Asymptotic security of discrete-modulation protocols for continuous-variable quantum key distribution

We consider discrete-modulation protocols for continuous-variable quantum key distribution (CV-QKD) that employ a modulation constellation consisting of a finite number of coherent states and that use a homodyne-detection receiver. We establish a security proof for arbitrary collective attacks in the asymptotic regime, and we provide a formula for an achievable secret-key rate. Previous works established security proofs for Gaussian-modulation CV-QKD protocols or for discrete-modulation protocols with two or three coherent states. The main constituents of our approach include approximating a complex, isotropic Gaussian probability distribution by a finite-size Gauss-Hermite constellation, applying entropic continuity bounds, and leveraging previous security proofs for Gaussian-modulation protocols. As an application of our method, we calculate secret-key rates achievable over a pure-loss bosonic channel. Our results indicate that in the high-loss regime the achievable key rates scale optimally, i.e., proportional to the channel's transmissivity, and approach that achieved by a Gaussian-modulation protocol as the constellation size is increased.


I. INTRODUCTION
Quantum key distribution (QKD) allows for two distant parties, often called Alice and Bob, to create a shared secret key by employing an insecure and noisy quantum communication channel and an authenticated public classical communication channel [1][2][3]. The security is based on the physical laws of quantum mechanics, in contrast to conventional cryptographic protocols, whose security relies on computational complexitytheoretic assumptions.
There are two basic classes of QKD protocols that have been considered: discrete-variable and continuousvariable (see, e.g., [3] for a review).
In discretevariable QKD (DV-QKD), the information is usually encoded in the polarization or time bin of single photons or weak coherent states (laser-light pulses). Discretevariable QKD requires high-efficiency, low dark-countrate, single-photon detectors, which are expensive and often need extreme cryo-cooling. In the other class of protocols, known as continuous-variable QKD (CV-QKD), the information is encoded in the quadrature amplitudes of coherent states. The transmitter modulates the phase and/or the amplitude of laser-light pulses, and the receiver is based on coherent detection (i.e., homodyne or heterodyne detection). Near shot-noise-limited, low-noise homodyne detection is readily realizable at room temperature using off-the-shelf hardware, unlike the single-photon detectors of DV-QKD. CV-QKD protocols thus possess a major advantage over DV-QKD in terms of the cost and ease of experimental implementation.
However, one major area that DV-QKD currently possesses an advantage over CV-QKD is that the DV modulation involves few levels (e.g., two polarization states of a photon or three amplitude levels of a coherent state in the decoy-state BB84 protocol [4][5][6]), which puts far less burden on the transmitter's modulator compared to that of the traditional Gaussian-modulation CV-QKD protocol. The latter requires modulation using an infinite-size constellation. This also makes the error correction protocols far simpler for DV-QKD, along with much less overhead for random-number generation. Another area where DV-QKD is arguably more advanced is the availability of quantum repeater protocols [7][8][9][10][11] for overcoming the fundamental rate-vs.-loss trade-off of direct-transmission based QKD [12][13][14]. However, there have been recent advances in designs of repeaters for CV-QKD [15][16][17].
In the most common form of CV-QKD, one uses Gaussian modulation of coherent states [18]: Alice modulates laser-light pulses with amplitudes selected randomly from a complex-valued Gaussian distribution with a given variance. Security proofs for this Gaussian modulation CV-QKD protocol have been developed for arbitrary attacks, even in the finite key-length regime [19]. Additionally, a suite of variants of this CV-QKD protocol exist, some of which use squeezed light modulation and two-way transmission [20][21][22][23][24][25][26][27][28]. However, all of their asymptotic security proofs require a Gaussian modulation. Gaussian modulation has obvious drawbacks, which include extreme burden on the transmitter's random number source, as well as computationally demanding and inefficient errorcorrection techniques. Furthermore, no matter how high the extinction ratio of a practically-realizable electro-optic modulator, it is impossible to sample pulse amplitudes from a true Gaussian distribution, on which the security proofs rely.
Despite the fact that Gaussian modulation has made security proofs manageable, it is important-for the practical realizability of CV-QKD-that protocols that use a few pre-determined modulation levels (such as binary phase and quadrature amplitude modulation) are proven secure. Discrete-modulation CV-QKD was introduced in [29][30][31], where the coherent states transmitted in each mode are chosen according to a discrete probability distribution, and it was developed further in [32]. Discretemodulation CV-QKD protocols can leverage the efficient modulation and error correction, and low-overhead random number generation that DV-QKD enjoys, while retaining the ease of implementation of homodyne detection of CV-QKD.
Several discrete-modulation protocols have already been considered [32][33][34][35], and security proofs have been developed in the asymptotic regime, i.e., in the limit of a large number of uses of the quantum channel, hence generating a large-length key (at a given key-bits per channel-use rate). Ref. [32] considered a protocol with binary-phase shift-keying of coherent states along with homodyne detection. However, the secure key rate established there is more than an order of magnitude lower than that which can be achieved with Gaussian modulation. Motivated by [32], Ref. [33] considered ternary-phase shift-keying modulation with homodyne detection, which led to an improvement in the secure key rates, but the resulting secret-key rates are still far from the key rates achievable with Gaussian modulation. Refs. [34,35] established security for discrete-modulation protocols against particular collective attacks that correspond to linear bosonic channels.
