Minimization of information leakage in continuous-variable quantum key distribution

A communication protocol based on a Gaussian modulation of squeezed states in a single quadrature and measured via homodyne detection can completely eliminate information leakage to an eavesdropper in a pure-loss channel. However, the asymmetry of the protocol with respect to the quadratures of light presents security issues and the eavesdropper's information is not necessarily minimized for general asymmetric attacks. Here, we perform asymptotic security analysis of the asymmetric protocol against general asymmetric collective attacks and bound the eavesdropper's information via the Heisenberg uncertainty principle. The bound is not tight and therefore, we symmetrize the protocol in a heralding way, discarding the issues of asymmetry altogether. Our proposed heralding protocol asymptotically eliminates information leakage in a pure-loss channel and minimizes leakage in a noisy channel.


I. INTRODUCTION
Quantum key distribution (QKD) [1,2] is the task of distributing a secret random key between two distant parties. Its provable security relies on quantum physics and it is therefore a promising solution to the vulnerability of current classical cryptosystems. The first QKD protocols were based on discrete-variables (DV), such as BB84 [3], where the fundamental component is a qubit. Recently, QKD has been extended to continuous-variable (CV) [4,5] systems, utilizing the infinite-dimensional space of modes of light, with the benefit of using simpler experimental set-ups and off-the-shelf optical communication devices such as homodyne detectors.
There is a zoo of CV QKD protocols [6][7][8][9][10][11][12]. For instance, either coherent states [6,10] or squeezed states [11,12] may be distributed between the trusted parties, and the ensemble may be symmetric or asymmetric with respect to the quadratures of light. See Ref. [2] for a review. A key difference between CV QKD and DV QKD is that in DV QKD lost photons are discarded, but in CV QKD all states are retained but are noisier.
A CV analogue of BB84 is the protocol based on Gaussian modulated squeezed states with switching (i.e., randomly choosing to squeeze and modulate either the x or p quadrature) and measured via homodyne detection [11], however, even in a pure-loss channel, information is inevitably leaked to an eavesdropper. During the protocol, correlations exist between all three parties, and the trusted parties, Alice and Bob, must suppress their correlations with the eavesdropper, known as Eve, to ensure the final key is secret. This can be done via error correction, privacy amplification, or for an entanglement protocol, via entanglement distillation or purification. Recently, a CV QKD protocol has been devised which takes a different approach. By designing the alphabet of input states in a certain way, information leakage to Eve is completely and deterministically eliminated in a pure-loss channel and minimized in a symmetric noisy channel [13]. Information is encoded in a single quadrature via a Gaussian modulation * matthew.winnel@uqconnect.edu.au of squeezed states, which are squeezed in the modulation direction such that the overall variance of the ensemble is shot noise. The motivation for minimizing information leakage is that this will simplify classical post-processing and ultimately speed up the secret key rate. Another motivation is that zero information leakage in a pure-loss channel is analogous to discarded photons in DV QKD.
It is vital that QKD protocols can be proved secure against the most general eavesdropping attacks allowed by the laws of quantum physics. Indeed, currently composable security for finite key lengths has been proved against general attacks for only several CV QKD protocols, such as the no-switching protocol based on Gaussian modulated coherent states and heterodyne detection [14], and the Gaussian modulated squeezed state protocol with switching and homodyne detection [15]. Recently, a discrete modulation protocol has been proved secure including finite-size effects [16]. In Ref. [13], the authors considered a symmetric Gaussian attack which is not asymptotically optimal since the protocol is asymmetric and the channel parameters in the unmodulated quadrature are unknown.
In this paper we deal with the asymmetry of the asymmetric minimum-leakage protocol from Ref. [13]. We first extend their security analysis to include general asymmetric Gaussian attacks. We show that Eve's information is not necessarily minimized for asymmetric attacks. Further, we introduce a new protocol which is strictly symmetric with respect to the quadratures of light. This forces Eve to implement symmetric attacks thereby avoiding the issues of asymmetry. Conditioned on a homodyne measurement at Alice's station, our protocol heralds squeezed states modulated in a single quadrature. We show that for this new protocol information leakage is asymptotically eliminated for pure-loss channels, and minimized for noisy channels.
The outline of this paper is as follows. In Sec. II, we revise state of the art security for CV QKD, and we introduce the asymptotic key rate formula and the Holevo bound. In Sec. III, we recall the asymmetric protocol from Ref. [13] and extend their analysis to include general asymmetric attacks. In Sec. IV, we introduce a symmetric heralding protocol. In Sec. V, we discuss our results and conclude.

