Asymptotic security of discrete-modulation protocols for continuous-variablequantum key distribution

Eneet Kaur,1 Saikat Guha,2 and Mark M. Wilde11Hearne Institute for Theoretical Physics, Department of Physics and Astronomy,

and Center for Computation and Technology, Louisiana State University, Baton Rouge, Louisiana 70803, USA2College of Optical Sciences and Department of Electrical and Computer Engineering,

University of Arizona, Tucson, Arizona 85719, USA(Dated: January 20, 2021)

We consider discrete-modulation protocols for continuous-variable quantum key distribution (CV-QKD) that employ a modulation constellation consisting of a finite number of coherent states andthat use a homodyne or a heterodyne-detection receiver. We establish a security proof for collec-tive attacks in the asymptotic regime, and we provide a formula for an achievable secret-key rate.Previous works established security proofs for discrete-modulation CV-QKD protocols that use twoor three coherent states. The main constituents of our approach include approximating a complex,isotropic Gaussian probability distribution by a finite-size Gauss-Hermite constellation, applyingentropic continuity bounds, and leveraging previous security proofs for Gaussian-modulation proto-cols. As an application of our method, we calculate secret-key rates achievable over a lossy thermalbosonic channel. We show that the rates for discrete-modulation protocols approach the ratesachieved by a Gaussian-modulation protocol as the constellation size is increased. For pure-losschannels, our results indicate that in the high-loss regime and for sufficiently large constellationsize, the achievable key rates scale optimally, i.e., proportional to the channel’s transmissivity.

I. INTRODUCTION

Quantum key distribution (QKD) allows for two dis-tant parties, often called Alice and Bob, to create ashared secret key by employing an insecure and noisyquantum communication channel and an authenticatedpublic classical communication channel [1–3]. The se-curity is based on the physical laws of quantum me-chanics, in contrast to conventional cryptographic proto-cols, whose security relies on computational complexity-theoretic assumptions.

There are two basic classes of QKD protocols thathave been considered: discrete-variable and continuous-variable (see, e.g., [3] for a review). In discrete-variable QKD (DV-QKD), the information is usually en-coded in the polarization or time bin of single photonsor weak coherent states (laser-light pulses). Discrete-variable QKD requires high-efficiency, low dark-count-rate, single-photon detectors, which are expensive andoften need extreme cryo-cooling. In the other class of pro-tocols, known as continuous-variable QKD (CV-QKD),the information is encoded in the quadrature amplitudesof coherent states. The transmitter modulates the phaseand/or the amplitude of laser-light pulses, and the re-ceiver is based on coherent detection (i.e., homodyneor heterodyne detection). Near shot-noise-limited, low-noise homodyne/heterodyne detection is readily realiz-able at room temperature using off-the-shelf hardware,unlike the single-photon detectors of DV-QKD. CV-QKDprotocols thus possess a major advantage over DV-QKDin terms of the cost and ease of experimental implemen-tation.

However, one major area that DV-QKD currently pos-sesses an advantage over CV-QKD is that the DV modu-lation involves few levels (e.g., two polarization states of

a photon or three amplitude levels of a coherent state inthe decoy-state BB84 protocol [4–6]), which puts far lessburden on the transmitter’s modulator compared to thatof the traditional Gaussian-modulation CV-QKD proto-col. The latter requires modulation using an infinite-sizeconstellation. This also makes the error correction proto-cols far simpler for DV-QKD, along with much less over-head for random-number generation. Another area whereDV-QKD is arguably more advanced is the availabilityof quantum repeater protocols [7–11] for overcoming thefundamental rate-vs.-loss trade-off of direct-transmissionbased QKD [12–14]. However, there have been recent ad-vances in designs of repeaters for CV-QKD [15–17]. Forexperimental developments in CV-QKD see [18–23].

In the most common form of CV-QKD, one uses Gaus-sian modulation of coherent states [24]: Alice modulateslaser-light pulses with amplitudes selected randomly froma complex-valued Gaussian distribution with a given vari-ance. Security proofs for this Gaussian modulation CV-QKD protocol have been developed for arbitrary attacks,even in the finite key-length regime [25]. Additionally, asuite of variants of this CV-QKD protocol exist, some ofwhich use squeezed light modulation and two-way trans-mission [26–34].

However, all of their asymptotic security proofs requirea Gaussian modulation. Gaussian modulation has ob-vious drawbacks, which include extreme burden on thetransmitter’s random number source, as well as computa-tionally demanding and inefficient error-correction tech-niques. Furthermore, no matter how high the extinctionratio of a practically-realizable electro-optic modulator,it is impossible to sample pulse amplitudes from a trueGaussian distribution, on which the security proofs rely.

Despite the fact that Gaussian modulation has madesecurity proofs manageable, it is important—for the prac-

arX

iv:1

901.

1009

9v4

[qu

ant-

ph]

19

Jan

2021

2

tical realizability of CV-QKD—that protocols that usea few pre-determined modulation levels (such as bi-nary phase and quadrature amplitude modulation) areproven secure. Discrete-modulation CV-QKD was in-troduced in [35–37], where the coherent states trans-mitted in each mode are chosen according to a discreteprobability distribution, and it was developed further in[38]. Discrete-modulation CV-QKD protocols can lever-age the efficient modulation and error correction, andlow-overhead random number generation that DV-QKDenjoys, while retaining the ease of implementation of ho-modyne/heterodyne detection of CV-QKD.

Several discrete-modulation protocols have alreadybeen considered [38–41], and security proofs have beendeveloped in the asymptotic regime, i.e., in the limit ofa large number of uses of the quantum channel, hencegenerating a large-length key (at a given key-bits perchannel-use rate). Ref. [38] considered a protocol withbinary-phase shift-keying of coherent states along withhomodyne detection. However, the secure key rate es-tablished there is more than an order of magnitudelower than that which can be achieved with Gaussianmodulation. Motivated by [38], Ref. [39] consideredternary-phase shift-keying modulation with homodynedetection, which led to an improvement in the securekey rates, but the resulting secret-key rates are still farfrom the key rates achievable with Gaussian modulation.Refs. [40, 41] established security for discrete-modulationprotocols against particular collective attacks that cor-respond to linear bosonic channels. For other proto-cols that use discrete modulation of coherent states, see[42, 43].

This brings us to the long-standing open problem ofproving security of a general M -ary discrete-modulationCV-QKD protocol, for M beyond a minimum thresh-old value, with the feature that the achievable key rateapproaches that of Gaussian modulation as M goes toinfinity. Such a result is of significant value for the prac-tical usability of CV-QKD. In this paper, we accomplishthe aforesaid for security against collective attacks havingthe physically reasonable assumptions outlined in Sec-tion III. Establishing a security proof and key-rate lowerbounds for discrete modulation CV-QKD protocols witha finite key length is left open for future work. Our proofeliminates the need to consider protocols based on Gaus-sian modulation in order to have asymptotic security inCV-QKD, with the ability of the user to determine thesize of the modulation alphabet based on how close onedesires the key rates to be to the Gaussian modulationprotocol. In addition, our numerical evaluation of achiev-able key rates over a pure-loss bosonic channel suggeststhat, for sufficiently large constellation size, the achiev-able key rates are proportional to the channel’s transmis-sivity, which is known to be the optimal rate-vs.-loss scal-ing achievable with any QKD protocol, CV or DV [12].

To establish these results, we make use of two impor-tant recent theoretical advances: the approximation ofGaussian distributions with discrete ones for communica-

tion [44, 45], especially in the context of bosonic Gaussianstates [45], and an entropic continuity bound from [46] forenergy-bounded bosonic states. The idea of approximat-ing a Gaussian modulation with a discrete one for CV-QKD was proposed in [47], but this work did not providea security proof for CV-QKD with discrete modulation.One of the main tools, beyond the approaches consideredin [47] and which allows us to establish a security proof,is the entropic continuity bound from [46]. We also de-velop methods for using the parameters observed in adiscrete-modulation CV-QKD protocol to bound Eve’sHolevo information.

This paper is organized as follows. We introducediscrete-modulation CV-QKD in Section II, followed bySection III’s detailed list of our assumptions on the col-lective attack of an eavesdropper. We give our securityproof in Section IV, and we discuss details of channel es-timation in Section V. We then showcase, in Section VI,the secure key rates that our approach leads to when theprotocol is conducted over a lossy thermal bosonic chan-nel. We end with open questions and future directions inSection VII.Note: In work independent of and concurrent to ours,

other approaches for security proofs in discrete modula-tion of CV-QKD have been put forward [48, 49].

II. PROTOCOL

We begin by outlining the steps of a phase-symmetrized discrete-modulation CV-QKD protocolbased on m2 coherent states, where m ∈ N. In thisprotocol, Bob performs either homodyne or heterodynedetection. Let X be a random variable with realizationsx ∈ {1, 2, . . . ,m2} and fix αx ∈ C for all x. Let r(x)be the probability associated with the realization x. Thesteps of the protocol are as follows:

1. Alice prepares the coherent state |αx〉 with proba-bility r(x). She records the value of x in the vari-able xj , where j ∈ {1, . . . , n} refers to the transmis-sion round. She also records the value

√2 Re{αx}

in the variable qj and the value√

2 Im{αx} in thevariable pj . Exact expressions for αx and r(x) thatwe use in the protocol are given in Section V.

2. Alice then picks a phase φj ∈ {0, π/2, π, 3π/2} uni-formly at random, applies it to her channel inputmode as the unitary e−in̂φj , which is physically re-alized by a phase shifter. The resulting state is thene−in̂φj |αx〉 =

∣∣αxe−iφj⟩, which she transmits overthe unknown and insecure quantum communicationchannel N to Bob. At the same time, she commu-nicates the choice φj to Bob over a public authenti-cated classical channel and then she locally discardsor forgets the choice of φj . The insecure quantumchannel N can be controlled by an eavesdropperEve. Our assumptions on the insecure quantumchannel N are stated in Section III.

3

3. Upon receiving the output of the quantum chan-nel, namely, the state N (e−in̂φj |αx〉〈αx|ein̂φj ), aswell as the classical choice of φj from the publicauthenticated classical channel, Bob applies the re-verse phase as the inverse unitary ein̂φj , and thenlocally discards or forgets the value of φj . The re-sulting state is then as follows:

N (|αx〉〈αx|), (1)

where the phase-symmetrized channel N is definedas

N (ρ) ≡ 1

4

3∑k=0

U(k)†N (U(k)ρU(k)†)U(k), (2)

with U(k) ≡ e−in̂πk/2. The phase symmetrizationof the channel N is helpful in reducing the num-ber of parameters that need to be estimated duringthe channel estimation part of the protocol, as weexplain in Section V.

4. If Bob performs position-quadrature or real-quadrature homodyne detection on the stateN (|αx〉〈αx|) the result is recorded in the variable yqj[50]. If Bob performs heterodyne detection, thenthe value of the position quadrature is recordedin yqj , and the value of the momentum quadratureis recorded in ypj .

5. Steps 1-4 are repeated n times, for n a large positiveinteger. If Bob performs homodyne detection, thenthe sequence {qj}nj=1 is known to Alice, and thesequence {yqj}nj=1 is known to Bob. If Bob performsheterodyne detection, then the sequences {qj}nj=1

and {pj}nj=1 are known to Alice, and {yqj}nj=1 and{ypj }nj=1 are known to Bob.

6. A constant fraction δ of the rounds are used forchannel estimation (or parameter estimation), forδ ∈ (0, 1) a small number. That is, for these δnrounds, the parameters γ11, γ22, and γ12 are calcu-lated. If Bob performs homodyne detection, thenthese parameters are given as

γ11 ≡1

δn

δn∑j=1

(qj − q)2, (3)

γ12 ≡1

δn

δn∑j=1

(qj − q)(yqj − y), (4)

γ22 ≡1

δn

δn∑j=1

(yqj − y)2, (5)

where

q ≡ 1

δn

δn∑j=1

qj , y ≡ 1

δn

δn∑j=1

yqj . (6)

If Bob performs heterodyne detection, then theseparameters are given as

γ11 ≡1

δn

δn∑j=1

(qj − q)2 =1

δn

δn∑j=1

(pj − p)2, (7)

γ12 ≡1

2δn

δn∑j=1

(qj − q)(yqj − yq) + (pj − p)(ypj − y

p), (8)

γ22 ≡1

2δn

δn∑j=1

(yqj − yq)2 + (ypj − y

p)2, (9)

where

q ≡ 1

δn

δn∑j=1

qj , yq ≡ 1

δn

δn∑j=1

yqj , (10)

p ≡ 1

δn

δn∑j=1

pj , yp ≡ 1

δn

δn∑j=1

ypj . (11)

Clearly, the parameter γ11 can be calculated fromAlice’s data alone, γ22 can be calculated from Bob’sdata alone, but it is necessary to calculate γ12 fromboth Alice and Bob’s data, and so it is necessary forBob to share the yj values of these δn rounds withAlice over a public authenticated classical chan-nel. Furthermore, the public authenticated clas-sical channel is used for Alice and Bob to share thevalues of γ11, γ12, and γ22 with each other. Thedata xj , qj , pj and yq,pj for these δn channel esti-mation rounds are then discarded. A detailed anal-ysis of the channel estimation part of the protocolis given in Section V.