This brings us to the long-standing open problem of proving security of a general M -ary discrete-modulation CV-QKD protocol, for M beyond a minimum threshold value, with the feature that the achievable key rate approaches that of Gaussian modulation as M goes to infinity. Such a result is of significant value for the practical usability of CV-QKD. In this paper, we accomplish the aforesaid for security against collective attacks. Establishing a security proof and key-rate lower bounds for discrete modulation CV-QKD protocols with a finite key length is left open for future work. Our proof eliminates the need to consider protocols based on Gaussian modulation in order to have asymptotic security in CV-QKD, with the ability of the user to determine the size of the modulation alphabet based on how close one desires the key rates to be to the Gaussian modulation protocol. In addition, our numerical evaluation of achievable key rates over a pure-loss bosonic channel suggests that, for sufficiently large constellation size, the achievable key rates are proportional to the channel's transmissivity, which is known to be the optimal rate-vs.-loss scaling achievable with any QKD protocol, CV or DV [12]. To establish these results, we make use of two important recent the-oretical advances: the approximation of Gaussian distributions with discrete ones for communication [36,37], especially in the context of bosonic Gaussian states [37], and an entropic continuity bound from [38] for energybounded bosonic states. The idea of approximating a Gaussian modulation with a discrete one for CV-QKD was proposed in [39], but this work did not provide a security proof for CV-QKD with discrete modulation. One of the main tools, beyond the approaches considered in [39] and which allows us to establish a security proof, is the entropic continuity bound from [38]. We also develop methods for using the parameters observed in a discrete-modulation CV-QKD protocol to bound Eve's Holevo information.
This paper is organized as follows: we introduce discrete-modulation CV-QKD in Section II, followed by Section III's detailed list of our assumptions on the collective attack of Eve. We give our security proof in Section IV, and we discuss details of channel estimation in Section V. We then showcase, in Section VI, the secure key rates that our approach lead to when the protocol is conducted over a pure-loss bosonic channel. We end with open questions and future directions in Section VII.

II. PROTOCOL
We begin by outlining the steps of a phasesymmetrized discrete-modulation CV-QKD protocol based on m 2 coherent states and homodyne detection, where m ∈ N. Let X be a random variable with realizations x ∈ {1, 2, . . . , m 2 } and fix α x ∈ C for all x. Let r(x) be the probability associated with the realization x. The steps of the protocol are as follows: 1. Alice prepares the coherent state |α x with probability r(x). She records the value of x in the variable x j , where j ∈ {1, . . . , n} refers to the transmission round. She also records the value √ 2 Re{α x } in the variable q j . Exact expressions for α x and r(x) that we use in the protocol are given in Section V.
2. Alice then picks a phase φ j ∈ {0, π/2, π, 3π/2} uniformly at random, applies it to her channel input mode as the unitary e −inφj , which is physically realized by a phase shifter. The resulting state is then e −inφj |α x = α x e −iφj , which she transmits over the unknown and insecure quantum communication channel N to Bob. At the same time, she communicates the choice φ j to Bob over a public authenticated classical channel and then she locally discards or forgets the choice of φ j . The insecure quantum channel N can be controlled by an eavesdropper Eve. Our assumptions on the insecure quantum channel N are stated in Section III.
3. Upon receiving the output of the quantum channel, namely, the state N (e −inφj |α x α x |e inφj ), as well as the classical choice of φ j from the public authenticated classical channel, Bob applies the reverse phase as the inverse unitary e inφj , and then locally discards or forgets the value of φ j . The resulting state is then as follows: where the phase-symmetrized channel N is defined as with U (k) = e −inπk/2 . The phase symmetrization of the channel N is helpful in reducing the number of parameters that need to be estimated during the channel estimation part of the protocol, as we explain in Section V.
4. Bob then performs position-quadrature or realquadrature homodyne detection on the state N (|α x α x |) and records the result in the variable y j [40].

5.
Steps 1-4 are repeated n times, for n a large positive integer, leading to the sequence {q j } n j=1 , known to Alice, and the sequence {y j } n j=1 , known to Bob. 6. A constant fraction δ of the rounds are used for channel estimation (or parameter estimation), for δ ∈ (0, 1) a small number. That is, for these δn rounds, the following parameters are calculated: where Clearly, the parameter γ 11 can be calculated from Alice's data alone, γ 22 can be calculated from Bob's data alone, but it is necessary to calculate γ 12 from both Alice and Bob's data, and so it is necessary for Bob to share the y j values of these δn rounds with Alice over a public authenticated classical channel. Furthermore, the public authenticated classical channel is used for Alice and Bob to share the values of γ 11 , γ 12 , and γ 22 with each other. The data x j , q j , and y j for these δn channel estimation rounds are then discarded. A detailed analysis of the channel estimation part of the protocol is given in Section V.
7. The remaining x j and y j data are used for final key generation. The final key-generation protocol includes reverse reconciliation, error correction, and privacy amplification (see [3] for a review).

III. ASSUMPTIONS ON THE INSECURE QUANTUM COMMUNICATION CHANNEL
In this section, we outline the various assumptions that we make on the insecure quantum communication channel: 1. Each Alice-to-Bob transmission is assumed to take place over independent identical uses of a quantum channel N , which is unknown to Alice and Bob at the beginning of the protocol. We assume that any deviation of N from the identity map is attributed to the most general adversarial action by Eve. Even though Eve's action-which appears as a noisy quantum channel N to Alice and Bobremains the same for each transmission, she is allowed to make arbitrary collective measurements on her quantum system at the end of the protocol. See below for a mathematical description. This scenario is referred to as a collective attack.
2. The channel is described mathematically as an isometric quantum channel U A→BE , meaning that there exists an isometry U A→BE , satisfying for all input density operators ρ A . The systems A, B, and E are described by separable Hilbert spaces H A , H B , and H E , respectively. The system A corresponds to a single bosonic mode, and system B does also. In particular, the channel can accept coherent states at the input A and is such that the receiver can perform homodyne detection on the system B. The system A is accessible to the sender Alice, the system B is accessible to the receiver Bob, and the system E is in possession of the eavesdropper Eve.
3. The reduced channel from Alice to Bob is given by consists of several bosonic modes E 1 , . . . , E k , then H E could be taken as the total photon number operator n 1 + · · · +n k for all of the k modes.
We note that an immediate consequence of the bounded mean photon number assumption in part three above, by applying the Cauchy-Schwarz inequality, is the following: If Alice inputs a state ρ A with finite mean vector [ q ρ , p ρ ], then the output mean vector for the state of system B is finite. If the input state ρ A has a finite covariance matrix with entries given by whereq 0 ≡q− q ρ andp 0 ≡p− p ρ , then the covariance matrix of the output state N A→B (ρ A ) is finite.

IV. SECRET-KEY RATE LOWER BOUND
The asymptotic secret-key rate K is bounded from below by the Devetak-Winter formula [44,45] as In the above inequality, the Shannon mutual information between Alice's variable X and Bob's variable Y is denoted by I(X; Y ), and the Holevo information between Bob's variable Y and Eve's quantum system E is denoted by I(Y ; E). We suppose that the quantum channel connecting Alice to Bob is not known, satisfies the assumptions given in Section III, and can only be partially estimated from X and the measurement outcomes Y on Bob's side, as we discuss in Section V. This lack of knowledge is an advantage to Eve. Therefore, the inequality in (10) features an optimization of the Holevo information I(Y ; E) over all isometric quantum channels U A→BE of Eve that are compatible with Alice's and Bob's data. Let S be the set of channels that are consistent with the measurement data. We discuss the precise meaning of this statement in Section V. We also suppose that reverse reconciliation [46] is being used in the key-generation protocol, in which the public classical communication is from Bob to Alice, and this accounts for Bob's variable Y appearing in the I(Y ; E) term in (10).
To calculate the lower bound in (10), we first need to calculate the Shannon mutual information I(X; Y ), which can be easily obtained from the observed data of Alice and Bob. The main difficulty is then to perform the optimization over the isometric quantum channels U A→BE of Eve and to bound the Holevo information I(Y ; E) from above. Doing so is the main bottleneck for many security proofs in quantum key distribution.
For protocols involving Gaussian modulation of coherent states, the aforementioned problem was solved in [47,48], with [47] relying on the techniques of [49]. The optimal attack by Eve for such protocols was proved to be a Gaussian attack, which considerably simplifies the security analysis. However, once we consider discretemodulation protocols, the optimal attack by Eve is no longer known, and is unlikely to be Gaussian. To address this problem, novel techniques are required.
In this paper, we provide a security proof for the protocol described in Section II by employing various existing tools: the approximation of Gaussian distributions with discrete ones [36,37], an entropic continuity bound from [38], and the optimality of Gaussian attacks for Gaussian modulation of coherent states [47,48]. The approach that we employ in this paper is rather intuitive: we approximate the Gaussian distribution with a discrete distribution and bound the error introduced due to this approximation in trace norm, by employing the techniques of [36,37]. Then, we expect Eve's Holevo information due to this approximation to be close to Eve's Holevo information resulting from a Gaussian-modulated protocol, with the absolute value of the difference being a function of the error introduced in the approximation.
