upper bound reads as~\cite{Pirandola17}
\begin{equation}
\Phi_{\mathcalorig{L}}(\tau,\bar{n})=\left\{\begin{array}{ll} -\ln[(1-\tau)\tau^{\bar{n}}]-h(\bar{n}) & \textrm{for} \quad \bar{n}<\frac{\tau}{1-\tau},\\
0 \quad\textrm{otherwise}, &\\
\end{array}\right.
\label{RREthlossA1}
\end{equation}
where
\begin{equation}
h(\bar{n})=(\bar{n}+1)\ln(\bar{n}+1)-\bar{n}\ln\bar{n}.
\end{equation}
Likewise, the secret key capacity of the thermal-amplifier channel is bounded from above by the relative entropy of entanglement bound~\cite{Pirandola17}
\begin{equation}
\Phi_{\mathcalorig{A}}(\tau,\bar{n})=\left\{\begin{array}{ll} \ln\left(\frac{\tau^{\bar{n}+1}}{\tau-1}\right)-h(\bar{n}) & \textrm{for} \quad \bar{n}<\frac{1}{\tau-1},\\
0 \quad\textrm{otherwise}. &\\
\end{array}\right.
\label{RREthampA1}
\end{equation}

By carrying out the substitutions~\eqref{substitution} and $\sqrt{\tau}=z$ in the upper bounds~\eqref{RREthlossA1} and~\eqref{RREthampA1} one obtains
\begin{equation}
\tilde{\Phi}_{\mathcalorig{L}}(z,x)=\left\{\begin{array}{ll} -\ln\left[(1-z^2)z^{\left(\frac{2x^2}{1-x^2}\right)}\right]-\tilde{h}(x) & \textrm{for} \quad x<z,\\
0 \quad\textrm{otherwise}, &\\
\end{array}\right.
\label{RREthlossA2}
\end{equation}
and
\begin{equation}
\tilde{\Phi}_{\mathcalorig{A}}(z,x)=\left\{\begin{array}{ll} \ln\left[\frac{z^{\left(\frac{2}{1-x^2}\right)}}{z^2-1}\right]-\tilde{h}(x) & \textrm{for} \quad x<\frac{1}{z},\\
0 \quad\textrm{otherwise}, &\\
\end{array}\right.
\label{RREthampA2}
\end{equation}
respectively, where
\begin{equation}
\tilde{h}(x)=\frac{1}{1-x^2}\ln\frac{1}{1-x^2}-\frac{x^2}{1-x^2}\ln\frac{x^2}{1-x^2}.
\end{equation}
Now, our goal is to show that for the thermal-loss and thermal-amplifier channel the quantity~\eqref{reofchoiA2} is never less than the quantity
\eqref{RREthlossA2} and~\eqref{RREthampA2}, respectively. For this purpose, we introduce the difference
\begin{equation}
\Delta_{\mathcalorig{L,A}}(z,x)\mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = E_{F,2}^\G (V_{\mathcalorig{L,A}})-\tilde{\Phi}_{\mathcalorig{L,A}}(z,x),
\label{DeltaLA}
\end{equation}
and we analyzed whether it is lower bounded by zero on the respective subset of the $(z,x)$-plane.

First, we investigate from this perspective the difference~\eqref{DeltaLA} for the thermal-loss channel,
\begin{equation}
\Delta_{\mathcalorig{L}}(z,x)=\ln\left[\frac{(1+x^{2})(1+z^2)-4x z}{(1-x^{2})}\right]+\frac{2x^2}{1-x^2}\ln z+\tilde{h}(x),
\label{DeltaL}
\end{equation}
by seeking its minimum on the set characterised by the conditions $0<z<1$ and $0<x<z$. The set is an open triangle and
therefore it may happen, that the difference~\eqref{DeltaL} does not have there any minimum. For this reason, in what follows we consider
a larger closed set given by the union of the triangle with its boundary lines.

Let us first identify the candidates for extremes of the function~\eqref{DeltaL} in the interior of the triangle by solving the extremal equations
$\partial\Delta_{\mathcalorig{L}}/\partial z=0$ and $\partial\Delta_{\mathcalorig{L}}/\partial x=0$. Obviously, the first equation,
\begin{equation}
\frac{\partial\Delta_{\mathcalorig{L}}}{\partial z}=\frac{2(1+x^2)(x-z)^2}{z(1-x^2)[(1+x^2)(1+z^2)-4xz]}=0,
\end{equation}
has no solution for $0<z<1$ and $0<x<z$, which implies that the difference~\eqref{DeltaL} does not have any extreme in the interior of the triangle.

Concerning the boundary, consider an open line segment $x=0$ and $0<z<1$, where the equation~\eqref{DeltaL} boils down to
\begin{equation}
\Delta_{\mathcalorig{L}}(z,0)=\ln(1+z^2).
\label{DeltaLx0}
\end{equation}
Obviously, it is a monotonically increasing function that does not possess any extreme on the interval $0<z<1$.

As for the open boundary line segment $z=1$ and $0<x<1$, one finds using~\eqref{DeltaL} that
\begin{equation}
\Delta_{\mathcalorig{L}}(1,x)=\ln\left[2\left(\frac{1-x}{1+x}\right)\right]+\tilde{h}(x).
\end{equation}
In this case, the derivative with respect to $x$ satisfies
\begin{equation}
\frac{d\Delta_{\mathcalorig{L}}}{dx}(1,x)=\frac{2}{(1-x^2)^2}(x^2-2x\ln x-1)<0,
\label{DeltaL1x}
\end{equation}
where the inequality is obtained if we substitute for $x$ from $x=\sqrt{\frac{\bar{n}}{\bar{n}+1}}$ and use
the logarithmic-geometric mean inequality according to which, if $0<a<b$, then
\begin{equation}
\frac{b-a}{\ln b-\ln a}>\sqrt{ab}.
\end{equation}
The function~\eqref{DeltaL1x} is thus monotonically decreasing and therefore there is not any extreme on the considered line segment.

For the last open boundary line segment $x=z$ and $0<z<1$, one gets immediately $\Delta_{\mathcalorig{L}}(z,z)=0$ and any point on the segment can be an
extreme.

Moving to the vertices of the triangle, for two of them one gets straightforwardly $\Delta_{\mathcalorig{L}}(0,0)=0$ and $\Delta_{\mathcalorig{L}}(1,0)=\ln 2$.
In the last vertex $(1,1)$ the behaviour of the function~\eqref{DeltaLA} is more complex. In order to see this, we calculate the limits
of~\eqref{DeltaLA} for $t\rightarrow 1$ along the line segments
\begin{equation}
z=q+(1-q)t,\quad x=t,\quad t\in\langle 0,1\rangle,
\end{equation}
which start at the point $(q,0)$ on the $z$-axis, $q\in[0,1]$, and end at the point of our interest $(1,1)$. This gives explicitly
\begin{equation}
L\mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} =\lim_{t\rightarrow 1}\Delta_{\mathcalorig{L}}[q+(1-q)t,t]=q+\ln\left[\frac{1}{2}(2-2q+q^2)\right].
\end{equation}
Hence, one can see immediately, that $L\in[0,1-\ln2]$, i.e.\ also at the point $(1,1)$ the least limit of the function~\eqref{DeltaLA} is equal to zero.

Putting it all together, we see that on the considered closed triangle it holds that $\Delta_{\mathcalorig{L}}(z,x)\geq0$, where the equality is satisfied only on the line segment $x=z$, $0\leq z\leq 1$. This implies, that a strict inequality $\Delta_{\mathcalorig{L}}(z,x)>0$ holds on the original open triangle together with the line segment $x=0$ and $0<z<1$
corresponding to the pure-loss channels. Taking into account also the entanglement breaking thermal-loss channels, where both the quantities~\eqref{reofchoiA1} and~\eqref{RREthlossA1} vanish, one finds that for the thermal-loss channel our quantity~\eqref{reofchoiA1} is never less than the relative entropy of entanglement bound~\eqref{RREthlossA1}, i.e.
\begin{equation}
E_{F,2}^\G (V_{\mathcalorig{L}})\geq\Phi_{\mathcalorig{L}}(\tau,\bar{n}),
\end{equation}
as we set out to prove.

In the case of the thermal-amplifier channel the function~\eqref{DeltaLA} reduces to
\begin{equation}
\Delta_{\mathcalorig{A}}(z,x)=\ln\left[\frac{(1+x^{2})(1+z^2)-4x z}{(1-x^{2})}\right]-\frac{2}{1-x^2}\ln z+\tilde{h}(x)
\label{DeltaA}
\end{equation}
and our goal is to show that on the open set characterised by inequalities $z>1$ and $x<\frac{1}{z}$ the function is bounded from below by zero.
Like previously, it is more convenient to work with a larger set described by the conditions $z\geq1$ and $x\leq\frac{1}{z}$, which includes
also the boundary curves. In order to analyze the behaviour of the function in the interior of the set, we calculate the extremal equation
\begin{equation}
\frac{\partial\Delta_{\mathcalorig{A}}}{\partial z}=-\frac{2(1+x^2)(xz-1)^2}{z(1-x^2)[(1+x^2)(1+z^2)-4xz]}=0,
\end{equation}
which has no solution owing to the inequality $xz<1$.

For the open boundary line segment $x=0$ and $z>1$, equation~\eqref{DeltaA} boils down to
\begin{equation}
\Delta_{\mathcalorig{A}}(z,0)=\ln\left(1+\frac{1}{z^2}\right),
\label{DeltaAx0}
\end{equation}
which is a monotonically decreasing function that does not possess any extreme for $z>1$.

The other part of the boundary is given by an open line segment $z=1$ and $0<x<1$. Since $\ln z=0$ in this case, one gets from~\eqref{DeltaL} and~\eqref{DeltaA}
that
\begin{equation}
\Delta_{\mathcalorig{A}}(1,x)=\Delta_{\mathcalorig{L}}(1,x).
\end{equation}
The situation is exactly the same as in the case of the thermal-loss channel and thus there is not an extreme on the investigated line segment.

The last part of the boundary is a curve $x=\frac{1}{z}$, where $z>1$, for which
\begin{equation}
\Delta_{\mathcalorig{A}}\left(z,\frac{1}{z}\right)=0
\label{DeltaAz1z}
\end{equation}
and any point of the curve can be an extreme.

It remains to calculate the value of the difference~\eqref{DeltaA} in the vertices of the considered set. Firstly, from~\eqref{DeltaAx0} we obtain
$\Delta_{\mathcalorig{A}}(1,0)=\ln 2$. Further, making use of the same formula and equation~\eqref{DeltaAz1z} we arrive at
\begin{equation}
\lim_{z\rightarrow +\infty}\Delta_{\mathcalorig{A}}(z,0)=0,\quad \lim_{z\rightarrow +\infty}\Delta_{\mathcalorig{A}}\left(z,\frac{1}{z}\right)=0,
\end{equation}
and thus the function vanishes in infinitely distant vertex on the $z$-axis. Finally, to find the lower bound for the function~\eqref{DeltaA} in the point $(1,1)$, we
calculate the limits of the function along the segments of the lines starting in the point $(q,0)$ on the $z$-axis, $q\in[1,2]$, and ending in the point $(1,1)$,
\begin{equation}
L'\mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} =\lim_{t\rightarrow 1}\Delta_{\mathcalorig{A}}[q+(1-q)t,t]=2-q+\ln\left[\frac{1}{2}(2-2q+q^2)\right].
\end{equation}
As for $q\in[1,2]$ one has $L'\in[1-\ln2,0]$, the least limit of function~\eqref{DeltaA} at the point $(1,1)$ is equal to zero.

Summarising the results for the thermal-amplifier channel we see, that $\Delta_{\mathcalorig{A}}(z,x)\geq0$, where the equality is satisfied only on the line segment $x=\frac{1}{z}$, $z\geq 1$. Consequently, a strict inequality $\Delta_{\mathcalorig{A}}(z,x)>0$ holds on the original open set together with the line segment $x=0$ and $z>1$,
which corresponds to the pure-amplifier channels. If we include into our considerations also the entanglement breaking thermal-amplifier
channels for which both the quantities~\eqref{reofchoiA1} and~\eqref{RREthampA1} vanish, one finds that for the thermal-amplifier
channel our quantity~\eqref{reofchoiA1} is never less than the relative entropy of entanglement bound~\eqref{RREthampA1}, i.e.
\begin{equation}
E_{F,2}^\G (V_{\mathcalorig{A}})\geq\Phi_{\mathcalorig{A}}(\tau,\bar{n}),
\end{equation}
which completes the proof.

In the last part of this section we show, that the R\'enyi-$2$ Gaussian entanglement of formation of a Choi state of the additive-noise Gaussian channel is also an upper bound on the relative entropy of entanglement bound~\cite{Pirandola17}. The channel is characterised by the variance of the added noise $\xi\geq 0$ and the channel is entanglement breaking if $\xi\geq1$.
For $\xi<1$, the R\'enyi-$2$ Gaussian entanglement of formation of a Choi state of the channel is equal to $E_{F,2}^\G (V_{\mathrm{add}})=\ln[\cosh(2r_{0})]$~\cite{AdessoSerafini}, where $r_{0}=-\ln\sqrt{\xi}$~\cite[Eq.~(6b)]{Tserkis18}, while $E_{F,2}^\G (V_{\mathrm{add}})=0$ otherwise. This gives
\begin{equation}
E_{F,2}^\G (V_{\mathrm{add}})=\left\{\begin{array}{ll} \ln\left(\frac{1+\xi^2}{2\xi}\right) & \textrm{for} \quad \xi<1,\\
0 \quad\textrm{otherwise}. &\\
\end{array}\right.
\label{reofchoiaddA}
\end{equation}
The relative entropy of entanglement bound attains the following form~\cite{Pirandola17}:
\begin{equation}
\Phi_{\mathrm{add}}(\xi)=\left\{\begin{array}{ll} \xi-1-\ln\xi & \textrm{for} \quad \xi<1,\\
0 \quad\textrm{otherwise}. &\\
\end{array}\right.
\label{RREaddA}
\end{equation}
Defining the difference
\begin{equation}
\Delta_{\mathrm{add}}(\xi)\mathrel{\vcenter{\baselineskip0.5ex \lineskiplimit0pt \hbox{\scriptsize.}\hbox{\scriptsize.}}} = E_{F,2}^\G (V_{\mathrm{add}})-\Phi_{\mathrm{add}}(\xi)
\end{equation}
and substituting for the quantities on the r.h.s.\ from~\eqref{reofchoiaddA} and~\eqref{RREaddA} we arrive at
\begin{equation}
\Delta_{\mathrm{add}}(\xi)=\left\{\begin{array}{ll} (1-\xi)\left[1-\frac{1+\xi}{\sqrt{2(1+\xi^2)}}\right] & \textrm{for} \quad \xi<1,\\
0 \quad\textrm{otherwise}. &\\
\end{array}\right.
\end{equation}
From inequality $(1-\xi)^2>0$ it follows that $\xi+1<\sqrt{2(1+\xi^2)}$ and as also $1-\xi>0$ one sees immediately that $\Delta_{\mathrm{add}}(\xi)>0$ for $\xi<1$. Since for $\xi\geq 1$ it holds that $\Delta_{\mathrm{add}}(\xi)=0$, we find that the bounds~\eqref{reofchoiaddA} and~\eqref{RREaddA} for the additive-noise Gaussian channel fulfil the following inequality:
\begin{equation}
E_{F,2}^\G (V_{\mathrm{add}})\geq\Phi_{\mathrm{add}}(\xi),
\end{equation}
as we wanted to show.

For completeness, we compare the new bound~\eqref{reofchoiA1}, the relative entropy of entanglement bound~\eqref{RREthampA1},
the squashed entanglement bound~\cite{Takeoka14b}
\begin{equation}
\mathcalorig{S}_{\mathrm{add}}(\xi)=\left\{\begin{array}{ll} \ln\left(\frac{2+\xi}{\xi}\right) & \textrm{for} \quad \xi<1,\\
0 \quad\textrm{otherwise}. &\\
\end{array}\right.
\label{Sqadd}
\end{equation}
and the improved squashed entanglement bound~\cite{Goodenough16}
\begin{equation}
\mathcal{S}_{\mathrm{add}}(\xi)=\left\{\begin{array}{ll}\frac{\xi^2+2\xi+2}{2(1+\xi)}\ln\left(\frac{2+\xi}{\xi}\right)-1 & \textrm{for} \quad \xi<1,\\
0 \quad\textrm{otherwise}. &\\
\end{array}\right.
\label{Sqimpadd}
\end{equation}
in Fig.~\ref{figadd}.

redpajama_set_name: RedPajamaArXiv