2022 0

530.145:535.12:681.7:53.082.5

# Continuous-variable quantum key distribution: security analysis with trusted
hardware noise against general attacks

1R. Goncharov  1A.D. Kiselev  1E. Samsonov  1V. Egorov  1 ITMO University,
Kronverkskiy, 49, St. Petersburg, 197101, Russia<EMAIL_ADDRESS>
###### Abstract

In this paper, using the full security framework for continuous variable
quantum key distribution (CV-QKD), we provide a composable security proof for
the CV-QKD system in a realistic implementation. We take into account
equipment losses and contributions from various components of excess noise and
evaluate performance against collective and coherent attacks assuming trusted
hardware noise. The calculation showed that the system remains operable at
channel losses up to 10.2 dB in the presence of collective attacks and up to
7.5 dB in the presence of coherent ones.

###### pacs:

03.67.-a, 42.50.-p

###### keywords:

quantum key distribution, continuous variables, security proof, composability,
trusted noise

††volume: 0

##  1 Introduction

Quantum key distribution (QKD) [1] is a special method of generating a secure
key between two parties, Alice and Bob, which will ensure the privacy of
transmitted information in the era of the quantum computer. Historically, the
first protocols to be presented were discrete variable (DV) ones [2, 3], where
information was encoded in the state of a single photon: polarization, phase
or time bin. However, over time, continuous variable (CV) protocols [4, 5, 6]
have been introduced, which are considered more efficient, high-rate and cost-
effective due to the use of homodyne/heterodyne detection systems instead of
single photon detectors.

Considering the security of QKD systems, one must take into account that each
of them has a finite physical implementation that is not ideal, which opens up
opportunities for the eavesdropper, Eve, to carry out a multiple attacks and
extract part of the secret key. To prevent this threat, for each protocol, a
complex system for assessing the information available to Eve and the
acceptable level of errors is being developed.

Currently, a fairly significant amount of work has been presented, covering
the topic of security of CV-QKD protocols [7, 8, 9, 10, 11, 12, 13, 14]. Of
the protocols most suitable for practical implementation, the GG02 protocol
[6, 15] stands out, for which the security is proven against coherent
(general) attacks, taking into account the finite-key effects. Moreover,
models of untrusted and trusted hardware noise are considered [12]. The latter
is preferable, since many security levels imply that Eve does not have access
to Alice’s and Bob’s blocks, moreover, accounting for untrusted noise makes
the protocol essentially unusable.

Thus, this paper will present a full security proof of CV-QKD on a realistic
implementation with trusted hardware noise against general attacks. In Section
2 we describe an optical configuration of the CV-QKD scheme, in Sections 3–5
we give a description of the protocol in the trusted noise scenario and
consider a possibility of specific attacks that go beyond general security
proof framework. In Section 6 we provide a technique of evaluation and
monitoring of experimental parameters and in Section 7 we clarify security
analysis and estimate the finite-length secure key generation rate. In Section
8 we discuss the results and draw the appropriate conclusions.

##  2 Optical CV-QKD scheme configuration

The optical scheme of the described protocol is shown in Figure 1 and consists
of the following blocks:

  * •

Alice block, in which the generation of signal states (Gaussian modulation)
and a local oscillator (LO) is carried out, after which, by means of
polarization-time multiplexing, they sent to Bob. Gaussian modulation itself
can be done in two stages: amplitude modulation with a Rayleigh distribution
and phase modulation with a uniform phase distribution; as a result, the the
complex signal amplitude value will correspond to the Gaussian distribution
[16]. It should also be noted that the need for reference signal, which is
used in the phase protocols of the DV-QKD [3, 17], is no longer necessary in
this case.

  * •

Quantum channel block, which in this work is represented by an optical fiber.

  * •

Bob block, in which demultiplexing and heterodyne detection are carried out.

Figure 1: Scheme of typical setup for CV-QKD with Gaussian modulation and
heterodyne detection.

In the considered configuration Alice uses the same laser to generate LO and
signal states modulated according to the Gaussian distribution, which then
experience the procedure of polarization-time multiplexing before sending
through the quantum channel. Bob then performs a demultiplexing procedure and
heterodyne detection. Figure 1 also shows additional elements for monitoring.