We now discuss this approach in detail. First, consider a key-generation protocol that employs coherent states with Gaussian modulation. The expected density operator for Alice's transmitted state is a thermal state θ(N S ) with mean photon number N S ≥ 0: The P -function of the thermal state θ(N S ) is a circularly symmetric complex Gaussian [50]. Following the approach of [37], we can approximate the real and imaginary parts of the circularly symmetric Gaussian by the various constellations considered in [36]: Gauss-Hermite, random walk, equilattice, and quantile. The type of constellation fixes |α x and r(x). In this paper, we focus exclusively on the Gauss-Hermite constellation. It is possible to consider other constellations and obtain security proofs for these other constellations using the techniques described below. We obtain the error introduced by this approximation, by employing bounds from [37], and then we apply an entropic continuity bound from [38] to obtain an upper bound on Eve's Holevo information I(Y ; E). We now discuss our security proof for discretemodulation protocols of the form presented in Section II. Suppose that Alice employs the following discretemodulation ensemble of coherent states: with expected density operator: Then depending on the constellation size m 2 and the mean photon number N S of the thermal state being approximated, we obtain the following bound on the normalized trace distance: where θ(N S ) is a thermal state of mean photon number N S and ε(m, N S ) is the approximation error, for which we determine an explicit characterization later in (76), by employing the techniques of [37]. The secret-key rate with reverse reconciliation is given by where β is the reconciliation efficiency [51] and the mutual information quantities are computed with respect to the following ensemble: where with {Λ y } y denoting Bob's POVM and U A→BE the isometric channel satisfying the assumptions of Section III and corresponding to the collective attack of Eve. Since we do not know what collective attack Eve will employ, we minimize the secret-key rate with respect to all collective attacks that are consistent with the measurement data observed by Alice and Bob, i.e., with respect to all isometric channels U A→BE satisfying the assumptions of Section III and in the set S. It is possible to estimate the Shannon mutual information I(X; Y ) from the measurement data of Alice and Bob, but we are left with the following optimization problem for Eve's Holevo information: where the optimization is with respect to all collective attacks of Eve consistent with the measurement data of Alice and Bob, and the subscript notation E ρ indicates that the Holevo information I(Y ; E) between Bob's measurement outcome and Eve's quantum system is being computed with respect to the following ensemble: where From the data processing inequality for trace distance (under the action of the isometric channel U A→BE and Bob's measurement channel), we find that where (27) We then define the following ensemble as that which would arise had Alice employed a Gaussian modulation at the channel input: At this point, we invoke the fourth assumption from Section III: if the mean energy of the input state to the channel Tr B •U A→BE is fixed at some finite mean photon number κ ∈ [0, ∞), then the mean energy of the output state is no larger than κ (κ) ∈ [0, ∞). Supposing that H E is the Hamiltonian for Eve's system E satisfying the properties stated in the fourth assumption from Section III, by applying the continuity bound given in [38,Proposition 27], we find that where P is an upper bound on the mean energy of the states Tr B •U A→BE (ρ A ) and Tr B •U A→BE (θ(N S )) and f (ε, P ) is a function of ε and P , given in [38], with the property that In particular, the function f (ε, P ) is given by for any t ∈ (0, 1 2ε ], where and S(θ E (P/εt)) is the entropy of a thermal state θ E (P/εt) of Eve's system with mean energy P/εt. Due to this uniform bound, we can then apply suprema to find that with the optimizations again taken with respect to collective attacks of Eve consistent with the measurement data of Alice and Bob. The lower bound on the key rate is then given as The Shannon mutual information between X and Y , i.e., the term I(X; Y ), can be calculated from the observed data, as mentioned previously. The term f (ε, P ), introduced due to the continuity of Holevo information, can be estimated from (31). Obtaining an upper bound on the remaining term, the Holevo information sup U A→BE ∈S I(Y ; E) E θ , still requires further development, which we detail in the next section.

V. CHANNEL ESTIMATION
The main objective of this section is to obtain an upper bound on the remaining term, the Holevo information sup U A→BE ∈S I(Y ; E) E θ . The approach that we take to obtain an upper bound can be divided into three parts: estimation of parameters from the actual protocol described in Section II, using these to bound the parameters that would result if a Gaussian-modulation protocol had been employed instead, and finally using these last estimates to bound the Holevo information sup U A→BE ∈S I(Y ; E) E θ from above.

A. Estimation of parameters from the actual discrete-modulation protocol
Alice and Bob calculate the parameters γ 11 , γ 12 , and γ 22 given in (3)-(5) of the sixth step of the protocol, as described in Section II. Then the set S discussed in Section IV consists of all of the isometric channels U N A→BE that are consistent with the calculated values of γ 11 , γ 12 , and γ 22 . In this way, Alice and Bob characterize the attack by Eve.
Since we are operating in the asymptotic regime, such that the number n of rounds is large, it follows that the number δn of channel estimation rounds is also large. Additionally, since Eve is employing a collective attack and the protocol has an i.i.d. structure, it follows that the parameters γ 11 , γ 12 , and γ 22 are given exactly as the expectation of particular random variables.
