High Bit Rate Continuous-Variable Quantum Key Distribution
HHigh Bit Rate Continuous-Variable Quantum Key Distribution
Paul Jouguet, David Elkouss, and Sébastien Kunz-Jacques SeQureNet, 23 avenue d’Italie, 75013 Paris, France Departamento de Análisis Matemático, Universidad Complutense de Madrid (Dated: September 23, 2014)Here, we demonstrate that a practical Continuous Variables Quantum Key Distribution (CVQKD)protocol relying on the Gaussian modulation of coherent states features secret key rates that cannotbe achieved with standard qubit Discrete Variables (DV) QKD protocols. Notably, we report forthe first time a practical postprocessing that allows to extract more than one bit of secret key perchannel use.
I. INTRODUCTION
QKD [1] has been the most studied quantum informa-tion technology primitive for the past twenty years. Ina practical QKD protocol, Alice and Bob can extract anarbitrary amount of secret key using an untrusted physi-cal channel (also called quantum channel), provided a fewminimum assumptions such as they have access to a pub-lic authenticated channel. Contrary to classical crypto-graphic primitives whose security can be established onlyagainst some restrictive classes of eavesdroppers, QKDkeys are secure in the information-theoretic sense evenagainst an eavesdropper with unlimited computationalresources or with undisclosed cryptanalytic knowledge.In DVQKD protocols, the information is encoded ondiscrete values, such as the phase or the polarization ofsingle photons, and detection is done using single pho-ton detectors. CVQKD protocols employ continuous ordiscrete modulations [2] of the quadratures of the elec-tromagnetic field. CVQKD setups rely on a coherentdetection (homodyne or heterodyne) between the quan-tum signal and a classical reference signal called the localoscillator, and their implementation requires only stan-dard telecom components. They are compatible withWavelength Division Multiplexing [3] which greatly easestheir deployment into telecommunication networks. Inthe early history of CVQKD, this technology was ex-pected to achieve higher secret key rates than DVQKDprotocols thanks to the possibility of encoding more thanone bit per pulse. However, the secure distance of themost common CVQKD protocol [4], which consists ina Gaussian modulation of coherent states in the phasespace and a homodyne detection of any of two orthog-onal quadratures of the field at random, was limited to25 km [5] for a long time because of the lack of efficienterror-correction procedures at low signal-to-noise ratios.This problem was solved thanks to the multidimensionalreconciliation technique proposed in [6] together with thedesign of high efficiency error correcting codes in [7] andsignificantly extended the secure distance of CVQKD toabout 80 km [8]. However, multidimensional protocolsare limited to one bit per pulse.In this paper, we exhibit high-efficiency error correct-ing codes for the Additive White Gaussian Noise Chan-nel (AWGNC). In the high signal-to-noise ratios (SNRs) regime, it allows us to go beyond previous achievable se-cret key rates [8] with CVQKD systems and extract morethan one bit of secret key per channel use; a rate impos-sible to attain, even in principle, with qubit DVQKDsystems.In Section II, we explain the links between the secretkey rate and error correction in CVQKD and review pre-vious work on error correction for both DVQKD andCVQKD. In Section III we detail the principle of SliceReconciliation, which is a technique that can be usedto reconcile non-binary elements, and study its practi-cal performance in the specific case of the distribution ofGaussian elements. Finally, we show in Section IV theconsequences of these developments on the performanceof the Gaussian protocol over short distances with a stateof the art CVQKD system and make projections aboutfuture achievable secret key rates.