7. The remaining qj , pj , and yq,pj data are used for fi-

nal key generation. The final key-generation proto-col includes reverse reconciliation, error correction,and privacy amplification (see [3] for a review).

III. ASSUMPTIONS ON THE INSECUREQUANTUM COMMUNICATION CHANNEL

In this section, we outline the various assumptions thatwe make on the insecure quantum communication chan-nel:

1. Each Alice-to-Bob transmission is assumed to takeplace over independent identical uses of a quantumchannel N , which is unknown to Alice and Bobat the beginning of the protocol. We assume thatany deviation of N from the identity channel is at-tributed to the most general adversarial action byEve. Even though Eve’s action—which appears asa noisy quantum channel N to Alice and Bob—remains the same for each transmission, she is al-lowed to make arbitrary collective measurements

4

on her quantum system at the end of the protocol.See below for a mathematical description. This sce-nario is referred to as a collective attack.

2. The channel is described mathematically as anisometric quantum channel UA→BE , meaningthat there exists an isometry UA→BE , satisfying[UA→BE ]†UA→BE = IA, such that

UA→BE(ρA) ≡ UA→BE ρA (UA→BE)† (12)

for all input density operators ρA. The systems A,B, and E are described by separable Hilbert spacesHA, HB , and HE , respectively. The system A cor-responds to a single bosonic mode, and system Bdoes also. In particular, the channel can accept co-herent states at the input A and is such that thereceiver can perform homodyne or heterodyne de-tection on the system B. The system A is accessibleto the sender Alice, the system B is accessible tothe receiver Bob, and the system E is in possessionof the eavesdropper Eve.

3. The reduced channel from Alice to Bob is given by

NA→B(ρA) ≡ TrE [UA→BE(ρA)], (13)

and this channelNA→B is what is used in the proto-col description in Section II. We assume that if themean photon number of the input state ρA is finite,then the mean photon number of the output stateNA→B(ρA) is finite. That is, Tr[n̂NA→B(ρA)] <∞if Tr[n̂ρA] < ∞. Furthermore, we assume that ifthe variance of the photon number of the inputstate ρA is finite, then the variance of the pho-ton number of the output state NA→B(ρA) is fi-nite. This implies that Tr[n̂2NA→B(ρA)] < ∞ ifTr[n̂2ρA] <∞.

4. We assume that if the mean photon number ofthe input state ρA is finite, then the mean en-ergy of Eve’s state TrB [UA→BE(ρA)] is finite, wherethe mean energy is computed with respect to aphysically reasonable Hamiltonian HE that satis-fies the Gibbs hypothesis [51–53], meaning thatTr[e−βHE ] < ∞ for all β > 0 and has its ground-state energy equal to zero. For example, if Eve’ssystem E of the state TrB [UA→BE(ρA)] consists ofseveral bosonic modes E1, . . . , Ek, then HE couldbe taken as the total photon number operatorn̂1 + · · ·+ n̂k for all of the k modes.

5. Let

µ(qA, pA) ≡∫dqB rQB |QA,PA(qB |qApA) qB , (14)

denote the conditional mean of the position quadra-ture of Bob, where rQB |QA,PA(qB |qApA) is the con-ditional probability distribution of the positionquadrature qB of the state

σqA,pAB ≡ NA→B(|α(qA, pA)〉〈α(qA, pA)|A), (15)

and |α(qA, pA)〉〈α(qA, pA)| is a coherent statewith position quadrature qA and momentumquadrature pA. We suppose that µ(qA, pA) =∑K1

k=0

∑K2

l=0 µklqkAp

lA, where K1,K2 ∈ Z+. That

is, the mean value of the position quadrature ofσqA,pAB is no more than a K1th-order polynomial inqA and a K2th-order polynomial in pA. We alsosuppose that µkl is an exponentially decaying func-tion, exp[−a(k + l)], in k and l for k ≥ 2m− 2 andl ≥ 2m− 1. Here, a > 0 and m is the constellationsize. For simplicity, we suppose that K1 = K2.These assumptions are required for the securityproof presented in Appendix A.

We note that an immediate consequence of thebounded mean photon number assumption in part threeabove, by applying the Cauchy–Schwarz inequality, is thefollowing: If Alice inputs a state ρA with finite mean vec-tor [〈q̂〉ρ, 〈p̂〉ρ], then the output mean vector for the stateof system B is finite. If the input state ρA has a finitecovariance matrix with entries given by[

2〈q̂20〉ρ 〈q̂0p̂0 + p̂0q̂0〉ρ

〈q̂0p̂0 + p̂0q̂0〉ρ 2〈p̂20〉ρ

], (16)

where q̂0 ≡ q̂−〈q̂〉ρ and p̂0 ≡ p̂−〈p̂〉ρ, then the covariancematrix of the output state NA→B(ρA) is finite.

IV. SECRET-KEY RATE LOWER BOUND

The asymptotic secret-key rate K is bounded from be-low by the Devetak-Winter formula [54, 55] as

K ≥ I(X;Y )− supUA→BE∈S

χ(Y ;E). (17)

In the inequality above, the Shannon mutual informa-tion between Alice’s variable X and Bob’s variable Yis denoted by I(X;Y ), and the Holevo information be-tween Bob’s variable Y and Eve’s quantum system Eis denoted by χ(Y ;E). We suppose that the quantumchannel connecting Alice to Bob is not known, satisfiesthe assumptions given in Section III, and can only bepartially estimated from X and the measurement out-comes Y on Bob’s side, as we discuss in Section V. Thislack of knowledge is an advantage to Eve. Therefore, theinequality in (17) features an optimization of the Holevoinformation χ(Y ;E) over all isometric quantum channelsUA→BE of Eve that are compatible with Alice’s and Bob’sdata. Let S denote the set of channels that are consis-tent with the measurement data. We discuss the precisemeaning of this statement in Section V. We also supposethat reverse reconciliation [56] is being used in the key-generation protocol, in which the public classical com-munication is from Bob to Alice, and this accounts forBob’s variable Y appearing in the χ(Y ;E) term in (17).

To calculate the lower bound in (17), we first needto calculate the Shannon mutual information I(X;Y ),

5

which can be easily obtained from the observed data ofAlice and Bob. The main difficulty is then to performthe optimization over the isometric quantum channelsUA→BE of Eve and to bound the Holevo informationχ(Y ;E) from above. Doing so is the main bottleneckfor many security proofs in quantum key distribution.

For protocols involving Gaussian modulation of coher-ent states, the aforementioned problem was solved in[57, 58], with [57] relying on the techniques of [59]. Theoptimal attack by Eve for such protocols was proved tobe a Gaussian attack, which considerably simplifies thesecurity analysis. However, once we consider discrete-modulation protocols, the optimal attack by Eve is nolonger known, and is unlikely to be Gaussian. To ad-dress this problem, novel techniques are required.

In this paper, we provide a security proof for the proto-col described in Section II by employing various existingtools: the approximation of Gaussian distributions withdiscrete ones [44, 45], an entropic continuity bound from[46], and the optimality of Gaussian attacks for Gaussianmodulation of coherent states [57, 58]. The approach thatwe employ in this paper is rather intuitive: we approxi-mate the Gaussian distribution with a discrete distribu-tion and bound the error introduced due to this approx-imation in trace norm, by employing the techniques of[44, 45]. Then, we expect Eve’s Holevo information dueto this approximation to be close to Eve’s Holevo infor-mation resulting from a Gaussian-modulated protocol,with the absolute value of the difference being a functionof the error introduced in the approximation.

We now discuss this approach in detail. First, considera key-generation protocol that employs coherent stateswith Gaussian modulation. The expected density opera-tor for Alice’s transmitted state is a thermal state θ(NS)with mean photon number NS ≥ 0:

θ(NS) ≡ 1

NS + 1

∞∑n=0

(NS

NS + 1

)n|n〉〈n|. (18)

The P -function of the thermal state θ(NS) is a circu-larly symmetric complex Gaussian [60]. Following theapproach of [45], we can approximate the real and imag-inary parts of the circularly symmetric Gaussian by thevarious constellations considered in [44]: Gauss-Hermite,random walk, equilattice, and quantile. The type of con-stellation fixes |αx〉 and r(x). In this paper, we focusexclusively on the Gauss-Hermite constellation. It is pos-sible to consider other constellations and obtain securityproofs for these other constellations using the techniquesdescribed below. We obtain the error introduced by thisapproximation, by employing bounds from [45], and thenwe apply an entropic continuity bound from [46] to obtainan upper bound on Eve’s Holevo information χ(Y ;E).

We now discuss our security proof for discrete-modulation protocols of the form presented in Sec-tion II. Suppose that Alice employs the following discrete-modulation ensemble of coherent states:

{r(x), |αx〉}m2

x=1, (19)

with expected density operator:

ρ ≡m2∑x=1

r(x)|αx〉〈αx|. (20)

Then depending on the constellation size m2 and themean photon number NS of the thermal state being ap-proximated, we obtain the following bound on the nor-malized trace distance:

1

2‖ρ− θ(NS)‖1 ≤ ε(m,NS), (21)

where θ(NS) is a thermal state of mean photon numberNS and ε(m,NS) is the approximation error, for whichwe determine an explicit characterization later in (100),by employing the techniques of [45].

The secret-key rate with reverse reconciliation is givenby

βI(X;Y )− χ(Y ;E), (22)

where β is the reconciliation efficiency [61] and the mu-tual information quantities are computed with respect tothe following ensemble:

{r(x, y), ρx,yE }x,y, (23)

where

r(x, y) ≡ r(x)r(y|x), (24)r(y|x) ≡ Tr{(ΛyB ⊗ IE)UA→BE(|αx〉〈αx|A)}, (25)

ρx,yE ≡ 1

r(y|x)TrB{(ΛyB ⊗ IE)UA→BE(|αx〉〈αx|A)},

(26)

with {Λy}y denoting Bob’s POVM and UA→BE the iso-metric channel satisfying the assumptions of Section IIIand corresponding to the collective attack of Eve. Sincewe do not know what collective attack Eve will employ,we minimize the secret-key rate with respect to all col-lective attacks that are consistent with the measurementdata observed by Alice and Bob, i.e., with respect to allisometric channels UA→BE satisfying the assumptions ofSection III and in the set S. It is possible to estimatethe Shannon mutual information I(X;Y ) from the mea-surement data of Alice and Bob, but we are left with thefollowing optimization problem for Eve’s Holevo informa-tion:

supUA→BE∈S

χ(Y ;E)Eρ , (27)

where the optimization is with respect to all collectiveattacks of Eve consistent with the measurement data ofAlice and Bob, and the subscript notation Eρ indicatesthat the Holevo information χ(Y ;E) between Bob’s mea-surement outcome and Eve’s quantum system is beingcomputed with respect to the following ensemble:

Eρ ≡ {r(y), ρyE}, (28)

6

where

r(y) ≡∑x

r(x, y), (29)

ρyE ≡∑x

r(x|y)ρx,yE

=∑x

r(x|y)

r(y|x)TrB{(ΛyB ⊗ IE)UA→BE(|αx〉〈αx|A)}

=1

r(y)TrB{(ΛyB ⊗ IE)UA→BE(ρA)}. (30)

From the data processing inequality for trace distance(under the action of the isometric channel UA→BE andBob’s measurement channel), we find that

ε ≥ 1

2‖ρ− θ(NS)‖1 (31)

≥ 1

2

∫dy∥∥r(y)ρyE − r

G(y)θyE(NS)∥∥

1, (32)

where

rG(y) ≡ Tr{(ΛyB ⊗ IE)UA→BE(θ(NS))}, (33)

θyE(NS) ≡ 1

rG(y)TrB{(ΛyB ⊗ IE)UA→BE(θ(NS))}. (34)

We then define the following ensemble as that whichwould arise had Alice employed a Gaussian modulationat the channel input:

Eθ = {rG(y), θyE}. (35)

At this point, we invoke the fourth assumption fromSection III: if the mean energy of the input state to thechannel TrB ◦UA→BE is fixed at some finite mean pho-ton number κ ∈ [0,∞), then the mean energy of theoutput state is no larger than κ′(κ) ∈ [0,∞). Supposingthat HE is the Hamiltonian for Eve’s system E satisfyingthe properties stated in the fourth assumption from Sec-tion III, by applying the continuity bound given in [46,Proposition 27], we find that

χ(Y ;E)Eρ ≤ χ(Y ;E)Eθ + f(ε, P ), (36)

where P is an upper bound on the mean energy of thestates TrB ◦UA→BE(ρA) and TrB ◦UA→BE(θ(NS)) andf(ε, P ) is a function of ε and P , given in [46], with theproperty that

limε→0

f(ε, P ) = 0. (37)

In particular, the function f(ε, P ) is given by

f(ε, P ) ≡ ε (2t+ rε(t))S(θE(P/εt))

+ 2g(εrε(t)) + 2h(εt), (38)

for any t ∈ (0, 12ε ], where

rε(t) ≡ (1 + t/2)/(1− εt), (39)

g(x) ≡ (x+ 1) log2(x+ 1)− x log2(x), (40)h(x) ≡ −x log2(x)− (1− x) log2(1− x), (41)

and S(θE(P/εt)) is the entropy of a thermal stateθE(P/εt) of Eve’s system with mean energy P/εt. Dueto this uniform bound, we can then apply suprema tofind that

supUA→BE∈S

χ(Y ;E)Eρ ≤ supUA→BE∈S

χ(Y ;E)Eθ + f(ε, P ),

(42)with the optimizations again taken with respect to col-lective attacks of Eve consistent with the measurementdata of Alice and Bob. The lower bound on the key rateis then given as

K ≥ I(X;Y )− supUA→BE∈S

χ(Y ;E)Eθ − f(ε, P ). (43)

The Shannon mutual information between X and Y ,i.e., the term I(X;Y ), can be calculated from the ob-served data, as mentioned previously. The term f(ε, P ),introduced due to the continuity of Holevo informa-tion, can be estimated from (38). Obtaining an up-per bound on the remaining term, the Holevo informa-tion supUA→BE∈S χ(Y ;E)Eθ , still requires further devel-opment, which we detail in the next section.

V. CHANNEL ESTIMATION

The main objective of this section is to obtain anupper bound on the remaining term, the Holevo infor-mation supUA→BE∈S χ(Y ;E)Eθ . The approach that wetake to obtain an upper bound can be divided into threeparts: estimation of parameters from the actual proto-col described in Section II, using these to bound theparameters that would result if a Gaussian-modulationprotocol had been employed instead, and finally usingthese last estimates to bound the Holevo informationsupUA→BE∈S χ(Y ;E)Eθ from above.

A. Estimation of parameters from the actualdiscrete-modulation protocol

Alice and Bob calculate the parameters γ11, γ12, andγ22 given in (3)–(5) or in (7)–(9), depending on Bob’smeasurement, as described in Section II. Then the set Sdiscussed in Section IV consists of all of the isometricchannels UNA→BE that are consistent with the calculatedvalues of γ11, γ12, and γ22. In this way, Alice and Bobcharacterize the attack by Eve.

Since we are operating in the asymptotic regime, suchthat the number n of rounds is large, it follows that thenumber δn of channel estimation rounds is also large.Additionally, since Eve is employing a collective attackand the protocol has an i.i.d. structure, it follows thatthe parameters γ11, γ12, and γ22 are given exactly as theexpectation of particular random variables.

7

To determine these random variables, we now give ex-act expressions for the constellation {αx}m

2

x=1 and distri-bution rX(x) that are used in the protocol. We begin byrecalling the Gauss-Hermite approximation to the nor-mal distribution with zero mean and unit variance, whichreproduces the first 2m−1 moments of the Gaussian dis-tribution [62, Section 3.6]. Let Hm be the mth Hermitepolynomial, and let Lm be a random variable with mrealizations lwm, with probability distribution given byrLm(lwm), where w ∈ {1, 2, . . . ,m}. Then, as definedin [44], the values lwm are set to the roots of the Her-mite polynomial Hm, and the probability distributionrLm(lwm) is defined as

rLm(lwm) ≡ (m− 1)!

mH2m−1(lwm)

. (44)

The P -function of a thermal state with mean photonnumber NS is a circularly symmetric complex Gaussian[60]. Following [45], we approximate the real and imag-inary parts of the thermal-state P -function individuallyby the constellation described above. Specifically, wechoose qwm for w ∈ {1, . . . ,m} such that the sequence{qwm/

√NS}w is equal to the zeros of the Hermite poly-

nomial Hm, and we choose ptm for t ∈ {1, . . . ,m} suchthat the sequence {ptm/

√NS}t is equal to the zeros of

the Hermite polynomial Hm. Then the constellation isgiven by the following distribution:

rX(x) = rX(αx) (45)

= rX

(qwm + iptm√

2

)(46)

= rLm

(qwm√NS

)rLm

(ptm√NS

)(47)

≡ rQA(qwm) rPA(ptm), (48)

where x = (w, t) ∈ {1, . . . ,m} × {1, . . . ,m}. The factor√NS is a scaling factor incorporated so that the mean

photon number of the expected density operator for theresulting constellation is equal to the mean photon num-ber of the thermal state θ(NS). The phase space dis-tribution for several discrete modulated states is give inFigure 1.

Let QA denote the discrete random variable with re-alizations qA ∈ R, taking values qwm and having a prob-ability distribution as detailed above. Let QB denotethe random variable associated to Bob’s homodyne mea-surement outcome of the position-quadrature operator,taking values in R. Then, for characterizing the isomet-ric channels UA→BE in S, Alice and Bob calculate theparameters γ11, γ12, and γ22 from their data. Due to thefact that we are operating in the asymptotic regime (withno finite-size statistical effects), the following equalitieshold for protocols with homodyne detection

γ11 = E[(QA − E[QA])2

], (49)

γ12 = E [(QA − E[QA])(QB − E[QB ])] , (50)

γ22 = E[(QB − E[QB ])2

]. (51)

Now consider the discrete-modulation protocols withheterodyne detection. Let QA denote the discrete ran-dom variable with realizations qA ∈ R, taking values qwmand having a probability distribution as detailed above.Let PA denote the discrete random variable with realiza-tions pA ∈ R, taking values pwm and having a probabil-ity distribution as detailed above. Let QB denote therandom variable associated to Bob’s heterodyne mea-surement outcome of the position-quadrature operator,taking values in R. Let PB denote the random variableassociated to Bob’s heterodyne measurement outcome ofthe momentum-quadrature operator, taking values in R.Then, in the asymptotic regime the following equalitieshold for protocols with heterodyne measurement

γ11 = E[(QA − E[QA])2

]= E

[(PA − E[PA])2

], (52)

γ12 =1

2

(E [(QA − E[QA])(QB − E[QB ])] +

E [(PA − E[PA])(PB − E[PB ])]), (53)

γ22 =1

2

(E[(QB − E[QB ])2

]+ E

[(PB − E[PB ])2

]).

(54)

Due to the symmetry of the protocol, (53) and (54) canbe simplified as

γ12 = E [(QA − E[QA])(QB − E[QB ])] , (55)

γ22 = E[(QB − E[QB ])2

]. (56)

As stated previously, Alice estimates γ11 from her prepa-ration data, while Bob estimates γ22 from his measure-ment data. Alice calculates γ12 from the data that ispublicly published by Bob. Then S is the set of isomet-ric channels UA→BE that fulfill the constraints in Sec-tion III and produce the observed values of γ12 and γ22.As a consequence, Alice and Bob deduce that the attackby Eve yields the observed values of γ12 and γ22. In thisway, they are able to restrict the possible attacks thatcould have been performed by Eve.

B. Estimation of parameters for a hypotheticalGaussian-modulation protocol

Now notice that the remaining Holevo informationsupUA→BE∈S χ(Y ;E)Eθ from (43) that we want to boundfrom above is calculated for a thermal state θ(NS) sentover an isometric channel UA→BE in the set S and Bobperforming homodyne or heterodyne detection. There-fore, we want to obtain an estimate of the parametersγG11, γG12, and γG22, which are defined analogously to (49)–(51), but with the initial random variable QA replaced bya Gaussian random variable with mean zero and varianceequal to NS . The parameters γG11, γG12, and γG22 are thosethat would be observed in a Gaussian modulation pro-tocol when the average channel input of Alice is a ther-

8

-3 -2 -1 0 1 2 3-3

-2

-1

0

1

2

3

x

p

m=10, Ns=0.5

0.020.040.060.080.100.120.14

(a)

-3 -2 -1 0 1 2 3-3

-2

-1

0

1

2

3

x

p

m=20, Ns=0.5

0.020.040.060.080.100.120.14

(b)

-3 -2 -1 0 1 2 3-3

-2

-1

0

1

2

3m=20, Ns=0.05

0.020.040.060.080.100.120.14

(c)

-3 -2 -1 0 1 2 3-3

-2

-1

0

1

2

3

x

p

m=2, Ns=0.5

0.020.040.060.080.100.120.14

(d)

FIG. 1. In this figure, we plot the phase space distribution for the discrete modulation state ρ̄. (a) M = 10, Ns = .5 (b)M = 20, Ns = .5 (c) M = 20, Ns = .05 (d) M = 2, Ns = .5.

mal state θ(NS) instead of ρ. A hypothetical Gaussian-modulation protocol refers to a protocol in which theaverage state that Alice sends is a thermal state θ(NS)instead of ρ. This protocol is not carried out by Aliceand Bob experimentally, but the parameters γG11, γ

G12, γ

G22

corresponding to the hypothetical Gaussian modulationprotocol are inferred from the discrete-modulation pro-tocol.

In order to bound the values of the parameters thatwould be obtained in a Gaussian-modulation protocolwith Eve’s attack taken from the set S, we can em-ploy the parameters that are observed in the discrete-modulation protocol. Before we do so, let us recall thedefinition of the χ2 divergence of two states ρ and σ asχ2(ρ, σ) ≡ Tr

[(ρσ−1/2)2

]− 1 [63]. Then we have the

following proposition:

Proposition 1 Let ρ =∑x rX(x) |αx〉〈αx|, where

αx =qA + ipA√

2, (57)

rX(x) = rQA(qA) rPA(pA), (58)

θNS =

∫dx rGX(x) |αx〉〈αx| , (59)

and rG(x) is the P -function of a thermal state with meanphoton number NS. If

√χ2(ρ, θ(NS)) ≤ ε2, and Eve’s

attacks fulfill the constraints in Section III, then

γ11 = γG11, (60)

|γ22 − γG22| ≤ ε1, (61)

|γ12 − γG12| ≤ ε2, (62)

where

ε1 ≡ ε · (1 + c1) ·√E [(QB − E[QB ])4], (63)

for some constant c1 > 0 and

ε2 ≡2m−2∑k=0

K∑l=2m

µkl∣∣ηG(qA, k + 1)

(ηG(pA, l)− η(pA, l)

)∣∣+

K∑k=2m−1

2m−1∑l=0

µkl∣∣ηG(pA, l)

(ηG(qA, k + 1)− η(qA, k + 1)

)∣∣+

K∑k=2m−1,l=2m

µkl∣∣ηG(pA, l)η

G(qA, k + 1)−

η(pA, l)η(qA, k + 1)| , (64)

where µkl is an arbitrary function for k ≤ 2m − 2, l ≤2m−1 and is equal to exp(−a(k + l)) otherwise. We alsodefine the following quantities

ηG(qA, k) ≡ ErGQA [QkA], (65)

9

η(qA, k) ≡ ErQA [QkA], (66)

ηG(pA, k) ≡ ErGPA [P kA], (67)

η(pA, k) ≡ ErPA [P kA]. (68)

Our proof of (61) relies mainly on the properties oftrace distance, invoking the Cauchy–Schwarz inequalityand the assumption that the fourth moment of the chan-nel output is bounded. Our proof of (62) relies mainly onthe properties of Gauss-Hermite distribution, and on thelast assumption in Section III. For details, please refer toAppendix A. By invoking Proposition 1, we conclude thatγG22 ∈ [γ22 − ε1, γ22 + ε1], and γG12 ∈ [γ12 − ε2, γ12 + ε2],where ε1 and ε2 are defined above.

Now, consider the following scenario corresponding toan entanglement-based (EB) QKD protocol: Alice pre-pares a two-mode squeezed vacuum state ψ(n̄)RA =|ψ(n̄)〉〈ψ(n̄)|RA where

|ψ(n̄)〉RA ≡1√n̄+ 1

∞∑n=0

√(n̄

n̄+ 1

)n|n〉R |n〉A , (69)

with n̄ ≥ 0. She applies a phase e−in̂πk/2 to her channelinput mode A, with k ∈ {0, 1, 2, 3} selected uniformlyat random, and she sends the system A to Bob over anisometric channel UNA→BE selected from the set S. Shealso communicates k to Bob over an authenticated pub-lic classical channel. Bob then applies the inverse phasee−in̂πk/2. Both Alice and Bob then discard the value of k.Let ρRB denote the state shared by Alice and Bob at theend, so that the reduced channel NA→B has been phasesymmetrized due to the protocol above and with NA→Bdefined as in (2):

ρRB ≡ NA→B(ψ(n̄)RA). (70)

Due to the symmetries of the two-mode squeezed vacuumstate ψ(n̄)RA as well as those of the phase-symmetrizedchannel NA→B , it follows that the covariance matrix ofthe state ρRB has the following form:[

γEB11 I2 γEB

12 R(θ)γEB

12 R(θ) γEB22 I2

], (71)

where γEB11 , γ

EB12 , γ

EB22 ∈ R such that the matrix above is

a legitimate quantum covariance matrix [64], the matrixI2 is the 2× 2 identity matrix, and

R(θ) ≡[cos(θ) sin(θ)sin(θ) − cos(θ)

], (72)

is a rotation matrix. See Appendix B for a proof of thisclaim. In what follows, we assume that θ = 0, due tothe fact that doing so simplifies the protocol, as well asreduces the number of parameters that need to be esti-mated, and it furthermore does not lead to an increase inEve’s Holevo information, as discussed in [25]. Alice thenperforms a heterodyne measurement on mode R and Bobperforms a homodyne or a heterodyne measurement on

mode B. As mentioned above, this is the entanglement-based (EB) version of the Gaussian-modulated prepare-measure (PM) protocol with the attacks by Eve con-strained to the set S.

Now, we want to deduce the parameters γEB11 , γ

EB12 , γ

EB22

observed in the EB protocol from the parametersγG11, γ

G12, γ

G22 observed in the PM version of the Gaussian

modulation protocol. As is common in the CV-QKD lit-erature, we consider the EB protocol because it is helpfulin analyzing the Holevo information χ(Y ;E) that resultsin the prepare-measure (PM) protocol. The “PM to EB”mapping of the parameters is well known in the litera-ture [65] and is given as follows for protocol where Bobperforms homodyne detection:

γEB11 = γG11 + 1 = γ11 + 1, (73)

γEB22 = γG22 ∈ [γ22 − ε1, γ22 + ε1] , (74)

γEB12 =

√γ11 + 2

γ11γG12

∈[√

γ11 + 2

γ11(γ12 − ε2),

√γ11 + 2

γ11(γ12 + ε2)

].

(75)

For protocols where Bob performs heterodyne detectionthe “PM to EB" mapping of the parameters is given by

γEB11 = γG11 + 1 = γ11 + 1, (76)

γEB22 = 2γG22 − 1 ∈ [2γ22 − 1− ε1, 2γ22 − 1 + ε1] , (77)

γEB12 =

√2(γ11 + 2)

γ11γG12

∈

[√2(γ11 + 2)

γ11(γ12 − ε2),

√2(γ11 + 2)

(γ11(γ12 + ε2)

].

(78)

Let Σ denote the set of quantum states ρRB that havecovariance matrix of the following form:[

γEB11 I2 γEB

12 σZγEB

12 σZ γEB22 I2

]. (79)

C. Upper bound on Eve’s Holevo information

By applying purification techniques of quantum infor-mation theory, the following equality holds

χ(Y ;E)Eθ = H(RB)ρ −H(R|Y ){p(y),ρy}y , (80)

for ρRB the state in (70) and {p(y), ρyR}y the ensem-ble resulting from Bob performing a position-quadraturehomodyne detection, or a heterodyne detection onthe state ρRB . As a consequence, the task of ob-taining an upper bound on supUA→BE∈S χ(Y ;E)Eθ canbe accomplished by obtaining an upper bound onsupρRB∈Σ

(H(RB)ρ −H(R|Y ){p(y),ρy}y

).

10

We then invoke the extremality of Gaussian states[57, 59], from which we infer that the Holevo informa-tion is optimized by a Gaussian state ρGRB having thesame covariance matrix as ρRB . Therefore, we obtainthe following:

supρRB∈Σ

(H(RB)ρ −H(R|Y ){p(y),ρy}

)= supρGRB∈Σ

(H(RB)ρG −H(R|Y ){pG(y),ρy,G}

), (81)

where {pG(y), ρy,GR } is the ensemble obtained if Bob per-forms a homodyne/heterodyne measurement on mode Bof ρGRB .

Then, Eve’s Holevo information can be calculated asfollows:

H(RB)ρG −H(R|Y ){pG(y),ρy,G}

= g(ν1) + g(ν2)− g(ν3), (82)

where the function g(·) is defined in (40), ν1 and ν2 arethe symplectic eigenvalues of the covariance matrix in(79). For protocols where Bob performs homodyne de-

tection, ν3 = γEB11

(γ11 −

(γEB12 )

2

γEB22 +1

). For protocols where

Bob performs heterodyne detection, ν3 = γEB11 −

(γEB22 )2

γEB12 +1

.Numerical checks, similar to those performed and statedin [25], reveal that the Holevo information is a monoton-ically decreasing function of γEB

12 , and a monotonicallyincreasing function of γEB

11 and γEB22 . Intuitively, the cor-

relations between Alice and Bob are quantified by γEB12 ,

so that increasing this parameter decreases Eve’s Holevoinformation.

Therefore, we conclude that the Holevo information forprotocols where Bob performs homodyne detection is nolarger than that achieved by a Gaussian state ρRB thathas a covariance matrix as follows: (γ11 + 1)I

√γ11+2γ11

(γ12 − ε2)σZ√γ11+2γ11

(γ12 − ε2)σZ (γ22 + ε1)I

. (83)

The Holevo information for protocols where Bobperforms heterodyne detection is no larger than thatachieved by a Gaussian state ρRB that has a covariancematrix as follows: (γ11 + 1)I

√2(γ11+2)γ11

(γ12 − ε2)σZ√2(γ11+2)γ11

(γ12 − ε2)σZ (2γ22 − 1 + ε1)I

.(84)

With this, we conclude our goal of obtaining an upperbound on the remaining term supUA→BE∈S χ(Y ;E)Eθ .

In Appendix C, we give an alternative method to upperbound the Holevo information supUA→BE∈S χ(Y ;E)Eρ in(42). The proposed method does not depend on the pa-rameters c1,K and a; however, it seems to be numericallyintensive.

VI. NUMERICAL RESULTS FOR A LOSSYTHERMAL BOSONIC CHANNEL

We now proceed with calculating the various terms in(43) for a Gauss-Hermite constellation of size m2 andfor a lossy thermal bosonic channel of transmissivityη ∈ [0, 1] and NB ≥ 0. This allows for determining theperformance of the discrete-modulation CV-QKD proto-col when the underlying channel is a lossy thermal chan-nels (however, keep in mind that Alice and Bob are notaware of this when executing the protocol).

The first term that we need to calculate is the Shan-non mutual information I(X;Y ). Here, X is a randomvariable that encodes the choice of coherent state, and Yis the random variable that is associated with the mea-surement result. For discrete-modulation protocols withhomodyne detection and the underlying channel as thepure-loss channel, we use the following approach: TheWigner function associated with the coherent state |αx〉subjected to a pure-loss channel with transmissivity η isgiven as

Wαxy,p =

1

πexp{− |z −√ηαx|2

}, (85)

where z = qB + ipB , with the real part qB correspond-ing to the position-quadrature phase-space variable, andthe imaginary part pB corresponding to the momentum-quadrature phase-space variable. Bob performs homo-dyne detection with respect to the qB quadrature, whichprovides the raw data for key generation. Then the var-ious probability distributions are given as

rX(x) = QNS ,m(αx), (86)

rY |X(qB |x) =

∫ ∞−∞

dpB WαxqB ,pB , (87)

rY (qB) =∑x

rX(x)rY |X(qB |x). (88)

With this information in hand, it is easy to calculateI(X;Y ) = H(Y )r − H(Y |X)r. Now, let us calculateI(X;Y ) for the discrete modulation protocols with het-erodyne detection. Alice sends a coherent state charac-terized by |αx〉 through a thermal channel characterizedby η andNB . After the transmission, Bob has a displacedthermal state with the mean vector r̄final and covariancematrix σfinal. These can be written as

r̄final =√η r̄coherent =

√η[√

2qwm,√

2ptm

]T, (89)

σfinal = η σcoherent + (1− η)(2NB + 1)I2= η I2 + (1− η)(2NB + 1)I2, (90)

where r̄coherent is the mean vector and σcoherent is the co-variance matrix of the coherent state |αx〉 =

∣∣∣ qwm+iptm√2

⟩.

Then the various probability distributions are given as

rY |X(qb, pb|qwm, ptm) =exp[− (qb−

√2qwm)2−(pb−

√2ptm)2

2(1−NB(1−η))

]π√

Det [2(1−NB(1− η))I2]

(91)

11

● Gaussian ■ m2=400 ◆ m

2=900

▲ m2=2500 ▼ m

2=4900 ○ m2=8100

●●

●●

●●

●●

●●

●●

●●

●●

●●

●●

●●

●●

●●

●●

●●

●●

●●

●●

●●

●

●

■■

■■

■■

■■

■■

■■

■■

■■

■■

■■

■■

■■

■■

■■

■■

■■

■■

■■

■■

■■

◆◆

◆◆

◆◆

◆◆

◆◆

◆◆

◆◆

◆◆

◆◆

◆◆

◆◆

◆◆

◆◆

◆◆

◆◆

◆◆

◆◆

◆◆

◆◆

◆◆

▲▲

▲▲

▲▲

▲▲

▲▲

▲▲

▲▲

▲▲

▲▲

▲▲

▲▲

▲▲

▲▲

▲▲

▲▲

▲▲

▲▲

▲▲

▲▲

▲▲

▼▼

▼▼

▼▼

▼▼

▼▼

▼▼

▼▼

▼▼

▼▼

▼▼

▼▼

▼▼

▼▼

▼▼

▼▼

▼▼

▼▼

▼▼

▼▼

▼

▼

○○

○○

○○

○○

○○

○○

○○

○○

○○

○○

○○

○○

○○

○○

○○

○○

○○

○○

○○

○

○

0 5 10 15 20 25

10-4

0.001

0.010

0.100

1

Loss in dB

Rate

FIG. 2. In this figure, we plot the lower bounds on the key rates for various constellation size m2 of the discrete-modulationprotocol considered in Section II with the underlying channel as a lossy bosonic channel

rY (qb, pb) =∑

qwm,ptm

rX(qwm, ptm)rY |X(qb, pb|qwm, ptm).

(92)

With this information, we can easily calculate I(X;Y ).Numerically, we find that I(X;Y ) calculated from theabove method is approximately equal to the I(X;Y ) thatwe obtain from a Gaussian modulation protocol with theunderlying channel as thermal channel. We invoke thisapproximation in the numerics. This approximation hasbeen proven rigorously in [45].

The second term that we need to calculate is theHolevo information supUA→BE∈S χ(Y ;E)Eθ for a key-generation protocol that uses Gaussian modulation ofcoherent states and homodyne/heterodyne detection. Tothis end, we need to calculate the parameters γ11, γ22,and γ12 for the discrete-modulation protocol in order toobtain the covariance matrix in (83) or in (84). These canbe calculated numerically. However, note that θ(NS) andρ have the same covariance matrix due to the second mo-ment of the Gauss-Hermite approximation and Gaussiandistribution being the same. Since we are consideringthe underlying channel as a lossy thermal bosonic chan-nel, we can calculate the parameters γ22 and γ12 usingthe analytical formulas given in Section 7 of [65]. Fromthe values of γ12 and γ22 we now have to estimate theparameters γG12 and γG22. To this end, we apply Proposi-tion 1. When applying Proposition 1, it is necessary tomake a choice for the parameters c1, a and K. In our ex-ample considered here, we take the conservative choices

c1 = 100, K = 104, and a = 5.Next, we have to calculate the third term, which is

the error introduced in the Holevo information χ(Y ;E)and denoted by f(ε,N ′S) in (43). To this end, we firstcalculate the approximation error ε defined in (21). Fol-lowing [45], we use the χ2-distance, defined as χ2(ρ, σ) ≡Tr[(ρσ−1/2)2]− 1, and we employ the bound ‖ρ− σ‖21 ≤χ2(ρ, σ), which follows from Lemma 5 of [63] with k =1/2.

Let us denote an additive white Gaussian noise channelwith signal to noise ratio s by Ws. The action of Ws isdefined as Ws(Z) =

√sZ + G, where G is a normally

distributed random variable with unit variance. Then,for Z ∼ N (0, 1) with distribution PZ , a random variableZ ′m with distribution PZm as given in (44), Y = Ws(Z),and Y ′m = Ws(Z

′m), the χ2 distance is given as

χ2(PY ′

m, PY

)= 2κ2

∑k≥m

(s

1 + s

)2k

(93)

= 2κ2 (1 + s)2

1 + 2s

(s

1 + s

)2m

, (94)

with 2κ2 ≈ 2.36 [44].Let

ρm =

m2∑x=1

QNS ,m(αx) |αx〉〈αx| , (95)

and θNS be a thermal state of mean photon number NS .

12

● Gaussian ■ m2=400 ◆ m

2=900

▲ m2=2500 ▼ m

2=4900 ○ m2=8100

●

●

●

●

●●

●●

●●

●●

●●

●●

●●

●●

●●

●●

●●

●

●

●

●

●

■

■

■

■

■■

■■

■■

■■

■■

■■

■■

■■

■■

■■

■■

■■

■■

◆

◆

◆

◆

◆◆

◆◆

◆◆

◆◆

◆◆

◆◆

◆◆

◆◆

◆◆◆◆◆◆◆◆◆◆◆

◆◆

◆◆

◆◆

◆◆

▲

▲

▲

▲

▲▲

▲▲

▲▲

▲▲

▲▲

▲▲

▲▲

▲▲▲▲▲▲▲▲▲▲▲▲▲▲▲▲▲▲▲▲

▲▲

▲▲

▲▲

▲▲

▼

▼

▼

▼

▼▼

▼▼

▼▼

▼▼

▼▼

▼▼

▼▼

▼▼▼▼▼▼▼▼▼▼▼▼▼▼▼▼▼▼▼▼▼▼

▼▼

▼▼

▼▼

▼▼

▼

○

○

○

○

○○

○○

○○

○○

○○

○○

○○○○○○○○○○○○○○○○○○○○○○○

○○

○○

○○

○○

○○

○

0 2 4 6 8 10 12 1410-4

0.001

0.010

0.100

1

Loss in dB

Rate

NB=10-3

FIG. 3. In this figure, we plot the lower bounds on the key rate for various constellation size m2 of the discrete-modulationprotocol considered in Section II with the underlying channel as a lossy thermal bosonic channel with thermal noise NB = 10−3.

Then

χ2(ρm, θNS ) =(1 + χ2(PYm , PY )

)2 − 1, (96)

= (1 + τ)2 − 1 (97)= τ(2 + τ), (98)

with s = NS/(√

NS(NS + 1)−NS)[45] and

τ ≡ 2κ2 (1 +NS)

(NS√

NS(1 +NS)

)2m

. (99)

Combining (93) and (96), we obtain the following expres-sion for the approximation error:

1

2‖ρm − θNS‖1 ≤ ε =

1

2

√τ(2 + τ). (100)

We can then invoke [46, Proposition 27], which utilizessome techniques from [53], to obtain

f(ε,NS) = ε (2t+ rε(t)) g(P/εt)+2g(εrε(t))+2h(εt),(101)

for any t ∈ (0, 12ε ], where

rε(t) = (1 + t/2)/(1− εt), (102)

P = 107, (103)g(N) = (N + 1) log2(N + 1)−N log2(N), (104)h(x) = −x log2(x)− (1− x) log2(1− x). (105)

In the above, we have set P = 107, which is an ex-tremely conservative choice to employ with respect tothe fourth assumption on Eve’s attack discussed in Sec-tion III. We have also supposed that Eve’s system is aharmonic oscillator. Even though the mean photon num-ber of the average input state in all example cases thatwe consider in what follows is many orders of magnitudesmaller than P = 107 and the actual physical channelbeing employed is a pure-loss channel, we can still sup-pose that the mean energy of the eavesdropper’s statesis extremely large (way beyond what an eavesdropper

13

● Gaussian modulation ■ m2=400 ◆ m

2=900

▲ m2=2500 ▼ m

2=4900 ○ m2=8100

●

●

●

●

●

●●

●●

●●

●●

●●

●●

●●

●●

●●

●●

●●

●●

●●

●●

●●

●●

●●

●●

●●

●

●

●

●

●

■

■

■

■

■

■

■■

■■

■■

■■

■■

■■

■■

■■

■■

■■

■■

■■

■

■

◆

◆

◆

◆

◆

◆

◆◆

◆◆

◆◆

◆◆

◆◆

◆◆

◆◆

◆◆

◆◆

◆◆

◆◆

◆◆

◆◆

◆◆

◆◆

◆◆

◆

▲

▲

▲

▲

▲

▲▲

▲▲

▲▲

▲▲

▲▲

▲▲

▲▲

▲▲

▲▲

▲▲

▲▲

▲▲

▲▲

▲▲

▲▲

▲▲

▲▲

▲▲

▲

▲

▲

▼

▼

▼

▼

▼

▼▼

▼▼

▼▼

▼▼

▼▼

▼▼

▼▼

▼▼

▼▼

▼▼

▼▼

▼▼

▼▼

▼▼

▼▼

▼▼

▼▼

▼▼

▼▼

▼

▼

▼

○

○

○

○

○

○○

○○

○○

○○

○○

○○

○○

○○

○○

○○

○○

○○

○○

○○

○○

○○

○○

○○

○○

○○

○

○

0 5 10 15 20

10-4

0.001

0.010

0.100

1

Loss in dB

Rate

NB=10-4

FIG. 4. In this figure, we plot the lower bounds on the key rate for various constellation size m2 of the discrete-modulationprotocol considered in Section II with the underlying channel as a lossy thermal bosonic channel NB = 10−4.

might reasonably employ in an attack) and we find thatthe performance of the discrete-modulation protocols ap-proaches that of the Gaussian-modulation protocol rel-atively quickly as the constellation size m2 increases.One could choose an even more conservative value forP , higher than what we have taken. However, in ournumerics, we have found the same qualitative behavior:that the performance of the discrete-modulation proto-col rapidly approaches that of the Gaussian-modulationprotocol as the constellation size m2 increases.

With all these ingredients in hand, we can now nu-merically evaluate (43) to obtain a lower bound on thesecret-key rate for a lossy thermal bosonic channel withtransmissivity η and thermal noise as NB . We take thereconciliation efficiency β = 0.95. Note that the key ratesobtained from (43) have a dependence on the mean pho-ton number NS of the input state. Thus, to obtain tightlower bounds on the secret-key rate, we also optimizeover NS .

In Figure 2, we present the achievable key rates ob-tained from discrete-modulation protocol with homodyne

detection if the underlying channel is a pure-loss chan-nel. In Figures 3, and 4, we present the achievable keyrates from discrete-modulation protocol with heterodynedetection if the underlying channel is a thermal chan-nel. We plot lower bounds for various values of m2 andcompare the obtained lower bounds with the Gaussian-modulation protocol. It is clear that the secure key rateof the discrete-modulation protocol increases as the con-stellation size m2 increases.

As explained before, to obtain the lower bound onthe rates for pure-loss channel and thermal channel, weoptimize over the mean photon number NS . For theGaussian-modulation protocol, we find that the optimalvariance for secret-key rates decreases with the increasein loss. Now, the main idea behind the technique pre-sented in this paper is to discretize the Gaussian prob-ability distribution by a finite constellation of size m2

and calculate the error introduced due to this approxi-mation. We find that as the variance of the Gaussianmodulation increases, the number of constellation pointsrequired to approximate the distribution to an ε error

14

increases. Therefore, for low losses, this technique re-quires a large numberm2 of constellation points to closelymatch the secret key-rates obtained with Gaussian mod-ulation.

A consequence of the aforementioned reasoning is that,with our approach, the lower bound on the secret-keyrate does not tend to logm2 in the limit as η → 1.Certainly, in this limit, the Holevo information withEve tends to zero, and the key rate is then given asK ≥ I(X;Y ) − f(ε,N ′S). We numerically observe thatthe Shannon mutual information of Alice and Bob satu-rates towards logm2 with the increase in variance; how-ever, the approximation error f(ε,N ′S) increases with theincrease in variance. Due to this trade-off, our techniquedoes not achieve the ideal rate of logm2 rate in the low-loss and low-noise limit.

It is possible (and likely) that our rate lower boundscan be improved by other constellation choices or otherproof techniques. However, even with our proof, requir-ing a pair of electro-optic (phase and amplitude) modu-lators to generate a 90×90 size constellation size is muchmore practical and less demanding compared to askingthat we modulate a pulse with a complex amplitude to anextremely high floating point accuracy, which a Gaussianmodulation would need.

We should also point out that dark counts in detectorscan be modeled as thermal noise for lossy thermal bosonicchannels [66]. Thus, our numerics are also applicable toprotocols with imperfect detectors modeled in this way.

We note here that we have included in the arXiv post-ing of this paper the Mathematica files used to performthe numerical calculation of the key rates and to generatethe figures.

VII. CONCLUSION

In this paper, we have addressed an open problemin continuous-variable quantum key distribution (CV-QKD), by establishing a security proof for discrete-modulation protocols. Even though many experimentshave been performed on discrete-modulation CV-QKDwith multiple constellation points (see, e.g., [67–69]), nosecurity proofs have been available for them, and the ex-pected key-rate calculations previously reported basedon measured homodyne statistics have been based on

assuming Gaussian attacks, which are not known to beoptimal for discrete-modulation CV-QKD. We have in-troduced a discrete-modulation protocol and then ob-tained rigorous lower bounds on the secret-key rates, se-cure against physically reasonable collective attacks inthe asymptotic key-length regime. The approach thatwe have used works well in the high-loss regime, withthe secure key rates being close to the secure key ratesachievable with a Gaussian-modulation protocol. An-other prominent feature of our approach is that with theincrease in the size m2 of the constellation, the lowerbound on the secret-key rate approaches the key rate forthe Gaussian-modulation protocol. This result demon-strates that we need not consider the full continuum ofthe Gaussian distribution in order to obtain key ratesachievable with a Gaussian modulation, and we do notneed to rely on Gaussian modulation for security proofsof discrete-modulation CV-QKD protocols.

Going forward from here, it is a pressing open ques-tion to determine security proofs for discrete-modulationCV-QKD protocols in the non-asymptotic, or finite key-length, regime. It would also be ideal to improve thebound from Proposition 1 to reduce or eliminate its de-pendence on the parameters c1, a, andK. In this context,it might be possible to utilize the results presented in Ap-pendix C, but as mentioned previously, this approach isnumerically intensive.

ACKNOWLEDGMENTS

We are grateful to Hari Krovi for discussions aboutCV-QKD with discrete modulation. We are especiallygrateful to Anthony Leverrier for his critical reading ofthe initial version of our paper, for pointing out theneed for more details of the channel estimation proce-dure, and for the idea behind Eq. (162). We thankJeffrey H. Shapiro, Xiang-Bin Wang, and Cosmo Lupofor helpful feedback on our manuscript. This workwas supported by the Office of Naval Research pro-gram Communications and Networking with QuantumOperationally-Secure Technology for Maritime Deploy-ment (CONQUEST): Raytheon BBN Technologies primecontract number N00014-16-C2069, under subcontractsto Louisiana State University and University of Arizona.

[1] Charles H. Bennett and Gilles Brassard, “Quantum cryp-tography: Public key distribution and coin tossing,” In-ternational Conference on Computers, Systems & SignalProcessing, Bangalore, India, December 9-12, 1984 , 175–179 (1984).

[2] Artur K. Ekert, “Quantum cryptography based on Bell’stheorem,” Physical Review Letters 67, 661–663 (1991).

[3] Valerio Scarani, Helle Bechmann-Pasquinucci, Nico-

las J. Cerf, Miloslav Dusek, Norbert Lütkenhaus, andMomtchil Peev, “The security of practical quantum keydistribution,” Reviews of Modern Physics 81, 1301–1350(2009), arXiv:0802.4155.

[4] Won-Young Hwang, “Quantum key distribution withhigh loss: Toward global secure communication,” Phys-ical Review Letters 91, 057901 (2003), arXiv:quant-ph/0211153.

15

[5] Xiang-Bin Wang, “Beating the photon-number-splittingattack in practical quantum cryptography,” Physical Re-view Letters 94, 230503 (2005), arXiv:quant-ph/0410075.

[6] Hoi-Kwong Lo, Xiongfeng Ma, and Kai Chen, “Decoystate quantum key distribution,” Physical Review Letters94, 230504 (2005), arXiv:quant-ph/0411004.

[7] Liang Jiang, Jacob M. Taylor, Kae Nemoto, William J.Munro, Rodney Van Meter, and M. D. Lukin, “Quantumrepeater with encoding,” Physical Review A 79, 032325(2009), arXiv:0809.3629.

[8] Sreraman Muralidharan, Linshu Li, Jungsang Kim,Norbert Lütkenhaus, Mikhail D. Lukin, and LiangJiang, “Optimal architectures for long distance quan-tum communication,” Scientific Reports 6, 20463 (2016),arXiv:1509.08435.

[9] Saikat Guha, Hari Krovi, Christopher A. Fuchs, ZacharyDutton, Joshua A. Slater, Christoph Simon, and Wolf-gang Tittel, “Rate-loss analysis of an efficient quantumrepeater architecture,” Physical Review A 92, 022357(2015), arXiv:1404.7183.

[10] Mihir Pant, Hari Krovi, Dirk Englund, and SaikatGuha, “Rate-distance tradeoff and resource costs forall-optical quantum repeaters,” Physical Review A 95,012304 (2017), arXiv:1603.01353.

[11] Sreraman Muralidharan, Chang-Ling Zou, Linshu Li,and Liang Jiang, “One-way quantum repeaters withquantum Reed-Solomon codes,” Physical Review A 97,052316 (2018), arXiv:1801.06706.

[12] Masahiro Takeoka, Saikat Guha, and Mark M. Wilde,“Fundamental rate-loss tradeoff for optical quantum keydistribution,” Nature Communications 5, 5235 (2014),arXiv:1504.06390.

[13] S. Pirandola et al., Nat. Comm. 8, 15043 (2017).[14] Mark M. Wilde, Marco Tomamichel, and Mario Berta,

“Converse bounds for private communication over quan-tum channels,” IEEE Transactions on Information The-ory 63, 1792–1817 (2017), arXiv:1602.08898.

[15] Josephine Dias and Timothy C. Ralph, “Quantum re-peaters using continuous-variable teleportation,” Physi-cal Review A 95, 022312 (2017), arXiv:1611.02794.

[16] Fabian Furrer and William J. Munro, “Repeaters forcontinuous-variable quantum communication,” PhysicalReview A 98, 032335 (2018), arXiv:1611.02795.

[17] Kaushik P. Seshadreesan, Hari Krovi, and Saikat Guha,“A continuous-variable quantum repeater with quantumscissors,” Physical Review Research 2, 013310 (2020),arXiv:1811.12393.

[18] Quyen Dinh Xuan, Zheshen Zhang, and Paul L. Voss, “A24 km fiber-based discretely signaled continuous variablequantum key distribution system,” Optics Express 17,24244 (2009), arXiv:0910.1042.

[19] Xu-Yang Wang, Zeng-Liang Bai, Shao-Feng Wang, Yong-Min Li, and Kun-Chi Peng, “Four-state modulation con-tinuous variable quantum key distribution over a 30-kmfiber and analysis of excess noise,” Chinese Physics Let-ters 30, 010305 (2013).

[20] Duan Huang, Dakai Lin, Chao Wang, Weiqi Liu,Shuanghong Fang, Jinye Peng, Peng Huang, and Gui-hua Zeng, “Continuous-variable quantum key distribu-tion with 1 Mbps secure key rate,” Optics Express 23,17511 (2015).

[21] Xuyang Wang, Siyou Guo, Pu Wang, Wenyuan Liu, andYongmin Li, “Realistic rate–distance limit of continuous-variable quantum key distribution,” Optics Express 27,

13372 (2019).[22] Hui Liu, Wenyuan Wang, Kejin Wei, Xiao-Tian Fang,

Li Li, Nai-Le Liu, Hao Liang, Si-Jie Zhang, WeijunZhang, Hao Li, Lixing You, Zhen Wang, Hoi-KwongLo, Teng-Yun Chen, Feihu Xu, and Jian-Wei Pan,“Experimental demonstration of high-rate measurement-device-independent quantum key distribution over asym-metric channels,” Phys. Rev. Lett. 122, 160501 (2019),arXiv:1808.08584.

[23] Nathan Walk, Sara Hosseini, Jiao Geng, Oliver Thearle,Jing Yan Haw, Seiji Armstrong, Syed M. Assad,Jiri Janousek, Timothy C. Ralph, Thomas Symul,Howard M.Wiseman, and Ping Koy Lam, “Experimentaldemonstration of gaussian protocols for one-sided device-independent quantum key distribution,” Optica 3, 634(2016), arXiv:1405.6593.

[24] Frédéric Grosshans and Philippe Grangier, “Continuousvariable quantum cryptography using coherent states,”Physical Review Letters 88, 057902 (2002), arXiv:quant-ph/0109084.

[25] Anthony Leverrier, “Composable security proof forcontinuous-variable quantum key distribution with co-herent states,” Physical Review Letters 114, 070501(2015), arXiv:1408.5689.

[26] Nicolas J. Cerf, M. Lévy, and Gilles Van Assche, “Quan-tum distribution of Gaussian keys using squeezed states,”Physical Review A 63, 052311 (2001), arXiv:quant-ph/0008058.

[27] F. Furrer, T. Franz, Mario Berta, Anthony Leverrier,Volkher B. Scholz, Marco Tomamichel, and Reinhard F.Werner, “Continuous variable quantum key distribution:Finite-key analysis of composable security against co-herent attacks,” Physical Review Letters 109, 100502(2012), arXiv:1112.2179.

[28] Christian Weedbrook, Andrew M. Lance, Warwick P.Bowen, Thomas Symul, Timothy C. Ralph, andPing Koy Lam, “Quantum cryptography without switch-ing,” Physical Review Letters 93, 170504 (2004),arXiv:quant-ph/0405105.

[29] Anthony Leverrier, Raúl García-Patrón, Renato Ren-ner, and Nicolas J. Cerf, “Security of continuous-variablequantum key distribution against general attacks,” Phys-ical Review Letters 110, 030502 (2013), arXiv:1208.4920.

[30] Vladyslav C. Usenko and Frédéric Grosshans, “Uni-dimensional continuous-variable quantum key distri-bution,” Physical Review A 92, 062337 (2015),arXiv:1504.07093.

[31] Vladyslav C. Usenko and Radim Filip, “Feasibility ofcontinuous-variable quantum key distribution with noisycoherent states,” Physical Review A 81, 022318 (2010),arXiv:0904.1694.

[32] Christian Weedbrook, Stefano Pirandola, Seth Lloyd,and Timothy C. Ralph, “Quantum cryptography ap-proaching the classical limit,” Physical Review Letters105, 110501 (2010), arXiv:1004.3345.

[33] Jaromír Fiurasek and Nicolas J. Cerf, “Gaussian postse-lection and virtual noiseless amplification in continuous-variable quantum key distribution,” Physical Review A86, 060302 (2012), arXiv:1205.6933.

[34] Nathan Walk, Timothy C. Ralph, Thomas Symul, andPing Koy Lam, “Security of continuous-variable quantumcryptography with Gaussian postselection,” Physical Re-view A 87, 020303 (2013), arXiv:1206.0936.

[35] Timothy C. Ralph, “Continuous variable quantum cryp-

16

tography,” Physical Review A 61, 010303 (1999),arXiv:quant-ph/9907073.

[36] Margaret D. Reid, “Quantum cryptography with apredetermined key, using continuous-variable Einstein-Podolsky-Rosen correlations,” Physical Review A 62,062308 (2000), arXiv:quant-ph/9909030.

[37] T. Hirano, H. Yamanaka, M. Ashikaga, T. Konishi, andR. Namiki, “Quantum cryptography using pulsed homo-dyne detection,” Physical Review A 68, 042331 (2003),arXiv:quant-ph/0008037.

[38] Yi-Bo Zhao, Matthias Heid, Johannes Rigas, and Nor-bert Lütkenhaus, “Asymptotic security of binary modu-lated continuous-variable quantum key distribution un-der collective attacks,” Physical Review A 79, 012307(2009), arXiv:0807.3751.

[39] Kamil Brádler and Christian Weedbrook, “Security proofof continuous-variable quantum key distribution usingthree coherent states,” Physical Review A 97, 022310(2018), arXiv:1709.01758.

[40] Anthony Leverrier and Philippe Grangier, “Continuous-variable quantum key distribution protocols with a dis-crete modulation,” (2010), arXiv:1002.4083.

[41] Anthony Leverrier and Philippe Grangier, “Continuous-variable quantum-key-distribution protocols with a non-Gaussian modulation,” Physical Review A 83, 042312(2011), arXiv:1101.3008.

[42] Zhengyu Li, Yi-Chen Zhang, and Hong Guo, “User-defined quantum key distribution,” ArXiv:1805.04249.

[43] Denis Sych and Gerd Leuchs, “Coherent state quan-tum key distribution with multi letter phase-shiftkeying,” New Journal of Physics 12, 053019 (2010),arXiv:0902.1895.

[44] Yihong Wu and Sergio Verdú, “The impact of constella-tion cardinality on Gaussian channel capacity,” in 201048th Annual Allerton Conference on Communication,Control, and Computing (Allerton) (2010) pp. 620–628.

[45] Felipe Lacerda, Joseph M. Renes, and Volkher B. Scholz,“Coherent-state constellations and polar codes for ther-mal Gaussian channels,” Physical Review A 95, 062343(2017), arXiv:1603.05970.

[46] Maksim E. Shirokov, “Tight uniform continuity boundsfor the quantum conditional mutual information, for theHolevo quantity, and for capacities of quantum channels,”Journal of Mathematical Physics 58, 100202 (2017),arXiv:1512.09047.

[47] Paul Jouguet, Sébastien Kunz-Jacques, Eleni Diamanti,and Anthony Leverrier, “Analysis of imperfections inpractical continuous-variable quantum key distribution,”Physical Review A 86, 032309 (2012), arXiv:1206.6357.

[48] Shouvik Ghorai, Philippe Grangier, Eleni Diamanti, andAnthony Leverrier, “Asymptotic security of continuous-variable quantum key distribution with a discretemodulation,” Physical Review X 9, 021059 (2019),arXiv:1902.01317.

[49] Jie Lin, Twesh Upadhyaya, and Norbert Lütkenhaus,“Asymptotic security analysis of discrete-modulatedcontinuous-variable quantum key distribution,” PhysicalReview X 9, 041064 (2019), arXiv:1905.10896.

[50] The phase symmetrization performed in Steps 2-3 of theprotocol implies that Bob need only perform measure-ments in one quadrature. That is, the effect of phasesymmetrization is to symmetrize Eve’s attack evenly withrespect to both the position and momentum quadratures,and therefore a measurement of only one of the quadra-

tures suffices to detect Eve’s tampering. It is for this rea-son that we have elected to simplify the CV-QKD proto-col so that all of the homodyne measurements are con-ducted with respect to a single quadrature.

[51] Alexander S. Holevo, “Entanglement-assisted capacity ofconstrained channels,” Proceedings of SPIE, First Inter-national Symposium on Quantum Informatics 5128, 62–69 (2003), arXiv:quant-ph/0211170.

[52] Alexander S. Holevo, “Entanglement-assistedcapacities of constrained quantum channels,”Theory of Probability & Its Applications48, 243–255 (2004), arXiv:quant-ph/0211170,http://dx.doi.org/10.1137/S0040585X97980415.

[53] Andreas Winter, “Tight uniform continuity bounds forquantum entropies: Conditional entropy, relative en-tropy distance and energy constraints,” Communica-tions in Mathematical Physics 347, 291–313 (2016),arXiv:1507.07775.

[54] Igor Devetak and Andreas Winter, “Distillation of secretkey and entanglement from quantum states,” Proceedingsof the Royal Society A 461, 207–235 (2005), arXiv:quant-ph/0306078.

[55] Barbara Kraus, Nicolas Gisin, and Renato Renner,“Lower and upper bounds on the secret-key rate forquantum key distribution protocols using one-way classi-cal communication,” Physical Review Letters 95, 080501(2005), arXiv:quant-ph/0410215.

[56] Frédéric Grosshans and Philippe Grangier, “Reverse rec-onciliation protocols for quantum cryptography with con-tinuous variables,” Proceedings of the 6th InternationalConference on Quantum Communications, Measure-ment, and Computing (2002), arXiv:quant-ph/0204127.

[57] Raúl García-Patrón and Nicolas J. Cerf, “Uncondi-tional optimality of Gaussian attacks against continuous-variable quantum key distribution,” Physical Review Let-ters 97, 190503 (2006), arXiv:quant-ph/0608032.

[58] Miguel Navascués, Frédéric Grosshans, and AntonioAcín, “Optimality of Gaussian attacks in continuous-variable quantum cryptography,” Physical Review Let-ters 97, 190502 (2006), arXiv:quant-ph/0608034.

[59] Michael M. Wolf, Geza Giedke, and J. Ignacio Cirac,“Extremality of Gaussian quantum states,” Physical Re-view Letters 96, 080502 (2006), arXiv:quant-ph/0509154.

[60] Christopher Gerry and Peter Knight, Introductory Quan-tum Optics (Cambridge University Press, 2004).

[61] Jérôme Lodewyck, Matthieu Bloch, Raúl García-Patrón,Simon Fossier, Evgueni Karpov, Eleni Diamanti, ThierryDebuisschert, Nicolas J. Cerf, Rosa Tualle-Brouri,Steven W. McLaughlin, and Philippe Grangier, “Quan-tum key distribution over 25km with an all-fibercontinuous-variable system,” Physical Review A 76,042305 (2007), arXiv:0706.4255.

[62] J. Stoer and R. Bulirsch, Introduction to Numerical Anal-ysis (Springer New York, 2002).

[63] Kristan Temme, Michael J. Kastoryano, Mary BethRuskai, Michael M. Wolf, and Frank Verstraete, “Theχ2–divergence and mixing times of quantum Markovprocesses,” Journal of Mathematical Physics 51, 122201(2010), arXiv:1005.2358.

[64] Alessio Serafini, Quantum Continuous Variables (CRCPress, 2017).

[65] Fabian Laudenbach, Christoph Pacher, Chi-Hang FredFung, Andreas Poppe, Momtchil Peev, BernhardSchrenk, Michael Hentschel, Philip Walther, and Hannes

17

Hübel, “Continuous–Variable quantum key distribu-tion with Gaussian modulation–The theory of practicalimplementations,” Advanced Quantum Technologies 1,1800011 (2018), arXiv:1703.09278.

[66] Filip Rozpędek, Kenneth Goodenough, Jeremy Ribeiro,Norbert Kalb, Valentina Caprara Vivoli, Andreas Reis-erer, Ronald Hanson, Stephanie Wehner, and David Elk-ouss, “Parameter regimes for a single sequential quantumrepeater,” Quantum Science and Technology 3, 034002(2018), arXiv:1705.00043.

[67] Takuya Hirano, Tsubasa Ichikawa, Takuto Matsubara,Motoharu Ono, Yusuke Oguri, Ryo Namiki, Kenta Kasai,Ryutaroh Matsumoto, and Toyohiro Tsurumaru, “Im-

plementation of continuous-variable quantum key distri-bution with discrete modulation,” Quantum Science andTechnology 2, 024010 (2017).

[68] Zhen Qu and Ivan B. Djordjevic, “High-speed continuous-variable quantum key distribution over atmospheric tur-bulent channels,” Proceedings of SPIE 10118, 101180B(2017).

[69] Jiawei Li, Duan Huang, Cailang Xie, Ling Zhang,and Ying Guo, “Performance improvement of discrete-modulation continuous-variable quantum key distribu-tion by using the machine-learning-based detector,” inConference on Lasers and Electro-Optics (Optical Soci-ety of America, 2018) p. JTh2A.13.

A. PROOF OF PROPOSITION 1

In this appendix, we provide a proof of Proposition 1. We first restate it here for convenience.

Proposition 2 Let ρ =∑x rX(x) |αx〉〈αx|, where

αx =qA + ipA√

2, (106)

rX(x) = rQA(qA) rPA(pA), (107)

θNS =

∫dx rGX(x) |αx〉〈αx| , (108)

and rG(x) is the P -function of a thermal state with mean photon number NS. If√χ2(ρ, θ(NS)) ≤ ε2, and Eve’s

attacks fulfill the constraints in Section III, then

γ11 = γG11, (109)

|γ22 − γG22| ≤ ε1, (110)

|γ12 − γG12| ≤ ε2, (111)

where

ε1 = ε · (1 + c1) ·√E [(QB − E[QB ])4], (112)

(113)

for some constant c1 > 0 and

ε2 =

2m−2∑k=0

K∑l=2m

µkl∣∣ηG(qA, k + 1)

(ηG(pA, l)− η(pA, l)

)∣∣+

K∑k=2m−1

2m−1∑l=0

µkl∣∣ηG(pA, l)

(ηG(qA, k + 1)− η(qA, k + 1)

)∣∣+

K∑k=2m−1,l=2m

µkl∣∣ηG(pA, l)η

G(qA, k + 1)− η(pA, l)η(qA, k + 1)∣∣ , (114)

where µkl is an arbitrary function for k ≤ 2m− 2, l ≤ 2m− 1 and is equal to exp(−a(k + l)) otherwise. We also have

ηG(qA, k) = ErGQA [QkA], (115)

η(qA, k) = ErQA [QkA], (116)

ηG(pA, k) = ErGPA [P kA], (117)

η(pA, k) = ErPA [P kA]. (118)

18

Proof. For simplicity, we prove the claim under the assumption that all random variables have zero mean, and wenote that it can be generalized by adopting a shift of the variables involved in the proof.

To prove the equality in (109), consider the following: γ11 is equal to the variance of the position quadrature thatis encoded by Alice during the preparation procedure. Since we are using the Gauss-Hermite approximation of theGaussian for the encoding, for which the lower moments match those of the Gaussian distribution, it follows thatγ11 = γG11. To prove the inequality in (110), observe that

‖ρ− θ(NS)‖1 ≤√χ2(ρ, θ(NS)) ≤ ε2, (119)

implies that

‖N (ρ)−N (θ(NS))‖1 ≤ ε2. (120)

The inequality in (120) follows from data processing.Now let us define

rQB (qB) ≡∫ ∫

dx dpB WN ,αx(qB , pB)rX(x), (121)

rGQB (qB) ≡∫ ∫

dx dpB WN ,αx(qB , pB)rGX(x), (122)

where WN ,αx is the associated Wigner function for the state resulting from transmitting a coherent state over thechannel N . Let rQB |X(qB |x) ≡

∫dpBW

N ,αx(qB , pB) be the probability distribution obtained over the positionquadrature when the coherent state αx is sent over a channel N .

Then we have the following:∫dqB

∣∣rQB (qB)− rGQB (qB)∣∣ ≤ ‖N (ρ̄)−N (θ(NS))‖1 ≤ ε2, (123)

which is a consequence of monotonicity of trace distance and (119).We obtain the following:

|γG22 − γ22| =∣∣∣∣∫ dqB rGQB (qB) |qB |2 −

∫dqB rQB (qB) |qB |2

∣∣∣∣ (124)

=

∣∣∣∣∫ dqB[rGQB (qB)− rQB (qB)

]|qB |2

∣∣∣∣ (125)

=

∣∣∣∣∫ dqB

[√rGQB (qB)

√rGQB (qB)−

√rGQB (qB)

√rQB (qB) +

√rGQB (qB)

√rQB (qB)−

√rQB (qB)

√rQB (qB)

]|qB |2

∣∣∣∣(126)

≤∫dqB

∣∣∣∣√rGQB (qB)−√rQB (qB)

∣∣∣∣ √rGQB (qB) |qB |2 +

∫dqB

∣∣∣∣√rGQB (qB)−√rQB (qB)

∣∣∣∣ √rQB (qB) |qB |2 (127)

≤

√∫dqB

∣∣∣∣√rGQB (qB)−√rQB (qB)

∣∣∣∣2 ∫ dqB rGQB (qB) |qB |4

+

√∫dqB

∣∣∣∣√rGQB (qB)−√rQB (qB)

∣∣∣∣2 ∫ dqB rQB (qB) |qB |4 (128)

=

√∫dqB

∣∣∣∣√rGQB (qB)−√rQB (qB)

∣∣∣∣2(√∫

dqB rGQB (qB) |qB |4 +

√∫dqB rQB (qB) |qB |4

). (129)

Now using that√∫

dqB

∣∣∣√rGQB (qB)−√rQB (qB)

∣∣∣2 is the Hellinger divergence and less than the square root of the

total variation distance∫dqB

∣∣rGQB (qB)− rQB (qB)∣∣, we obtain that

∣∣∣∣∫ dqB rGQB (qB) |qB |2 −∫dqB rQB (qB) |qB |2

∣∣∣∣ ≤ ε ·(√∫

dqB rGQB (qB) |qB |4 +

√∫dqB rQB (qB) |qB |4

). (130)

19

To bound the second term we invoke the assumption that the photon number variance of the channel output isbounded. Therefore,

Tr(n̂2ρ) = Tr((q̂2B + p̂2

B − 1)2ρ)

(131)

= Tr((q̂4B + p̂4

B + 1− 2q̂2B − 2p̂2

B + 2q̂2B p̂

2B)ρ

)<∞, (132)

where ρ = N (θ(NS)). We thus conclude that√∫

dqB rGQB (qB) |qB |4 is also bounded, so that√∫

dqB rGQB (qB) |qB |4 ≤

c1 ·√∫

dqB rQB (qB) |qB |4, for some constant c1 > 0.To prove the inequality in (111), observe the following:

γ12 =

∫ ∫dqA dpA rQA(qA) rPA(pA)qA

∫ ∫dpB dqB rQB ,PB |QA,PA(qB pB |qA pA)qB . (133)

=

∫ ∫dqA dpA rQA(qA) rPA(pA)qA

∫dqB rQB |QA,PA(qB |qA pA)qB . (134)

Let us define

µ(qA, pA) ≡∫dqB qB rQB |QAPA(qB |qApA). (135)

This implies that

γ12 =

∫ ∫dqA dpA rQA(qA) rPA(pA) qA µ(qA, pA). (136)

Similarly, we can define

γG12 =

∫ ∫dqA dpA rGQA(qA) rGPA(pA) qA µ(qA, pA). (137)

This implies

|γ12 − γG12| =∣∣∣∣∫ dqA dpA µ(qA, pA)

(rG(pA) rG(qA)qA − rPA(pA) rQA(qA)qA

)∣∣∣∣ . (138)

Now let us suppose that it is possible to expand µ(qA, pA) as a polynomial in qA and pA, as mentioned in theassumptions from Section III. That is,

µ(qA, pA) =

K∑k=0

K∑l=0

µk,lqkAp

lA. (139)

This assumption implies that the mean value of Bob’s position-quadrature measurement result when a coherent state|α(qA, pA)〉〈α(qA, pA)| is transmitted through an unknown channel N is no more than polynomial in qA and pA.

With this assumption, we obtain the following:

|γ12 − γG12| =

∣∣∣∣∣∣∑k,l

µk,l

∫ ∫dqA dpA

(rGPA(pA) plA rGQA(qA) qk+1

A − rPA(pA) plA rQA(qA) qk+1A

)∣∣∣∣∣∣ (140)

Let us now define the following:

ηG(pA, l) ≡∫dpA rGPA(pA) plA, (141)

ηG(qA, l) ≡∫dqA rGQA(qA) qlA, (142)

η(pA, l) ≡∫dpA rPA(pA) plA, (143)

η(qA, l) ≡∫dqA rQA(pA) qlA. (144)

20

This implies that

|γ12 − γG12| ≤∑k,l

µk,l∣∣ηG(pA, l)η

G(qA, k + 1)− η(pA, l)η(qA, k + 1)∣∣ (145)

Now, we know that the first 2m − 1 moments of the Gauss-Hermite distribution are equal to the first 2m − 1moments of the Gaussian distribution. With that, we conclude the following upper bound:

|γ12 − γG12| ≤2m−2∑k=0

K∑l=2m

µkl∣∣ηG(qA, k + 1)

(ηG(pA, l)− η(pA, l)

)∣∣+

K∑k=2m−1

2m−1∑l=0

µkl∣∣ηG(pA, l)

(ηG(qA, k + 1)− η(qA, k + 1)

)∣∣+

K∑k=2m−1,l=2m

µkl∣∣ηG(pA, l)η

G(qA, k + 1)− η(pA, l)η(qA, k + 1)∣∣ . (146)

This concludes the proof.

B. CHANNEL SYMMETRIZATION

We now show that by performing a discrete phase symmetrization in Steps 2-3 of the key distribution protocol fromSection II, it is possible to simplify the form of the covariance matrix of the state that Alice and Bob share at theend of the EB protocol to a symmetrized form.

Let NA→B be a single-mode bosonic channel. Alice and Bob can make this channel phase covariant by applyinga random phase rotation and its inverse at the channel input and output, respectively, resulting in the followingsymmetrized channel:

NA→B(ρA) =1

4

3∑k=0

ein̂Bπk/2NA→B(e−in̂Aπk/2ρAein̂Aπk/2)e−in̂Bπk/2. (147)

If the state input to the phase randomized channel is one share of a two-mode squeezed vacuum ψ(n̄)RA =|ψ(n̄)〉〈ψ(n̄)|RA, defined from

|ψ(n̄)〉RA ≡1√n̄+ 1

∞∑n=0

√(n̄

n̄+ 1

)n|n〉R ⊗ |n〉A, (148)

then it follows that

NA→B(ψ(n̄)RA) =1

4

3∑k=0

(e−in̂Rπk/2 ⊗ ein̂Bπk/2

)NA→B(ψ(n̄)RA)

(ein̂Rπk/2 ⊗ e−in̂Bπk/2

), (149)

where we have applied the fact that

e−in̂Aπk/2|ψ(n̄)〉RA = e−in̂Rπk/2|ψ(n̄)〉RA. (150)

We would now like to determine the covariance matrix elements of the phase-randomized state τRB ≡ NA→B(ψ(n̄)RA):2⟨x̂2R

⟩τ

〈{x̂R, p̂R}〉τ 〈{x̂R, x̂B}〉τ 〈{x̂R, p̂B}〉τ〈{x̂R, p̂R}〉τ 2

⟨p̂2R

⟩τ

〈{p̂R, x̂B}〉τ 〈{p̂R, p̂B}〉τ〈{x̂R, x̂B}〉τ 〈{p̂R, x̂B}〉τ 2

⟨x̂2B

⟩τ

〈{x̂B , p̂B}〉τ〈{x̂R, p̂B}〉τ 〈{p̂R, p̂B}〉τ 〈{x̂B , p̂B}〉τ 2

⟨p̂2B

⟩τ

, (151)

where we assume for simplicity that τRB has zero mean, but we note here that the more general case can be incorpo-rated by a shift. Given an initial covariance matrix with elements

σ =

σ11 σ12 σ13 σ14

σ12 σ22 σ23 σ24

σ13 σ23 σ33 σ34

σ14 σ24 σ34 σ44

, (152)

21

the phase rotation e−in̂Rφ ⊗ ein̂Bφ corresponds to the following symplectic transformation

X(φ) =

cos(φ) sin(φ) 0 0− sin(φ) cos(φ) 0 0

0 0 cos(φ) − sin(φ)0 0 sin(φ) cos(φ)

. (153)

So then calculating covariance matrix for the phase randomized state, it is given by

1

4

3∑k=0

X(πk/2)σXT(πk/2), (154)

and we find that it is equal to

1

2

σ11 + σ22 0 σ13 − σ24 σ14 + σ23

0 σ11 + σ22 σ14 + σ23 − (σ13 − σ24)σ13 − σ24 σ14 + σ23 σ33 + σ44 0σ14 + σ23 − (σ13 − σ24) 0 σ33 + σ44

. (155)

The latter has the following form: a 0 c2 c10 a c1 −c2c2 c1 b 0c1 −c2 0 b

, (156)

for a, b ≥ 1 and c1, c2 ∈ R. We can write this in the form of Eq. (D34) in [25] by setting c1 = z sin(θ) and c2 = z cos(θ),so that z =

√c21 + c22 and θ = arctan(c1/c2), so that the form becomes a 0 z cos(θ) z sin(θ)

0 a z sin(θ) −z cos(θ)z cos(θ) z sin(θ) b 0z sin(θ) −z cos(θ) 0 b

=

[aI2 z R(θ)

z R(θ) bI2

]. (157)

This completes the symmetrization of the covariance matrix due to the discrete phase randomization.Ideally, we would estimate all the elements of the covariance matrix in the channel estimation step of the protocol.

However, it is much simpler to estimate only the parameters a, b, and z cos(θ), and assume instead that the covariancematrix has the following form: a 0 z cos(θ) 0

0 a 0 −z cos(θ)z cos(θ) 0 b 0

0 −z cos(θ) 0 b

. (158)

That is, we ignore all correlations between position and momentum quadratures. The effect of doing so is to under-estimate the correlations that are present in the state τRB . Therefore, this intuitively means we overestimate Eve’sHolevo information during the channel estimation phase, and exhaustive numerical checks confirm that Eve’s Holevoinformation is larger when replacing z with z cos(θ) (as was reported in [25]). Since we overestimate the Holevo infor-mation, the security of the protocol is not compromised, but it is only the final key rate that is potentially reduced.For additional discussion, see Appendix D of [25].

C. ALTERNATIVE APPROACH FOR BOUNDING THE PARAMETERS OF A HYPOTHETICALGAUSSIAN-MODULATED PROTOCOL

In this section, we outline a method to remove the parameters c1 and c2 from the security proof of discrete-modulation protocols.

Let ρ be the averaged state that Alice sends to Bob in the discrete-modulation protocol, and let the thermal stateθ(NS) be the averaged state that Alice sends to Bob in Gaussian-modulation protocol. Let S be a set of isometriesUA→BE that Eve implements and which agrees with the statistics that are collected by Alice and Bob, and fullfills the

22

criteria given in Section III. Then, we want to obtain an upper bound on the Holevo information supU∈S χ(B;E)U(ρ).Let W = Span {|α1〉 , |α2〉 , . . . |αm2〉} be a finite-dimensional vector space, and is spanned by a basis having m2

elements. We want to construct an orthonormal basis for this space, and this can be done by using Gram-Schmidtorthogonalization method. Let

|φ′i〉 = |αi〉 −i−1∑j=1

⟨φ′j∣∣αi⟩ ∣∣φ′j⟩ , (159)

and define |φi〉 =|φ′i〉

‖φ′i‖. We can then construct the following orthonormal basis {|φ1〉 , |φ2〉 . . . |φ〉m2} for W. Now, let

us define the following projector on W:

ΠW =

m2∑i=1

|φi〉〈φi| . (160)

It is easy to see that

ΠW ρΠW = ρ. (161)

To each isometry UA′→BE ∈ S, we can define the following isometry U such that

TrE′[UA′→BEE′(ρA′)

]= UA′→BE(ΠW ρA′ΠW ) + Tr [(1−ΠW ) ρA′ ] |u〉〈u|BE , (162)

where |u〉BE is an arbitrary unit vector in HBE . Then, TrE′[UA′→BEE′(ρA′)

]= UA′→BE(ΠW ρA′ΠW ). We also have

that

χ(B;EE′)U(ρ̄) ≥ χ(B;E)U(ρ) = χ(B;E)U(ρ) (163)

Then, using the continuity of Holevo information, we obtain

χ(B;E)U(ρ) ≤ χ(B;EE′)U(θ(NS)) + f(ε,NS), (164)

where f(ε,Ns) is defined in (38). Now we need to obtain an upper bound on χ(B;EE′)U(θ(NS)). This Holevoinformation is calculated for a thermal state θ(NS) sent over an isometric channel UA′→BEE′ in the set S and Bobperforming homodyne or heterodyne measurement. For this, we obtain the parameters γ̄G11, γ̄

G12 and γ̄G22, which are

defined analogously to (49)–(51), with the initial random variable QA replaced with Gaussian random variable withmean zero and variance equal to NS . In the following proposition, we obtain bounds on the parameters γ̄G11, γ̄

G12 and

γ̄G22 with respect to γ11, γ12, and γ22 observed in discrete-modulation protocol.

Proposition 3 Let ρ =∑x rX(x) |αx〉〈αx|, where

αx =qAs + ipAt√

2, (165)

rX(x) = rQA(qAs) rPA(pAt), (166)

θNS =

∫dx rG(x) |αx〉〈αx| , (167)

where rG(x) is the P -function for a thermal state with mean photon number NS, and s, t ∈ {1 · · ·m}. If√χ2(ρ, θ(NS)) ≤ ε2 and Eve’s attack UA′→B′E′ fulfills the constraints in Section III, then,

γ̄G11 = γ11, (168)

γ̄G22 ≤ γ22 + γ22

∥∥∥ρ(− 12 )∥∥∥2

∞ε+ εTr

[|u〉〈u| q̂2

], (169)

γ̄G12 ≥ zγ12 +

∫dqAr

G(qA)qA

∫dpAr

G(pA) Tr [(I−ΠW ) |α(qA, pA)〉〈α(qA, pA)|] Tr [|u〉〈u| q̂] , (170)

where ΠW =∑m2

i=1 |φi〉〈φi|, |u〉 represents an arbitrary unit vector and |φi〉 with i ∈{

1, · · ·m2}, forms an orthonormal

basis for W = Span {|α1〉 , |α2〉 , . . . |αm2〉}, and

z = mini,j

∣∣∣∣∣∫dqA

∫dpAr

G(qA)rG(pA)qAdij(qA, pA)∑s,t qAsr(qAs)r(pAt)bij(s, t)

∣∣∣∣∣ , (171)

with dij(qA, pA) = 〈φi|α(qA, pA)〉 〈α(qA, pA)|φj〉, and bij(s, t) = 〈φi|α(qAs , pAt)〉 〈α(qAs , pAt)|φj〉.

23

Proof. First, consider γ̄G22 defined as

γ̄G22 = Tr[q̂2N (ΠW θ(NS)ΠW )

]+ Tr [(1−ΠW ) (θ(NS))] Tr

[|u〉〈u| q̂2

]. (172)

Let us concentrate on the first term Tr[q̂2N (ΠW θ(NS)ΠW )

]= Tr

[q̂2N (σ)

], where σ = ΠW θ(NS)ΠW . Then,

Tr[q̂2N (σ)

]= Tr

[q̂2N (ρ( 1

2 )ρ(− 12 )σρ(− 1

2 )ρ( 12 ))]

(173)

≤ Tr[q̂2N (ρ)

]‖ρ(− 1

2 )σρ(− 12 )‖∞ (174)

≤ γ22 ‖ρ(− 12 )σρ(− 1

2 )‖∞. (175)

To obtain (174) from (173), observe that

ρ−1/2σρ−1/2 ≤ ‖ρ−1/2σρ−1/2‖∞ I (176)

=⇒ ρ1/2ρ−1/2σρ−1/2ρ1/2 ≤ ‖ρ−1/2σρ−1/2‖∞ ρ (177)

=⇒ Tr[q̂2ρ1/2ρ−1/2σρ−1/2ρ1/2

]≤ ‖ρ−1/2σρ−1/2‖∞ Tr

[q̂2ρ]

(178)

Then, from linearity of channel, the inequality follows.Now, we would like to obtain an upper bound on ‖ρ(− 1

2 )σρ(− 12 )‖∞. Let ∆ = σ − ρ. Then,

‖ρ(− 12 )σρ(− 1

2 )‖∞ = ‖ρ(− 12 ) (∆ + ρ) ρ(− 1

2 )‖∞ (179)

= ‖ρ(− 12 )∆ρ(− 1

2 ) + I‖∞ (180)

≤ ‖I‖∞ + ‖ρ(− 12 )∆ρ(− 1

2 )‖∞ (181)

≤ 1 + ‖ρ(− 12 )‖2∞‖∆‖∞ (182)

≤ 1 + ‖ρ(− 12 )‖2∞‖∆‖1. (183)

Now, ‖ρ− θ(NS)‖1 ≤ ε. By data-processing we obtain

‖ρ− σ‖1 ≤ ε. (184)

We thus obtain

Tr[q̂2N (σ)

]≤ γ22 + γ22‖ρ(− 1

2 )‖2∞‖∆‖1, (185)

≤ γ22 + γ22‖ρ(− 12 )‖2∞ε. (186)

Now, consider the following term: Tr [(I−ΠW ) θ(NS)]. We know that

‖ρ− θ(NS)‖1 ≤ ε (187)

This implies,

sup0≤M≤1

Tr [M (θ(NS)− ρ)] ≤ ε. (188)

Choosing M = I−ΠW , we obtain, Tr [(I−ΠW ) θ(NS)] ≤ ε. Then,

γ̄G22 ≤ γ22 + γ22‖ρ(− 12 )‖2∞ε+ εTr

[|u〉〈u| q̂2

]. (189)

Now, let us consider the parameter γ̄G12. Numerical checks, similar to those stated in [40], reveal that Holevoinformation is a monotonically decreasing function of this parameter. Since we want an upper bound on the Holevoinformation, we obtain a lower bound on this parameter. First, consider γ̄G,112 defined as follows:

γ̄G,112 =

∫dqA rG(qA) qA

∫dpAr

G(pA)

∫dqB Tr [N (ΠW |α(qA, pA)〉〈α(qA, pA)|ΠW ) q̂B ] (190)

=

∫dqA rG(qA) qA

∫dpAr

G(pA)

∫dqB Tr

N∑

i,j

dij(qA, pA) |φi〉〈φj |

q̂B

(191)

24

=

∫dqA rG(qA) qA

∫dpAr

G(pA)∑i,j

dij(qA, pA)

∫dqB Tr [N (|φi〉〈φj |) q̂B ] (192)

=∑i,j

∫dqA rG(qA) qA

∫dpAr

G(pA)dij(qA, pA)

∫dqB Tr [N (|φi〉〈φj |) q̂B ] (193)

=∑i,j

fij

∫dqB Tr [N (|φi〉〈φj |) q̂B ] , (194)

where dij(qA, pA) = 〈φi|α(qA, pA)〉 〈α(qA, pA)|φj〉, and fij =∫dqA

∫dpAr

G(qA)rG(pA)qAdij(qApA). We can write γ12

defined in (50) as

γ12 =∑s,t

qAsr(qAs)r(pAt) Tr [N (|α(qAs , pAt)〉〈α(qAs , pAt)|) q̂B ] (195)

=∑s,t

qAsr(qAs)r(pAt) Tr

∑i,j

bij(s, t)N (|φi〉〈φj |) q̂B

(196)

=∑i,j

∑s,t

qAsr(qAs)r(pAt)bij(s, t) Tr [N (|φi〉〈φj |) q̂B ] (197)

=∑i,j

gij Tr [N (|φi〉〈φj |) q̂B ] , (198)

where bij(s, t) = 〈φi|α(qAs , pAt)〉 〈α(qAs , pAt)|φj〉, and gij =∑s,t qAsr(qAs)r(pAt)bij(s, t). We can then express γ̄G,112

in terms of γ̄12 as follows:

γ̄G,112 =∑i,j

fijgij

gij Tr [N (|φi〉〈φj |) q̂B ] (199)

≥ z γ12, (200)

where z = mini,j

∣∣∣ fijgij ∣∣∣. Let us now define γ̄G,212 as

γ̄G,212 =

∫dqAr

G(qA)qA

∫dpAr

G(pA) Tr [(I−ΠW ) |α(qA, pA)〉〈α(qA, pA)|] Tr [|u〉〈u| q̂B ] . (201)

We can calculate the above term numerically.We can now combine (200) and (201) to obtain the following lower bound on γ̄G12 = γ̄G,112 + γ̄G,212 :

γ̄G12 ≥ zγ12 +

∫dqAr

G(qA)qA

∫dpAr

G(pA) Tr [(I−ΠW ) |α(qA, pA)〉〈α(qA, pA)|) Tr (|u〉〈u| q̂B ] . (202)

This concludes the proof.

Corollary 4 Let ρ =∑x rX(x) |αx〉〈αx|, where

αx =qAs + ipAt√

2, (203)

rX(x) = rQA(qAs) rPA(pAt), (204)

θNS =

∫dx rG(x) |αx〉〈αx| , (205)

where rG(x) is the P -function for a thermal state with mean photon number NS, and s, t ∈ {1 · · ·m}. If√χ2(ρ, θ(NS)) ≤ ε2 and Eve’s attack UA′→B′E′ fulfills the constraints in Section III, then,

γ̄G11 = γ11, (206)

γ̄G22 ≤ γ22 + γ22

∥∥∥ρ(− 12 )∥∥∥2

∞ε, (207)

25

γ̄G12 ≥ zγ12, (208)

where ΠW =∑m2

i=1 |φi〉〈φi| and |φi〉 with i ∈{

1, · · ·m2}, forms an orthonormal basis for W =

Span {|α1〉 , |α2〉 , . . . |αm2〉}, and

z = mini,j

∣∣∣∣∣∫dqA

∫dpAr

G(qA)rG(pA)qAdij(qA, pA)∑s,t qAsr(qAs)r(pAt)bij(s, t)

∣∣∣∣∣ , (209)

with dij(qA, pA) = 〈φi|α(qA, pA)〉 〈α(qA, pA)|φj〉, and bij(s, t) = 〈φi|α(qAs , pAt)〉 〈α(qAs , pAt)|φj〉.

Proof. In Proposition 3, choose |u〉 to be in the kernel of q̂ (for example, a position-squeezed vacuum state thatconverges to a position eigenstate).

In Proposition 3, we obtain a lower bound on γ̄G12 and upper bound on γ̄G22. Now, we can follow the steps statedin Section V to obtain an upper bound on χ(B;E)U(θ(NS)). Consider a state σABEE′ = Tr

[UA′→BEE′(ψ(n̄))AA′

],

where |ψ(n̄〉AA′ is TMSV as defined in (69). Let the covariance matrix of σAB be[γ̄EB

11 I2 γ̄EB12 σZ

γ̄EB12 σZ γ̄EB

22 I2

]. (210)

We can use the “PM to EB" mapping defined in Section VB to obtain bounds on parameters γ̄EB11 , γ̄EB

12 , and γ̄EB22

of state σAB from bounds on γ̄11, γ̄12 and γ̄22. Then invoke the Gaussian extremality theorem to state that theHolevo information χ(B;E)U(θ(NS)) is maximized by a Gaussian state with the covariance matrix given in (210). Bycombining the upper bound obtained on χ(B;E)U(θ(NS)) with (164), we obtain an upper bound on χ(B;E)U(ρ).

The method outlined above does succeed in obtaining a security proof for discrete-modulation protocols with nodependence on the parameters c1 and c2. However, as of now it seems that this method is numerically intensive.