Self-referenced continuous-variable quantum key distribution protocol

We introduce a new continuous-variable quantum key distribution (CV-QKD) protocol, self-referenced CV-QKD, that eliminates the need for transmission of a high-power local oscillator between the communicating parties. In this protocol, each signal pulse is accompanied by a reference pulse (or a pair of twin reference pulses), used to align Alice's and Bob's measurement bases. The method of phase estimation and compensation based on the reference pulse measurement can be viewed as a quantum analog of intradyne detection used in classical coherent communication, which extracts the phase information from the modulated signal. We present a proof-of-principle, fiber-based experimental demonstration of the protocol and quantify the expected secret key rates by expressing them in terms of experimental parameters. Our analysis of the secret key rate fully takes into account the inherent uncertainty associated with the quantum nature of the reference pulse(s) and quantifies the limit at which the theoretical key rate approaches that of the respective conventional protocol that requires local oscillator transmission. The self-referenced protocol greatly simplifies the hardware required for CV-QKD, especially for potential integrated photonics implementations of transmitters and receivers, with minimum sacrifice of performance. As such, it provides a pathway towards scalable integrated CV-QKD transceivers, a vital step towards large-scale QKD networks.


I. INTRODUCTION
Quantum key distribution (QKD), which enables the generation of secure shared randomness between two distant parties (Alice and Bob) [1], is the most advanced quantum technology to date [2][3][4].Discrete-variable QKD (DV-QKD) is the term for well-established protocols that involve generation and detection of extremely weak pulses of light (ideally, single photons).Unfortunately, significant technological challenges still remain in generation and detection of single photons, although important advances have been made over past three decades [4,5].Protocols for an alternative approach, continuous-variable QKD (CV-QKD), were developed more recently [2,6].CV-QKD utilizes conjugate continuous degrees of freedom (field quadratures) of a light pulse prepared in a Gaussian (coherent or squeezed) state to transmit the signals that constitute the shared randomness.At the receiver, the quadratures are measured using shot-noise limited balanced homodyne or heterodyne detectors, which have the advantage of not requiring single photon detection and operating at extremely high detection rates (on the order of GHz).In particular, the coherent-state CV-QKD protocol has received much attention because of its promise of achieving information theoretic secure key distribution with modest technological resources [7][8][9].The technical ease of CV-QKD is balanced by more complex and less efficient post-processing schemes for distilling a shared secret key from the imperfect shared randomness established during the quantum signal exchange portion of the protocol.However, with the recent development of higher efficiency error correction codes [10][11][12] and more comprehensive security proofs [13][14][15] for CV-QKD, it is becoming an attractive alternative to DV-QKD.A particular reason for the appeal is the expectation that the integrated photonics implementation of CV-QKD will be easier than that of DV-QKD, and such implementations are critical for the next phase of QKD development that is focused on practicality and wide-spread utilization.
A major obstacle to the implementation of CV-QKD, especially in integrated photonics, is the requirement for transmission of a local oscillator (LO) between Alice and Bob.Current fiber-based implementations co-transmit the LO with the signal states using techniques that involve combinations of timedivision multiplexing (TDM), wavelength-division multiplexing (WDM), and polarization encoding [10,16].Since the LO intensity dictates the quality of quadrature measurement at Bob's receiver, it is desirable to transmit a high-power LO that is many orders of magnitude more intense than the signal pulse.Due to this power disparity, multiplexing has to significantly separate the two components in order to minimize the contamination of the signal states by photons scattered from the LO (for example, this is the reason for combining polarization encoding with TDM, as in Ref. [10]).This degree of separation in multiplexing (and associated demultiplexing at Bob's receiver) greatly complicates the hardware required for CV-QKD, and is even a roadblock for integrated photonics implementations of CV-QKD since TDM and polarization manipulation and maintenance are more difficult on-chip [17][18][19].Another complication associated with the requirement of LO transmission is that a relative phase shift arises between the signal and LO due to the path separation during demultiplexing at the receiver [16,20].This shift can be compensated by precise calibration of the separated paths, which is however not a robust solution, or by dynamic phase estimation at the receiver, in which case the speed at which this estimation can be done becomes a practical limitation on the rate of key generation.
In this work, we eliminate all of the issues outlined above by developing a coherent-state CV-QKD protocol that eliminates the transmission of an LO between Alice and Bob.We achieve this by noticing that a common reference frame between Alice and Bob can be established by a method that, FIG. 1. Hardware schematic for the SR-CV-QKD protocol.In contrast to conventional CV-QKD implementations (e.g., Ref. [10]), the hardware requirements are dramatically simplified due to elimination of LO transmission.instead of transmitting the LO, uses regularly spaced reference pulses whose quadratures are measured by Bob to estimate Alice's phase reference.This new protocol, which we call self-referenced CV-QKD (SR-CV-QKD), greatly simplifies the hardware requirements at Alice's and Bob's stations since it enables them both to employ independent (truly local) LOs.We demonstrate the key elements of SR-CV-QKD using a fiber-based setup utilizing fiber-pigtailed bulk-optics components.However, we stress that this protocol is manifestly compatible with chip-scale implementation since it only requires (low-loss and low-noise) classical optical communication components, as outlined in Fig. 1.
The remainder of the paper is organized as follows.The SR-CV-QKD protocol is described in Sec.II.In Sec.III we use the entanglement-based theoretical description of SR-CV-QKD to analyze the secret key rate under individual and collective Gaussian attacks.Section IV presents the details of the experimental demonstration of the protocol's feasibility.Finally, our conclusions are summarized in Sec.V.