II. ERROR CORRECTION WITHCONTINUOUS VARIABLESA. Secret Key Rate and Error Correction
In any QKD protocol (either DV or CV), after somequantum states are exchanged on a quantum channel,an error correction mechanism is used to make Alice andBob share some common data. There are two usual cases:either Bob corrects its errors with respect to Alice in the direct reconciliation scenario; or Alice corrects its errorswith respect to Bob in the reverse reconciliation scenario.In these two cases, the party performing error correctiondoes so using additional data revealed by the other partythrough a noiseless, classical channel.The final secret key size generated by a QKD exper-iment therefore depends on three quantities: the rawcommon data after error correction, the amount of in-formation that was revealed during the error correctionphase, and an upper estimate of the amount of informa-tion gained by the attacker through its interaction withthe quantum channel. The latter quantity is a result ofthe security proof of the considered protocol, and is theinformation that the attacker Eve has in common withAlice in the direct reconciliation case and with Bob in thereverse reconciliation case. In the case of CVQKD, the a r X i v : . [ qu a n t - ph ] S e p measurement of information used is the Holevo informa-tion and the direct (resp. reverse) quantities are denotedby χ AE (resp. χ BE ). The relevant quantity to take intoaccount for the amount of information revealed becauseof error correction is the mutual (Shannon) informationbetween Alice and Bob, I AB . A perfect error-correctionscheme is able to retrieve all of I AB , that is, the amountof common information after error correction substractedof the amount of auxiliary data revealed to perform theerror correction is equal to I AB ; a practical scheme willextract only an amount of information βI AB with β < βI AB − χ AE with direct reconciliationand βI AB − χ BE with reverse reconciliation.In the case of Gaussian modulated coherent-stateCVQKD [4], the channel parameters enabling to boundthe information obtained by Eve are the line transmission T and the noise added by Eve on the quantum channel or excess noise ξ . When there is no excess noise, one has forany line transmission T , χ BE < I AB : some secret key canbe produced at any distance using reverse reconciliationwith a perfect error correction scheme, or a “sufficientlygood” scheme such that βI AB − χ BE >
0. Using directreconciliation however, χ AE < I AB only when losses arelower than 3 dB ( T > . β is typically highly sensitive to the SNR of the sys-tem; historical CVQKD systems used reasonably highSNRs because of this. The coherent-state Gaussian pro-tocol is the CVQKD protocol whose security has beenstudied the most because it features higher secret keyrates than protocols that employ discrete modulationsand can be implemented with standard components con-trarily to squeezed-state protocols. However, in contrastto DVQKD, specific error correction techniques need tobe designed to deal with non-binary key elements. Fur-thermore, the error correction schemes used also dependon the SNR of the data to correct. B. Previous work
The first reconciliation protocols were ad-hoc construc-tions targeting DVQKD. Among these early proposals,Cascade [9] stands out as a very simple protocol withreasonably high efficiency. Its principal defect is that itis extremely interactive. However, a recent implementa-tion of Cascade [10] shows that, provided that a dedi-cated classical communications line is available, a highthroughput is achievable. In contrast to these protocols, most recent work inDVQKD has focused in applying capacity-approachingone-way error correcting codes for reconciliation. Forinstance, large length (10 ) low-density parity-check(LDPC) codes can be used to approach the theoreticallimits [11]. These results only hold for large lengths,recently explicit fundamental one-way limits have beenstressed in [12] as a function of the length and the tar-get frame error rate (FER). However, a combination oferror correcting codes with a few rounds of interactivityallows to bypass these limitations while maintaining ahigh throughput [13].As regards CVQKD, specific error correction tech-niques need to be designed to deal with non-binary keyelements. In [14], Slice Error Correction (SEC) was pro-posed to extract mutual information out of any corre-lated variables, either discrete or continuous. SEC usesinteractive