Continuous-variable quantum key distribution: security analysis with trusted hardware noise against general attacks

Quantum key distribution (QKD) [1] is a special method of generating a secure key between two parties, Alice and Bob, which will ensure the privacy of transmitted information in the era of the quantum computer. Historically, the first protocols to be presented were discrete variable (DV) ones [2, 3], where information was encoded in the state of a single photon: polarization, phase or time bin. However, over time, continuous variable (CV) protocols [4, 5, 6] have been introduced, which are considered more efficient, high-rate and cost-effective due to the use of homodyne/heterodyne detection systems instead of single photon detectors.

Considering the security of QKD systems, one must take into account that each of them has a finite physical implementation that is not ideal, which opens up opportunities for the eavesdropper, Eve, to carry out a multiple attacks and extract part of the secret key. To prevent this threat, for each protocol, a complex system for assessing the information available to Eve and the acceptable level of errors is being developed.

Currently, a fairly significant amount of work has been presented, covering the topic of security of CV-QKD protocols [7, 8, 9, 10, 11, 12, 13, 14]. Of the protocols most suitable for practical implementation, the GG02 protocol [6, 15] stands out, for which the security is proven against coherent (general) attacks, taking into account the finite-key effects. Moreover, models of untrusted and trusted hardware noise are considered [12]. The latter is preferable, since many security levels imply that Eve does not have access to Alice’s and Bob’s blocks, moreover, accounting for untrusted noise makes the protocol essentially unusable.

Thus, this paper will present a full security proof of CV-QKD on a realistic implementation with trusted hardware noise against general attacks. In Section 2 we describe an optical configuration of the CV-QKD scheme, in Sections 3–5 we give a description of the protocol in the trusted noise scenario and consider a possibility of specific attacks that go beyond general security proof framework. In Section 6 we provide a technique of evaluation and monitoring of experimental parameters and in Section 7 we clarify security analysis and estimate the finite-length secure key generation rate. In Section 8 we discuss the results and draw the appropriate conclusions.

The optical scheme of the described protocol is shown in Figure 1 and consists of the following blocks:

• •

  Alice block, in which the generation of signal states (Gaussian modulation) and a local oscillator (LO) is carried out, after which, by means of polarization-time multiplexing, they sent to Bob. Gaussian modulation itself can be done in two stages: amplitude modulation with a Rayleigh distribution and phase modulation with a uniform phase distribution; as a result, the the complex signal amplitude value will correspond to the Gaussian distribution [16]. It should also be noted that the need for reference signal, which is used in the phase protocols of the DV-QKD [3, 17], is no longer necessary in this case.

• •

  Quantum channel block, which in this work is represented by an optical fiber.

• •

  Bob block, in which demultiplexing and heterodyne detection are carried out.

In the considered configuration Alice uses the same laser to generate LO and signal states modulated according to the Gaussian distribution, which then experience the procedure of polarization-time multiplexing before sending through the quantum channel. Bob then performs a demultiplexing procedure and heterodyne detection. Figure 1 also shows additional elements for monitoring.

In Alice block a continuous wave (CW) laser with a central wavelength of 1550 nm and a spectral line width of 100 kHz is used. The width of the spectral line makes it possible to estimate the coherence time, and also affects the amount of phase noise. Coherent detection systems require the use of sources with a narrow spectral line. The Bob block uses a polarization-maintaining optical fiber of the Panda type due to the sensitivity of the optoelectronic components to polarization and implementation polarization multiplexing. The optical isolator OI1 is used in order to avoid backlight due to reflection on the optical scheme elements in the laser module. An amplitude modulator AM1 is used to form identical optical pulses with a repetition rate of 50 MHz and a duration of 3 ns. Laser pulses then divided by amplitude into two arms using a 10/90 beam splitter BS1: the signal arm (10%) and LO arm (90%).