In Alice block a continuous wave (CW) laser with a central wavelength of 1550
nm and a spectral line width of 100 kHz is used. The width of the spectral
line makes it possible to estimate the coherence time, and also affects the
amount of phase noise. Coherent detection systems require the use of sources
with a narrow spectral line. The Bob block uses a polarization-maintaining
optical fiber of the Panda type due to the sensitivity of the optoelectronic
components to polarization and implementation polarization multiplexing. The
optical isolator OI1 is used in order to avoid backlight due to reflection on
the optical scheme elements in the laser module. An amplitude modulator AM1 is
used to form identical optical pulses with a repetition rate of 50 MHz and a
duration of 3 ns. Laser pulses then divided by amplitude into two arms using a
10/90 beam splitter BS1: the signal arm (10%) and LO arm (90%).

The second 90/10 beam splitter BS2 in LO arm is used to separate 10% of the
optical pulse power and direct it to the photodiode PD1, which allows to
organize feedback with an amplitude modulator to control the power of LO.

In the signal arm, Gaussian modulation of optical pulses occurs using an
amplitude modulator AM2 and a phase modulator PM. Amplitude modulation is
realized according to the Rayleigh distribution with a given variance. Phase
modulation is realized according to a uniform distribution in the range from 0
to 2$\pi$. The amplitude modulator AM3 is used as a fast attenuator with a
wide range of extinction coefficient to set the average number of photons in
an optical pulse. Every second pulse in the signal arm is a reference pulse
and is not subjected to amplitude and phase modulation on amplitude modulators
AM1 and AM2 and phase modulator PM. The modulators are controlled by a
digital-to-analog converter (DAC), which is not indicated on Figure 1.

In the signal and LO arms, 90:10 beam splitters BS3 and BS4 are used to
separate part of the signal and LO pulses to control the power and variance
(feedback for amplitude modulators AM1 and AM2) using a homodyne detector,
which is carried out using 50/50 beam splitter BS5 and balanced detector BD1.
For successful balanced detection, it is necessary that the optical paths of
the signal and LO are identical.

In order to avoid the interaction of signal pulses and LO before their
detection in Bob’s side, time-division and polarization multiplexing is used.
Time-division multiplexing is implemented by increasing length of the signal
arm in Alice by an amount corresponding to half the pulse repetition period
compared to LO arm. Polarization multiplexing is implemented using a
polarization combiner PBS1 with a single-mode (SM) output, to which
polarization maintaining fibers of two arms are connected with mutually
orthogonal slow optical axes.

A SM optical isolator OI2 is used to prevent backlighting of Alice from the
channel output. Alice and Bob are connected through a SM optical fiber of the
G.652.D standard with a length of 25 km.

On Bob side the signal and LO enters the CWDM filter with a central wavelength
of 1550 nm. The use of a CWDM filter is due to protection against backlight at
a different wavelength from the channel input. The output of the CWDM filter,
corresponding to the reflected light, goes to the monitor photodiode PD2, by
the signal from which one can analyse the presence or absence of backlights.
The output of the CWDM filter, corresponding to the transmitted light, is
connected to the input of the polarization controller PC, which is used to
compensate for polarization distortions in the SM optical fiber between the
Alice and Bob. The input of a polarization beam splitter PBS2 is connected to
the output of the polarization controller, which is used for polarization
demultiplexing of the signal and LO. In LO arm there is a delay line for
demultiplexing signals in time domain and also a 90:10 beam splitter BS6,
which is used to organize feedback of the polarization controller: a part of
LO pulse power (10%) is sent to the photodiode PD3 to determine the optical
power. The other output of the 90/10 beam splitter, which corresponds to 90%
optical power, is connected to LO input of the 90-degree optical hybrid. In
the signal arm, after the output of the polarizing beam splitter PBS2, it is
connected to the signal input of the 90-degree optical hybrid. The 90-degree
optical hybrid has four outputs: two outputs correspond to the sum and
difference amplitude of the signal field and LO with zero additional relative
phase, and two outputs correspond to an additional phase equal to 90 degrees.
The outputs of the 90-degree optical hybrid are connected to the inputs of two
balanced detectors. The signal from balanced detectors is entered to analog-
to-digital converter (ADC), which is not shown in the Figure 1).

