1. INTRODUCTION

Quantum mechanics promises many new opportunities for the design of communication networks, providing highly correlated resources, such as entangled or even nonlocal states, as well as stringent restrictions on the possible knowledge of observables, as exemplified by Heisenberg’s uncertainty principle. By considering entropic versions of these uncertainty relations [1,2], the intimate connection between entanglement and uncertainty, first uncovered in the seminal work of Einstein, Podolsky, and Rosen (EPR) [3], has since begun to be formalized and quantified [4].

Both these features are of value to the would-be cryptographer, as they enable protocols in which security is grounded in the laws of quantum physics, with the most celebrated example being quantum key distribution (QKD) [5]. The earliest, and most conceptually simple, QKD schemes encode a discrete variable (DV) key in a two-dimensional Hilbert space [6,7]. As the optical implementation involves sophisticated techniques such as the generation and detection of single photons, considerable attention has also been devoted to schemes that instead utilize the quadratures of the optical field [8–12] in which one has access to deterministic, high-efficiency broadband sources and detectors. This approach is more theoretically involved, however, as the secret key is now a continuous variable (CV) that is encoded in states living in an infinite-dimensional Hilbert space.

The challenge of realizing the full promise of QKD—physically guaranteed security with minimal additional assumptions—has crystallized into two fronts. In the first place, we desire a lower bound on the extractable secret key length, including the effects of a finite number of transmitted symbols, that allows for an arbitrarily powerful eavesdropper (Eve) [13–16]. In the second place, we would like to close any gaps that may exist between a theoretical QKD protocol and its practical realization. Essentially, this is the problem of whether or not the honest parties (Alice and Bob) have correctly characterized their experimental devices. One might expect that these gaps must simply be closed on a case-by-case basis. Indeed, as various loopholes due to mischaracterized devices have been pointed out, they have usually been followed by straightforward methods for their closure. Remarkably, however, it is in-principle possible to rigorously surmount even this challenge by harnessing nonlocal quantum correlations, and it is this second problem we tackle for the entire Gaussian family of CV-QKD protocols. We identify all protocols that can be proven secure in a one-sided device-independent (1sDI) setting, i.e., independent of the devices of either Alice or Bob (but not both), and provide a proof-of-principle experimental demonstration of some of the most practical of such protocols.

Fully device-independent (DI) protocols allow Eve control over all experimental devices and are closely related to the concept of Bell nonlocality and the exclusion of local hidden variable (LHV) models [17–22]. These schemes are extremely experimentally challenging as they require the implementation of a detection-loophole-free Bell test [23–25]. As such, they are also out of reach for purely Gaussian protocols, as it is impossible to violate a Bell inequality utilizing only Gaussian resources [26]. More recently, an intermediate, asymmetric form of nonlocality known as EPR-steering has been classified, which allows Alice or Bob to rule out an LHV explanation of the other parties’ correlations [27]. A natural question to ask is whether there exist analogous cryptographic results, where only one party’s devices are untrusted. This possibility, first noted in Ref. [28], was subsequently developed to prove the security of experimentally difficult, but feasible, proposals for 1sDI DVQKD protocols, which were explicitly linked to the corresponding EPR steering inequality [29]. Note that this should not be confused with the distinct concepts of measurement-device-independent QKD, in which both Alice and Bob use trusted sources to generate a key via an untrusted measurement in the middle [30–34], and semi-device independence, in which all devices are untrusted, but assumptions are made about the Hilbert space dimension [35].

As with Bell tests, closure of the steering detection loophole has only recently been achieved in state-of-the-art single-photon experiments [36–38]. This is in stark contrast to the CV case where detection-loophole-free tests have been experimentally feasible for over 20 years [39] and very strong violations of steering inequalities have been demonstrated [40]. Protocols motivated by these hardware advantages have begun to appear. A direct extension [28] to the infinite-dimensional Hilbert spaces relevant for CV-QKD [41] has been applied to propose a discretized 1sDI-CV-QKD protocol that also accounts for finite-size effects [15,16], and a scheme independent of Bob’s devices only has recently been demonstrated [42].

In this paper we utilize further advances in entropic uncertainty relations [43,44] to theoretically and experimentally investigate the security of the entire family of 16 Gaussian CV-QKD protocols against arbitrary attacks in the asymptotic setting. We identify the six protocols, including two prepare-and-measure (P&M) schemes, that can be proven 1sDI and compactly calculate their secret key rates. Remarkably, we show that 1sDI-CV-QKD is possible with the cheapest and most practical resource in quantum optics—coherent states. We calculate the ultimate limits for all protocols under realistic decoherence channels and show that, while reasonably robust to losses, and hence more practical than their DV counterparts over short to medium distances, all the 1sDI-CV-QKD protocols are inherently loss-limited. We also make explicit the connection between the asymmetric forms of nonlocality and DI cryptography, with the 1sDI-CV-QKD key rates displaying an elegant connection to the relevant EPR-steering parameter, a result not known for the DV protocols. Finally, we experimentally implement several protocols, including both P&M and entanglement-based (EB) schemes, finding varying degrees of robustness to losses and experimental imperfections. The best performing protocols allow equivalent losses of up to 7.5 km of optical fiber transmission. Notably, the coherent state protocol has the poorest theoretical loss tolerance, but its experimental performance lies closest to the theoretical limits, indicating it could well be the most practical candidate for short-range 1sDI metropolitan networks.

2. RESULTS

A. Entropic Uncertainty Relations and CV-QKD

The most common CV-QKD protocols are the Gaussian protocols that encode information in the quadratures of the optical field, described by operators like $\widehat{x}=\sqrt{\frac{\hslash }{2}}(\widehat{a}+{\widehat{a}}^{†})$ and $\widehat{p}=\sqrt{\frac{\hslash }{2}}i({\widehat{a}}^{†}-\widehat{a})$, where $\widehat{a}$ and ${\widehat{a}}^{†}$ are bosonic annihilation and creation operators. One can prepare squeezed [8,9] or coherent [12] states, and measure with either homodyne detection (switching between quadratures) or heterodyne detection [45] (where both quadratures are measured simultaneously). One could also use EB schemes where two-mode squeezing is used to create Gaussian EPR-correlated states (EPR states) [10]. An equivalence between these EB schemes and the P&M approaches has been established in a device-dependent scenario [46]. The communicating parties, Alice and Bob, can also use either a direct reconciliation (DR) scheme in which Alice sends corrections to Bob or a reverse reconciliation (RR) scheme [11] in which Bob sends corrections to Alice. This makes for a total of 16 protocols. Only the RR protocols allow for losses above 50%, although one can also achieve this loss-tolerance via postselection, which discards some of the keys in order to retain a more correlated subset [47].

Previous works have proved the security of Gaussian CV-QKD in the asymptotic limit up to the level of collective attacks, via the Gaussian extremality of relevant quantities [48,49]. The proofs were finally raised to the level of the most general coherent attacks by use of the de Finetti theorem adapted to infinite dimensions [50], which shows that collective attacks are in fact optimal. Consequently, one can asymptotically lower bound the secret key rate by considering only Gaussian collective attacks. For concreteness, we first consider an RR protocol with EPR states and a secret key extracted from Alice and Bob’s homodyne measurements denoted by the random variables $X_{A(B)}$ with outcomes $x_{A(B)}$, which follow probability distributions $p(x_{A(B)})$. Neglecting detector and reconciliation efficiencies for simplicity (we shall include these effects in our final calculations) the asymptotic RR secret key rate is lower bounded by [48,49]

One can alternatively analyze the security in terms of the conditional entropy of the observable ${\widehat{x}}_B$ from the perspective of a quantum eavesdropper $E$:

Writing out the key rate in Eq. (1) in full and comparing with Eq. (2) we have

Bounding the conditional entropy of an observable is the longstanding goal of the study of entropic uncertainty relations [1,2]. For our purposes, we require a general tripartite relation, encompassing Alice, Bob, and Eve, that holds for continuous quadrature observables in an infinite-dimensional Hilbert space (see Supplement 1 for details). Very recently, an appropriate relation bounding the entropy of Bob and Eve regarding the conjugate quadratures of Alice has been derived [43,44,51]:

This entropic uncertainty relation now allows us to bound the eaves-droppers information on the relevant observable. Substituting from Eq. (4) and recalling that $S(P_A|B)\le S(P_A|P_B)=H(P_A|P_B)$, we can write

