{'fraction_non_alphanumeric': 0.04595518420053171, 'fraction_numerical': 0.014305608304848715, 'mean_word_length': 4.18, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 5, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 1, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Security against collective attacks for a continuous-variable quantum key distribution protocol using homodyne detection and postselection

We analyze the security against collective attacks for a homodyne-based continuous-variable quantum key distribution protocol using binary coherent states and postselection. We derive a lower bound of the secret key rate in an asymptotic scenario, and numerically optimize it for the case of a symmetric Gaussian channel.


I. INTRODUCTION
Quantum key distribution (QKD) enables to share a random bit sequence, usually called secret key, between two remote users, (the sender, Alice and the receiver, Bob) through an optical signal transmission and classical communications. Provided that a few physical assumptions holds, the key can be proven information theoretically secure whenever the statistical errors in the transmission is sufficiently small. An amount of the total errors determines the length of the secret key whether or not an eavesdropper (Eve) could have accessed to the transmission channel. There have been considerable research activity in QKD from pure theoretical aspects to long term fieldworks [1][2][3].
Recently, a finite-size security of a CV-QKD protocol has been established [22]. This protocol is based on the transmission of binary coherent states, and employs both the homodyne and heterodyne measurements. The homodyne measurement is used to generate a raw key whereas it is the statistics of the heterodyne measurement that guarantees the security through monitoring a type of channel fidelity. This fidelity test gives an upper bound of a phase error rate on a virtually defined qubit-based QKD protocol. Thereby, an asymptotic key rate can be determined by a simple formula using binary entropy function for the phase error bound [23,24]. Since this protocol requires both the homodyne and heterodyne measurements its experimental implementation is thought to be technically demanding. Therefore, it is natural to ask whether one can make use of such a security proof for a homodyne based CV-QKD protocol.
Incidentally, the security statement for the homodynebased CV-QKD protocols [25,26] is strictly limited under the Gaussian assumption [27,28] and its possible re-finements beyond Gaussian attacks have been open until now.
In this paper we prove an asymptotic security of a CV-QKD protocol with binary coherent states and homodyne detection. The structure of our protocol is essentially the same as the homodyne-based CV-QKD protocols with the postselection [25,26]. Our main task is to find a lower bound of the fidelity by using the homodyne statistics. Given such a bound, the security proof can be completed by repeating the method in Ref. [22]. We also numerically determine key rates for the case of a symmetric Gaussian channel.
This paper is organized as follows. In Sec. II, we introduce our QKD protocol and outline our security proof. In Sec. III, we prove an inequality to complete the security proof of our protocol. In Sec. IV, we show numerically determined key rates when the quantum channel is a symmetric Gaussian channel. We conclude in Sec. V.

