# Homodyne Detection Quadrature Phase Shift Keying Continuous-Variable Quantum
Key Distribution with High Excess Noise Tolerance

Wen-Bo Liu  Chen-Long Li  Yuan-Mei Xie  Chen-Xun Weng  Jie Gu  Xiao-Yu Cao
Yu-Shuo Lu  Bing-Hong Li  Hua-Lei Yin<EMAIL_ADDRESS>Zeng-Bing Chen
<EMAIL_ADDRESS>National Laboratory of Solid State Microstructures, School
of Physics and Collaborative Innovation Center of Advanced Microstructures,
Nanjing University, Nanjing 210093, China

###### Abstract

Discrete-modulated continuous-variable quantum key distribution with homodyne
detection is widely recognized for its ease of implementation, efficiency with
respect to error correction, and its compatibility with modern optical
communication devices. However, recent studies report that the application of
homodyne detection obtains poor tolerance to excess noise and insufficient
transmission distance, hence seriously restricting the large-scale deployment
of quantum secure communication networks. In this paper, we propose a homodyne
detection protocol using the quadrature phase shift keying technique. By
limiting information leakage, our proposed protocol enhances excess noise
tolerance to a high level. Furthermore, we demonstrate that homodyne detection
performs better than heterodyne detection in quaternary-modulated continuous-
variable quantum key distribution under the untrusted detector noise scenario.
The security is analyzed using the tight numerical method against collective
attacks in the asymptotic regime. Our results imply that the current protocol
is able to distribute keys in nearly intercity area and thus paves the way for
constructing low-cost quantum secure communication networks.

##  I INTRODUCTION

In recent years, the rapid development of quantum computing [1, 2] has
signaled the coming quantum era, which threatens modern secure communications.
For example, the most widely used public key cryptography, the Rivest-Shamir-
Adleman cryptosystem [3], whose security relies on the complexity of
factorizing a large number, can be cracked by the Shor algorithm [4] with
quantum computers. Fortunately, the one-time pad algorithm [5] can ensure
information-theoretically secure communication provided that two remote users
share a large number of identical secret keys. Quantum key distribution (QKD)
[6, 7] is the only solution that enables two distant users to share secure
keys against the most general attacks [8, 9, 10].

Since the first protocol was proposed by Bennett and Brassard in 1984 [6], a
large number of discrete-variable quantum key distribution (DV-QKD) protocols,
based on various discrete degrees of freedom of a single photon, have been
developed, such as polarization [11, 12, 13] and time bin [14, 15, 16]. Many
attempts have been made to realize the network deployment of DV-QKD [9, 10,
17, 18]. Compared with DV-QKD, continuous-variable quantum key distribution
(CV-QKD) [8, 19] has the competitive advantages of lower-cost implementations
and higher secret key rates over the metropolitan areas, and it has thus
attracted widespread attention.

CV-QKD encodes keys on the quadratures of the quantized electromagnetic field
by preparing and measuring coherent states [20, 21, 22] or squeezed states
[23]. From an experimental perspective, CV-QKD based on Gaussian modulation
has made remarkable achievements [24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34,
35], such as the provision of security against all detection loopholes [33],
integration of all optical components on chips [34], and record-breaking
distance up to 200 km [35]. Because Gaussian modulation, which samples
quadratures from Gaussian distribution, possesses $U(n)$ symmetry, it has a
relatively complete security analysis [36, 37, 38, 39, 40] based on the
optimality of Gaussian attacks [41, 42]. However, the continuous modulation of
quadratures is not experimentally feasible [43]. Practical implementations
sample from a discrete and finite distribution of coherent states to
approximate the Gaussian distribution, resulting in an unclosed gap between
security analysis and experimental implementation. Moreover, Gaussian
modulation requires complex post-processing procedures mainly because of the
low signal-to-noise ratio and complex data structure, which often consumes
large amounts of computing resources [27, 44].

Unlike Gaussian modulation, discrete modulation [45, 46, 47, 48, 49] can
sample from a quite small set of coherent states with different phases and,
thus, can perform an easier error correction. The security proof of discrete
modulation carefully considers the effect of discrete distribution of prepared
states. Despite that discrete modulation lacks $U(n)$ symmetry, several
effective numerical [50, 51, 52] and analytical methods [53, 54] have emerged
for security analysis, and robustness to collective attacks in the asymptotic
regime has been verified. Recently, the security proof of a binary-modulated
protocol has been proposed in the finite-key-size regime against general
coherent attacks [55]. With security improvement and simplified
implementations, discrete modulation becomes a trend of CV-QKD [9, 10].

Currently, for CV-QKD implementations, homodyne detection is a relatively
mature technology with the advantages of simple structures, stable
performance, high efficiency, and low noise, making it widely adopted [24, 25,
26, 27, 28, 29, 30, 31, 32, 33, 34, 35]. However, the existing homodyne
detection protocol for discrete modulation, specifically quaternary modulation
[51], performs poorly in terms of excess noise tolerance, which is far from
practical demands.

In this paper, we present a quaternary-modulated protocol with homodyne
detection. Unlike in previous quaternary-modulated protocols [50, 51], we
prepare each signal with the phase chosen from
$\\{\frac{\pi}{4},\frac{3\pi}{4},\frac{5\pi}{4},\frac{7\pi}{4}\\}$, which can
be implemented using classical quadrature phase shift keying (QPSK)
technology. We require the sender to generate raw keys according to quadrature
choices of the receiver. According to this interesting operation, our protocol
shows good tolerance to excess noise and promises significantly longer
transmission distances than the previous homodyne detection protocol [51]. In
addition, the secret key rate of the proposed protocol is comparable to that
of the well-performed heterodyne detection protocol [51]. Considering the
imperfections of detectors, our protocol even performs better than the
heterodyne detection protocol.

We introduce our protocol in Section II, with an instruction of a possible
experimental setup. In Section III, the formula of the secret key rate is
given against collective attacks in the asymptotic regime. In Section IV, we
numerically simulate the performance of our proposed protocol, which
demonstrates an increase in transmission distance and secret key rate. Further
discussions are presented in Section V.

##  II PROTOCOL DESCRIPTION

We illustrate our protocol in this section using the preparing and mapping
method in Fig. 1 and the experimental setup in Fig. 2.

Figure 1: Quaternary phase shift keying and key mapping of our protocol. Alice
randomly sends one coherent state with amplitude $\alpha$ and phase
$\theta\in\\{\frac{\pi}{4},\frac{3\pi}{4},\frac{5\pi}{4},\frac{7\pi}{4}\\}$
for each round, representing labels $\\{00,10,11,01\\}$, respectively. For
each round, Bob randomly measures one quadrature from $\\{\hat{q},\hat{p}\\}$.
He maps the outcome greater than $\Delta$ into bit 0 and the outcome smaller
than $-\Delta$ into bit 1. After the announcement, Alice records the first bit
of the label as her key bit if a state is measured in $\hat{q}$ or the second
bit of the label if a state is measured in $\hat{p}$.

_(1) Preparation._ —For each round, the sender Alice prepares randomly one of
four coherent states $\left\\{\mbox{$\left|\alpha
e^{i\frac{\pi}{4}}\right\rangle$},\mbox{$\left|\alpha
e^{i\frac{3\pi}{4}}\right\rangle$},\mbox{$\left|\alpha
e^{i\frac{5\pi}{4}}\right\rangle$},\mbox{$\left|\alpha
e^{i\frac{7\pi}{4}}\right\rangle$}\right\\}$ with equal probabilities. She
then sends the prepared state to the receiver Bob.

_(2) Measurement._ —After receiving the state, Bob selects randomly a
quadrature from $\\{\hat{q},\hat{p}\\}$ with equal probabilities and performs
corresponding homodyne detection to obtain the measurement outcome.

_(3) Announcement and parameter estimation._ —After sufficient rounds of the
above two steps, Alice and Bob communicate through an authenticated public
channel. First, Bob announces his choice of quadrature for each round. Second,
Alice and Bob randomly select a test subset from all rounds. For each round in
the test subset, Alice discloses the state that she sends, and Bob discloses
the outcome. Based on the information that they expose, they calculate the
secret key rate under reverse reconciliation. If calculations show that no
secret keys can be generated, they abort the protocol. Otherwise, they
proceed.

_(4) Raw key generation._ —Alice and Bob can obtain their raw keys using the
remaining undisclosed rounds. Assuming that $M$ rounds remain, they number
these rounds according to the order of sending. For the $k$th round, Alice
labels the corresponding state
$\mbox{$\left|\phi_{k}\right\rangle$}\in\left\\{\mbox{$\left|\alpha
e^{i\frac{\pi}{4}}\right\rangle$},\mbox{$\left|\alpha
e^{i\frac{3\pi}{4}}\right\rangle$},\mbox{$\left|\alpha
e^{i\frac{5\pi}{4}}\right\rangle$},\mbox{$\left|\alpha
e^{i\frac{7\pi}{4}}\right\rangle$}\right\\}$ as $a_{k}\in\\{00,10,11,01\\}$.
Then, the raw key bit $x_{k}$ is equal to the first bit of the label $a_{k}$
when the round is measured in $\hat{q}$, and it is equal to the second bit of
$a_{k}$ when the round is measured in $\hat{p}$. Thus, she obtains her string
$\textbf{X}^{\prime}=(x_{1},..,x_{k},...,x_{M})$. For the $k$th round, Bob
maps the outcome greater than $\Delta$ into the raw key bit $z_{k}=0$ and the
outcome smaller than $-\Delta$ into $z_{k}=1$. The outcome with other values
is mapped into $z_{k}=\bot$. Thus, he obtains his string
$\textbf{Z}^{\prime}=(z_{1},..,z_{k},...,z_{M})$. $\Delta$ is a non-negative
parameter and related to post-selection. A protocol without post-selection can
set $\Delta=0$. If $\Delta>0$, Bob communicates with Alice about positions of
bits with value $\bot$ and they get rid of these positions from their strings
$\textbf{X}^{\prime}$ and $\textbf{Z}^{\prime}$. Finally, they obtain their
raw key strings X and Z.

_(5) Error correction and privacy amplification._ —Alice and Bob choose
suitable methods to conduct error correction and privacy amplification. In the
end, they generate secret keys.

Figure 2: Experimental schematic of our protocol. To prevent Eve from
manipulating the local oscillator (LO) transmitted from Alice, we adopt the
local LO scheme [32]. Abbreviations of components in the figure: EPC,
electrical polarization controller; PD, photodetector; PM, phase modulator;
QPSK, quadrature phase shift keying; BS, beam splitter.

A realistic experimental setup of our protocol is proposed in Fig. 2. The
required components are displayed with unnecessary details omitted. To prevent
security loopholes of the LO, we adopt the local LO scheme with secure phase
compensation [30, 31, 32]. Alice randomly [32] sends reference pulses and
signal pulses. Signal pulses are modulated using QPSK technology, and are used
to generate keys. Setting the phase of signal pulses before QPSK as the
reference phase, Alice prepares reference pulses that are brighter than signal
pulses and contribute nothing to the generation of keys. Reference and signal
pulses are transmitted to Bob’s side through quantum channels. The
polarization of any pulse received by Bob is corrected by the electrical
polarization controller. Bob generates a local LO with the phase randomly
chosen from $\\{0,\frac{\pi}{2}\\}$ using the phase modulator, which will be
sent to the beam splitter together with signal pulses or reference pulses for
interference. The photodetector with a subtractor reveals the interference
outcomes, according to which Bob evaluates the exact phase difference between
the reference phase and local LO. Then, Bob uses this phase information to
conduct phase compensation [32]. Thereafter, Alice and Bob conduct post-
processing described by steps (3)-(5), and we do not show this part in the
figure.

##  III SECRET KEY RATE

To evaluate the secret key rate, we analyze the security of an equivalent
entanglement-based protocol of our prepare-and-measure protocol. Then, we
calculate the secret key rate against collective attacks in the asymptotic
regime by applying the numerical method [51, 52].

###  III.1 Entanglement-based protocol

An equivalent entanglement-based protocol of our prepare-and-measure protocol
can be described below. Alice prepares an entangled state

$\mbox{$\left|\Phi\right\rangle$}_{AA^{\prime}}=\sum_{x}\sqrt{p_{x}}\mbox{$\left|x\right\rangle$}_{A}\mbox{$\left|\phi_{x}\right\rangle$}_{A^{\prime}},$
(1)

where the subscripts $A$ and $A^{\prime}$ represent two entangled systems. $x$
represents one of four labels in $\\{00,10,11,01\\}$, and $p_{x}=0.25$ refers
to the probability that the entangled state will collapse into the state
labeled by $x$. $\\{\mbox{$\left|x\right\rangle$}\\}$ is the set of orthogonal
bases in system $A$, which can be measured by a set of positive operator
valued measurement $\\{M^{x}=\mbox{$\left|x\right\rangle$}\mbox{$\left\langle
x\right|$}\\}$. Four states in $\\{\mbox{$\left|\phi_{x}\right\rangle$}\\}$
are $\left\\{\mbox{$\left|\alpha
e^{i\frac{\pi}{4}}\right\rangle$},\mbox{$\left|\alpha
e^{i\frac{3\pi}{4}}\right\rangle$},\mbox{$\left|\alpha
e^{i\frac{5\pi}{4}}\right\rangle$},\mbox{$\left|\alpha
e^{i\frac{7\pi}{4}}\right\rangle$}\right\\}$, respectively. The system $A$ is
kept by Alice and $A^{\prime}$ is sent to Bob via a quantum channel. Thus, the
final state is given by

$\rho_{AB}=(\mathbb{I}_{A}\otimes\mathcal{E}_{A^{\prime}\rightarrow
B})(\mbox{$\left|\Phi\right\rangle$}\mbox{$\left\langle\Phi\right|$})_{AA^{\prime}},$
(2)

where $\mathcal{E}_{A^{\prime}\rightarrow B}$ is a completely positive and
trace-preserving mapping. This mapping includes the influence of the
environment and attacks by Eve. Alice randomly projects the system $A$ to an
eigenstate by $\\{M^{x}\\}$. Then, she can write down the corresponding label
$x$ without performing any additional operations. Bob measures the system $B$
as with the step (2) in our prepare-and-measure protocol and follows the
remaining steps.

###  III.2 Key rate formula

Applying reverse reconciliation means that Alice corrects her string X
according to Bob’s string Z, which implies that adversary Eve should derive
Bob’s string unscrupulously. In the case where Eve performs collective attacks
in the asymptotic regime, the secret key rate formula [51, 56] is given by

$\displaystyle R^{\infty}=p_{\rm
pass}\min_{\rho_{AB}\in\textbf{S}}H(\textbf{Z}|E)-p_{\rm pass}\delta_{\rm
EC},$ (3)

where $p_{\rm pass}$ is the sifting probability of preserving a round in the
post-selection step to generate a raw key. The conditional von Neumann entropy
$H(\textbf{Z}|E)$ describes the uncertainty of the string Z from Eve’s
perspective. Eve’s maximal knowledge of Bob’s string Z leads to the minimum
uncertainty of Z under certain density matrix $\rho_{AB}$. To evaluate Eve’s
maximal knowledge when $\rho_{AB}$ is uncertain for Alice and Bob, we must
find the minimum conditional entropy $H(\textbf{Z}|E)$ of all $\rho_{AB}$ that
conform to constraints S. $\delta_{\rm EC}$ is the amount of information
leakage of each round in the error correction step. Considering the
reconciliation efficiency, the leakage is

$\displaystyle\delta_{\rm EC}=$ $\displaystyle H(\textbf{Z})-\beta
I(\textbf{X};\textbf{Z})$ (4) $\displaystyle=$
$\displaystyle(1-\beta)H(\textbf{Z})+\beta H(\textbf{Z}|\textbf{X}),$

where $H(\textbf{Z})$ is the total information of Z related to the probability
distribution of Bob’s measurement outcomes. $I(\textbf{X};\textbf{Z})$ is the
classical mutual information between two strings. $H(\textbf{Z}|\textbf{X})$
is the conditional entropy describing the uncertainty of the string Z
conditioned on knowing the string X. The parameter $\beta$ represents the
efficiency of error correction.

Because Bob announces the measurement quadrature of each round, we can analyze
the security of each quadrature separately. To this end, we rewrite the secret
key rate formula as

$\displaystyle R^{\infty}=\frac{1}{2}\sum_{y\in\\{q,p\\}}p^{y}_{\rm
pass}\Big{\\{}\min_{\rho_{AB}\in\textbf{S}}H(\textbf{Z}_{y}|E)-\delta^{y}_{\rm
EC}\Big{\\}}.$ (5)

The coefficient $\frac{1}{2}$ indicates that one half of states are measured
in $\hat{q}$ and one half in $\hat{p}$. The secret key rate comprises the
secret key rate in $\hat{q}$ and the secret key rate in $\hat{p}$. Note that
Eve manipulates the density matrix $\rho_{AB}$ before Bob measures it, and she
thus has no knowledge of Bob’s choice of quadrature at that time. We can move
the summation sign into the minimization problem because $\rho_{AB}$ of
different quadratures are shared.

According to Refs. [57, 58], the conditional entropy terms in formula (5) with
their coefficients can be reformulated as

$\frac{1}{2}\min_{\rho_{AB}\in\textbf{S}}\sum_{y\in\\{q,p\\}}D(\mathcal{G}_{y}(\rho_{AB})||\mathcal{Z}[\mathcal{G}_{y}(\rho_{AB})]),$
(6)

where
$D(\rho||\sigma)=\text{Tr}(\rho\log_{2}\rho)-\text{Tr}(\rho\log_{2}\sigma)$ is
the quantum relative entropy, $\mathcal{G}_{y}$ describes the post-processing
of different quadratures, and $\mathcal{Z}$ is a pinching quantum channel that
reads out key information. The post-processing mapping
$\mathcal{G}_{y}(\rho)=K_{y}\rho K^{\dagger}_{y}$ corresponds to the
measurement $\hat{y}\in\\{\hat{q},\hat{p}\\}$ and is given by

$K_{y}=\sum^{1}_{b=0}\mbox{$\left|b\right\rangle$}_{R}\otimes\mathbb{I}_{A}\otimes(\sqrt{I_{y}^{b}})_{B}.$
(7)

Here $\mbox{$\left|b\right\rangle$}_{R}$ is the state of the key register $R$,
which is determined by interval operators $\\{I_{y}^{b}\\}$. $I_{y}^{b}$
projects the system $B$ to one of two subspaces spanned by the eigenstates of
operator $\hat{y}$ in terms of the mapping rule:

$I_{y}^{0}=\int^{\infty}_{\Delta}dy\mbox{$\left|y\right\rangle$}\mbox{$\left\langle
y\right|$}\text{,
}I_{y}^{1}=\int^{-\Delta}_{-\infty}dy\mbox{$\left|y\right\rangle$}\mbox{$\left\langle
y\right|$}.$ (8)

$\mathcal{Z}(\rho)=\sum^{1}_{b=0}Z_{b}\rho Z_{b}$ reads out the key from the
mapping $\mathcal{G}_{y}(\rho_{AB})$ with
$Z_{0}=\mbox{$\left|0\right\rangle$}\mbox{$\left\langle
0\right|$}_{R}\otimes\mathbb{I}_{AB}$ and
$Z_{1}=\mbox{$\left|1\right\rangle$}\mbox{$\left\langle
1\right|$}_{R}\otimes\mathbb{I}_{AB}$. Here $\mathcal{G}_{y}$ is in a
simplified form introduced by Ref. [51]. Kraus operators $\\{K_{y}\\}$
describe the part of the measurement and announcement: Alice’s operation is
described by an identity matrix because Alice announces nothing and has no
effect on the register $R$. Her measurement in the entanglement-based protocol
can be moved after the announcement and never influences $K_{y}$. Bob would
announce the choice of quadrature, and his measurement is represented by
interval operators. When considering the security, we can discuss two
quadratures separately, denoted by the parameter $y\in\\{q,p\\}$ in the above
formulas.

Finally, the key rate formula reads

$\displaystyle R^{\infty}=$
$\displaystyle\frac{1}{2}\bigg{\\{}\min_{\rho_{AB}\in\textbf{S}}\sum_{y\in\\{q,p\\}}D(\mathcal{G}_{y}(\rho_{AB})||\mathcal{Z}[\mathcal{G}_{y}(\rho_{AB})])$
(9) $\displaystyle-\sum_{y\in\\{q,p\\}}p^{y}_{\rm pass}\delta^{y}_{\rm
EC}\bigg{\\}}.$

###  III.3 Numerical method

Figure 3: Comparison between the excess noise tolerance of our protocol and
that of Protocol 1 in Ref. [51]. Protocol 1 is a quaternary-modulated homodyne
detection protocol that is similar to our protocol in terms of its
implementation. The upper blue line is the performance of our protocol. The
bottom red line is the performance of Protocol 1. The reconciliation
efficiency is $\beta=0.95$ and the post-selection is $\Delta=0$. We plot this
figure with the photon number cutoff $N_{c}=12$ and the maximal $N_{i}=100$
iterations of the first step in the numerical method.

To realize the calculation of secret key rates, a photon-number cutoff
assumption [51] is adopted. Based on this assumption, we can describe
operators and density matrices in the photon-number representation with finite
dimensions $N_{c}$. Because $\delta_{\rm EC}$ and $p_{\rm pass}$ are only
concerned with the information held by Alice and Bob, the term
$\sum_{y\in\\{q,p\\}}p^{y}_{\rm pass}\delta^{y}_{\rm EC}$ in the key rate
formula (9) can be easily calculated according to general definitions [51]. We
calculate the rest of the formula numerically. The rest is a minimization
problem that can be described by

minimize
$\displaystyle\sum_{y\in\\{q,p\\}}D(\mathcal{G}_{y}(\rho_{AB})||\mathcal{Z}[\mathcal{G}_{y}(\rho_{AB})])$
(10) subject to
$\displaystyle\text{Tr}[\rho_{AB}(\mbox{$\left|x\right\rangle$}\mbox{$\left\langle
x\right|$}_{A}\otimes\hat{q})]=p_{x}\langle\hat{q}\rangle_{x},$
$\displaystyle\text{Tr}[\rho_{AB}(\mbox{$\left|x\right\rangle$}\mbox{$\left\langle
x\right|$}_{A}\otimes\hat{p})]=p_{x}\langle\hat{p}\rangle_{x},$
$\displaystyle\text{Tr}[\rho_{AB}(\mbox{$\left|x\right\rangle$}\mbox{$\left\langle
x\right|$}_{A}\otimes\hat{n})]=p_{x}\langle\hat{n}\rangle_{x},$
$\displaystyle\text{Tr}[\rho_{AB}(\mbox{$\left|x\right\rangle$}\mbox{$\left\langle
x\right|$}_{A}\otimes\hat{d})]=p_{x}\langle\hat{d}\rangle_{x},$
$\displaystyle\text{Tr}_{B}[\rho_{AB}]=\sum^{3}_{i,j=0}\sqrt{p_{i}p_{j}}\langle\phi_{j}|\phi_{i}\rangle\mbox{$\left|i\right\rangle$}\mbox{$\left\langle
j\right|$}_{A},$ $\displaystyle\text{Tr}[\rho_{AB}]=1,$
$\displaystyle\rho_{AB}\geqslant 0.$

The variable is the density matrix $\rho_{AB}$ subject to constraints S [51].
The first four constraints come from the experimental outcomes, where $x$
belongs to $\\{00,10,11,01\\}$ and $\langle\hat{q}\rangle_{x}$,
$\langle\hat{p}\rangle_{x}$, $\langle\hat{n}\rangle_{x}$, and
$\langle\hat{d}\rangle_{x}$ are expectation values of operators when Bob
measures states labeled by $x$. Homodyne detection directly outputs the
outcomes of operators $\hat{q}$ and $\hat{p}$, while
$\hat{n}=\frac{1}{2}(\hat{q}^{2}+\hat{p}^{2}-1)$ and
$\hat{d}=\hat{q}^{2}-\hat{p}^{2}$ correspond to the second moments of
$\hat{q}$ and $\hat{p}$. The next constraint about partial trace of system $B$
comes from the requirement of the completely positive and trace-preserving
mapping, which implies that the quantum channel cannot influence the system
$A$ of Alice. The last two constraints are natural requirements because
$\rho_{AB}$ is a density matrix.

This minimization problem can be solved using many methods. We adopt one using
a linearization method, given in Appendix A. Briefly speaking, the numerical
method involves two steps. First, we approach the optimal value of the
minimization problem (10) by at most $N_{i}$ iterations. Second, the dual
problem of the minimization problem is considered to guarantee that the result
is less than or equal to the optimal value.

##  IV PERFORMANCE

Figure 4: Comparison between the secret key rate of our protocol and that of
Protocol 1 in Ref. [51] with quaternary modulation and homodyne detection.
From top to bottom, the solid lines represent the performance of our protocol
under excess noise $\xi=0.015,0.02,0.04$. The amplitude of our protocol is
optimized in the range $[0.6,1.1]$ with step of $0.01$. From top to bottom,
the dashed line represents the performance of Protocol 1 under excess noise
$\xi=0.015,0.02,0.04$. The signal state amplitude of Protocol 1 is optimized
in range $[0.35,0.6]$ with steps of $0.01$. For all points, $\beta=0.95$ and
$\Delta=0$ are used. We plot this figure with $N_{c}=12$ and $N_{i}=300$.
Figure 5: Comparison between the secret key rate of our proposed protocol and
that of Protocol 1 in Ref. [51] with quaternary modulation and homodyne
detection. Solid lines from top to bottom show the performance of our protocol
under excess noise $\xi=0.002,0.01$. The amplitude of our protocol is
optimized in the range $[0.6,1.1]$ with steps of $0.01$. Dashed lines from top
to bottom are the performance of Protocol 1 under excess noise
$\xi=0.002,0.01$. The amplitude of Protocol 1 is optimized in the range
$[0.35,0.6]$ with steps of $0.01$. For all points, $\beta=0.95$ and $\Delta=0$
are used. We plot this figure with $N_{c}=12$ and $N_{i}=300$.

Here, we investigate the performance of our protocol by performing numerical
simulations. The simulation method is described in Appendix B, where we set
the reconciliation efficiency $\beta=0.95$.

To simulate the performance, we adopt the phase-invariant Gaussian channel
model in the absence of Eve [51], which adds an effective excess noise to the
input of the channel and transmits the input under the loss-only scenario. In
this channel, the transmittance is $\eta=10^{-\frac{aL}{10}}$ for distance $L$
with $a=0.2$ dB/km, and the effective excess noise is
$\xi=\frac{\left(\mathrm{\Delta}q_{obs}\right)^{2}}{\left(\mathrm{\Delta}q_{vac}\right)^{2}}-1$.
$\left(\mathrm{\Delta}q_{obs}\right)^{2}$ is the effective variance of
$\hat{q}$ quadrature for the input of the channel, including the influence of
detection noises. $\left(\mathrm{\Delta}q_{vac}\right)^{2}=1/2$ is the
variance of the vacuum state in the $\hat{q}$ quadrature. Both variances are
in the natural unit. Because $\xi$ is normalized by
$\left(\mathrm{\Delta}q_{vac}\right)^{2}$, the excess noise is under the shot-
noise unit without vacuum noise.

We first emphasize the significant performance improvement of our proposed
protocol by comparing it with Protocol 1 in Ref. [51], which also prepares
four types of coherent states and performs homodyne detection without post-
selection.

As shown in Fig. 3, we investigate the excess noise tolerance at different
distances. The excess noise tolerance is calculated by maximizing the excess
noise $\xi$ that enables the protocol to generate keys. The cutoff photon
number $N_{c}$ is truncated at $12$ with $N_{i}=100$ iterations in the first
step of the numerical method. The excess noise tolerance of our protocol is
approximately double that of Protocol 1.

As shown Fig. 4, we investigate the best secret key rates of our protocol for
different levels of excess noise by optimizing the amplitude $\alpha$ of
signal states in the interval $[0.6,1.1]$ with steps of $0.01$. We also
calculate the best secret key rates of Protocol 1 by optimizing the amplitude
$\alpha$ of signal states in the interval $[0.35,0.6]$ with steps of $0.01$.
Different search ranges are used because the optimal range of $\alpha$ varies
for different protocols. The cutoff photon number $N_{c}$ is $12$ and the
maximal iteration number $N_{i}$ of the first step in numerical method is
$300$. The solid lines show the performance of our proposed protocol, whereas
the dashed lines show the performance of Protocol 1. When the excess noise is
experimentally feasible, such as $\xi=0.02$, our protocol enables the
distribution of keys for around 200 km with meaningful $10^{-6}$ bit secret
keys per pulse. Moreover, when Protocol 1 can hardly generate keys for
$\xi=0.04$, our protocol can still distribute secret keys over 50 km.

Figure 6: Comparison of different CV-QKD protocols for the excess noise
$\xi=0.04$. From top to bottom, solid lines represent the secret key rates of
the Gaussian-modulated homodyne detection protocol [24] with optimal modulated
variance, the quaternary-modulated heterodyne detection protocol (Protocol 2)
[51] with optimal amplitude of signals in the range $[0.6,1.1]$, this work
with optimal amplitude in range $[0.6,1.1]$ and the quaternary-modulated
homodyne detection protocol (Protocol 1) [51] with optimal amplitude in the
range $[0.35,0.6]$. The step of searching the optimal amplitude in the
discrete-modulated protocol is 0.01, with $N_{c}=12$ and $N_{i}=300$. All CV-
QKD protocols take the ideal detector scenario under consideration without
post-selection and are against the collective attacks under the asymptotic
regime. The difference between the secret key rates of this work and Protocol
2 is normalized by the secret key rate of this work $R_{het}/R_{our}-1$ and is
shown with the y axis on the right. Figure 7: Comparison of heterodyne
detection protocol and this work under the untrusted detector noise scenario.
The upper line is the secret key rate of this work, and the lower line is the
secret key rate of Protocol 2 with heterodyne detection [51]. The excess noise
of our protocol is $\xi=\xi_{oth}+\frac{\xi_{hom}}{\eta}$, and the excess
noise of the heterodyne protocol is
$\xi=\xi_{oth}+\frac{2\xi_{hom}}{\eta\times 10^{-\frac{0.7dB}{10}}}$, where
$\xi_{hom}=0.002$ is the detection noise of one homodyne detector, and
$\xi_{oth}=0.01$ is the excess noise except detection noise.
$\eta=10^{-\frac{0.2dB/km\times L}{10}}$ is the transmittance with distance
$L$. We search the optimal amplitude for both protocols in the range
$[0.6,1.1]$ with steps of $0.01$. For all points, $\beta=0.95$ and $\Delta=0$
are used. We plot this figure with $N_{c}=12$ and $N_{i}=100$.

In Fig. 5, we show that there is an improvement in the transmission distance
for a small excess noise with $N_{c}=12$ and $N_{i}=300$. When the excess
noise is sufficiently small, but still possible, our protocol has the
potential to distribute secret keys over 350 km. The transmission distance and
secret key rates are increased significantly, which makes our protocol
applicable and useful in the quantum secure communication network.

We further compare our protocol with a well-performed quaternary-modulated
heterodyne detection protocol called Protocol 2 in Ref. [51]. Owing to
differences in the detection methods, the comparison is made under two
scenarios: ideal detector scenario and untrusted detector noise scenario.

Under the ideal detector scenario, both excess noise and loss are from the
channel. We set the detection (electronic) noise of detectors $\xi_{det}=0$
and the detection efficiency $\eta_{det}=1$. In Fig. 6, our protocol and
Protocol 2 are simulated with parameters $\xi=0.04$, $N_{c}=12$ and
$N_{i}=300$. We search the best secret key rates of our protocol and Protocol
2 by optimizing the amplitude $\alpha$ of signal states in the interval
$[0.6,1.1]$ with steps of $0.01$. Protocol 2 can generate a higher secret key
rate compared with our proposed protocol under the ideal detector scenario
because heterodyne detection can accumulate twice the amount of raw key data
than homodyne detection. We call the secret key rate of Protocol 2 $R_{het}$
and the secret key rate of our protocol $R_{our}$. Then, we use
$R_{het}/R_{our}-1$ to represent the proportion of the secret key rate
difference $R_{het}-R_{our}$ in $R_{our}$, as shown by the dashed line in Fig.
6. The secret key rate of Protocol 2 is no more than $20\%$ higher than that
of our proposed protocol within 30 km. The uncertainty relation limits the
accuracy of measuring both quadratures simultaneously and increases the bit
error rate of Protocol 2. Therefore, the improvement of the secret key rate by
heterodyne detection is not significant. We also show the secret key rate of
the Gaussian-modulated homodyne detection protocol in Fig. 6. The modulated
variance in the Gaussian-modulated protocol is the parameter that has been
optimized.

In Fig. 7, we regard the detector as a noisy and lossy device, and Eve can
control the imperfection of the device, which is a more practical condition.
We should note that the heterodyne detector often comprises two homodyne
detectors and one 50:50 beam splitter that splits signal pulses. Therefore,
two points of imperfection are considered under the untrusted detector noise
scenario that we used here. First, the detection noise of a homodyne detector
is $\xi_{hom}=0.002$, and the detection noise of a heterodyne detector is at
least $\xi_{het}=2\xi_{hom}=0.004$. Second, the imperfection in the beam
splitter usually causes an additional insertion loss of about $0.7$ dB. By
setting other excess noise as $\xi_{oth}=0.01$, the total excess noise of our
protocol is $\xi=\xi_{oth}+\frac{\xi_{hom}}{\eta}$, and the total excess noise
of Protocol 2 with heterodyne detection is
$\xi=\xi_{oth}+\frac{2\xi_{hom}}{\eta\times 10^{-\frac{0.7}{10}}}$. The cutoff
photon number $N_{c}$ is $12$ with $N_{i}=100$ iterations in the first step of
the numerical method. Under this untrusted detector noise scenario, our
protocol can perform better than the heterodyne detection protocol.

Figure 8: Comparison of the heterodyne detection protocol [51, 48] and this
work under different detector noise scenarios. The upper two lines are under
the ideal detector scenario, and the one for this work is a little lower. The
lower two lines are under the untrusted detector noise scenario, and that for
this study is higher. The performance of the heterodyne detection protocol
under the trusted detector noise scenario [48] is the blue line in the middle.
The data of the heterodyne protocol has been reported by the authors of Ref.
[48]. The parameters are the same as those used in Fig. 3 in Ref. [48].
Specifically, the imperfect detector has excess noise $\xi_{hom}=0.01$ and
detection efficiency $\eta_{d}=0.719$. $\xi_{oth}=0.01$ is the excess noise
and does not include detection noise. The total excess noise of our protocol
under the untrusted detector noise scenario is
$\xi=\xi_{oth}+\frac{\xi_{hom}}{\eta\times\eta_{d}}$. We search the optimal
amplitude for our protocol in the range $[0.6,1.1]$ with steps of $0.01$. For
all points, $\beta=0.95$ and $\Delta=0$ are used. We plot this figure with
$N_{c}=15$ and the iteration of our protocol is $N_{i}=100$.

In Fig. 8, we compare the heterodyne protocol [51, 48] under ideal, trusted,
and untrusted detector noise scenarios with our protocol under ideal and
untrusted detector noise scenarios. The data of the heterodyne protocol were
reported by the authors of Ref. [48]. The imperfect detector has excess noise
$\xi_{hom}=0.01$ and detection efficiency $\eta_{d}=0.719$. The other excess
noise is $\xi_{oth}=0.01$ and the cutoff photon number $N_{c}$ is $15$. We
simulate our proposed protocol using the same parameters. Thus, the total
excess noise of our protocol under the untrusted detector noise scenario is
$\xi=\xi_{oth}+\frac{\xi_{hom}}{\eta\times\eta_{d}}$. The iteration in the
first step of the numerical method is $N_{i}=100$. Our protocol is a little
worse than the heterodyne protocol under the ideal scenario, but it is better
under the untrusted detector noise scenario. The heterodyne protocol with
trusted detector noise has a key rate that is comparable to the same protocol
with the ideal detector, which may imply good performance when we also
consider our protocol under the trusted detector noise scenario.

For the experiments, we show the optimal amplitudes that are searched for
different transmission distances with parameters $N_{c}=12$ and $N_{i}=300$.
As shown in Fig. 9, in the case of a long distance, the optimal amplitude
decreases as the transmission distance increases, except for the case when
there are some jitters, and a larger excess noise induces a lower optimal
amplitude with little violation. The optimal amplitude for remote users is
about 0.66. This conclusion also applies to the condition where $N_{c}=12$ and
$N_{i}=100$.

Figure 9: Optimal amplitudes of the coherent states prepared by Alice for
different transmission distances. From top to bottom, the lines correspond to
the conditions where the excess noises are $\xi=0.015,0.02,0.03,0.04$. For all
points, $\beta=0.95$ and $\Delta=0$ are used. We plot this figure with
$N_{c}=12$ and $N_{i}=300$. Figure 10: Performance of the optimal post-
selection. Cases when $\xi=0.03$ and $\xi=0.04$ are considered. The top solid
line in blue represents the performance of the post-selection ($\Delta>0$)
with $\xi=0.03$, while the top dashed line in blue is the performance without
post-selection. The lower solid line in red represents the performance of the
post-selection $\xi=0.04$, while the lower dashed line in red is the
performance without post-selection ($\Delta=0$). The amplitude for the point
in the dashed lines is optimized in the range $[0.6,1.1]$ with steps of
$0.01$. The amplitude for the point in the solid lines is the same with dashed
lines under the same distance and excess noise. For $\xi=0.04$, at the
distance where our protocol is unable to generate keys, we use the amplitude
$\alpha=0.66$ in post-selection. For all points, $\beta=0.95$ is used. We plot
this figure with $N_{c}=12$ and $N_{i}=100$.

The post-selection is a useful method to further increase the transmission
distance and improve the secret key rate. In Fig. 10, we optimize the sifting
parameter $\Delta$ using the amplitude of signal states that have been
optimized without post-selection. The cutoff photon number $N_{c}$ is
truncated at $12$ with $N_{i}=100$ iterations. The available $\Delta$ has
steps of 0.01. At distances where secret key rates are zero without post-
selection, we search the best post-selection parameter $\Delta$ by setting the
amplitude to 0.66. This choice is reasonable considering that the optimal
amplitude for the long distance is around 0.66 in average, as depicted in Fig.
9. The post-selection is more important for the scenario with the higher
excess noise. For $\xi=0.04$, the secret key rates are improved, and the
largest transmission distance is extended. For smaller excess noise
$\xi=0.03$, the improvement of post-selection is subtle. Over a long distance,
there is no improvement in the secret key rates for $\xi=0.03$. This is
because as the excess noise increases, the overlap of outcome distributions
obtained by measuring different kinds of signal states also increases, which
causes higher bit error rates. The post-selection discards outcomes around
zero because the overlap of outcome distributions most likely happens around
zero. By post-selection, we discard many error bits, thus reducing the bit
error rates. Protocols with heterodyne detection enjoy the same advantages of
post-selection [59]. The optimal $\Delta$ is larger under longer transmission
distance. The sifting probability related to post-selection decreases to
around 0.15 over the longest transmission distance for $\xi=0.04$; the post-
selection thus makes sense in our protocol. This operation can work well when
the amplitude cannot be prepared optimally in the experiment.

Note that the curves in the above figures should have been smooth in theory.
Although the secret key rate formula is a convex function with convex domain
$\rho_{AB}$, it is difficult to unify the imprecision of $\rho_{AB}$ under
different amplitudes and transmittances. The inaccuracy also accumulates along
with steps of calculations, resulting in some calculation noise. Finally, as a
numerical method, limited by the calculation accuracy of computers and the
stability of the convex optimization algorithm, unstable points and unsmooth
curves appear. The quality of the algorithm largely determines the secret key
rates. When the ideal secret key rate is quite small that it reaches the
computational accuracy limit, numerical results sometimes show that no keys
can be generated. Achieving improvements in the algorithm may help further
enhance the transmission distance and stabilize the key rates. The calculation
speed of the numerical method is often slow and is approximately 20 min per
set of parameters. The speed largely depends on the number of iterations and
the truncated photon number. Intriguingly, recent work [60] can utilize a
neural network model to quickly predict the secure key rate of homodyne
detection discrete-modulated CV-QKD with high accuracy.

##  V DISCUSSION

Homodyne detection is the first adopted measurement method of CV-QKD with
noticeable performance experimentally, and it provides excellent tolerance in
terms of excess noise in Gaussian-modulated protocols. Our main goal is to
inherit this mature technology and apply it to the discrete-modulated
protocol. We propose a quaternary-modulated homodyne detection protocol with
very high excess noise tolerance and long transmission distance that has never
been reached by previous discrete-modulated homodyne detection protocols [61,
62, 51]. There is a quaternary-modulated heterodyne detection protocol [51]
that shows high secret key rate and long transmission distance under large
excess noise based on simulations. However, the heterodyne detector [63, 64,
65, 66, 67] is more sophisticated than the homodyne detector, and it
introduces more noise and loss in experiments [68, 69, 70, 71]. We show that
our proposed protocol can offer a comparable performance with this heterodyne
detection protocol under the ideal detector scenario. Our protocol can even
perform better than this heterodyne detection protocol when considering the
untrusted detector noise condition.

We determine why the previous quaternary-modulated homodyne detection protocol
[51] cannot transmit over a long distance although they also send four kinds
of states. In particular, from a practical point of view, our protocol and the
previous protocol both generate one bit per pulse by homodyne detection.
Compared with Eq. (17) in Ref. [51], the mapping $K_{y}$ of our protocol in
Eq. (7) is an identity matrix at Alice’s end, which means that Alice remains
silent in our protocol. This mathematical difference implies that additional
announcements cause more information leakage.

In addition, the adoption of QPSK is required during the preparation. Note
that QPSK is a mature method in classical communication, shifting the phase of
states by $\\{\frac{\pi}{4},\frac{3\pi}{4},\frac{5\pi}{4},\frac{7\pi}{4}\\}$.
In previous quaternary-modulated protocols [50, 51], they use states with
phases $\\{0,\frac{\pi}{2},\pi,\frac{3\pi}{2}\\}$. The probability
distribution of a state in quadrature $\hat{p}$ is symmetric about the
original point if the state has phase $0$ or $\pi$. Thus, states with phase
$0$ or $\pi$ cannot represent keys when Bob applies $\hat{p}$ measurement.
Similarly, states with $\frac{\pi}{2}$ or $\frac{3\pi}{2}$ cannot represent
keys when Bob applies $\hat{q}$. The additional $\frac{\pi}{4}$ phase shift in
our protocol offers chances to generate keys in both quadratures, and Alice
can thus announce nothing.

Eventually, owing to the tolerance of excess noise, the transmission distance
is improved, which removes the obstruction of the proceedings of the large-
scale discrete-modulated CV-QKD network. It is worth recalling that commercial
instruments for QPSK have been updated to over 50 Gbps [72], which implies
that the speed of preparation in our proposed protocol can also be increased
to 50 Gbps. Our protocol will maximize the use of the mature homodyne
detection technology to achieve the long-distance key distribution. The
experimental demonstration of our protocol is of great practical value for
network security and information security. Moreover, we can consider the
trusted detector noise model [48]. With a simpler preparation, our proposed
protocol has a chance to exceed the transmission record of 202.81 km set by
the Gaussian modulation protocol [35] with an ultralow-loss fiber and small
excess noise parameters. The experimental schematic and the search of optimal
amplitudes in the text provide instructions for the experimental
implementation.

Further studies of our protocol’s security are also desirable. Note that the
photon-number cutoff assumption can be removed [73] in the heterodyne
detection protocol, which inspires us to present a more rigorous security
analysis of our protocol in future work. Moreover, we can focus on determining
a suitable adjustment of security theory to deal with the finite-size effects.
The security against coherent attacks is another interesting and important
direction for discrete-modulated CV-QKD. The quantum de Finetti representation
theorem [74] is a possible path to equalize the information leaked by coherent
attacks and collective attacks.

## Acknowledgments

We thank Jie Lin for valuable discussions on the numerical method in Ref. [51]
and providing data points from Ref. [48] for the comparison in Fig. 8. We
gratefully acknowledge the support received from the National Natural Science
Foundation of China (under Grant No. 61801420), the Key-Area Research and
Development Program of Guangdong Province (under Grant No. 2020B0303040001),
and the Fundamental Research Funds for the Central Universities (under Grant
No. 020414380182).

##  Appendix A Numerical methods of calculating the key rates

The minimization problem in Eq. (10) is a convex optimal problem with one
unique solution. It can be described as follows.

The independent variable is the density matrix $\rho_{AB}$. The dimension
number of Alice’s system is $4$, which is determined by the number of
different states she prepared.
$\mbox{$\left|x\right\rangle$}\mbox{$\left\langle x\right|$}_{A}$ with
$x\in\\{00,10,11,01\\}$ projects Alice’s system into a one-dimensional
subspace, which implies that Alice sends state
$\mbox{$\left|\phi_{x}\right\rangle$}\in\left\\{\mbox{$\left|\alpha
e^{i\frac{\pi}{4}}\right\rangle$},\mbox{$\left|\alpha
e^{i\frac{3\pi}{4}}\right\rangle$},\mbox{$\left|\alpha
e^{i\frac{5\pi}{4}}\right\rangle$},\mbox{$\left|\alpha
e^{i\frac{7\pi}{4}}\right\rangle$}\right\\}$ to Bob. However, the state that
Bob receives is infinite-dimensional. The photon-number cutoff assumption is
proposed to cut off the dimension of Bob’s system. According to the
assumption, $\rho_{AB}$ can be represented by a finite-dimensional matrix in
Fock representation. Thus, the numerical method can be applied. The operators
$\hat{q},\hat{p},\hat{n},\hat{d}$ correspond to the measurement on Bob’s
system. Considering the photon-number representation, they can be defined by
the annihilation operator $\hat{a}$:

$\displaystyle\hat{q}$
$\displaystyle=\frac{1}{\sqrt{2}}(\hat{a}+\hat{a}^{\dagger}),$ (11)
$\displaystyle\hat{p}$
$\displaystyle=\frac{i}{\sqrt{2}}(\hat{a}^{\dagger}-\hat{a}),$
$\displaystyle\hat{n}$
$\displaystyle=\hat{a}^{\dagger}\hat{a}=\hat{a}\hat{a}^{\dagger}-1,$
$\displaystyle\hat{d}$ $\displaystyle=\hat{a}^{2}+(\hat{a}^{\dagger})^{2}.$

To calculate them numerically, the matrix of $\hat{a}$ in photon-number
representation is also cut off according to the photon-number cutoff
assumption. We introduce notation
$\langle\hat{q}\rangle_{x},\langle\hat{p}\rangle_{x},\langle\hat{n}\rangle_{x},\langle\hat{d}\rangle_{x}$
to represent the expectation values of these operators. The relative entropy
$D(\rho||\sigma)$ is the dependent variable that we need to minimize.
$\mathcal{G}(\rho)=K\rho K^{\dagger}$ is the map in post-processing with Kraus
operator $K$.

To implement the convex optimization, a two-step numerical method is
introduced [58] below. For convenience, we use $f(\rho)$ to represent the
function $D(\mathcal{G}(\rho)||\mathcal{Z}[\mathcal{G}(\rho)])$. The
constraints can be described by a set S:

$\textbf{S}=\\{\rho\in\mathcal{H}_{+}|\text{Tr}(\Gamma_{i}\rho)=\gamma_{i},\forall
i\\},$ (12)

where $\mathcal{H}_{+}$ is the set of positive semidefinite operators.
$\Gamma_{i}$ is the Hermitian operator and $\gamma_{i}$ is the corresponding
expectation value. To fit this form, one should rewrite the fifth constraint
in Eq. (10). Specifically, one needs to transform the partial trace on Bob
into some Hermitian operators.

Using the linearization method, we can obtain

$\displaystyle f(\rho^{*})\geqslant$ $\displaystyle
f_{\epsilon}(\rho)+\min_{\rho+\Delta\rho\in\textbf{S}}[\text{Tr}((\Delta\rho)^{T}\nabla
f_{\epsilon}(\rho))]-\zeta_{\epsilon},$ (13) $\displaystyle=$ $\displaystyle
f_{\epsilon}(\rho)-\text{Tr}(\rho^{T}\nabla
f_{\epsilon}(\rho))+\min_{\sigma\in\textbf{S}}[\text{Tr}(\sigma^{T}\nabla
f_{\epsilon}(\rho))]-\zeta_{\epsilon},$

where $\rho^{*}$ is the optimal density matrix (i.e., the solution of
minimization problem Eq. (10) and $\epsilon$ represents a perturbation
parameter, by which the gradient of $f(\rho)$ can exist. Owing to the
existence of $\epsilon$, the term
$\zeta_{\epsilon}=2\epsilon(d^{\prime}-1)\log_{2}\frac{d^{\prime}}{\epsilon(d^{\prime}-1)}$
is applied to correct the difference between $f(\rho)$ and
$f_{\epsilon}(\rho)$ caused by perturbation. In our simulation, we set
$\epsilon=10^{-12}$ to decrease the value of $\zeta_{\epsilon}$. Using
$\epsilon$, the dependent variable becomes

$f_{\epsilon}(\rho)=D(\mathcal{G}_{\epsilon}(\rho)||\mathcal{Z}[\mathcal{G}_{\epsilon}(\rho)]).$
(14)

The gradient of $f_{\epsilon}(\rho)$ is

$[\nabla
f_{\epsilon}(\rho)]^{T}=\mathcal{G}_{\epsilon}^{\dagger}(\log_{2}\mathcal{G}_{\epsilon}(\rho))-\mathcal{G}_{\epsilon}^{\dagger}(\log_{2}\mathcal{Z}(\mathcal{G}_{\epsilon}(\rho))),$
(15)

where

$\displaystyle\mathcal{G}_{\epsilon}(\rho)=(1-\epsilon)\mathcal{G}(\rho)+\epsilon\mathbb{I}/d^{\prime},$
(16)
$\displaystyle\mathcal{Z}(\mathcal{G}_{\epsilon}(\rho))=(1-\epsilon)\mathcal{Z}(\mathcal{G}(\rho))+\epsilon\mathbb{I}/d^{\prime}.$

$d^{\prime}$ is the dimension of the matrix $\mathcal{G}(\rho)$, which is
twice the dimension of density matrix $\rho$.

Using the linearization expressed in Eq. (13), the optimization problem is
transformed into a semi-definite program, such as the second or third term of
the first or the second line, respectively, in Eq. (13). Therefore, we only
need to find $\Delta\rho$ or $\sigma=\rho+\Delta\rho$ that minimizes the
related term. We take $\Delta\rho$ as an example, and the first step is to
find a density matrix $\rho$ that is quite close to the optimal one. To
accomplish this step, we perform the algorithm as follows:
1\. Begin with any $\rho_{0}\in\textbf{S}$ and set i = 0.
2\. Compute
$\min_{\rho+\Delta\rho\in\textbf{S}}[\text{Tr}((\Delta\rho)^{T}\nabla
f_{\epsilon}(\rho_{i}))]$.
3\. If $\text{Tr}((\Delta\rho)^{T}\nabla f_{\epsilon}(\rho_{i}))$ is
sufficiently small, STOP.
4\. Find $\lambda\in(0,1)$ that minimizes
$f_{\epsilon}(\rho_{i}+\lambda\Delta\rho)$.
5\. Set $\rho_{i+1}=\rho_{i}+\lambda\Delta\rho$, $i\leftarrow i+1$ and go to
2.

When solving the minimization problem in step 2 of the algorithm, we find that
the results are often sensitive to the setting of $\rho_{0}$. Different
convergence paths affect the convergence effect. In our simulation, we often
choose the result of feasible verification under S or the result that
maximizes the minimal eigenvalue of $\rho$ under S as the primal density
matrix $\rho_{0}$. The iteration of 2–5 sometimes needs to be broken manually;
otherwise, it may take a large amount of time to converge or even never stop.
The largest iteration number in our simulation is 300 or 100. After 300 or 100
iterations, we choose $\rho_{i}$ with the smallest
$\text{Tr}((\Delta\rho)^{T}\nabla f_{\epsilon}(\rho_{i}))$ among all
iterations as our result of the first step.

Reference [58] does not offer any method to deal with the minimization of
$f_{\epsilon}(\rho_{i}+\lambda\Delta\rho)$ because its DV-QKD example is
simple for calculation. However, it is not an easy task for CV-QKD. We provide
our own method inspired by BinarySearch:
1\. Set a starting point $\lambda_{s}=0$, an ending point $\lambda_{e}=1$, and
a middle point $\lambda_{m}=0.5$.
2\. Calculate $f_{\epsilon}(\rho_{i}+\lambda\Delta\rho)$ in three points, and
compare them.
3\. If $\lambda_{s}$ is the smallest one, update the ending point by
$\lambda_{e}=\lambda_{m}$ and the middle point by
$\lambda_{m}=0.5(\lambda_{s}+\lambda_{e})$. Then, go to 2.
4\. If $\lambda_{e}$ is the smallest one, update the starting point by
$\lambda_{s}=\lambda_{m}$ and the middle point by
$\lambda_{m}=0.5(\lambda_{s}+\lambda_{e})$. Then, go to 2.
5\. If $\lambda_{m}$ is the smallest one, two temporary points are generated
by $\lambda_{1}=0.5(\lambda_{s}+\lambda_{m})$ and
$\lambda_{2}=0.5(\lambda_{m}+\lambda_{e})$.
6\. Calculate $f_{\epsilon}(\rho_{i}+\lambda\Delta\rho)$ of two temporary
points and compare them with $\lambda_{m}$.
7\. If $\lambda_{m}$ is still the smallest one, set $\lambda_{s}=\lambda_{1}$
and $\lambda_{e}=\lambda_{2}$, and go to 2.
8\. If $\lambda_{1}$ is the smallest one, set $\lambda_{e}=\lambda_{m}$ and
$\lambda_{m}=\lambda_{1}$, and go to 2.
9\. If $\lambda_{2}$ is the smallest one, set $\lambda_{s}=\lambda_{m}$ and
$\lambda_{m}=\lambda_{2}$, and go to 2.

The calculation results of some points can be temporarily stored for the next
iteration. The termination of the iteration is decided by the calculation
accuracy of computers.

After the first step, we seemingly find an appropriate density matrix $\rho$.
However, considering the imprecision of numerical calculations, we cannot
guarantee that the solution of the first step is the optimal one. In fact, we
find an upper bound of the solution. To protect the security of the generated
keys, we use the dual problem in the second step.

One can transform the primal problem
$\min_{\sigma\in\textbf{S}}[\text{Tr}(\sigma^{T}\nabla f_{\epsilon}(\rho))]$
into the dual problem
$\max_{\vec{y}\in\textbf{S}^{*}(\rho)}\vec{\gamma}\cdot\vec{y}$. The variable
$\vec{y}$ obeys the constraints:

$\textbf{S}^{*}(\rho)=\\{\vec{y}\in\mathbb{R}^{n}|\sum_{i}y_{i}\Gamma^{T}_{i}\leqslant\nabla
f_{\epsilon}(\rho)\\}.$ (17)

In general, primal and dual problems satisfy the weak duality. The weak
duality shows that the optimal value of the dual problem is always less than
or equal to the optimal value of the primal problem. According to this
principle, the final solution that we obtain from the dual problem must be a
lower bound of the primal problem even if it is not optimal. The lower bound
of the primal problem is also the lower bound of the secret key rates
according to Eq. (13).

In addition, we can consider the imprecision of the floating-point
representations of $\\{\Gamma_{i}\\}$ and $\\{\gamma_{i}\\}$.

$|\text{Tr}(\tilde{\Gamma}_{i}\rho)-\tilde{\gamma}_{i}|\leq\epsilon_{\rm
rep},$ (18)

where $\\{\tilde{\Gamma}_{i}\\}$ and $\\{\tilde{\gamma}_{i}\\}$ are the
approximate representations used in the calculation. Furthermore, the solution
$\rho$ may not satisfy the constraints, especially the positive semi-definite
constraint. Ref. [58] encourages one to transform $\rho$ into positive semi-
definite matrix $\rho^{\prime}$ by subtracting a term $\lambda_{\rm
min}\mathbb{I}$ when the smallest eigenvalue $\lambda_{\rm min}$ of $\rho$ is
negative. Then, we restrict the imprecision by

$|\text{Tr}(\tilde{\Gamma}_{i}\rho^{\prime})-\tilde{\gamma}_{i}|\leq\epsilon_{\rm
sol}.$ (19)

After the first step, we extract the quantity
$\epsilon^{\prime}=\max(\epsilon_{\rm rep},\epsilon_{\rm sol})$ from the
output $\rho$. This quantity influences the second step. The dual problem
solved in the second step is adjusted to

$\max_{(\vec{y},\vec{z})\in\tilde{\textbf{S}}^{*}(\rho)}\left(\vec{\gamma}\cdot\vec{y}-\epsilon^{\prime}\sum_{i=1}^{n}z_{i}\right),$
(20)

where

$\displaystyle\tilde{\textbf{S}}^{*}(\rho)$ (21)
$\displaystyle:=\\{(\vec{y},\vec{z})\in(\mathbb{R}^{n},\mathbb{R}^{n})|-\vec{z}\leqslant\vec{y}\leqslant\vec{z},\sum_{i}^{n}y_{i}\tilde{\Gamma}^{T}_{i}\leqslant\nabla
f_{\epsilon}(\rho)\\}.$

The description above is about one quadrature. Because $f_{q}(\rho)$ for
$\hat{q}$ and $f_{p}(\rho)$ for $\hat{p}$ are added linearly, we can replace
$f_{\epsilon}(\rho)$ by $f_{q,\epsilon}(\rho)+f_{p,\epsilon}(\rho)$. Then,
$\nabla f_{\epsilon}(\rho)$ in primal and dual problems is replaced by $\nabla
f_{q,\epsilon}(\rho)+\nabla f_{p,\epsilon}(\rho)$. In addition, the
perturbation compensation $\zeta_{\epsilon}$ is multiplied by 2.

Thus far, the lower bound of the minimization problem is solved numerically.
Note that we solve primal and dual problems using the SDPT3 solver in CVX 1.22
package on MATLAB R2020b. This package is for specifying and solving convex
programs, and SDPT3 is a free solver [75, 76]. The code of our protocol is
uploaded to the open-source code website [77].

##  Appendix B Simulation Methods

We simulate the experiment’s statistical results by assuming a phase-invariant
Gaussian channel, as referred in Ref. [51]. When Alice sends a coherent state
$\left|\alpha\right\rangle$, Bob obtains a displaced thermal state centered at
$\sqrt{\eta}\alpha$ with the variance $\frac{1}{2}+\frac{\eta\xi}{2}$ for each
quadrature. The first term $\frac{1}{2}$ in the variance is the vacuum noise.
Thus, $\rho_{B}^{x}$ can be given by

$\rho_{B}^{x}=\frac{1}{\pi V_{A}}\int
e^{-|\beta-\sqrt{\eta}\alpha_{x}|^{2}/V_{A}}\mbox{$\left|\beta\right\rangle$}\mbox{$\left\langle\beta\right|$}d^{2}\beta,$
(22)

with $\alpha_{x}\in\left\\{\mbox{$\left|\alpha
e^{i\frac{\pi}{4}}\right\rangle$},\mbox{$\left|\alpha
e^{i\frac{3\pi}{4}}\right\rangle$},\mbox{$\left|\alpha
e^{i\frac{5\pi}{4}}\right\rangle$},\mbox{$\left|\alpha
e^{i\frac{7\pi}{4}}\right\rangle$}\right\\}$ and $V_{A}=\frac{\eta\xi}{2}$.
$\xi$ is the excess noise and $\eta=10^{-\frac{aL}{10}}$ is the transmittance
with $a=0.2$ dB/km in the distance $L$. Thus, the expectation values of
measurement operators are

$\displaystyle\langle\hat{q}\rangle_{x}$
$\displaystyle=\sqrt{2\eta}Re(\alpha_{x}),$ (23)
$\displaystyle\langle\hat{p}\rangle_{x}$
$\displaystyle=\sqrt{2\eta}Im(\alpha_{x}),$
$\displaystyle\langle\hat{n}\rangle_{x}$
$\displaystyle=\eta|\alpha_{x}|^{2}+\frac{\eta\xi}{2},$
$\displaystyle\langle\hat{d}\rangle_{x}$
$\displaystyle=\eta[(\alpha_{x})^{2}+(\alpha^{*}_{x})^{2}].$

To simulate the error correction, the conditional probability between Alice’s
sending state and Bob’s mapping result can be given by

$P(q|x)=\frac{1}{\sqrt{\pi(\eta\xi+1)}}e^{[-(q-\sqrt{2\eta}Re(\alpha_{x}))^{2}]/(\eta\xi+1)},$
(24)

to measure $\hat{q}$ and

$P(p|x)=\frac{1}{\sqrt{\pi(\eta\xi+1)}}e^{[-(q-\sqrt{2\eta}Im(\alpha_{x}))^{2}]/(\eta\xi+1)},$
(25)

to measure $\hat{p}$. According to the bit mapping of Bob, the probability
distribution of the bit is

$\displaystyle P_{y}(0|x)$ $\displaystyle=\int^{\infty}_{\Delta}P(y|x)dy,$
(26) $\displaystyle P_{y}(1|x)$
$\displaystyle=\int^{\Delta}_{-\infty}P(y|x)dy,$ $\displaystyle P_{y}(\bot|x)$
$\displaystyle=\int^{\Delta}_{-\Delta}P(y|x)dy,$

where $y\in\\{q,p\\}$. Then, we can find the sifting probability

$p^{y}_{\rm pass}=\sum_{x}p_{x}(P_{y}(0|x)+P_{y}(1|x)),$ (27)

and normalize the probability distribution after discarding bits $\bot$. The
conditional entropy for each quadrature is thus calculated by

$H(\textbf{Z}_{y}|\textbf{X}_{y})=\sum_{x}p_{x}h\left(\frac{P_{y}(0|x)}{P_{y}(0|x)+P_{y}(1|x)}\right),$
(28)

where $h(x)=-x\log_{2}{x}-(1-x)\log_{2}{(1-x)}$. Thus, the experimental
results required for calculating the key rates can be simulated by utilizing
the above equations.

## References

  * Arute  _et al._ [2019] F. Arute, K. Arya, R. Babbush, D. Bacon, J. C. Bardin, R. Barends, R. Biswas, S. Boixo, F. G. Brandao, D. A. Buell, _et al._ , Quantum supremacy using a programmable superconducting processor, Nature 574, 505 (2019).
  * Zhong  _et al._ [2020] H.-S. Zhong, H. Wang, Y.-H. Deng, M.-C. Chen, L.-C. Peng, Y.-H. Luo, J. Qin, D. Wu, X. Ding, Y. Hu, _et al._ , Quantum computational advantage using photons, Sci. 370, 1460 (2020).
  * Rivest  _et al._ [1978] R. L. Rivest, A. Shamir, and L. Adleman, A method for obtaining digital signatures and public-key cryptosystems, Commun. ACM 21, 120 (1978).
  * Shor [1994] P. W. Shor, Algorithms for quantum computation: discrete logarithms and factoring, in  _Proceedings of 35th Annual Symposium on Foundations of Computer Science_ (IEEE, New York, USA, 1994) pp. 124–134.
  * Shannon [1949] C. E. Shannon, Communication theory of secrecy systems, The Bell System Technical Journal 28, 656 (1949).
  * Bennett and Brassard [1984] C. H. Bennett and G. Brassard, Quantum cryptography: Public key distribution and coin tossing, in  _Proc. of the Int. Conf. on Comput., Syst. and Signal Process._ (IEEE, New York, USA, 1984) pp. 175–179.
  * Ekert [1991] A. K. Ekert, Quantum cryptography based on bell’s theorem, Phys. Rev. Lett. 67, 661 (1991).
  * Weedbrook  _et al._ [2012] C. Weedbrook, S. Pirandola, R. García-Patrón, N. J. Cerf, T. C. Ralph, J. H. Shapiro, and S. Lloyd, Gaussian quantum information, Rev. Mod. Phys. 84, 621 (2012).
  * Pirandola  _et al._ [2020] S. Pirandola, U. L. Andersen, L. Banchi, M. Berta, D. Bunandar, R. Colbeck, D. Englund, T. Gehring, C. Lupo, C. Ottaviani, _et al._ , Advances in quantum cryptography, Adv. Opt. Photon. 12, 1012 (2020).
  * Xu  _et al._ [2020] F. Xu, X. Ma, Q. Zhang, H.-K. Lo, and J.-W. Pan, Secure quantum key distribution with realistic devices, Rev. Mod. Phys. 92, 025002 (2020).
  * Zhao  _et al._ [2006] Y. Zhao, B. Qi, X. Ma, H.-K. Lo, and L. Qian, Experimental quantum key distribution with decoy states, Phys. Rev. Lett. 96, 070502 (2006).
  * Comandar  _et al._ [2016] L. C. Comandar, M. Lucamarini, B. Fröhlich, J. F. Dynes, A. W. Sharpe, S. W. B. Tam, Z. L. Yuan, R. V. Penty, and A. J. Shields, Quantum key distribution without detector vulnerabilities using optically seeded lasers, Nat. Photonics 10, 312 (2016).
  * Wei  _et al._ [2020] K. Wei, W. Li, H. Tan, Y. Li, H. Min, W.-J. Zhang, H. Li, L. You, Z. Wang, X. Jiang, _et al._ , High-speed measurement-device-independent quantum key distribution with integrated silicon photonics, Phys. Rev. X 10, 031030 (2020).
  * Yin  _et al._ [2016] H.-L. Yin, T.-Y. Chen, Z.-W. Yu, H. Liu, L.-X. You, Y.-H. Zhou, S.-J. Chen, Y. Mao, M.-Q. Huang, W.-J. Zhang, _et al._ , Measurement-device-independent quantum key distribution over a 404 km optical fiber, Phys. Rev. Lett. 117, 190501 (2016).
  * Boaron  _et al._ [2018] A. Boaron, G. Boso, D. Rusca, C. Vulliez, C. Autebert, M. Caloz, M. Perrenoud, G. Gras, F. Bussières, M.-J. Li, _et al._ , Secure quantum key distribution over 421 km of optical fiber, Phys. Rev. Lett. 121, 190502 (2018).
  * Yin  _et al._ [2020] H.-L. Yin, P. Liu, W.-W. Dai, Z.-H. Ci, J. Gu, T. Gao, Q.-W. Wang, and Z.-Y. Shen, Experimental composable security decoy-state quantum key distribution using time-phase encoding, Opt. Express 28, 29479 (2020).
  * Joshi  _et al._ [2020] S. K. Joshi, D. Aktas, S. Wengerowsky, M. Lončarić, S. P. Neumann, B. Liu, T. Scheidl, G. C. Lorenzo, Ž. Samec, L. Kling, _et al._ , A trusted node–free eight-user metropolitan quantum communication network, Sci. Adv. 6, eaba0959 (2020).
  * Tang  _et al._ [2016] Y.-L. Tang, H.-L. Yin, Q. Zhao, H. Liu, X.-X. Sun, M.-Q. Huang, W.-J. Zhang, S.-J. Chen, L. Zhang, L.-X. You, _et al._ , Measurement-device-independent quantum key distribution over untrustful metropolitan network, Phys. Rev. X 6, 011024 (2016).
  * Diamanti and Leverrier [2015] E. Diamanti and A. Leverrier, Distributing secret keys with quantum continuous variables: Principle, security and implementations, Entropy 17, 6072 (2015).
  * Grosshans and Grangier [2002] F. Grosshans and P. Grangier, Continuous variable quantum cryptography using coherent states, Phys. Rev. Lett. 88, 057902 (2002).
  * Grosshans  _et al._ [2003] F. Grosshans, G. Van Assche, J. Wenger, R. Brouri, N. J. Cerf, and P. Grangier, Quantum key distribution using gaussian-modulated coherent states, Nature 421, 238 (2003).
  * Yin  _et al._ [2019] H.-L. Yin, W. Zhu, and Y. Fu, Phase self-aligned continuous-variable measurement-device-independent quantum key distribution, Sci. Rep. 9, 49 (2019).
  * Cerf  _et al._ [2001] N. J. Cerf, M. Levy, and G. Van Assche, Quantum distribution of gaussian keys using squeezed states, Phys. Rev. A 63, 052311 (2001).
  * Lodewyck  _et al._ [2007] J. Lodewyck, M. Bloch, R. García-Patrón, S. Fossier, E. Karpov, E. Diamanti, T. Debuisschert, N. J. Cerf, R. Tualle-Brouri, S. W. McLaughlin, and P. Grangier, Quantum key distribution over 25 km with an all-fiber continuous-variable system, Phys. Rev. A 76, 042305 (2007).
  * Qi  _et al._ [2007] B. Qi, L.-L. Huang, L. Qian, and H.-K. Lo, Experimental study on the gaussian-modulated coherent-state quantum key distribution over standard telecommunication fibers, Phys. Rev. A 76, 052323 (2007).
  * Fossier  _et al._ [2009] S. Fossier, E. Diamanti, T. Debuisschert, A. Villing, R. Tualle-Brouri, and P. Grangier, Field test of a continuous-variable quantum key distribution prototype, New J. Phys. 11, 045023 (2009).
  * Jouguet  _et al._ [2013] P. Jouguet, S. Kunz-Jacques, A. Leverrier, P. Grangier, and E. Diamanti, Experimental demonstration of long-distance continuous-variable quantum key distribution, Nat. Photonics 7, 378 (2013).
  * Huang  _et al._ [2016] D. Huang, P. Huang, D. Lin, and G. Zeng, Long-distance continuous-variable quantum key distribution by controlling excess noise, Sci. Rep. 6, 19201 (2016).
  * Liu  _et al._ [2020] W. Liu, Y. Cao, X. Wang, and Y. Li, Continuous-variable quantum key distribution under strong channel polarization disturbance, Phys. Rev. A 102, 032625 (2020).
  * Qi  _et al._ [2015] B. Qi, P. Lougovski, R. Pooser, W. Grice, and M. Bobrek, Generating the local oscillator “locally” in continuous-variable quantum key distribution based on coherent detection, Phys. Rev. X 5, 041009 (2015).
  * Soh  _et al._ [2015] D. B. S. Soh, C. Brif, P. J. Coles, N. Lütkenhaus, R. M. Camacho, J. Urayama, and M. Sarovar, Self-referenced continuous-variable quantum key distribution protocol, Phys. Rev. X 5, 041010 (2015).
  * Huang  _et al._ [2015] D. Huang, P. Huang, D. Lin, C. Wang, and G. Zeng, High-speed continuous-variable quantum key distribution without sending a local oscillator, Opt. Lett. 40, 3695 (2015).
  * Pirandola  _et al._ [2015] S. Pirandola, C. Ottaviani, G. Spedalieri, C. Weedbrook, S. L. Braunstein, S. Lloyd, T. Gehring, C. S. Jacobsen, and U. L. Andersen, High-rate measurement-device-independent quantum cryptography, Nat. Photonics 9, 397 (2015).
  * Zhang  _et al._ [2019] G. Zhang, J. Y. Haw, H. Cai, F. Xu, S. Assad, J. F. Fitzsimons, X. Zhou, Y. Zhang, S. Yu, J. Wu, _et al._ , An integrated silicon photonic chip platform for continuous-variable quantum key distribution, Nat. Photonics 13, 839 (2019).
  * Zhang  _et al._ [2020] Y. Zhang, Z. Chen, S. Pirandola, X. Wang, C. Zhou, B. Chu, Y. Zhao, B. Xu, S. Yu, and H. Guo, Long-distance continuous-variable quantum key distribution over 202.81 km fiber, Phys. Rev. Lett. 125, 010502 (2020).
  * Silberhorn  _et al._ [2002] C. Silberhorn, T. C. Ralph, N. Lütkenhaus, and G. Leuchs, Continuous variable quantum cryptography: Beating the 3 db loss limit, Phys. Rev. Lett. 89, 167901 (2002).
  * García-Patrón and Cerf [2009] R. García-Patrón and N. J. Cerf, Continuous-variable quantum key distribution protocols over noisy channels, Phys. Rev. Lett. 102, 130501 (2009).
  * Leverrier  _et al._ [2010] A. Leverrier, F. Grosshans, and P. Grangier, Finite-size analysis of a continuous-variable quantum key distribution, Phys. Rev. A 81, 062343 (2010).
  * Leverrier [2015] A. Leverrier, Composable security proof for continuous-variable quantum key distribution with coherent states, Phys. Rev. Lett. 114, 070501 (2015).
  * Pirandola [2021] S. Pirandola, Limits and security of free-space quantum communications, Phys. Rev. Research 3, 013279 (2021).
  * Navascués  _et al._ [2006] M. Navascués, F. Grosshans, and A. Acín, Optimality of gaussian attacks in continuous-variable quantum cryptography, Phys. Rev. Lett. 97, 190502 (2006).
  * García-Patrón and Cerf [2006] R. García-Patrón and N. J. Cerf, Unconditional optimality of gaussian attacks against continuous-variable quantum key distribution, Phys. Rev. Lett. 97, 190503 (2006).
  * Lupo [2020] C. Lupo, Towards practical security of continuous-variable quantum key distribution, Phys. Rev. A 102, 022623 (2020).
  * Zhou  _et al._ [2019] C. Zhou, X. Wang, Y. Zhang, Z. Zhang, S. Yu, and H. Guo, Continuous-variable quantum key distribution with rateless reconciliation protocol, Phys. Rev. Applied 12, 054013 (2019).
  * Leverrier and Grangier [2009] A. Leverrier and P. Grangier, Unconditional security proof of long-distance continuous-variable quantum key distribution with discrete modulation, Phys. Rev. Lett. 102, 180504 (2009).
  * Xuan  _et al._ [2009] Q. D. Xuan, Z. Zhang, and P. L. Voss, A 24 km fiber-based discretely signaled continuous variable quantum key distribution system, Opt. Express 17, 24244 (2009).
  * Hirano  _et al._ [2017] T. Hirano, T. Ichikawa, T. Matsubara, M. Ono, Y. Oguri, R. Namiki, K. Kasai, R. Matsumoto, and T. Tsurumaru, Implementation of continuous-variable quantum key distribution with discrete modulation, Quantum Sci. Technol. 2, 024010 (2017).
  * Lin and Lütkenhaus [2020] J. Lin and N. Lütkenhaus, Trusted detector noise analysis for discrete modulation schemes of continuous-variable quantum key distribution, Phys. Rev. Applied 14, 064030 (2020).
  * Ghalaii  _et al._ [2020] M. Ghalaii, C. Ottaviani, R. Kumar, S. Pirandola, and M. Razavi, Discrete-modulation continuous-variable quantum key distribution enhanced by quantum scissors, IEEE J. Sel. Areas Commun. 38, 506 (2020).
  * Ghorai  _et al._ [2019] S. Ghorai, P. Grangier, E. Diamanti, and A. Leverrier, Asymptotic security of continuous-variable quantum key distribution with a discrete modulation, Phys. Rev. X 9, 021059 (2019).
  * Lin  _et al._ [2019] J. Lin, T. Upadhyaya, and N. Lütkenhaus, Asymptotic security analysis of discrete-modulated continuous-variable quantum key distribution, Phys. Rev. X 9, 041064 (2019).
  * Hu  _et al._ [2021] H. Hu, J. Im, J. Lin, N. Lütkenhaus, and H. Wolkowicz, Robust interior point method for quantum key distribution rate computation (2021), arXiv:2104.03847 .
  * Kaur  _et al._ [2021] E. Kaur, S. Guha, and M. M. Wilde, Asymptotic security of discrete-modulation protocols for continuous-variable quantum key distribution, Phys. Rev. A 103, 012412 (2021).
  * Denys  _et al._ [2021] A. Denys, P. Brown, and A. Leverrier, Explicit asymptotic secret key rate of continuous-variable quantum key distribution with an arbitrary modulation, Quantum 5, 540 (2021).
  * Matsuura  _et al._ [2021] T. Matsuura, K. Maeda, T. Sasaki, and M. Koashi, Finite-size security of continuous-variable quantum key distribution with digital signal processing, Nat. Commun. 12, 252 (2021).
  * Devetak and Winter [2005] I. Devetak and A. Winter, Distillation of secret key and entanglement from quantum states, Proc. R. Soc. A. 461, 207 (2005).
  * Coles  _et al._ [2016] P. J. Coles, E. M. Metodiev, and N. Lütkenhaus, Numerical approach for unstructured quantum key distribution, Nat. Commun. 7, 11712 (2016).
  * Winick  _et al._ [2018] A. Winick, N. Lütkenhaus, and P. J. Coles, Reliable numerical key rates for quantum key distribution, Quantum 2, 77 (2018).
  * Kanitschar and Pacher [2021] F. Kanitschar and C. Pacher, Postselection strategies for continuous-variable quantum key distribution protocols with quadrature phase-shift keying modulation (2021), arXiv:2104.09454 .
  * Zhou  _et al._ [2021] M.-G. Zhou, Z.-P. Liu, W.-B. Liu, C.-L. Li, J.-L. Bai, Y.-R. Xue, Y. Fu, H.-L. Yin, and Z.-B. Chen, Machine learning for secure key rate in continuous-variable quantum key distribution (2021), arXiv:2108.02578 .
  * Zhao  _et al._ [2009] Y.-B. Zhao, M. Heid, J. Rigas, and N. Lütkenhaus, Asymptotic security of binary modulated continuous-variable quantum key distribution under collective attacks, Phys. Rev. A 79, 012307 (2009).
  * Brádler and Weedbrook [2018] K. Brádler and C. Weedbrook, Security proof of continuous-variable quantum key distribution using three coherent states, Phys. Rev. A 97, 022310 (2018).
  * Weedbrook  _et al._ [2004] C. Weedbrook, A. M. Lance, W. P. Bowen, T. Symul, T. C. Ralph, and P. K. Lam, Quantum cryptography without switching, Phys. Rev. Lett. 93, 170504 (2004).
  * Lance  _et al._ [2005] A. M. Lance, T. Symul, V. Sharma, C. Weedbrook, T. C. Ralph, and P. K. Lam, No-switching quantum key distribution using broadband modulated coherent light, Phys. Rev. Lett. 95, 180503 (2005).
  * [65] H. H. Brunner, L. C. Comandar, F. Karinou, S. Bettelli, D. Hillerkuss, F. Fung, D. Wang, S. Mikroulis, M. Kuschnerov, A. Poppe, _et al._ , Low-noise, low-complexity cv-qkd architecture, in  _QCrypt 2017(Cambridge)_.
  * Chin  _et al._ [2021] H.-M. Chin, N. Jain, D. Zibar, U. L. Andersen, and T. Gehring, Machine learning aided carrier recovery in continuous-variable quantum key distribution, npj Quantum Inf. 7, 20 (2021).
  * Jain  _et al._ [2021] N. Jain, I. Derkach, H.-M. Chin, R. Filip, U. L. Andersen, V. C. Usenko, and T. Gehring, Modulation leakage vulnerability in continuous-variable quantum key distribution, Quantum Sci. Technol. 6, 045001 (2021).
  * Caves and Drummond [1994] C. M. Caves and P. D. Drummond, Quantum limits on bosonic communication rates, Rev. Mod. Phys. 66, 481 (1994).
  * Leonhardt [1997] U. Leonhardt,  _Measuring the quantum state of light_ , Vol. 22 (Cambridge university press, Cambridge, England, 1997).
  * Dall’Arno  _et al._ [2010] M. Dall’Arno, G. M. D’Ariano, and M. F. Sacchi, Purification of noisy quantum measurements, Phys. Rev. A 82, 042315 (2010).
  * Laudenbach  _et al._ [2018] F. Laudenbach, C. Pacher, C.-H. F. Fung, A. Poppe, M. Peev, B. Schrenk, M. Hentschel, P. Walther, and H. Hübel, Continuous-variable quantum key distribution with gaussian modulation - the theory of practical implementations, Adv. Quantum Technol. 1, 1800011 (2018).
  * Dong  _et al._ [2012] P. Dong, L. Chen, C. Xie, L. L. Buhl, and Y.-K. Chen, 50-gb/s silicon quadrature phase-shift keying modulator, Opt. Express 20, 21181 (2012).
  * Upadhyaya  _et al._ [2021] T. Upadhyaya, T. van Himbeeck, J. Lin, and N. Lütkenhaus, Dimension reduction in quantum key distribution for continuous- and discrete-variable protocols, PRX Quantum 2, 020325 (2021).
  * Renner [2008] R. Renner, Security of quantum key distribution, Int. J. Quantum Inf. 6, 1 (2008).
  * Grant and Boyd [2014] M. Grant and S. Boyd, CVX: Matlab software for disciplined convex programming, version 2.1, http://cvxr.com/cvx (2014).
  * Grant and Boyd [2008] M. Grant and S. Boyd, Graph implementations for nonsmooth convex programs, in  _Recent Advances in Learning and Control_ , Lecture Notes in Control and Information Sciences, edited by V. Blondel, S. Boyd, and H. Kimura (Springer-Verlag Limited, 2008) pp. 95–110, http://stanford.edu/~boyd/graph_dcp.html.
  * [77] W.-B. Liu and C.-L. Li, Codes of key rate calculation, https://github.com/hechuwuliu/HD-QPSK-CVQKD.