## Abstract

Continuous variable quantum key distribution (CV QKD) is a promising candidate for the deployment of quantum cryptography. At present, the longest distance is limited to ∼100 km at fiber-based quantum channel. We investigated in depth the realistic rate–distance limit (RDL) of CV QKD, considering reconciliation efficiency, finite-size effect, and realistic excess noise under collective attack. It is shown that the excess noise generated on Bob’s side degrades significantly the transmission distance and we verify it in experiment. The improvement in RDL by reconciliation efficiency depends on the excess noise level, considerable increase of RDL by improving the reconciliation efficiency occurs only for relative large excess noises. A convergence modulation variance, useful in calculation simplification, is found. Furthermore, we restudy the finite-size analysis and eliminates a loophole arising from the Holevo-bound information monotonicity and a safe RDL is guaranteed. Based on the revised finite-size analysis, the optimum ratio determining the amount of data used for parameter estimation is analyzed.

© 2019 Optical Society of America under the terms of the OSA Open Access Publishing Agreement

## 1. Introduction

Quantum key distribution (QKD) allows two distant parties to share secret keys based on the laws of quantum physics. Eavesdropping on the key information are inevitably discovered, and the eavesdropped information can be eliminated to ensure security. This technology can provide an effective solution for high-security applications. Current QKD protocols can be divided into three categories [1–8]: discrete-variable (DV), continuous-variable (CV), and distributed phase-reference (DPR) protocols. The DV QKD protocol employs the discrete variables of a quantum state, such as the polarization or phase of single photons, whereas in the CV scheme, the key information is encoded in continuous variables, such as the quadratures of quantized electromagnetic modes (coherent states or squeezed states). The DPR coding scheme resorts to the phase difference between two successive signal pulses or the photon arrival times to encode the key information. In the paper, we focus on CV protocols.

Early CV protocols primarily focused on squeezed and entangled states [9–12]. In 2002, Grosshans and Grangier proposed the famous GG02 protocol [13], which realized QKD using only a coherent state instead of nonclassical states. Then reverse reconciliation method was designed to beat the 3-dB limit. In 2003, the GG02 protocol was demonstrated experimentally [14]; afterward, CV QKD entered a period of rapid development. Various protocols were proposed and realized experimentally [15–27]. Prototypes were also developed, and some field tests were reported [28–31]. At present, CV QKD can be realized using low-cost off-the-shelf components with good compatibility with classical communications. Thus, it is considered a promising candidate for enabling the deployment of quantum cryptography in future networks. Currently, the longest distance of CV QKD remains limited to ∼100 km in experiments. The performance of the CV QKD system depends mainly on the reconciliation efficiency, finite-size effect, and excess noise. In this work, we investigated in depth the realistic rate-distance limit (RDL) of CV QKD, considering reconciliation efficiency, finite-size effect, and realistic excess noise under collective attack.

At present, a reconciliation efficiency of 99%, near the Shannon limit, can be achieved [32]. In this study, it is found that improvements in the rate-distance limit (RDL) by increasing reconciliation efficiency depend on the excess noise. When the excess noise is larger, the improvement is more obvious. A convergence modulation variance is found and can be used to substitute the optimal modulation variance, especially for long transmission distances. Revisiting the finite-size effect, we reveal a loophole from the monotonicity of the Holevo bound. A safe and tight RDL is then used to ensure the security of system. The optimal ratio determining the amount of data used for parameter estimation is analyzed. The statistic effect and privacy amplification effect due to finite size are analyzed and we found that statistic effects are dominant. Based on a detailed investigation of the CV QKD system, we find that the excess noise generated on Bob’s side is the main factor restricting the RDL and verify it in experiment. Finally, we discuss the possible ways to break the realistic RDL.

In Sec. 2, RDLs of several typical CV QKD protocols and the related experimental results are reviewed. In Sec. 3, the RDLs for different reconciliation efficiencies are analyzed. In Sec. 4, the finite-size effect on the RDL is analyzed. A loophole due to the monotonicity of the Holevo bound was revealed and eliminated and a safe and tight RDL was established. Section 5 focuses on the excess noise analysis model and the realistic RDL is presented. Finally, Sec. 6 presents the conclusions and the methods to break the realistic RDL are discussed.

## 2. Review of the RDL under realistic parameters

Presently, various CV QKD protocols have been proposed, such as one-way, two-way, and measurement-device-independent (MDI) protocols. Hereafter, we focus on the one-way coherent-state protocols that have been experimentally demonstrated in all-fiber systems. The secret key rate Δ*I* under collective attack and reverse reconciliation condition can be calculated by

*I*is the Shannon mutual information between Alice and Bob,

_{AB}*β*is the reverse reconciliation efficiency, and

*χ*is the maximum information accessed by Eve bounded by the Holevo quantity. The RDLs of several typical protocols with realistic parameters in the asymptotic case are presented in Fig. 1, as well as some representative experimental results. Notably, only collective attack is considered in our study.

_{BE}To achieve reasonable RDLs under realistic conditions, typical parameters are used: reconciliation efficiency *β* = 0.95, excess noise *ε* = 0.01 (shot noise units, SNU), detection efficiency *η* = 0.6, electronic noise *ν _{e}* = 0.1, and a transmission loss of 0.2 dB/km. The modulation variance is optimized according to the transmission distance (or the transmission efficiency

*T*). All variances are normalized to the shot noise

*N*

_{0}. The inset figure shows that the coherent-state protocol with heterodyne detection performs slightly better than the coherent-state protocol with homodyne detection (GG02 protocol) at a short distance. With increasing distance, their RDLs nearly converge. The unidimensional coherent-state protocol [26,33] with advantages of easy modulation, low cost, and fewer random number requirements, has comparable performance with the above two-dimensional coherent protocols. The non-Gaussian-state protocols could realize high-speed gigahertz quantum communication using phase-shift keying technology [34]. It mainly includes two-state, four-state, and eight-state protocols. The number of states is larger, the performance is better. For eight-state protocol, the performance approaches the GG02 protocol [35]. Here, the typical four-state protocol is presented.

In Fig. 1, we can see that the transmission distances achieved in various experiments are less than 100 km, although the theoretical maximum transmission distance approaches ∼400 km with the secret key rate of 10^{−9} in the asymptotic case. In this case, with a pulse rate of 1 GHz and secret key rate of 10^{−9}, a secret key bit rate of approximately 10 bit per second can be achieved. There is a large gap between the currently achieved distances of ∼100 km and the theoretically maximum transmission distance of 400 km. In the following, we analyze three fundamental factors which affect the RDL.

## 3. Improvement in RDL by enhancing reconciliation efficiency

One method for improving the RDL is to enhance the reconciliation efficiency. The reconciliation efficiency recently reached 0.99 [32], which is close to the Shannon limit. In the following, we investigate the RDL of the GG02 protocol with different reconciliation efficiencies.

In Fig. 2, the red lines present the RDLs at a reconciliation efficiency of *β* = 0.99 under different excess noise levels. Comparing them to the blue lines representing the performance at an efficiency *β* = 0.95, we observe that the improvement in the RDL is dependent on the excess noise level. When the excess noise is larger, the improvement of the performance is more obvious. Table 1 presents the performance improvement arising from the enhanced reconciliation efficiency (from 0.95 to 0.99) versus different excess noise levels at a constant distance or secret key rate. For fixed distances, the larger the excess noises, the better the secret key rate improvement. The reason of this phenomena is because that higher excess noise degrades *βI _{AB}*, whereas increases

*χ*, which makes the value of the latter approaches that of the former. In this case, the enchancement of

_{BE}*β*is more favorable to the secret key rate improvement. It is also noted that for a constant secret key rate, the distance improvement is more evident for a higher excess noise level.

From Fig. 2, the decreased performance due to using lower reconciliation efficiency at the excess noise level 0.01 is not obvious. The theoretically achievable distance at *β* = 0.95 and *ε* = 0.01 is still far longer than the real transmission distance of ∼100 km; therefore, we infer that the reconciliation efficiency is not the primary contributor to the largest achievable distance at *ε* = 0.01.

Usually in theoretical analysis, the reconciliation efficiency of 1 is used to achieve the best performance of a protocol. In this case, larger modulation variance is better. In the above analysis under realistic conditions, realistic efficiency of < 1 is used. In order to achieve the best performance, an optimal modulation variance is adopted according to the transmission distance. For sufficiently large distances, the optimal modulation variance converges to a constant value that depends on the reconciliation efficiency, as shown in Fig. 3(a).

Figure 3 presents the optimal modulation variance versus the transmission distance. In Fig. 3(a), from top to bottom, the reverse reconciliation efficiencies are 0.99, 0.97, 0.95, and 0.93, with convergence variances of 10.07, 5.20, 3.71, and 2.92, respectively. To plot Fig. 3(b), the same efficiency *β* = 0.99 is used for different excess noise levels. It is shown that the optimal modulation variance and convergence variance remain almost unchanged for different excess noise levels. Upon reaching a maximum transmission distance which depends on the excess noise levels, the convergence variances suddenly disappear at the stop lines, as marked in Fig. 3(b).

Figure 4 plots the RDLs with optimal modulation variances and convergence variances at different excess noise levels. We observe that little difference appears between the RDLs of the optimal modulation variance and the convergence variance at the same excess noise (Fig. 4(a)). Even for short distances, the difference is not significant, as shown in Fig. 4(b). In some cases, particularly for long transmission distances, the convergence variance can be used to simplify the calculation. In the following calculation considering the finite-size effect and realistic excess noise, the convergence modulation variance is used instead of the optimal modulation variance.