II. SECURITY OF CV QKD PROTOCOLS
A. State-of-the-art security proofs The goal of security analysis is to provide a useful upper bound on Eve's information using correlations between Alice and Bob, leading to an expression for the secret key rate. Unfortunately, proving security is problematic in CV QKD because the Hilbert space is infinite dimensional, the measurement operators are unbounded, and channel parameters must be estimated of noisy quantum channels. Compare this with DV QKD where the Hilbert space is finite dimensional and loss can be dealt with by simply discarding the state. It is known that Gaussian collective attacks are asymptotically optimal for fully Gaussian CV QKD protocols [17], i.e. in the asymptotic case of infinitely long keys. To go beyond asymptotic analysis, only a few Gaussian CV QKD protocols are known to be composably secure against general attacks and including finite-size effects, for instance, the no-switching protocol based on Gaussian modulated coherent states in the x and p quadratures and heterodyne detection [14,18], and the switching protocol based on squeezed states with a Gaussian modulation in the x or p quadratures and homodyne detection such that the overall state prepared by Alice is a Gaussian thermal state [15,19].
We restrict our attention here to the asymptotic regime though we caution that finite-size effects are expected to be significant. The original asymmetric protocol from Ref. [13] with squeezed states is analyzed against collective attacks in the asymptotic limit in Sec. III. Our symmetric heralding protocol, discussed in Sec. IV, is Gaussian and symmetric, however, current composable security proofs including finite-size effects still fail due to Alice's homodyne detection.

B. Asymptotic secret key rate formula and Eve's maximal information
A lower bound on the asymptotic secret key rate in the case of reverse reconciliation for collective attacks is given by the Devetak-Winter rate [20] where I AB is the classical (Shannon) mutual information between Alice and Bob, χ EB is the Holevo quantity, the maximal quantum mutual information between Eve and Bob (the reference side of the information reconciliation), and β is the reconciliation efficiency.
The upper bound on the information extractable by Eve is given by the Holevo quantity [21] where S(ρ E ) is the von Neumann entropy of Eve's state, and S(ρ E|b ) is the von Neumann entropy of Eve's state conditioned on Bob's measurement. The Holevo information is obtained by allowing Eve access to the purification of the state shared between Alice and Bob ρ AB . The global state ρ ABE is pure and we can use the self-duality property of the von Neumann entropy to write S(ρ E ) = S(ρ AB ) and S(ρ E|b ) = S(ρ A|b ), where S(ρ A|b ) is Alice's mode conditioned on a measurement on Bob's mode.
For Gaussian states, χ EB may be calculated from the symplectic eigenvalues of the covariance matrices of ρ AB and ρ A|b in the equivalent entanglement-based (EB) version of a prepare-and-measure CV QKD protocol. Thus, Eve's information is given by i.e. the Holevo quantity is given in terms of von Neumann entropies which can be calculated using the symplectic eigenvalues v i of the covariance matrix of the state, i.e. Γ AB and Γ A|b , via the relation where N is the number of modes.

III. ASYMMETRIC PROTOCOL
The asymmetric minimum-leakage protocol from Ref. [13] is shown in Fig. 1. It is based on squeezed states modulated in a single direction with an overall Gaussian modulation and squeezing chosen so that the Holevo information χ EB is eliminated or minimized while the key rate is non-zero. Let us assume that the modulated quadrature is chosen to be the amplitude quadrature x. In a pure-loss channel, the requirement for complete elimination of χ EB is for the ensemble of squeezed states to have an overall amplitude quadrature noise variance of vacuum.
In the prepare-and-measure (PM) version of the protocol (the version Alice and Bob implement in practice), Alice prepares a Gaussian modulation of squeezed states of light to send to Bob. The PM scheme of the protocol is given in Fig. 1(a). Alice prepares x squeezed states with amplitude quadrature variance V sqz and applies modulation in the x quadrature, displacing each squeezed state according to a random Gaussian variable with variance V sig . The states are then sent to Bob through an asymmetric noisy channel with transmittance T x , T p and excess noise ξ x , ξ p in the x and p quadratures respectively. Bob performs homodyne measurements of the modulated x quadrature, but sometimes also measures the unmodulated p quadrature for estimating the properties of the channel in the p quadrature. Alice and Bob extract a secret key from the x quadrature data using a reversereconciliation procedure.
Security is analyzed using the equivalent EB version of the protocol, shown in Fig. 1b) which goes as follows. Alice prepares a two-mode squeezed vacuum state of variance µ, keeps one of the modes, and squeezes the x quadrature of the second mode with squeezing parameter r before sending it to Bob. Alice performs homodyne measurements in the x quadrature in order to project Bob's mode onto an ensemble of squeezed states with a Gaussian modulation. For instance, if Alice homodynes x then effectively she has sent a Gaussian modulation of x squeezed states in the x direction to Bob, equivalent to the PM version. When the variance of the overall ensemble is shot noise, information leakage is zero in a pure-loss channel.
As shown in Ref. [13], the PM condition which completely decouples the eavesdropper in a pure-loss channel is V sig + V sqz = 1, an overall x quadrature noise variance of vacuum. One can arrive at this condition by calculating Eve's maximal information via the covariance matrix shared between Alice and Bob in the EB version, and we refer you to Appendix A 1 and Ref. [13] for details. A similar relation minimizes the Holevo information under the assumption of a symmetric noisy channel but a little more squeezing is required because of the noise. By symmetric channel we mean T x = T p and ξ x = ξ p , which is a restricted eavesdropping attack since the input state to the channel is asymmetric. The dashed curve in Fig. 2 shows that Eve's information is minimized in a symmetric noisy channel for an appropriate choice of V sqz given that V sig = 0.5. In the next section we go beyond symmetric attacks.

A. General asymmetric attacks
In this section, we consider channels where the noise and loss may be asymmetric in each of the quadratures. Recall that during the protocol, Alice and Bob perform parameter estimation to derive the covariance matrix shared between them. Usually both quadratures are modulated allowing the full covariance matrix to be estimated, however, although only one quadrature is modulated, Bob can still estimate the variance of the unmodulated quadrature and use physicality of the quantum state to bound Eve's information, i.e., via the Heisenberg uncertainty principle [8].

Bounding Eve using the Heisenberg Uncertainty Principle
We use the EB version shown in Fig. 1 b) and bound Eve using the Heisenberg uncertainty principle. The EB parameters are related to the PM parameters such that where µ is the EPR variance and V = e −2r is the strength of the squeezing on the outgoing mode with squeezing parameter r. Equivalently, solving for µ and r, we have The covariance matrix shared between Alice and Bob after Eve's asymmetric attack is given by (see Appendix A 2 for details): where v B p and c p are unknown since the p quadrature is unmodulated. Fixing T x and ξ x , then given Bob's p quadrature variance v B p measured during an experiment (which he only does sometimes since he is mostly performing a homodyne measurement of the x quadrature), we bound the unknown correlation parameter c p by the physical requirement of the state given by Γ AB + iΩ ≥ 0, where Ω is the symplectic form Ω = n i=1 ω, ω = 0 1 −1 0 . To calculate a general upper bound on Eve's information we simulate an experiment and give Bob's variance v B p the value it would have if the channel were symmetric (i.e., in our simulated experiment v B p is calculated using T p = T x and ξ p = ξ x ), and then we maximize Eve's information χ EB by going over all physical covariance matrices. This is plotted in Fig. 2 (solid). Also plotted is for a symmetric channel (dashed), which has been done in [13]. Note that Alice prepares a Gaussian modulation of coherent states for no squeezing V sqz = 1. For coherent states, bounding Eve's information in this way is not very pessimistic, as can be seen in the plot since the gap between symmetric and upper bound is not significant. But as squeezing is increased, the gap between the symmetric channel and the general upper bound becomes very significant. To provide tighter bounds, it is better to measure all terms of the covariance matrix, thus, we need to do some estimation of the unmodulated quadrature.

Estimating the unmodulated quadrature
One must perform some estimation of the unmodulated quadrature in an experiment to obtain the full covariance matrix but it is difficult to estimate the unmodulated quadrature since it is antisqueezed. For illustration purposes, we assume that some estimation of the p quadrature is performed and that the excess noise is equal in both quadratures, ξ p = ξ x , and we again bound Eve's information using physicality of the covariance matrix and plot this in Fig. 2 (dotted). We do not have to simulate Bob's variance in this case because there is only one unknown parameter, T p . Compared to the general upper bound, assuming equal excess noise in both quadratures does much better. This shows that it is important to estimate the noise in the unmodulated quadrature, however, equal excess noise in both quadratures is not a realistic assumption because in an experiment the noise associated with the unmodulated quadrature is expected to be worse than the modulated quadrature. Therefore, one can expect Eve's information to lie between the symmetric channel and the upper bound. In summary, Eve's information is not necessarily minimized when considering stronger attacks beyond symmetric ones (and note that we have not yet considered finite-size effects). This motivates an exploration of symmetric protocols with the goal of minimizing Eve's information.