II. DETAILS OF THE SR-CV-QKD PROTOCOL
In this section, we describe the prepare-and-measure version of the protocol, which corresponds to the actual physical implementation.The equivalent entanglement-based description is presented in Sec.III.
In each round of SR-CV-QKD, Alice chooses two independent Gaussian random variables (q A , p A ), both distributed as N (0, V A ), and sends Bob the coherent state |q A + ip A , which we refer to as the signal pulse.In addition, she sends a coherent-state reference pulse in the next time bin.The mean quadrature values of the reference pulse in Alice's reference frame, (q A R , p A R ), 1 are publicly known.The amplitude of 1 We use lowercase letters q and p for c-number mean values of quadratures FIG. 2. The phase-space representation of Alice's and Bob's misaligned reference frames.The reference pulse is assumed to be on the QA axis for Alice in this example, and the signal pulse is randomly placed.
the reference pulse, 2 V , is fixed and may be several times larger than V 1/2 A , but much smaller than that of a typical LO.Using reference pulses with a relatively small amplitude is a practically important aspect of SR-CV-QKD, which helps to reduce the interference with the signal pulse, as compared to the effect of a large-amplitude (classical) pulse, whose "long tail" cannot be completely suppressed and hence would interfere with the signal if time multiplexed at the same rate.
In each round, Bob performs a homodyne measurement of one of the quadratures (Q B or P B ) of the received signal pulse to estimate its mean value (q B or p B , respectively), where these quadratures are defined relative to his own high-power LO.He also performs a heterodyne measurement on the received reference pulse to obtain both of its mean quadrature values, q B R and p B R (again, with respect to his LO).
The phase-space representation of Alice's and Bob's misaligned reference frames is shown in Fig. 2. The phase difference θ between Alice's and Bob's frames is a time-dependent quantity since their individual LOs are free-running, and we assume that θ at any time is a random variable distributed uniformly on (−π, π] and that the frequency of its fluctuations (i.e., the phase noise bandwidth), f θ , which is measured and calibrated before the protocol begins, is much lower than the rate of pulse generation.In other words, the time delay ∆t between the signal and reference pulses is much shorter than the inverse of the bandwidth f θ , i.e., and capital letters Q and P for quadrature operators. 2Throughout this paper, we express all quadrature variances and correlations in shot-noise units, N 0 , and all quadrature values and amplitudes in units of N 1/2 0 .
Provided that condition (1) is satisfied, the θ value will be the same for measurements on both pulses.Estimation of the phase difference θ is the key element in SR-CV-QKD.Since Bob knows the mean quadrature values of the reference pulse both in Alice's frame, (q A R , p A R ), and in his own frame, (q B R , p B R ), he can calculate an estimate θ of the phase difference, via: where 0 < T eff ≤ 1 is the effective channel transmittance that can be eliminated to obtain In the following we will assume without loss of generality that Alice's reference pulse has p A R = 0, in which case Eq. ( 3) becomes Since the reference pulse has a relatively small amplitude, its quantum uncertainty cannot be ignored, and therefore even in the case of a technically ideal measurement, there will be an error in the phase difference estimate, i.e., where the estimation error ϕ is a random variable distributed according to some probability distribution P(ϕ).We assume that θ and ϕ are independent random variables, since they arise from separate physical processes.We will see in Sec.III that the error of phase difference estimation plays a critical role in determining the expected secret key rate of SR-CV-QKD.
As is standard in modern CV-QKD, our protocol employs reverse reconciliation.Bob sends Alice his estimate of the phase difference between their frames, θ, and which quadrature of the signal pulse (Q B or P B ) he measured.Then Alice rotates her tabulated values for the signal pulse by θ, to obtain an estimate (q B or pB ) of Bob's measured quadrature value, via At this point Alice and Bob share a partially correlated Gaussian random variable and the remainder of the protocol is the same as conventional CV-QKD, which proceeds by performing channel estimation, error correction, and privacy amplification after a large enough block of (imperfect) shared randomness has been collected [9,10].
We mention a number of points about the new protocol before examining it quantitatively.First, the occurrence ratio of reference pulses to signal pulses does not have to be 1:1.If the phase drift is significantly slower than the signal pulse rate, then one can utilize fewer reference pulses to estimate the slow drifting phase difference.In this situation, condition (1) should hold for ∆t being the period between subsequent reference pulses.
Second, the frequency difference between Alice's source and Bob's LO should be reasonably stable: this can be accomplished through the use of single-frequency lasers locked individually to a stable reference frequency such as an atomic line.In case the stable frequency reference is difficult to implement, commercially available single-frequency lasers can still be utilized.If the relative frequency drift is slow and the linewidth is sufficiently narrow, the drift can be treated as a phase noise, which the SR-CV-QKD scheme will handle.However, if the relative frequency drift is fast, one should consider frequency locking Bob's LO by utilizing a dedicated locking beam and utilizing the transfer cavity technique [21,22].
Third, in some instances Bob may be restricted to performing homodyne measurements only, for example, if it is desirable to simplify his receiver hardware as much as possible.In this case Alice can send a pair of closely spaced twin reference pulses, and Bob will perform orthogonal quadrature measurements on them sequentially, obtaining q B R from the measurement on one reference pulse and p B R from the measurement on the other.In addition to hardware simplification, this twin-reference-pulse mode results in a lower uncertainty of the phase difference estimate, as quantified in Sec.III below, but at the expense of a reduction in the number of time bins available for signal pulses (which constitute the raw data for the eventual key) for a fixed communication time.
Finally, we note that using reference pulses to perform phase drift estimation is not only useful for the SR-CV-QKD protocol per se, but also for calibration purposes before and during the protocol.This technical improvement is discussed in more detail in Appendix B.