The second 90/10 beam splitter BS2 in LO arm is used to separate 10% of the optical pulse power and direct it to the photodiode PD1, which allows to organize feedback with an amplitude modulator to control the power of LO.

In the signal arm, Gaussian modulation of optical pulses occurs using an amplitude modulator AM2 and a phase modulator PM. Amplitude modulation is realized according to the Rayleigh distribution with a given variance. Phase modulation is realized according to a uniform distribution in the range from 0 to 2$\pi$. The amplitude modulator AM3 is used as a fast attenuator with a wide range of extinction coefficient to set the average number of photons in an optical pulse. Every second pulse in the signal arm is a reference pulse and is not subjected to amplitude and phase modulation on amplitude modulators AM1 and AM2 and phase modulator PM. The modulators are controlled by a digital-to-analog converter (DAC), which is not indicated on Figure 1.

In the signal and LO arms, 90:10 beam splitters BS3 and BS4 are used to separate part of the signal and LO pulses to control the power and variance (feedback for amplitude modulators AM1 and AM2) using a homodyne detector, which is carried out using 50/50 beam splitter BS5 and balanced detector BD1. For successful balanced detection, it is necessary that the optical paths of the signal and LO are identical.

In order to avoid the interaction of signal pulses and LO before their detection in Bob’s side, time-division and polarization multiplexing is used. Time-division multiplexing is implemented by increasing length of the signal arm in Alice by an amount corresponding to half the pulse repetition period compared to LO arm. Polarization multiplexing is implemented using a polarization combiner PBS1 with a single-mode (SM) output, to which polarization maintaining fibers of two arms are connected with mutually orthogonal slow optical axes.

A SM optical isolator OI2 is used to prevent backlighting of Alice from the channel output. Alice and Bob are connected through a SM optical fiber of the G.652.D standard with a length of 25 km.

On Bob side the signal and LO enters the CWDM filter with a central wavelength of 1550 nm. The use of a CWDM filter is due to protection against backlight at a different wavelength from the channel input. The output of the CWDM filter, corresponding to the reflected light, goes to the monitor photodiode PD2, by the signal from which one can analyse the presence or absence of backlights. The output of the CWDM filter, corresponding to the transmitted light, is connected to the input of the polarization controller PC, which is used to compensate for polarization distortions in the SM optical fiber between the Alice and Bob. The input of a polarization beam splitter PBS2 is connected to the output of the polarization controller, which is used for polarization demultiplexing of the signal and LO. In LO arm there is a delay line for demultiplexing signals in time domain and also a 90:10 beam splitter BS6, which is used to organize feedback of the polarization controller: a part of LO pulse power (10%) is sent to the photodiode PD3 to determine the optical power. The other output of the 90/10 beam splitter, which corresponds to 90% optical power, is connected to LO input of the 90-degree optical hybrid. In the signal arm, after the output of the polarizing beam splitter PBS2, it is connected to the signal input of the 90-degree optical hybrid. The 90-degree optical hybrid has four outputs: two outputs correspond to the sum and difference amplitude of the signal field and LO with zero additional relative phase, and two outputs correspond to an additional phase equal to 90 degrees. The outputs of the 90-degree optical hybrid are connected to the inputs of two balanced detectors. The signal from balanced detectors is entered to analog-to-digital converter (ADC), which is not shown in the Figure 1).

After variable $\rho_{\mathrm{AB}}$ has been removed from the shared state equation, it can be viewed as a pure two-particle state with a common Alice and Bob on one side and Eve on the other. As such, it can be written in terms of the Schmidt decomposition

where $\lambda_{j}$ is a real non-negative number.

Taking a partial trace over subsystems gives

The von Neumann entropy depends only on the $\lambda_{i}$ components, which, due to the Schmidt decomposition, are the same for $\rho_{\mathrm{AB}}$ and $\rho_{\mathrm{E}}$. Therefore, the von Neumann entropy of Eve is the same as the entropy shared by Alice and Bob

Then the following transformation is obvious

In the trusted noise model [12], the noise coming from the Alice’s and Bob’s equipment is assumed to be trusted, that is, Eve cannot manipulate it. The same applies to equipment losses. In this context, it is necessary to clarify the equation (19)

where $\xi_{\mathrm{pr}}$ is an Alice excess noise, $\xi_{\mathrm{ch}}$ is a channel excess noise, and $\xi_{\mathrm{rec}}$ is a Bob excess noise.

Assuming that the detection devices are well calibrated and reliable, $T_{\mathrm{rec}}$ and $\xi_{\mathrm{rec}}$ are beyond Eve’s influence. Then the covariance matrix describing its von Neumann entropy prior to measurement by Bob is

The matrix itself can be represented in the form

The symplectic eigenvalues of this matrix are expressed as

where $z=\sqrt{(a+b)^{2}-4c^{2}}$.

Although in the trusted noise model the quantities $T_{\mathrm{rec}}$ and $\xi_{\mathrm{rec}}$ do not contribute to $S_{\mathrm{E}}$, though they do affect Alice measurements and, consequently, Eve entropy $S_{\mathrm{E}\mid\mathrm{B}}$.

In the trusted noise scenario, the eavesdropper can only manipulate the state in the channel and carry out purifying in the same place. This means that the state of the system must be viewed through three distinct subsystems in the entanglement base scenario. Let the state ”Alice-Bob-Eve” consist of two entangled states and a thermal state, each of which is uniquely determined by its variance: one entangled state $\mathrm{EPR}_{\mathrm{AB}}$ with variance $V$ used for key exchange between Alice and Bob, one entangled state $\mathrm{EPR}_{\mathrm{ch}}$ with variance $W_{\mathrm{ch}}$ for modeling noise and loss in the quantum channel and thermal state $\mathrm{Th}_{\mathrm{rec}}$ with variance $W_{\mathrm{rec}}$ to simulate the noise and losses of the receiver. The beam splitters, one with $T_{\mathrm{ch}}$ transmittance and one with $T_{\mathrm{rec}}$ transmittance, mix the initial Bob’s entangled state modes with the channel state and thermal state modes, respectively. The general state before the action of beam splitters can be represented by the covariance matrix

It can be noted here that the eavesdropper attack on the quantum channel involves only two entangled states, $\mathrm{EPR}_{\mathrm{AB}}$ and $\mathrm{EPR}_{\mathrm{ch}}$, which guarantees purifying as part of an attack. Unitary equivalence with complete purifying thus makes it easier to express the state on Bob’s side: in the general case, it must be represented by another entangled state [14].

The beam splitter in the channel affects Alice’s mode and one of the $\mathrm{EPR}_{\mathrm{ch}}$ state modes; the second beam splitter affects Bob’s mode and the thermal state simulating the detection module

Denoting the sequence of both beam splitters as $\mathrm{BS}_{\mathrm{tot}}=\mathrm{BS}_{\mathrm{rec}}\mathrm{BS}_{\mathrm{ch}}$, the total quantum state is transformed as follows

To simplify expressions for the covariance matrix, it should be considered block by block. Thus, the block describing Alice-Bob subsystem is transformed as follows

Let the variances for entangled states be defined as

Then the variance of Bob’s quadrature operator is

Final expression for Alice-Bob block

Eve block is described by the matrix

This matrix can be described in the form given by Eq. (32), so its symplectic eigenvalues can be calculated by Eq. (33). It can be verified that the entropy of Eve $S_{\mathrm{E}}$ is the same as the entropy shared by Alice and Bob and obtained from their mutual covariance matrix in the trusted receiver noise scenario from Eq. (31), which is expected when Eve purifies the state of Alice and Bob, i.e.