To determine these random variables, we now give exact expressions for the constellation {α x } m 2 x=1 and distribution r X (x) that are used in the protocol. We begin by recalling the Gauss-Hermite approximation to the normal distribution with zero mean and unit variance, which reproduces the first 2m − 1 moments of the Gaussian distribution [52,Section 3.6]. Let H m be the mth Hermite polynomial, and let L m be a random variable with m realizations l wm , with probability distribution given by r Lm (l wm ), where w ∈ {1, 2, . . . , m}. Then, as defined in [36], the values l wm are set to the roots of the Hermite polynomial H m , and the probability distribution r Lm (l wm ) is defined as .
The P -function of a thermal state with mean photon number N S is a circularly symmetric complex Gaussian [50]. Following [37], we approximate the real and imaginary parts of the thermal-state P -function individually by the constellation described above. Specifically, we choose q wm for w ∈ {1, . . . , m} such that the sequence {q wm / √ N S } w is equal to the zeros of the Hermite polynomial H m , and we choose p tm for t ∈ {1, . . . , m} such that the sequence {p tm / √ N S } t is equal to the zeros of the Hermite polynomial H m . Then the constellation is given by the following distribution: where x = (w, t) ∈ {1, . . . , m} × {1, . . . , m}. The factor √ N S is a scaling factor incorporated so that the mean photon number of the expected density operator for the resulting constellation is equal to the mean photon number of the thermal state θ(N S ).
Let Q A denote the discrete random variable with realizations q A ∈ R, taking values q wm and having a probability distribution as detailed above. Let Q B denote the random variable associated to Bob's homodyne measurement outcome of the position-quadrature operator, taking values in R. Then, for characterizing the isometric channels U A→BE in S, Alice and Bob calculate the parameters γ 11 , γ 12 , and γ 22 from their data. Due to the fact that we are operating in the asymptotic regime (with no finite-size statistical effects), the following equalities hold As stated previously, Alice estimates γ 11 from her preparation data, while Bob estimates γ 22 from his measurement data. Alice calculates γ 12 from the data that is publicly published by Bob. Then S is the set of isometric channels U A→BE that fulfill the constraints in Section III and produce the observed values of γ 12 and γ 22 . As a consequence, Alice and Bob deduce that the attack by Eve yields the observed values of γ 22 and γ 12 . In this way, they are able to restrict the possible attacks that could have been performed by Eve.

B. Estimation of parameters for a hypothetical Gaussian-modulation protocol
Now notice that the remaining Holevo information sup U A→BE ∈S I(Y ; E) E θ from (36) that we want to bound from above is calculated for a thermal state θ(N S ) sent over an isometric channel U A→BE in the set S and Bob performing homodyne detection of the position quadrature. Therefore, we want to obtain an estimate of the parameters γ G 11 , γ G 12 , and γ G 22 , which are defined analogously to (42)- (44), but with the initial random variable Q A replaced by a Gaussian random variable with mean zero and variance equal to N S . The parameters γ G 11 , γ G 12 , and γ G 22 are those that would be observed in a Gaussian modulation protocol when the average channel input of Alice is a thermal state θ(N S ) instead of ρ.
In order to bound the values of the parameters that would be obtained in a Gaussian-modulation protocol with Eve's attack taken from the set S, we can employ the parameters that are observed in the discretemodulation protocol. Before we do so, let us recall the definition of the χ 2 divergence of two states ρ and σ as χ 2 (ρ, σ) ≡ Tr (ρσ −1/2 ) 2 − 1 [53]. Then we have the following proposition: where r G (x) is the P -function for a thermal state with mean photon number N S . If χ 2 (ρ, θ(N S )) ≤ ε 2 and Eve's attack U N A→BE fulfills the constraints in Section III, then, where for some constants c 1 , c 2 > 0.
The proof relies mainly on the properties of trace distance, invoking the Cauchy-Schwarz inequality and the assumption that the fourth moment of the channel output is bounded. For details, please refer to Appendix A. By invoking Proposition 1, we conclude that γ G 22 ∈ [γ 22 − ε 1 , γ 22 + ε 1 ], and γ G 12 ∈ [γ 12 − ε 2 , γ 12 + ε 2 ], where ε 1 and ε 2 are defined above. Now, consider the following scenario corresponding to an entanglement-based (EB) QKD protocol: Alice prepares a two-mode squeezed vacuum state ψ(n) RA withn ≥ 0. She applies a phase e −inπk/2 to her channel input mode A, with k ∈ {0, 1, 2, 3} selected uniformly at random, and she sends the system A to Bob over an isometric channel U N A→BE selected from the set S. She also communicates k to Bob over an authenticated public classical channel. Bob then applies the inverse phase e −inπk/2 . Both Alice and Bob then discard the value of k. Let ρ RB denote the state shared by Alice and Bob at the end, so that the reduced channel N A→B has been phase symmetrized due to the protocol above and with N A→B defined as in (2): Due to the symmetries of the two-mode squeezed vacuum state ψ(n) RA as well as those of the phase-symmetrized channel N A→B , it follows that the covariance matrix of the state ρ RB has the following form: where γ EB 11 , γ EB 12 , γ EB 22 ∈ R such that the above is a legitimate quantum covariance matrix [54], the matrix I 2 is the 2 × 2 identity matrix, and is a rotation matrix. See Appendix B for a proof of this claim. In what follows, we assume that θ = 0, due to the fact that doing so simplifies the protocol, as well as reducing the number of parameters that need to be estimated, and it furthermore does not lead to an increase in Eve's Holevo information, as discussed in [19]. Alice then performs a heterodyne measurement on mode R and Bob performs a homodyne measurement on mode B. As mentioned above, this is the entanglement-based (EB) version of the Gaussian-modulated prepare-measure (PM) protocol with the attacks by Eve constrained to the set S. Now, we want to deduce the parameters γ EB 11 , γ EB 12 , γ EB 22 observed in the EB protocol from the parameters γ G 11 , γ G 12 , γ G 22 observed in the PM version of the Gaussian modulation protocol. As is common in the CV-QKD literature, we consider the EB protocol because it is helpful in analyzing the Holevo information I(Y ; E) that results in the prepare-measure (PM) protocol. The "PM to EB" mapping of the parameters is well known in the literature [55] and is given as follows: Let Σ denote the set of quantum states ρ RB that have covariance matrix of the following form: (60)

C. Upper bound on Eve's Holevo information
By applying purification techniques of quantum information theory, the following equality holds for ρ RB the state in (54) and {p(y), ρ y R } y the ensemble resulting from Bob performing a positionquadrature homodyne detection on the state ρ RB .
As a consequence, the task of obtaining an upper bound on sup U A→BE ∈S I(Y ; E) E θ can be accomplished by obtaining an upper bound on sup ρ RB ∈Σ H(RB) ρ − H(R|Y ) {p(y),ρ y }y .
We then invoke the extremality of Gaussian states [47,49], from which we infer that the Holevo information is optimized by a Gaussian state ρ G RB having the same covariance matrix as ρ RB . Therefore, we obtain the following: where {p G (y), ρ y,G R } is the ensemble obtained if Bob performs a homodyne measurement on mode B of ρ G RB . Then, Eve's Holevo information can be calculated as follows: where the function g(·) is defined in (33), ν 1 and ν 2 are the symplectic eigenvalues of the covariance matrix in (60), and ν 3 = γ EB 11 γ 11 − (γ EB 12 ) 2 γ EB 22 +1 . Numerical checks, similar to those performed and stated in [19], reveal that the Holevo information is a monotonically decreasing function of γ EB 12 , and a monotonically increasing function of γ EB 11 and γ EB 22 . Intuitively, the correlations between Alice and Bob are quantified by γ EB 12 , so that increasing this parameter decreases Eve's Holevo information. Therefore, we conclude that the Holevo information is no larger than that achieved by a Gaussian state ρ RB that has a covariance matrix as follows: With this, we conclude our goal of obtaining an upper bound on the remaining term sup U A→BE ∈S I(Y ; E) E θ .

VI. NUMERICAL RESULTS FOR A PURE-LOSS BOSONIC CHANNEL
We now proceed with calculating the various terms in (36) for a Gauss-Hermite constellation of size m 2 and for a pure-loss bosonic channel of transmissivity η ∈ [0, 1]. This allows for determining the performance of the discrete-modulation CV-QKD protocol when the underlying channel is a pure-loss channel (however, keep in mind that Alice and Bob are not aware of this when executing the protocol).
The first term that we need to calculate is the Shannon mutual information I(X; Y ). Here, X is a random variable that encodes the choice of coherent state, and Y is the random variable that is associated with the measurement result. The Wigner function associated with the coherent state |α x subjected to a pure-loss channel with transmissivity η is given as where z = q B + ip B , with the real part q B corresponding to the position-quadrature phase-space variable, and the imaginary part p B corresponding to the momentumquadrature phase-space variable. Bob performs homodyne detection with respect to the q B quadrature, which provides the raw data for key generation. Then the various probability distributions are given as With this information in hand, it is easy to calculate  [13,14], which bounds the secret-key rate of any repeaterless quantum key distribution protocol conducted over a pure-loss bosonic channel.
The second term that we need to calculate is the Holevo information sup U A→BE ∈S I(Y ; E) E θ for a keygeneration protocol that uses Gaussian-modulation of coherent states and homodyne detection. To this end, we need to calculate the parameters γ 11 , γ 22 , and γ 12 for the discrete-modulation protocol in order to obtain the covariance matrix in (64). These can be calculated numerically. However, note that θ(N S ) and ρ have the same covariance matrix, due to the second moment of the Gauss-Hermite approximation and Gaussian distribution being the same. Since we are considering the underlying channel as a pure-loss channel, we can calculate the parameters γ 22 and γ 12 that would be observed by Alice and Bob during the protocol. To do so, we follow the calculation given in detail in Section 7 of [55].
When applying Proposition 1, it is necessary to make a choice for the parameters c 1 and c 2 . In our example considered here, we take the conservative choice of c 1 = c 2 = 100. Let us emphasize that the interpretation of this choice is that the parameters 2 ] that would be observed in a hypothetical Gaussian modulation protocol are no larger than 100 times those observed in the discrete modulation protocol. One could certainly criticize this choice and demand that higher values of c 1 and c 2 be chosen. However, we note that it is always possible for Alice and Bob to overcome more conservative choices and achieve the same secret key rates simply by taking the constellation size to be higher than that considered in our example.