III. SECRET KEY RATE ANALYSIS
While claims of secure key distribution should be based on empirically estimated correlations between Alice and Bob [15], it is common to calculate an expected secret key rate based on reasonable assumptions on the communication channel and detection apparatus.The usefulness of such a theoretical analysis is in revealing the effects of various design parameters on the achievable key rate.This calculation is particularly important in our case since it allows us to compare the expected performance of SR-CV-QKD against the respective conventional protocol that requires LO transmission.
We follow the approach in Refs.[2,23] and compute the asymptotic expected key rate in the presence of a lossy, noisy passive Gaussian process, E, that models channel transmittance, channel excess noise, detection inefficiency, and electronic detector noise.The entanglement-based description of the conventional protocol begins with the density matrix for the state shared between Alice and Bob before they perform any measurements: ρ AB = E(ρ SV ), where ρ SV is the ideal two-mode squeezed vacuum state.Since ρ SV and E are Gaussian, one can equivalently express the state ρ AB in terms of its covariance matrix (represented in the basis {Q A , P A , Q B , P B }) [2,23]: with where 1 1 = 1 0 0 1 and σ z = 1 0 0 −1 .In Eqs. ( 7) and ( 8), T is the channel transmittance, η is the detector efficiency (so the overall effective transmittance is T eff = T η), χ is the channel noise (referred to the input of the channel), and V is the variance of both quadratures of Alice's output state, i.e., V = V A + 1, where V A is the variance of Alice's Gaussian modulation of the signal pulse.The noise can be modeled as a sum of three terms [2]: where the first term is the loss-induced vacuum noise, the second term is the contribution of the detector electronic noise with the variance V el , and ε is the excess noise in the channel.
Note that this noise model treats channel and detector contributions on equal footing, thus resulting in a conservative estimate of the expected key rate.Some works [9,20,24,25] use a more nuanced model which assumes that Eve cannot benefit from the noise added by Bob's detector, therefore resulting in a more optimistic key rate estimate.In this work, we use the conservative noise model of Ref. [2], which corresponds to a stronger security scenario.
In SR-CV-QKD, in addition to the process E, we need to take into account the effect of phase-space rotations due to the reference frame mismatch, including averaging over distributions of random variables θ and ϕ.The resulting density matrix for the state shared between Alice and Bob before they perform any measurements is with where U A(B) (φ) is the operator of a phase-space rotation of Alice's (Bob's) mode by angle φ.The interpretation of this state is that Bob's mode undergoes a rotation by the angle equal to the actual phase difference θ, and Alice attempts to compensate for this by applying a rotation of her mode by the angle − θ.Note that in the ideal case where θ = θ, these rotations describe an orthogonal transformation of Bob's state and the conjugate orthogonal transformation [26] of Alice's state, whose combination leaves the bipartite state invariant, i.e., ρ AB (θ, θ) = ρ AB and, consequently, ρ AB = ρ AB in the ideal case.Thus, in the entanglement-based description, the SR-CV-QKD protocol can be seen as an attempt to restore the imperfect EPR correlations in the state U B (θ)ρ AB U † B (θ) by compensating for the random rotation experienced by Bob's mode.
The state ρ AB is also Gaussian, and its covariance matrix can be expressed as where U A(B) is the symplectic representation of a phase-space rotation operator U A(B) [6].Computing these rotations and integrals yields with Comparing the covariance matrix γ AB of Eq. ( 14) to γ AB of Eq. ( 7), we see that the effect of the reference frame alignment in SR-CV-QKD is to replace σ z by Φ in off-diagonal blocks.In the following we will assume that the phase estimation error is dominated by the quantum uncertainty of the reference pulse(s), in which case the distribution P(ϕ) is symmetric around ϕ = 0, and consequently sin ϕ = 0.Then, and the effect of the reference frame alignment is to simply rescale the Q A Q B and P A P B correlations by the factor cos ϕ.Therefore we can carry over the analysis in Refs.[2,23] for the respective conventional CV-QKD protocol, and simply replace the off-diagonal blocks in the covariance matrix by the scaled versions.A more visual way for evaluating variances and correlations in SR-CV-QKD is by using the Heisenberg picture, i.e., applying the phase-space rotations to the quadrature operators, and evaluating quantum expectation values over the unrotated state ρ AB , as well as averaging over distributions of random variables θ and ϕ.Using elements of the covariance matrix γ AB , it is straightforward obtain: and analogously for other variances and correlations, thus reproducing the elements of γ AB in Eq. ( 14).Alice's preparation of Gaussian-modulated coherent states in the prepare-and-measure description corresponds to her performing a heterodyne measurement on the state of mode A in the entanglement-based description.This heterodyne measurement is equivalent to mixing mode A with vacuum on a balanced beam splitter and performing homodyne measurements on conjugate quadratures of two output modes A and A .Due to the symmetry between the two quadratures, it is sufficient to consider the measurement of the Q quadrature of mode A , which is given by Since the vacuum noise is not correlated with any other mode, it is easy to obtain: A. Individual attacks The asymptotic secret key rate against individual attacks for reverse reconciliation is given by where 0 < β ≤ 1 is the reconciliation efficiency, I A B is the mutual information between Alice's and Bob's measurements, and I BE is the mutual information between Eve's and Bob's measurements.These mutual informations are given by where is the variance of the quadrature Q B measured by Bob, and is the conditional variance that quantifies Alice's uncertainty on Q B after the measurement of Q A .Using Eqs. ( 19) and ( 21), we obtain and where We see from Eq. ( 25) that the effect of using the reference pulse is the increase in the conditional variance by the additional term If the distribution P(ϕ) is tight, then cos ϕ ≈ 1− 1 2 ϕ 2 and ξ ≈ ϕ 2 .Also, if condition (1) is satisfied, the θ value is constant during each θ estimation, and the variance of the estimated value is V θ = V ϕ = ϕ 2 (recall that we assume symmetric P(ϕ), which implies ϕ = 0).If P(ϕ) monotonically and rapidly decreases with |ϕ| from the maximum value at ϕ = 0, the variance V θ = ϕ 2 is a tight upper bound on ξ, i.e., ξ V θ , and, consequently, We can evaluate V θ by expressing it as where z = tan θ = p B R /q B R , ∂ θ/∂z = cos 2 θ, and is the dimensionless variance of the measured value of z.In Eq. ( 31), δ R = 1 in the single-reference-pulse mode (a heterodyne measurement is performed on a single reference pulse) and δ R = 0 in the twin-reference-pulse mode (sequential homodyne measurements are performed on a pair of twin reference pulses).In general, the value of V z depends on the modulation used by Alice to generate reference pulses.In particular, for fixed mean quadrature values and p A R = 0, we find: By substituting these expressions into Eqs.( 31) and ( 30), we obtain: Correspondingly, the tight upper bound on the conditional variance increase due to the reference pulse use, given by Eq. ( 29), can be now expressed in terms of experimental parameters: which scales as V A /V R .The corresponding lower bound on the mutual information between Alice and Bob is Now, to evaluate the mutual information between Eve and Bob, one can apply the Heisenberg uncertainty relation to the pure state held by Bob conditioned on Alice's and Eve's measurements, to obtain [2]: where, due to the symmetry between Q and P quadratures, B stands for any quadrature of Bob's mode.By substituting inequality (36) into Eq.(23b), we obtain: where in the last line we have used ξ V θ to express the bound on mutual information in terms of experimental parameters.
Finally, putting together the bounds in Eqs. ( 35) and (37), we obtain the minimum key rate that is secure against individual attacks, K ind ≥ K min ind , expressed in terms of experimental parameters: Note that all terms associated with the reference pulse's quantum uncertainty reduce the key rate and scale inversely with V R .In the limit of a large-amplitude (classical) reference pulse, V R → ∞, the theoretical key rate of SR-CV-QKD is the same as that for the respective conventional CV-QKD protocol that requires LO transmission [2,23].However, even in this limit, SR-CV-QKD could still be practically advantageous since it avoids many technical difficulties associated with LO transmission, as detailed in Sec.I.

