Security of continuous-variable quantum key distribution via a Gaussian de Finetti reduction

TL;DR

This paper introduces a new Gaussian de Finetti reduction method for continuous-variable quantum key distribution, proving security against general attacks by focusing on Gaussian collective attacks, thus confirming their optimality.

Contribution

It develops a novel Gaussian de Finetti reduction leveraging $U(n)$ invariance and generalized $SU(2,2)$ coherent states, enabling security proofs against general attacks.

Findings

Security against general attacks reduces to security against Gaussian collective attacks.

The new reduction confirms Gaussian attacks are optimal for these protocols.

Provides a rigorous foundation for the security of continuous-variable QKD.

Abstract

Establishing the security of continuous-variable quantum key distribution against general attacks in a realistic finite-size regime is an outstanding open problem in the field of theoretical quantum cryptography if we restrict our attention to protocols that rely on the exchange of coherent states. Indeed, techniques based on the uncertainty principle are not known to work for such protocols, and the usual tools based on de Finetti reductions only provide security for unrealistically large block lengths. We address this problem here by considering a new type of Gaussian de Finetti reduction, that exploits the invariance of some continuous-variable protocols under the action of the unitary group $U(n)$ (instead of the symmetric group $S_n$ as in usual de Finetti theorems), and by introducing generalized $SU(2,2)$ coherent states. Our reduction shows that it is sufficient to prove the security of these protocols against Gaussian collective attacks in order to obtain security against general attacks, thereby confirming rigorously the widely held belief that Gaussian attacks are indeed optimal against such protocols.

Equations

$$\Vert \Delta {\Vert }_{\diamond }=\underset{\rho \in \mathfrak{S}(\mathcal{H}\otimes {\mathcal{H}}^{\prime })}{\sup }\Vert (\Delta \otimes \text{mathbbm}{1}_{{\mathcal{H}}^{\prime }})(\rho ){\Vert }_1$$

$$\Vert \Delta \circ \mathcal{T}{\Vert }_{\diamond }\le \Vert \Delta \circ \mathcal{P}{\Vert }_{\diamond }+2\Vert (\text{mathbbm}1-\mathcal{P})\circ \mathcal{T}{\Vert }_{\diamond }.$$

$$F_{2,2,n}^{U(n)}=\left\{|\psi ⟩\in F_{2,2,n}:W_u|\psi ⟩=|\psi ⟩,\forall u\in U(n)\right\},$$

$$Z_{11}$$

$$Z_{21}$$

$$|\Lambda ,n⟩=\det (1-\Lambda {\Lambda }^{†}{)}^{n/2}\exp \left(\sum _{i,j=1}^2{\lambda }_{ij}{Z}_{ij}\right)|\mathrm{vacuum}⟩.$$

$${\int }_{\mathcal{D}}|\Lambda ,n⟩⟨\Lambda ,n|\mathrm{d}{\mu }_n(\Lambda )=\text{mathbbm}{1}_{F_{2,2,n}^{U(n)}}$$

$$\mathrm{d}{\mu }_n(\Lambda )=\frac{(n-1)(n-2{)}^2(n-3)}{{\pi }^4\det (\text{mathbbm}{1}_2-\Lambda {\Lambda }^{†}{)}^4}\mathrm{d}{\lambda }_{11}\mathrm{d}{\lambda }_{12}\mathrm{d}{\lambda }_{21}\mathrm{d}{\lambda }_{22}.$$

$$\mathrm{Span}\left\{(Z_{11}{)}^i(Z_{12}{)}^j(Z_{21}{)}^k(Z_{22}{)}^{\ell }|\mathrm{vac}⟩:i+j+k+\ell \le K\right\}.$$

$${\int }_{{\mathcal{D}}_{\eta }}|\Lambda ,n⟩⟨\Lambda ,n|\mathrm{d}{\mu }_n(\Lambda )\ge (1-\epsilon ){\Pi }_{\le K}$$

$$\Vert \Delta {\Vert }_{\diamond }\le \frac{K^4}{50}\Vert (\Delta \otimes \mathrm{id}){\tau }_{\mathcal{H}\mathcal{N}}^{\eta }{\Vert }_1,$$

$$\Vert (({\mathcal{E}}_0-{\mathcal{F}}_0)\otimes \mathrm{id})(|\Lambda ,n⟩⟨\Lambda ,n|){\Vert }_1\le \epsilon$$

$${\epsilon }^{\prime }=\frac{K^4}{50}\epsilon$$

$$F_{2,2,n}:=\underset{k=0}{\overset{\infty }{⨁}}{\mathrm{Sym}}^k(H_A\otimes H_B\otimes H_{A^{\prime }}\otimes H_{B^{\prime }}),$$

$$\Vert \psi {\Vert }^2:=⟨\psi ,\psi ⟩=\frac{1}{{\pi }^{4n}}\int \exp (-|z{|}^2-|z^{\prime }{|}^2)|\psi (z,z^{\prime }){|}^2\mathrm{d}z\mathrm{d}{z}^{\prime }<\infty$$

$$U(n)$$

$$u$$

$$W_u\psi =\psi \forall u\in U(n).$$

$${\mathrm{Sym}}^n(\text{mathbbm}{C}^d):=\left\{|\psi ⟩\in (\text{mathbbm}{C}^d{)}^{\otimes n}:P(\pi )|\psi ⟩=|\psi ⟩,\forall \pi \in S_n\right\}$$

$$Z_{11}=\sum _{i=1}^n{z}_{i,1}{z}_{i,1}^{\prime }$$

$$Z_{12}=\sum _{i=1}^n{z}_{i,1}{z}_{i,2}^{\prime }$$

$$Z_{21}=\sum _{i=1}^n{z}_{i,2}{z}_{i,1}^{\prime }$$

$$Z_{22}=\sum _{i=1}^n{z}_{i,2}{z}_{i,2}^{\prime }$$

$$\displaystyle|\psi\rangle=f\big{(}\sum_{i=1}^{n}a_{i}^{\dagger}b_{i}^{\dagger},\sum_{i=1}^{n}a_{i}^{\dagger}a^{\prime\dagger}_{i},\sum_{i=1}^{n}b_{i}^{\dagger}b^{\prime\dagger}_{i},\sum_{i=1}^{n}a^{\prime\dagger}_{i}b^{\prime\dagger}_{i}\big{)}|\mathrm{vacuum}\rangle$$

$$SU(2,2):=\left\{A\in M_4(\mathbb{C}):A\text{mathbbm}{1}_{2,2}{A}^{†}=\text{mathbbm}{1}_{2,2}\right\}$$

$$H:=\left\{g\in G:T_g|{\psi }_0⟩=\alpha |{\psi }_0⟩\text{for}|\alpha |=1\right\},$$

$$\mathcal{D}=\left\{\Lambda \in M_2(\mathbb{C}):\text{mathbbm}{1}_2-\Lambda {\Lambda }^{†}>0\right\},$$

$${\psi }_{\Lambda ,n}(Z_{1,1},\dots ,Z_{2,2})=\det (1-\Lambda {\Lambda }^{†}{)}^{n/2}\det \exp ({\Lambda }^{T}Z)$$

$${\psi }_{\Lambda ,n}={\psi }_{\Lambda ,1}^{\otimes n}.$$

$${\int }_{\mathcal{D}}|\Lambda ,n⟩⟨\Lambda ,n|\mathrm{d}{\mu }_n(\Lambda )=\text{mathbbm}{1}_{F_{2,2,n}^{U(n)}},$$

$$\mathrm{d}{\mu }_n(\Lambda )=\frac{(n-1)(n-2{)}^2(n-3)}{{\pi }^4\det (\text{mathbbm}{1}_2-\Lambda {\Lambda }^{†}{)}^4}\prod _{i=1}^2\prod _{j=1}^2\mathrm{d}\mathfrak{R}({\Lambda }_{i,j})\mathrm{d}\mathfrak{I}({\Lambda }_{i,j}),$$

$$B(k,n)={\int }_0^1{t}^{k-1}(1-t{)}^{n-1}\mathrm{d}t=\frac{(k-1)!(n-1)!}{(n+k-1)!},B(x;k,n)={\int }_0^x{t}^{k-1}(1-t{)}^{n-1}\mathrm{d}t,$$

$$I_x(k,n)=\frac{B(x;k,n)}{B(k,n)}.$$

Full text

Quantum key distribution (QKD) is a cryptographic primitive aiming at distributing large secret keys to two distant parties, Alice and Bob, who have access to an authenticated classical channel. Mathematically, a QKD protocol $\mathcal{E}$ is described by a quantum channel, that is a completely positive trace-preserving (CPTP) map transforming an input state, typically a large bipartite entangled state shared by Alice and Bob, into two keys, ideally two identical bit strings unknown to any third party. Establishing the security of the protocol against arbitrary attacks means proving that the map $\mathcal{E}$ is approximately equal to an ideal protocol $\mathcal{F}$. An operational way of quantifying the security is by bounding the completely positive trace distance, or diamond distance between the two maps Portmann and Renner (2014): the protocol is said to be $\varepsilon$-secure if $\|\mathcal{E}-\mathcal{F}\|_{\diamond}\leq\varepsilon$. If $\mathcal{E}$ and $\mathcal{F}$ act on some Hilbert space $\mathcal{H}$ and $\Delta=\mathcal{E}-\mathcal{F}$, then the diamond norm is defined as

[TABLE]

where $\|\cdot\|_{1}$ is the trace norm and $\mathfrak{S}(\mathcal{H}\otimes\mathcal{H}^{\prime})$ is the set of normalized density matrices (positive operators of trace 1) on $\mathcal{H}\otimes\mathcal{H}^{\prime}$ with $\mathcal{H}^{\prime}\cong\mathcal{H}$ (see e.g. Watrous (2016)). Computing an upper bound of Eq. (1) is very challenging in general because the Hilbert space $\mathcal{H}=\mathcal{H}_{1}^{\otimes n}$ has a dimension scaling exponentially with the number $n$ of quantum systems shared by Alice and Bob. Typical values of $n$ range in the millions or billions.

In order to estimate the diamond norm, it is natural to exploit all the symmetries displayed by $\Delta$. For instance, if $\mathcal{E}$ is a QKD protocol involving many 2-qubit pairs, such as BB84 for instance Bennett and Brassard (1984), then $\Delta$ might be covariant under any permutation of these pairs. For such maps, Christandl, König and Renner Christandl et al. (2009) showed that the optimization of Eq. (1) can be dramatically simplified provided that one is only interested in a polynomial approximation of $\|\Delta\|_{\diamond}$: indeed, it is then sufficient to consider a single state, called a “de Finetti state”, instead of optimizing over $\mathcal{H}\otimes\mathcal{H}^{\prime}\cong(\mathbb{C}^{4})^{n}\otimes(\mathbb{C}^{4})^{n}$. More precisely, this de Finetti state is a purification of $\tau_{\mathcal{H}}=\int\sigma_{\mathcal{H}_{1}}^{\otimes n}\mu(\sigma_{\mathcal{H}_{1}})$, where $\mathcal{H}_{1}\cong\mathbb{C}^{4}$ is the single-system Hilbert space and $\mu(\cdot)$ is the measure on the space of density operators on a single system induced by the Hilbert-Schmidt metric.

This approach, called a de Finetti reduction, has been applied successfully to analyze the security of QKD protocol such as BB84 Sheridan et al. (2010) or qudit protocols Sheridan and Scarani (2010). Indeed, computing the value of $\|(\Delta\otimes\mathbbm{1}_{\mathcal{H}^{\prime}})\tau_{\mathcal{H}\mathcal{H}^{\prime}}\|_{1}$ for some purification $\tau_{\mathcal{H}\mathcal{H}^{\prime}}$ of $\tau_{\mathcal{H}}$ is usually tractable and is closely related to the task of establishing the security of the QKD protocol against collective attacks, corresponding to restricting the inputs of $\mathcal{E}$ to i.i.d. states of the form $\sigma_{\mathcal{H}_{1}}^{\otimes n}$. A full security proof then consists of two steps: proving the security against these restricted collective attacks, and applying the de Finetti reduction to obtain security (with a polynomially larger security parameter) against general attacks.

An outstanding problem in the theory of QKD is to address the security of protocols with continuous variables, that is protocols encoding the information in the continuous degrees of freedom of the quantified electro-magnetic field Weedbrook et al. (2012); Diamanti and Leverrier (2015). From a practical point of view, the essential difference between continuous-variable (CV) protocols and discrete-variables ones lies in the detection method: CV protocols rely on coherent detection, either homodyne or heterodyne depending on whether one or two quadratures are measured for each mode, while discrete-variable protocols use photon counting. The main theoretical difference is the Hilbert space $\mathcal{H}$, which is infinite-dimensional for CV QKD, corresponding to a $2n$-mode Fock space: $\mathcal{H}=F(\mathbb{C}^{n}\otimes\mathbb{C}^{n})=\bigoplus_{k=0}^{\infty}\mathrm{Sym}^{k}(\mathbb{C}^{n}\otimes\mathbb{C}^{n})$, where $\mathrm{Sym}^{k}(H)$ stands for the symmetric part of $H^{\otimes k}$. Note that the definition of Eq. (1) is formally restricted to finite-dimensional spaces, but we will ignore this issue here because one can always truncate $\mathcal{H}$ to make its dimension finite (arbitrary large) and will therefore assume that the supremum can still be taken on $\mathcal{H}\otimes\mathcal{H}^{\prime}$ for $\mathcal{H}^{\prime}\cong\mathcal{H}$. For later convenience, let us denote $\mathcal{H}$ by $F_{1,1,n}$ and $\mathcal{H}\otimes\mathcal{H}^{\prime}$ by $F_{2,2,n}:=F(\mathbb{C}^{2n}\otimes\mathbb{C}^{2n})\cong F_{1,1,n}\otimes F_{1,1,n}$.

A possible strategy to prove the security of such CV protocols is to follow the same steps as for BB84: first establish the security against collective attacks, then prove that this implies security against general attacks (with a reasonable loss). For protocols involving a Gaussian modulation of coherent states and heterodyne detection Weedbrook et al. (2004), composable security against collective attacks was recently demonstrated in Leverrier (2015). The second step is to apply the de Finetti reduction outlined above. The difficulty here comes from the infinite dimensionality of the Fock space $\mathcal{H}$. In order to apply the technique of Christandl et al. (2009), it is therefore needed to truncate the Fock space in a suitable manner. This can be achieved with the help of an energy test, but unfortunately, the local dimension of $\overline{\mathcal{H}}_{1}$, the truncated single-mode space, needs to grow like the logarithm of $n$, for the technique to apply Leverrier et al. (2013). Indeed, the technique of Christandl et al. (2009) was developed for finite-dimensional systems, and the energy test needs to enforce that with high probability, each the unmeasured modes contains a number of photons below some given threshold. Such a guarantee can only be obtained for a threshold increasing logarithmically with $n$. The dimension of the total truncated Hilbert space is then super-exponential in $n$, on the order of $(\log n)^{Cn}$, for some constant $C>1$. Since the loss in the security parameter obtained with Christandl et al. (2009) is superpolynomial in the dimension of the total Hilbert space, this means that if the protocol is $\varepsilon$-secure against collective attacks, this approach only shows that the protocol is also $\varepsilon^{\prime}$-secure against general attacks with $\varepsilon^{\prime}=\varepsilon\times 2^{\mathrm{polylog}(n)}$. While this gives a proof that the protocol is asymptotically secure in the limit of infinitely large block lengths, it fails to provide any useful bound in practical regimes where $n\sim 10^{6}-10^{9}$. We note that a related strategy relies on the exponential de Finetti theorem but fails similarly to provide practical security bounds in the finite-size regime Renner (2008); Renner and Cirac (2009).

Let us also mention that there exists a CV QKD protocol with proven security where Alice sends squeezed states to Bob instead of coherent states Cerf et al. (2001). This protocol can be analyzed thanks to an entropic uncertainty relation Furrer et al. (2012), but this technique requires the exchange of squeezed states, which makes the protocol much less practical. Moreover, this approach does not recover the secret key rate corresponding to Gaussian attacks in the asymptotic limit of large $n$, even though these attacks are expected to be optimal. Here, in contrast, we are interested in the security of CV protocols based on the exchange of coherent states.

The idea that we exploit in this paper is that CV QKD protocols not only display the permutation invariance common to most QKD protocols, but also a specific symmetry with a continuous-variable flavor Leverrier et al. (2009). This new symmetry is linked to the unitary group $U(n)$ instead of the symmetric group $S_{n}$. More precisely, the protocols are covariant if Alice and Bob process their $n$ respective modes with linear-optical networks acting like the unitary $u\in U(n)$ on Alice’s annihilation operators and its complex conjugate $\overline{u}$ on Bob’s annihilation operators.

Our main technical result is an upper bound on $\|\Delta\|_{\diamond}$ for maps $\Delta$ covariant under a specific representation of the unitary group. For such maps, we show that is it sufficient to consider again a single state, which is the purification of a specific mixture of Gaussian i.i.d. states. This in turn will imply that it is sufficient to establish the security of the protocol against Gaussian collective attacks in order to prove the security of the protocol against general attacks. An important technicality is that we still need to truncate the total Hilbert space to replace it by a finite-dimensional one. Crucially, this truncation can now be done globally and not for single-mode Fock spaces as in Leverrier et al. (2013) and this is this very point that makes our approach so effective. Indeed, in our security proof, we argue that it is sufficient to consider states that are invariant under the action of $U(n)$ and such states live in a very small subspace of the ambient Fock space. More precisely, the dimension of the restriction of this subspace to states containing $K$ photons grows polynomially in $K$, instead of exponentially in the case of the total Fock space. This phenomenon is reminiscent of the fact that the dimension of the symmetric subspace of $(\mathbb{C}^{\otimes d})^{\otimes n}$ only grows polynomially in $n$ if the local dimension $d$ is constant.

The consequence is that the security loss due to the reduction from general to collective attacks will not scale like $2^{\mathrm{polylog}(n))}$ anymore, but rather like $O(n^{4})$, which behaves much more nicely for typical values of $n$, and yields the first practical security proof of a CV QKD protocol with coherent states against general attacks. Indeed, our security reduction performs even better than the original de Finetti reduction developed for BB84, where the security loss scales like $O(n^{15})$ Christandl et al. (2009).

Ideally, truncating the Fock space could be done by projecting the quantum state given as an input to $\Delta$ onto a finite dimensional subspace with say, less than $K$ photons (where the value of $K$ scales linearly with the total number of modes). Of course, such a projection $\mathcal{P}$ is unrealistic, and one will instead apply an energy test $\mathcal{T}$ that passes if the energy measured on a small number $k\ll n$ of modes is below some threshold and will abort the protocol otherwise. Such an idea was already considered in previous works dealing with the security of CV QKD Renner and Cirac (2009); Leverrier et al. (2013); Furrer (2014). An application of the triangle inequality (see Lemma 18 in the appendix) yields:

[TABLE]

In other words, it is sufficient for our purposes to show the security of the protocol restricted to input states subject to a maximum photon number constraint, provided that we can bound the value of $\|(\mathbbm{1}-\mathcal{P})\circ\mathcal{T}\|_{\diamond}$, which corresponds to the probability that the energy test passes but that the number of photons in the remaining modes is large.

Analysis of the energy test.—We show that $\|(\mathbbm{1}-\mathcal{P})\circ\mathcal{T}\|_{\diamond}$ is indeed small for a maximal number of photons $K$ scaling linearly with $n$ (see Appendix G). The energy test $\mathcal{T}(k,d_{A},d_{B})$ depends on 3 parameters: the number $k$ of additional modes that will be measured for the test and maximum allowed average energies $d_{A}$ and $d_{B}$ for Alice and Bob’s modes. The input of the state is a $2(n+k)$-mode state. Alice and Bob should symmetrize this state by processing them with random conjugate linear-optical networks and measure the last $k$ modes with heterodyne detection, corresponding to a projection of standard (Glauber) coherent states. If the average energy per mode is below $d_{A}$ for Alice and $d_{B}$ for Bob, the test passes and Alice and Bob apply the protocol $\mathcal{E}_{0}$ to their remaining modes. Otherwise the protocol simply aborts. These thresholds $d_{A}$, $d_{B}$ should be chosen large enough to ensure that the energy test passes with large probability. Note that the symmetrization of the state can be done on the classical data for the protocols of Refs Weedbrook et al. (2004); Pirandola et al. (2015) since these protocols require both parties to measure all the modes with heterodyne detection, which itself commutes with the action of the linear-optical networks. For this, Alice and Bob need to multiply their measurement results (gathered as vectors for $\mathbbm{R}^{2n}$) by an identical random orthogonal matrix. There is also hope that this symmetrization can be further simplified, but we do not address this issue here.

An upper bound on $\|\Delta\circ\mathcal{P}\|_{\diamond}$ via de Finetti reduction.— This requires two main ingredients: first, a proof that any mixed state on $F_{1,1,n}$ that is invariant under the action of the unitary group admits a purification in the symmetric subspace $F_{2,2,n}^{U(n)}$, and second, that Gaussian states resolve the identity on the symmetric subspace. The symmetric subspace $F_{2,2,n}^{U(n)}$ was introduced and studied in Ref. Leverrier (2016) and is defined as follows:

[TABLE]

where $u\mapsto W_{u}$ is a representation of the unitary group $U(n)$ on the Fock space $F_{2,2,n}$ corresponding to mapping the $4n$ annihilation operators $\vec{a}=(a_{1},\ldots,a_{n}),\vec{b}=(b_{1},\ldots,b_{n}),\vec{a}^{\prime}=(a^{\prime}_{1},\ldots,a^{\prime}_{n}),\vec{b}^{\prime}=(b^{\prime}_{1},\ldots,b^{\prime}_{n})$ of each of the $n$ modes of $\mathcal{H}_{A},\mathcal{H}_{B},\mathcal{H}_{A^{\prime}},\mathcal{H}_{B^{\prime}}$ to $u\vec{a},\overline{u}\vec{b},\overline{u}\vec{a}^{\prime},u\vec{b}^{\prime}$. Here $\overline{u}$ denotes the complex conjugate of $u$ and $F_{2,2,n}=\mathcal{H}_{A}\otimes\mathcal{H}_{B}\otimes\mathcal{H}_{A^{\prime}}\otimes\mathcal{H}_{B^{\prime}}$.