Now, in order to get $S_{\mathrm{E\mid B}}$, we have to calculate $\Sigma_{\mathrm{tot\mid B}}$, i.e. the covariance matrix of the common state of the remaining modes after the projective measurement of the receiver mode. It is convenient to represent $\Sigma_{\mathrm{tot}}$ so that the Alice’s mode is located in the last row and column. This can be done by using a permutation matrix, which allows to rearrange the third and fourth rows (columns) down (to the right) when multiplied by $\Sigma_{\mathrm{tot}}$ from the left (right) [14]:

Since $P_{3,\>4\rightarrow 9,\>10}P_{3,\>4\rightarrow 9,\>10}^{T}=\mathbf{1}$, the above permutation is a similarity transformation and therefore leaves the eigenvalues of the matrix $\Sigma_{\mathrm{tot}}$ invariant. The covariance matrix itself now looks like this:

where $\Sigma_{\mathrm{A},\>\mathrm{ch},\>\mathrm{rec}}\in\mathbb{R}^{8\times 8}$ is a matrix describing the Alice’s mode and the state of the channel and the detection module, $\Sigma_{\mathrm{B}}\in\mathbb{R}^{2\times 2}$ is a matrix describing the Bob’s mode, and $\Sigma_{C}\in\mathbb{R}^{8\times 2}$ is a matrix describing quadrature correlations between $\Sigma_{\mathrm{A},\>\mathrm{ch},\>\mathrm{rec}}$ and $\Sigma_{\mathrm{B}}$.

The $\Sigma_{\mathrm{tot\mid B}}$ matrix after a projective measurement of the Bob’s mode depends on whether it performs homodyne or heterodyne detection.

In the case of heterodyne detection, the remaining modes are projected into the state described by the $8\times 8$ matrix

Again, there is no need to evaluate the entire covariance matrix. Instead, one can evaluate a block describing the eavesdropper information, that is two modes representing the entangled state that was used to model the noise and channel loss. The block itself is expressed as follows

Considering that the matrix $\Sigma_{\mathrm{E\mid B}}$ can also be represented in the form of Eq. (32), then the symplectic eigenvalues can also be represented similarly to the formula (33) as

Thus, the necessary values for estimating the Holevo bound in the presence of collective attacks in the trusted receiver noise scenario have been obtained. Further, the model will need to be supplemented taking into account the lack of access of Eve to the noise of Alice in order to consider the full scenario of trusted noise from trusted nodes.

The noise on Alice side can be composed of noise from laser power fluctuation and imperfect modulation [20, 13]. Models of such trusted Alice noise for collective attacks are presented in [21, 22, 23, 14]. This noise is modeled by analogy with the noise of the channel and the detection module using an additional thermal state $\mathrm{Th}_{\mathrm{pr}}$ with variance

where $T_{\mathrm{pr}}$ is a transmittance coefficient of Alice module.

Then the Alice noise measured by Bob will be $\xi_{\mathrm{pr,\>B}}=T_{\mathrm{ch}}T_{\mathrm{rec}}\xi_{\mathrm{pr}}$. The thermal state $\mathrm{Th}_{\mathrm{pr}}$ interacts with the Bob’s mode through a beam splitter with a transmittance $T_{\mathrm{pr}}\rightarrow 1$, since the initial signal power is assumed already at the output of Alice module. While the limit $T_{\mathrm{pr}}\rightarrow 1$ would result in $W_{\mathrm{pr}}\rightarrow\infty$, the noise $\left(1-T_{\mathrm{pr}}\right)W_{\mathrm{pr}}=\xi_{\mathrm{pr}}+1-T_{\mathrm{pr}}\rightarrow\xi_{\mathrm{pr}}$ of the mode reflected into the channel will be finite and good certain.

The problem can again be reduced to considering only two modes available to Eve, reducing the eigenvalue problem to a second degree polynomial. This allows to describe the trusted noise of Alice and Bob using simple analytical expressions.

The overall initial state now includes the thermal state responsible for the Alice’s noise

Then one should redesignate the sequence of all beam splitters $\mathrm{BS}_{\mathrm{tot}}=\mathrm{BS}_{\mathrm{rec}}\mathrm{BS}_{\mathrm{ch}}\mathrm{BS}_{\mathrm{pr}}$. Then the sympectic transformation, analogous to Eq. (52), will change the block of the covariance matrix related to the eavesdropper as

Obviously, the matrices from the expressions (58) and (79) coincide up to the replacement $V\rightarrow V+\xi_{\mathrm{pr}}$. The symplectic eigenvalues $v_{1}$ and $v_{2}$ required for calculating $S_{\mathrm{E}}$ are again obtained by the formula (33). To calculate $v_{3}$ and $v_{4}$ for $S_{\mathrm{E\mid B}}$, $\Sigma_{\mathrm{tot}\mid\mathrm{B}}$ must be rearranged according to the modified shared state structure.

Thus, after substitution $T_{\mathrm{pr}}=1$ and with the accuracy of replacement $V\rightarrow V+\xi_{\mathrm{pr}}$, the Eve’s covariance matrix after heterodyne detection by Bob has the form in accordance with expression (71). The symplectic eigenvalues $v_{3}$ and $v_{4}$ are again obtained by the formulas (72)-(74).

The advantage of this model is that as equipment losses increase, the Holevo bound decreases faster than mutual information [14].

The Gaussian quantum channel, as already mentioned in this paper, is characterized by two parameters: the transmittance and excess noise. Often CV-QKD papers do not provide clarifications on the components of these characteristics [16, 24, 25]: an analytical assessment has been carried out only for some components.

Modeling the parameters of the Gaussian channel is necessary to obtain the value of the signal-to-noise ratio, which will be maintained at a given distance.

As has already been demonstrated in the previous section, the transmittance is composite, which is why it cannot be estimated in the aggregate, which, for example, was done in [26, 24]. This assumption significantly improves the performance and the amount of allowable losses in the stability analysis but remains incorrect.

So, given that the quantum channel is an optical fiber channel, the transmittance can be estimated in accordance with the well-known expression [27]:

where $\zeta$ is a fiber attenuation in dB/km.

The coefficient $T_{\mathrm{det}}$ can be obtained from equipment loss and detector efficiency as:

where $\mathrm{losses}$ is a cumulative losses on the Alice’s equipment.

Here it should be clarified that $T_{\mathrm{det}}$ is a transmittance in the signal arm, $T_{\mathrm{det}}^{\prime}$ is a transmittance in LO arm. The latter will be necessary for estimating the excess noise. Both coefficients are calculated using the formula (81) taking into account the fact that losses in both arms are different. For example, the power of LO is expressed as

where $P_{\mathrm{LO,\>A}}$ is a power of LO at the output of Alice.

The cumulative losses on the equipment in Bob module are presented in the Table 1.

In many theoretical works, the excess noise values are approximated and fixed [36, 25, 37, 38, 14]. This is motivated by the fact that in real CV-QKD systems, the excess noise, as well as the transmittance, is estimated from experimental data on the variances of quadrature operators. As far as strictly theoretical works are concerned, the substitution is necessary only for illustrative purposes. However, for a theoretical performance evaluation of the considered CV-QKD system, it is necessary to take into account various noise sources, which will be further carried out in accordance with the work [13].

Like the transmittance, excess noise is compound. In this case, the excess noise components are:

• •

  Alice module noises:

  • –

    laser power fluctuations noise;

  • –

    DAC noise;

• •

  channel noises:

  • –

    phase noise;

• •

  Bob module noises:

  • –

    common-mode rejection ratio (CMRR) noise;

  • –

    internal noise of the balanced detector;

  • –

    ADC noise.