B. Collective attacks
The expected secret key rate against collective attacks for reverse reconciliation is given by where the lower bound on I A B is given by Eq. ( 35) and χ BE is the Holevo quantity for Eve's maximum accessible information.For Gaussian protocols, the Holevo quantity is [20,23] where S(ρ) is the von Neumann entropy of the state ρ, ρ AB is the state shared between Alice and Bob before they perform any measurements, and ρ q B A is the state of Alice's system conditional on Bob's measurement outcome q B .Since these states are Gaussian, the entropy is evaluated in terms of symplectic eigenvalues of the covariance matrices of the corresponding states [6].This procedure results in [23] where G(x) = (x + 1) log 2 (x + 1) − x log 2 (x), and the eigenvalues λ i are obtained from Furthermore, we find that χ BE monotonically increases as ξ increases, and therefore we can upper bound χ BE using ξ ≤ V θ .Thus, replacing ξ in Eqs.(42) with expression (33) for V θ completes the derivation of the minimum expected key rate that is secure against collective attacks, K col ≥ K min col , in terms of experimental parameters.We note that since SR-CV-QKD is a Gaussian protocol, security against collective attacks is sufficient for asymptotic unconditional security (i.e., security against coherent attacks) with some processing overhead [27,28].
Figure 3 shows the expected minimum key rates secure against individual and collective attacks, as expressed by K min ind and K min col , respectively.Each plot shows the key rate as a function of the effective transmittance T eff = T η, for a number of reference-pulse amplitude values (V R /V A = {10, 20, 50, 100, 200, 500} with V A = 40) and also for ξ = 0 (which results in the same key rate as the respective conventional CV-QKD protocol with LO transmission).We see that as V R increases the performance of SR-CV-QKD approaches that of conventional CV-QKD, and at V R ∼ 500V A the achievable key rates are very similar for the two protocols.Figure 3 shows results for the single-reference-pulse mode (δ R = 1); the results for the twin-reference-pulse mode (δ R = 0) are very similar, except that smaller values of V R /V A are required to approach the ξ = 0 curve, which is a result of the higher accuracy of the phase difference estimation possible in this mode of operation.(specifically, VR/VA = {10, 20, 50, 100, 200, 500}), along with the curve for ξ = 0, in which case the key rate is the same as that for the respective conventional CV-QKD protocol with LO transmission.The curves terminate on the left at values of T eff below which the expected secret key rate is zero.

IV. EXPERIMENTAL CHARACTERIZATION AND DEMONSTRATION
The primary benefit of the SR-CV-QKD protocol is the reduction in hardware it enables at the transmitter and receiver.A schematic of Alice's and Bob's stations for performing SR-CV-QKD is shown in Fig. 1, which demonstrates that the required hardware is significantly simpler than that in conventional CV-QKD implementations (e.g., Ref. [10]).
Since our purpose is to demonstrate the feasibility of the SR-CV-QKD protocol, the channel fiber length between Alice and Bob in all of the experiments reported on below was only 5 m.Extending the SR-CV-QKD operation to a practical distance is ongoing work.Further details of our experimental setup are given in Appendix A.

A. Signal retrieval under strong phase noise
We first demonstrate the ability of the protocol to detect the phase drift and compensate for it.For this purpose we let Bob compensate his measured quadrature values rather than send the phase estimate to Alice.Each signal pulse is prepared in a constant coherent state and is accompanied by a reference pulse that is also prepared in a constant coherent state with with mean quadrature values (q A R , p A R ) = (30, 0).Bob measures both Q and P quadratures of signal and reference pulses using his own LO, and the measured data are shown in Figs.4(a) and 4(b).The fluctuations of measured mean quadrature values of both signal and reference pulses indicate the phase drift happening in the setup.Bob's estimate of the drifting phase, calculated using measurements of reference pulses' quadratures, is shown in Fig. 4(c), and mean quadrature values of signal pulses, compensated in accordance with the estimated phase, are shown in Fig. 4(d).The compensation successfully recovers the constant signal that Alice sent despite the variation of the phase difference between Alice's and Bob's frames.The phase-space representation of Bob's compensated signal is shown in Fig. 5.The variances of the reconstructed signal data is 1. 16.
We note that in this setup Bob was restricted to performing homodyne measurements and therefore could measure only one quadrature per pulse.Therefore Alice sent two identi-

