Long-distance continuous-variable measurement-device-independent quantum key distribution with postselection

We introduce a robust scheme for long-distance continuous-variable (CV) measurement-device-independent (MDI) quantum key distribution in which we employ postselection between distant parties communicating through the medium of an untrusted relay. We perform a security analysis that allows for general transmissivity and thermal noise variance of each link, in which we assume that an eavesdropper performs a collective attack and controls the excess thermal noise in the channels. The introduction of postselection enables the parties to sustain a secret key rate over distances exceeding those of existing CV MDI protocols. In the worst-case scenario in which the relay is positioned equidistant between them, we ﬁnd that the parties may communicate securely over a range of 14 km in standard optical ﬁber. Our protocol helps to overcome the rate-distance limitations of previously proposed CV MDI protocols while maintaining many of their advantages.


I. INTRODUCTION
With the promise of provably secure communication built on the laws of physics, Quantum key distribution (QKD) [1,2] is one of the most important results emerging from the field of quantum information theory [3,4].QKD allows two parties, conventionally named Alice and Bob, to generate a secret key by communicating via an untrusted quantum channel.An eavesdropper (Eve) may employ the most robust attack allowed by the laws of physics, however, she is always restricted by the inherent uncertainty of quantum mechanics and is forced to avoid over-tampering with the signal as doing so will reveal her presence to the parties.By combining the attained secret key from a QKD protocol with the one-time pad algorithm, fully secure communication between the parties is guaranteed.
In recent years the field of QKD has evolved rapidly from the primitive BB84 protocol [5] to current stateof-the-art provably secure protocols allowing parties to communicate over hundreds of kilometers [6][7][8].Furthermore, there exists a large body of work based on proof-of-principle experiments and in-field tests, including ground-to-satellite communications [9][10][11].Most of the aforementioned work has focused on discrete variable (DV) protocols.Continuous variable (CV) protocols are a promising alternative which utilize readily available, inexpensive, and easily implementable equipment.CV protocols have been demonstrated to be capable of secret key rates close to the ultimate repeaterless (PLOB) bound [12].Many protocols have been proven secure and others have been demonstrated in a proof-of-concept experiment [13] and a field tests [14].See also the recent long-distance implementations of Refs.[15,16].
Many recent QKD protocols have focused on an endto-end as opposed to point-to-point approach in which Alice and Bob communicate via remote relays.In fact, introducing a relay allows the parties to perform measurement-device-independent (MDI) QKD protocols, even if the relay is untrusted [17,18].Measurement de-vice independence removes the security threat of sidechannel attacks attempted by Eve.Considering the case in which Alice and Bob communicate via a single untrusted relay, many state-of-the-art DV-MDI protocols allow long-distance, high-rate communications exceeding the PLOB bound.CV-MDI protocols have also been proposed and have been demonstrated in a proof-of-concept experiment to achieve very high secret key rates over relatively short distances [19].Unfortunately, developing a protocol that allows exploitation of the practicality of the CV-MDI regime at long distance is a difficult problem in recent QKD theory.One protocol exists that offers some improvement in the range of the CV-MDI protocol using discrete modulation [20].However, this protocol requires a very asymmetric configuration of the parties for the best results and does not offer a significant increase in the maximum range.
In this work, we begin to bridge the rate-distance gap between DV-and CV-MDI protocols.In particular, we aim to improve the distance over which a rate is attainable when a single relay is positioned equidistant between the two parties.In this case, a secret key rate of the CV-MDI protocol is only attainable at very short distances corresponding to a 0.75 dB loss [21].In order to extend this range, we employ a post-selection (PS) regime.PS describes the ability of the parties to utilize only instances of the protocol in which they have an advantage over the eavesdropper, given a prescriptive map of the contribution of the possible signals.By discarding any other instances, the secret key rate is always positive, and the parties can communicate securely up to a distance at which the key rate drops below a minimum usability threshold.
Post selection of a CV protocol was first introduced by Silbebrhorn et al.where it allowed a secret key to be constructed for losses exceeding the previous limit of 3 dB [22].Later, the technique was generalized to thermal loss channels [28] and the concept has been demonstrated in the experimental settings [24,25].In this work, for the first time, we consider post-selection of an MDI protocol which includes a measurement at an untrusted relay.We perform post-selection over the relay measurement outcome as well as Alice and Bob's variables.We assume that Eve employs a collective attack in which she targets both the Alice-relay and Bob-relay links while utlizing a quantum memory.
The paper is structured as follows: we begin by outlining the protocol in detail and explain the evolution of the modes.We then derive the mutual information between the parties and the Holevo bound in order to quantify Eve's information.We use these calculations to build the single-point rate, which serves as a prescriptive map for the parties to pick the positive channel uses.Finally, we calculate the post selected secret key rate of the protocol.

II. THE PROTOCOL
Alice and Bob may select either the q-or p-quadrature for the encoding.Alice prepares coherent states of the form | 1 2 (κ A +ip A ) for q-quadrature encoding or | 1 2 (q A + iκ A) for p-quadrature encoding, where A is the modulus of q A or p A , respectively and κ is its sign.κ = +1 and κ = −1 correspond to bits 0 and 1, respec-tively.Fig. 1 outlines a schematic of the protocol for q-quadrature encoding.The amplitude q A or p A is chosen from a Gaussian distribution with variance V A , given by She subsequently sends her mode the relay and publicly broadcasts the absolute value A.
In the prepare-and-measure representation of the protocol, Bob sends coherent states |β to the relay.Alternatively, in entanglement based representation, his action may be modelled as measuring one mode of a two-mode squeezed vacuum (TMSV) state with modulation µ.The amplitude of the coherent states | β remotely prepared as a result of this process is related to the measurement outcome β by In our security analysis we will consider the entanglement-based representation of the protocol.We label Bob's heterodyne measurement outcome as (κ B, p B ) or (q B , κ B) depending on Alice's chosen quadrature, where B is the modulus of q B or p B , respectively and κ is its sign.Eve's attack begins with the injection of two modes E 1 and E 2 on Alice and Bob's links, respectively.These modes form one half of independent TMSV states with conjugate modes e 1 and e 2 , respectively with respective variances ω A and ω B .On route to the relay, modes A and B interact with Eve's corresponding modes E 1 and E 2 , through beam splitter interactions with transmissivities τ A and τ B , respectively.The output modes A ′ and B ′ are mixed in the balanced beam splitter of the relay with outputs A ′′ and B ′′ and are subsequently measured with homodyne detection in p-and q-quadrature, respectively.The corresponding outcomes γ q and γ p are publicly broadcast as γ = (γ q , γ p ).
In one variation of the protocol, Bob may broadcast B. By doing so, he ensures that himself and Alice possess the same information and can therefore independently establish which instances of the protocol offer them an advantage over Eve and which do not.This process that we describe later is the principal idea of post-selection.Eve may also compute this quantity and therefore discard the same instances discarded by the parties, thus decreasing her entropy.We refer to this regime as total-broadcasting (TB).In an alternative version of the protocol which we refer to as partial-broadcasting (PB), Bob may keep his measurement information secret, but he must then communicate via the public channel to Alice which signals are ignored.In this scenario we must account for Eve's knowledge of this information.We can establish an upper bound on the rate by assuming that Eve does not interact with the information about which instances are kept.In both cases we aim to compute the secret key rate R = I AB − I AE which depends on all of the parameters of the protocol.

A. Experimental considerations
We will now discuss two difficulties which may arise in a practical implementation of our protocol.Firstly, to account for realistic reconciliation strategies with finite block size, we add a reconciliation parameter β ≤ 1.The parameter simply reduces the mutual information, such that the secret key rate becomes R = βI AB − I AE .Secondly, a more complex difficulty we must consider is the efficiency η of the homodyne detectors at the relay.We can model the efficiency by considering perfect detection of the output of a beam splitter of transmissivity η which mixes the vacuum with the mode to be measured.For complete security we should assume that Eve injects the vacuum mode and has access to its output.However, let us first consider the case in which the noise is trusted as shown in Fig. 2(a).In this case Eve's state is still made up of the four modes shown in Fig. 1 but we must add vacuum modes M 1 and M 2 which interact with modes B ′′ and A ′′ , respectively.After the interaction these modes are traced out and Eve's accessible information is computed from her four-mode state which now depends on η.If, on the other hand, we assume that Eve has access to the output of the detector beam splitters which she may store in a quantum memory as shown in Fig. 2(b), her CM consists of six modes and we must use all of these modes to compute her accessible information.In the symmetric case (τ A = τ B = τ and ω A = ω B = ω) we may model the effect of the detection beam splitters by adjusting the transmissivity of the Alice-relay and Bobrelay links as shown in Fig. 2(c).The transmissivity of the links is simply multiplied by η and Eve's accessible information is obtained from her four modes.In each case the mutual information between Alice and Bob is the same and can be written for a general η.

B. Protocol evolution
We will now outline the evolution of the covariance matrices (CMs) and mean values of the modes throughout use of the protocol.For simplicity and without loss of generality, we will consider the case in which the encoding is in the q-quadrature, as the main results are identical in each case.We assume that Eve injects the vacuum modes at the detector beam splitters while noting that these additional modes may be traced out in the case of trusted noise or if η = 1.We begin with the initial CM of the combined system of Alice, Bob and Eve, given by where V E is Eve's initial CM, given by The associated mean value is given by We describe the effect of the beam splitters by defining the matrix which we apply to the CM and mean value of the initial state to obtain the post-propagation CM and mean value We now come to the relay measurements of the modes A ′′ and B ′′ which produce the measurement outcomes γ q and γ p , respectively.Importantly, as we are performing homodyne measurements on conjugate quadratures, the outcome of one of the relay measurements does not affect the other, i.e. we have p(γ q |κ A γ p ) = p(γ q |κ A).Furthermore, as the encoding only appears in one quadrature, measurement of the conjugate quadrature has no effect on the final rate.We may therefore use the label γ to describe the relay measurement outcome of the quadrature containing the encoding, given by where we define the variance (10) After the relay measurements, the CM and mean value of the remaining system become V bE ′ |κ A γqγp and xbE ′ |κ A γqγp .In the final step of the protocol Bob performs a heterodyne measurement on his retained mode.He obtains p(κ B p B |κ A γ) and integrates over p B to obtain where In the following sections we will derive the secret key rate of the protocol based on the secret encoding variable κ and Bob's variable κ.We first compute the mutual information then the Holevo bound which provides an upper bound on Eve's accessible information.Finally, we introduce the post-selection procedure and calculate the post-selected rate.

III. MUTUAL INFORMATION
The first step in the computation of secret key rate is to establishing the mutual information between Alice and Bob using the protocol outputs.The mutual information is given by where H(X|x) := p(x)H X|x dx is the conditional entropy.The first term is given by while the second may be expressed as where H κ| A B γ and H κ| κ A B γ are computed with the binary entropy formula from their respective probabilities.The main difficulty in computing the mutual information emerges from the calculation of the necessary probabilities using only the protocol output probabilities p(γ |κ A) and p(κ B |κ A γ) and the known probability p(κ A).The solution is repeated application of Bayes' rule to obtain firstly and Then, using the same set of probabilities we can calculate and Finally, we calculate the probability of all of the postselection variables as

IV. EVE'S ACCESSIBLE INFORMATION
We now come to the quantification of Eve's accessible information in the protocol.To upper-bound this quantity we use the Holevo bound, which gives the largest possible information Eve may access.The Holevo bound is different depending on whether the protocol is PB (with individual or collective attacks) or TB.We will compute the bound for each case in the following sections.

A. Partial broadcasting
Firstly, we consider the case in which Bob does not broadcast his measurement outcome.We provide an upper bound on the rate by considering the case in which Eve does not utilize the communication between the parties needed in order to establish which instances of the protocol are kept.

Individual attacks
Let us first examine an individual attacks scenario, making the assumption that Eve does not have access to a quantum memory.In this case the mutual information between Alice and Eve, I AE , can be computed using the fidelity, F of Eve's two possible states, ρE|+A γ and ρE|−A γ .We compute this quantity directly from the corresponding covariance matrices and mean values of the states as outlined in [26].We then apply the following lower bound in order to bound Eve's error probability from below, modelling a worst-case scenario for Alice and Bob [27].Finally, we. may write where H 2 (p) is the binary entropy.

Collective attacks
In the case of collective attacks we must compute the Holevo bound in order to upper-bound Eve's knowledge.The Holevo bound is given by where S(X|x) := p(x)S(ρ X|x ) dx is the conditional von Neumann entropy of system X on variable x with corresponding probability distribution p(x), and S(ρ) is the von Neumann entropy of state ρ, defined as The first term is given by where ρE| A γ is the total state, given by As it is derived from the sum of two Gaussian states, the total state is non-Gaussian.To avoid the difficulty in obtaining the entropy of this state from its photon statistics, we may employ a non-Gaussian entropy approximation which we derive in Appendix A. Using the main result we may write the CM of the total state as where ∆x E = xE|+A γ − xE|−A γ .Taking the entropy of this state via the symplectic eigenvalues, {ν i } of its CM provides an upper bound on the exact entropy as it assumes the state to be Gaussian.We therefore have where Meanwhile, The second term of the Holevo bound involves a Gaussian state and can be computed directly from the protocol output.After the relay measurements, Eve's CM V E|κ A is obtain by tracing out Bob's remaining mode.The entropy is then simply computed from the symplectic eigenvalues, {υ i } of the CM by Finally, we may write the upper bound on Eve's information

B. Total broadcasting
In the case in which Bob broadcasts B we must compute the Holevo bound conditioned on B as well as the other broadcast variables.We may write the bound as The first term is given by where the total state is can be written in terms of Eve's protocol output state as while the conditional state is given by We will now introduce a method of calculating the entropy of the non-Gaussian states required for the Holevo bound.The method originates from Refs [28? ] for oneway protocols with coherent states.With little added complexity we derive the equivalent method for the MDI protocol with coherent states.Let us write the output state of the protocol in the following alternative notation while for convenience we also introduce the shorthand notation Using this notation we may write the total state as Using Gaussian state tomography it is possible to describe Eve's state with the matrix of overlaps of all of the possible states.The overlap matrix takes the following special form where we have ignored phase factors in the knowledge that they may always be removed by multiplying the states by alternative phase factors.As we are able to express the matrix of overlaps in product form, Eve's state may be written as the following product state Let us then expand the separate states in orthonormal bases such that and then we may perform the following inner product to obtain expressions for the absolute values of the coefficients c 0 and c 1 of and Following a similar calculation we arrive at the following expressions for the remaining coefficients and Eve's total state may now be expressed in this basis by evaluating Eq. (35).We obtain where we have defined To obtain the entropy of the total state we compute the eigenvalues of Eq. (54) which amounts to solving a quartic equation in which the coefficients are combinations of the absolute values of the basis coefficients, and then computing their VNE using Eq. ( 25).This entropy is then substituted into Eq.( 34) to obtain the first term of the Holevo bound.
In order to compute the conditional state and the second term of the Holevo bound, we construct the density matrices of the conditional states.Firstly, we have which has corresponding eigenvalues Similarly, for the counterpart state we have with eigenvalues Using the eigenvalues of the two states, it is straightforward to compute the second term of the Holevo bound, given by

V. RAW KEY AND POST-SELECTION
With the components of the rate now computed, we can describe the post-selection step that improves the achievable distance of the protocol.Let us first write the mutual information as a single integrand in the following form where we define the single-point mutual information ĨAB (A, B, γ) = H κ| A B γ − κ p(κ | A B γ)H κ| κ A B γ .Similarly for individual attacks we can write the mutual information between Alice and Eve as a single integrand with ĨAE = 1 − H 2 (F − ) being the single-point information between Alice and Eve.In the same way, we define the following single-point Holevo bounds χPB for PB and χTB for TB protocols, Using these definitions, we may now define the singlepoint rate, R = ĨAB − ĨAE for individual attacks and R = Ĩ − χPB/TB for collective attacks and we can write the secret key rate as For post-selection, we are interested in the region where the single-point rate is positive so that the parties can choose to only include instances of the protocol that contribute positively to the key rate.We can therefore define the post-selected key rate as We also define the post-selection area, which is simply the region of the A-B-γ volume in which the single-point rate is positive.Computing the post-selected rate amounts to integrating the single-point rate in this volume.

VI. RESULTS
We now present numerical results for the rates of our protocol.In order to express the rate as a function of the distance between the parties we have first used the relation τ = 10 −dB/10 to express the transmissivity in terms of the loss in dB.Then, as the protocol is performed with standard optical fibre, we compute the length of the links assuming 0.2 dB/km.We use the excess noise to express the thermal noise in terms of the transmissivity of the channel.By considering each link to be a point-to-point channel we write where ǫ A(B) is the excess noise in the Alice-relay (Bobrelay) links.Fig. 3 shows the total-distance between Alice and Bob as a function of the rates of the PB and TB protocols in the symmetric configuration (τ A = τ B ) and assuming a pure-loss attack (ǫ = ǫ A = ǫ B = 0).In each case we optimize over V A and µ.For comparison we include the rate of the original Gaussian MDI protocol [19] with equivalent parameters.At the cost of a lower rate at short distances, our protocol significantly improves the range at which the parties may communicate.It is important to note that the achievable, fully secure rate may fall anyway between the rates of the TB protocol and the PB protocol, but despite being the worst-case scenario, the TB protocol still offers a notable advantage over the existing Gaussian MDI protocol.Fig. 4 shows the rate of the symmetric TB protocol as a function of the total distance between Alice and Bob, with varying amounts of excess noise.Again, we also show the rate of the Gaussian MDI protocol.Clearly our protocol is robust against excess noise in the channels, and the advantage over the existing protocol is still clear at the largest amount of noise considered.To explore the effect of the experimental parameters in more detail, we consider in Fig. 5, for individual and collective attacks with partial broadcasting, the rates with ǫ = 0.05, η = 0.8 and β = 0.95.We have incorporated η by scaling the transmissivities on each link.This has a considerable effect on the rate but a distance exceeding 60km with collective attacks is still possible.Fig. 6 shows the optimal parameters for each of the rate-distance plots in Fig. 5.
In Fig. 7 we explore the asymmetric configuration of the TB protocol.We see that our protocol offers the biggest advantage at more symmetric configurations, however it still offers some advantage into the asymmetric regime up to very asymmetric configurations.The solid lines represent the optimal parameters for the pureloss case with ideal detection and the dashed lines represent the optimal parameters for ǫ = 0.05, η = 0.8 and β = 0.95.The red lines are for µ and the black lines are for VA.

VII. CONCLUSIONS
In this work we have introduced a long-distance CV-MDI-QKD protocol with a general mathematical formulation considering individual and collective eavesdropping regimes which can include excess noise and exper-imental inefficiencies.We have demonstrated that our protocol exceeds the range of the original Gaussian CV-MDI-QKD protocol in both symmetric and asymmetric configurations.We have shown that this improved range exists even in the strongest eavesdropping scenario, and is substantially increased to distances exceeding 50 km if passive eavesdropping is considered.Our protocol is robust against excess noise as well as detection and reconciliation inefficiencies and it is therefore a significant step towards a realistic experimental implementation.
Our results demonstrate that CV-MDI-QKD need not be restricted to short-distances.In fact, our protocol provides a theoretical foundation for MDI-QKD at distances previously only achievable with discrete variable protocols, achievable with inexpensive and easily implementable equipment.where we have used 1 − p(κ) = p(−κ).Now note that p(κ)p(−κ) = p(+)p(−) for both values of κ, and κ xκ i (x κ j − x−κ j ) = (x + j − x− j ) κ κx κ i .Therefore we obtain We can write this in compact outer product form as where ∆x = x+ − x− .

FIG. 1 :
FIG. 1: Schematic of the protocol using q-quadrature encoding.Alice prepares coherent states of the form | 1 2 (κ A +ipA) and sends them to the relay.Bob's action may be viewed in either the prepare and measure representation (a) or the entanglement-based representation (b).In (a), Bob sends coherent states |β to the relay.In (b), Bob holds a two-mode squeezed vacuum state of variance µ with modes labelled b and B. He measures mode b with heterodyne detection obtaining the outcome (κ B, pB) and hence prepares coherent states in mode B. Modes A and B interact with Eve's modes E1 and E2, respectively, which each form one half of individual TMSV states with conjugate modes e1 and e2, respectively.The interaction is characterized by the beam splitter operation with transmissivities τA and τB, respectively.The output modes A ′ and B ′ are mixed in the balanced beam splitter of the relay.Subsequently, the outputs A ′ and B ′ are measured with homodyne p-and q-detection, respectively with corresponding respective outcomes γp and γq, which are publicly announced.

FIG. 2 :
FIG.2: Models of experimental inaccuracy in homodyne measurements at the relay using beam splitters.(a) depicts a trusted noise scenario in which it is assumed that Eve does not have access to the output of the beam splitters.(b) assumes that the output of the beam splitters is added to Eve's quantum memory for later measurement.(c) depicts a simplification in the symmetric case (τA = τB = τ ) in which the transmissivities on the Alice-relay and Bob-relay links are scaled by a factor of η to model the effect of beam splitters at detectors.

FIG. 3 :
FIG.3: Rates of the symmetric partial-broadcasting protocol with post-selection over all three variables, as a function of the total distance between Alice and Bob with VA and µ optimized.The red line represents the rate of the symmetric Gaussian MDI protocol.

FIG. 4 :
FIG.4: Rates of the symmetric protocol with totalbroadcasting as a function of the total distance between Alice and Bob with VA and µ optimized, for different levels of excess noise.The red line represents the rate of the symmetric Gaussian MDI protocol.

FIG. 5 :FIG. 6 :
FIG.5: Rates of the symmetric protocol with partialbroadcasting as a function of the total distance between Alice and Bob with VA and µ optimized.The black lines correspond to the pure-loss case with perfect detection while the red lines represent the rate with parameters ǫ = 0.05, η = 0.8 and β = 0.95.

10 FIG. 7 :
FIG. 7:Comparison of the maximum Bob-Relay distance as a function of the Alice-Relay distance for the total-broadcasting protocol.The dashed line represents the a rate of 10 −8 and the the solid black line represents a rate of 10 −10 .For comparison, the red line represents a rate of 10 −10 in the Gaussian MDI protocol.