## 4. RDL considering the finite-size effect

In the above analysis, we mainly consider the RDLs in the asymptotic case. As the total number of data samples in real scenarios is always finite, the finite-size effect must be considered. The expression used to calculate the secret key rate considering the finite-size effect is [33,36–38]

*δ*is the distribution probability of the estimated parameters such as the channel efficiency

_{PE}*T*and noise variance

*σ*

^{2}, that is beyond the confidence intervals when considering the finite-size effect. It is different from the asymptotic case in which the channel parameters can be perfectly estimated. In this case, the minimum Shannon mutual information ${I}_{\mathit{AB}}^{{\delta}_{\mathit{PE}}}$ and the maximum Holevo information ${\chi}_{\mathit{BE}}^{{\delta}_{\mathit{PE}}}$ can be calculated based on the confidence intervals of the estimated parameters.

*n* is the number of data samples used to distill the secret key rate, *N* represents the total number of samples, and the rest of the data samples with numbers *m* = *N* − *n* are used for parameter estimation. Δ(*n*, *δ _{PA}*) is a correction term for the achievable mutual information in the finite case, and

*δ*is the probability of an error during privacy amplification. Usually, conservative values of

_{PA}*δ*=

_{PE}*δ*= 10

_{PA}^{−10}are utilized.

The monotonicity of information *I _{AB}* and χ

*is the basis for analyzing the finite-size effect. In our review of the finite-size effect, we find that one assumption in the finite-size analysis is incorrect which generates a loophole. In the original analysis [34], a conclusion is achieved that the information χ*

_{BE}*eavesdropped by Eve obeys the following inequalities:*

_{BE}*t*is the square root of transmission efficiency

*T*,

*σ*

^{2}=

*N*

_{0}+

*ν*+

_{e}*ηTε*is the noise variance of Bob’s data. The variable

*η*is the detection efficiency,

*N*

_{0}is the shot noise,

*ν*is the electronic noise, and

_{e}*ε*is the excess noise. More details can be seen in [39]. However, through a detailed numerical analysis, we find that the curve representing Holevo information versus

*T*is not monotonically decreasing. The calculation method in Appendix can be used to verify the convexity of χ

*. Thus, we should restudy the finite-size effect.*

_{BE}The results of numerical calculations are presented in Fig. 5. The blue dot, black dashed, and red solid curves represent the secret key rate Δ*I _{AB}*, Shannon mutual information

*I*, and the Holevo bound information χ

_{AB}*, respectively. We can see clearly that χ*

_{BE}*versus*

_{BE}*T*is not monotonically decreasing. A red circle is used to mark the peak. The three curves are based on the condition that the variable

*σ*

^{2}is constant.

To calculate the secret key rate, the variables *t* and *σ*^{2} should be evaluated from the experiment data. Because of the finite-size effect, the estimated values *t̂* and *σ̂*^{2} may have any value in the confidence ranges [*t*_{min}, *t*_{max}] and [${\sigma}_{\text{min}}^{2}$, ${\sigma}_{\text{max}}^{2}$], respectively, with the probability 1 − *δ _{PE}*. In order to calculate a safe secret key rate, calculating the maximum value of χ

*should be divided into two situations because of its convex function character versus*

_{BE}*T*. In this case, the expressions used to calculate the secret key rate in the regime of finite-size effect can be written as

*t*

_{peak}is the square root of

*T*

_{peak}, which corresponds to

*T*where Eve eavesdrops the maximum information. When the transmission efficiency is larger than

*t*

_{peak},

*t*

_{min}is used to maximize the information χ

*. When the transmission efficiency is smaller than*

_{BE}*t*

_{peak},

*t*

_{max}is used to maximize the information χ

*. If*

_{BE}*t*

_{peak}is located within [

*t*

_{min},

*t*

_{max}], we can move the value of

*t*

_{peak}out of the region by changing the modulation variance. On the other hand, the information χ

*versus noise*

_{BE}*σ*

^{2}is a monotonic increasing function, and ${\sigma}_{\text{max}}^{2}$ is used in any case. Because the mutual information

*I*has the following properties

_{AB}*t*

_{min}and ${\sigma}_{\text{max}}^{2}$ are used to calculate the minimum mutual information

*I*in any cases.

_{AB}Using Eq. (4), safe and tight RDLs can be achieved as shown in Fig. 6(a). The dashed curves are loose RDLs, and the solid curves are tight RDLs. From left to right, the numbers of total samples are 10^{8} (blue lines), 10^{10} (green lines), and 10^{12} (red lines). When the total number of samples is larger, the difference between the solid and dashed lines of the same color is minimized and the red dashed and solid lines nearly overlap. The black line represents the asymptotic case. Here, the tight or loose RDLs are drawn with optimal ratios, as shown in Fig. 6(b). The ratio is defined as dividing *m* by the total number *N*, where *m* is the amount of data used for the parameter estimation. When the distance or total number *N* varies, the optimal ratio *R* corresponding to the largest secret key rate varies accordingly. Here, the optimal ratio can be determined by scanning all possible ratios at a fixed distance and total number *N*. Obviously, the optimal ratio *R*_{imp} = *m*/*N* with the improved tight calculation method has the same variation tendency as the ratio *R*_{ori} = *m*/*N* in the original loose calculation method. Both ratios increase with increasing transmission distance for a constant number of total samples. For a fixed transmission distance, the optimal ratios decrease with increases in the number of total samples. This is a very useful rule in determining the number of data used for parameter estimation in experiment.

The solid lines in Fig. 6(a) only reflect the expected case *E*(*t̂*) or *E*(*σ̂*^{2}). In fact the estimated values *t̂* or *σ̂*^{2} can take any values in the confidence regions [*t*_{min}, *t*_{max}] and [${\sigma}_{\text{min}}^{2}$,${\sigma}_{\text{max}}^{2}$] with a probability of 1− *δ _{PE}* in realistic conditions. For example, when the total number of samples is on the order of 10

^{12}, the RDL should be distributed between the red dotted line (

*L*

_{min}bound) and the red dotted-dashed line (

*L*

_{max}bound). The longest transmission distance is nearly 190 km.

In the above, the finite-size effect is analyzed by analyzing two main factors simultaneously. One is the statistics effect generated by $\beta {I}_{\mathit{AB}}^{{\delta}_{\mathit{PE}}}-{\chi}_{\mathit{BE}}^{{\delta}_{\mathit{PE}}}$; the other is the privacy amplification effect generated by Δ(*n,* *δ _{PA}*). In the following, we investigate the effect of them on the key rate individually. The reduction of the secret key rate due to the statistic effect is defined as

Figure 7 plots the reduction ratios versus the transmission distance at different total numbers of samples. From left to right, the numbers of total samples of the blue, green, and red lines are 10^{8}, 10^{10}, and 10^{12}, respectively. The solid lines are the reduction ratios due to the statistics effect. The dot lines are the reduction ratios due to the privacy amplification effect. Comparing the solid and dashed lines, the statistic effect is more important than the privacy amplification effect. When the number of total samples is fixed, the ratios *R _{ST}* and

*R*decrease and increase, respectively, with the transmission distance. When the transmission distance is fixed, the ratios

_{PA}*R*and

_{ST}*R*increase and decrease, respectively, with the number of total samples.

_{PA}## 5. Realistic RDLs

In the above analysis, we can see that the finite-size effect play a key role in limiting the transmission distance. In this section, the RDLs considering realistic excess noise are analyzed and realistic RDLs are achieved.

In general, the estimated excess noise in CV QKD system increases with the distance. Controlling the excess noise to less than 0.01 for long transmission distances in experiments is extremely challenging [19,25]. It is shown that the excess noise *ε _{l}* from the fiber based quantum channel is usually small [40] and the excess noise

*ε*generated on Alice’s side is usually constant. In this case, we find that the excess noise

_{a}*ε*generated on Bob’s side mainly contribute to above phenomenon. The excess noise

_{b}*ε*can be attributed to the measurement error, such as the error due to the fluctuations of the relative phase (between the signal and the local oscillator) and the drift of the homodyne output. To illustrate this question clearly, a typical model for describing Alice’s and Bob’s variable in CV QKD is as follows:

_{b}*y*represents the measured quadrature of the signal field by Bob, and its variance is denoted as

*V*. The variable

_{B}*x*is Alice’s variable encoded on the quadrature of prepared quantum states, and its variance is

*V*. The variable

_{M}*z*follows a Gaussian distribution with the variance

*σ*

^{2}=

*ηT*(

*ε*+

_{a}*ε*) +

_{l}*ε*+

_{b}*N*

_{0}+

*ν*and a mean of zero, where the excess noise

_{e}*ε*generated on Bob’s side is introduced to reflect the measurement error. Eq. (10) can be transformed into a variance form as

_{b}*ε*can be calculated by

_{r}Notably, the excess noise is referred to the input port of the channel for security. From Eq. (12), we can see that the excess noise increase with the transmission efficiency *T* and the detection efficiency *η* due to the term *ε _{b}*/

*ηT*. This is due to the fact that

*ε*generated on Bob’s side occurs after the transmission of the quantum state and thus doesn’t attenuate with the channel transmission efficiency. When referred to the input port of the quantum channel, it will be amplified by a factor of 1/

_{b}*ηT*. In order to verify the above theoretical analysis, the excess noises at different transmission distances were measured using a CV QKD prototype [30]. The traditional method to estimate the excess noise can be seen in [36]. In our experiment, the parameters are set to

*V*= 10,

_{M}*ν*= 0.1,

_{e}*η*= 0.6. The measurement results are shown in Table 2, from which we can see that the estimated excess noise increases with the transmission distance. For comparison, Fig. 8 shows the experimental outcomes (black square points) and the simulated realistic excess noise

*ε*(cyan solid line) as a function of the transmission distance. The relevant parameters for simulation of

_{r}*ε*are

_{r}*ε*+

_{a}*ε*= 0.005,

_{l}*ε*= 0.0005, and

_{b}*η*= 0.6. We find that the experimental results agree with the theoretical predictions approximately.

The realistic RDLs versus the distance for a GG02 protocol in both the asymptotic (black dashed line) and finite-size cases (blue, green and red lines) are also illustrated in Fig. 8. For comparison, the performance of the system at a fixed excess noise of *ε* = 0.01 in asymptotic case is also presented (black solid line). For the realistic RDL, because the realistic excess noise rapidly increases with the transmission distance, the maximum transmission distance is limited to approximately 100 km. It is very different from the case with a fixed excess noise. The blue, green, and red lines are the conditions considering the finite-size effect. From left to right, the total numbers of samples are 10^{8}, 10^{10}, and 10^{12}, respectively. When the total number is 10^{12}, the red line nearly overlaps with the black dashed line, indicating that further increases in the total number of samples have no effect on the RDL. The results of Fig. 8 reflect the limitations of the CV QKD system under realistic excess noise.

## 6. Conclusions and discussion

In this study, we investigate the realistic RDL of CV QKD. At first, we present the RDLs considering the fixed excess noise and the experimental results of several typical protocols. Theoretical calculations indicate that the longest distance of 400 km can be achieved with a secret key rate of 10^{−9} bits/pulse. However, the real transmission distance is limited to ∼100 km with the channel loss of 0.2 dB/km. In order to find the reasons for this gap, the RDLs considering reconciliation efficiency, finite-size effect, and realistic excess noise are analyzed under collective attack. We find that the improvement in RDL by enhancing reconciliation efficiency is dependent on the excess noise. If the excess noise is larger, the improvement is more obvious. The convergence modulation variance is found as a substitute for the optimal modulation variance, thus simplifying the calculation. Furthermore, the RDL considering the finite-size effect is restudied; a loophole due to the monotonicity of χ* _{BE}* is eliminated and a tight RDL is presented. The optimal ratios determining the number of data used to evaluate the parameters are analyzed in different conditions. The reduction ratios due to the statistic and privacy amplification effects are analyzed individually, we find that the statistical effect is more important than the privacy amplification effect. More importantly, the excess noise generated on Bob’s side play a crucial role on the realistic RDL, which was verified by our experiment.

The above simulations are based on standard telecom single-mode fibers with a typical attenuation of 0.2 dB/km. If ultralow-loss fiber with attenuation of < 0.16 dB/km, or satellite-based free-space quantum communication technology are exploited, a longer distance could be anticipated. For future experimental research, some approaches can be attempted to break the realistic RDL, such as precisely calibrating the excess noise generated on Bob’s side and attributing it to virtual electronic noise. Innovative methods to accurately characterize the excess noise of the system may also be developed. On the other hand, the realistic RDL in the regime of composable security against coherent attacks will be considered in a further theoretical analysis.

## Appendix: calculation of the secret key rate

To calculate the secret key rate Δ*I*, an Entanglement-based scheme as shown in Fig. 9 was used. On Alice’s side, an Einstein-Podolsky-Rosen (EPR) state *ρ*_{AB0} is used. It can be determined by its covariance matrix *γ*_{AB0}, with the following form

After the transmission of mode *B*_{0} through the channel characterized by efficiency *T* and excess noise *ε*, the covariance matrix *γ*_{AB1} has the following form

_{line}= (1 −

*T*) /

*T*+

*ε*is the total noise added relative to channel input and (1 −

*T*) /

*T*is losses-induced vacuum noise. The balanced homodyne detector (BHD) with detection efficiency

*η*can be model as a beam splitter with transmission

*η*and a perfect BHD. The electronic noise

*ν*of it can be modelled by a thermal state

_{e}*ρ*

_{R0}with variance

*V*entering the other input port of the beam splitter, which is given by The thermal state

_{N}*ρ*

_{R0}could be considered as the reduced state obtained from an EPR state

*ρ*

_{R0H}. Then the covariance matrix

*γ*characterizing the state

_{AB}*ρ*after the beam splitter is given by

_{AB}_{tot}= χ

_{line}+ χ

_{hom}/

*T*is the total added noise between Alice and Bob relative to the channel input, and χ

_{hom}= (1 −

*η*) /

*η*+

*ν*/

_{e}*η*is the total noise introduced by the BHD relative to Bob’s input.