In Ref. Leverrier (2016), a full characterization of the symmetric subspace $F_{2,2,n}^{U(n)}$ is given. Let us introduce the four operators $Z_{11},Z_{12},Z_{21},Z_{22}$ defined by:

[TABLE]

We now define the so-called $SU(2,2)$ generalized coherent states Perelomov (1972, 1986): to any $2\times 2$ complex matrix $\Lambda=\left(\begin{smallmatrix}\lambda_{11}&\lambda_{12}\\ \lambda_{21}&\lambda_{22}\end{smallmatrix}\right)$ such that $\Lambda\Lambda^{\dagger}\prec\mathbbm{1}_{2}$ (that is, with a spectral norm strictly less than 1), we associate the $4n$-mode Gaussian state $|\Lambda,n\rangle=|\Lambda,1\rangle^{\otimes n}$ given by

[TABLE]

Since the polynomial $\sum_{i,j=1}^{2}\lambda_{ij}Z_{ij}$ is quadratic in the creation operators, the generalized coherent state is a Gaussian state. More specifically, it corresponds to $n$ copies of a centered 4-mode pure Gaussian state whose covariance matrix is a function of $\Lambda$ (see the discussion in Section 3 of Ref. Leverrier (2016) for details).

These generalized coherent states span the symmetric subspace Leverrier (2016), and moreover, for $n\geq 4$, they resolve the identity on the symmetric subspace Leverrier (2016):

[TABLE]

where $\mathcal{D}$ is the set of $2\times 2$ matrices $\Lambda$ such that $\Lambda\Lambda^{\dagger}\prec\mathbbm{1}_{2}$ and $\mathrm{d}\mu_{n}(\Lambda)$ is the invariant measure on $\mathcal{D}$ given by

[TABLE]

Since the space $F_{2,2,n}^{U(n)}$ is infinite-dimensional, the integral of Eq. (3) is not normalizable. In order to obtain an operator with finite norm, we consider the finite-dimensional subspace $F_{2,2,n}^{U(n),\leq K}$ of $F_{2,2,n}^{U(n)}$ spanned by states with less than $K$ “excitations”:

[TABLE]

We show in Appendix C that an approximate resolution of the identity still holds for this space when restricting the coherent states $|\Lambda,n\rangle$ to $\Lambda\in\mathcal{D}_{\eta}$ for $\mathcal{D}_{\eta}=\left\{\Lambda\in\mathcal{D}\>:\>\eta\mathbbm{1}_{2}-\Lambda\Lambda^{\dagger}\succeq 0\right\}$ for $\eta\in[0,1[$. Let us denote by $\Pi_{\leq K}$ the identity onto the subspace $F_{2,2,n}^{U(n),\leq K}$ and introduce the relative entropy $D(x||y)=x\log\frac{x}{y}+(1-x)\log\frac{1-x}{1-y}$.

[TABLE]

holds with \varepsilon=2N^{4}(1+K/N)^{7}\exp\left(-ND\left(\frac{K}{K+N}\big{\|}\eta\right)\right).

This approximate resolution of the identity allows us to bound the diamond norm of maps which are covariant under the action $W_{u}$ of the unitary group $U(n)$, provided that the total photon number of the input state is upper bounded by some known value $K$. Let us define $\tau_{\mathcal{H}}^{\eta}$ to be the normalized state corresponding to the left-hand side of Eq. (4), and $\tau_{\mathcal{H}\mathcal{N}}^{\eta}$ a purification of $\tau_{\mathcal{H}}^{\eta}$.

[TABLE]

for $\eta=\frac{K-n+5}{K+n-5}$, provided that $n\geq N^{*}(K/(n-5))$.

The function $N^{*}$ is defined in Eq. (22) and its argument is an upper bound on the average number of photons per mode. One has for instance $N^{*}(21)\approx 10^{4}$, $N^{*}(60)\approx 10^{5}$.

Similarly as in Christandl et al. (2009) for the case of permutation invariance, Theorem 22 shows that one can obtain a polynomial approximation of degree 4 (if the average number of photons per mode is constant) of the diamond norm by simply evaluating the trace norm of the map on a very simple state, namely a purification of a mixture of Gaussian i.i.d. states. We note that we restricted the analysis to $SU(2,2)$ coherent states here because they are the relevant ones for cryptographic applications, but our results can be extended to $SU(p,q)$ coherent states for arbitrary integers $p,q$. In that case, the prefactor of the diamond norm approximation would be a polynomial of degree $pq$.

Security reduction to Gaussian collective attacks.—We now explain how to obtain a bound on $\|(\Delta\otimes\mathrm{id})\tau^{\eta}_{\mathcal{H}\mathcal{N}}\|_{1}$, if we already know that the initial protocol (without the energy test) is $\varepsilon$-secure against collective attacks. Let us therefore assume that we are given such a CV QKD protocol $\mathcal{E}_{0}$ acting on $2n$-mode states shared by Alice and Bob which is, in addition, covariant under the action of the unitary group (i.e. there exists $\mathcal{K}_{u}$ such that $\mathcal{E}_{0}\circ W_{u}=\mathcal{K}_{u}\circ\mathcal{E}_{0}$). Examples of such protocols are the no-switching protocol Weedbrook et al. (2004) and the measurement-device-independent protocol of Ref. Pirandola et al. (2015), provided that they are suitably symmetrized. We define $\mathcal{E}:=\mathcal{R}\circ\mathcal{E}_{0}\circ\mathcal{T}$, where $\mathcal{R}$ is an additional privacy amplification step that reduces the key by $\lceil 2\log_{2}\tbinom{K+4}{4}\rceil$ bits.

Recall that by definition, the QKD protocol $\mathcal{E}_{0}$ is $\varepsilon$-secure against Gaussian collective attacks if

[TABLE]

for all $\Lambda\in\mathcal{D}$. It means that the protocol is shown to be secure for input states of the form $\mathrm{tr}_{\mathcal{H}_{A^{\prime}}\mathcal{H}_{B^{\prime}}}(|\Lambda,n\rangle\langle\Lambda,n|)$, which are nothing but i.i.d. bipartite Gaussian states. By linearity, we immediately obtain that $\|(\Delta\otimes\mathrm{id})\tau^{\eta}_{\mathcal{H}}\|_{1}\leq\varepsilon$. To finish the proof, we need to take into account the extra system $\mathcal{N}$ given to Eve. This system can be chosen of dimension $\tbinom{K+4}{4}$ and the leftover hashing lemma of Renner Renner (2008) says that by shortening the final key of the protocol by $2\log_{2}(\mathrm{dim}\,\mathcal{N})$, one ensures that the protocol remains $\varepsilon$-secure. This is the role of the map $\mathcal{R}$. Overall, we find that $\|((\mathcal{E}-\mathcal{F})\otimes\mathrm{id})\tau^{\eta}_{\mathcal{H}\mathcal{N}}\|_{1}\leq\varepsilon$.

Results.—Putting everything together, we show that if $\mathcal{E}_{0}$ is covariant under the action of the unitary group and $\varepsilon$-secure against Gaussian collective attacks, then the protocol $\mathcal{E}=\mathcal{R}\circ\mathcal{E}_{0}\circ\mathcal{T}$ is $\varepsilon^{\prime}$-secure against general attacks, with

[TABLE]

for K=\max\Big{\{}1,n(d_{A}+d_{B})\Big{(}1+2\sqrt{\frac{\ln(8/\varepsilon)}{2n}}+\frac{\ln(8/\varepsilon)}{n}\Big{)}\Big{(}1-2{\sqrt{\frac{\ln(8/\varepsilon)}{2k}}}\Big{)}^{-1}\Big{\}}. The full proof is presented in Appendix D. The advantage of our approach compared to the previous results of Leverrier et al. (2013) is two-fold: first the improvement of the prefactor in Eq. (5) from $2^{\mathrm{polylog}(n)}$ to $O(n^{4})$ yields security for practical settings; second, it is only required to establish the security of the protocol against Gaussian collective attacks in order to apply our security reduction, a task arguably much simpler than addressing the security against collective attacks in the case of CV QKD.

Discussion.—Despite their wide range of application, there is a regime where “standard” de Finetti theorems fail, namely when the local dimension is not negligible compared to the number $n$ of subsystems Christandl et al. (2007). In particular, these techniques do not apply directly to CV protocols where the local spaces are infinite-dimensional Fock spaces. In this work, we considered a natural symmetry displayed by some important CV QKD protocols, which are covariant under the action of beamsplitters and phase-shifts on their $n$ modes Leverrier et al. (2009). For such protocols, one legitimately expects that stronger versions of de Finetti theorems should hold. In particular, a widely held belief that it is enough to consider Gaussian i.i.d. input states instead of all i.i.d. states in order to analyze the security of the corresponding protocol.

We proved this statement rigorously here. Our main tool is a family of $SU(2,2)$ generalized coherent states that resolve the identity of the subspace spanned by states invariant under the action of $U(n)$. This implies that in some applications such as QKD, it is sufficient to consider the behaviour of the protocol on these states in order to obtain guarantees that hold for arbitrary input states.

Let us conclude by discussing the issue of active symmetrization. For the proof above to go through, it is required that the protocols are covariant under the action of the unitary group. Such an invariance can be enforced by symmetrizing the classical data held by Alice and Bob. However, this step is computationally costly and it would be beneficial to bypass it. We believe that this should be possible. Indeed, it is often argued that a similar step is unnecessary when proving the security of BB84 for instance, and there is no fundamental reason to think that the situation is different here. Moreover, we already know of security proofs based on the uncertainty principle Tomamichel and Renner (2011); Tomamichel et al. (2012); Dupuis et al. (2016) where such a symmetrization is not required.

Appendix A The symmetric subspace $F_{2,2,n}^{U(n)}$ and generalized $SU(2,2)$ coherent states

In this section, we recall some results from Ref. Leverrier (2016) where the symmetric subspace $F_{p,q,n}^{U(n)}$ is considered for arbitrary integers $p,q$ and specialize them to the case where $p=q=2$.

A.1 The symmetric subspace $F_{2,2,n}^{U(n)}$

Let $H_{A}\cong H_{B}\cong H_{A^{\prime}}\cong H_{B^{\prime}}\cong\mathbb{C}^{n}$ and define the Fock space $F_{2,2,n}$ as

[TABLE]

where $\mathrm{Sym}^{k}(H)$ is the symmetric part of $H^{\otimes k}$.

In this paper, we will use both the standard Hilbert representation and the Segal-Bargmann representation of $F_{2,2,n}$. Using the Segal-Bargmann representation, the Hilbert space $F_{2,2,n}$ is realized as a functional space of complex holomorphic functions square-integrable with respect to a Gaussian measure, $F_{2,2,n}\cong L^{2}_{\mathrm{hol}}(\mathbb{C}^{4n},\|\cdot\|)$, with a state $\psi\in F_{2,2,n}$ represented by a holomorphic function $\psi(z,z^{\prime})$ with $z\in\mathbb{C}^{2n},z^{\prime}\in\mathbb{C}^{2n}$ satisfying

[TABLE]

where $\mathrm{d}z:=\prod_{k=1}^{n}\prod_{i=1}^{2}\mathrm{d}z_{k,i}$ and $\mathrm{d}z^{\prime}:=\prod_{k=1}^{n}\prod_{j=1}^{2}\mathrm{d}z_{k,j}^{\prime}$ denote the Lebesgue measures on $\mathbb{C}^{2n}$ and $\mathbb{C}^{2n}$, respectively, and $|z|^{2}:=\sum_{k=1}^{n}\sum_{i=1}^{2}|z_{k,i}|^{2},|z^{\prime}|^{2}:=\sum_{k=1}^{n}\sum_{j=1}^{2}|z_{k,j}^{\prime}|^{2}$. A state $\psi$ is therefore described as a holomorphic function of $4n$ complex variables $(z_{1,1},z_{n,1};z_{1,2},\ldots,z_{n,2};z_{1,1}^{\prime},\ldots,z_{n,1}^{\prime};z_{1,2}^{\prime},\ldots,z_{n,2}^{\prime})$. In the following, we denote by $z_{i}$ and $z_{j}^{\prime}$ the vectors $(z_{1,i},\ldots,z_{n,i})$ and $(z_{1,j}^{\prime},\ldots,z_{n,j}^{\prime})$, respectively, for $i,j\in\{1,2\}$. With these notations, the vector $z_{1}$ is associated to the space $H_{A}$, the vector $z_{1}^{\prime}$ to $H_{B}$, the vector $z_{2}$ to $H_{B}^{\prime}$ and the vector $z_{2}^{\prime}$ to $H_{A}^{\prime}$. These notations are chosen so that the unitary $u\in U(n)$ acts as $u$ on $z_{1},z_{2}$, and $\overline{u}$ on $z^{\prime}_{1},z_{2}^{\prime}$.

Let $\mathfrak{B}(F_{2,2,n})$ denote the set of bounded linear operators from $F_{2,2,n}$ to itself and let $\mathfrak{S}(F_{2,2,n})$ be the set of quantum states on $F_{2,2,n}$: positive semi-definite operators with unit trace.

Formally, one can switch from the Segal-Bargmann representation to the representation in terms of annihihation and creation operators by replacing the variables $z_{k,1}$ by $a_{k}^{\dagger}$, $z_{k,2}$ by $b^{\prime\dagger}_{k}$, $z^{\prime}_{k,1}$ by $b_{k}^{\dagger}$ and $z^{\prime}_{k,2}$ by $a^{\prime\dagger}_{k}$. The function $f(z,z^{\prime})$ is therefore replaced by an operator $f(a^{\dagger},b^{\dagger},a^{\prime\dagger},b^{\prime\dagger})$ and the corresponding state in the Fock basis is obtained by applying this operator to the vacuum state.

The metaplectic representation of the unitary group $U(n)\subset Sp(2n,\mathbb{R})$ on $F_{2,2,n}$ associates to $u\in U(n)$ the operator $W_{u}$ performing the change of variables $z\to uz$, $z^{\prime}\to\overline{u}z^{\prime}$:

[TABLE]

where $\overline{u}$ denotes the complex conjugate of the unitary matrix $u$. In other words, the unitary $u$ is applied to the modes of $F_{A}\otimes F_{B^{\prime}}$ and its complex conjugate is applied to those of $F_{B}\otimes F_{A^{\prime}}$.

The states that are left invariant under the action of the unitary group $U(n)$ are relevant for instance in the context of continuous-variable quantum key distribution, and we define the symmetric subspace as the space spanned by such invariant states.

Definition 3** (Symmetric subspace).**

For integer $n\geq 1$, the symmetric subspace $F_{2,2,n}^{U(n)}$ is the subspace of functions $\psi\in F_{2,2,n}$ such that

[TABLE]

The name symmetric subspace is inspired by the name given to the subspace $\mathrm{Sym}^{n}(\mathbbm{C}^{d})$ of $(\mathbbm{C}^{d})^{\otimes n}$ of states invariant under permutation of the subsystems:

[TABLE]

where $\pi\mapsto P(\pi)$ is a representation of the permutation group $S_{n}$ on $(\mathbbm{C}^{d})^{\otimes n}$ and $P(\pi)$ is the operator that permutes the $n$ factors of the state according to $\pi\in S_{n}$. See for instance Harrow (2013) for a recent exposition of the symmetric subspace from a quantum information perspective.

In Leverrier (2016), a full characterization of the symmetric subspace $F_{2,2,n}^{U(n)}$ is given. It is helpful to introduce the four operators $Z_{11},Z_{12},Z_{21},Z_{22}$ defined by:

[TABLE]

Definition 4**.**

For integer $n\geq 1$, let $E_{2,2,n}$ be the space of analytic functions $\psi$ of the $4$ variables $Z_{1,1},\ldots,Z_{2,2}$, satisfying $\|\psi\|_{E}^{2}<\infty$, that is $E_{2,2,n}=L^{2}_{\mathrm{hol}}(\mathbb{C}^{pq},\|\cdot\|_{E})$.

In Leverrier (2016), is was proven that $E_{2,2,n}$ coincides with the symmetric subspace $F_{2,2,n}^{U(n)}$.

Theorem 5**.**

For $n\geq 2$, the symmetric subspace $F_{2,2,n}^{U(n)}$ is isomorphic to $E_{2,2,n}$.

In other words, any state in the symmetric subspace can be written as

[TABLE]

for some function $f$. Said otherwise, such a state is characterized by only 4 parameters instead of $4n$ for an arbitrary state in $F_{2,2,n}$; or else, the symmetric subspace is isomorphic to a 4-mode Fock space (with “creation” operators corresponding to $Z_{11},Z_{12},Z_{21},Z_{22}$, instead of the ambient $4n$-mode Fock space.

A.2 Coherent states for $SU(2,2)/SU(2)\times SU(2)\times U(1)$

In this section, we first review a construction due to Perelomov that associates a family of generalized coherent states to general Lie groups Perelomov (1972), Perelomov (1986). In this language, the standard Glauber coherent states are associated with the Heisenberg-Weyl group, while the atomic spin coherent states are associated with $SU(2)$. The symmetric subspace $F_{2,2,n}^{U(n)}$ is spanned by $SU(2,2)$ coherent states, where $SU(2,2)$ is the special unitary group of signature $(2,2)$ over $\mathbb{C}$:

[TABLE]

where $M_{4}(\mathbb{C})$ is the set of $4\times 4$-complex matrices and $\mathbbm{1}_{2,2}=\mathbbm{1}_{2}\oplus(-\mathbbm{1}_{2})$.

In Perelomov’s construction, a system of coherent states of type $(T,|\psi_{0}\rangle)$ where $T$ is the representation of some group $G$ acting on some Hilbert space $\mathcal{H}\ni|\psi_{0}\rangle$, is the set of states $\left\{|\psi_{g}\rangle\>:\>|\psi_{g}\rangle=T_{g}|\psi_{0}\rangle\right\}$ where $g$ runs over all the group $G$. One defines $H$, the stationary subgroup of $|\psi_{0}\rangle$ as

[TABLE]

that is the group of $h\in G$ such that $|\psi_{h}\rangle$ and $|\psi_{0}\rangle$ differ only by a phase factor. When $G$ is a connected noncompact simple Lie group, $H$ is the maximal subgroup of $G$. In particular, for $G=SU(2,2)$, one has $H=SU(2,2)\cap U(4)=SU(2)\times SU(2)\times U(1)$ and the factor space $G/H$ corresponds to a Hermitian symmetric space of classical type (see e.g. Chapter X of Helgason (1979)). The generalized coherent states are parameterized by points in $G/H$. For $G/H=SU(2,2)/SU(2)\times SU(2)\times U(1)$, the factor space is the set $\mathcal{D}$ of $2\times 2$ matrices $\Lambda$ such that $\Lambda\Lambda^{\dagger}<\mathbbm{1}_{p}$, i.e. the singular values of $\Lambda$ are strictly less than 1.

[TABLE]

where $A>0$ for a Hermitian matrix $A$ means that $A$ is positive definite.

We are now ready to define our coherent states for the noncompact Lie group $SU(2,2)$.

Definition 6** ($SU(2,2)$ coherent states).**

For $n\geq 1$, the coherent state $\psi_{\Lambda,n}$ associated with $\Lambda\in\mathcal{D}$ is given by

[TABLE]

where $Z$ is the $2\times 2$ matrix $\left[Z_{i,j}\right]_{i,j\in\{1,2\}}$.

In the following, we will sometimes abuse notation and write $\psi_{\Lambda}$ instead of $\psi_{\Lambda,n}$, when the parameter $n$ is clear from context.

We note that the coherent states have a tensor product form in the sense that

[TABLE]

We will also write $|\Lambda,n\rangle=|\Lambda,1\rangle^{\otimes n}$ for $\psi_{\Lambda,n}$. Such a state is called identically and independently distributed (i.i.d.) in the quantum information literature.

The main feature of a family of coherent states is that they resolve the identity. This is the case with the $SU(2,2)$ coherent states introduced above: see Ref. Leverrier (2016).

Theorem 7** (Resolution of the identity).**

For $n\geq 4$, the coherent states resolve the identity over the symmetric subspace $F_{2,2,n}^{U(n)}$:

[TABLE]

where $\mathrm{d}\mu_{n}(\Lambda)$ is the invariant measure on $\mathcal{D}$ given by

[TABLE]

where $\mathfrak{R}(\Lambda_{i,j})$ and $\mathfrak{I}(\Lambda_{i,j})$ refer respectively to the real and imaginary parts of $\Lambda_{i,j}$. This operator equality is to be understood for the weak operator topology.

Appendix B Technical lemmas

In this section, we prove or recall a number of technical results that will be useful for analyzing the finite energy version of the de Finetti theorem in C.

B.1 Tail bounds

For positive integers $k,n>0$, the Beta and regularized (incomplete) Beta functions are given respectively by

[TABLE]

for $x>0$. Finally, the regularized Beta function is defined as

[TABLE]

Let us recall the Chernoff bound for a sum of independent Bernoulli variables.

Theorem 8** (Chernoff bound).**

Let $X_{1},\ldots,X_{n}$ be independent random variables on $\{0,1\}$ with $\mathrm{Pr}[X_{i}=1]=p$, for $i=1,\ldots,n$. Set $X=\sum_{i=1}^{n}X_{i}$. Then for any $t\in[0,1-p]$, we have

[TABLE]

where the relative entropy is defined as $D(x||y)=x\log\frac{x}{y}+(1-x)\log\frac{1-x}{1-y}$.

Pinsker’s inequality gives a lower bound on $D(x||y)$ as a function of the total variation distance between the two probability distributions.

Lemma 9** (Pinsker’s inequality).**

For $0<y<x<1$, it holds that

[TABLE]

We now prove a tail bound for the regularized Beta function.

Lemma 10** (Tail bound for regularized Beta function).**

For integers $k,n>0$, it holds that

[TABLE]

provided that $\eta\geq(k-2)/(n+k-1)$.

Proof.

The incomplete Beta function can be related to the tail of the binomial distribution as follows:

[TABLE]

where $F(K,N,p)$ is the probability that there are at most $K$ successes when drawing $N$ times from a Bernoulli distribution with success probability $p$. Equivalently, if $X_{i}$ are $\{0,1\}$-random variables such that $\mathrm{Pr}[X_{i}=1]=1-p$ for $i=1,\ldots,n$, then

[TABLE]

where $X=\sum_{i=1}^{n}X_{i}$. The Chernoff bound of Theorem 8 yields

[TABLE]

for $t=p-\frac{K-1}{N}$, provided that $N-K+1\geq(1-p)N$, i.e. $p\geq(K-1)/N$ or $\eta\geq(K-1)/N$. Taking $K=k-1,N=n+k-1$ and $p=\eta$, and injecting into Eq. (10), gives

[TABLE]

which holds provided that $\eta\geq(k-2)/(n+k-1)$. This proves the claim. ∎

B.2 Energy cutoff

The resolution of the identity of Theorem 7 involves operators which are not trace-class, as well as coherent states with arbitrary large energy. The natural solution to get operators with finite norm is to replace the domain $\mathcal{D}$ by a cut-off versions $\mathcal{D}_{\eta}$ defined by

[TABLE]

for $\eta\in[0,1[$. Note that

[TABLE]

The integration over $\mathcal{D}_{\eta}$ can then be performed by first integrating the measure $\mathrm{d}\mu_{n}(\Lambda)$ on the “polar variables”, and only later on the “radial” variables corresponding to the singular values of $\Lambda$.

For a fixed pair of squared singular values $(x,y)$, let $V_{x,y}$ be the set of matrices $\Lambda\in\mathcal{D}$ with squared singular values $(x,y)$, i.e.,

[TABLE]

We further define the operator $P_{x,y}$ corresponding to the integral of $|\Lambda,n\rangle\langle\Lambda,n|$ over $V_{x,y}$:

[TABLE]

where $\mathrm{d}\mu_{x,y}(\Lambda)$ is the Haar measure on $V_{x,y}$ and the normalization is chosen so that $\mathrm{tr}\,P_{x,y}=1$.

We have the following equivalent version of the resolution of the identity of Theorem 7.

Theorem 11**.**

For $n\geq 4$, it holds that:

[TABLE]

where the distribution $q(x,y)$ is given by

[TABLE]

Proof.

We wish to integrate $|\Lambda,n\rangle\langle\Lambda,n|\mathrm{d}\mu_{n}(\Lambda)$ over the “polar” variables. For this, we perform the singular value decomposition of $\Lambda$, which reads $\Lambda=u\Sigma v^{\dagger}$, where $u,v\in U(2)$ and $\Sigma=\mathrm{diag}(\sigma_{1},\sigma_{2})$, with $\sigma_{1},\sigma_{2}\in[0,1[$.

The Jacobian for the singular value decomposition is Muirhead (1982):

[TABLE]

Exploiting this Jacobian and performing the change of variables $x=\sigma_{1}^{2}$, $y=\sigma_{2}^{2}$, one obtains that the resolution of the identity of Theorem 7 can be written:

[TABLE]

for the appropriate constant $C$. Here, we have used that $\det(\mathbbm{1}_{2}-\Lambda\Lambda^{\dagger})^{4}=(1-x)^{4}(1-y)^{4}$ for any $\Lambda\in V_{x,y}$.

The constant $C$ can be determined by considering the overlap between $\mathbbm{1}_{F_{2,2,n}^{U(n)}}$ and the vacuum state:

[TABLE]

where we used that \big{\langle}0\big{|}u\big{[}\begin{smallmatrix}\sqrt{x}&0\\ 0&\sqrt{y}\end{smallmatrix}\big{]}v^{\dagger},n\big{\rangle}=(1-x)^{n/2}(1-y)^{n/2} for any $u,v\in U(2)$ and that the measures $\mathrm{d}u$ and $\mathrm{d}v$ are normalized. ∎

Let $K\geq 0$ be an integer. We define $V_{=K}$ as the subspace of $F_{2,2,n}^{U(n)}$ spanned by vectors with $K$ pairs of excitations:

[TABLE]

and the projector $\Pi_{=K}$ to be the orthogonal projector onto $V_{=K}$. Physically, this is the subspace of the Fock space restricted to states containing $2K$ photons in total in the $4n$ optical modes.

Moreover, let us denote by $a_{k}^{n}:=\tbinom{n+k-1}{k}$ the number of configurations of $k$ particles in $n$ modes.

Lemma 12**.**

For $K\in\mathbb{N}$ and $x,y\in[0,1[$, we have

[TABLE]

Proof.

The total photon number distribution of a state $|\Lambda,n\rangle$ is invariant under local unitaries $u,v\in U(2)$ applied on the creation operators of $F_{A}$ or $F_{B}$. This means that this distribution only depends on the squared singular values of the matrix $\Lambda$. In particular, denoting by $|(\sqrt{x},\sqrt{y}),n\rangle$ the coherent state corresponding to the matrix $\mathrm{diag}(\sqrt{x},\sqrt{y})$, we obtain:

[TABLE]

Since this coherent state is given by

[TABLE]

it implies that

[TABLE]

∎

Let us define the operator $\overline{P}_{\eta}$ as

[TABLE]

Lemma 13**.**

For $n\geq 38$, $K\in\mathbb{N}$ and $\eta\in[0,1[$ such that $K\leq\frac{\eta}{1-\eta}(n-5)$, it holds that

[TABLE]

where $N=n-5$ and $\alpha:=K/N$.

Proof.

For any non negative distribution $f(x,y)\geq 0$ symmetric in $x$ and $y$, i.e. such that $f(x,y)=f(y,x)$, it holds that

[TABLE]

Since $q(x,y)\mathrm{tr}\left[P_{=K}\Pi_{x,y}\right]$ is such a distribution, it holds that

[TABLE]

Lemma 12 then yields

[TABLE]

where we used the trivial bound $(x-y)^{2}\leq 1$ for $0\leq x,y\leq 1$ in the last inequality.

The normalization of the Beta function reads

[TABLE]

which gives

[TABLE]

Lemma 10 allows us to bound the integral:

[TABLE]

provided that $1-\eta\leq(n-3)/(n+k_{1}-5)$.

If $\frac{n-5}{n+K-5}\geq 1-\eta$, this term can be bounded uniformly as

[TABLE]

where we defined $N:=n-5$. Injecting this in Eq. (14), we obtain

[TABLE]

Imposing in addition that $N\geq 4$, i.e. $n\geq 9$, so that $N+K+4\leq 2(N+K)$, one finally obtains the bound:

[TABLE]

One can get a better bound by choosing $N\geq 33$, i.e. $n\geq 38$: in that case, one can check that for any $K\geq 0$, it holds that

[TABLE]

which gives $(N+K+4)^{6}\leq 2(N+K)^{6}$. Injecting this into Eq. (16) yields

[TABLE]

∎

Lemma 14**.**

For any nonnnegative operator $A\geq 0$ and projector $\Pi$ with $\mathrm{rank}(\Pi)<\infty$, it holds that:

[TABLE]

Proof.

The support of $\Pi A\Pi$ is contained in that of $\mathrm{tr}[\Pi A]\Pi$. Since both operators are positive semi-definite, the only thing we need to prove is that for any $\lambda\in\mathrm{spec}(\Pi A\Pi)$, it holds that

[TABLE]

since all the nonzero eigenvalues of $\mathrm{tr}[\Pi A]\Pi$ are equal to $\mathrm{tr}[\Pi A]$. The sum of the eingenvalues of an operator is equal to its trace, which gives

[TABLE]

Moreover, since all these eigenvalues are nonnegative, we have that $\lambda_{\max}(\Pi A\Pi)\leq\sum_{\lambda\in\mathrm{spec}(\Pi A\Pi)}\lambda$, which concludes the proof. ∎

Appendix C Finite energy version of de Finetti theorem

In this section, we establish a de Finetti reduction, similar to the one obtained in Christandl et al. (2009) in the case of permutation invariance. Such a reduction uses as a main tool as statement analogous to the resolution of the identity

[TABLE]

where $C(n,d)$ is a polynomial in $n$ provided the local dimension $d$ is finite.

In the case of continuous-variable protocols, the local dimension is infinite and we need to find a better reduction. This is indeed possible provided we have bounds on the maximum energy (or total number of photons) of the states under consideration.

For $\eta\in[0,1[$, define the sets $\mathcal{E}_{\eta}=[0,\eta]\times[0,\eta]$ and $\overline{\mathcal{E}}_{\eta}=[0,1[^{2}\setminus\mathcal{E}_{\eta}$.

We introduce the following positive operators

[TABLE]

where the equalities follow from the fact that one can integrate over $\mathcal{D}_{\eta}$ by first integrating over $V_{x,y}$ and then over $\mathcal{E}_{\eta}$. We recall that the operator $P_{xy}$ is defined in Eq. (11) and that the distribution $q(x,y)$ is defined in Eq. (12). The resolution of the identity over $F_{2,2,n}^{U(n)}$ (Theorem 7) immediately implies that

[TABLE]

Let $K\geq 0$ be an integer. We recall that $V_{=K}$ is the subspace of $F_{2,2,n}^{U(n)}$ spanned by vectors with $K$ pairs of excitations:

[TABLE]

The subspace $V_{\leq K}$ is defined as $V_{\leq K}:=\bigoplus_{k=0}^{K}V_{=k}$. The projector $\Pi_{=K}$ is the orthogonal projector onto $V_{=K}$ and the projector $\Pi_{\leq K}$ is defined as

[TABLE]

Theorem 15** (Finite energy version of de Finetti theorem (Theorem 1 from the main text)).**

For $n\geq 5$ and $\eta\in[0,1[$, if $K\leq\frac{\eta}{1-\eta}(n-5)$, then the following operator inequality holds

[TABLE]

with

[TABLE]

for $\alpha=K/N$ and $N=n-5$.

In particular, choosing $K$ such that $\alpha=\frac{1+\eta}{1-\eta}=\frac{K}{N}$ and using Pinsker’s inequality (Lemma 9) yields

[TABLE]

Proof of Theorem 15.

The resolution of the identity reads

[TABLE]

For all $k\leq K$, the projector $\Pi_{=k}$ can be written as:

[TABLE]

In particular, since $k\leq K\leq\frac{\eta}{1-\eta}(n-5)$, we have

[TABLE]

where we used Lemma 14 in Eq. (19) and the upper bound resulting from Lemma 13:

[TABLE]

in Eq. (20). It follows that:

[TABLE]

for all $k\leq K$. This finally implies that

[TABLE]

∎

The crucial property of Theorem 15 that will be important for application is that the volume of $\mathcal{D}_{\eta}$ is finite, and scales as a low degree polynomial in $n$ and $K$.

Theorem 16**.**

For $n\geq 38$, $K\geq n-5$ and $\eta=\frac{K-n+5}{K+n-5}$, it holds that

[TABLE]

Proof.

The volume of $\mathcal{D}_{\eta}$ is given by

[TABLE]

where we used that $\eta\leq(1+\eta)/2$ in the last equation.

In particular, choosing $K$ such that $\eta=\frac{K-n+5}{K+n-5}$ gives $\frac{1+\eta}{1-\eta}=\frac{K}{n-5}$, and therefore

[TABLE]

For $n\geq 38$, it holds that $\frac{1}{192}\left(\frac{n}{n-5}\right)^{4}\leq\frac{1}{100}$, which finally gives

[TABLE]

∎

For future reference, let us not that that under the same assumptions as in the theorem, the following inequality also holds:

[TABLE]

This inequality will later be useful to analyze Eq. (27) at the end of Section D and obtain Eq. (5) in the main text.

In other words, the volume $T(n,\eta)$ of $\mathcal{D}_{\eta}$ is upper bounded by a polynomial of degree 4 in the number of modes (or equivalently in the total energy).

Let us define the function $N^{*}:[1,\infty[\to\mathbb{N}$ such that

[TABLE]

For instance, $N^{*}(21)\approx 10^{4}$, $N^{*}(60)\approx 10^{5}$.

We obtain:

Corollary 17**.**

For $K\geq n-5$, if n\geq N^{*}\big{(}\frac{K}{n-5}\big{)}-5 then, for $\eta^{*}=\frac{K-n+5}{K+n-5}$, it holds that

[TABLE]

Appendix D Security proof for a modified CV QKD protocol

In this section, we recall some facts about security proofs for QKD protocols and explain how to obtain a secure protocol from an initial protocol $\mathcal{E}_{0}$ known to be secure against Gaussian collective attacks, by prepending an energy test and adding an additional privacy amplification test. These various steps will then be detailed in the subsequent sections.

QKD protocols and their security.— A QKD protocol is a CP map from the infinite-dimensional Hilbert space $(\mathcal{H}_{A}\otimes\mathcal{H}_{B})^{\otimes n}$, corresponding to the initially distributed entanglement, to the set of pairs $(S_{A},S_{B})$ of $\ell$-bit strings (Alice and Bob’s final keys, respectively) and $C$, a transcript of the classical communication. In order to assess the security of a given QKD protocol $\mathcal{E}$ in a composable framework, one compares it with an ideal protocol Müller-Quade and Renner (2009); Portmann and Renner (2014). The action of an ideal protocol $\mathcal{F}$ is defined by concatenating the protocol $\mathcal{E}$ with a map $\mathcal{S}$ taking $(S_{A},S_{B},C)$ as input and outputting the triplet $(S,S,C)$ where the string $S$ is a perfect secret key (uniformly distributed and unknown to Eve) with the same length as $S_{A}$, that is $\mathcal{F}=\mathcal{S}\circ\mathcal{E}$. Then, a protocol will be called $\epsilon$-secure if the advantage in distinguishing it from an ideal version is not larger than $\epsilon$. This advantage is quantified by (one half of) the diamond norm defined by

[TABLE]

where the supremum is taken over density operators on $(\mathcal{H}_{A}\otimes\mathcal{H}_{B})^{\otimes n}\otimes\mathcal{K}$ for any auxiliary system $\mathcal{K}$. The diamond norm is also known as the completely bounded trace norm and quantifies a notion of distinguishability for quantum maps Watrous (2016).

Our main technical result is a reduction of the security against general attacks to that against Gaussian collective attacks, for which security has already been proved in earlier work, for instance in Leverrier (2015). Let us therefore suppose that our CV QKD protocol of interest, $\mathcal{E}_{0}$, is secure against Gaussian collective attacks. We will slightly modify it by prepending an initial test $\mathcal{T}$. More precisely, $\mathcal{T}$ is a CP map taking a state in a slightly larger Hilbert space, $(\mathcal{H}_{A}\otimes\mathcal{H}_{B})^{\otimes(n+k)}$, applying a random unitary $u\in U(n+k)$ to it (corresponding to a network of beamsplitters and phaseshifters), measuring the last $k$ modes and comparing the measurement outcome to a threshold fixed in advance. The test succeeds if the measurement outcome (related to the energy) is small, meaning that the global state is compatible with a state containing only a low number of photons per mode. Such a state is well-described in a low dimensional Hilbert space, as we will discuss in Section G. Depending on the outcome of the test, either the protocol aborts, or one applies the original protocol $\mathcal{E}_{0}$ on the $n$ remaining modes.

For the test to be practical, it is important that the legitimate parties do not have to physically implement the transformation $u\in U(n+k)$. Rather, they can both measure their $n+k$ modes with heterodyne detection, perform a random rotation of their respective classical vector in $\mathbb{R}^{2(n+k)}$ according to $u\in U(n+k)\cong O(2(n+k))\cap Sp(2(n+k))$.

In this paper, we assume that this symmetrization step is performed, as it is anyway required for the security proof of the protocol against collective attacks Leverrier (2015). We believe, however, that this step might not be required for establishing the security of the protocol and leave it as an important open question for future work. In particular, recent proof techniques in discrete-variable QKD have shown that the permutation need not be applied in practice Tomamichel et al. (2012).

In section E, we will prove a de Finetti reduction that allows to upper bound the diamond distance between two quantum channels, provided that they display the right invariance under the action of the unitary group $U(n)$ and that the input states have a maximum number of photons. We address this second issue by introducing another CP map $\mathcal{P}$ which projects a state acting on $F_{1,1,n}=(\mathcal{H}_{A}\otimes\mathcal{H}_{B})^{\otimes n}$ onto a low-dimensional Hilbert space $F_{1,1,n}^{\leq K}$ with less than $K$ photons overall in the $2n$ modes shared by Alice and Bob. Here, the value of $K$ scales linearly with $n$.

Let us denote by $\mathcal{E}_{0}$ a CV QKD proven ${\varepsilon}$-secure against Gaussian collective attacks, for instance as in Leverrier (2015). This means that (see Section F for details)

[TABLE]

for any generalized coherent state $|\Lambda,n\rangle$. Here $\mathcal{F}_{0}:=\mathcal{S}\circ\mathcal{E}_{0}$ and $\mathcal{S}$ is a map that replaces the output key of $\mathcal{E}_{0}$ by an independent and uniformly distributed string of length $\ell$ when $\mathcal{E}_{0}$ did not abort, and does nothing otherwise.

Here $\mathcal{E}_{0}$ maps an arbitrary density operator $\rho_{AB}\in\mathfrak{S}(F_{1,1,n})$ to a state $\rho_{S_{A},S_{B},C}$ where the registers are all classical and store respectively Alice’s final key, Bob’s final key and a transcript of the classical communication.

Let us define the following maps:

[TABLE]

where

• •

$\mathcal{T}(k,d_{A},d_{B})$ takes as input an arbitrary state $\rho_{AB}$ on $F_{1,1,n+k}$, maps it to $V_{u}\rho_{AB}V_{u}^{\dagger}$ where the unitary $u$ is chosen from the Haar measure on $U(n+k)$, measures the last $k$ modes for $A$ and $B$ with heterodyne detection and check whether the measurement outputs pass the test if the $k$ outcomes $\alpha_{1},\cdots,\alpha_{k}$ of Alice and $\beta_{1},\cdots,\beta_{k}$ of Bob satisfy

[TABLE]

If they pass the test, the map returns the state on the first $n$ modes (that were not measured) as well as the flag “passes”. Otherwise, it returns the vacuum state and the flag “aborts”.

• •

$\mathcal{P}$ is the projector onto the finite-dimensional subspace $F_{1,1,n}^{\leq K}$ (corresponding to states with at most $K$ photons in the $2n$ modes): it maps any state $\rho\in\mathcal{B}(F_{1,1,n})$ to $\Pi_{\leq K}\rho\Pi_{\leq K}\in\mathcal{B}(F_{1,1,n}^{\leq K})$. This trace non-increasing map is introduced as a technical tool for the security analysis but need not be implemented in practice. It simply ensures that the states that are fed to the original QKD protocol $\mathcal{E}_{0}$ live in a finite-dimensional subspace. In the text, we will alternatively denote this projection by $\mathcal{P}^{\leq K}$ or $\mathcal{P}(n,K)$, depending on which parameters we wish to make explicit.

• •

$\mathcal{R}$ takes two $\ell$-bit strings as input and returns $\ell^{\prime}$-bit strings (for $\ell^{\prime}<\ell$).

We finally define our CV QKD protocol $\mathcal{E}$ as

[TABLE]

and the ideal protocol as $\mathcal{F}=\mathcal{S}\circ\mathcal{E}$. Abusing notation slightly, the map $\mathcal{S}$ now acts on strings of length $\ell^{\prime}$ instead of $\ell$.

Lemma 18**.**

Let $\overline{\mathcal{E}}$ be the protocol $\mathcal{R}\circ\mathcal{E}_{0}$ where the inputs are restricted to the finite-dimensional subspace $\mathcal{B}(F_{1,1,n}^{\leq K})$, and $\overline{\mathcal{F}}=\mathcal{S}\circ\overline{\mathcal{E}}$. Then the security of $\overline{\mathcal{E}}$ implies the security of $\mathcal{E}$:

[TABLE]

provided that the quantity $||(\mathbbm{1}-\mathcal{P})\circ\mathcal{T}||_{\diamond}$ can be made arbitrarily small.

Proof.

We define (virtual) protocols $\tilde{\mathcal{E}}:=\mathcal{R}\circ\mathcal{E}_{0}\circ\mathcal{P}$ and $\tilde{\mathcal{F}}:=\mathcal{S}\circ\tilde{\mathcal{E}}$. The security of the protocol $\mathcal{E}$ is then a consequence of the following derivation:

[TABLE]

where we used the triangle inequality and the fact that the CP maps $\mathcal{T}$, $\mathcal{R}\circ\mathcal{E}_{0}$ and $\mathcal{S}$ cannot increase the diamond norm.

Since $\overline{E}\circ\mathcal{P}=\tilde{E}$ and $\mathcal{P}$ is trace non-increasing, we finally obtain that

[TABLE]

∎

Bounding the two terms in the right hand side of Eq. (25) is done with the two following theorems, which will be proven in Sections F and G, respectively.

Theorem 19**.**

With the previous notations, if $\mathcal{E}_{0}$ is $\varepsilon$-secure against Gaussian collective attacks, then

[TABLE]

where $T(n,\eta)=(n-1)(n-2)^{2}(n-3)\frac{\eta^{4}}{12(1-\eta)^{4}}$ and $\overline{\mathcal{E}}=\mathcal{R}\circ\mathcal{E}_{0}\circ\mathcal{P}^{\leq K}$.

Theorem 20**.**

For integers $n,k\geq 1$, and $d_{A},d_{B}>0$, define $K=n(d^{\prime}_{A}+d^{\prime}_{B})$ for $d^{\prime}_{A/B}=d_{A/B}g(n,k,\varepsilon/4)$ for the function $g$ defined in Eq. (34). Then

[TABLE]

Putting everything together yields our main result.

Theorem 21**.**

If the protocol $\mathcal{E}_{0}$ is $\varepsilon$-secure against Gaussian collective attacks, then the protocol $\mathcal{E}=\mathcal{R}\circ\mathcal{E}_{0}\circ\mathcal{P}$ is $\varepsilon^{\prime}$-secure against general attacks with

[TABLE]

Putting everything together, we show that if $\mathcal{E}_{0}$ is covariant under the action of the unitary group and $\varepsilon$-secure against Gaussian collective attacks, then the protocol $\mathcal{E}=\mathcal{R}\circ\mathcal{E}_{0}\circ\mathcal{T}$ is $\varepsilon^{\prime}$-secure against general attacks, with

[TABLE]

for $T(n,\eta)\leq\frac{1}{12}\left(\frac{\eta n}{1-\eta}\right)^{4}$, $\eta=\frac{K-n+5}{K+n-5}$ and $K=n(d_{A}+d_{B})\left(1+2\sqrt{\frac{\ln(8/\varepsilon)}{2n}}+\frac{\ln(8/\varepsilon)}{n}\right)\left(1-2{\sqrt{\frac{\ln(8/\varepsilon)}{2k}}}\right)^{-1}$. The first term in Eq. (27) results from the de Finetti reduction and the second term results for the energy test failure probability.

In particular, for $n\geq 38$ and $K\geq n-5$, we obtain the bound $T(n,\eta)+1\leq\frac{K^{4}}{100}$ from Eq. (21). This yields $\varepsilon^{\prime}\leq\frac{K^{4}}{50}\varepsilon$, which corresponds to Eq. (5) in the main text.

Appendix E Generalization of the postselection technique of Ref. Christandl et al. (2009)

The goal of this section is to prove the following theorem (Theorem 2 in the main text).

Theorem 22** (Theorem 2 of the main text).**

Let $\Delta:\mathrm{End}(F_{1,1,n}^{\leq K})\to\mathrm{End}(\mathcal{H}^{\prime})$ such that for all $u\in U(n)$, there exists a CPTP map $\mathcal{K}_{u}:\mathrm{End}(\mathcal{H}^{\prime})\to\mathrm{End}(\mathcal{H}^{\prime})$ such that $\Delta\circ u=\mathcal{K}_{u}:\circ\Delta$, then

[TABLE]

for $\eta=\frac{K-n+5}{K+n-5}$, provided that $n\geq N^{*}(K/(n-5))$.

One way to make sure that the input of the map is indeed restricted to states with less than $K$ photons is to replace $\Delta$ by $\Delta\circ\mathcal{P}^{\leq K}$.

In the following, for conciseness, we will denote by $\mathcal{H}$ the symmetric subspace:

[TABLE]

Let $\tau^{\eta}_{\mathcal{H}}$ be the normalized state corresponding to the projector $P_{\eta}$ defined in Eq. (17):

[TABLE]

where

[TABLE]

Consider an orthonormal basis $\left\{|\nu_{i}\rangle\right\}$ of $F_{2,2,n}^{U(n)}$ and define the non normalizable operator

[TABLE]

A conjecture for an explicit such orthonormal basis was given in Leverrier (2016), but we do not need to have such an explicit basis for our present purpose.

Let us further define the state $|\Phi^{\eta}\rangle\in F_{2,2,n}^{U(n)}\otimes F_{2,2,n}^{U(n)}$:

[TABLE]

It is well-known that $|\Phi^{\eta}\rangle$ is a purification of $\tau_{\mathcal{H}}^{\eta}$:

[TABLE]

Recall that $F_{2,2,n}^{U(n),\leq K}$ denotes the finite-dimensional subspace of $F_{2,2,n}^{U(n)}$ with less than $K$ excitations.

Lemma 23**.**

Let $\rho$ be an arbitrary density operator on $F_{2,2,n}^{U(n),\leq K}$. Then there exists a binary measurement $\mathcal{M}=\{M_{\mathcal{N}},\mathbbm{1}_{\mathcal{N}}-M_{\mathcal{N}}\}$ on $\mathcal{N}$ applied to $|\Phi^{\eta}\rangle\in\mathcal{H}\otimes\mathcal{N}$ that successfully prepares the state $\rho$ with probability at least $\frac{1}{2T(n,\eta)}$.

Proof.

To avoid cluttering up the notations, let us write $\tau$ instead of $\tau^{\eta}_{\mathcal{H}}$. Recall that $\tau\geq p\mathbbm{1}_{F_{2,2,n}^{U(n),\leq K}}$ with $p=\frac{1}{2T(n,\eta)}$, as a consequence of Corollary 17.

Let us define the non negative operator $M:=p\tau^{-1/2}\rho\tau^{-1/2}$. Since $p^{-1}\tau\geq\mathbbm{1}$ on the support of $\rho\leq\mathbbm{1}$, the operator $M$ satisfies

[TABLE]

Let us define the measurement $\mathcal{M}=\{M,\mathbbm{1}-M\}$. Performing this measurement on state $|\Phi^{\eta}\rangle$ prepares the state

[TABLE]

with probability $\langle\Phi^{\eta}|(1\otimes M)|\Phi^{\eta}\rangle$. This state can be written:

[TABLE]

and it is obtained with probability $p$. In Eq. (29), we used that $M$ is symmetric, that is $\langle\lambda_{i}|M|\lambda_{j}\rangle=\langle\lambda_{j}|M|\lambda_{i}\rangle$. ∎

Lemma 24**.**

For $k\geq 0$ and $n\geq 4$, the dimensions of $V_{=K}$ and $V_{\leq K}=F_{2,2,n}^{U(n),\leq K}$ are given by

[TABLE]

Proof.

It was proven in Leverrier (2016) that the vectors $(Z_{1,1})^{i}(Z_{1,2})^{j}(Z_{2,1})^{k}(Z_{2,2})^{\ell}$ are independent (provided than $n\geq 4$), which means that the dimension of $V_{=K}$ is the cardinality of the sets of quadruples $\{(i,j,k,\ell)\in\mathbb{N}^{4}\>:\>i+j+k+\ell=K\}$. This number is $\tbinom{K+3}{3}$. More generally, the number of $t$-uples of nonnegative integers that sum to $K$ is $\tbinom{n+K-1}{n-1}$. Since the subspaces $V_{=K}$ are orthogonal, it follows that $\mathrm{dim}\,V_{\leq K}=\sum_{k=0}^{K}\mathrm{dim}\,V_{=k}$, which can be computed explicitly. Alternatively, one can see that the space $V_{\leq K}$ of quadruples $(i,j,k,\ell)$ summing to $K-m$ for some integer $m\leq K$ corresponds to the space of $5$-uples $(i,j,k,\ell,m)$ that sum to $K$. ∎

Lemma 25**.**

For any $K$ and $n$ integers, there exists a finite subset $\mathcal{U}\subset U(n)$, such that for any state $\rho$ with support on $F_{1,1,n}^{\leq K}$, the subspace of $F_{1,1,n}$ restricted to states with less than $K$ photons, the following holds:

[TABLE]

where $\mathrm{d}u$ is the normalized Haar measure on $U(n)$.

Note that by definition of the Haar measure, the state $\int V_{u}\rho V_{u}^{\dagger}\mathrm{d}u$ is invariant under the application of any unitary $u^{\prime}\in U(n)$: $V_{u^{\prime}}\int V_{u}\rho V_{u}^{\dagger}\mathrm{d}uV_{u^{\prime}}^{\dagger}=\int V_{u}\rho V_{u}^{\dagger}\mathrm{d}u$, which means that it has support on $F_{1,1,n}^{U(n),\leq K}$.

Proof.

By linearity, it is sufficient to establish the lemma for pure states $|\psi\rangle\in F_{1,1,n}^{\leq K}$. Such a state can be written as

[TABLE]

Applying $V_{u}$ maps $a_{i}^{\dagger}$ to $\sum_{j=1}^{n}u_{i,j}a_{j}^{\dagger}$ and $b_{i}^{\dagger}$ to $\sum_{j=1}^{n}\overline{u}_{i,j}b_{j}^{\dagger}$. In other words, the function $f:u\mapsto V_{u}|\psi\rangle\langle\psi|V_{u}^{\dagger}$ is a polynomial of degree at most $K$ in $u$ and $\overline{u}$. Taking $\mathcal{U}$ to be a $K$-design of $U(n)$, we obtain that

[TABLE]

which proves the result. ∎

We recall the following theorem that was established in Leverrier (2016).

Theorem 26**.**

Any density operator $\rho\in\mathfrak{S}(F_{1,1,n})$ invariant under $U(n)$ admits a purification in $F_{2,2,n}^{U(n)}$.

Lemma 27**.**

It is sufficient to consider states $\rho_{\mathcal{H}\mathcal{N}}$ with support on $F_{2,2,n}^{U(n),\leq K}$ when computing the diamond norm of Theorem 22.

Proof.

Consider a state $\rho_{\mathcal{H}\mathcal{N}}$ with support on $F_{2,2,n}^{\leq K}$. Let $\mathcal{U}$ be a finite set of unitaries as promised by Lemma 25. Let $\{|u\rangle_{\mathcal{C}}\}_{u\in\mathcal{U}}$ be an orthogonal basis for some classical register $\mathcal{C}$. The following sequence of equalities holds:

[TABLE]

where we used that the classical states $|u\rangle$ are all pairwise orthogonal in Eq. (30), that $\mathcal{K}_{u}$ is trace preserving in Eq. (31), that $\mathcal{K}_{u}\circ\Delta=\Delta\circ u$ in Eq. (32). Consider now the reduced state $\tilde{\rho}_{\mathcal{H}}$:

[TABLE]

where the last equality follows from Lemma 25. Theorem 26 now assures the existence of some purification $\tilde{\rho}_{\mathcal{H}\mathcal{N}}$ of $\tilde{\rho}_{\mathcal{H}}$ in $F_{2,2,n}^{U(n),\leq K}\cong\mathcal{H}\otimes\mathcal{N}$. In particular, there exists a CPTP map $g:\mathrm{End}(\mathcal{N})\to\mathrm{End}(\mathcal{N}\otimes\mathcal{C})$ such that

[TABLE]

Since $g$ is trace preserving, it further implies that

[TABLE]

which concludes the proof ∎

We are now in position to prove Theorem 22.

Theorem 22.

Let $\Delta:\mathrm{End}(F_{1,1,n}^{\leq K})\to\mathrm{End}(\mathcal{H}^{\prime})$ such that for all $u\in U(n)$, there exists a CPTP map $\mathcal{K}_{u}:\mathrm{End}(\mathcal{H}^{\prime})\to\mathrm{End}(\mathcal{H}^{\prime})$ such that $\Delta\circ u=\mathcal{K}_{u}:\circ\Delta$, then

[TABLE]

for $\eta=\frac{K-n+5}{K+n-5}$, provided that $n\geq N^{*}(K/(n-5))$.

Proof.

According to Lemma 27, it is sufficient to prove the theorem for a state $\rho_{\mathcal{H}\mathcal{N}}$ on $F_{2,2,n}^{U(n),\leq K}$. Lemma 23 guarantees the existence of a trace-non-increasing map $\mathcal{T}$ from a copy of $F_{2,2,n}^{U(n),\leq K}$ to $\mathbb{C}$ such that

[TABLE]

This gives

[TABLE]

and finally that

[TABLE]

∎

Appendix F Security against collective attacks provides a bound on $\|\mathcal{R}\circ\Delta\circ\mathcal{P}\|_{\diamond}$

In order to exploit Theorem 22, one needs an upper bound on $\|((\mathcal{R}\circ\Delta\circ\mathcal{P}^{\leq K})\otimes\mathrm{id})\tau^{\eta}_{\mathcal{H}\mathcal{N}}\|_{1}$. We will see that such a bound can be obtained if the protocol is known to be secure against Gaussian collective attacks. For this, we follow the same strategy as in Christandl et al. (2009). Let us first recall the definition of being secure against Gaussian collective attacks.

Definition 28**.**

The QKD protocol $\mathcal{E}_{0}$ is $\varepsilon$-secure against Gaussian collective attacks if

[TABLE]

for all $\Lambda\in\mathcal{D}$.

We show the following result.

Theorem 29**.**

With the previous notations, if $\mathcal{E}_{0}$ is $\varepsilon$-secure against Gaussian collective attacks, then

[TABLE]

where $\tau^{\eta}_{\mathcal{H}\mathcal{N}}$ is a purification of $\tau^{\eta}_{\mathcal{H}}$. Here $\mathcal{R}$ is an additional privacy amplification step that reduces the key by $\lceil 2\log_{2}\tbinom{K+4}{4}\rceil$ bits and $\mathcal{P}^{\leq K}$ is the projection onto $F_{1,1,n}^{\leq K}$.

Proof.

Recall that

[TABLE]

where

[TABLE]

By linearity, it holds that

[TABLE]

In order to obtain the theorem, we need to consider a purification of $\tau_{\mathcal{H}\mathcal{N}}^{\eta}$. Since $\mathcal{P}^{\leq K}$ restricts the states to live in a space of dimension at most $\mathrm{dim}\,F_{2,2,n}^{U(n),\leq K}=\tbinom{K+4}{4}$ (according to Lemma 24), it implies that the purifying system $\mathcal{N}$ can be chosen of this dimension. Giving this extra system to Eve can at most provide her with a limited amount of information. Applying an additional privacy amplification step $\mathcal{R}$ ensures that the protocol remains $\varepsilon$-secure for the state $\tau_{\mathcal{H}\mathcal{N}}^{\eta}$ thanks to the leftover hashing lemma (Theorem 5.1.1 of Renner (2008)):

[TABLE]

∎

Combining this result with Theorem 22 yields Theorem 19.

Theorem 19.

With the previous notations, if $\mathcal{E}_{0}$ is $\varepsilon$-secure against Gaussian collective attacks, then

[TABLE]

Appendix G Energy test

The goal of this section is to prove the following result.

Theorem 20.

For integers $n,k\geq 1$, and $d_{A},d_{B}>0$, define $K=n(d^{\prime}_{A}+d^{\prime}_{B})$ for $d^{\prime}_{A/B}=d_{A/B}g(n,k,\varepsilon/4)$ for the function $g$ defined in Eq. (34). Then

[TABLE]

For $d>0$, let us introduce the following operators on $\mathcal{H}^{\otimes n}$ for a single-mode Fock space $\mathcal{H}$:

[TABLE]

where $\Pi_{m}^{n}$ is the projector onto the subspace of $\mathcal{H}^{\otimes n}$ spanned by Fock states containing $m$ photons:

[TABLE]

In words, $T_{n}^{d}$ is the sum of the projectors onto products of coherent states such that the total squared amplitude is greater than $nd$ and $U_{n}^{d}$ is the projector onto Fock states containing more that $nd$ photons. Intuitively, both operators should be “close” to each other. This is formalized with the following lemma that was proven in Leverrier et al. (2013).

Lemma 30**.**

For any integer $n$ and any $d\geq 0$, it holds that

[TABLE]

The following lemma results from the definitions of $U_{n}^{d}$ and $\mathcal{P}^{\leq K}$, the projector onto $F_{1,1,n}^{\leq K}$.

Lemma 31**.**

For any $d_{A},d_{B}\geq 0$ and integer $K$ such that $K\leq n(d_{A}+d_{B})$, it holds that

[TABLE]

Proof.

The left hand side is the projector onto the states of $\mathcal{H}_{A}^{\otimes n}\otimes\mathcal{H}_{B}^{\otimes n}$ containing strictly more than $K$ photons. Any such state must contain either at least $nd_{A}$ photons in $\mathcal{H}_{A}^{\otimes n}$ or at least $K-nd_{A}$ photons in $\mathcal{H}_{B}^{\otimes n}$, for any possible value of $d_{A}$. This proves the claim. ∎

Combining Lemmas 30 and 31, we obtain the immediate corollary.

Corollary 32**.**

For any $d_{A},d_{B}\geq 0$ and integer $K$ such that $K\leq n(d_{A}+d_{B})$, it holds that

[TABLE]

Recall that the heterodyne measurement corresponds to a projection onto (Glauber) coherent states, and is described by the resolution of the identity:

[TABLE]

In other words, measuring a state $\rho$ on $\mathcal{H}^{\otimes k}$ with heterodyne detection outputs the result $(\alpha_{1},\ldots,\alpha_{k})\in\mathbb{C}^{k}$ with probability

[TABLE]

Laurent and Massart Laurent and Massart (2000) established the following tail bounds for $\chi^{2}(D)$ distributions.

Lemma 33** (Laurent and Massard Laurent and Massart (2000)).**

Let $U$ be a $\chi^{2}$ statistic with $D$ degrees of freedom. For any $x>0$,

[TABLE]

Definition 34**.**

A state $\rho$ on $\mathcal{H}^{\otimes n}=F(\mathbb{C}^{n})$ is said rotationally invariant is $V_{u}\rho V_{u}^{\dagger}=\rho$ for all $u\in U(n)$.

In particular, the state $\int V_{u}\rho V_{U}^{\dagger}\mathrm{d}u$ is invariant if $\mathrm{d}u$ is the Haar measure on $U(n)$.

Lemma 35**.**

Let $\rho$ be an rotationally invariant state on $\mathcal{H}^{\otimes(n+k)}$. Then, for any $d>0$,

[TABLE]

for $d^{\prime}=g(n,k,\varepsilon)d$ and

[TABLE]

Proof.

By definition, $\mathrm{tr}[T_{k}^{d}\rho]$ is the probability that the outcome $(\alpha_{1},\ldots,\alpha_{k})\in\mathbb{C}^{k}$ obtained by measuring the last $k$ modes of the state $\rho$ with heterodyne detection satisfies $\sum_{i=1}^{k}|\alpha_{i}|^{2}\geq kd$. Similarly, $\mathrm{tr}\left[((T_{n}^{d^{\prime}}\otimes(\mathbbm{1}-T_{k}^{d}))\rho\right]$ is the probability that the outcome of measuring the $n+k$ modes of $\rho$ with heterodyne detection yields a vector $(\alpha_{1},\ldots,\alpha_{n+k})$ such that

[TABLE]

Since the state is rotationally invariant, it means that the random vector $(\alpha_{1},\ldots,\alpha_{n+k})$ is uniformly distributed on the sphere of radius $M$ in $\mathbb{C}^{n+k}$, conditioned on the fact that the modulus is $\sqrt{\sum_{i=1}^{n+k}|\alpha_{i}|^{2}}=M$. Equivalently, one can consider the $2(n+k)$-dimensional real vector $(\mathfrak{R}(\alpha_{1}),\mathfrak{I}(\alpha_{1}),\ldots,\mathfrak{R}(\alpha_{1}),\mathfrak{I}(\alpha_{1}))$ which is uniformly distributed over the sphere in $\mathbb{R}^{2(n+k)}$. Here $\mathfrak{R}(\alpha_{1})$ and $\mathfrak{I}(\alpha)$ refer respectively to the real and imaginary part of $\alpha$. We obtain

[TABLE]

where the inequality is a simple consequence of the fact that the rectangle $[nd^{\prime},\infty]\times[0,kd]$ is a subset of the triangle $\{(x,y)\in[0,\infty]^{2}\>:\>kdx\geq nd^{\prime}y\}$.

It is well-known that the uniform distribution over the unit sphere of $\mathbb{R}^{2(n+k)}$ can be generated by sampling $2(n+k)$ normal variables with 0 mean and unit variance. In that case, the squared norm $\sum_{i=1}^{n}|\alpha_{i}|^{2}$ is simply a $\chi^{2}$ variable with $2n$ degrees of freedom while $\sum_{i=1}^{k}|\alpha_{n+i}|^{2}$ corresponds to an independent $\chi^{2}$ variable with $2k$ degrees of freedom. Let us denote by $Z_{n}$ and $Z_{k}$ the corresponding random variables: $Z_{n}\sim\chi^{2}(2n)$, $Z_{k}\sim\chi^{2}(2k)$. Since $(Y_{n},Y_{k})$ and $(Z_{n},Z_{k})$ follow the same distribution, up to rescaling, we obtain that

[TABLE]

This is particularly useful because it means that there is no need to enforce normalization explicitly. Finally, using now that the triangle $\{(x,y)\in[0,\infty]^{2}\>:\>kdx\geq dd^{\prime}y\}$ is a subset of the union of the rectangles $[\alpha nd^{\prime},\infty]\times[0,\infty]$ and $[0,\infty]\times[0,\alpha kd]$ for any $\alpha>0$, it follows that

[TABLE]

Choosing $\alpha$ such that

[TABLE]

and applying the lower bounds on the tails of the $\chi^{2}$ distribution given in Lemma 33 gives

[TABLE]

This establishes that

[TABLE]

which concludes the proof. ∎

We are now ready to define and analyze the energy test. Alice and Bob perform a random rotation of their data according to a unitary $u\in U(n)$ chosen from the Haar measure on $U(n)$, and measure the last $k$ modes of their respective state with heterodyne detection. They compute the squared norm of their respective vectors and obtain two values $Y_{A}$ for Alice and $Y_{B}$ for Bob. The test depends on three parameters: the number $k$ of modes which are measured, a maximum value for Alice $d_{A}$ and a maximum value for Bob, $d_{B}$. The test $\mathcal{T}(k,d_{A},d_{B})$ passes if

[TABLE]

We are interested in the probability of passing the test and failing for the remaining modes to contain less than $K$ photons, more precisely in the quantity

[TABLE]

Let us denote by $\mathrm{Inv}(\mathfrak{S}(\mathcal{H}^{\otimes(n+k)}))$ the set of density matrices which are invariant under the action of $U(n+k)$.

Theorem 20.

For integers $n,k\geq 1$, and $d_{A},d_{B}>0$, define $K=n(d^{\prime}_{A}+d^{\prime}_{B})$ for $d^{\prime}_{A/B}=d_{A/B}g(n,k,\varepsilon/4)$ for the function $g$ defined in Eq. (34). Then

[TABLE]

Proof.

Writing $\mathcal{P}$ and $\mathcal{T}$ for conciseness, the definition of the diamond norm yields:

[TABLE]

where we used that \big{(}(\mathbbm{1}-\mathcal{P})\circ\mathcal{T})\otimes\mathbbm{1}_{\mathcal{H}_{AB}^{\otimes(n+k)}}\big{)}(\rho) is a nonnegative operator in Eq. (35), the fact that both $\mathcal{P}$ and $\mathcal{T}$ are rotationally invariant in Eq. (36), Lemma 31 in Eq. (37), the triangle inequality in Eq. (38), Lemma 35 in Eq. (40). ∎