Long-distance continuous-variable quantum key distribution using non-Gaussian state-discrimination detection

We propose a long-distance continuous-variable quantum key distribution (CVQKD) with a four-state protocol using non-Gaussian state-discrimination detection. A photon subtraction operation, which is deployed at the transmitter, is used for splitting the signal required for generating the non-Gaussian operation to lengthen the maximum transmission distance of the CVQKD. Whereby an improved state-discrimination detector, which can be deemed as an optimized quantum measurement that allows the discrimination of nonorthogonal coherent states beating the standard quantum limit, is applied at the receiver to codetermine the measurement result with the conventional coherent detector. By tactfully exploiting the multiplexing technique, the resulting signals can be simultaneously transmitted through an untrusted quantum channel, and subsequently sent to the state-discrimination detector and coherent detector, respectively. Security analysis shows that the proposed scheme can lengthen the maximum transmission distance up to hundreds of kilometers. Furthermore, by taking the finite-size effect and composable security into account we obtain the tightest bound of the secure distance, which is more practical than that obtained in the asymptotic limit.


INTRODUCTION
Quantum key distribution (QKD) [1][2][3] is one of the most practical applications of quantum cryptography, whose goal is to provide an elegant way that allows two remote legitimate partners, Alice and Bob, to establish a sequence of random secure key over insecure quantum and classical channels.Its security is provided by the laws of quantum physics [4,5].
For decades, continuous-variable (CV) QKD [6][7][8][9][10][11][12][13] has been becoming a hotspot of QKD research due to its simple implementation with state-of-art techniques [14,15].It has been shown to be secure against arbitrary collective attacks, which are optimal in both the asymptotic limit [12,13,16,17] and the finite-size regime [18,19].Recently, CVQKD is further proved to be secure against collective attacks in composable security framework [20], which is the security analysis by carefully considering every detailed step in CVQKD system.
In general, there are two main modulation approaches in CVQKD, i.e., Gaussian modulated CVQKD [6][7][8] and discretely modulated CVQKD [9][10][11][12][13].In the first approach, the transmitter Alice usually continuously encodes key bits in the quadratures (x and p) of optical field with Gaussian modulation [21], while the receiver Bob can restore the secret key through high-speed and high-efficiency coherent detector (i.e., homodyne or heterodyne detector) [15,22].This scheme usually has a repetition rate higher than that of single-photon detections so that Gaussian modulated CVQKD could potentially achieve higher secret key rate, whereas it seems unfortunately limited to much shorter distance than its discrete-variable (DV) counterpart [12].The key problem is that the reconciliation efficiency β is quite low for Gaussian modulation, especially in the long-distance transmission.To solve this problem, one has to design a perfect error correcting code which is more suitable than LDPC code at very low signal-to-noise ratio (SNR).However, this kind of error correcting code is relatively hard to design and implement.Fortunately, there exist another way to well solve the problem, that is, using discrete modulation such as the four-state CVQKD protocol, proposed by Leverrier et al. [13].This discretely modulated CVQKD generates four nonorthogonal coherent states and exploits the sign of the measured quadrature of each state to encode information rather than uses the quadrature x or p itself.This is the reason that the sign of the measured quadrature is already the discrete value to which the most excellent error-correcting codes are suitable even at very low SNR.Consequently, the four-state CVQKD protocol has the merits of both high reconciliation efficiency in the long-distance transmission and the security proof of CVQKD so that it could improve the maximal transmission distance of CVQKD.
Currently, photon-subtraction operation, which is a kind of non-Gaussian operation in essence, has been demonstrated theoretically and experimentally to extend the transmission distance of the CVQKD using two-mode entangled states [23][24][25] due to the fact that a suitable photon-subtraction operation would increase the entanglement degree of two-mode entangled state and thereby increase the correlation between the two output modes of two-mode entangled state.Since the entanglement-based (EB) scheme is equivalent to the prepare-and-measure (PM) one, this operation can be employed practically implemented in protocols using coherent states with ex-isting technologies.
Furthermore, although a high-speed and highefficiency homodyne or heterodyne detector can be effectively to measure the received quantum state, the inherent quantum uncertainty (noise) still prevents the nonorthogonal coherent states from being distinguished with perfect accuracy [26][27][28].Even if the detector is ideal with perfect detection efficiency, the receiver cannot still obtain the precise result.The conventional ideal detector can only achieve the standard quantum limit (SQL) which defines the minimum error with which nonorthogonal states can be distinguished by direct measurement of the physical property of the light, e.g.quadrature x or p.Actually, there exists a lower error bound known as the Helstrom bound [29] which is allowed by quantum mechanics, and this bound can be achieved by designing excellent state-discrimination strategies.Recently, a well-behaved state-discrimination detector has been proposed to unconditionally discriminate among four nonorthogonal coherent states in QPSK modulation [26].This detector can beat the SQL by using photon counting and adaptive measurements in the form of fast feedback and thus approach or achieve the Helstrom bound.Therefore, the performance of CVQKD would be improved by taking advantage of this wellbehaved state-discrimination detector.
Inspired by the afore-mentioned advantages, which have been analyzed in theory and subsequently demonstrated with simulations and experiments, in this paper, we propose a long-distance CVQKD using non-Gaussian state-discrimination detection.In stead of the traditional Gaussian modulation which continuously encodes information into both quadrature x and quadrature p, the discretely-modulated four-state CVQKD protocol is adopted as the fundamental communication protocol since it can well tolerate lower SNR, leading to the long-distance transmission compared with Gaussianmodulated counterpart.Meanwhile, a photon subtraction operation is deployed at the transmitter, where it is not only used for splitting the incoming signal, but also improving the performance of CVQKD as it has been proven to be beneficial for lengthening the maximal transmission distance.Moreover, an improved statediscrimination detector is applied at the receiver to codetermine the measurement result with coherent detector.The state-discrimination detector can be deemed as the optimized quantum measurement for the received nonorthogonal coherent states so that it could surpass the standard quantum limit.As a result, one can obtain precise result of incoming signal in QPSK format with the help of the state-discrimination detector.By exploiting multiplexing technique, the yielded signals can be simultaneously transmitted through an untrusted quantum channel, and subsequently sent to the improved state-discrimination detector and the coherent detector.The proposed long-distance CVQKD scheme can greatly increase the secure transmission distance and thus outperforms the existing CVQKD protocols in terms of the maximal transmission distance.Taking finite-size effect and composable security into account we obtain the tightest bound of the secure distance, which is more practical than that obtained in asymptotic limit.
This paper is structured as follows.In Sec.II, we first introduce the discretely modulated CVQKD protocols, in particular, the four-state CVQKD protocol, and then demonstrate the proposed long-distance CVQKD scheme.In Sec.III, we elaborate the characteristics of photon-subtraction operation and the principle of improved state-discrimination detector.Numeric simulation and performance analysis are discussed in Sec.IV, and finally conclusions are drawn in Sec.V.