II. PROTOCOL AND SECURITY PROOF
We consider a postselection protocol whose structure is basically the same as the protocols proposed in Refs. [25,26]. Alice sends pulsed coherent states with binary phase modulation |±α (α > 0) and Bob randomly measures {x,p} via homodyne detection. Our idea is to use the homodyne statistics of the canonical quadrature pair (x,p) for monitoring the fidelity. A sifted key is generated from pulses on which Bob measures x as follows: Let us denote by x th ≥ 0 the postselection threshold. Bob tells Alice the position of the pulsed signals where his x-measurement outcome x satisfies |x| ≥ x th . For each of such pulses, Alice assigns her bit values associated with the sign of modulation, whereas Bob's bit value is determined by the sign of his outcome x.
In this paper we restrict our analysis for collective attacks so that Bob is supposed to receive signals come through an unknown but fixed quantum channel. We also assume an asymptotic scenario in which a sample mean is equal to the expectation value over the density operator of individual signals.
Following [22] we use the system indexC → C → B on the signal transmitted from Alice to Bob. Alice prepares her coherent state on an optical modeC, This state is transmitted to the state on Bob's optical mode C through a quantum channel EC →C . Bob virtually converts the state in the optical mode C into a state in a qubit system B by a completely positive (CP) map F C→B . This sequence is symbolically summarized as Then, Bob's homodyne measurement process can be effectively represented by the CP map F and a Z measurement on B.
For a concrete description we may use an entanglement based picture with an initial entangled state in a bipartite system AC consists of a qubit and the optical modeC, As we have assumed that Eve performs a collective attack, the systemC is sent to Bob through a quantum channel E. Thereby, the state shared between Alice and Bob can be written as where we define ρ (0) := |Ψ Ψ| and I A represents the identity map acting on Alice's qubit system A. Let us denote by ρ C a density operator in the optical mode that Bob receives and let be x ∈ R an outcome of Bob's homodyne measurement on the x quadrature. We consider the form of the CP map that converts ρ C into a possibly subnormalized density operator of a qubit system: with where {|0 B , |1 B } denotes the Z basis of the qubit system B, |x denotes the homodyne basis of the x quadrature, and f suc (x) ∈ [0, 1] represents the probability that the mode conversion is carried out associated with the measurement outcomes ±x. In what follows we consider the form of a step function with the postselection parameter x th ≥ 0, Note that F is trace decreasing if x th > 0. Now, starting with ρ AC in Eq. (3), Alice and Bob generate a sifted key associated with a joint Z A ⊗ Z B measurement of the final state Thereby, the probability of obtaining a sifted bit is give by and the bit error rate of the sifted key is given by Here, we note that p x th and e bit can be determined directly through our homodyne measurement of the variablex.
Since our protocol can be seen as a protocol based on the transmission of a qubit system, the secret key rate in the asymptotic limit can be determined by estimating the error rate in the X basis often called the phase error rate [23,24]. In order to give an expression of the phase error rate on the sifted key, let us start by noting that the operator K x in Eq. (5) can be written as where the X basis of Bob's qubit is defined as and the projection to the even (odd) photon number subspace of the optical mode is defined as The relation in Eq. (10) can be derived from the Eqs. (5), (11), (12), and the following two equations: where the last relation comes from the parity of the wave functions, i.e., x|n = (−1) n −x|n .
For a notation convention we may define a pair of positive operators With the help of Eqs. (4) and (10), this gives the probability obtaining "+" or "−" outcome at the measurement on the X basis as One can readily confirm that this pair can be associated with the probability p x th defined in Eq. (8) where |± A = 1 √ 2 (|0 A ± |1 A ) represents Alice's X basis. Now, let us define the phase error rate being symmetric to the bit error rate e bit in Eq. (9) as From Eqs. (15) and (16), it can be expressed in terms of qubit-mode elements on the joint system AC as where the positive operator in the numerator is defined as In contrast to the bit error rate e bit , the phase error rate e ph cannot be observed directly in our protocol. This is because our homodyne measurement does not implement the filtering process associated with the projections Π ev and Π od . We thus consider an upper bound of e ph , which can be determined through our protocol. Due to Corollary 2 of Ref. [22], the following inequality holds for any κ, γ ≥ 0 and β ∈ C: where B κ,γ,β is defined in Appendix A, and Here, |±β denotes a pair of coherent states. From Eq. (20), the phase error rate in Eq. (18) can be bounded from above as Here, in the numerator, the first term B κ,γ,β is independent of the state ρ AC . The second term is determined by Alice's state preparation or the marginal state Tr C (ρ AC ). In fact, this term is simply calculated to be where |Ψ is defined in Eq. (2). It is only the last term in the numerator of Eq. (22) that depends on the transmission of the signal. This term is regarded as an average fidelity for a transmission of the binary coherent states. In fact, with the help of Eqs. (2) and (3), we have the following expression: where we define ρ ± := E(|±α ±α|).
In Ref. [22], such a fidelity term Tr(ρ AC Π fid ) is lower bounded by using the statistics of Bob's heterodyne measurement. Here, we use another lower bound based on Bob's homodyne statistics: where F 0 will be defined in Eq. (38) below. As we will see in next section, this function F 0 is determined by the first and second moments of the canonical variables: Therefore, the lower bound of the fidelity can be obtained from the homodyne statistics of the quadrature pair (x,p) observed in our protocol. From Eqs. (22), (23), and (26) we obtain an upper bound of the phase error rate: This gives a lower bound of an asymptotic key rate [23,24] G(α, where h(e) = 1 − e log 2 e − (1 − e) log 2 (1 − e) is binary entropy function, and the term h(e bit ) represents the portion of bits deleted to accomplish an ideal error correction. Note that G(α, x th ) works as a key rate for any κ, γ ≥ 0 and β ∈ C. In practical application, we may numerically optimize (κ, γ, β) as well as (α, x th ) to obtain a higher key rate. For the case of a phase insensitive quantum channel with the transmission η > 0, we may consider the optimization around β = √ ηα so as not to induce much degradation in the fidelity term in Eq. (24). Note also that the term h(e bit ) in the right-hand side of Eq. (29) is often replaced with f h(e bit ) by considering an inefficiency parameter f ≥ 1 so as to take into account the performance of a practical error correction process.
We will determine the function F 0 of Eq. (26) in next section. After that we show numerically determined key rates for a symmetric Gaussian channel in Sec. IV.
Proof. The fidelity to the vacuum state can be bounded as (32) where {|n } n=0,1,2,··· denotes the number basis andn is the number operator. This operator can be associated with the quadrature operators aŝ Let us define the displacement operator by its action to a coherent state as This implies Then the bound Eq. (31) is obtained from Eq. (34) by the replacement Now we can readily obtain the inequality in Eq. (26) by using Eq. (31) on the right-hand side of Eq. (24). This determines the quantity F 0 in Eq. (26) as follows: Note that this can be written as a linear combination of the quantities listed in Eq. (27). Hence, the fidelity bound can be determined by Bob's homodyne measurements.

IV. NUMERICAL SIMULATION
In this section, we consider a symmetric Gaussian channel and numerically determine a lower bound of the key rate.
We assume a symmetric Gaussian channel with transmission η ∈ [0, 1] and the excess noise ξ > 0. For an input of a coherent state, the output of the channel can be written as In the case of α ∈ R, this gives where ρ ± is defined in Eq. (25). Using these expressions we can write the quantity F 0 in Eq. (38) as where we assume β > 0 and set (x β , p β ) = (β, 0) in the final expression. From Eqs.
(2) -(9) and (39), we can write where the complementary error function is given by Now, p x th and e bit are represented as a function of (α, x th , η, ξ). Then, the phase error boundẽ in Eq. (28) with F 0 in the form of Eq. (44) is determined as a function of (α, x th , η, ξ) and (κ, γ, β) if we set (β R , β I ) = (β, 0) in the definition of B κ,γ,β in Appendix A. Therefore, we can calculate the key rate in Eq. (29) for a given set of the parameters (α, x th , η, ξ, κ, γ, β). Figure 1 shows the key rate G in Eq. (29) as a function of the loss 1 − η for a set of excess noise ξ. For each value of (η, ξ), the five positive parameters (γ, κ, α, β, x th ) were optimized to maximize G. Our key rate is typically lower than the key rate of four-state protocols given in [17,18] by more than one order of magnitude. In comparison with the two-state protocol without postselection [15], our key rates show relatively slow decay and longer transmission distances in which key rate is positive. Almost the same statement holds in conjunction with the three-state protocol without postselection [16], at least in a certain parameter regime. Such a better performance in our protocol is thought to come from the use of the postselection although the difference in the security proofs potentially induces some impact. Note that the advantage of the postselection has been rather directly studied in the case of four-state protocols in Refs. [17,18,30].
Our key rate is comparable to the asymptotic key rate in Ref. [22]. As an essential technical difference to Ref. [22] we use a different lower bound for the fidelity. However, it makes no much numerical significance in the present channel (See Appendix B). Another technical difference to Ref. [22], we have considered an optimization of the parameter β, which is fixed to β = √ ηα in Ref. [22].
This optimization has typically induced a few percent improvement in the key rate.

V. CONCLUSION AND REMARKS
We have proven an asymptotic security of a CV-QKD protocol using binary coherent state and homodyne measurement, and develop a numerical method to show the key rate for a symmetric Gaussian channel. The structure of our protocol is essentially the same as the CV-QKD protocols with the postselection [25,26], and our result would be useful to show the performance of those protocols. Our security proof is based on the method in Ref. [22] that established a finite size security. In contrast to Ref. [22] our approach uses an unbounded function for the fidelity test. This prevents us from dealing with the finite-size security at least in the present form.
For a real world application, an important aspect is to establish the security under a trusted noise scenario, in which the detection noise at Bob's station is assumed to be independent of Eve's intervention [7,28,[31][32][33][34][35][36]. Such a direction would be addressed elsewhere.

ACKNOWLEDGMENTS
This work was performed for Council for Science, Technology and Innovation (CSTI), Cross-ministerial Strategic Innovation Promotion Program (SIP),"Photonics and Quantum Technology for Society 5.0" (Funding agency : QST).
Appendix A: Definition of B κ,γ,β B κ,γ,β in Eq. (20) is defined through largest eigenvalues of a pair of matrices as followings: Here, we use a 4-by-4 matrix, and a 2-by-2 matrix, The matrix elements are specified by where the operator M suc ev(od) and the function erfc(x) are respectively defined in Eqs. (14) and (47), and we assume the following form for the complex amplitude β = β R + iβ I , β R , β I ∈ R. (A9)

Appendix B: Comparison of fidelity bounds
Here, we briefly describe typical behavior of our lower bound of the fidelity and the known fidelity bound due to Ref [22] in the case of a symmetric Gaussian channel. From Eq. (39) we have the following expression to the fidelity √ ηα|E(|α α|)| √ ηα = 1 1 + ξ/2 .
(B6) Figure 2 shows the fidelity and bounds as functions of the excess noise ξ. There are no impact difference in the three functions when the excess noise is not significantly high, e.g., ξ ≤ 0.2. In fact, our bound 1 − ξ/2 is equivalent to the fidelity up to the second order of ξ, and the following relation holds: