Quantum key distribution with phase-encoded coherent states: Asymptotic security analysis in thermal-loss channels
Panagiotis Papanastasiou, Cosmo Lupo, Christian Weedbrook, Stefano Pirandola
aa r X i v : . [ qu a n t - ph ] M a r Quantum key distribution with phase-encoded coherent states:Asymptotic security analysis in thermal-loss channels
Panagiotis Papanastasiou, Cosmo Lupo, Christian Weedbrook, and Stefano Pirandola Computer Science and York Centre for Quantum Technologies,University of York, York YO10 5GH, United Kingdom Xanadu, 372 Richmond St W, Toronto, M5V 2L7, Canada
We consider discrete-alphabet encoding schemes for coherent-state quantum key distribution. Thesender encodes the letters of a finite-size alphabet into coherent states whose amplitudes are sym-metrically distributed on a circle centered in the origin of the phase space. We study the asymptoticperformance of this phase-encoded coherent-state protocol in direct and reverse reconciliation as-suming both loss and thermal noise in the communication channel. In particular, we show thatusing just four phase-shifted coherent states is sufficient for generating secret key rates of the orderof 4 × − bits per channel use at about 15 dB loss in the presence of realistic excess noise. I. INTRODUCTION
Quantum cryptography, or more accurately known asquantum key distribution (QKD), is based on the laws ofquantum information [1, 2] to provide in principle securecommunication between two authorized parties [3, 4], tra-ditionally called Alice and Bob. In particular these twoparties exchange many signals using a quantum channelwhich prohibits an exact duplication of them [5]. Thisfact allows the remote parties to quantify and boundthe amount of information that a potential eavesdrop-per (Eve) may intercept, so that they can still extractand share a secret key. Such key may then be used fordata encryption by means of the one-time pad [6].Since the first QKD protocol [7], many advances havebeen made including theoretical proofs, proof-of princi-ple experiments and in-field tests. Despite these efforts,the performance of any point-to-point QKD protocol can-not surpass the fundamental repeater-less PLOB boundestablished in Ref. [8] based on the relative entropy of en-tanglement of the channel (see Ref. [9] for a review, andRef. [10] for an extension to repeaters and arbitrary net-works). However, it is also true that continuous-variable(CV) QKD [11] has a key rate performance which is notfar from this ultimate bound when we assume ideal recon-ciliation and detectors with high efficiency. Furthermore,another advantage of CV systems [12] relies on the useof cheap room temperature equipment, easily integrablein the current telecommunication infrastructure.In recent years, we have witnessed the introductionof many protocols based on a CV encoding, e.g., ex-ploiting a Gaussian modulation of the amplitude ofGaussian states. These protocols were designed forsqueezed states [13, 14], coherent states [15, 16], ther-mal states [17–20], and also extended from one-wayto two-way quantum communication [21–25] or reducedto one-dimensional encoding [26]. In addition, proto-cols such as in Ref. [27–29], assuming measurement-device-independence (MDI) [30, 31] as a counter-measureagainst detectors’ side-channel attacks, have extendedthe concept of CV-QKD to end-to-end network imple-mentations [32]. For most of these protocols, not only experiments were shown [27, 33–40], but also their se-curity analysis has been gradually refined to incorporatefinite-size effects [41–43] and composable aspects [44–46].We know that Gaussian encoding may be subject toa reduced performance due to the reconciliation codes.This issue can be easily fixed by resorting to a discrete-alphabet encoding, e.g., coherent states with fixed energybut discrete shifting of their phase as in Ref. [47]. Nev-ertheless, the study of these protocols has been mainlyrestricted to the case of a pure-loss channel. In Ref. [48–50] a bound for the secret key rate has been calculatedfor two or four coherent states in a thermal loss chan-nel. However, this was based on a Gaussian approxima-tion [51] of the alphabet, which rapidly becomes loosewhen the energy of the states increases. Also note thatRefs. [52, 53] studied binary and ternary modulation pro-tocols in the presence of collective attacks.In this work, we consider