Laser power fluctuations noise contains of two components, signal and LO ones

where $\mathrm{RIN}_{\mathrm{sig}}$ is a relative intensity noise (RIN) of signal, $\mathrm{RIN}_{\mathrm{LO}}$ is a relative intensity noise of LO, $B_{\mathrm{sig}}$ is a signal spectrum width, and $B_{\mathrm{LO}}$ is a LO spectrum width.

It is important to note that due to the fact that both the signal and LO emit from the same laser, the spectral width and relative intensity noise for them will be the same [13], i.e. $B_{\mathrm{sig}}=B_{\mathrm{LO}}\equiv B$, $\mathrm{RIN}_{\mathrm{sig}}=\mathrm{RIN}_{\mathrm{LO}}\equiv\mathrm{RIN}$.

The excess noise caused by noise from the modulating voltage side is expressed by the inequality [13]

where $V_{\pi}$ is a voltage required to reverse the phase by $\pi$, $\alpha$ is a DAC gain coefficient, $V_{\mathrm{q}}$ is a converter output voltage variance, LSB is aleast significant bit, $V_{\mathrm{FS}}$ is a full-scale voltage range of the converter, and $N_{\mathrm{res}}$ is a DAC resolution.

Coherent quantum signal detection requires a well calibrated phase and frequency relationship between the signal and LO. In addition, the signal initially carries a certain level of phase noise. This phase noise, as well as relative phase shifts, can be compensated with a strong reference sent by Alice [39, 40, 41, 42]. The reference (or pilot) signal carries well-known phase with a fixed phase relation to the original signal pulse. Bob performs heterodyne detection of the reference signal by measuring its quadratures $q$ and $p$. It can determine the deviation from a fixed and time-constant reference phase. Any of such measured phase shift is used to appropriately correct the measured phase of the quantum signal. The remaining phase noise is then expressed as [13]

where $V_{\mathrm{pt}}$ is a variance of the quadrature operator of the reference signal, $N_{\mathrm{pt}}$ is a number of the reference signals, $\left\langle N_{\mathrm{pt}}\right\rangle$ is a the average number of photons in the reference pulse.

It should be noted that at purposed paper, it is assumed that for each signal message there is a reference signal, i.e. the number of reference signals is half of the total number of messages.

It is convenient to express the internal noise of a balanced detector in terms of a characteristic called clearance $C$, which is defined as the ratio of the total experimental variance of a zero power signal (dispersion shot noise $V_{0}(\hat{q})$ and electronic noise of dispersion $V_{\operatorname{det}}(\hat{q})$) and variance $V_{\operatorname{det}}(\hat{q})$ caused only by detector electronic noise:

The shot noise variance depends linearly on the power of LO, which, however, is limited by the saturation limit of the detector’s PIN diodes. Experimentally, the numerator of the Eq. (89) can be determined by measuring the quadrature variance of LO when it is mixed with the vacuum inlet. The denominator is the remaining quadrature variance after LO is disconnected from the detector. In SNU by definition $V_{0}(\hat{q})=1$, and the equation becomes

Thus, the noise of a balanced detector relative to the clearance, taking into account one/two detectors in homo-/heterodyne detection respectively, is

An experimental evaluation of $\xi_{\mathrm{det}}$ was carried out for the General Photonics OEM Balanced Detector (BPD-003) with an operating frequency band of 200 MHz (see Figure 2). The choice of the detector was based on the following parameters for the optimal signal-to-noise ratio:

• •

  low noise equivalent power — indicates the possibility of detecting signals with a power comparable to that of shot noise;

• •

  high gain coefficient — allows detection of low power signals with high attenuation of LO;

• •

  high CMRR — shows the gain quality;

• •

  a wide operating frequency band — allows to increase the frequency of sending states, which, in accordance with the current technical level, should be about MHz [26, 16, 24]. The established relationship between the excess noise of the detector and its operating frequency band is linear [13], so a too large range can lead to a high level of internal detector noise.

The dependence of excess noise of the detector and, as a result, the signal-to-noise ratio on the operating frequency band does not have a minimum due to linearity, however, as can be seen in Figure 2, the obtained noise level in the considered detector is quite low and corresponds to the level established by [13, 24]. So, for example, with a total loss of 13.7 dB (5 dB in the channel and 8.7 dB in LO arm), $\xi_{\mathrm{det}}=0.093$ is observed in [13] at operating frequency band of the detector is 250 MHz. In [24] $\xi_{\mathrm{det}}\sim 10^{-1}$, based on the given data.

According to the obtained dependence of the excess noise of the balanced detector on the input power of LO, one can observe an increase in the contribution of the noise with a decrease in its values. In practice, a decrease in power is associated with an increase in losses. The resulting dependence will be used later in the overall assessment of the total excess noise. The experimental background of the obtained formula is related to the fact that the proposed models do not take into account the full composition of the balanced detector.

A realistic differential amplifier will amplify not only the difference current with a coefficient $g$, but also to a small extent with a coefficient $g_{\mathrm{CM}}$ their average value of the input photocurrents in the subtractive circuit. As a characteristic for estimating such amplification, CMRR [43] is used:

Noise dependent on CMRR is calculated as [13]:

where $P_{\mathrm{LO}}$ is a LO power, $\tau$ is a pulse duration, $f$ is an optical frequency and $h$ is a Planck’s constant.

The incoming signal pulse will be received and amplified by Bob’s balanced detector, where the output voltage will be proportional to the measured quadrature. However, if the output voltage is quantized by DAC, it will introduce additional error into the measured signal, thereby contributing to excess noise as [13]:

where $g$ is a gain coefficient of the electrical circuit of balanced detector and $\rho$ is a photodiode responsivity.

It should be noted that in the equations (86) and (94) the output voltage variance of DAC and ADC are equal, because they are selected with the same scope and resolution.

The calculation of the components of the total excess noise was carried out in accordance with the parameters specified in Table LABEL:tab:parameters. The substantiation of the variance of the quadrature operator is given below in Sec. 6.1. It is important that in the considered case of transmitted LO (see Figure 1), the power of the LO, as well as the signal power, depends significantly on the losses on equipment and in the channel, which must be taken into account in assessing the excess noise related to the receiver.

This subsection describes the procedure for assessing, optimizing and monitoring the key parameters of the CV-QKD. Since the selection of parameters directly affects the secure key generation rate, it is necessary to introduce a boundary with respect to which the calculation will be carried out.

In the general case, the secure key generation rate $K$ is determined by

where $f_{\mathrm{sym}}$ is a repetition rate and $r$ is a secure key fraction.

The asymptotic secure key generation rate in terms of a message with ideal post-processing for the CV-QKD system in the case of collective attacks is given by the Devetak-Winter bound [45] as

Given the non-ideal reverse reconciliation, the bound can be refined as

where $\mathrm{FER}\in[0,\>1]$ is a frame error rate (FER).

The quantities $I_{\mathrm{AB}}$ and $\chi_{\mathrm{EB}}$ are respectively obtained by the formulas (24) and (29). The dependence of these quantities on losses in the quantum channel is shown in Figure 3.

It can be seen that the Holevo bound does not exceed the mutual information at large distances, thereby keeping the secure key generation rate positive (see Figure 3). Such an assessment poorly reflects reality, because with an infinite number of messages, and, hence, with an infinite sample for estimating the parameters and an infinite number of reference signals, the excess noise in the channel is very small. At the same time, the excess noise and losses on Bob side are still large. Limitations on the quantum channel length, as, for example, in [14], are due to the fact that the excess noise model uses not analytical expressions, but approximate fixed values. It can also be noted that when using error correction codes over an alphabet of size $q$, each symbol of the code corresponds to $\log_{2}q$ bits, and for a given code rate $R$, which is selected based on the channel parameters, one can write  [13]: