Dimension Reduction in Quantum Key Distribution for Continuous-and Discrete-Variable Protocols

,


I. INTRODUCTION
Quantum key distribution (QKD) [1,2] enables two remote parties, Alice and Bob, to establish informationtheoretically secure keys even in the presence of an eavesdropper, Eve.These keys can then be used in many other cryptographic applications, such as the one-time pad.To prove QKD to be secure with a specified key rate, we need to assume a quantum-mechanical model for Alice and Bob's devices, but do not have to assume anything about the processing power available to the eavesdropper [3].Reviews of QKD protocols can be found in [4][5][6].
For a given QKD protocol, the goal of a security proof is to find a lower bound on the secure key rate.Analytical methods for this task can be very involved, tend to be restricted to symmetric protocols, and can introduce looseness in the lower bounds.These issues are ameliorated by the recent development of tight, reliable numerical methods for finding secure key rates [7,8].At a high level, these methods determine the key rate by solving a particular convex optimization over the set of quantum states that could be held by Alice and Bob.Thus, when the bipartite Hilbert space is infinite-dimensional, the numerical methods cannot be used directly.Fortunately, for many discrete-variable (DV) protocols, the numerical methods can be applied by using the squashing map [9][10][11] or the more general flag-state squasher [12] to reduce the problem to finite dimensions.However, these squashing approaches do not seem applicable to continuous-variable (CV) protocols.Additionally, even for DV protocols, the flag-state squasher can have challenging runtimes [13].
Discrete-modulated continuous-variable QKD (DM-CVQKD) is a family of protocols that utilize existing telecommunication infrastructure, including homodyne or conjugate homodyne detection [14][15][16].They are thus promising candidates for deployment in large scale quantum-secured networks.In comparison to Gaussianmodulated CVQKD [17][18][19], discrete modulation is less demanding on the source modulator and on the errorcorrection protocols, yet is expected to achieve similar key rates.It is thus of interest to establish security proofs for DMCVQKD.Of particular interest is DM-CVQKD with four or more modulated states, which is expected to outperform protocols with a smaller constellation.While there are analytic asymptotic security proofs of DMCVQKD with two [20] or three [21] modulated states, they are difficult to generalize to more states.Recent works have numerically studied asymptotic security proofs for DMCVQKD with any number of modulated states [22,23].However, these approaches assume the state is finite-dimensional, known as the photon-number cutoff assumption.Thus, while these results seem numerically plausible, they do not constitute a rigorous asymptotic security proof, as the cutoff assumption cannot be justified.A full finite-key analysis of binary-modulated DMCVQKD has also been recently completed in [24].
The main contribution of this paper is a method to tightly lower bound the key rate of an infinitedimensional QKD protocol in terms of a finitedimensional convex optimization.In combination with existing numerical tools for solving finite-dimensional convex optimizations, this enables us to find tight, reliable key rates for general device-dependent QKD protocols in infinite-dimensional Hilbert spaces.Our dimension reduction method can also be applied to study other quantum information tasks, such as entanglement verification [25].
As a result, our method can provide a complete asymptotic security proof for discrete-modulated continuousvariable protocols with any number of modulated states, with tight key rates and without relying on the photonnumber cutoff assumption.While our focus in this work is on calculating asymptotic key rates, we expect key el-ements of our method to lift to a finite-key analysis.
Our dimension reduction method also provides an alternative approach to study protocols admitting a flagstate squasher.We consider unbalanced phase-encoded BB84 as an example, and show that our method can have an improved runtime compared to the flag-state squasher, while providing similar results.
The remainder of this paper is structured as follows.In Sec.II, we review the basic steps of a QKD protocol and how the key rate can be formulated as a convex optimization.In Sec.III, we develop our framework for dimension reduction, in more generality than is needed for QKD.In Sec.IV, we then specialize our general method to asymptotic key rate calculations.In Sec.V, we show how to implement the relevant optimizations numerically.In Sec.VI, we calculate key rates for DMCVQKD, including modelling postselection and trusted noise.In Sec.VII we compare our method to the flag-state squasher.Finally, we provide concluding remarks and avenues for future work in Sec.VIII.Certain technical details are relegated to the Appendices.

II. BACKGROUND: QKD PROTOCOLS AND SECURITY ANALYSIS
A. Generic QKD Protocol Steps We first review the basic steps of a generic QKD protocol.Alice and Bob have access to an uncharacterized quantum channel and an authenticated, public classical channel.By the source-replacement scheme [26][27][28][29], any prepare-and-measure (P&M) protocol can be equivalently viewed as an entanglement-based (EB) one.Thus, without loss of generality we consider entanglementbased protocols.
1. Alice and Bob establish a quantum state ρ AB .
2. Alice and Bob measure their subsystems with positive operator-valued measures (POVMs) {P i A } and {P j B }. To each outcome i, j, they associate two pieces of classical data: a public announcement a i , b j and a private measurement result α i , β j .The respective alphabets from which the values are drawn are S a , S b , S α , S β .We can think of the classical announcements as partitioning the data.
After repeating the previous two steps for a large number of rounds, Alice and Bob proceed to the classical phase.
3. Alice and Bob choose a random subset of the rounds to use for parameter estimation.For these testing rounds, they announce their public and private results.This allows them to determine the expectations γ i of some testing observables Γ i .
4. Alice and Bob announce their public data.Based on the joint announcements, they may decide to discard some rounds.This is represented by a binary function d : S a × S b → {0, 1}; where d = 0 if the signal is kept and d = 1 if discarded.
5. Based on the public announcements and their private data, one party performs the key map.When Alice (Bob) performs the key map, it is conventionally referred to as direct (reverse) reconciliation.In the following discussion, we consider the case where Bob performs the key map.For a k-ary key, the key map is a function g : The ⊥ symbol is only used to flag the discarded or sifted signals, so g(a, b, β) = ⊥ ⇐⇒ d(a, b) = 1.
6. Alice and Bob then perform error correction over the classical channel to get Alice's data to agree with the sifted key established by Bob.
7. Alice and Bob perform privacy amplification using a two-universal hash function to obtain the final shared secret key.
In practice, the discarded signals are simply removed before performing privacy amplification.We include them with the discard flag ⊥ only to formulate the protocol in a trace-preserving manner.This description of an EB protocol is general.When modelling the EB version of a P&M protocol, some steps can be made more specific.Suppose Alice prepares signal states |ψ i with probability p(i).In the sourcereplacement scheme, this is modelled as Alice preparing the state τ AA = ij p(i)p(j) |i j| A ⊗ |ψ i ψ j | A , sending system A to Bob, and measuring with the POVM {|i i| A }.As Eve cannot access Alice's lab, the reduced density matrix is known.Thus, for P&M protocols there is an additional constraint in parameter estimation, namely ρ A = τ A = ij p(i)p(j) ψ j |ψ i |i j|.Note that τ A is closely related to the Gram matrix of signal states.

B. Post-processing Channel
In order to evaluate the key rate, we formally define the post-processing steps as a quantum channel.We introduce registers Ã and B, which hold the public announcements, A and B, which hold the private measurement data, and Z, which holds the result of the key map.Without loss of generality, Eve has access to the register E purifying ρ AB and the public information.
Alice and Bob's measurement can be described by a channel Φ AB M that is simply given by Tr AB (Φ AB T ), where The action of the key map can be represented by the isometry The final state between all parties is then V Φ AB M (ρ ABE ) V † .We can pull the partial trace in the measurement channel Φ AB M through the isometry V .Then, the final classical-quantum state between the register holding the result of the key map and Eve is The channel Φ characterizes the post-processing steps and [E] denotes the composite register E Ã B. Note that discarded signals will not contribute to the key rate, as σ Z[E] is block-diagonal in the classical announcements.
To compute Φ, it is thus simpler and equivalent to not apply the POVM elements leading to discarded outcomes, rather than use a discard symbol [23].In this case, the postprocessing map is completely positive and trace nonincreasing.

C. Asymptotic Key Rate Formula
The secure key rate of a QKD protocol, in the asymptotic limit and assuming independent and identically distributed (IID) rounds (collective attack), is given by the Devetak-Winter formula [30].One can then aim to lift this to the key rate under coherent attacks, for example, using a quantum de Finetti theorem [31], and ultimately to a fully-composable security proof incorporating finitesize effects.Under collective attacks, for a given ρ AB , the asymptotic key rate is where I denotes the mutual information and χ denotes the Holevo information.The quantities are evaluated on the post-processed state after a single round, and X refers to the party who does not perform the key map.
In general, the state ρ AB is unknown.However, it is constrained by Alice and Bob through testing.The Devetak-Winter formula should be evaluated on the worst-case state compatible with these constraints.Determining the key rate of a protocol can then be reformulated as a convex optimization problem [7].The Devetak-Winter formula can be rearranged as, Only the first term needs to be optimized over.The second term is replaced by the actual error-correction cost δ leak EC which is the number of bits leaked per round.
For realistic error correction, δ leak EC will be larger than the Shannon limit H(Z|X).The key rate is thus where the objective function is the conditional entropy evaluated on the purified state after post-processing and the set S QKD is defined by the parameter estimation Alice and Bob perform, as well as the reduced density matrix constraint for P&M protocols [8].That is, As both the objective function and feasible set are convex [8], Eq. ( 8) is a convex optimization.
When the Hilbert space H AB is finite-dimensional, this problem can be reliably solved numerically [7,8].However, when the Hilbert space is infinite-dimensional, it is clearly not possible to directly solve this optimization numerically.We will develop a general method that, for all QKD protocols, allows us to compute tight lower bounds on the asymptotic key rate by relating the infinitedimensional optimization to a finite-dimensional one.We can then numerically solve the finite-dimensional problem using the methods of [8] to get tight lower bounds on the key rate for protocols where the state lives in an infinite-dimensional Hilbert space.

III. GENERAL FRAMEWORK
In this section, we develop a general method to lower bound infinite-dimensional optimizations of the sort seen in the previous section.In fact, we present our results in more generality than used for finding QKD key rates.Our general method may be applied to other quantum information scenarios, such as entanglement verification [25].
Our notational conventions are as follows.For a Hilbert space H, let D(H) ( D(H)) be the set of (sub)normalized density operators on H.
That is, D(H) = Pos (H) ∩ T 1 , where Pos (H) is the set of positive semidefinite operators on H, and T 1 is the set of trace-class operators with trace no greater than 1.We use tildes to denote operators that are subnormalized.

A. Problem Setup and Definitions
We begin with some definitions.Let H ∞ be a separable Hilbert space, which may be infinite-dimensional.Let S ∞ be a convex subset of D(H ∞ ).Finally, let f be a convex function from D(H ∞ ) to R. The infinite-dimensional optimization we will consider is min ρ∈S∞ f (ρ).(11) We assume that there exists a feasible operator ρ∞ achieving the optimum.This assumption holds in the practical case where the objective function f is continuous and S ∞ is compact.Our goal then is to find a lower bound on f (ρ ∞ ).Our strategy to do this is to relate the infinite-dimensional optimization to a suitably chosen finite-dimensional optimization, which can then be solved numerically.Note that in the process we choose certain mathematical objects freely; how to choose them effectively is the focus of the following sections.
Choose H N to be any finite-dimensional subspace of H ∞ .Π is defined as the projector onto this subspace, and Π ≡ 1 − Π. Choose S N to be a nonempty convex It is always possible to choose such a set S N , as Π D(H ∞ )Π ⊆ D(H N ).We can now define the finitedimensional optimization We assume there exists a feasible operator ρN achieving this optimum.Again, this assumption holds in the practical case when f is continuous and S N is compact.

B. Main Theorem
At a high level, our proof method is illustrated in Fig. 1.In order to relate the objective function f evaluated at the two optimal operators, ρ∞ and ρN , we introduce an auxiliary variable, ρΠ ≡ Πρ ∞ Π.This variable is the projection of the infinite-dimensional optimum ρ∞ onto the chosen finite subspace.We relate the optima to this auxiliary variable separately, and then to each other.For positive operators P and Q, our convention for the fidelity function is Inequality 1, Finite Set: We first relate f (ρ N ) and f (ρ Π ).By definition, ρΠ ∈ ΠS ∞ Π.By the containment property introduced in Eq. (12), it follows that ρΠ ∈ S N .Thus, ρΠ is feasible for the minimization in Eq. (13).Since ρN achieves the minimum, it follows that Inequality 2, Projection: We next relate f (ρ ∞ ) and f (ρ Π ).To do this, we introduce a property of f relating the fidelity of input states to changes in the function. ρ∞ where ∆ is a nonnegative, increasing function satisfying ∆(0) = 0.This property has some similarities to uniform-continuity with respect to trace distance.In fact, it is implied by the latter.However, because being UCDUP is a weaker condition, we may be able to find smaller ∆ than implied by a uniform-continuity bound (see Sec. IV C 1).In some cases, it may also be possible to set ∆ = 0.This is the case for bounding the QKD objective function when the key map POVM elements commute with Π (see Sec. IV C 2).It is also the case for some entanglement measures [25].
We can re-express the condition on W in a more useful way.By Winter's Gentle Measurement Lemma [32], which holds with equality when considering projections, the fidelity can be written as Rearranging, it follows that Thus, when f is UCDUP on S ∞ and Tr ρ∞ Π ≤ W , We now have all the pieces in place to prove our main theorem.
In order to apply this theorem, in addition to choosing H N and S N , we need to determine an expression for the correction term ∆ and a suitable value for W (see Sec. IV).For the latter quantity, as ρ∞ is unknown, we choose the smallest value of W satisfying We thus see that the determination of W itself involves an infinite-dimensional optimization.In practice, this optimization tends to be considerably easier to solve than the original one (Eq.( 11)).In particular, when S ∞ is the feasible set of a semidefinite program (SDP), known as a spectrahedron, then any solution to the dual problem provides an upper bound.For the QKD protocols we study, we can obtain tight values of W by analytically solving the dual or a relaxed version of the primal problem (see Sec. IV B).Note that W will not only be used to determine the correction term ∆(W ), but also to parametrize the set S N we choose (see Sec. IV D).

IV. APPLICATION OF FRAMEWORK TO QKD
Having developed a general method to lower-bound convex optimizations, we will now apply it to asymptotic QKD key rate optimizations.Our initial infinitedimensional optimization is as described in Sec.II C, so that H ∞ = H AB , f = f QKD , and S ∞ = S QKD .Unless otherwise stated, we will focus on the case where H A is finite-dimensional.In order to apply Theorem (1), we need four inputs: the subspace H N onto which Π projects, the bound on weight outside the subspace W , the correction term ∆, and the finite set S N .The first two of these depend on the specific QKD protocol, so we only give some general remarks on them in this section.The second two are generic for all protocols, so we derive them in detail.

A. Choose Subspace HN
This step is protocol-specific, and the choice of finite subspace H N can be made freely.However, for a fixed finite dimension, some subspaces will give a better lower bound than others.Intuitively, we want to choose a subspace which contains most of the weight of ρ∞ .Since this state is unknown, a good heuristic is to choose the subspace containing the most weight of the expected state under a representative channel model (see Sec. VI C 1).This is conceptually similar to assuming a particular channel for the purpose of designing a QKD protocol or error-correcting code.Another consideration is to choose the projection to commute with the objective function POVM elements (see Sec. IV C) or the constraint operators (see Sec. IV D).The choice of the dimension of the finite subspace will be influenced by the run time of the numerical method used to solve the finite-dimensional optimization.

B. Bound Weight W Outside Subspace
This step is also protocol-specific.Note that for S ∞ as given in Eq. ( 10), the bound on W shown in Eq. ( 20) is a semidefinite program.The range of approaches to calculate W is fairly wide, so in place of general strategies, we instead survey some examples.For DMCVQKD, we analytically find a solution to the dual SDP (see Sec. VI C 2).For unbalanced phase-encoded BB84, the monotonicity of cross-clicks or double-clicks with increasing photon number, along with Markov's inequality, is used to bound W [13].

C. Determine Correction Term ∆
Recall our objective function f is given in Eq. ( 9).We will show that it is UCDUP and determine the correction term ∆ as a function of W .We will find a general correction term which does not depend on the details of the postprocessing map (see Eq. ( 4)) and is thus applicable to all protocols.We will also show that when the postprocessing map satisfies a certain property, which holds for some protocols, we can omit the correction term entirely, i.e. ∆ = 0.

General Case
In this case, we do not make any assumptions about the post-processing channel Φ in Eq. ( 4), other than the fact that it is indeed a channel.The crux of the proof is in the following lemma.

Lemma 1. Let H A and H B be two Hilbert spaces, where the dimension of H
) where h(x) is the binary entropy function.
Proof.This result is a generalization of Lemma 2 in [33], which was derived for normalized states.The proof of the extension to subnormalized states is given in Appendix A.
With this lemma in hand, we will prove that f is UCDUP on D(H ∞ ) in the following theorem.Note this is sufficient as for any QKD protocol, where |Z| is the dimension of the key map register.
Proof.As per the definition of UCDUP, let Let σ ABE and σΠ ABE be purifications of σ AB and Πσ AB Π respectively (we consider a purification of an unnormalized state to not change the trace).By Uhlmann's theorem [34], we can choose the purifications to satisfy By the monotonicity of fidelity under channels, we have where . The Fuchs-van de Graaf inequalities [35], which are valid in infinite dimensions and for subnormalized states, relate fidelity and trace distance as follows, 1 . Thus, we can apply Lemma 1 to obtain This is precisely the condition we require for f to be UCDUP, so we identify the right-hand side as ∆(W ).
For a key map with k outcomes, the dimension of the key map register is k.For the purpose of this argument, the discard symbol ⊥ does not count towards a key outcome.The reason for this is that instead of ⊥, one could use any pre-existing key symbol to flag discarded signals.
Since the classical-quantum state σ Z[E] between the key map register and Eve is block-diagonal in the classical announcements (Eq.( 4)), Eve could identify the discarded signals from those public announcements alone.This would leave the value of the objective function unchanged.Indeed, the ⊥ symbol is only used for clarity in our presentation.

Special Case: Block-Diagonal Measurements
If the key map POVM elements are block-diagonal with respect to Π and Π, the correction term is zero.Theorem 3. Let Φ be defined by the POVMs {P i A } and {P j B } and a key map isometry V .If all POVM elements are block-diagonal, so that [P i A ⊗ P j B , Π] = 0 ∀i, j, then Proof.Recall that Π only acts on the AB subsystem.Then, Πρ ABE Π is a purification of Πρ AB Π. Π commutes with V as they act on different subsystems, and commutes with all elements of the POVMs {P i A } and {P j B } by assumption.By the definition of Φ AB T (Eq.( 1)), it then follows that and analogously for Π.Defining the channel Ξ AB (ρ) = ΠρΠ + Πρ Π, we have where we have in Eq. ( 33) freely introduced a channel as it will be traced out, in Eq. ( 35) used the concavity of conditional entropy, and in Eq. ( 36) used the nonnegativity of conditional entropy for classical-quantum states (see Eq. ( 4)).

D. Choose Finite Set SN
Recall that the feasible set S ∞ for the infinitedimensional optimization is given in Eq. (10).The form of this set is common to all protocols.We consider one particular way of choosing S N which is to individually expand the constraints of S ∞ , using W as a parameter.Note that in order to have the highest key rates, we want S N to be as small as possible, while still satisfying the containment in Eq. (12).Assuming σ ∈ S ∞ , we will now list constraints that σΠ ≡ ΠσΠ must satisfy.
We next consider the expectation constraints, Tr(σΓ i ) = γ i .We choose to define the loosened con-straints as , where For concreteness, we now specialize our discussion to the case where [Π, Γ i ] = 0 and Γ i ≥ 0 ∀i.This condition is satisfied for all the protocols we study in this article.We emphasize that this is not a particularly strong assumption.With a judicious choice of Π, this condition can be achieved for many protocols.In the alternate, determining the bounds in Eqs.(38) and (39) without this assumption is also tractable.For example, tight bounds are derived even for non-commuting, non-positive, and unbounded observables Γ i in [25].
In the following theorem, we derive the desired bounds on expectations in the finite subspace.
Proof.By the commutation relation, it follows that We now find the upper and lower bounds separately.
For the upper bound, we simply note that the trace of a positive operator can only decrease under projection.Then, For the lower bound, recall Hölder's inequality, which states that for any two operators A and B, Tr A † B ≤ A p B q , where 1 p + 1 q = 1 so that • p and • q are dual Schatten norms.Then, where in Eq. ( 46) we used Hölder's inequality.Note that this lower bound is trivial for unbounded observables.
Finally we consider the reduced state constraint Tr B (σ) = τ A .We could, using a complete Hermitian basis on system A, write the reduced state constraint as a set of expectations and expand it in the same manner as above.However, there are two better ways to perform the expansion.One approach works in general, while the other is tighter but only works in a specific case.In general, by the Fuchs-van de Graaf inequalities, . By the monotonicity of trace distance under channels, and by the fact that taking the partial trace is a channel, this implies the constraint 1  2 Alternatively, in the case where the projection has the form Π = Π A ⊗ Π B , a simple positivity argument implies the constraint Tr B (σ Π ) ≤ Π A τ A Π A .This constraint can be used even when H A is infinite-dimensional.
Having expanded all the constraints in the case where the observables are positive operators and commute with the projection, we summarize the definitions of the original infinite-dimensional optimization: minimize: and the expanded finite-dimensional optimization: minimize: When Π = Π A ⊗ Π B , the constraint on the reduced density matrix is instead Tr B (ρ The tightness of the feasible set is guaranteed by the fact that for W = 0, S N = S ∞ .For nonzero W , our numerical results in Sec.VII provide strong evidence that our definition of S N is close to the optimal choice ΠS ∞ Π.

V. NUMERICAL IMPLEMENTATION A. Review of Reliable Numerical Method
Having formulated the finite-dimensional optimization of interest, we now wish to solve it numerically.In order to obtain a reliable lower bound in spite of floating-point imprecision and the imperfection of convex solvers, we use the numerical framework developed in [8].We briefly summarize the two steps of the method here.
The first step is to approximately solve the optimization as written, using a method such as the Frank-Wolfe algorithm.This returns an approximate minimum, ρ opt .The gradient of the objective function at this point ∇f (ρ opt ) is computed.In the second step an expanded, linearized SDP is constructed from the first step optimization.To linearize, the objective function is replaced with Tr[ρ∇f (ρ opt )].Intuitively, this represents lower bounding the original convex function f by a tangent hyperplane.To expand, the feasible set is enlarged by a small amount to account for numerical imprecision.Finally, the dual of this expanded, linearized SDP is derived.This dual SDP is solved numerically and any feasible point is a reliable lower bound on the original convex minimization.As discussed in Appendix C, we make use of one small improvement in how we expand the set in the second step, to account for numerical imprecisions, compared to [8].This change is important because it allows us to improve our numerical results at long distances (see Sec. VI E).
Note that the constraint operators Γ i and the POVM elements P k defining f are, in general, infinite-dimensional.
However, as Tr(ΠρΠ X) = Tr[(ΠρΠ)(ΠXΠ)], we can equivalently set Γ i → ΠΓ i Π and P k → ΠP k Π.In the following discussion, we tacitly assume this substitution has been made in order to represent the optimizations numerically.

B. SDP Formulation for Numerics
To apply the numerical framework, we need the feasible set of the convex minimization to be that of an SDP.To show that S N is such a set, we rewrite the trace distance constraint for the reduced density matrix.The trace norm can be expressed as an SDP [36], which allows us to rewrite the constraint using slack variables.This equivalent reformulation of the finite-dimensional optimization is given by: minimize: Let ξ denote the adjoint of the partial trace map Tr B restricted to operators on H N .Following the numerical framework, the corresponding dual linearized SDP is: maximize: ), and rep and rep are the expansion parameters which account for finite numerical precision (see Appendix C for further discussion).
As noted in Sec.IV D, the finite-dimensional optimization has a slightly different form when the projection only acts on Bob's system, that is Π = 1 A ⊗ Π B .In this case, the dual SDP is the same as above, but the term in the objective function and both constraints involving y s are removed, Y 2 is set to zero, and the term − rep Tr(Y 1 ) is added to the objective function.

VI. DISCRETE-MODULATED CVQKD
We apply our approach for infinite-dimensional key rate calculations to DMCVQKD.We begin by reviewing the protocol and setting up the infinite-dimensional optimization.We then apply the steps of our method from Sec. IV to relate the key rate to a finite-dimensional optimization.Finally, we solve this finite problem numerically to obtain key rates.Unless otherwise stated, all discussion is in the ideal detector scenario.We note that although continuity bounds have been considered in the context of DMCVQKD in [37], this is very different from our work, as the bounds in [37] are used to quantify how well Gaussian modulation is approximated.

A. Protocol Description
We briefly review the DMCVQKD protocol.More details can be found in [23].In each round of the quantum phase, Alice prepares one of d coherent signal states {|α i } d−1 i=0 with probability p(i).Our security proof works for any constellation of signal states, but we focus on the protocol with four symmetrically modulated states, also known as quadrature phase-shift keying.In this case, Alice prepares the states {|α , |iα , |−α , |−iα } uniformly at random, for a fixed signal state amplitude α. Bob then performs either a homodyne or heterodyne measurement.We focus on the case where he does a heterodyne measurement.Bob's POVM is then { 1 π |ζ ζ|} ζ∈C , while We focus on reverse reconciliation as it is known to outperform direct reconciliation in terms of transmission distance.Again, our security proof can be easily adapted to direct reconciliation.In reverse reconciliation, Bob maps his heterodyne measurement outcome ζ to a key symbol based on which region in the complex plane, or phase space, the outcome falls in.The key map is visualized in Fig. 2. Bob can also perform postselection (sifting) to improve the key rate of the protocol [16].
After a large number of rounds, Alice and Bob move on to the classical phase.For parameter estimation, Alice announces which signal state was sent.Since Bob's measurement determines the Husimi Q-function, he could in principle perform complete tomography to uniquely determine the received conditional states.This would not extend reasonably to a finite-key analysis.We thus choose to only use certain coarse-grained observables as constraints.(It is then unnecessary for Bob to announce his fine-grained measurement results, he only needs to announce these coarse-grained expectations.)In Appendix E, we outline how to calculate the coarse-grained expectations from the fine-grained probability distribution.For reverse reconciliation with postselection, Bob also announces which signals are discarded.Finally, Alice and Bob perform error correction and privacy amplification on the sifted key.

B. Infinite-Dimensional Optimization
To formalize this description of the protocol, we define the objective function f and the observables Γ i .

Objective Function
Recall the definition of the postprocessing map in Eq. ( 4).Outside of the testing rounds, the only announcements in this protocol are for sifting.Since Bob defines the key map and makes the sifting decision, this means that Alice's data is irrelevant for the postprocessing map.Thus, for the purpose of the postprocessing map, we can take Alice's POVM to trivially be {1 A }.For Bob's POVM, we do not need to work with the finegrained set and can instead deal directly with the coarsegrained region operators.These region operators can be expressed as linear combinations of the fine-grained POVM elements.The region operators corresponding to non-discarded signals are for j ∈ {0, 1, 2, 3}.Here ∆ a and ∆ p are postselection parameters for the amplitude and phase.Not performing postselection corresponds to setting ∆ a , ∆ p = 0.The key map g trivially maps Bob's private measurement result to the key register.Thus, we can omit the key map isometry altogether, and simply relabel the register B to Z.The simplified completely positive and trace non-increasing form of the postprocessing map Φ in Eq. ( 4) is then where we have omitted trivial or redundant registers [23].

Observables
Alice and Bob's POVMs are as given above.As discussed, we need to choose a set of coarse-grained observables for Bob's side of parameter estimation.Typically, these observables are taken to be the quadratures and their higher moments [23].However, we introduce a different set of observables which will simplify our development, as they will commute with the projection we later define (Eq.( 58)).They will be parametrized by a list of complex numbers {β i } d−1 i=0 .For any operator X, we use the shorthand notation X γ ≡ D (γ) X D † (γ) where D (γ) is the displacement operator with complex parameter γ.
Denoting the photon number operator by n ≡ â † â, we choose as constraint observables for our protocol the set We consider second order constraints in n as this will be necessary to make the weight W outside the subspace sufficiently small.We choose the displacements to be which are the amplitudes of the coherent signal states after passing through a Gaussian channel with loss η.As will be discussed in Sec.VI E, our choice here is based on the expected channel behavior in an honest implementation of the protocol.We emphasize however that our security proof method works for any choice of {β i }.This choice of coarse-grained observables is of interest as it elucidates some of the essential working principles of the DMCVQKD protocol.The observables measure how spread out a state is compared to the coherent state |β i .Intuitively, this characterizes the deviation from a generalized beamsplitting attack [38].These constraints also dovetail with a natural choice for the finite subspace.
Note that although Bob's observables have a dependence on the signal state, Bob physically performs the same heterodyne measurement each round.For parameter estimation, he simply holds all fine-grained data and coarse grains only after Alice announces which signal state was sent.

Optimization Formulation
We are now able to write down the infinite-dimensional optimization for DMCVQKD.Let H A be the Hilbert space with dimension equal to the number of signal states d.Let H B be the Hilbert space of a single optical mode, spanned by Fock states {|n } ∞ n=0 .The minimization is then: minimize:

C. Finite-Dimensional Optimization and Correction Term
We apply the steps of our method to convert the preceding infinite-dimensional optimization into a tractable finite-dimensional one, and determine the associated correction term.

Choose Subspace HN
Recall our general principle is to choose the subspace containing the most weight of the state under a typical channel model.As discussed in Sec.VI E, the channel model for a fiber-based implementation of this protocol is a lossy and noisy Gaussian channel.As noted above, for a pure-loss channel the expected coherent state is |0 βi , where |n γ ≡ D (γ) |n .For the specific noise model we consider, the expected state will be a displaced thermal state.This means some weight leaks into displaced Fock states with n > 0. For the i th signal state, the best projection on H B is thus We will refer to N as the subspace dimension parameter.
The projection operator on the total Hilbert space is Note that this projection commutes with the observables (Eq.( 54)) because Π N B β i commutes with nβi .We use this fact to define the finite set(see Sec.VI C 4).
Unlike the truncated Fock basis considered in previous work [22,23], our finite subspace contains the full weight of the state when the channel is purely lossy.This is important as it ensures our numerics exactly reproduces the analytically solvable loss-only case.

Bound Weight W Outside Subspace
To bound the weight outside the subspace, we analytically solve the dual of the SDP in Eq. (20).Our result is stated in the following theorem.
Theorem 5 (Bound on W for DMCVQKD).For the DMCVQKD protocol, with Π N as defined in Eq. (58), the weight outside the subspace is bounded by Proof.To prove this theorem, we will consider Bob's conditional states be the weight of the i th conditional state.We first show that Tr ρi Now, we only need to bound the weight of each conditional state.Using the constraints from Eq. ( 56), each of these bounds can be expressed as a primal SDP. maximize: In order to find an upper bound on this primal SDP we consider its dual.By weak duality, it holds that a feasible solution to the dual SDP upper bounds the primal.
In fact, strong duality holds for this SDP, so this upper bound can be made tight. minimize: A feasible solution for the dual is ) .(This is in fact the optimal solution.)This can be easily verified as all operators in the constraint are diagonal in the |n βi basis, so positivity is implied if and only if the diagonal entries are nonnegative.This solution leads to the objective value Substituting into Eq.( 62), the proof is complete.

Determine Correction Term ∆
The correction term, as a function of the weight W and key map register dimension |Z|, is given in Theorem 2. We use the value of W determined in Sec.VI C 2. Regardless of whether postselection is performed, |Z| = 4 as there are four non-discarded key outcomes (see Sec. IV C.

Choose Finite Set SN
By design, the projection Π N (Eq.( 58)) commutes with the positive observables Γ i (Eq.( 54)).We can thus use the form of S N in Eq. ( 49).The finite-dimensional optimization is: minimize: where ) .Note that the lower bounds in Eq. ( 49) are not useful as the observables Γ i are unbounded.
In order to implement the optimization numerically, we need to choose a basis in which to represent our operators.The natural choice is {|i A ⊗ |n βi B }.We compute the matrix elements of the observables and the objective function POVM in this basis in Appendix B. As this basis is not a standard construction for a bipartite Hilbert space, calculating the partial trace and its adjoint is slightly involved.We present these technical details in Appendix B.

D. DMCVQKD with Trusted Detector Noise
In the previous section, we have given a security proof for DMCVQKD assuming Bob's detector is ideal.We can extend this result to the scenario where Bob has imperfect but characterized detectors.We consider the specific model for detector imperfections given in [39].Namely, the two homodyne detectors comprising the heterodyne measurement have an associated efficiency and electronic noise.To illustrate our approach, we focus on the case where the two detectors have the same efficiency η d and electronic noise ν el .In this case, Bob's POVM elements are displaced thermal states, as opposed to coherent states [39].
The protocol description is exactly the same as for the ideal detector case, except Bob's heterodyne detection is noisy.This noisy POVM enters into the optimization in two ways: changing the objective function f and the observables Γ i .To evaluate the objective function defined by a noisy POVM f noisy , we need only calculate the new matrix elements.This calculation is presented in Appendix D. Critically, due to our coarse-graining, there is a simple relation between the noisy and ideal observables.Thus, our results on the bound of W carry over from the ideal detector scenario.For any operator A, we denote its noisy counterpart by [A] .As shown in Appendix D, the ideal and noisy observables are related by linear combinations, Bob measures the observables displaced by √ η d β i .With these noisy expectations, the ideal ones can effectively be recreated by inverting the relationships in Eqs. ( 66), (67).Explicitly, The finite-dimensional optimization is then: minimize: where τ A = ij p(i)p(j) α j |α i |i j| and W = i p(i) .

Simulation Parameters
To understand the performance of this protocol and demonstrate our security proof approach, we simulate expectation values obtained from a typical experiment.In particular, we model the signal states as passing through a noisy and lossy Gaussian channel.The transmittance η is modelled as a function of distance d according to η = 10 −k•d/10 , where k is the attenuation factor of the channel.We use a typical value for commerical-grade fiber k = 0.2 dB/km.The excess noise ξ is taken to be fixed at the channel input, for example as preparation noise, so that Bob sees the effective noise δ = ηξ.The expectation values for this simulation are nβi = δ/2 and n2 βi = δ(1 + δ)/2, as derived in Appendix E. This implies W = δ 2 /[2N (N + 1)].We emphasize that our security proof does not depend on these parameter choices and simulation model, which are only used to illustrate the performance of the protocol in a typical implementation.
To account for realistic error-correction costs, δ leak EC in Eq. ( 8) is taken to be H(Z) − β EC I(Z : X), where β EC characterizes the error-correction efficiency.We use β EC = 0.95 as a representative value.The errorcorrection cost is calculated by simulating the joint probability distribution obtained by Alice and Bob (see Appendix E).
All our algorithms are implemented in Matlab R2019B, using the convex optimization package CVX 2.1 [40,41] with the Mosek 8.0.0.60 solver [42].The Frank-Wolfe algorithm, with a maximum of 30 iterations, is used to solve the first step of the numerical method.All parameter optimizations use the fminbnd algorithm included in the Matlab distribution, which uses a combination of parabolic interpolation and golden-section search.
We emphasize that all key rate plots include the correction term unless stated otherwise.That is, R ∞ = C num − δ leak EC − ∆(W ), where C num denotes the reliable numerical lower bound on f (ρ N ).In order to evaluate the effect of the correction term, and to compare with previous work using the photon number cutoff assumption, we will find it useful to consider the uncorrected values, defined as C num − δ leak EC .

Key Rate Plots
We present key rate plots for different choices of channel parameters η and ξ, protocol parameters α, ∆ a , and ∆ p , and the subspace dimension parameter N .For the trusted noise scenario, we also consider η d and ν el .
In Fig. 3, we compare the key rates and uncorrected values from our dimension reduction method to the key rates under the photon number cutoff assumption obtained in [23].In order to enable a meaningful comparison, we use the protocol parameters from [23].The uncorrected values, which are equal to the key rate before subtracting the correction term ∆, are essentially identical to those in [23].As the results from [23] are an upper bound on the key rate, this indicates our choice of S N is tight.Further, our corrected key rates are very close to the uncorrected values.This illustrates our correction term is small for reasonable values of the subspace dimension parameter N , at low channel excess noise (see Fig. 5).
As our key rates are very similar to the ones under the cutoff assumption, the qualitative conclusions of previous work [23,39] are confirmed to hold under our precise treatment, without the previous working assumptions.We thus defer to [23,39] for more extensive parameter exploration, and only focus on some important results in this section.
In Fig. 4, we plot the ideal detector key rates for different channel parameters.The signal state intensity and postselection parameters are numerically optimized for FIG.3: Comparison of key rates and uncorrected values from our dimension reduction method with key rates under the photon number cutoff assumption from [23].Results are plotted versus distance with excess noise ξ = 0.01, and are in the ideal detector scenario.Postselection parameters and signal state intensities from [23] are used: α = 0.6, ∆ p = 0, and ∆ a is optimized with a coarse-grained search over [0.5, 0.65].The subspace dimension parameter is N = 20.each distance and value of excess noise, using N = 10.The key rates are calculated using N = 40, except for a small number of points where we use N = 30 to ameliorate numerics issues, as discussed in Appendix C. Using postselection extends the range of the protocol for high excess noise while also reducing the amount of data processing for error correction, which can be a bottleneck in actual implementations.For example, for 2% excess noise, postselection increases the maximum distance by around 50 km, while discarding 40% of the signals.The small number of outlying points that deviate from the trend are due to numerical issues inherent to convex solvers.We emphasize that these key rates are still rigorous, and can be improved by using higher numerical precision.
To illustrate the relative size of the correction term, we plot it as a fraction of the uncorrected value in Fig. 5, at a fixed distance of 15 km.More precisely, for each value of excess noise ξ and subspace dimension parameter N , we plot the fractional correction term ∆(W )/C num , where W = (ηξ) 2 /[2N (N + 1)], while C num is computed at a fixed value of N = 40 for each ξ.(In the range considered here, C num has a negligible dependence on N .)The protocol parameters are the same as in Fig. 4. We see that for a pure-loss channel, the correction term is zero since our subspace fully contains the simulation state, as discussed in Sec.VI C 1.For small values of excess noise, the correction term is negligible even for small N .For larger values of excess noise, and especially in the high loss regime, N must be increased to obtain reasonable results.This is because the correction term scales like the loss η for all values of excess noise ξ, while, for nonzero ξ, the key rate scales worse than η.It is an interesting avenue for future research to determine if a smaller correction term can be found.
The optimal signal state amplitudes α opt are shown in Fig. 6.The optimization range [0.5, 2] is sufficient for almost all parameter choices, though α opt tends to infinity as distance and excess noise tend to zero.The general trend is that α opt decreases as distance and excess noise increase.With α opt fixed, ∆ a is optimized over ters, but we do not expect this to noticeably improve the key rates.)We find that the optimal value for ∆ p seems to always be zero, so phase postselection is omitted altogether.Thus, while the postselection pattern used here is a simple and intuitive one, it is an interesting future research topic to investigate other postselection patterns.In Fig. 7, we consider the key rates in the trusted detector noise scenario.We take the channel to have 1% excess noise, and consider different values of detector efficiency and electronic noise.The protocol parameters are optimized for the ideal detector scenario, and the same parameters are used for each of the different trusted noise cases.We observe that even with large detector imperfections and 1% channel excess noise, it is possible to generate secure key at 200 km.As expected, trusted detector noise does not significantly alter the scaling of the key rates.This is markedly different from the effect of channel excess noise (see Fig. 4).
Discrete-modulated (DM) CVQKD is intended to be a more experimentally feasible alternative to Gaussianmodulated (GM) CVQKD [19,43].It is thus of interest to compare the performance of the two protocols.We perform a very basic comparison in Fig. 8, using the same error-correction efficiency β EC = 0.95, detector loss η d = 0.6, and electronic noise ν el = 0.05.The signal variance is optimized for GM, while the optimized protocol parameters for DM are the same as in Fig. 7.We note that a complete and in-depth comparison of the two protocols would have to account for many more implementation details.For a pure-loss channel, the GM key rates are around an order of magnitude higher.At higher excess noise, the gap is larger as GM is more robust to channel noise.However, both protocols are largely unaffected by trusted detector imperfections.At ξ = 0.01, a typical value for channel excess noise, the key rates scale similarly.Further, we expect the tolerance of DM to channel noise can be improved by using a larger constellation of signal states.

VII. COMPARISON TO FLAG-STATE SQUASHER
Our dimension reduction (DR) approach encompasses another method known as the flag-state squasher (FSS) [12].The FSS also obtains lower bounds on the key rate by solving a finite-dimensional optimization.However, the FSS is restricted to protocols where both the key map POVM elements and constraint observables commute with the projection.Notably, this is not the case for DMCVQKD.In this section, we compare our method to the FSS both analytically and numerically.This demonstrates the advantages of our method and offers further insight into the FSS approach.

A. Analytical Comparison
We briefly summarize the FSS, deferring a complete description to [12].As usual, Alice's POVM is given by {|j j| A }, while Bob's POVM is {Γ i B }.The corresponding probabilities are {γ ij }.The FSS also requires choosing a projection Π = 1 A ⊗ Π B onto a finite subspace and upper-bounding the weight W outside that subspace.It is assumed that [Γ i B , Π B ] = 0. Define a flag Hilbert space H F , with dimension equal to the number of elements in Bob's POVM.The finitedimensional optimization is over density matrices in H N ⊕H F .Bob's new POVM is Γi = Π Γ i Π⊕|i i| F .Alice's POVM and the expectation values are unchanged.The objective function is f F SS (ρ N ⊕ σF ) = f (ρ N ), i.e. it simply discards the flag portion and evaluates the usual key rate function on the remaining portion.This completes the formulation of the finite-dimensional optimization for the FSS.
The squashing map Λ B is a channel from Note that ρ ∞ is feasible for the original infinite-dimensional optimization if and only if Λ(ρ ∞ ) is feasible for the finite-dimensional one.In this sense, we can think of the flag-state squasher as implicitly solving over the tightest possible choice of S N , namely ΠS ∞ Π.
As a special case, our method can be applied to any protocol admitting a flag-state squasher.The FSS requires choosing a projection Π and getting a bound on weight W , which establishes the first two steps of our method.Since the key map POVM elements commute with the projection, we can set ∆ = 0 (Theorem 3).All observables are POVM elements, so we can use the explicit form of S N in Eq. ( 49).This establishes the last two steps of our method.We can now compare both approaches in the following theorem.Theorem 6.For a fixed projection Π and weight W , our dimension reduction (DR) method gives the same key rate as the flag-state squasher (FSS) when S N = ΠS ∞ Π.
Proof.Let Λ(ρ ∞ ) = ρN ⊕ σF be a state reaching the minimum in the FSS optimization.By definition, f F SS (ρ N ⊕ σF ) = f DR (ρ N ).By the definition of Λ, ρN = Πρ ∞ Π.Thus, ρN ∈ S N , so is feasible for the dimension reduction optimization.Since this optimization is a minimization, R ∞ F SS ≥ R ∞ DR .Conversely, let ρN be a subnormalized state reaching the minimum in the dimension reduction optimization.
By the definition of S N , ρN = Πρ ∞ Π for some state ρ ∞ ∈ S ∞ .By definition, f DR (ρ N ) = f F SS (Λ(ρ ∞ )).By the property of the squashing map, Λ(ρ ∞ ) is feasible for the FSS optimization.Since the FSS optimization is a minimization If S N is not chosen optimally, then our dimension reduction method gives a lower key rate.In practice, our explicit prescription for choosing S N in Eq. (49) gives very similar key rates to the flag state squasher (see Sec. VII B), suggesting this choice is essentially optimal.
In addition to being more general, our method has an important advantage compared to the flag-state squasher.Our finite-dimensional optimization is over a smaller Hilbert space, since we do not require flag-state dimensions.Therefore, if we compare fixed total dimension, which roughly determines the runtime, our method can give higher key rates than the flag-state squasher.Some protocols can have a very large number of POVM constraints.For the flag-state squasher, using all the constraints would make the runtime prohibitive, as the dimension of the problem depends on the number of constraints.Thus, a smaller set of coarse-grained POVM elements is typically used.Our dimension reduction method is not limited by the number of constraints and can thus handle the fine-grained POVM directly, potentially giving better key rates.

B. Numerical Comparison: Unbalanced
Phase-Encoded BB84 Having provided an analytical comparison between our method and the flag-state squasher, we now perform a sample numerical comparison of the two methods.We will consider the unbalanced phase-encoded BB84 protocol, to which the flag state squasher has recently been applied [13].We defer a complete description of the protocol to [13].Briefly, this is a phase-encoded BB84 protocol where Alice and Bob's interferometers each have a loss 1 − κ only in the arm with the phase modulator; hence the term unbalanced.The projection is Π where |n 1 , n 2 are twomode Fock basis states.The weight W is bounded using the fact that the frequency of cross-clicks increases with photon number [13].
In Fig. 9 we compare the key rates from our method and the flag-state squasher, for a channel with transmittance η and for different interferometer asymmetric transmittance κ.All parameters are the same as in Figure 3(a) of [13], and the signal state intensity is optimized separately for each method and parameter choice.We see that our method gives essentially identical key rates.In conjunction with Theorem 6, this provides strong numerical evidence that our heuristic choice of S N in Eq. ( 49) is tight.While a more thorough benchmarking would be in order, we remark that for generating the data in Fig. 9, our method was approximately five times faster than the key rates from our dimension reduction method are nearly identical to those from the flag-state squasher, indicating the tightness of our method in practice.In generating the data for this graph, our dimension reduction method was approximately five times faster than the flag-state squasher as implemented in [13].

VIII. CONCLUSION
In summary, we establish a framework to lower bound a large dimensional convex optimization using a judiciously chosen smaller dimensional one.We show how this framework can be used to reduce the dimension of QKD key rate calculations.This allows existing numerical tools for finite-dimensional key rate calculations to be applied to protocols in infinite-dimensional Hilbert spaces.This allows us to do more detailed modelling of imperfections in devices.An important application of our method is to prove the asymptotic security of DMCVQKD with an arbitrary number of modulated states.As a concrete example, we apply this method to the quadrature phase-shift keying scheme in both ideal and trusted detector noise scenarios.We show that discrete modulation key rates can scale similarly to Gaussian modulation.Moreover, we rigorously demonstrate that postselection of data can improve the key rates for DMCVQKD.Using unbalanced phase-encoded BB84 as an example, we show that our approach can achieve key rates nearly identical to those from the flag-state squasher, while having an improved runtime.Some directions for future work are as follows.One may be able to make the correction term for the QKD objective function smaller by using the commutation relations of the POVM elements and the projection.Qualitatively, this would interpolate between the two cases we considered.There may also be tighter ways to construct the finite set.This could involve using additional properties of the constraint operators in specific cases.For DMCVQKD in particular, one may consider the effects of using more modulated states and different postselection regions in order to increase the key rate.Given the recent development of a finite-key numerical framework [46], we hope to extend our dimension reduction method to finitekey analysis of protocols in infinite-dimensional Hilbert spaces.We expect that key elements of the method, including bounding the weight outside the subspace and expanding the feasible set, will lift to the finite-key analysis.
upper bounds the second step, this implies a poor second step result.One way to ameliorate this is to solve with a smaller N so that the solver returns a better first step solution.Thus, purely due to numerical precision issues, solving with N = 30 instead of N = 40 can improve the key rate at long distances.Even though the correction term ∆(W ) is slightly larger, this is more than offset by the improved quality of the first step solution.This suggests that due to numerical issues, one should choose the finite dimension carefully, even though analytically a larger dimension is always better.
The reason the first step upper bounds the second step is due to the expansion of the feasible set.Referring to the notation in Appendix D of [8], the large constraint violations lead to a large value of , which controls how much the set is expanded for the second step.However, the choice = max( rep , sol ) (Equation (165) of [8]) is pessimistic.One only needs to choose = rep .As noted in Equation (162) of [8], this is sufficient to provide a reliable lower bound when accounting for finite numerical precision.Further, note that f (ρ) is lower bounded by a tangent hyperplane at any point in its domain.Thus, it is not necessary to expand the feasible set further to include the point returned by the first step.This change gives improved results in practice, while still being reliable and tight.
In previous work using the numerical framework in [8], it has been assumed that rep ≤ sol .Hence the issue of how to suitably choose rep has not been considered.As noted in [8], rigorously determining rep for a particular implementation can be an involved process.For our Matlab implementation, which has precision better than 10 −15 , we conservatively use 10 −10 for rep and all elements of rep .Finally note that in our numerical evaluation of the unbalanced phase-encoded BB84 protocol, we continue to use the original, larger set expansion as in [8].This is to ensure a fair comparison to the flag-state squasher numerical results.

Appendix D: Trusted Detector Noise Operators
We determine expressions for the relevant operators in the trusted detector noise scenario, focusing on the case where both homodyne detectors in the overall heterodyne setup have the same efficiency η d and electronic noise ν el .The only change in the protocol for the trusted noise scenario is Bob's POVM.The changed POVM enters the optimization in two different ways: through Bob's new observables in the constraints and new region operators in the objective function definition.
Recall Bob's POVM in the ideal case is a projection onto coherent states { 1 π |ζ ζ|} ζ∈C .In the trusted noise scenario, it is instead a projection onto scaled and displaced thermal states .We will simplify our notation by omitting the dependence of ρ th on n.We denote the POVM elements by G ζ .Recall our notation [•] for the noisy version of an operator.From [39], if an operator in the ideal detector model is defined as then its noisy counterpart is  We use the expression in Equation (B1) in [39] for the matrix elements of the displaced thermal operator in the Fock basis, convert to polar coordinates, and compute the integral in Matlab.

Observables
To express the observables in the form of Eq. (D1), we write them in antinormal ordering, and replace the ladder We can now calculate the noisy observables using Eq.(D2).We make use of the following identity,

FIG. 2 :
FIG. 2: Phase-space regions for the key map, with postselection, for reverse reconciliation in QPSK DMCVQKD.Bob obtains the measurement result ζ from the heterodyne detector.He maps the outcome to the symbol of the region containing ζ. ∆ a and ∆ p are amplitude and phase postselection parameters, respectively.The ⊥ region corresponds to signals that are discarded.

FIG. 4 :FIG. 5 :
FIG. 4: Ideal detector secure key rates versus transmission distance, for different values of excess noise ξ, with optimized postselection parameters and signal state intensity.For each point, the better of the two results from N = 30 and N = 40 is used, with the majority of points from N = 40.Postselection can improve the noise tolerance and range of the protocol.

FIG. 6 :
FIG. 6: Optimal signal state amplitude α opt versus transmission distance, for different values of excess noise ξ and in the ideal detector scenario.The amplitude is optimized in the range [0.5, 2], with ∆ a = ∆ p = 0 and N = 10.
photon number of the thermal state is n = 1−η d +ν el η d