error correcting codes whose efficiency is sub-optimal as pointed in [15]. MultiLevel Coding / Multi-Stage Decoding (MLC / MSD) are standard coded mod-ulation techniques that were applied to CVQKD recon-ciliation in [15] and [5]. They feature higher efficiencythan SEC for SNR between 1 and 15 but their efficiencydrops quickly for SNR below 3. In CVQKD, achievinglong distances requires to maintain a high reconciliationefficiency for low SNRs. This is why the secure distancewas limited to 25 km [5] until the multidimensional rec-onciliation scheme was proposed in [6]. This scheme en-codes the information in binary variables which allowsus to deal with a Binary Input (BI) AWGNC instead ofthe usual AWGNC. Since low-rate high-efficiency multi-edge LDPC codes can be designed for this channel [7],the achievable secure distance for CVQKD with a Gaus-sian modulation can be considerably extended. In [6],high efficiency with a SNR of 0.5 allowed to extend thesecure distance to about 50 km while LDPC codes specif-ically designed for SNRs as low as 0.03 [7] were used todemonstrate the exchange of secure keys at 80 km [8]. Fi-nally, since achieving high efficiencies requires intensiveiterative decoding for LDPC codes, the use of GraphicProcessing Units (GPUs) [5, 16] for LDPC decoding orthe use of polar codes [16] which feature a high speeddecoder on Central Processing Units (CPUs) have beeninvestigated. III. SLICE RECONCILIATIONA. Principle
Slice reconciliation was introduced in [14] as a rec-onciliation scheme for non-binary sources using binaryerror correcting codes. It works in two steps (see Fig.1 for a schematic description of the protocol). Thefirst step consists in choosing a set of m slice functions S , ..S m : R → { , } that take the source to binary val-ues. Together the m functions can be regarded as a quan-tizing function Q : R → { , } m that transforms the con- x , . . . , x n q , . . . , q n q , . . . , q n q m , . . . , q mn s , . . . , s n (1 − R ) s m , . . . , s mn (1 − R m ) ˆ q , . . . , ˆ q n ˆ q , . . . , ˆ q n ˆ q m , . . . , ˆ q mn Q y , . . . , y n ENC ENC m DEC DEC m BobAliceFigure 1: Schematic representation of the slice protocol for direct reconciliation. First the input source is quantized into an m -bit source. Then each of the m sources is encoded and sent to Bob. In the figure the first slice is transmitted unencoded.The decoder takes as side information its own source and with the m encoded sources produces an estimate of the quantizedsource. tinuous Gaussian source into an m bit source. Howeverby the data processing inequality I ( Q ( X ); Y ) ≤ I ( X ; Y )(or equivalently I ( X ; Q ( Y )) ≤ I ( X ; Y ) for RR). That is,there is an inherent inefficiency associated with the dis-cretization of the source. For any fixed number of bits m we can optimize the secret key rate by finding the func-tion that maximizes I ( Q ( X ); Y ) ( I ( X ; Q ( Y )) for RR).This problem of designing a discretization function thatmaximizes a mutual information criterion was describedin [17].We consider here two different slice constructions (seeFig. 2). Both of them divide the real line into 2 m dis-joint intervals and take the Gaussian source to the ( m bit) index of the interval. In the first slice constructionthe intervals are defined by 2 m − m = 3 to m = 5. The secondconstruction chooses freely the 2 m intervals. In this case,finding the optimal function is an optimization problemwith 2 m − −∞ ∞ Figure 2: Two examples of quantizers dividing the real linein 2 intervals. The figure on the top shows a quantizer withconstant step, the figure on the bottom shows a quantizerwith optimized interval length. The second step deals with sending an encoding of Q ( X ) to Bob (resp. Q ( Y ) to Alice in RR) such thathe can infer Q ( X ) (resp. Q ( Y ) in RR) with high proba-bility. This is a problem that can be readily tackled withcoding techniques. In particular, slice reconciliation usesa multilevel coding scheme [15]. Each of the m slices isencoded independently as the syndrome of an error cor-recting code with rate R i (1 ≤ i ≤ m ). If the informationrates are chosen appropriately the decoder can recovereach of the slices using its own source as side informa-tion. The rate of the encoding is upper bounded by thecapacity of the associated channel. However, this boundcan only be reached in the limit of asymptotically largecodes, in consequence the use of real, finite-length, codesintroduces a second source of inefficiency. The efficiency β of slice reconciliation is given by: β = H ( Q ( X )) − m + P mi =1 R i I ( X ; Y ) (1)Eq. 1 shows that β is highly dependent in the rates ofthe available codes and how close they are to the chan-nel capacities. For this reason we have chosen LDPCcodes, well known for operating close to the capacity ofsymmetric binary input channels. The procedure is wellknown, for each rate the space of ensembles of codes isexplored with an evolutionary algorithm [18] and for eachensemble the asymptotic behavior of the codes belongingto the ensemble can be evaluated with the Density Evo-lution algorithm [19]. The evolution of the value of theoptimal rates for each slice with respect to the SNR foran optimal discretization of the real line into regular in-tervals is given in Fig. 7. In practice, once the numberof slices is fixed, for a given SNR we use Fig. 6 to choosethe optimal quantization step and Fig. 7 to choose theoptimal rates of the codes we need to design to decodethe successive slices.With optimal codes, the efficiency β disc of the dis-cretization scheme is β disc = H ( Q ( X )) − m + P mi =1 C i I ( X ; Y ) (2)where C i is the capacity of the channel corresponding tothe i -th discretization layer. Assuming codes of efficiency β c < β = H ( Q ( X )) − m + P mi =1 β c C i I ( X ; Y )= β disc − (1 − β c ) γ (3)with γ = P mi =1 C i I ( X ; Y )The quantity γ therefore controls the relationship be-tween the lack of efficiency of individual error-correctingcodes used and the efficiency loss that it causes on theslice reconciliation scheme. Because H ( Q ( X )) ≤ m ,when β disc is close to 1, γ >
1. Typical values of γ arebetween 1 and 2 as shown in Fig. 3. B. Simulation Results
An optimization on the bounds of the discretization Q ( X ) shows the following basic facts. For a fixed SNR,the higher the number of layers, the lower the discretiza-tion loss I ( X ; Y ) − I ( Q ( X ); Y ). It is always possible tomake this loss negligible by increasing the number of lay-ers. This implies that γ increases and can become muchlarger than 1 as shown in Fig. 3. As seen in Eq. 3, thismeans that adding layers requires error-correcting codescloser to the Shannon limit to minimize the loss on thescheme caused by the inefficiency of the individual codes.Overall, with codes having β c ≥ . −
15, and is alwaysabove 90% efficiency, as shown on Fig. 4, thanks to itshigh quantization efficiency (see Fig. 5), and despite itshigher γ value at low SNR. This is much better than re-sults of [5], where an efficiency above 90% could only beobtained for SNRs above 7. This is mainly due to thefact that we designed specific codes to decode each slice.Furthermore we perform error correction with codes oflarge length (2 ).As a summary, we show in the first two columns ofTable I the best efficiencies obtained with slice recon-ciliation optimizing over the number of slices and thequantization step. In the last two columns we show theefficiencies reported in [7] with codes for the BIAWGNC.For SNRs below 0.5, the multidimensional methods of[7] are more competitive than slice reconciliation. Indeedin that case I ( X, Y ) (cid:28)
1, and the main limitation of mul-tidimensional methods that they can only extract 1 bitper pulse is not a problem. Therefore the combination ofmultidimensional methods and slice reconciliation withup to 5 slices yields an efficiency above 90% for SNRs
Table I: The first two columns show the efficiencies achievedwith slice reconciliation with respect to the SNR. The last twocolumns show the efficiencies achieved with multi-edge LDPCcodes with respect to the SNR, these values were reported in[7]. AWGN BIAWGNSNR Efficiency SNR Efficiency0.55 93.4% 0.0075 95.9%0.86 93.7% 0.0145 96.6%1 94.2% 0.029 96.9%3 94.1% 0.075 95.8%5.12 94.4% 0.161 93.1%14.57 95.8% 1.097 93.6%66.10 94.8% ranging from 0.01 to 100. For SNRs above 10, the capac-ity of the highest layer is sufficiently close to 1 to be ableto use a simple, fast, hard decoding code such as a BCHcode to decode it. As an alternative, it is always possibleto use a code in a regime of higher SNR than its initialthreshold SNR. In this case the following efficiency canbe obtained: β s = β s log(1 + s )log(1 + s ) (4)where s, β s denotes the target SNR and s , β s the orig-inal SNR and efficiency [28].At the other end of the spectrum, low-rate slices aredecoded with multi-edge LDPC codes which can have anefficiency above 95% for rates 0 . − .
02 [7]. For evenlower rates, multi-edge LDPC codes can be combinedwith a length k repetition code without a significant ef-ficiency loss [20]: β s = β s s log(1 + s ) s log(1 + s ) ≈ s ≈ s = s /k . Alternatively, the slices can be fullyrevealed. Revealing a lower slice is not equivalent to re-ducing the number of slices, since the knowledge of thelowest slices helps the soft decoding of the upper slices. IV. APPLICATION TO HIGH BIT RATECVQKD
For all our simulations, we have computed the secretkey rate against collective attacks [21, 22], which is equiv-alent to the secret key rate against general attacks in thelimit of large block lengths. When considering finite sizeeffects [23, 24], the performance of reconciliation is notaffected but the modulation variance that yields the op-timal key rate is different than in the asymptotic case;the secret key rate is also lower in this scenario than inthe asymptotic one at any distance, partly because theestimated value of the excess noise is increased to takeinto account the statistical uncertainty of the estimator.The secret key rate greatly varies between the direct and γ = P m i = C i I ( X ; Y ) SNR3 slices 4 slices 5 slices
Figure 3: (Color online). Factor γ indicating the sensitivity ofslice reconciliation to the suboptimality of the error-correctingcodes used for 3, 4 and 5 slices. β SNR3 slices 4 slices 5 slices
Figure 4: (Color online). Overall efficiency of slice reconcilia-tion with error-correcting codes of efficiency β c = 95% for 3,4 and 5 slices. E ffi c i e n c y ( % ) SNRconst. step 3 slicesopt. bound. 3 slices const. step 4 slicesopt. bound. 4 slices const. step 5 slicesopt. bound. 5 slices
Figure 5: (Color online). Optimal quantization efficiency withrespect to the SNR for a discretization of the real line into reg-ular intervals (solid lines) and non regular intervals (dashedlines). Red lines give the discretization efficiency for 3 slices(8 intervals), green lines for 4 slices (16 intervals) and bluelines for 5 slices (32 intervals). B e s t c o n s t a n t s t e p SNR3 slices 4 slices 5 slices
Figure 6: (Color online) Evolution of the value of the constantstep giving the best quantization efficiency with respect tothe SNR. Solid red line corresponds to 3 slices (8 intervals),dashed green line corresponds to 4 slices (16 intervals), dottedblue line corresponds to 5 slices (32 intervals). R a t e SNR3 slices 4 slices 5 slices
Figure 7: (Color online) Evolution of the value of the optimalrates for each slice with respect to the SNR for an optimaldiscretization of the real line into regular intervals. The low-est plots correspond to the least significant bits which are thenoisiest bits. Solid red lines corresponds to 3 slices, dashedgreen lines corresponds to 4 slices, dotted blue lines corre-sponds to 5 slices. reverse reconciliation scenarios. In Fig. 8 we plot bothscenarios with parameters ξ = 0 . V A , α = 0 .
2, where V A is the variance of Alice’s input signal and ideal mea-surement devices and α is the loss coefficient of the opti-cal fiber. For distances shorter than 2 km, DR is a betteroption but the curve drops sharply and reaches zero be-fore 15 km which corresponds to the DR limit of 3dB. RRon the other hand has no theoretical limitation and withthe chosen parameters at 100 km still yields a secret keyrate close to 5 · − bits per symbol. These secret keyrates are the maximized rates over the variance of Alice’sinput signal. The corresponding SNR values are plottedwith the same pattern and colour as the correspondingsecret key rate with smaller width. The remaining figuresin this section follow the same convention.
20 40 60 80 100 120 14010 (cid:2) Distance (cid:2) km (cid:3) S ec r e t k e y r a t e Coherent states RR Coherent states DR S N R Coherent states RR Coherent states DR
Figure 8: (Color online). Comparison of the DR and RRsecret key rate with ideal measurement devices. The thicklines show secret key rate, the thin lines the optimal SNRwhich is equal to V A /T up to some small excess noise relatedterm. The secret key rate of the first four km is zoomed inthe upper right corner. Parameters: α = 0 . , ξ = 0 . V A . The optimization of the quantization step allows to in-crease the secret key rate in the short distance regime.This is particularly noticeable in the DR scenario. InFig. 10 we show the achievable secret key rate with idealmeasurement devices. We have chosen three scenarios forcomparison: 1) imperfect detection devices and perfectreconciliation 2) slice reconciliation and 3) reconciliationover a BIAWGN of the same SNR (limit case of the mul-tidimensional channels [7]). The four curves run sepa-rated over the whole region considered, the main reasonis that the optimal V A values correspond to high SNRvalues (plotted in the same curve) which translates intoan advantage for slice reconciliation. We would like tohighlight that for very short distances, slice reconcilia-tion allows to distill for the first time more than onesecret bit per channel use.In the reverse reconciliation scenario the advantage ofour implementation of slice reconciliation is limited todistances below 13 km. The reason lies in the increasingdifficulty of optimizing multilevel coding schemes for lowSNRs. Furthermore, binary encodings are optimal in thelow SNR regime. The reason is that the capacity of theassociated channel, the BIAWGN, converges to the ca-pacity of the AWGN channel as the SNR goes to zero.In fact, binary encodings have successfully been used forlong distance CVQKD [6]. We observe this behaviour inFig. 9: below 13 km there is an advantage in using slicereconciliation, but over this distance binary encodingslead and allow to distill secret key over large distances[7].We used the experimental system reported in [8] andoperated it in the high SNR regime for very low lossesbetween Alice and Bob. For a SNR of 19 and a linetransmission of 0.995, we obtained an excess noise of 0.03shot noise units (SNU) on Bob’s side, i.e. an excess noiseof 0.05 SNU on Alice’s side for a measured homodyne S N R
20 40 60 80 100 120 14010 (cid:2) (cid:2) Distance (cid:2) km (cid:3) S ec r e t k e y r a t e Coherent states RR Imperfect devices RRAWGN Imperfect RR BIAWGN Imperfect RR
Figure 9: (Color online). Secret key rate in the RR scenario.From top to bottom the curves show the secret key rate with:ideal measurement devices, realistic devices characterized bya finite detection efficiency η and an electronic noise v elec ,slice reconciliation and reconciliation over a BIAWGN. Thethick lines show secret key rate, the thin lines the optimalSNR which is a function of the input signal variance. Thesecret key rate of the first twenty km is zoomed in at theupper right corner. Parameters: ξ = 0 . V A , α = 0 . , η =0 . , v elec = 0 . S N R (cid:2) (cid:2) Distance (cid:2) km (cid:3) S ec r e t k e y r a t e Coherent states DR Imperfect devices DRAWGN Imperfect DR BIAWGN Imperfect DR
Figure 10: (Color online). Secret key rate in the DR scenario.From top to bottom the curves show the secret key rate with:ideal measurement devices, realistic devices characterized bya finite detection efficiency η and an electronic noise v elec , slicereconciliation and reconciliation over a BIAWGN. The thicklines show secret key rate, the thin lines the optimal SNRwhich is a function of the input signal variance. Parameters: ξ = 0 . V A , α = 0 . , η = 0 . , v elec = 0 . detection efficiency of 0.6 and an electronic noise of 0.01SNU. We obtained a practical reconciliation efficiency of95% and the secret key rate per pulse is about 1.02 inthe reverse reconciliation scenario while it reaches 1.04 inthe direct reconciliation scenario. These measurementsconfirm the possibility to extract more than one secretbit per pulse with a CVQKD system.We investigated the robustness of these results in thecomposable security framework presented in [25]. In the
20 40 60 8010 (cid:2) (cid:2) Distance (cid:2) km (cid:3) S ec r e t k e y r a t e Asymptotic (cid:2)
Η(cid:4) (cid:3)
Asymptotic (cid:2)
Η(cid:4) (cid:3)
Finite key (cid:2)
Η(cid:4) (cid:3)
Finite key (cid:2)
Η(cid:4) (cid:3)
Figure 11: (Color online) Secret key rate in the RR scenariowith a heterodyne detection and the security proof of [25].From top to bottom the curves show the secret key rate inthe asymptotic and finite key scenario for realistic devicescharacterized by an electronic noise v elec = 0 .
001 and a finitedetection efficiency η = 0 .
85 and η = 0 .
6. We consider herethe paranoid mode where the noise added by the detectioncan be manipulated by the attacker. The solid lines showthe asymptotic secret key rate, the dashed lines show thesecret key rate with finite blocks of length n = 10 . Otherparameters: ξ = 0 . V A , α = 0 .
2, blocks size n = 10 andthe security parameter (cid:15) = 10 − . same way than our previous simulations, we optimizedthe secret key rate with respect to the reconciliation ef-ficiency and considered both direct and reverse recon-ciliation scenarios with imperfect devices. However, weconsidered the heterodyne protocol, as described in [25],in the paranoid mode where the imperfections of the de-tector are assumed to be controlled by Eve and in thelimit of finite-length data blocks. This corresponds tothe most secure known scenario and as expected the se-cret key rate is lower than in our previous simulations asshown in Fig. 11. With a heterodyne detection charac-terized by an efficiency η = 0 . v elec = 0 .
01, the secret key rate vanishes at about 30 km.This is why we plot in Fig. 11 the secret key rate in boththe finite key and the asymptotic scenario for realistic im-provements of the heterodyne detection. All the curvesare plotted with an electronic noise v elec = 0 .
001 whichis achievable with cooled heterodyne detections. With aheterodyne detection efficiency of 60% a secure distanceof about 35 km can be achieved in the finite key scenariowhile an improved heterodyne detection efficiency of 85%would allow us to exchange keys at about 80 km but inthe asymptotic limit. One can see that the secret keyrate drops below 1 bit per symbol with a heterodyne de-tection efficiency of 60%. We show in Fig. 12 that it isstill possible to exchange secret keys with a rate higherthan 1 bit per symbol at short distance (0 . .In Table II we compare a recent DVQKD experiment Η S ec r e t k e y r a t e Asymptotic Finite key
Figure 12: (Color online) Secret key rate in the RR scenariowith a heterodyne detection and the security proof of [25].From top to bottom the curves show the secret key rate in theasymptotic and finite key scenario for realistic devices char-acterized by an electronic noise v elec = 0 .
001 with respect tothe detection efficiency. We consider here the paranoid modewhere the noise added by the detection can be manipulatedby the attacker. Other parameters: distance d = 0 . km , ξ = 0 . V A , α = 0 .
2, blocks size n = 10 and the securityparameter (cid:15) = 10 − . yielding high secret key throughput [26] with the twoCVQKD scenarios depicted in Fig. 11. Columns twoand four correspond to secret key rate per signal, whilecolumns seven to nine correspond to secret key through-puts. Columns three and five respectively give the ratiosbetween columns two and six and between columns fourand six. In order to get a throughput figure, we multi-ply the secret key rates by the corresponding clock rate.Column seven corresponds to a clock rate of 1 MHz asreported in [8], while column eight reports the expectedthroughput for a reasonable improvement of the clockrate to 50 MHz.On the hardware side, increasing the clock rate toabout 50 MHz is not a big deal: high bandwidth op-tical modulators and acquisition cards are commerciallyavailable while homodyne detections running at a fewhundreds MHz have already been reported [27]. As re-gards the post-processing, privacy amplification can bedone at a few hundreds of MHz on one core of a modernCPU but high efficiency error correction as described inthis paper would require at least one modern GPU andprobably two. More generally, when dealing with contin-uous values at such speeds, every step, such as randomnumbers generation and network communication, mustbe implemented carefully. V. CONCLUSION
We have optimized the performance of practical recon-ciliation schemes for CVQKD, and the resulting schemeshave above 90% efficiency for any SNR, which leads tohigher key rates than those reported in past CVQKD ex-periments [8]. Notably, for distances below 100m, more rate throughputCVQKD ratio / CVQKD ratio / DVQKD
50 MHz
100 m 2.7E-01 17 6.0E-01 39 1.5E-02 2.7E+05 3.0E+07 1.5E+0710 km 1.1E-01 12 2.2E-01 23 9.5E-03 1.1E+05 1.1E+07 9.5E+0630 km 9.0E-03 2 3.2E-02 9 3.6E-03 9.0E+03 1.6E+07 3.6E+0640 km - - 3.7E-03 2 2.2E-03 - 1.8E+05 2.2E+06Table II: Comparison of CVQKD and DVQKD. corresponds to a realistic setting characterized by an electronic noise v elec =0 . η = 0 . corresponds to an optimistic setting characterized by anelectronic noise v elec = 0 . η = 0 .
85 and a 50MHz repetition rate. corresponds to the DVQKD datareported in [26]. For CVQKD, the figures are obtained using the security proof of Ref. [25] as in Fig. 11. than 1 bit per symbol can be distilled. The expectedthroughput with a CVQKD clock rate of 1 MHz, as re-ported in [8], is lower than the best DVQKD reportedthroughput, which uses a 1 GHz clock rate [26]. However,we predict (see Table II) that reasonable improvementsof the CVQKD hardware would result in throughputshigher than those of DVQKD in distances up to 30 Km. VI. ACKNOWLEDGEMENTS
This research was supported by the French NationalResearch Agency, through the HIPERCOM (2011-CHRI- 006) project, by the DIRECCTE Ile-de-France throughthe QVPN (FEDER-41402) project, and by the Euro-pean Union through the Q-CERT (FP7-PEOPLE-2009-IAPP) project.DE acknowledges financial support from the EuropeanCHIST-ERA project CQC (funded partially by MINECOgrant PRI-PIMCHI-2011-1071). [1] V. Scarani, H. Bechmann-Pasquinucci, N. J. Cerf,M. Dušek, N. Lütkenhaus, and M. Peev, Rev. Mod. Phys. , 1301 (2009).[2] C. Weedbrook, S. Pirandola, R. García-Patrón, N. J.Cerf, T. Ralph, J. Shapiro, and S. Lloyd, Rev. Mod.Phys. , 621 (2012).[3] B. Qi, W. Zhu, L. Qian, and H. Lo, New J. Phys. ,103042 (2010).[4] F. Grosshans and P. Grangier, Phys. Rev. Lett. ,057902 (2002).[5] J. Lodewyck, M. Bloch, R. García-Patrón, S. Fossier,E. Karpov, E. Diamanti, T. Debuisschert, N. J. Cerf,R. Tualle-Brouri, S. W. McLaughlin, et al., Phys. Rev.A , 042305 (2007).[6] A. Leverrier, R. Alléaume, J. Boutros, G. Zémor, andP. Grangier, Phys. Rev. A , 042325 (2008).[7] P. Jouguet, S. Kunz-Jacques, and A. Leverrier, Phys.Rev. A , 062317 (2011).[8] P. Jouguet, S. Kunz-Jacques, A. Leverrier, P. Grangier,and E. Diamanti, Nature Photonics , 378 (2013).[9] G. Brassard and L. Salvail, in advances in Cryptology–EUROCRYPT93 (Springer, 1994), pp. 410–423.[10] T. B. Pedersen and M. Toyran, arXiv:1307.7829 (2013).[11] D. Elkouss, A. Leverrier, R. Alléaume, and J. J. Boutros,in Information Theory, 2009. Proceedings. IEEE Interna-tional Symposium on (IEEE, 2009), pp. 1879–1883.[12] M. Tomamichel, J. Martinez-Mateo, C. Pacher, andD. Elkouss, in
Information Theory, 2014. Proceedings.IEEE International Symposium on (IEEE, 2014), pp.1469–1473.[13] J. Martinez-Mateo, D. Elkouss, and V. Martin, ScientificReports , 1 (2013). [14] G. Van Assche, J. Cardinal, and N. J. Cerf, InformationTheory, IEEE Transactions on , 394 (2004).[15] M. Bloch, A. Thangaraj, S. W. McLaughlin, and J.-M.Merolla, in Information Theory Workshop, 2006. ITW’06Punta del Este. IEEE (IEEE, 2006), pp. 116–120.[16] P. Jouguet and S. Kunz-Jacques, Quantum Information& Computation , 329 (2013).[17] J. Cardinal and G. Van Assche, in Information TheoryWorkshop, 2003. Proceedings. 2003 IEEE (IEEE, 2003),pp. 135–138.[18] A. Shokrollahi and R. Storn, in
Information Theory,2000. Proceedings. IEEE International Symposium on (IEEE, 2000), p. 5.[19] S.-Y. Chung, G. D. Forney Jr, T. J. Richardson, andR. Urbanke, Communications Letters, IEEE , 58 (2001).[20] A. Leverrier and P. Grangier, arXiv:1002.4083 (2010).[21] R. García-Patrón and N. J. Cerf, Phys. Rev. Lett. ,190503 (2006).[22] M. Navascués, F. Grosshans, and A. Acín, Phys. Rev.Lett. , 190502 (2006).[23] A. Leverrier, F. Grosshans, and P. Grangier, Phys. Rev.A , 062343 (2010).[24] P. Jouguet, S. Kunz-Jacques, E. Diamanti, and A. Lev-errier, Phys. Rev. A , 032309 (2012).[25] A. Leverrier, arXiv:1408.5689 (2014).[26] L. Comandar, B. Fröhlich, M. Lucamarini, K. Patel,A. Sharpe, J. Dynes, Z. Yuan, R. Penty, and A. Shields,Applied Physics Letters , 021101 (2014).[27] D. Huang, J. Fang, C. Wang, P. Huang, and G. Zeng,Qcrypt 2013 (2013).[28] Let R be the rate of a binary code that is used for rec-onciliation with s as SNR, then β s = R/ log(1 + s ). The same code can be used for reconciliation with a loweramount of noise, in this case the efficiency is simply given by: β s = R/ log(1 + s ) = β s log(1 + s ) / log(1 + ss