Usually, the secret key rate considering reverse reconciliation under collective attack in the asymptotic limit can be calculated by the following expression

where*I*is the Shannon mutual information between Alice and Bob,

_{AB}*β*is the reverse reconciliation efficiency, and χ

*is the maximum information accessed by Eve bounded by the Holevo quantity.*

_{BE}*I _{AB}* can be calculated directly using Shannon’s equation as follows

*V*is the quadrature variance for Alice, being the diagonal element of matrix

_{A}*γ*describing mode

_{A}*A*. Further,

*V*

_{A|B}is the conditional quadrature variance which is equal to the diagonal element of the conditional matrix

*γ*

_{A|B}and given by

*γ*,

_{A}*γ*, and

_{B}*σ*are all submatrices of the covariance matrix

_{AB}*γ*and appear in the decomposition of matrix

_{AB}*γ*in Eq. (21); and MP represents the Moore-Penrose matrix inverse.

_{AB}Eve’s accessible information can be calculated using

where*S*(

*ρ*) is the von Neumann entropy of the quantum state

*ρ*. For an n-mode Gaussian state

*ρ*, this entropy can be calculated using the symplectic eigenvalues of the covariance matrix

*γ*characterizing

*ρ*as follows where

*G*(

*x*) = (

*x*+ 1) log

_{2}(

*x*+ 1) −

*x*log

_{2}

*x*. The symplectic eigenvalues of a covariance matrix

*γ*with

*N*modes can be calculated by finding the absolute eigenvalues of the matrix

*i*Ω

*γ*.

As states *ρ*_{AB1E} and ${\rho}_{\mathit{ARHE}}^{{x}_{B}}$ are pure, *S* (*ρ _{E}*) =

*S*(

*ρ*

_{AB1}) and $S\left({\rho}_{\mathit{ARH}}^{{x}_{B}}\right)=S\left({\rho}_{E}^{{x}_{B}}\right)$. The entropy

*S*(

*ρ*) can be calculated from the symplectic eigenvalues

_{AB}*λ*

_{1,2}of the covariance matrix

*γ*. In order to present the expression of

_{AB}*λ*

_{1,2}concisely, the covariance matrix

*γ*is rewritten as

_{AB}Similarly, the entropy $S\left({\rho}_{\mathit{ARH}}^{{x}_{B}}\right)$ can be determined from the symplectic eigenvalues *λ*_{3,4,5} of the covariance matrix ${\gamma}_{\mathit{ARH}}^{{x}_{B}}$. The matrix ${\gamma}_{\mathit{ARH}}^{{x}_{B}}$ characterizing the state ${\rho}_{\mathit{ARH}}^{{x}_{B}}$ after Bob’s projective measurement can be determined using the following equation

Matrices *γ _{ARH}*,

*γ*and

_{B}*σ*appear in the decomposition of matrix

_{ARH;B}*γ*, i.e.,

_{ARHB}*γ*describing the state

_{ABRH}*ρ*. Specifically,

_{ABRH}*γ*can be obtained by applying a beam splitter transformation

_{ABRH}*S*

_{B1R0}to modes

*B*

_{1}and

*R*

_{0}, as follows

*λ*

_{3,4,5}of the covariance matrix ${\gamma}_{\mathit{ARH}}^{{x}_{B}}$ can be derived as

Base on the above expressions, we can calculate the Shannon mutual information *I _{AB}*, and the Holevo bound information χ

*. Finally, the secret key rate can be obtained. Using these expressions we can conveniently verify the convexity of χ*

_{BE}*.*

_{BE}## Funding

National Key R&D Program of China (2016YFA0301403); National Natural Science Foundation of China (NSFC) (11504219, 61378010); Key Research and Development Projects of Shanxi Province (201803D121065); Shanxi 1331KSC.

## References

**1. **C. H. Bennett and G. Brassard, “Quantum cryptography: public key distribution and coin tossing,” in *Proceedings of IEEE International Conference on Computers, Systems, and Signal Processing* (IEEE, 1984), pp. 175–179.

