# Continuous-variable quantum cryptography with discrete alphabets:

Composable security under collective Gaussian attacks

###### Abstract

We consider continuous-variable quantum key distribution with discrete-alphabet encodings. In particular, we study protocols where information is encoded in the phase of displaced coherent (or thermal) states, even though the results can be directly extended to any protocol based on finite constellations of displaced Gaussian states. In this setting, we provide a composable security analysis in the finite-size regime assuming the realistic but restrictive hypothesis of collective Gaussian attacks. Under this assumption, we can efficiently estimate the parameters of the channel via maximum likelihood estimators and bound the corresponding error in the final secret key rate.

## I Introduction

Quantum key distribution (QKD) bb84 ; E91 ; BBM92 ; Stefano_rev2 allows two remote authenticated parties to establish a shared secret key without any assumption on the computational power of the eavesdropper, the security being based on fundamental laws of quantum mechanics, such as the no-cloning theorem noclone ; noclone0 . The first QKD protocols were based on the use of discrete variables (DVs), i.e., discrete degrees of freedom of the electromagnetic field, such as polarization or time bins. Later, at the end of the 90s and beginning of 2000, QKD was extended to continuous-variables(CVs) Sam_rev ; Stefano_rev by the work of Ralph CV1 and other authors CV2 ; CV3 ; CV4 ; CV5 , culminating in the seminal GG02 protocol GG02 based on Gaussian modulation of coherent states. This seminal work also introduced the notion of reverse reconciliation that allowed experimental CV-QKD to reach long distances and led to the theoretical introduction of the reverse coherent information of a bosonic channel rev1 ; rev2 . Ref. rev2 was the first exploration of the ultimate limits of point-to-point (i.e., repeaterless) QKD, culminating in 2015 with the discovery and proof of the PLOB bound PLOB (see Ref. Stefano_rev2 ; TQC for more details on the historical developments).

Other theoretical advances in CV-QKD were the introduction of thermal-state protocols thermal1 ; thermal2 ; thermal3 ; thermal4 ; panos_thermal (where Refs. thermal3 ; thermal4 specifically studied the extension to longer wavelenghts, down to the microwaves), two-way quantum communication protocols two-way ; Carlo_two-way , one-dimensional protocols 1dim ; 1dim2 , and CV measurement-device independent (MDI) QKD stefano_mdi . Last but not least, there was the important development of CV-QKD with discrete-alphabet encoding. This idea was first introduced in the post-selection protocol of Ref. disc1 and later developed in a number of works disc2 ; disc3 ; disc4 ; disc5 ; disc6 ; disc7 ; disc8 ; disc9 ; disc10 . In particular, Refs. disc1 ; disc2 ; disc3 ; disc4 considered binary and ternary alphabets of displaced coherent states. Ref. disc7 considered four coherent states and, later, other words studied alphabets with arbitrary number of states under pure-loss disc5 and thermal-loss disc6 attacks. All these security proofs were limited to the asymptotic case of infinite signal exchanged by the parties. In particular, the security of discrete-alphabet CV QKD has been proven asymptotically under general collective attacks using decoy-like states disc8 or a suitable Gaussian bound disc9 .

In this work, we provide a finite-size composable proof of the security of discrete-alphabet CV-QKD protocols, under the assumption of collective Gaussian attacks collectiveG (and, in particular, collective entangling cloner attacks virtual ; Stefano_rev2 which result into a realistic thermal-loss channel between the remote parties). While the general arguments apply to any discrete alphabet, we focus on the case of phase-encoded coherent (or thermal) states, so that they are displaced in the phase-space to create regular constellations at fixed distance from the vacuum state. Our techniques combine tools from Refs. Usenko_cpe ; Antony_cpe ; compLeverier1 ; Cosmo_comp . The assumption of collective Gaussian attack is used for the purpose of parameter estimation, for which we follow the approach of Refs. Usenko_cpe ; Antony_cpe . The composable proof is then obtained by adapting the methods developed in Refs. compLeverier1 ; Cosmo_comp for protocols with Gaussian modulation. In particular, we adapt an expression developed for CV-MDI-QKD Cosmo_comp to the case of one-way QKD protocols.

The manuscript is organized as follows. In Sec. II, we describe the discrete-alphabet (phase-encoded) QKD protocol, for which we discuss the asymptotic security analysis. In Sec. III, we discuss parameter estimation in the presence of finite-size effects and, in Sec. IV, we provide the key rate of the protocol in the composable security framework. Sec. V is for conclusions.

## Ii Asymptotic security of a phase-encoded protocol

In a generic phase-encoded CV-QKD protocol with states, Alice randomly chooses between coherent states with and (so that the classical label is chosen with probability ). More generally, she prepares her mode in one of displaced thermal states with amplitudes , each with a fixed mean number of photons . In terms of quadrature operators , Alice’s conditional thermal state has mean value

(1) |

and covariance matrix (CM) , where and is the bidimensional identity matrix.

The signal state is travelling through a Gaussian (thermal-loss) channel which is under the full control of Eve. This is described by transmissivity and injected thermal noise . This channel can always be dilated into an entangling cloner attack collectiveG , where Eve has a two-mode squeezed-vacuum (TMSV) state with zero mean and CM

(2) |

In particular, mode is mixed with Alice’s travelling mode in a beam-splitter with transmissivity described by the symplectic matrix

(3) |

After the interaction, modes and are kept in a quantum memory for an optimal final measurement taking into consideration of all the classical communication between the parties. For each use of the channel, Eve’s and Bob’s conditional output state has mean and CM given by

(4) | ||||

(5) |

At the output, assume that Bob applies heterodyne measurement with outcome (the analysis can be easily adapted to considering the case of switching homodyne detections). Then, Eve’s doubly-conditional state has CM Cirac ; Jens ; stefano_gd

(6) |

while the probability of the outcome is given by

(7) |

with . Setting

(8) |

with and , we obtain

(9) | |||||

Integrating over for and for , we derive

(10) |

which can be calculated numerically. Here is Bob’s estimator of Alice’s enconding variable . Using Bayes’ formula we may write

(11) |

and compute the residual entropy

(12) |

The mutual information between the variables and is given by

(13) |

In reverse reconciliation (RR), Eve’s information on is bounded by the Holevo quantity

(14) |

where is non-Gaussian, and the conditional state is calculated by using the replacement of Eq. (8) in the Gaussian state and averaging over the probability , i.e., we have

(15) |

Thus, the asymptotic secret key rate in RR is given by

(16) |

where is the reconcilation efficiency.

Note that some simplifications may be employed to compute the Holevo quantity of Eq. (14). Using the optimality of Gaussian states, we can replace where is a Gaussian state with the same CM as . Then, we could also use the concavity of the von Neumann entropy holding for any ensemble of states . In this way, from Eq. (15), we see that we can bound the conditional entropic term as follows

(17) |

Because the CM of the Gaussian state does not depend on the variables (while the mean value does), from Eq. (17) we then have and finally . The entropy of can be computed by the symplectic spectrum of its CM . Also note that the CM of the average state can be computed from the statistical moments and (see Appendix A for more details).

## Iii Channel parameter estimation

The asymptotic rate in Eq. (16) is a function of Alice’s encoding parameters, i.e., , and , together with the channel parameters, i.e., and , or equivalently and , where is the excess noise. In order to estimate the parameters of the channel, Alice and Bob sacrifice signal states (note that the parameter estimation can also post-poned after the error correction stage, in which case the parties can use almost all their data for both parameter estimation and key generation). By communicating their outcomes for these signals, Alice and Bob can compute estimators for and and corresponding confidence intervals. They can choose worst-case parameters to be used in the computation of the key rate in Eq. (16).

Therefore, assume that Alice reveals the encoding of signal states out of a block of signal states. For sufficiently large, we have that can be chosen to be an integer. Bob will have samples for associated to a specific Alice’s encoding . Because we assume heterodyne detection, the discussion of the and quadratures is symmetric. In the quadrature, Bob’s sampled -quadratures can be described by the following stochastic variable

(18) | ||||

(19) |

where is Alice preparation noise with variance , is Eve’s noise variable with variance , and is the noise variance due to Bob’s heterodyne measurement. The variable is Gaussian with mean

(20) |

and variance

(21) |

We can then create maximum likelihood estimators for the mean value and variance of starting from the samples . In fact, we may write

(22) |

The mean value and variance of the estimator are given by

(23) | |||||

(24) |

since can be considered to be i.i.d. variables (in a collective Gaussian attack).

Note that the estimator can be replaced by its expected value due to the fact that its variance in Eq. (24) vanishes for . Thus, we can write the variance estimator in Eq. (22) as

(25) |

The term inside the brackets follows a standard normal distribution with zero mean and unit variance. Therefore, the sum term follows a chi-squared distribution with mean equal to and variance . Consequently, for the mean and variance of the estimator we obtain

(26) | ||||

(27) |

Based on the estimator we can build an estimator for the transmissivity

(28) |

The estimator is the sample mean of and as such follows a Gaussian distribution. We then can express the above equation with the help of the chi-squared variable with mean

(29) |

This estimator of the transmissivity has mean and variance equal to

(30) | ||||

(31) |

Since there will other estimators corresponding to the other values of Alice’s encoding we can create an optimal linear combination of them with variance Usenko_cpe

(32) |

So far, we have used only samples from the -quadrature of Bob’s outcomes. Similar relations will hold for the -quadrature. Combining all the available - and -samples, the optimal linear estimator of the transmissivity will have variance

(33) |

In fact, for large , we can approximate all the estimators to have Gaussian distributions with the same mean and variance . As a result, the global estimator is a Gaussian variable with the same mean and variance equal to . Now, assuming an error for channel parameter estimation (CPE), we have to consider a standard deviation interval for . This means that the worst-case value for the transmissivity is equal to

(34) |

Starting from we may also define an estimator for the excess noise. Solving Eq. (21) with respect to , we obtain

(35) |

Then the mean and variance of this estimator are given by

(36) | ||||

(37) |

The variance of the optimal linear combination of all the estimators (also considering the -quadrature) is given by

(38) |

Based on the assumption of large , we approximate the distribution of each to be Gaussian. As a result, the distribution of is Gaussian with the same mean and variance given by above. Assuming an error , we obtain the 6.5 confidence intervals for . Therefore, the worst-case value is give by

(39) |

Using the worst-case values and , we can write a finite-size expression of the key rate of Eq. (16) which accounts for the imperfect parameter estimation and the reduced number of signals. This is give by replacing

(40) |

## Iv Composable security

Our approach for the composable security of the protocol is based on tools of Ref. compLeverier1 ; Cosmo_comp . Let us suppose that the block size is , where signals are used for key generation and signals for parameter estimation. The total number of secret key bits that can be extracted from Bob’s variable are given by

(41) |

where is the smooth min-entropy of Bob’s variable conditioned on Eve’s quantum systems , which are described by the global state in Eve’s hands after successful error correction (EC). The term leak accounts for the bits that are lost during the reconciliation process. Parameter is related to the probability that the protocol is not secure, while is the smoothing parameter, and is associated with the error in the EC routine.

Under a collective attack, Eve’s state before EC can be considered to be a tensor product state . However, this is no longer true after EC. In fact, if the EC routine is successful (with probability ), Eve’s state undergoes the transformation

(42) |

where is a suitable projector. Assuming that the protocol is not aborted (with probability ), it is then secure with probability . Theorem 1 in Ref. Cosmo_comp states that we can still bound the number of secret bits by computing the smooth min-entropy over the tensor product state (before EC) proviso that we replace the smoothing parameter as and we reduce the number of bits by .

Then, we can also use the conditional von Neuman entropy of instead of the conditional smooth min-entropy of to approximate the previous bound. This is based on the asymptotic equipartition property (AEP) stating that the conditional smooth min-entropy of is larger or equal to times the conditional von Neumann entropy of minus a correction term AEP . This term depends on the smoothing parameter and the number of phase-encoded signals ; it can be bounded by

(43) |

In turn, the conditional von Neumann entropy can be written in terms of the von Neumann entropy and the quantum mutual information, with further simplifications in the presence of a classical variable . In fact, we have

(44) | |||||

where is the Shannon entropy and is the Holevo bound.

We then can make the following replacement

(45) |

in terms of the mutual information and the reconcilation parameter . Thanks to this manipulations, the expression of the asymptotic secret key rate appears in the bound of Eq. (IV). We explicitly have

(46) |

## V Conclusion and discussion

In this work, we have studied the finite-size composable security of a discrete-alphabet CV-QKD protocol under the assumption of collective Gaussian attacks. This assumption is realistic because the standard model of loss and noise in optical quantum communications is the memoryless thermal-loss channel, which is dilated into a collective entangling cloner attack, i.e., a specific type of collective Gaussian attack. Our analysis extends previous asymptotic analysis under collective attacks to the finite-size and composable regime, but simultaneously pays the price to be restricted to Gaussian attacks. Removing this assumption is the subject of future investigations.

Since our analysis applies not only to displaced coherent states but also to displaced thermal states, it can be useful for studying the security of phase-encoded protocols at frequencies lower than the optical. It is also worth to stress that our derivation, described for phase-encoded signals, can immediately be extended to any configuration or constellation of displaced Gaussian states (e.g., coherent, thermal or squeezed), besides the fact that it also applies to CV-QKD protocols based on the Gaussian modulation of the amplitudes of Gaussian states (e.g., coherent, thermal or squeezed). As a matter of fact, the formalism of Sec. IV does not change. This is heavily based on Ref. compLeverier1 and the following simplification Cosmo_comp originally developed for CV-MDI-QKD, that we have suitably adapted to the case of one-way QKD protocols. The most crucial part is the finite-size rate which can always be estimated, under the assumption of collective Gaussian attacks, by using maximum likelihood estimators and their confidence intervals, i.e., adopting simple variations of the technique in Sec. III. In this way, the finite-size rate can always be expressed in terms of the asymptotic key rate of the specific protocol under consideration via the transformation in Eq. (40).

Acknowledgements. This work has been sponsored by the EPSRC Quantum Communications Hub (Grant No. EP/T001011/1) and the European Union via “Continuous Variable Quantum Communications” (CiViQ, Grant agreement No 820466).

## References

- (1) C. H. Bennett and G. Brassard,In Proceedings of IEEE International Conference on Computers, Systems and Signal Processing 175, 8 (1984).
- (2) A. K. Ekert, Phys. Rev. Lett. 67, 661 (1991).
- (3) C. H. Bennett, G. Brassard, and N. D. Mermin, Phys. Rev. Lett. 68, 557 (1992).
- (4) S. Pirandola, U. L. Andersen, L. Banchi, M. Berta, D. Bunandar, R. Colbeck, D. Englund, T. Gehring, C. Lupo, C. Ottaviani, J. Pereira, M. Razavi, J. S. Shaari, M. Tomamichel, V. C. Usenko, G. Vallone, P. Villoresi, and P. Wallden, arXiv:1906.01645 (2019).
- (5) W. Wootters, and W. Zurek, Nature 299, 802 (1982).
- (6) J. Park, Found. Phys. 1, 23 (1970).
- (7) S. L. Braunstein and P. van Loock Rev. Mod. Phys. 77, 513 (2005).
- (8) Ch. Weedbrook, S. Pirandola, R. Garci-a-Patron, N. J. Cerf, T. C. Ralph, J. H. Shapiro, and S. Lloyd, Rev. Mod. Phys. 84, 621 (2012).
- (9) T. C. Ralph, Rev. A 61, 010303 (1999).
- (10) M. Hillery, Phys. Rev. A 61, 022309 (2000).
- (11) M. D. Reid, Phys. Rev. A 62, 062308 (2000).
- (12) N. J. Cerf, M. L evy, and G. V. Assche, Phys. Rev. A 63, 052311 (2001).
- (13) G. Van Assche, J. Cardinal, and N. Cerf, IEEE Trans. Inf. Theory 50, 3940 (2004).
- (14) F. Grosshans and P. Grangier, Phys. Rev. Lett. 88, 057902 (2002).
- (15) R. Garcia-Patron, S. Pirandola, S. Lloyd, and J. H. Shapiro, Phys. Rev. Lett. 102, 210501 (2009).
- (16) S. Pirandola, R. Garcia-Patron, S. L. Braunstein, and S. Lloyd, Phys. Rev. Lett. 102, 050503 (2009).
- (17) S. Pirandola, R. Laurenza, C. Ottaviani, and L. Banchi, Nat. Comm. 8, 15043 (2017). See also arXiv:1510.08863 (2015).
- (18) S. Pirandola, S. L Braunstein, R. Laurenza, C. Ottaviani, T. P. W. Cope, G. Spedalieri, and L. Banchi, Quantum Sci. Technol. 3, 035009 (2018).
- (19) R. Filip, Phys. Rev. A 77, 022310 (2008).
- (20) V. C. Usenko and R. Filip, Phys. Rev. A 81, 022318 (2010).
- (21) C. Weedbrook, S. Pirandola, S. Lloyd, and T. C. Ralph, Phys. Rev. Lett. 105, 110501 (2010).
- (22) C. Weedbrook, S. Pirandola, and T. C. Ralph, Phys. Rev. A 86, 022318 (2012).
- (23) P. Papanastasiou, C. Ottaviani, and S. Pirandola, Phys. Rev. A 98, 032314 (2018).
- (24) S. Pirandola, S. Mancini, S. Lloyd, S. L. Braunstein, Nat. Phys. 4, 726 (2008).
- (25) C. Weedbrook, C. Ottaviani, and S. Pirandola, Phys. Rev. A 89, 012309 (2014).
- (26) V. C. Usenko and F. Grosshans, Phys. Rev. A 92, 062337 (2015).
- (27) T. Gehring, C. S. Jacobsen, and U. L. Andersen, Quantum Information and Computation 16, 1081 (2016).
- (28) S. Pirandola, C. Ottaviani, G. Spedalieri, Ch. Weedbrook, S. L. Braunstein, S. Lloyd, T. Gehring, Ch. S. Jacobsen, and U. L. Andersen, Nat. Phot. 9,397-402 (2015).
- (29) C. Silberhorn, T. C. Ralph, N. Lütkenhaus, and G. Leuchs, Phys. Rev. Lett. 89, 167901 (2002).
- (30) M. Heid and N. Lütkenhaus, Phys. Rev. A 76, 022313 (2007).
- (31) Y.-B. Zhao, M. Heid, J. Rigas, and N. Lütkenhaus, Phys. Rev. A 79, 012307 (2009).
- (32) K. Bradler and C. Weedbrook, Phys. Rev. A 97, 022310 (2018).
- (33) A. Leverrier and P. Grangier, Phys. Rev. Lett. 102, 180504 (2009).
- (34) D. Sych and G. Leuchs, New J. Phys.12, 053019 (2010).
- (35) P. Papanastasiou, C. Lupo, C. Weedbrook, and S. Pirandola, Phys. Rev. A 98, 012340 (2018).
- (36) A. Leverrier and P. Grangier, Phys. Rev. A 83, 042312 (2011).
- (37) S. Ghorai, P. Grangier, E. Diamanti, and A. Leverrier, Phys. Rev. X 9, 021059 (2019).
- (38) J. Lin, T. Upadhyaya, and N. Lütkenhaus, arXiv:1905.10896 (2019).
- (39) S. Pirandola, S.Lloyd and S.L. Braunstein, Phys. Rev. Lett. 101, 200504 (2008).
- (40) F. Grosshans, N. J. Cerf, J. Wenger, R. Tualle-Brouri, and P. Grangier, Quantum. Inf. Comput. 3, 535–552 (2003).
- (41) A. Leverrier, F. Grosshans, and P. Grangier, Phys. Rev. A 81, 062343 (2010).
- (42) L. Ruppert, V. C. Usenko, and R. Filip, Phys. Rev. A 90, 062310 (2014).
- (43) A. Leverrier, Phys. Rev. Lett. 114, 070501 (2015).
- (44) C. Lupo, C. Ottaviani, P. Papanastasiou, and S. Pirandola, Phys. Rev. A 97, 052327 (2018).
- (45) P. Papanastasiou, C. Ottaviani, and S. Pirandola, Phys. Rev. A 98, 032314 (2018).
- (46) G. Giedke and J. I. Cirac, Phys. Rev. A 66, 032316 (2002).
- (47) J. Eisert and M. Plenio, Int. J. Quantum. Inform. 1, 479 (2003).
- (48) S. Pirandola, G. Spedalieri, S. L. Braunstein, N. J. Cerf, and S. Lloyd, Phys. Rev. Lett. 113, 140405 (2014).
- (49) M. Tomamichel, R. Colbeck, and R. Renner, IEEE Trans. on Inf. Theory 55, 5840-5847 (2009).

## Appendix A Covariance matrix of the average state

Consider the generic quadrature

(48) |

of a -mode bosonic system. Given a state , we have a vectorial mean value , with generic element

(49) |

and a CM , with generic element

(50) | |||

Let us assume that

(51) |

where are Gaussian states with CM and mean value , chosen with probability . By using the linearity of the trace operation, the CM of the average state will be given by

(52) |

For the component we may write

(53) |

and replace in Eq. (A), so that we find

(54) | |||||

which expresses the CM of the average state in terms of the statistical moments of its components .