IV. HERALDING PROTOCOL
In this section, we symmetrize the asymmetric protocol of Ref. [13] in a heralding way to avoid worrying about asymmetric attacks in the security analysis. We present our heralding protocol in Fig. 3. In the PM version, Alice prepares two modes; two independent ensembles of squeezed states with a Gaussian modulation in a single direction, one mode modulated in the x direction and the other mode in the p direction. Note that here again we use V sqz for the squeezing variance and V sig for the modulation variance. These are combined on a beamsplitter and Alice homodynes one of the outputs (labelled A3) in either x or p at random while the other mode is sent to Bob (labelled B). The protocol heralds squeezed states modulated in a single quadrature, conditioned on Alice's homodyne measurement at A3. Bob independently and randomly homodynes in either x or p and, during classical post-processing, Alice and Bob sift their results, where they only keep the data for which they have used the same quadrature for the measurement.
In the EB version, Alice's ensembles are replaced with EPR states plus auxiliary squeezing on one of the modes. Mode B is squeezed in the x quadrature with squeezing parameter r and mode A3 is squeezed in the p direction by an equal amount. The EB version is equivalent to the PM version if Alice homodynes A1 in x and A2 in p.
Our heralding protocol consists of all Gaussian elements and is symmetric, so we can analyze security against Gaussian collective attacks in the asymptotic limit. For our heralding protocol we do know that in the asymptotic limit Gaussian attacks are optimal, and, unlike the asymmetric protocol, we no longer have to worry about asymmetric attacks since the protocol is symmetric. We still have the issue that we do not know Eve's optimal attack in the finite-size regime. Now we consider the EB version of the Heralding protocol. Before going through the channel, the mode that will go to Bob is symmetric and is given by After the channel, homodyne detection is performed on modes A3 and B independently and randomly in x and p. At the end Alice and Bob sift, and here, without loss of generality, we assume this sifting is in the x quadrature (shifted results in the p quadrature will behave similarly). After the quantum channel and Alice's heralding measurement (which we assume is homodyne A3 in x), the covariance matrix of Bob's mode is The full covariance matrix is given in Appendix B. For zero information leakage in a pure-loss channel we require that the variance of the x quadrature is equal to the shot noise. Solving for the prepare-and-measure parameters defined in Eq. (4), we find the following condition For example, if V sig = 0.3, then this condition implies that there are two solutions which eliminate the Holevo quantity: squeezing V sqz = 0.2821 or antisqueezing V sqz = 1.4179. We are interested in the squeezing solution, not antisqueezing (since mutual information I AB decreases with antisqueezing), and note that V sqz = 0 for infinite squeezing and V sqz = 1 for zero squeezing. Figure 4 shows Eve's information as a function of transmissivity T and squeezing variance V sqz for a) pure-loss and b) excess-noise ξ = 0.001. Eve's information is eliminated in a pure-loss channel when Eq. (9) is satisfied. For the noisy case Fig. 4 b) shows that when Eq. (9) is approximately satisfied and the Holevo information is minimized, the Holevo information actually decreases with loss. In other words, the Holevo information goes to zero as the transmissivity of the channel is decreases. That Eve's information is less the more loss there is may be counter-intuitive (since she steals more but gets less) but makes sense when one remembers that Alice and Bob's mutual information is also less for more loss.
In Fig. 5, we plot Eve's information as a function of signal modulation and squeezing in a pure-loss channel with fixed transmissivity T = 0.5. This shows that as squeezing is increased from V sqz = 1 (coherent states) to V sqz → 0 (infinite squeezing), the modulation variance V sig must also be increased in order to minimize information leakage.
In Fig. 6, we show the secret key rate of the heralding protocol as a function of distance for a thermal-loss channel with excess noise ξ = 0.05. Alice and Bob's mutual information is calculated assuming modes A1, A3 and B are all homodyned in x, and the parameters of the protocol are fixed such that Eq. (9) is satisfied and Eve's information is eliminated or approximately minimized at all distances. Alice and Bob's mutual information is calculated after Alice's heralding measurement of mode A3 in the x quadrature and is given by where V Bx is the variance of Bob's x quadrature, since this is the quadrature we assume he uses for the key, and V Bx|A1homx is the variance of Bob's x quadrature conditioned on Alice's homodyne measurement in x of mode A1. The heralding protocol optimizes for very large squeezing shown as the dashed line in Fig. 6. Infinite squeezing is V sqz →0 and the zero-leakage condition Eq. (9) means that V sig →0.5. Also shown is the key rate for the heralding protocol with 10dB of finite squeezing (dot-dashed). For comparison, we plot the optimized key rate for Gaussian-modulated squeezed state protocol and measured via homodyne detection [11] (red) and Gaussian-modulated coherent state protocol and heterodyne detection [6] (blue). The optimized squeezed state protocol with homodyne detection outperforms our heralding protocol. However, since our heralding protocol likewise is based on squeezed states and homodyne detection it can outperform the coherent state protocol with heterodyne detection.
We note here that rates for the heralding protocol are numerically identical as those for the asymmetric protocol against symmetric thermal-loss channel. Indeed, the rate for the heralding protocol for a pure-loss channel, infinite squeezing, and reconciliation efficiency β=1 reaches half of the fundamental repeaterless PLOB bound, which is given by [23]. This result for the asymmetric protocol was indeed mentioned in [13].