II. LONG-DISTANCE CVQKD SCHEME
We consider the four-state CVQKD protocol as a fundamental communication protocol for the proposed scheme, since the discretely-modulated protocol is more suitable for long-distance transmission (lower SNR) and it could be extended larger than its Gaussian modulation counterparts.Furthermore, the transmission distance of the four-state CVQKD protocol can be enhanced by performing a proper photon-subtraction operation and applying a well-behaved state-discrimination detector.To make the derivation self-contained, in this section, we first briefly describe the discretely modulated four-state CVQKD protocol, and then give the detail structure of the long-distance CVQKD scheme.

A. Four-state CVQKD protocol
In general, the four-state CVQKD protocol is derived from discretely modulated CVQKD, which can be generalized to the one with N coherent states |α N k = |αe i2kπ/N , where k ∈ {0, 1, ..., N } [10].For the fourstate CVQKD protocol, we have |α 4 k = |αe i(2k+1)π/4 , where k ∈ {0, 1, 2, 3}, α is a positive number related to the modulation variance of coherent state as Let us consider the PM version of the four-state CVQKD protocol first.Alice randomly chooses one of the coherent states |α 4  k and sends it to the remote Bob through a lossy and noisy quantum channel, which is characterized by a transmission efficiency η and an excess noise ε.When Bob receives the modulated coherent states, he can apply either homodyne or heterodyne detector with detection efficiency τ and electronics noise v el to measure arbitrary one of the two quadratures x or p (or both quadratures).The mixture state that Bob received can be expressed with the following form After measurement, Bob then reveals the absolute values of measurement results through a classical authenticated channel and keeps their signs.Alice and Bob exploit the signs to generate the raw key.After conducting postprocessing procedure, they can finally establish a correlated sequence of random secure key.
The PM version of the protocol is equivalent to the EB version, which is more convenient for security analysis.In EB version, Alice prepares a pure two-mode entangled state where the states are the non-Gaussian states, and the state |φ m is given by with Consequently, the mixture state ρ 4 can be expressed by Let A and B respectively denote the two output modes of the bipartite two-mode entangled state |Ψ 4 , â and b denote the annihilation operators applying to mode A and B respectively.We have the covariance matrix Γ AB of the bipartite state |Ψ 4 with the following form where I and σ z represent diag(1, 1) and diag(1, −1) respectively, and Note that the addition arithmetic should be operated with modulo 4. The detailed derivation of the four-state CVQKD protocol can be found in [12].After preparing the two-mode entangled state |Ψ 4 with variance V = 1 + V M , Alice performs projective measurements |ψ k ψ k | (k = 0, 1, 2, 3) on mode A, which projects another mode B onto a coherent state |α 4  k .Alice subsequently sends mode B to Bob through the quantum channel.Bob then applies homodyne (or heterodyne) detection to measure the incoming mode B. Finally, the two trusted parties Alice and Bob extract a string of secret key by using error correction and privacy amplification.

B. Long-distance discretely modulated CVQKD
In what follows, we elaborate the long-distance discretely modulated CVQKD scheme.This novel scheme is based on the four-state CVQKD protocol so that its transmission distance could be extended more largely comparing with the continuous modulation counterparts.We focus on the principle of the whole long-distance CVQKD scheme first, leaving the detailed techniques description to the next section.
As shown in Fig. 1, a source of the two-mode entangled state [Einstein-Podolsky-Rosen (EPR) state] is used for creating a secure key [30].After Alice prepares the entangled state |Ψ 4 , she performs heterodyne detection on one half (mode A) of the state and sends another half (mode B) to the photon-subtraction operation (the module within the green box).This non-Gaussian operation is modeled by a beam splitter (BS) with transmittance µ and a vacuum state |0 imports the unused port of the beam splitter.As a result, the incoming signal (mode B) is then divided into two parts by the photon-subtraction operation.There are two advantages for applying photon-subtraction operation.Firstly, putting a proper non-Gaussian operation at Alice's side has been proven to be beneficial for lengthening the maximal transmission distance of the traditional CVQKD [25], because this operation can be deemed the preparation trusted noise controlled by Alice, which can well prevent the eavesdropper from acquiring communication information [23,31].Secondly, the photon-subtraction operation tactfully provides a method to divide the incoming signal into two parts, which are the mode B 1 containing most photons for homodyne (or heterodyne) detector and the mode C containing a few subtracted j photons (or even one) for state-discrimination detector respectively.The two parts of signal are subsequently recombined by using the polarization-multiplexing technique with a polarizing beamsplitter (PBS).The recombinational mode B 2 is then sent to the lossy and insecure quantum channel.
In the EB CVQKD scheme, the quantum channel is replaced by an eavesdropper (say Eve) who performs the collective Gaussian attack strategy.This attacks is proved to be an optimal attack strategy in direct and FIG. 1. Schematic diagram of the long-distance CVQKD.Alice detects one half of EPR state (the blue box) using heterodyne detection while another half is sent to the photon-subtraction module (the green box) which splits the incoming signal into two parts.The two parts are then recombined by using polarization-multiplexing technique and subsequently sent to Bob.Eve replaces the quantum channel and performs the optimal entangling cloner attack during the transmission.Bob demultiplexes the incoming signal and measures one of them using homodyne or heterodyne detector, whereas the other mode is sent to the state-discrimination detector (the purple box).BS denotes beam splitter, PBS denotes polarizing beamsplitter, DPC denotes dynamic polarization controller, and PNRD stands for photon number resolving detector.
reverse reconciliation protocols.Very recently, Leverrier [32] shows that it is sufficient to prove the security of CVQKD against collective Gaussian attacks in order to obtain security against general attacks, therefore confirming rigorously the belief that collective Gaussian attacks are indeed optimal against CVQKD.In this kind of attacks, Eve usually prepares her ancillary system in a product state and each ancilla interacts individually with a single pulse sent by Alice, being later stored in a quantum memory [33].The tripartite state then reads, After eavesdropping the communication revealed by Alice and Bob in the data post-processing, Eve applies the optimal collective measurement on the ensemble of stored ancilla to steal the secret information.In particular, Eve can launch the so called entangling cloner [17,21,34]  After passing the untrusted quantum channel, Bob applies another PBS with dynamic polarization controller (DPC) to demultiplex the incoming signal.One of the demultiplexed modes B 4 is then sent to Bob's homodyne or heterodyne detector which is modeled by a BS with transmittance τ and its electronic noise is modeled by an EPR state with variance v el .The mode D is synchronously sent to the state-discrimination detector to improve the system's performance.
This long-distance CVQKD scheme subtly combines the merits of the four-state CVQKD protocol and photon-subtraction operation in terms of lengthening maximal transmission distance, surpassing the SQL via the state-discrimination detector.

III. TECHNIQUES
In this section we show the detailed characteristics of the photon-subtraction operation and the statediscrimination detector that can be used for beating the SQL.

A. Photon-subtraction operation
As shown in Fig. 1, we suggest the EB CVQKD with photon-subtraction operation (the green box) applied at Alice's station, where other modules are temporarily ignored.Alice uses a beam splitter with transmittance µ to split the incoming mode B and the vacuum state C 0 into modes B 1 and C. The yielded tripartite state ρ ACB1 can be expressed by Subsequently a photon-number-resolving detector (PNRD, black dotted box at Alice's side) is adopted to measure mode C by applying positive operator-valued measurement (POVM) { Π0 , Π1 } [35].
The photon number of subtraction j depends on Π1 = |j j|.Only when the POVM element Π1 clicks can Alice and Bob keep A and B 1 .The photon-subtracted state ρ Π1 AB1 is given by where tr X (•) is the partial trace of the multi-mode quantum state and tr ACB1 ( Π1 ρ ACB1 ) is the success probability of subtracting j photons, which can be calculated as where C j n is combinatorial number and ξ = α √ 1+α 2 .After passing the BS, it is worth noticing that the subtracted state ρ Π1 AB1 is not Gaussian anymore, while its entanglement degree increases with the introduction of the photon-subtraction operation [23,25].
Due to the fact that heterodyne detection on one half of the EPR state will project the other half onto a coherent state, which is convenient to implement in experimentation, we take into account a situation where Alice performs heterodyne detection and Bob executes homodyne detection.Suppose Γ (j) AB1 represents the covariance matrix of ρ Π1 AB1 , and it can be given by where See [24] for the detailed calculations.Note that for the proposed long-distance CVQKD scheme, the PNRD which is placed at Alice's side is removed, whereas the subtracted mode C which is supposed to enter the PNRD is recombined with mode B 1 in a PBS by using polarization-multiplexing technique.The task of resolving subtracted photon number is therefore handed over to the state-discrimination detector at Bob's side.

B. State-discrimination detector
We design a state-discrimination detector to increase the performance of the CVQKD coupled with photonsubtraction operation.This quantum detector can unconditionally discriminate four nonorthogonal coherent states in QPSK modulation with the error probabilities lower than the SQL.
As shown in Fig. 2, we depict the structure of the improved state-discrimination detector using photon number resolving and adaptive measurements [36][37][38] in the form of fast feedback.This state-discrimination detector contains M times adaptive measurements in the field of |α .For each measurement i (i ∈ {0, 1, • • • , M }), the strategy first prepares a predicted state |β i which has the highest probability based on the current data in classical memory.Subsequently, a displacement D(β i ) is adopted to displace |α to |α − β i and a PNRD is used to detect the number of photons of the displaced field.If the predicted state is correct, i.e., |β i = |α , Π 0 will click, because the input field is displaced to vacuum so that the PNRD cannot detect any photon [26].Note that different from the photon-subtraction operation where Π 0 clicks represents the failure of subtracting photon, Π 0 clicks here denotes that the improved statediscrimination strategy has correctly predicted the input state.This successful prediction is marked as l i = 0, otherwise l i = 1.After the i-th adaptive measurement, the strategy calculates the posterior probabilities of all possible states (|α i0 , |α i1 ,|α i2 and |α i3 ) using Bayesian inference according to the present label history L Hist and predicted history DHist (Note that for now β i has aready been added to the DHist with previous data to collectively calculate these probabilities), and designates the most probable state as |β i+1 , which is deemed as an input for next feedback.In each feedback period, the probabilities of all possible states are updated dynamically and the posterior probabilities of period i become prior probabilities in period i + 1.The rule of Bayesian inference can be expressed as P po ({|α }|β i , l i ) = A P(l i |β i , {|α })P pr ({|α }), (16) where P po ({|α }|β i , l i ) and P pr ({|α }) are the posterior and prior probabilities respectively, P(l i |β i , {|α }) is conditional Poissonian probability of observing the detection result l i for |α displaced by field β i , and A is the normalization factor calculated by summing Eq. ( 16) over all possible states.Therefore, the final decision |β M +1 of the input state |α can be predicted in the last adaptive measurement M using iterative Bayesian inference [28].
This kind of strategies could surpass the SQL and approach the Helstrom bound with the help of high bandwidth and high detection efficiency.Mathematically, the SQL for discriminating the four nonorthogonal coherent state in QPSK modulation can be expressed by where and the Helstrom bound for the QPSK signals can be approximated by using the square-root measure (SRM) [10], which can be calculated by where )] are eigenvalues of Gram matrix for QPSK signals.As the improved state-discrimination detector is parallel with homodyne or heterodyne detector at Bob's side, the ultimate detection of the states is codetermined by the coherent detector and the state-discrimination detector.From the perspective of information-theoretical sense, we can define an improvement ratio ζ to depict how much performance could the state-discrimination detector enhance the CVQKD system, namely where represents the error probability of statediscrimination detector with M adaptive measurements.Theoretically, the detector could reach the Helstrom bound when M is large enough.Therefore, the optimal improvement ratio ζ opt can be calculated by considering the minimum error probability allowed by quantum mechanics.Thus we have In Fig. (3), we illustrate the error probabilities of discriminating the four nonorthogonal coherent states and FIG. 3. Error probabilities for discriminating QPSK states and improvement ratio as functions of mean photon number n .The dashed line denotes standard quantum limit, the solid line denotes the state-discrimination detector with 10 adaptive measurements, the dotted line denotes Helstrom bound and the red dashed line with squares denotes improvement ratio.
the improvement ratio as functions of mean photon number n .The blue dashed line shows the standard quantum limit to which the conventional and ideal coherent detector can achieve, while the blue solid line shows that the state-discrimination detector with 10 adaptive measurements is below the SQL and approaches the Helstrom bound (the blue dotted line).The red dashed line with squares denotes the optimal improvement ratio which descends quickly with the increased mean photon number but still above 1.Therefore, the proposed detection strategy that consists of state-discrimination detector and coherent detector could improve the performance of CVQKD system, satisfying the requirement of long-distance transmission.

IV. PERFORMANCE AND DISCUSSION
In this section, we show the performance of the proposed long-distance CVQKD scheme with numeric simulation results.To simplify the expression, we only focus on a scenario that Bob performs homodyne detection and reverse reconciliation (RR) in the data post-processing procedure.

A. Parameter optimization
We first demonstrate the optimal values of simulated parameters before giving the performance of secret key rate.It is known that the optimal photon-subtraction operation in Gaussian-modulated CVQKD can be achieved when only one photon is subtracted [23,24], which means that subtracting one photon is the preferred operation to improve the transmission distance.For the proposed long-distance discretely-modulated CVQKD scheme, we show the success probability of subtracting j (j = 1, 2, 3, 4, 5) photons as a function of transmittance µ in Fig. (4).Similar to its Gaussian-modulated counterpart, the success probability of subtracting one photon (j = 1, blue line) outperforms other numbers of photon subtraction and the success probability decreases with the increase of the number of subtracted photons.Meanwhile, as shown in Fig. (3), the red dashed line with squares depicts the improvement ratio of the improved state-discrimination detector.It is obvious that the highest value of the improvement can be obtained with mean photon number n = 1.This coincidence (j = n = 1) allows us to obtain the optimal performance by tactfully combining photon-subtraction operation and statediscrimination detector together.More specifically, the one photon subtracted by photon-subtraction operation at Alice' side is detected by state-discrimination detector at Bob' side, and both modules perform optimally as one photon meets the optimal requirements.Therefore, we consider the optimal one-photon subtraction operation in subsequent simulations to show the best performance of the proposed scheme.
Because channel loss and excess noise are two of the most important factors that would have an effect on the performance of CVQKD system [39], the performance of these parameters with different modulation variance V M needs to be illustrated.In  solid lines denote the performance of the proposed longdistance CVQKD scheme with the optimal one-photon subtraction operation, while dashed lines represent the four-state CVQKD protocol as a comparison, and their secret key rates change as V M changes.The global simulation parameters are as follows: reconciliation efficiency is β = 95%, quantum efficiency of Bob's detection is τ = 0.6 and electronic noise is v el = 0.05.In Fig. (5), excess noise ε and other parameters are fixed to legitimate values, the numerical areas of V M are compressed for the four-state CVQKD protocol when channel loss increases, and the secret key rate decreases rapidly with the increase of channel loss.While for the proposed longdistance CVQKD scheme, V M can be set to a large range of values and its secret key rate increases with the increased V M even though the secret key rate also decreases as channel loss increases, which means the performance of the proposed long-distance CVQKD scheme would be consecutively improved theoretically when the modulation variance is set large enough.However, this cannot be realized in practice, thus the modulation variance V M must be set to a reasonable value in simulations.In Fig. (6), transmission distance, which is proportional to the channel loss (0.2 dB/km), and other parameters are fixed.For the four-state CVQKD protocol, its optimal regions of V M are also compressed with the increased excess noise ε.Fortunately, there is only slight impact on the proposed long-distance CVQKD scheme with onephoton subtraction when excess noise ε changes.It shows the proposed scheme greatly outperforms the four-state CVQKD protocol in terms of tolerable channel excess noise.The reasons may be given as follows.Firstly, excess noise can be deemed channel imperfections which deteriorate the correlation between the two output modes, while photon-subtraction operation can well enhance the correlation which is positively related to entanglement degree of EPR state and thus improves the performance of CVQKD system [23,25].Rendering the CVQKD system that applied this non-Gaussian operation tolerates more higher excess noise.Secondly, the proposed long-distance CVQKD scheme is not very sensitive to the noise with the help of state-discrimination detector, which means Bob can obtain more correct results without performing very precise measurement on quadrature x or/and p.The reason is that the raw key in Gaussian modulated CVQKD protocol is tremendously affected by channel excess noise (and imperfect coherent detector) since its information is directly encoded in quadratures.In the four-state CVQKD protocol, the information is encoded in QPSK modulation which can be unconditionally discriminated by the state-discrimination detector [26].Therefore, the detection strategy could predict incoming state using probability-based method, i.e.Bayesian inference, thus alleviating the impact of excess noise.

B. Secret key rates
Up to now, we have derived the parameters that may largely affect the CVQKD system.In what follows, we consider the secret key rate of the proposed CVQKD scheme.In general, the asymptotic secret key rate can be calculated with the form where β is the efficiency for RR, I(A : B) is the Shannon mutual information between Alice and Bob, and S(E : B) is the Holevo bound [40] of the mutual information between Eve and Bob.For the proposed CVQKD protocol, the asymptotic secret key rate in Eq. ( 22) can be rewritten by As previously mentioned, P Π1 (j) represents the probability of successful subtracting j photons and ζ opt depicts the improvement ratio of the introduced state-discrimination detector.Detailed calculation of the asymptotic secret key rate can be found in Appendix A.
In Fig. (7), we depict the asymptotic secret key rate as a function of transmission distance for the CVQKD protocol.Red line shows the original four-state protocol proposed in [13], yellow line denotes the optimal one-photon subtraction scheme for Gaussian modulated coherent state proposed in [24], blue line represents the scheme of four-state protocol with one-photon subtraction, and the green line denotes the proposed long-distance CVQKD scheme using non-Gaussian state-discrimination detector.The modulation variance V M of above protocols is optimized except for the proposed long-distance CVQKD scheme since its secret key rate is monotonic increasing in a large range of the modulation variance V M , which means that the performance of the proposed scheme can be further improved when V M is set to larger value.However, from the perspective of fair comparison and practical significance, the modulation variance V M of the proposed long-distance CVQKD scheme is reasonably set as same as its fundamental communication protocol, i.e., the four-state CVQKD protocol.As shown in Fig. (7), the proposed long-distance CVQKD scheme outperforms all other CVQKD protocols in terms of maximum transmission distance up to 330 km.Therefore, the proposed long-distance CVQKD scheme using non-Gaussian statediscrimination detector could be more suitable for longdistance transmission.Note that this distance record is limited by the secret key rate more than 10 −6 bits per pulse, and it can be further extended when one considers the secret key rate below this bound.
In addition, finite-size effect [41] needs to be taken into consideration, since the length of secret key is impossibly unlimited in practice.Moreover, one can make the assumption in the asymptotic case that the quantum channel is perfectly known before the transmission FIG. 7. Asymptotic secret key rate as a function of transmission distance with excess noise ε = 0.01.Red line shows the original four-state protocol, yellow line denotes the optimal one-photon subtraction scheme for Gaussian modulated coherent state, blue line represents the scheme of four-state protocol with one-photon subtraction, and the green line denotes the proposed long-distance scheme using non-Gaussian state-discrimination detector.
is performed, while in finite-size scenario, one actually does not know the characteristics of the quantum channel in advance.Because a part of exchanged signals has to be used for parameter estimation rather than generates the secret key.As shown in Fig. (8), the performance of the proposed CVQKD scheme in finite-size regime is outperformed by that obtained in asymptotic limit.The maximum transmission distance significantly decreases when the number of total exchanged signals N decreases.However, it still has a large improvement when comparing with original four-state CVQKD protocol and its Gaussian-modulated protocol counterpart which also take finite-size effect into account.Notice that the performance in the finite-size regime will converge to the asymtotic case if N is large enough.The detailed calculation of secret key rate in the finite-size regime can be found in Appendix B.
Finally, we demonstrate the performance of the proposed long-distance CVQKD scheme in composable security framework.The composable security is the enhancement of security based on uncertainty of the finitesize effect [18] so that one can obtain the tightest secure bound of the protocol by carefully considering every detailed step in CVQKD system [20].In Fig. (9), we show the secret key rate of the proposed long-distance CVQKD scheme with one-photon subtraction operation in the case of composable security, as a function of total exchanged signals N .The performance is more pessimistic than that obtained in the finite-size regime, let alone in the asymptotic limit.For example, assuming that N = 10 14 and the minimal secret key rate is limited to above 10 −6 bis per pulse, the maximal transmission distance in finite-size regime is approximate 320 km (purple line in Fig. (8)), while the maximal transmission distance is reduced to approximate 260 km (light blue line in Fig. ( 9)) when one considers the proposed scheme in composable security framework.Therefore, the composable security, which takes the failure probabilities of every step into account, is the strictest theoretic security analysis of CVQKD system so that one can obtain more practical secure bound.In addition, the composable secret key rate also approaches the asymptotic value for very large N (dashed lines).The detailed calculation of the secret key rate for composable security is shown in Appendix C.
The asymptotic limit, the finite-size scenario and the composable security framework are the efficient approaches to evaluate the performance of CVQKD system.Although the results vary with the different approach, the trends of the performance are similar.Therefore, the proposed long-distance CVQKD using non-Gaussian state-discrimination detector can beat other existing CVQKD protocols in terms of maximal transmission distance and thus meet the requirement of longdistance transmission.

V. CONCLUSION
We have suggested a novel long-distance CVQKD using non-Gaussian state-discrimination detector.The discretely-modulated four-state CVQKD protocol is adopted as the fundamental communication protocol since it can well tolerate the lower SNR and hence it is more suitable for the long-distance transmission compared with Gaussian-modulated counterpart.We deploy a non-Gaussian operation, i.e. photon-subtraction operation at the transmitter, where the photon-subtraction operation is not only used for splitting the signal, but also used for lengthening the transmission distance of CVQKD.Meanwhile, an improved state-discrimination detector is applied at the receiver to codetermine the measurement result with coherent detector.The statediscrimination detector can be deemed as the optimized quantum measurement for the received nonorthogonal coherent states, beating the standard quantum limit using adaptive measurements in the form of fast feedback.Therefore, Bob can obtain more precise result of incoming signal in the QPSK modulation with the help of the state-discrimination detector.By exploiting multiplexing technique, the yielded signals are simultaneously transmitted through an untrusted quantum channel, and subsequently sent to the state-discrimination detector and coherent detector, respectively.Security analysis shows that the proposed scheme can lengthen the maximal transmission distance, and thus outperform other existing CVQKD protocols.Furthermore, by taking the finite-size effect and the composable security into account we obtain the tightest bound of the secure distance, which is more practical than that obtained in asymptotic limit.In terms of possible future research, it would be interesting to design an experiment to implement this long-distance CVQKD scheme for its practical security analysis.The above-mentioned error probabilities can be set to ¯ = P E = P A = 10 10 . (B8) Finally, one can calculate the secret key rate in the finitesize scenario using the derived bounds t min and σ 2 max .
Appendix C: Secret key rate of the CVQKD in composable security We detail the generation of secret key rate of the proposed long-distance CVQKD scheme provided by composable security framework.In Tab.I, we show the definition of parameters in the composable security case.Before the calculation, we give a of composable security for the proposed scheme [20].
The proposed long-distance CVQKD protocol issecure against collective attacks if = 2 sm + + P E / + cor / + ent / and if the final key length n is chosen such that The above-mentioned restraints can be achieved from the covariance matrix Γ Finally, we can calculate the secret key rate of the proposed scheme provided by composable security as follows

FIG. 2 .
FIG. 2.Schematic diagram of the improved statediscrimination detector using photon number resolving and adaptive measurements in the form of feedback.

FIG. 4 .
FIG. 4. Success probability of subtracting j photons for discretely modulated CVQKD with different transmittances µ.The lines from top to bottom represent one-photon subtraction (blue line), two-photon subtraction (red line), threephoton subtraction (yellow line), four-photon subtraction (purple line) and five-photon subtraction (green line).

FIG. 5 .
FIG. 5. Asymptotic secret key rate as a function of modulation variance VM in different channel losses with excess noise ε = 0.01.Solid lines denote the proposed longdistance CVQKD scheme with optimal one-photon subtraction, dashed lines represent the four-state CVQKD protocol.Channel losses are set to 12 dB (blue lines), 16 dB (red lines), 20 dB (yellow lines) and 24 dB (green lines), respectively.Inset (a) is the extended graph with VM to 10. Inset (b) shows the optimal µ for the current secret key rate as a function of modulation variance VM .

FIG. 8 .
FIG. 8. Finite-size secret key rate of the proposed longdistance CVQKD scheme with one-photon subtraction as a function of transmission distance.The excess noise is set to ε = 0.01.From left to right, the solid lines correspond to block lengths of N = 10 8 , 10 10 , 10 12 , 10 14 , 10 15 and 10 16 , and the red dashed line denotes the asymptotic case.The secret key rate is null for a block length of 10 4 .

FIG. 9 .
FIG. 9. Composable secret key rate of the proposed longdistance CVQKD with one-photon subtraction as a function of N , the number of exchanged signals.From top to bottom, solid lines denote the distances of d = 40, 80, 120 and 160 km.The dashed lines correspond to the respective asymptotic case.Inset shows the composable secret key rate of the proposed scheme at long-distance range, the lines from top to bottom denote the distances of d = 260, 280, 300 and 320 km, respectively.Excess noise is ε = 0.01, discretization parameter is d = 5, robustness parameter is rob ≤ 10 −2 and security parameter is = 10 −20 .Other intermediate parameters can be found in Appendix C.

n−∆ ent = log 2 1 − 2 ≤
≤ 2N ĤMLE (U ) − N F (Ω max a leak EC − ∆ AEP − ∆ ent − 2 U ) is the empiric entropy of U , the maximum likelihood estimator (MLE) of H(U ) to be ĤMLE (U ) = − 2 di=1 pi log pi with pi = ni dN denotes the relative frequency of obtaining the value i, and ni is the number of times the variable U takes the value i for i ∈ {1, • • • , 2 d }, F is the function computing the Holevo information between Eve and Bob, and∆ AEP = √ N (d + 1) 2 + √ 16N (d + 1) log 2 2 4N log 2 (2N ) log(2/ sm ).(C3)Now, we consider the calculation of secret key rate of the proposed long-distance CVQKD scheme provided by composable security framework.Since the transmission channel is characterized by transmissivity η and excess noise ε, the following model is used for error correctionβI(A : B) = 2 ĤMLE(U) − 1 2n leak EC ,(C4)where I(A : B) represents the mutual information between Alice and Bob, β denotes the reconciliation efficiency.For the proposed protocol, we obtain I(A : B) that the success probability of parameter estimation is at least 0.99, and hence the robustness of the proposed protocol is rob ≤ 10 −2 .Consequently, the values of random variables ||X|| 2 , ||Y || 2 and X, Y satisfy the following restraints ||X|| AB3 of the proposed CVQKD scheme.According to these bounds, we have the definations Ω attack which is a kind of collective Gaussian attack.Specifically, Eve replaces the channel with transmittance η and excess noise referred to the input χ by preparing the ancilla |E with variance W and a beam splitter with transmittance η.The value W can be tuned to match the noise of the real channel χ line = (1 − η)/η + ε.After that, Eve keeps one mode E 1 of |E and injects the mode E 2 into the unused port of the beam splitter and thus acquires the output mode E 3 .After repeating this process for each pulse, Eve stores her ancilla modes, E 1 and E 3 , in quantum memories.Finally, Eve measures the exact quadrature on E 1 and E 3 after Alice and Bob reveal the classical communication information.The measurement of E 1 allows her to decrease the noise added by E 3 .

TABLE I .
The parameters of the proposed scheme in the composable security framework parameter definition N total number of exchanged light pulses.n size of final key if the protocol did not abort.d number of bits on which each measurement result is encoded.leakEC size of Bob's communication to Alice during error correction step.