B. Signal constellation reconstruction and noise estimation
Next, we report reconstruction of a constellation of signal pulses, which demonstrates the effectiveness of the selfreferenced technique for signals over a large area in the phase space.In this experiment, we used a square grid in Alice's phase plane, with tiles of size 5 × 5 and centers of tiles spanning from -15 to 15 in both quadrature axes (for a total of 49 tiles).Alice generated 1000 identical signal pulses prepared in a coherent state centered on each tile, and sent them to Bob.Each pair of signal pulses was accompanied by a pair of reference pulses; all reference pulses were identical with mean quadrature values (q A R , p A R ) = (30, 0).Bob performed homodyne measurements of Q and P quadratures on each pair of twin signal pulses (resulting in 500 paired data points for each grid tile), as well as on each pair of twin reference pulses.In the same manner as described in Sec.IV A above, Bob used quadrature measurements on reference pulses to estimate the fluctuating phase difference between his and Alice's frames, and then compensated for estimated phase values to recover signal pulses sent by Alice. Figure 6 shows the reconstructed constellation of signal pulses.The distribution of Bob's reconstructed signals is quite uniform in both quadratures for each of the grid tiles.However, one can notice the known "zero anomaly" [29,30], which is manifested as a skewed distribution of reconstructed values near the vacuum, arising due to a finite extinction ratio of Alice's electro-optic modulator (EOM) used for amplitude modulation.This undesirable effect can be mitigated by using an EOM with a higher extinction ratio or chaining multiple EOMs to achieve greater extinction.FIG. 6.The phase-space representation of signal pulses reconstructed using quadrature measurements on reference pulses and phase difference estimation.
Typical Gaussian-modulated coherent-state pulses used as signals in CV-QKD have the modulation variance V A ∼ 40, and the purpose of the presented example is to demonstrate that such signals can be accurately reconstructed using reference pulses and phase difference estimation.We emphasize that during this entire experiment (which involved transmission of 49,000 signal pulses and reconstruction of 24,500 pairs of mean quadrature values) we did not have to concern ourselves with the stability of Bob's LO since the random phase drift was compensated at all times using the self-referenced technique.
Next, we extended the characterization of signal pulses to the evaluation of the excess noise in the combined system, including Alice's encoding and Bob's decoding apparatus.In this experiment, we used the same reconstruction procedure for a constellation of coherent-state signal pulses as described above, but applied it to a different sample.With a finer grid tiling (2.5 × 2.5), the number of tiles was four times greater (for a total of 196 tiles), but only 250 identical signal pulses were generated for each tile.After performing the reconstruction of the signal's mean quadrature values, we calculated the variance of the reconstructed data for each grid tile.Figure 7 shows this variance as a function of the location on the phaseplane grid.Any variance in excess of 1 is the excess noise introduced by the experimental apparatus, channel, or phase estimation procedure.We note that the variance distribution is quite uniform (0.95-1.2) over much of the considered phaseplane region.The average variance value over the entire constellation is 1.16.Thus the entire apparatus, including the phase compensation step, has a total excess noise of 0.16.This excess noise is due to several experimental imperfections, including non-uniform performance and calibration of EOMs across the phase plane and electronic noise in detectors.

C. Demonstration of SR-CV-QKD with Gaussian modulation
In addition to the above experiments that utilized the selfreferenced technique for reconstruction of signal pulses in the presence of phase fluctuations and for characterization of the excess noise, we also performed the quantum components of an experimental secret key distribution using the SR-CV-QKD protocol.The QKD experiment was performed under a strong phase noise between Alice's signal-generating laser and Bob's LO.
We used a pseudo-random number generator based on the Mersenne twister for Alice's signal modulation and Bob's measurement axis selection.Each communication block consisted of 24,500 data points.Alice's pulse generation rate was 250 kHz; two thirds of these were identical reference pulses (used in the twin-reference-pulse mode), and one-third were signal pulses prepared in random Gaussian-modulated coherent states.Alice's Gaussian modulation variance was V A = 34, and mean quadrature values of reference pulses were (q A R , p A R ) = (30, 0), corresponding to V R /V A ≈ 26.47.Since the transmission was only across an optical table, T = 1.Accounting for detector efficiency, homodyne visibility, and imperfections in homodyne arm balancing, Bob's homodyne efficiency was estimated to be η = 0.719 on average, however due to fluctuating mode-matching and homodyne arm balancing conditions this efficiency can fluctuate ±0.1.
At each round (consisting of two reference pulses and one signal pulse), Bob estimated the phase difference between his and Alise's frames and communicated this estimate to Alice, who performed the compensation rotation on the tabulated random values of the signal pulse quadratures.
In each session, among the 24,500 pulses exchanged, 2000 were randomly selected for estimation of the covariance matrix between Alice's and Bob's measurements during the pa-rameter estimation stage.An example of such an estimated covariance matrix is: (43) Note that this covariance matrix corresponds to the prepareand-measure version of the protocol and thus differs from γ AB of Eq. ( 14).The theoretical form of γ pm AB is where we used the assumption of symmetric P(ϕ) to set sin ϕ = 0. We can achieve reasonably good agreement between this theoretical form and the experimentally reconstructed covariance matrix using the above values for V A , V R , and T , along with the calibrated values = 0.01 and V el = 0.01, and a value of homodyne efficiency at the upper limits of our calibrated range, η = 0.8, which yields the theoretical covariance matrix 34.000 0.000 30.389 0.000 0.000 34.000 0.000 30.389 30.389 0.000 28.218 0.000 0.000 30.389 0.000 28.218 Using the above parameter values, we also calculate mutual information bounds: I A B 2.37 bit/round, I EB ≤ 1.492 bit/round, and χ BE 1.742 bit/round (a round consists of three pulses, two reference and one signal).Assuming the reconciliation efficiency value of β = 0.95, the expected minimum key rates secure against individual and collective attacks are K min ind ≈ 0.759 bit/round and K min col ≈ 0.509 bit/round, respectively.Taking into account that SR-CV-QKD in the twin-reference-pulse mode utilizes three pulses per round, the key rates per physical pulse would be three times lower.Finally, with the pulse generation rate of 250 kHz, the expected minimum key rates are K min ind ≈ 63.26 kbit/s and K min col ≈ 42.45 kbit/s.

V. CONCLUSIONS AND DISCUSSION
We have developed a new protocol, SR-CV-QKD, that eliminates the need to transmit an LO.The removal of this demand dramatically simplifies the hardware required to perform CV-QKD and removes the most significant obstacles to developing integrated photonics implementations of CV-QKD transceivers.We thus believe that this new protocol will play a key role in enabling the miniaturization of CV-QKD hardware, which has the potential to significantly enhance the applicability of quantum communications.
In the reported experiments, we characterized the core new element of SR-CV-QKD, signal reconstruction through compensation of the drifting phase, and performed a proof-ofprinciple demonstration of key distribution using the new protocol.On the theory side, we computed expected key rates, secure under a passive Gaussian channel assumption.A principal feature of our security analysis is the consideration of the inherent quantum uncertainty of reference pulses.Crucially, we showed that, as the reference pulse amplitude increases, the key rate of SR-CV-QKD approaches that of conventional CV-QKD with LO transmission, but this rate can be achieved with much simpler hardware.
A way to view the difference between SR-CV-QKD and conventional CV-QKD is that while the latter physically transmits a reference frame (in the form of the LO), the former only transmits information about the reference frame.As a result, SR-CV-QKD is immune against many of the recently identified side-channel attacks that exploit detection using a publicly shared high-power LO [31,32].Of course, it remains to be seen whether new side channel attacks that target SR-CV-QKD are possible.
In this work, we focused on a version of SR-CV-QKD, in which Alice prepares signal and reference pulses in coherent states, and Bob performs a homodyne measurement on the signal pulse.More generally, it is possible (in analogy with a variety of conventional CV-QKD protocols [23]) to consider alternative versions of SR-CV-QKD.For example, Alice can prepare the signal pulse in a squeezed state, Alice can prepare a pair of reference pulses in orthogonal squeezed states, Bob can perform a heterodyne measurement on the signal pulse, Bob can perform a homodyne measurement of a random quadrature, and so on.
It should be noted that in classical optical communication based on coherent detection, reference laser pulses have been used as a direct phase reference for signal generation and phase noise cancellation and stabilization.In particular, in formats involving quadrature phase-shift keying and quadrature amplitude modulation, the self-homodyne detection (SHD) approach [33][34][35] makes use of dedicated pilot carrier pulses that are multiplexed with the signal pulses from the same laser to enable homodyne detection at the receiver.SR-CV-QKD is in the same spirit as these techniques, except that, unlike SHD, our protocol enables absolute amplitude and phase measurement in the low-photon-number regime with encoding and decoding capabilities across a continuous amplitude and phase variation in real-time.
Finally, we note that this new CV-QKD protocol was independently discovered by Qi et al., as recently reported in Ref. [25].Qi et al. present a complementary study of the protocol, including its implementation to perform key distribution over a 25 km link, which goes beyond our proofof-principle demonstration.In contrast, in this work, we focused on a comprehensive analysis of the fundamental limits of the protocol (expected secret key rate calculations taking into account the quantum uncertainty of reference pulses and accuracy of the phase estimation, in Sec.III), and characterization of the performance of the central new element in the protocol: phase drift compensation using reference pulses (in Sec.IV).These results, along with the demonstration in Qi et al. [25], establish SR-CV-QKD as a practical protocol with significant benefits in terms of hardware simplification and potential compatibility with integrated photonics.
Ongoing work in our laboratory is focused on increasing the transmission distance of the SR-CV-QKD link and increasing the stability and robustness of the transmitter and receiver components.We are currently making progress in understanding the root causes of, and stabilizing, this uncertainty.
For data collection and analog voltage generation for the EOMs, we used a commercially available data acquisition card (NI PCIE-6363), capable of reliably collecting multichannel data at 250 kHz.Since the analog output of this card has 1 MΩ impedance while the EOM's RF modulation input has 50 Ω impedance, we built in a fast unity-gain voltage follower to match the impedances.All data generation and collection were performed through Matlab's data acquisition toolbox based codes.

Appendix B: Device calibration with reference pulses
The technique of using reference pulses and phase estimation to compensate for phase drifts is valuable not only for running the CV-QKD protocol per se, but also for the calibration of Alice's and Bob's apparatus.Since CV-QKD operates at the limits of detection, it is vital to calibrate, and maintain calibration of, the modulators and homodyne detectors in the setup.Typically, this calibration is done locally by Alice and Bob to minimize security loopholes, and for this reason Alice's station should have homodyne/heterodyne detection capabilities and Bob's station should have pulse generation capabilities.In this appendix, we present a calibration task that Alice and Bob need to perform and show that it benefits greatly from the use of reference pulses and phase estimation.
It is critical that the phase induced by Alice's and Bob's phase EOM is well calibrated against the applied voltage; i.e., the actual phase modulation should correspond accurately to the random numbers generated by Alice, or the measurement axis chosen by Bob.In a long-running CV-QKD implementation, this calibration may have to be performed repeatedly since EOM characteristics can drift over time.The calibration requires performing a test phase modulation and measuring its value.The measurement is performed using a homodyne setup that utilizes an LO generated from the same master laser as the modulated pulse.As a result, this calibration requires precise knowledge of the path difference (which results in a relative phase shift) between the modulation path and the LO path.This path difference can fluctuate due to thermal effects and tracking it requires a considerable effort.
Noting that the calibration problem in the presence of a phase drift is very similar to the problem of establishing a common phase reference in CV-QKD, it is clear that we can alternatively use reference pulses to perform the EOM phase calibration.That is, during the calibration stage, each phasemodulated pulse is accompanied by a reference pulse (with no phase modulation).The procedure of heterodyne measurement and phase estimation on this reference pulse tells us what the reference zero phase modulation value is, and this can be used to recover the actual phase of the modulated pulse.
Figure 8(a) shows raw measured values for the phasemodulated pulse when the EOM voltage is swept from −3.5 V to 3.5 V, along with those for the accompanying reference pulse.Within this voltage range the EOM response is reasonably linear.The raw voltages show that the phase does drift over the timescale of the sweep.However, Fig. 8(b) shows that by estimating the drifting phase and compensating for it, one can obtain a clean calibration map between the applied voltage and the induced phase.

FIG. 3 .
FIG. 3. Expected minimum key rates for the SR-CV-QKD protocol, secure against (a) individual attacks and (b) collective attacks, as functions of the effective transmittance T eff = T η.The parameter values used are VA = 40, ε = 0.01, V el = 0.01 (all in shot-noise units), β = 0.95, δR = 1.As shown in the legend, different curves correspond to different values of the reference-pulse amplitude V 1/2 R FIG. 4. Phase drift estimation and compensation for constant signal pulses.Bob's measured voltages proportional to mean values of Q quadrature (blue dots) and P quadrature (red dots) for (a) reference pulses and (b) signal pulses.(c) Estimated values θ of the phase difference between Alice's and Bob's frames.Each data point is calculated as in Eq. (4) using mean quadrature values qB R and pB R obtained from sequential homodyne measurements on a pair of twin reference pulses.(d) Mean values of Q quadrature (blue dots) and P quadrature (red dots) for signal pulses, after a rotation by the angle − θ to compensate for the phase drift.

FIG. 5 .
FIG. 5.The phase-space representation of reconstructed signal pulses after phase drift compensation.

FIG. 7 .
FIG. 7. The variance of the reconstructed signal data as a function of the phase-space location.

FIG. 8 .
FIG. 8. In-situ calibration of a phase EOM using reference pulses and phase drift compensation.(a) Raw data collected while the modulation voltage is swept from −3.5 V to 3.5 V within the time window (5-58 ms); red: in-phase value of the reference pulse, magenta: quadrature value of the reference pulse, blue: in-phase value of the phase-modulated pulse, cyan: quadrature value of the phasemodulated pulse.(b) The calibration curve between the applied voltage and the induced phase after phase drift compensation; blue dots: calibration data, red line: polynomial fit.