V. DISCUSSION AND CONCLUSION
In this paper, we have investigated CV QKD protocols designed to eliminate information leakage to Eve. We extended security analysis of the original asymmetric minimumleakage protocol by considering general asymmetric channels by demanding physicality of the quantum states. We also introduced a new protocol by symmetrizing in a heralding way.
The main results from this paper are the following: if the unmodulated quadrature can be properly estimated, the asymmetric protocol minimizes Eve's information and is secure against Gaussian attacks in the asymptotic regime. However, using the Heisenberg uncertainty principle for security analysis can give Eve a lot of information. Our heralding protocol minimizes Eve's information in a heralding way despite being symmetric with respect to the quadratures, but with added experimental complexity.
Another way to symmetrize the asymmetric minimumleakage protocol is by switching, i.e., randomly sending xsqueezed or p-squeezed states with an overall modulation of shot noise in each quadrature. However, the overall ensemble prepared by Alice will be non-Gaussian (specifically, it will not be a Gaussian thermal state as in the squeezed state protocol with homodyne detection from Ref. [11]). The non-Gaussianity complicates the security analysis, potentially giving more information to the eavesdropper, departing from our goal of minimum-leakage. We leave the investigation of minimum-leakage switching protocols for future work.
In conclusion, we have introduced a new CV QKD protocol which minimizes the amount of information leaked to an eavesdropper in a noisy channel and eliminates information leakage in a pure-loss channel, meaning that the classical part of the protocol will be computationally less complex, potentially leading to an overall increase in the secret key rate in situations of practical interest. Secret key rate of the heralding protocol as a function of distance for lossy thermal channel. The dashed and dot-dashed lines (black) show the heralding protocol with infinite and 10dB of finite squeezing respectively. The heralding protocol optimizes at very large squeezing, i.e., Vsqz→0, Vsig→0.5. For these plotted rates, the condition Eq. (9) is satisfied at all distances, hence, Eve's information is zero at all distances in a pure-loss channel and small in a noisy channel. Shown for comparison are optimized rates for the original squeezed state protocol with switching and homodyne detection [11] and no-switching coherent state protocol with heterodyne detection [6]. The excess noise is ξ = 0.05 for all protocols, the reconciliation efficiency is β=0.95 and we have considered optical fiber with loss of 0.2dB/km. The repeaterless PLOB bound [23] and is also plotted in the figure (gray). The covariance matrix for Alice's mode conditioned on Bob's homodyne measurement, which is assumed to be in the x quadrature, is Γ A|b = µ− T e −2r (µ 2 −1) T (e −2r µ+ξ)+1−T 0 0 µ . The Holevo quantity can be determined from the symplectic eigenvalues of these two matrices, Γ AB and Γ A|b . If r = ln √ µ then χ EB → 0 in a pure-loss channel.

Asymmetric attack
Now we write down the covariance matrix for general asymmetric channels. After the asymmetric channel, the covariance matrix shared by Alice and Bob is: where r is the squeezing parameter in the EB version. T x and ξ x are, respectively, the channel transmittance and excess noise, estimated by Alice and Bob in the x quadrature. However, since the p quadrature is not modulated, T p and ξ p are unknown.