Let us denote an additive white Gaussian noise channel with signal to noise ratio s by W s . The action of W s is defined as W s (Z) = √ sZ + G, where G is a normally distributed random variable with unit variance. Then, for Z ∼ N (0, 1) with distribution P Z , a random variable Z m with distribution P Zm as given in (37), Y = W s (Z), and Y m = W s (Z m ), the χ 2 distance is given as with 2κ 2 ≈ 2.36 [36]. Let and θ N S be a thermal state of mean photon number N S . Then with s = N S / N S (N S + 1) − N S [37] and Combining (69) and (72), we obtain the following expression for the approximation error: We can then invoke [38,Proposition 27], which utilizes some techniques from [43], to obtain f (ε, N S ) = ε (2t + r ε (t)) g(P/εt) + 2g(εr ε (t)) + 2h(εt), (77) In the above, we have set P = 10 7 , which is an extremely conservative choice to employ with respect to the fourth assumption on Eve's attack discussed in Section III. We have also supposed that Eve's system is a harmonic oscillator. Even though the mean photon number of the average input state in all example cases that we consider in what follows is many orders of magnitude smaller than P = 10 7 and the actual physical channel being employed is a pure-loss channel, we can still suppose that the mean energy of the eavesdropper's states is extremely large (way beyond what an eavesdropper might reasonably employ in an attack) and we find that the performance of the discrete-modulation protocols approaches that of the Gaussian-modulation protocol relatively quickly as the constellation size m 2 increases. One could choose an even more conservative value for P , higher than what we have taken. However, in our numerics, we have found the same qualitative behavior: that the performance of the discrete-modulation protocol rapidly approaches that of the Gaussian-modulation protocol as the constellation size m 2 increases.
With all these ingredients in hand, we can now numerically evaluate (36) to obtain a lower bound on the secret-key rate for a pure-loss channel with transmissivity η. We take the reconciliation efficiency β = 0.98. Note that the key rates obtained from (36) have a dependence on the mean photon number N S of the input state. Thus, to obtain tight lower bounds on the secretkey rate, we also optimize over N S .
In Figure 1, we present the main results of our analysis. We plot lower bounds for various values of m 2 and compare the obtained lower bounds with the Gaussianmodulation protocol. It is clear that the secure key rate of the discrete-modulation protocol increases as the constellation size m 2 increases.
As explained before, to obtain the lower bound on the rates given in Figure 1, we optimize over the mean photon number N S . For the Gaussian-modulation protocol, we find that the optimal variance for secret-key rates decreases with the increase in loss. Now, the main idea behind the technique presented in this paper is to discretize the Gaussian probability distribution by a finite constellation of size m 2 and calculate the error introduced due to this approximation. We find that as the variance of the Gaussian modulation increases, the number of constellation points required to approximate the distribution to an ε error increases. Therefore, for low losses, this technique requires a large number m 2 of constellation points to closely match the secret key-rates obtained with Gaussian modulation.
A consequence of the aforementioned reasoning is that, with our approach, the lower bound on the secret-key rate does not tend to log m 2 in the limit as η → 1. Certainly, in this limit, the Holevo information with Eve tends to zero, and the key rate is then given as K ≥ I(X; Y ) − f (ε, N S ). We numerically observe that the Shannon mutual information of Alice and Bob saturates towards log m 2 with the increase in variance; however, the approximation error f (ε, N S ) increases with the increase in variance. Due to this trade-off, our technique does not achieve the ideal rate of log m 2 rate in the lowloss limit.
It is possible (and likely) that our rate lower bounds can be improved by other constellation choices or other proof techniques. However, even with our proof, requiring a pair of electro-optic (phase and amplitude) modulators to generate a 90 × 90 size constellation size is much more practical and less demanding compared to asking that we modulate a pulse with a complex amplitude to an extremely high floating point accuracy, which a Gaussian modulation would need.
We note here that we have included in the arXiv posting of this paper the Mathematica files used to perform the numerical calculation of the key rates and to generate Figure 1. We also note here that a similar approach can be used to evaluate secure key rates achievable over a thermal bosonic Gaussian channel.

VII. CONCLUSION
In this paper, we have addressed a long-standing open problem in continuous-variable quantum key distribution (CV-QKD), by establishing a security proof for discretemodulation protocols. Even though many experiments have been performed on discrete-modulation CV-QKD with multiple constellation points (see, e.g., [56][57][58]), no security proofs have been available for them, and the expected key-rate calculations reported based on measured homodyne statistics have been based on assuming Gaussian attacks, which are not known to be optimal for discrete-modulation CV-QKD. We have introduced a discrete-modulation protocol and then obtained rigorous lower bounds on the secret-key rates, secure against collective attacks in the asymptotic key-length regime. The approach that we have used works well in the highloss regime, with the secure key rates being close to the secure key rates achievable with a Gaussian-modulation protocol. Another prominent feature of our approach is that with the increase in the size m 2 of the constellation, the lower bound on the secret-key rate approaches the key rate for the Gaussian-modulation protocol. This result demonstrates that we need not consider the full continuum of the Gaussian distribution in order to obtain key rates achievable with a Gaussian modulation, and we do not need to rely on Gaussian modulation for security proofs of discrete-modulation CV-QKD protocols.
Going forward from here, it is a pressing open question to determine security proofs for discrete-modulation CV-QKD protocols in the non-asymptotic, or finite keylength, regime. It would also be ideal to improve the bound from Proposition 1 to reduce or eliminate its dependence on the parameters c 1 and c 2 .
Note Added : After the first version of our paper was posted to the arXiv [59], the first version of the GGDL19 paper [60] appeared, which discussed a semi-definite programming approach for security of a four-state discretemodulation CV-QKD protocol. The GGDL19 approach was later extended to include discrete-modulation CV-QKD protocols that have an arbitrary number of states, at the expense of an increased complexity of the semidefinite program [61,62]. The second version of our paper (this version) was then posted to include more details of the channel estimation part of our protocol and security proof. In light of the fact that our approach gives a security proof and good performance for large constellation sizes and the approach of GGDL19 gives the same for small constellation sizes, we view our approach and the GGDL19 one as being complementary.

ACKNOWLEDGMENTS
We are grateful to Hari Krovi for discussions about CV-QKD with discrete modulation. We are especially grateful to Anthony Leverrier for his critical reading of the initial version of our paper and for pointing out the need for more details of the channel estimation procedure. We thank Jeffrey H. Shapiro and Xiang-Bin Wang for helpful feedback on our manuscript. This work was supported by the Office of Naval Research program Communications and Networking with Quantum Operationally-Secure Technology for Maritime Deployment (CONQUEST): Raytheon BBN Technologies prime contract number N00014-16-C2069, under subcontracts to Louisiana State University and University of Arizona.
Proof. For simplicity, we prove the claim under the assumption that all random variables have zero mean, and we note that it can be generalized by adopting a shift of the variables involved in the proof.
To prove the equality in (85), consider the following: γ 11 is equal to the variance of the position quadrature that is encoded by Alice during the preparation procedure. Since we are using the Gauss-Hermite approximation of the Gaussian for the encoding, for which the lower moments match those of the Gaussian distribution, it follows that γ 11 = γ G 11 . Due to the multiplicativity of the quantity χ 2 (ρ, σ) + 1, so that and the fact that [37] it follows that which means that To prove the inequality in (86), observe that implies that The second inequality follows from data processing. Now consider where W N ,αx is the associated Wigner function for the state resulting from transmitting a coherent state over the channel N . Let r Q B |X (q B |x) = dp B W N ,αx (q B , p B ), be the probability distribution obtained over the position quadrature when the coherent state α x is sent over a channel N . Then we have the following: which is a consequence of monotonicity of trace distance and (94).
Then we obtain the following: Now using that is the Hellinger divergence and less than the square root of the total variation distance dq B r G Q B (q B ) − r Q B (q B ) , we obtain that To bound the second term we invoke the assumption that the photon number variance of the channel output is bounded. Therefore, where ρ = N (θ(N S )). We thus conclude that To prove the inequality in (87), observe the following: where r(q B |q A , p A ) = dp B W N ,αq A ,p A (p B , q B ), and r Q A ,P A (q A , p A ) = r Q A (q A )r P A (p A ). Then, By similar reasoning as above, we arrive at Then, invoking the assumption that the fourth moments of q A and q B are bounded, we obtain that the second term in the above equation is bounded, such that for some constant c 2 > 0.

B. CHANNEL SYMMETRIZATION
We now show that by performing a discrete phase symmetrization in Steps 2-3 of the key distribution protocol from Section II, it is possible to simplify the form of the covariance matrix of the state that Alice and Bob share at the end of the EB protocol to a symmetrized form.
Let N A→B be a single-mode bosonic channel. Alice and Bob can make this channel phase covariant by applying a random phase rotation and its inverse at the channel input and output, respectively, resulting in the following symmetrized channel: If the state input to the phase randomized channel is one share of a two-mode squeezed vacuum ψ(n) RA = |ψ(n) ψ(n)| RA , defined from then it follows that N A→B (ψ(n) RA ) = 1 4 3 k=0 e −in R πk/2 ⊗ e in B πk/2 N A→B (ψ(n) RA ) e in R πk/2 ⊗ e −in B πk/2 , where we have applied the fact that e −in A πk/2 |ψ(n) RA = e −in R πk/2 |ψ(n) RA .
We would now like to determine the covariance matrix elements of the phase-randomized state τ RB ≡ N A→B (ψ(n) RA ): where we assume for simplicity that τ RB has zero mean, but we note here that the more general case can be incorporated by a shift. Given an initial covariance matrix with elements