a multi-letter protocol wherethe letters are encoded in different phases of a coher-ent state with fixed energy, so as to form a symmetricconstellation of coherent states equidistant from the ori-gin of the phase space. For this phase-encoded proto-col, we compute the secret key rate in direct and reversereconciliation assuming a thermal-loss channel, i.e., thepresence of an entangling cloner collective attack [11, 54],which is the most typical and realistic collective Gaussianattack [55]. We perform an asymptotic security analy-sis based on infinitely-many uses of the channel, so thatthe secret-key rate may be computed from the Devetak-Winter formula [56]. While our analysis is for arbitrary N number of phases, we specify the results for the caseof N = 4 which well approximates the continuous limit N → ∞ when the energy of the states is sufficiently low. II. PROTOCOL
Consider a discrete alphabet with N letters, randomlydrawn by Alice. Each letter k is encoded into a coherentstate with amplitude a k = ze iφ k , where z is a fixed ra-dius in phase space (it is just the square root of the meannumber of photons) and the phase is given by φ k = πN k .We call each realization C ( z, N ) of this encoding schemea “constellation”. As an example, a four-state constella-tion is shown in Fig. 1. The coherent state is preparedon mode A which is sent through a thermal-loss chan-nel, whose output B is detected by Bob. In a practicalrealization of the protocol, this measurement is an het-erodyne detection [57].As already mentioned, the thermal-loss channel de-scribes the effect of an entangling cloner collective at-tack [54]. In each use of the channel, Eve’s modes e and E are prepared in a two-mode squeezed vacuum (TMSV)state with variance ω ≥
1, so that ¯ n = ω − is the meannumber of photons in each thermal mode [11]. Mode E interacts with Alice’s mode A via a beam splitter withtransmissivity τ , which characterizes the channel losses.Eve’s output mode E ′ and kept mode e are then storedin a quantum memory which is measured at the end ofthe protocol. Note that for ¯ n = 0 Eve is injecting avacuum mode, so that the channel becomes a pure-losschannel [8, 11]. In this case, the output modes E ′ and B are described by coherent states with attenuated ampli-tudes. FIG. 1: Alice prepares mode A in one of the four coherentstates of the constellation C ( z,
4) with radius z and sendsit to Bob through a thermal-loss channel dilated into anentangling-cloner attack. In particular, the beam splitter hastransmissivity τ , characterizing the channel loss, and the vari-ance ω ≥ III. DIRECT RECONCILIATION
We start by presenting the analysis of the protocol indirect reconciliation [15], where Bob infers Alice’s input.This analysis is first given for the pure-loss channel, con-sidering an upper bound for the key rate (assuming aquantum memory for Bob) and then a realistic key rate(where Bob applies heterodyne detection). We then gen-eralize the realistic key rate to a thermal-loss channel,presenting the specific results for N = 4 coherent states. A. Pure loss channel
1. Upper bound for the secret key rate
In this section, we assume that Bob has a quantummemory so that he may apply an optimal joint detection.This gives an upper bound to the actual performanceof the protocol. This analysis provides simple resultsthat allow us to give an insight on the performance withrespect to different constellation parameters z and N . Inparticular, we may show the conditions where N = 4coherent states allow the parties to achieve essentiallythe same performance as N → ∞ coherent states.Because Alice is sending coherent states | a k i with thesame probability p k = 1 /N , the average state before thechannel is given by ρ A = 1 N N − X k =0 | a k ih a k | . (1)It is clear that this state is parameterized by N and z . InFig. 2, we have plotted the von Neumann entropy S ( ρ A )of ρ A for different N over the radius of the encodingscheme z . Recall that S ( ρ ) := − Tr( ρ log ρ ) = − X j n j log n j , (2)where n j are the eigenvalues of a generic state ρ (see Ap-pendix A for more details on how to compute this entropyvia a preliminary Gram-Schmidt procedure). The en-tropy S ( ρ A ) is larger as we increase the number of statesin the circle. For any given N , the entropy saturates toa constant value after a certain value of the radius z . Wealso consider the limit of N → ∞ (see Appendix B forthe calculation of the corresponding average state).After a pure-loss channel with transmissivity τ ∈ (0 , ρ B = 1 N N − X k =0 |√ τ a k ih√ τ a k | . (3)Assuming that Bob accesses a quantum memory andmay perform a collective optimal detection of all the out-put modes, his accessible information is bounded by theHolevo information [11] χ ( B : { a k } ) = S ( ρ B ) − N N − X k =0 S ( | a k ih a k | ) . (4)In particular, since a coherent state is a pure state itsvon Neumann entropy is zero, which simplifies Eq. (4)into χ ( B : { a k } ) = S ( ρ B ). In order to calculate the vonNeumann entropy of the mixture ρ B , we express the N coherent states in terms of a Gram-Schmidt orthonormalbasis (see details in Appendix A).In the same fashion, we calculate the Holevo informa-tion of the eavesdropper, who can keep in a quantum Constellation Radius E n t r op y N= ∞ N=2 N=3 N=4 N=5 N=7
FIG. 2: The von Neumann entropy S ( ρ A ) of the Alice’s av-erage state ρ A for different number N over the radius z ofthe constellation circle (solid lines). We plotted also the en-tropy of the continuous uniform distribution ( N → ∞ ) of theconstellation states (dashed line). memory the other output E ′ of the beam splitter. ThenEve’s average state will be given by ρ E ′ = 1 N N − X k =0 |√ − τ a k ih√ − τ a k | (5)and her accessible information by χ ( E ′ : { a k } ) = S ( ρ E ′ ) . (6)Therefore, we get the optimal secret key rate R = χ ( B : { a k } ) − χ ( E ′ : { a k } ) = S ( ρ B ) − S ( ρ E ′ ) . (7)In Fig. 3 we plotted this optimal rate for N = 4 as afunction of the transmissivity τ and for different values ofthe radius z . We see that there is an optimal intermediatevalue for z , so that it cannot be too small (so that all thecoherent states are too similar to the vacuum), neithertoo large (so that all the coherent states become almost-perfectly distinguishable). Then, in Fig. 4, we also showthat the optimal performance for the N = 4 protocolis very close to that of the continuous-alphabet protocol N = ∞ for the relevant values of the radius z .
2. Realistic secret key rate
Contrary to the previous discussion, the realistic situa-tion is dictated by the limitations in the current technol-ogy. In this case, Bob does not use a quantum memoryand an optimal collective measurement but individualheterodyne detections, with a continuous (complex) out-come b . Therefore, in order to calculate the secret key Transmissivity U ppe r bound z=2 z=3z=1z=0.5 z=0.7 FIG. 3: The optimal secret-key rate of Eq. (7) for N = 4 isplotted over the transmissivity τ for different values of theradius z of the constellation. We can see that for values z < z is decreasing (blue lines) while for z > z increases till it gets to zero for z = 10 (green lines). Transmissivity U ppe r bound z=0.6z=0.5z=0.7z=1 FIG. 4: The optimal secret-key rate of Eq. (7) for N = 4is plotted over the transmissivity τ for different values of theradius z (solid red lines). Here we also plot the optimal se-cret key rate for the continuous uniform distribution of states(black dashed lines). We see that for z < .
6, the two ratesbecome almost identical. This corresponds to a saturationpoint for the 4-state protocol, so that it makes no differenceto use four coherent states or infinite. rate, we need to consider the corresponding mutual in-formation between Alice and Bob. Let us define the vari-ables X A = { a k , p k } with p k = 1 /N and X B = { b, p ( b ) } .Then, we consider I ( X A : X B ) = H ( X A ) − H ( X A | X B ) , (8)where H is the Shannon entropy and H ( ... | ... ) the condi-tional Shannon entropy. Recall that H ( X A | X B ) = Z p ( b ) H ( X A | X B = b ) d b. (9) Attenuation (dB) -3 -2 R a t e ( b i t s / u s e ) FIG. 5: Realistic secret-key rate (bits/use) over the attenua-tion (decibels) in direct reconciliation for N = 4 and z = 0 . n = 0 . n = 0 . It is clear that H ( X A ) = log N . In order to calcu-late the probability distribution p ( a k | b ), i.e., the prob-ability that the state | a k i was sent through the chan-nel given that Bob measured the amplitude b . Theprobability that Bob measures b given that the coher-ent state | α k i was sent through the channel is given by p ( b | a k ) = π e −| b −√ τa k | . Therefore, we can apply Bayes’rule to obtain p ( a k | b ) = 1 N πp ( b ) e −| b −√ τa k | , (10)where p ( b ) = N P Nk =0 p ( b | a k ). With all these elementswe can compute the Devetak-Winter rate R = I ( X A : X B ) − S ( ρ E ′ ) which is plotted in Fig. 5 for N = 4. B. Thermal loss channel
We now consider the more general case of a thermal-loss channel, i.e., the presence of an entangling-clonerattack. Let us write Eve’s TMSV state in the Fock ba-sis [11] ρ Ee ( λ ) = (1 − λ ) ∞ X n =0 ( − λ ) ( k + l ) | k ih l | ⊗ | k ih l | , (11)with λ = tanh (cid:2) arcosh(2¯ n + 1) (cid:3) , where ¯ n is the meannumber of thermal photons. Let us apply the beam split-ter operation to Alice’s mode A and Eve’s mode E , withannihilation operators ˆ a A and ˆ a E , respectively. This isgiven by [11] U ( θ ) = exp h θ (cid:16) ˆ a † A ˆ a E − ˆ a A ˆ a † E (cid:17)i , (12) where θ = arcos( √ τ ). Therefore, the global output stateof Bob (mode B ) and Eve (modes e and E ′ ), is given by ρ BE ′ e ( θ, a k , λ ) = U ( θ )Π A ( a k ) ρ Ee ( λ ) U † ( θ ) , (13)where Π A ( a k ) := | a k ih a k | . By tracing out B , we obtainEve’s state ρ Eve | k := ρ E’e ( θ, a k , λ ) = Tr B [ ρ BE ′ e ( θ, a k , λ )] . (14)The average state of Eve is given by the convex sum ρ Eve ( θ, z, λ ) = 1 N N X k =0 ρ Eve | k . (15)Therefore, the Holevo information is given by χ (Eve : X A ) = S ( ρ Eve ) − N N X k =0 S ( ρ Eve | k ) . (16)The entropy of the state ρ Eve | k does not depend on k ,i.e., the phase of the amplitude of the coherent state thatAlice has sent. Thus Eq. (16) can be simplified to χ (Eve : X A ) = S ( ρ Eve ) − S ( ρ Eve | k ) , (17)for any k . In order to calculate the mutual information,we follow the reasoning of Section III A 2 with the differ-ence that Bob’s probability distribution is given by p ( b | a k )(¯ n ) = Tr[Π( b ) ρ ( √ τ a k , (1 − τ )¯ n )Π † ( b )] , (18)where Π( b ) := | b ih b | and ρ ( √ τ a k , (1 − τ )¯ n ) is a displacedthermal state with amplitude √ τ a k and mean photonnumber (1 − τ )¯ n . We find (see Appendix C) p ( b | a k )(¯ n ) = exp h | b −√ τa k | − t )¯ n i π (1 + (1 − τ )¯ n ) . (19)Using the Bayes’ rule we can derive p ( a k | b )(¯ n ) and com-pute Alice and Bob’s mutual information via the formulain Eq. (8). Altogether, we then compute (numerically)the direct reconciliation secret-key rate R (¯ n ) = I ( X A : X B )(¯ n ) − χ (Eve : X A ) . (20)In Fig. 5, we plot this secret key rate over the attenua-tion for a protocol with N = 4 and z = 0 .
1. In particular,we see that the performance obtained in the presence ofthermal noise ¯ n = 0 .
01 is not so far from the performanceachievable in the presence of a pure-loss channel. In otherwords, the four-state protocol is sufficiently robust to thepresence of excess noise. However, as expected, we alsohave that direct reconciliation restricts the use of theprotocol to low loss. The case is for different reverse rec-onciliation that we study below.
Attenuation (dB) -4 -3 -2 R a t e ( b i t s / u s e ) FIG. 6: Realistic secret key rate (bits/use) over the attenua-tion (decibels) in reverse reconciliation for N = 4 and z = 0 . ǫ = 0 . V M = 0 . IV. REVERSE RECONCILIATION
As before, for the sake of simplicity, we start by con-sidering the case of a pure-loss channel in reverse recon-ciliation [33] and then we extend the results to the pres-ence of thermal noise. We just need to re-compute Eve’sHolevo bound (now with respect to Bob’s outcomes).More specifically, we need to re-compute Eve’s condi-tional entropy.Eve’s state conditioned to Bob’s outcome b is ρ E ′ | b = N − X k =0 p ( a k | b ) |√ − τ a k ih√ − τ a k | , (21)where p ( a k | b ) is given in Eq. (10). We can then com-pute S ( ρ E ′ | b ) which is now depending on b . Using thisquantity, we may write the secret-key rate R = I ( X A : X B ) − S ( ρ E ′ ) + Z d bp ( b ) S ( ρ E ′ | b ) . (22)This rate is plotted in Fig. 6 for the four-state protocol N = 4 and radius z = 0 . ρ E ′ e | b = N − X k =0 p ( a k | b )(¯ n ) ρ Eve | k , (23)where ρ Eve | k is given in Eq. (14) and p ( a k | b ) comes fromEq. (19). Therefore, we may derive S ( ρ E ′ e | b ) and calcu-late the secret-key rate R (¯ n ) = I ( X A : X B )(¯ n ) − S ( ρ Eve ) + Z d b p ( b )(¯ n ) ρ E ′ e | b , (24) where p ( b )(¯ n ) := N P N − k =0 p ( b | a k )(¯ n ). Numerically, wecompute this rate by truncating the Hilbert space to asuitable number of photons, which is of the order of ≃ −
15 photons for the specific regime of parametersconsidered.
Attenuation (dB) -2 -1 R a t e ( b i t s / u s e ) FIG. 7: Realistic secret key rate (bits/use) over the attenu-ation (decibels) in reverse reconciliation over the attenuation(decibels) for N = 4 and z = 1. We have plotted the ratefor a pure-loss channel (lower solid line) and a thermal-losschannel with excess noise ǫ = 0 .
01 (lower dashed line). Thecorresponding secret key rate for the protocol with Gaussianmodulation ( V M = 2) has also been plotted for the case ofpure-loss channel (upper solid line) and thermal-loss channelwith excess noise ǫ = 0 .
01 (upper dashed line). We see that,for this regime of energies, the rate of the four-state protocoldoes not coincide with the rate of the Gaussian protocol.
In Fig. 6, we plot the reverse reconciliation secretkey rate over the attenuation for the four-state protocol N = 4 with radius z = 0 . ǫ = 0 .
001 [58].We can see that the protocol is sufficiently robust to ex-cess noise, achieving a rate of 6 × − bits per channeluse for attenuation values of about 20 dB. In this regimeof energy, the performance of the protocol coincides withthat of a Gaussian protocol modulating coherent statewith modulation variance V M = 2 z (and performingheterodyne detection on the channel output). On thecontrary, for larger energies, e.g., for a constellation ra-dius z = 1, the rate of the four-state protocol does notcoincide with its Gaussian counterpart, as also illustratedin Fig. 7. Here the four-state protocol can achieve a rateof the order of 4 × − bits per channel use for attenu-ation values of about 15 dB and excess noise ǫ = 0 . V. CONCLUSION
In this work, we have investigated finite-alphabetcoherent-state QKD protocols, where the encoding is per-formed by randomly choosing the phase of the coherentstates so that they are iso-energetic and symmetricallydistributed around the origin of the phase space. Consid-ering an optimal scenario where Bob may access a quan-tum memory and the channel is pure-loss, we have ana-lyzed the conditions under which the use of four statescan approximate a continuous alphabet. Our analysisis asymptotic, i.e., we assume the limit of infinite signalstates exchanged by the remote parties, so that it doesnot account for finite-size effects and composable aspects.Nevertheless, this is the first study of these types of pro-tocols in the presence of realistic thermal-loss conditions,without assuming Gaussian approximations. In reversereconciliation, we find that the four-state phase-encodedprotocol is sufficiently robust to loss and noise, so thatit may be used to extract secret keys at metropolitanmid-range distances (e.g. around 75 km).
VI. ACKNOWLEDGEMENTS
C.W. would like to acknowledge the Office of NavalResearch program Communications and Networking withQuantum Operationally-Secure Technology for MaritimeDeployment (CONQUEST), awarded to Raytheon BBNTechnologies under prime contract number N00014-16-C-2069. P. P. acknowledges support from the EP-SRC via the ‘UK Quantum Communications Hub’(EP/M013472/1) and would like to thank Thomas Copefor advices on the use of the computer cluster of the Uni-versity of York (YARCC). C. L. acknowledges supportfrom Innovation Fund Denmark (Qubiz project).
Appendix A: Orthonormal basis for N coherentstates Suppose that we have N coherent states described byamplitudes a k for k = 0 , . . . N −
1. Since these states arenon-orthogonal we can have a matrix V that describestheir overlaps, which are given by V ij = h a i | a j i = exp (cid:20) − (cid:0) | a i | + | a j | − a ∗ i a j (cid:1)(cid:21) . (A1)For a constellation of states as described before and afterthe attenuation due to the propagation through a pure-loss channel, the overlaps for Bob are given by V Bij = h√ τ a i |√ τ a j i = exp h τ z (cid:16) e i πN ( j − i ) − (cid:17)i , (A2)while for Eve we may write V Eij = h√ − τ a i |√ − τ a j i == exp h (1 − τ ) z (cid:16) e i πN ( j − i ) − (cid:17)i . (A3)Then, according to the Gram-Schmidt procedure, we canderive an orthonormal basis {| i i} = {| i , | i , . . . | N − i} for the subspace spanned by these N coherent states. As a result, each state will be expressed as a superpositionof this basis vectors as | a k i = k X i =0 M ki | i i (A4)where the M ki can be computed by the algorithm M k = V k , M ki = M ii (cid:16) V ik − P i − j =0 M ∗ ij M kj (cid:17) if 1 ≤ i < k , M ki = 0 otherwise, M kk = q − P k − i =0 | M ki | for k > ρ ( a k ) = | a k ih a k | is given by ρ ( a k ) = k X i,j =0 M k,i M ∗ k,j | i ih j | , (A5)and the average state takes the form ρ = 1 N N − X k =0 ρ ( a k ) = 1 N N − X k =0 k X i,j =0 M k,i M ∗ k,j | i ih j | . (A6)Diagonalizing the previous state, we then compute itsvon Neumann entropy. Appendix B: Asymptotic state for a continuousalphabet
Let us express a coherent state in the Fock basis, i.e,Π( a ) := | a ih a | = e −| a | ∞ X n,m =0 a n ( a † ) m √ n ! √ m ! | n ih m | (B1)In order to be able to do numerical calculations, we haveto truncate the Fock space and a very good approxima-tion is given by n ∼ | α | . As a result, in this truncatedFock basis, the state will beΠ tranc ( a ) ≃ e −| a | ⌊ | a | ⌋ X n,m =0 a n ( a † ) m √ n ! √ m ! | n ih m | . (B2)For N coherent states in a constellation with radius z ,the average state can be written as ρ = e − z N ⌊ z ⌋ X n,m =0 z ( n + m ) P N − j =0 e i πN ( n − m ) j √ n ! √ m ! | n ih m | , (B3)where the non zero terms are the terms with m − n = N and n = m . For a continuous distribution p ( a φ ) = π of phase-encoded coherent states | a φ i with fixed radius z = | a | and φ = arg( a φ ), Eq. (B3) becomes ρ = e − z π ⌊ z ⌋ X n,m =0 z ( n + m ) R π e i φ ( n − m ) dφ √ n ! √ m ! | n ih m | == e − z ⌊ z ⌋ X n =0 z n n ! | n ih n | . (B4) Appendix C: Displaced thermal state
A thermal state with mean number of photons ¯ n maybe expressed as a convex sum of coherent states | a i ac-cording to the P-Glauber representation as ρ (¯ n ) = Z p ( a, ¯ n ) | a ih a | d a, p ( a, ¯ n ) = 1¯ nπ e −| a | / ¯ n . (C1)Applying the displacement operator D ( d ), which dis-places a coherent state | a i with amplitude a into a co-herent state | a + d i with amplitude a + d , we obtain adisplaced thermal state ρ ( d, ¯ n ) = D ( d ) ρ (¯ n ) D † ( d ) == Z p ( a, ¯ n ) D ( d ) | a ih a | D † ( d ) d a == Z p ( a, ¯ n ) | a + d ih a + d | d a == Z p ( c − d, ¯ n ) | c ih c | d c (C2)with p ( c − d, ¯ n ) = nπ e −| c − d | / ¯ n . According to equationEq. (B1), we can have a representation of this state in Fock basis, so that ρ ( d, ¯ n ) = Z ∞ X n,m =0 p ( a − d, ¯ n ) e −| a | a n ( a ∗ ) m √ n ! √ m ! | n ih m | d a (C3)The state after projecting to a coherent state | b i (hetero-dyne measurement), i.e., Π( b ) ρ ( d, ¯ n )Π † ( b ), will be calcu-lated as Z d a ∞ X n,m,k,l,i,j =0 p ( a − d, ¯ n ) e −| α | α n ( α ∗ ) m √ n ! √ m ! e −| b | b k ( b ∗ ) l √ k ! √ l ! ×× e −| b | b i ( b ∗ ) j √ i ! √ j ! | k ih l || n ih m || i ih j | = (C4) Z d a p ( a − d, ¯ n ) e −| a | e − | b | ∞ X n,m =0 ( ab ∗ ) n ( ba ∗ ) m √ n ! √ m ! ×× ∞ X k,j =0 b k ( b ∗ ) j √ k ! √ j ! | k ih j | , (C5)and, applying the trace operation, we obtain the proba-bility distribution p ( b | d )(¯ n ) = Z d a nπ e −| a − d | / ¯ n e − ( | a | + | b | − b ∗ a − ba ∗ ) == 1¯ nπ Z e −| a − d | / ¯ n e −| a − b | d a == 1(¯ n + 1) π exp (cid:0) −| b − d | / (¯ n + 1) (cid:1) . (C6)Let us write this probability distribution for the thermaloutput state of a thermal-loss channel with transmissivity τ and mean thermal photon number ¯ n when applied to aninput coherent state | a k i ( d := √ τ a k ). We find Eq. (19). [1] M. A. Nielsen, and I. L. Chuang, Quantum computationand quantum information (Cambridge University Press,Cambridge, 2000).[2] M. Hayashi,
Quantum Information Theory: Mathe-matical Foundation (Springer-Verlag Berlin Heidelberg,2017).[3] N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, Rev.Mod. Phys. , 145 (2002).[4] V. Scarani, H. Bechmann-Pasquinucci, N. J. Cerf, M.Dusek, N. L¨utkenhaus, and M. Peev, Rev. Mod. Phys. , 1301 (2008)[5] W. K. Wootters and W. H. Zurek, Nature , 802-803(1982).[6] B. Schneier, Applied Cryptography (John Wiley & Sons,New York, 1996).[7] C. H. Bennett and G. Brassard, Theoretical ComputerScience , 7-11 (2014).[8] S. Pirandola, R. Laurenza, C. Ottaviani, and L. Banchi,Nat. Commun. , 15043(2017). See also arXiv:1510.08863and arXiv:1512.04945 (2015). [9] S. Pirandola, S. L. Braunstein, R. Laurenza, C. Otta-viani, T. P. W. Cope, G. Spedalieri, and L. Banchi, The-ory of channel simulation and bounds for private com-munication , arXiv:1711.09909 (2017).[10] S. Pirandola,
Capacities of repeater-assisted quantumcommunications , arXiv:1601.00966 (2016).[11] C. Weedbrook, S. Pirandola, R. Garc´ıa-Patr´on, N. J.Cerf, T. C. Ralph, J. H. Shapiro, and S. Lloyd, Rev.Mod. Phys. , 621 (2012).[12] S. L. Braunstein and P. van Loock, Rev. Mod. Phys. ,513 (2005).[13] M. Hillery, Phys. Rev. A , 022309 (2000).[14] N. J. Cerf, M. Levy, and G. Van Assche, Phys. Rev. A , 052311 (2001).[15] F. Grosshans and P. Grangier, Phys. Rev. Lett. ,057902 (2002).[16] C. Weedbrook, A. M. Lance, W. P. Bowen, T. Symul, T.C. Ralph, and P. K. Lam, Phys. Rev. Lett. , 170504(2004).[17] R. Filip, Phys. Rev. A , 022310 (2008). [18] C. Weedbrook, S. Pirandola, and T. C. Ralph, Phys. Rev.Lett , 110501 (2010).[19] V. C. Usenko and R. Filip, Phys. Rev. A , 022318(2010).[20] C. Weedbrook, S. Pirandola, and T. C. Ralph, Phys. Rev.A , 022318 (2012).[21] C. Weedbrook, C. Ottaviani, and S. Pirandola, Phys.Rev. A , 012309 (2014).[22] S. Pirandola, S. Mancini, S. Lloyd, and S. L. Braunstein,Nat. Phys. , 726 (2008).[23] C. Ottaviani and S. Pirandola, Sci. Rep. , 22225 (2016).[24] J. H. Shapiro, Phys. Rev. A , 022320 (2009).[25] Q. Zhuang, Z. Zhang, J. Dove, F. N. C. Wong, and J. H.Shapiro, Phys. Rev. A , 012322 (2016).[26] V. C. Usenko, and F. Grosshans, Phys. Rev. A , 062337(2015).[27] S. Pirandola, C. Ottaviani, G. Spedalieri, C. Weedbrook,S. L. Braunstein, S. Lloyd, T. Ghering, C. S. Jacobsen,and U. L. Andersen, Nat. Photon. , 397 (2015).[28] S. Pirandola, C. Ottaviani, G. Spedalieri, C. Weedbrook,S. L. Braunstein, S. Lloyd, T. Ghering, C.S. Jacobsen,and U. L. Andersen, Nat. Photon. , 773 (2015).[29] C. Ottaviani, G. Spedalieri, S. L. Braunstein, and S. Pi-randola, Phys. Rev. A , 022320 (2015).[30] S. L. Braunstein and S. Pirandola, Phys. Rev. Lett. ,130502 (2012).[31] M.Curty, B. Qi, H.K. Lo, Phys. Rev. Lett. , 130503(2012).[32] C. Ottaviani, C. Lupo, R. Laurenza, and S.Pirandola, High-rate secure quantum conferencing ,arXiv:1709.06988 (2017).[33] F. Grosshans, G. Van Ache, J. Wenger, R. Brouri, N. J.Cerf, and P. Grangier, Nature , 238 (2003).[34] J. Lodewyck, M. Bloch, R. Garc´ıa-Patr´on, S. Fossier, E.Karpov, E. Diamanti, T. Debuisschert, N. J. Cerf, R.Tualle-Brouri, S. W. McLaughlin et al. , Phys. Rev. A , 042305 (2007).[35] L. S. Madsen, V. C. Usenko, M. Lassen , R. Filip, andU. L. Andersen, Nat. Commun. , 1083 (2012).[36] P. Jouguet, S. Kunz-Jacques, A. Leverrier, P. Grangier,and E. Diamanti, Nat. Photon. , 378 (2013)[37] Z. Zhang, M. Tengner, T. Zhong, F. N. C. Wong, and J.H. Shapiro, Phys. Rev. Lett. , 010501 (2013).[38] J. H. Shapiro, Z. Zhang, and F. N. C. Wong, QuantumInf. Process. , 2171 (2014).[39] C. S. Jacobsen, T. Gehring, and U. L. Andersen, Entropy , 4654 (2015).[40] Y.-C. Zhang et al ., Continuous-variable QKD over 50kmcommercial fiber , arXiv:1709.04618 (2017).[41] A. Leverrier, F. Grosshans, and P. Grangier, Phys. Rev.A , 062343 (2010).[42] L. Ruppert, V. C. Usenko, and R. Filip, Phys. Rev. A , 062310 (2014).[43] P. Papanastasiou, C. Ottaviani, and S. Pirandola, Phys.Rev. A , 042332 (2017)[44] A. Leverrier, Phys. Rev. Lett. , 070501 (2015).[45] A. Leverrier, Security of continuous-variable quantumkey distribution via a Gaussian de Finetti reduction ,arXiv:1701.03393 (2017).[46] C. Lupo, C. Ottaviani, P. Papanastasiou, and S. Piran-dola,
CV MDI QKD: Composable Security against Co-herent Attacks , arXiv:1704.07924 (2017).[47] D. Sych and G. Leuchs, New J. Phys. , 053019 (2010).[48] A. Leverrier and P. Grangier, Phys. Rev. Lett. ,180504 (2009).[49] A. Leverrier and P. Grangier, Continuous-variable Quan-tum Key Distribution protocols with a discrete modula-tion , arXiv:1002.4083 (2010).[50] A. Leverrier and P. Grangier, Phys. Rev. A , 042312(2011).[51] R. Garcia-Patron and N. J. Cerf, Phys. Rev. Lett. ,190503 (2006).[52] Y. Bo, M. Heid, J. Rigas, and N. L¨utkenhaus, Phys. Rev.A , 012307 (2009).[53] K. Br´adler and C. Weedbrook, Phys. Rev. A , 022310(2018).[54] F. Grosshans, N. J Cerf, J. Wenger, R. Tualle-Brouri, andP. Grangier, Quantum Inf Comput , 535-552 (2003).[55] S. Pirandola, S. L. Braunstein, and S. Lloyd, Phys. Rev.Lett. , 200504 (2008).[56] I. Devetak and A. Winter, Proc. R. Soc. London A ,207 (2005).[57] J. H. Shapiro, IEEE Journal of Quantum Electronics ,237-250 (1985).[58] In order to evaluate the excess noise of the thermal-losschannel, Alice may send Gaussian-modulated decoy co-herent states to Bob (interleaved with coherent statesused for the key). At the end of all quantum communica-tion, Alice informs Bob in which instances she was send-ing decoys so that they can use their data to compute ǫ .In the asymptotic regime, we may write ǫ = (1 − τ )( ω − ττ