Thus we have bounded the secret key by an expression that depends only upon the conditional Shannon entropies that are directly accessible to Alice and Bob. Furthermore, one can show via a variational calculation that, for any probability distribution $p(x)$, the corresponding Shannon entropy is maximized for a Gaussian distribution of the same variance. In other words, Alice and Bob can bound their secret key rate for this protocol by measuring Bob’s conditional variances. Substituting the Shannon entropy for a Gaussian distribution $H_G(x_B|x_A)=\log \sqrt{2\pi e{V}_{X_B|X_A}}$, where $V_{X_B|X_A}=V_{X_B}-\frac{{⟨X_A{X}_B⟩}^2}{V_{X_A}}$ is Bob’s variance conditioned on Alice’s measurement, we arrive at the final expression for the RR key rate:

The DR expression is obtained by simply permuting the labels of Alice and Bob. We note that this expression was also calculated in Ref. [51], but the proof was incomplete, as it relied on the assumption of the applicability of the entropic uncertainty relation. Moreover, it was incorrectly concluded that this method would never predict a positive key when applied to coherent state or heterodyne protocols. In fact, the extension of Eq. (6) to the other Gaussian protocols is straightforward and is given in Supplement 1.

B. 1sDI-CV-QKD

An important benefit of utilizing entropic uncertainty relations in QKD proofs is that they lend themselves toward 1sDI protocols [28,29]. These are relaxed versions of the fully DI schemes [18–20] in which all devices are untrusted and the security is guaranteed via a detection-loophole-free Bell violation. The only assumptions that need to be made for DI schemes are the security of the stations, the causal independence of the measurement trials, and a trusted source of randomness for choosing measurement settings. We adopt the same assumptions here; however, it should be noted that recently schemes have appeared that do not require causal independence [21,22].

For 1sDI-QKD protocols, only one side, Alice or Bob, is untrusted and regarded as a black box while the other is assumed to involve a particular set of quantum operations (see Fig. 1). Now, the security is linked to the steering inequalities [27] associated with the observables on the trusted side. The 1sDI nature of these entropic proofs is manifest in expressions like Eq. (6), in that it depends upon measuring a known observable upon only one side. For example, in the derivation, we need to know only that Bob is measuring either ${\widehat{x}}_B$ or ${\widehat{p}}_B$ in order to apply the entropic uncertainty relation. Although we write expressions $V_{X_B|X_A}$, as this is what will be measured in experiments, Alice could be making any measurement (not necessarily a quadrature measurement), and the key rate given by Eq. (6) would still hold.

 

Fig. 1. Conceptual picture of a 1sDI-CV-QKD protocol. From the perspective of Alice (Bob) the local devices are known and allow a secret key to be extracted from a direct (reverse) reconciliation protocol, even though the other party exists only as an unknown red (blue) box.

Download Full Size | PDF

Thus, for EPR states and homodyne measurements, any positive key predicted via the entropic uncertainty relation is by definition 1sDI, independent of Alice for RR and Bob for DR [15,16]. However, this device independence does not necessarily extend to the protocols involving heterodyne detection. This is essentially because the proof to derive nonzero key rates for the heterodyne protocols depends upon characterizing the devices used in the heterodyne detection. Therefore, employing a heterodyne detection on the supposedly untrusted side immediately invalidates the device independence. Alternatively, recall that a steering demonstration requires a measurement choice by the untrusted party [27] and no such choice takes place if they heterodyne detect. Nonetheless, the remaining protocols, with the heterodyne detection taking place in the trusted station, are still implementable with high-efficiency sources and detection opening the way to several 1sDI-CV-QKD protocols with current technology. This means that, for EB protocols, both DR and RR may be 1sDI provided all parties are homodyning, while Bob may safely heterodyne for an RR protocol and Alice may heterodyne for a DR protocol. Finally, for DR protocols where Alice (who controls the source) is trusted, we may also safely make the equivalence between P&M and EB schemes. Remarkably, this means that, for DR, it is possible to generate 1sDI key using only coherent states. We summarize which of the 16 possible Gaussian protocols are potentially 1sDI in the table inset in Fig. 2.

 

Fig. 2. Secure regions for 1sDI-CV-QKD protocols for a Gaussian channel parameterized by a transmission $T$ and excess noise $\xi$. DR protocols are plotted in blue when Alice homodynes (or equivalently sends squeezed states) and purple when Alice heterodynes (or equivalently sends coherent states). RR schemes are plotted in red when Bob homodynes and orange when Bob heterodynes. For each protocol, secure communication is possible for all channels above the corresponding line. Inset: summary of 1sDI-CV-QKD protocols where subscript A (B) indicates independence of Alice’s (Bob’s) devices.

Download Full Size | PDF

Although they allow for 1sDI keys, the entropic proofs result in different, and, it turns out, generically lower, secret key rates than the standard proofs for Gaussian CV-QKD schemes. To map out the ultimate limits of these protocols, we first consider an idealized setup with perfect detectors and a highly squeezed (10 dB) two-mode squeezed vacuum source. To evaluate performance, we consider a Gaussian channel, an excellent model for real fiber optic cable, characterized by a transmission $T$ and an excess noise parameter $\xi$, given in units of shot noise. The noise parameter can be thought of as the noise input to the channel such that a pure state with unity variance would have a variance $1+T\xi$ after the channel. Neglecting imperfections such as detector and reconciliation efficiency, this is the chief factor that limits the range. In Fig. 2 we plot the four distinct secure regions (there are two redundancies between P&M and EB schemes) for the 1sDI protocols. The best performing scheme (in terms of loss tolerance) is the RR EPR scheme in which both parties homodyne. In the limit of low excess noise, this scheme is secure for up to 73% loss. For very low noises the next best scheme is the RR protocol in which Bob heterodyne detects, but for higher noises the DR protocol with both parties homodyning (or alternatively with Alice sending squeezed states) performs better. Finally, although the DR coherent state scheme performs the poorest, it is still secure up to around 33% loss. These results show that 1sDI-CV-QKD is reasonably robust to decoherence, but noticeably less loss tolerant than the standard CV-QKD. In this idealized case, the standard protocols tolerate arbitrarily large amounts of loss provided the excess noise is sufficiently small, whereas our results show that all the Gaussian 1sDI CV-QKD protocols are inherently loss limited. Ultimately, this is because the uncertainty relations used to bound the secret key rate are tight only when the parties involved, e.g., Bob and Eve in Eq. (6), can be approximated as sharing a pure, highly-squeezed EPR state [16,43]. In reality, this is rarely ever the case, and the entropic proof method tends to give a pessimistic bound on the eavesdroppers information. We will discuss the prospects for extending the transmission range in the final section.

C. Connection to EPR Steering

In the earlier DV work, a clear conceptual link was made between DI protocols and Bell nonlocality [18]. Our intuition that the 1sDI-DV-QKD protocols should be analogously related to the corresponding asymmetric form of nonlocality, EPR steering, was confirmed by Branciard et al., who showed that the condition for their protocol to achieve a positive key was equivalent to a steering inequality [29].

For the Gaussian states and measurements relevant to CV-QKD, steering is traditionally demonstrated by a violation of a condition on the conditional variances. In particular, we must violate ${\mathcal{E}}_{▸}:=V_{X_B|X_A}{V}_{P_B|P_A}\ge 1$ for Alice to provably steer Bob, as indicated by the right black triangle, and similarly with $A$ and $B$ interchanged [27] and the arrow reversed. This is precisely the same as the EPR paradox criteria derived long ago by Reid [52]. Comparison with Eq. (6) shows that we can write the key directly in terms of the steering parameter:

For the homodyne key rate, $K^{◃}>0$ if and only if ${\mathcal{E}}_{▸}<{\left(\frac{2}{e}\right)}^2\approx 0.55$, with the identical relation between the DR key rate and ${\mathcal{E}}_{◂}$ following straightforwardly. In other words, the condition for a positive 1sDI key is more stringent than EPR steering, similarly to the case for 1sDI-DV-QKD [29]. For the protocols where a trusted heterodyne detection takes place, the security of the protocol is instead linked to the steerability of the outcome of the heterodyne measurement, which will be more challenging due to the extra loss involved (see Supplement 1). Consequently, this connection gives us an operational interpretation for the Reid product of conditional variances [52] as being directly related to the number of secure 1sDI bits extractable from Gaussian states with Gaussian measurements. This is a particularly practical cryptographic interpretation, in addition to previous work highlighting the links between steering and one-sided device independence in quantum teleportation [53] and secret sharing [54]. Interestingly, the gap between a steering violation and the generation of a 1sDI key tells us that Eve’s optimal attack (which we know to be Gaussian) followed by a non-Gaussian collective measurement allows her to more effectively steer the Gaussian measurement results of Alice and Bob than any Gaussian measurement.

As a side note, we point out that, in the situation where Eve is restricted to individual attacks, we would expect a perfect correspondence between steering and key generation since the optimal eavesdropping strategy is known to utilize Gaussian measurements in this scenario. Recalling the secret key formulas when Eve makes Gaussian measurements, $K_G$ [11], we find this is indeed the case with

In short, one can also interpret the entropic EPR steering criteria as precisely quantifying the number of secret, 1sDI bits, extractable from a scenario where all parties are restricted to individual measurements.

D. Experimental Results

As mentioned in the previous sections, six of the 16 possible Gaussian protocols are 1sDI. We implement five protocols experimentally, three of which exhibit sufficient correlations to allow for 1sDI-CV-QKD. Two different experimental setups were used, the first for the EB protocols based on EPR correlations and the second for a coherent-state P&M protocol (see Fig. 4). To perform the first and second 1sDI protocols we used the EPR source while both parties performed a homodyne detection. The third and fourth protocols were implemented using the same EPR source while one party (Alice for the DR protocol and Bob for the RR protocol) heterodyned while the other homodyned. Finally, the P&M scheme was implemented for the DR protocol where Alice, who was trusted and controlled the source, generated coherent states and Bob performed a homodyne measurement.

 

Fig. 3. Schematic diagram of all the experimentally realized 1sDI protocols. Alice and Bob can choose between homodyne and heterodyne measurements, using a source that generates either EPR or coherent states. Direct (reverse) reconciliation protocols are demonstrated using right (left) pointing arrows. The table summarizes each performed protocol and the experimentally achieved results. The same color scheme as Fig. 2 is used here to show the different performed protocols.

Download Full Size | PDF

 

Fig. 4. Schematic diagram of all the experimental setups. (a)(i) EPR source: OPA1 and OPA2 are two similar optical parametric amplifiers (OPAs), which produced amplitude-squeezed beams. A 1064 nm Nd:YAG laser was used to seed both OPAs. They both generated $-6.5\mathrm{dB}$ of squeezing and 10.7 dB of anti-squeezing. PZT is a piezo-electric crystal and BS is a $50:50$ beam splitter. Two amplitude squeezed beams were mixed on a beam splitter with their relative phase locked in quadrature to produce an EPR state. (a)(ii) Optical components used to simulate the lossy channel, which consisted of a half-wave plate and a polarizing beam splitter (PBS). In (b)–(d), one part of the entangled state is sent to Alice locally and the other through a lossy channel to Bob. Here “Hom” refers to alternating homodyne measurements, and “Het” to a heterodyne measurement. The measurement configurations for Alice and Bob are (b) Homodyne (Alice)—Homodyne (Bob), (c) Heterodyne (Alice)—Homodyne (Bob), and (d) Homodyne (Alice)—Heterodyne (Bob). (e) P&M experiment: AM and PM are electro-optic modulators (EOMs) driven by function generators (FG), which, in turn, provided a Gaussian distributed displacement of the vacuum state in amplitude and phase quadratures. The resulting coherent states were then sent to Bob through a lossy channel where he performed a homodyne measurement. Details of the experimental setups are presented in Supplement 1.

Download Full Size | PDF

In each protocol, Alice and Bob are connected by a lossy channel of transmission $T$. The lossy channel is constructed using a half-wave plate and a polarizing beam splitter, as detailed in Fig. 4(a)(ii). We express the applied loss as the equivalent transmission distance through a standard telecom optical fiber with a loss of 0.2 dB/km. Ideally, the secret key rate could be computed directly from the expressions in Supplement 1. However, in practice we must modify these expressions, multiplying Alice and Bob’s mutual information by a factor $\beta <1$ to account for finite information reconciliation efficiency (see Supplement 1 for explicit calculations). Reconciliation efficiencies for CV-QKD have increased substantially in the past few years [55,56], with efficiencies of between 94% and 95.5% recently reported [42]. Here, we choose $\beta =0.95$. The inclusion of $\beta <1$ will reduce the final calculated key rate. This makes the condition ${\mathcal{E}}_{▸(◂)}<0.55$ necessary but no longer sufficient for a positive key when $\beta$ is included. A schematic diagram of all the performed experiments and the achieved results are summarized in Fig. 3.

Among the successful implementations, protocol 2 (EB scheme RR protocol where both parties homodyned) shows the best loss tolerance and protocol 1 (EB scheme DR protocol where both parties homodyned) shows the worst, with protocol 5 (coherent state P&M scheme with homodyne detection) being intermediate. This actually demonstrates a different hierarchy of loss tolerance than the theoretical results calculated in the limit of very large squeezing and pure entanglement (Fig. 2). This difference is because in our experiment we had only about −6 dB of squeezing and 10.7 dB of anti-squeezing, which, along with other losses and imperfections, degraded the quality of the entangled source and hence limited the range of the EB protocols. This is also why the heterodyne protocols (3 and 4) fail to produce any positive key at all, as overcoming the shot noise penalty requires extremely strong correlations. Our calculations show that a perfect system with no losses of any kind and reconciliation efficiency of 0.95 would still require at least 7 dB of perfectly pure squeezing ($-7\mathrm{dB}$ squeezing and 7 dB anti-squeezing) to get a positive key rate even over a perfect channel with the heterodyne protocols.

We plot our measured secret key rates as a function of effective transmission distance in Fig. 5. Solid lines are calculated from a theoretical model based upon the characterization of various imperfections in the experiment. Results for the protocols where Alice and Bob performed the homodyne measurements on a distributed EPR state are given in Fig. 5(a). By using the RR protocol, we measured a positive key rate independent of Alice’s devices up to an equivalent transmission distance of $7.57\pm 0.26\mathrm{km}$ (approximately 29% applied loss). Using the DR protocol, we measured a secret key independent of Bob’s devices up to an equivalent transmission distance of $2.52\pm 0.21\mathrm{km}$ (approximately 11% applied loss). Our theoretical model, which is in good agreement with the experimental data, predicts maximum transmission ranges of 8 and 2.8 km for the RR and DR protocols, respectively (see Supplement 1).

 

Fig. 5. Key rates versus distance for (a) DR and RR protocols with EB source and homodyne–homodyne detection and (b) P&M coherent state DR scheme (protocols 1, 2, and 5 in the table in Fig. 3). Theoretical curves, including imperfect reconciliation efficiency were evaluated from the expressions given in Supplement 1, part 3 using models described in Supplement 1, part 4 and part 5, which took into account the finite reconciliation efficiency $\beta$, source and locking imperfection, and optical losses. The experimental data points are superposed on the plot, with error bars (1 standard deviation) estimated from error propagation of uncertainties. (c) Example experimental data points from the EB DR protocol. Phase-space plots show the correlations between the quadratures, $P_A$ and $P_B$ and $X_A$ and $X_B$, measured by Alice and Bob. Using their statistics, the conditional variances are calculated and used to estimate the EPR steering parameters. The circle on the right illustrates the comparison of the measured value of the EPR steering (purple), the necessary condition for obtaining a positive key rate (dashed), and the upper bound for EPR steerability (green). Panels (d) and (e) illustrate circles corresponding to each plotted data point in (a) and (b), showing the connection between the measured values of EPR steering and the generation of positive key rates.

Download Full Size | PDF

Figure 5(b) depicts the results of the DR coherent state protocol. We show that a secure key remains possible after an equivalent transmission distance of $3.47\pm 0.46\mathrm{km}$ (approximately 15% applied loss). This is in good agreement with our theoretical model, which predicts our current setup would be secure up to a maximum of 4.5 km. With the P&M protocol, described in Fig. 4(e), we have much more latitude to vary the modulation variance and, hence, the virtual entanglement to optimize the secret key rate for each loss setting (see Supplement 1). As such, we achieve a loss tolerance superior to the EB DR protocol, while using only the cheapest and most readily available quantum optical resource states.

We also display the behavior of the measured steering parameter with respect to the thresholds required for key generation and violation of the Reid EPR-steering criteria [see Fig. 5(c)]. For each data point, we graphically represent the relevant steering parameter with respect to these thresholds in Figs. 5(d) and 5(e). In accordance with our earlier discussion, we show that a positive key is achieved with an EB RR (DR) protocol only when ${\mathcal{E}}_{▸(◂)}<{\left(\frac{2}{e}\right)}^2\approx 0.55$. We note that, for the P&M DR protocol, since in the equivalent EB picture Alice performs a heterodyne detection, ${\mathcal{E}}_{▸}=V_{X_{A_1}|X_B}{V}_{P_{A_2}|P_B}$. Here, $A_1$ and $A_2$ are the modes upon which Alice measured $\widehat{x}$ and $\widehat{p}$, respectively. On the other hand, all plotted points demonstrate EPR steering through a violation of the Reid criteria. Consequently, the negative data points would demonstrate sufficient correlations for 1sDI key generation if we were able to restrict Eve to individual attacks as per Eq. (8).

To better understand the limitations of, and potential improvements to, our experiments, theoretical models of both the EB and P&M were constructed. Modeling all processes as Gaussian allows for compact calculations and matches the experimental data closely. As well as using these models to determine the maximum range of our current experiment, we also investigated the performance that could be achieved with an improved implementation. For the EB protocols, the dominant source of decoherence are losses in the squeezing cavities. Modeling indicates that making challenging but reasonable improvements to the amount of available squeezing and the precision of locking could extend the asymptotic range of the DR and RR homodyne protocols to around 8 and 17 km, respectively, again assuming a reconciliation efficiency of $\beta =0.95$. See Supplement 1 for detailed explanation of the model for the EB protocols.

As mentioned previously, in contrast to the EB protocols when using coherent states, we have a great deal of flexibility in tuning the virtual squeezing via an increase in the modulation strength. In this protocol, the dominant source of noise is the unwanted cross modulation between the quadratures, which worsens as the modulation strength increases. This can be thought of as an unknown phase space rotation, and means we cannot use the modulation variance that would otherwise be optimal and depend only upon $\beta$ and the channel loss. If this cross modulation could be eliminated, our model shows that the asymptotic range of the coherent state scheme would increase to around 6.5 km. Details of the P&M model and the modulation optimization can be found in Supplement 1.

3. DISCUSSION

To summarize, we have provided a complete taxonomy of the Gaussian CV-QKD protocols from the perspective of one-sided device-independence. We also derived the asymptotic secret key rate for all six such protocols, and made an explicit connection to the EPR steering parameters for Gaussian states and measurements. Using these derived rates, we have characterized an experimental implementation of five of the six protocols, achieving secure key under a lossy channel equivalent of up to 7.5 km of optical fiber. Of particular interest was the first demonstration of a 1sDI CV-QKD protocol using only coherent states. That such an exotic quantum communication protocol is possible with these relatively mundane quantum states is a surprising result in itself. Furthermore, the ease with which they can be generated makes them especially attractive candidates for short-range metropolitan networks.

Several comments on extensions and directions for future work are in order, beginning with the prospect of extending this security proof to include finite-size effects and comparison with the results in Refs. [15,16,42]. In particular, in the experiment in Ref. [42], the authors follow a similar program of applying entropic uncertainty relations, in this case to the smooth min-entropies, allowing them to account for all finite-size effects while providing proof against completely general attacks while implementing one of the protocols described here (protocol 1). With squeezing level of 10 dB, the key rate demonstrated was about 0.1 bit per sample at a distance of 2.7 km, while the range is about 1.6 km for our setup, or up to 6 km with comparable squeezing level (see Supplement 1). Nevertheless, this proof is only for DR homodyne protocols and limited to short distances (up to 5 km) even with extremely high levels of squeezing. Very recently, an extension to RR homodyne protocols for both the asymptotic and finite-size regimes, secure up to 15 km, has also appeared [16]. For a coherent state homodyne protocol like that discussed here, a finite-size proof has also been developed [57]. It seems very promising then, that these techniques could be adapted to prove the finite-size security of all the other protocols presented here. Nonetheless, our asymptotic analysis shows that, even in the most ideal situations, 1sDI-CV-QKD is presently limited to transmission through urban networks.

An obvious avenue for future work is the investigation of methods to improve long-distance performance. One option would be to revisit the restrictions, or lack thereof, made about the eavesdropper, including physical assumptions about the quantum memory available to Eve [58–60], which has already seen application in DI-DV-QKD [61]. Another candidate to further extend the range of these protocols would be the noiseless linear amplifier [62,63], which has already been proposed for application to fully DI-DV-QKD [64]. Even more appealing may be the measurement-based versions of these amplification schemes [65,66] that have recently been experimentally demonstrated [67], although this could be applied only to RR protocols. In light of these results, it appears that several 1sDI-CV-QKD protocols are within the reach of current technology, and multiple possibilities exist to extend the secure range of such schemes to long distances.