**2. **V. Scarani, H. Bechmann-Pasquinucci, N.J. Cerf, M. Dušek, N. Lütkenhaus, and M. Peev, “The security of practical quantum key distribution,” Rev. Mod. Phys. **81**(3), 1301–1350 (2009). [CrossRef]

**3. **C. Weedbrook, S. Pirandola, R. García-Patrón, N. J. Cerf, T. C. Ralph, J. H. Shapiro, and S. Lloyd, “Gaussian quantum information,” Rev. Mod. Phys. **84**(2), 621–669 (2012). [CrossRef]

**4. **S. Pirandola, R. Laurenza, C. Ottaviani, and L. Banchi, “Fundamental limits of repeaterless quantum communications,” Nat. Commun. **8**, 15043 (2017). [CrossRef] [PubMed]

**5. **M. Lucamarini, Z. L. Yuan, J. F. Dynes, and A. J. Shields, “Overcoming the rate-distance limit of quantum key distribution without quantum repeaters,” Nature **557**, 400–407 (2018). [CrossRef] [PubMed]

**6. **K. Inoue, E. Waks, and Y. Yamamoto, “Differential-phase-shift quantum key distribution using coherent light,” Phys. Rev. A **68**(2), 022317 (2003). [CrossRef]

**7. **D. Stucki, N. Brunner, N. Gisin, V. Scarani, and H. Zbinden, “Fast and simple one-way quantum key distribution,” Appl. Phys. Lett. **87**(19), 194108 (2005). [CrossRef]

**8. **D. Bacco, J. B. Christensen, M. A. U. Castaneda, Y. H. Ding, S. Forchhammer, K. Rottwitt, and L. K. Oxenlowe, “Two-dimensional distributed-phase-reference protocol for quantum key distribution,” Sci. Reports **6**, 36756 (2016). [CrossRef]

**9. **T. C. Ralph, “Continuous variable quantum cryptography,” Phys. Rev. A **61**(1), 010303(R) (1999). [CrossRef]

**10. **N. J. Cerf, M. Levy, and G. Van Assche, “Quantum distribution of Gaussian keys using squeezed states,” Phys. Rev. A **63**(5), 052311(2001). [CrossRef]

**11. **D. Gottesman and J. Preskill, “Secure quantum key distribution using squeezed states,” Phys. Rev. A **63**(2), 022309 (2001). [CrossRef]

**12. **C. Silberhorn, N. Korolkova, and G. Leuchs, “Quantum key distribution with bright entangled beams,” Phys. Rev. Lett. **88**(16), 167902 (2002). [CrossRef] [PubMed]

**13. **F. Grosshans and P. Grangier, “Continuous variable quantum cryptography using coherent states,” Phys. Rev. Lett. **88**(5), 057902 (2002). [CrossRef] [PubMed]

**14. **F. Grosshans, G. Van Assche, J. Wenger, R. Brouri, N. J. Cerf, and P. Grangier, “Quantum key distribution using Gaussian-modulated coherent states,” Nature **421**, 238–241 (2003). [CrossRef] [PubMed]

**15. **C. Weedbrook, A. M. Lance, W. P. Bowen, T. Symul, T. C. Ralph, and P. K. Lam, “Quantum cryptography without switching,” Phys. Rev. Lett. **93**(17), 170504 (2004). [CrossRef] [PubMed]

**16. **R. García-Patrón and N. J. Cerf, “Unconditional optimality of Gaussian attacks against continuous-variable quantum key distribution,” Phys. Rev. Lett. **97**(19), 190503 (2006). [CrossRef] [PubMed]

**17. **J. Lodewyck, M. Bloch, R. García-Patrón, S. Fossier, E. Karpov, E. Diamanti, T. Debuisschert, N. J. Cerf, R. Tualle-Brouri, S. W. McLaughlin, and P. Grangier, “Quantum key distribution over 25 km with an all-fiber continuous-variable system,” Phys. Rev. A **76**(4), 042305 (2007). [CrossRef]

**18. **X. Y. Wang, Z. L. Bai, S. F. Wang, Y. M. Li, and K. C. Peng, “Four-state modulation continuous variable quantum key distribution over a 30-km fiber and analysis of excess noise,” Chin. Phys. Lett. **30**(1), 010305 (2013). [CrossRef]

**19. **P. Jouguet, S. Kunz-Jacques, A. Leverrier, P. Grangier, and E. Diamanti, “Experimental demonstration of long-distance continuous-variable quantum key distribution,” Nat. Photonics **7**, 378–381 (2013). [CrossRef]

**20. **R. kumar, H. Qin, and R. Alléaume, “Coexistence of continuous variable QKD with intense DWDM classical channels,” New J. Phys. **17**(4), 043027 (2015). [CrossRef]

**21. **V. C. Usenko and F. Grosshans, “Unidimensional continuous-variable quantum key distribution,” Phys. Rev. A **92**(6), 062337 (2015). [CrossRef]

**22. **C. Wang, D. Huang, P. Huang, D. Lin, J. Peng, and G. Zeng, “25 MHz clock continuous-variable quantum key distribution system over 50 km fiber channel,” Sci. Rep. **5**, 14607 (2015). [CrossRef]

**23. **B. Qi, P. Lougovski, R. Pooser, W. Grice, and M. Bobrek, “Generating the local oscillator “Locally” in continuous-variable quantum key distribution based on coherent detection,” Phys. Rev. X **5**(4), 041009 (2015).

**24. **D. Huang, P. Huang, D. Lin, and G. Zeng, “Long-distance continuous-variable quantum key distribution by controlling excess noise,” Sci. Rep. **6**, 19201 (2016). [CrossRef] [PubMed]

**25. **X. Y. Wang, W. Y. Liu, P. Wang, and Y. M. Li, “Experimental study on all-fiber-based unidimensional continuous-variable quantum key distribution,” Phys. Rev. A **95**(6), 062330 (2017). [CrossRef]

**26. **S. Fossier, E. Diamanti, T. Debuisschert, A Villing, R. Tualle-Brouri, and P. Grangier, “Field test of a continuous-variable quantum key distribution prototype,” New J. Phys. **11**(4), 045023 (2009). [CrossRef]

**27. **N. Wang, S. N. Du, W. Y. Liu, X. Y. Wang, Y. M. Li, and K. C. Peng, “Long-Distance Continuous-Variable Quantum Key Distribution with Entangled States,” Phys. Rev. Applied **10**(6), 064028 (2018). [CrossRef]

**28. **P. Jouguet, S. Kunz-Jacques, T. Debuisschert, S. Fossier, E. Diamanti, R. Alléaume, R. Tualle-Brouri, P. Grangier, A. Leverrier, P. Pache, and P. Painchault, “Field test of classical symmetric encryption with continuous variables quantum key distribution,” Opt. Express **20**(13), 14030–14041 (2012). [CrossRef] [PubMed]

**29. **D. Huang, P. Huang, H. Li, T. Wang, Y. Zhou, and G. Zeng, “Field demonstration of a continuous-variable quantum key distribution network,” Opt. Lett. **41**(15), 3511–3514 (2016). [CrossRef] [PubMed]

**30. **Y. M. Li, X. Y. Wang, Z. L. Bai, W. Y. Liu, S. S. Yang, and K. C. Peng, “Continuous variable quantum key distribution,” Chin. Phys. B. **26**(4), 040303 (2017). [CrossRef]

**31. **F. Karinou, H. H. Brunner, C. F. Fung, L. C. Comandar, S. Bettelli, D. Hillerkuss, M. Kuschnerov, S. Mikroulis, D. Wang, C. X M. Peev, and A. Poppe, “Toward the integration of CV quantum key distribution in deployed optical networks,” IEEE Photonic Tech. Lett. **30**(7), 650–653 (2018). [CrossRef]

**32. **M. Milicevic, C. Feng, L. M. Zhang, and P. G. Gulak, “Quasi-cyclic multi-edge LDPC codes for long-distance quantum cryptography,” NPJ Quantum Inf. **4**, 21 (2018). [CrossRef]

**33. **P. Wang, X. Y. Wang, J. Q. Li, and Y. M. Li, “Finite-size analysis of unidimensional continuous-variable quantum key distribution under realistic conditions,” Opt. Express **25**(23), 27995–28009 (2017). [CrossRef]

**34. **Z. Qu, I. B. Djordjevic, and M. A. Neifeld, “RF-subcarrier-assisted four-state continuous variable QKD based on coherent detection,” Opt. Lett. **41**(23), 5507–5510 (2016). [CrossRef] [PubMed]

**35. **A. Leverrier and P. Grangier, “Continuous-variable quantum-key-distribution protocols with a non-Gaussian modulation,” Phys. Rev. A **83**(4), 042312 (2011). [CrossRef]

**36. **A. Leverrier, F. Grosshans, and P. Grangier, “Finite-size analysis of a continuous-variable quantum key distribution,” Phys. Rev. A **81**(6), 062343 (2010). [CrossRef]

**37. **P. Papanastasiou, C. Ottaviani, and S. Pirandola, “Finite-size analysis of measurement-device-independent quantum cryptography with continuous variables,” Phys. Rev. A **96**(4), 042332 (2017). [CrossRef]

**38. **X. Y. Zhang, Y. C. Zhang, Y. J. Zhao, X. Y. Wang, S. Yu, and H. Guo, “Finite-size analysis of continuous-variable measurement-device-independent quantum key distribution,” Phys. Rev A **96**(4), 042334 (2017). [CrossRef]

**39. **P. Jouguet, S. K. Jacques, E. Diamanti, and A. Leverrier, “Analysis of imperfections in practical continuous-variable quantum key distribution,” Phys. Rev. A **86**(3), 032309 (2012). [CrossRef]

**40. **J. Lodewyck, T. Debuisschert, R. Tualle-Brouri, and P. Grangier, “Controlling excess noise in fiber-optics continuous-variable quantum key distribution,” Phys. Rev. A **72**(5), 050303(R) (2005). [CrossRef]