##  3 GG02 protocol features

###  3.1 Gaussian modulation of coherent states

In the CV-QKD with Gaussian modulation [15, 6], Alice prepares coherent states
(with a given value of amplitude and phase) with quadrature components $q$ and
$p$ which are realizations of two independent and identically distributed
random variables $\mathcal{Q}$ and $\mathcal{P}$, which have the same Gaussian
distribution with zero mean and given variance

$\mathcal{Q}\sim\mathcal{P}\sim\mathcal{N}\left(0,\>\tilde{V}_{\mathrm{A}}\right),$
(1)

where $\tilde{V}_{\mathrm{A}}$ is a modulation variance.

Alice prepares a sequence of coherent states
$|\alpha_{1}\rangle,\ldots|\alpha_{j}\rangle,\ldots,|\alpha_{N}\rangle$ of the
form:

$\displaystyle|\alpha_{j}\rangle=|q_{j}+ip_{j}\rangle,\text{ for
}q_{j}\in\mathcal{Q},\>p_{j}\in\mathcal{P}.$ (2)

In this case, the equations for the eigenvalues are satisfied in shot noise
units (SNU)

$\displaystyle\hat{a}|\alpha_{j}\rangle$
$\displaystyle=\alpha_{j}|\alpha_{j}\rangle,$ (3)
$\displaystyle\frac{1}{2}(\hat{q}+i\hat{p})|\alpha_{j}\rangle$
$\displaystyle=(q_{j}+ip_{j})|\alpha_{j}\rangle,$ (4)

where $\hat{a}$ is a creation operator and $\hat{p}$, $\hat{q}$ are a
quadrature operators.

The mean photon number in each individual state is estimated as follows

$\displaystyle\langle
n_{j}\rangle=\langle\alpha_{j}|\hat{n}|\alpha_{j}\rangle=|\alpha_{j}|^{2}=q_{j}^{2}+p_{j}^{2}.$
(5)

Given that $q_{j}$ and $p_{j}$ taken from the distribution in expression (1),
the mean photon number over the ensemble of states prepared by Alice is

$\langle
n\rangle=\langle\mathcal{Q}^{2}\rangle+\langle\mathcal{P}^{2}\rangle=2\tilde{V}_{\mathrm{A}}.$
(6)

To calculate the variance of the quadrature operator
$V(\hat{q})=\langle\hat{q}^{2}\rangle-\langle\hat{q}\rangle^{2}$, it is
necessary to find the averaged values:

$\displaystyle\langle\hat{q}\rangle$
$\displaystyle=\langle\alpha|\hat{q}|\alpha\rangle=0,$ (7)
$\displaystyle\langle\hat{q}^{2}\rangle$
$\displaystyle=\langle\alpha|\hat{q}^{2}|\alpha\rangle=\langle\alpha|(\hat{a}+\hat{a}^{\dagger})^{2}|\alpha\rangle=$
$\displaystyle=\langle\alpha|\hat{a}^{2}|\alpha\rangle+\langle\alpha|(\hat{a}^{\dagger})^{2}|\alpha\rangle+\langle\alpha|\hat{a}\hat{a}^{\dagger}|\alpha\rangle+\langle\alpha|\hat{a}^{\dagger}\hat{a}|\alpha\rangle=$
$\displaystyle=\alpha^{2}+(\alpha^{*})^{2}+\alpha^{*}\alpha+1+\alpha^{*}\alpha=$
$\displaystyle=q^{2}-p^{2}+2iqp+q^{2}-p^{2}-2iqp+2(q^{2}+p^{2})+1=$
$\displaystyle=4q^{2}+1.$ (8)

Considering that the values $q$ and $p$ are realizations of the random
variables $\mathcal{Q}$ and $\mathcal{P}$ respectively, we can write:

$\displaystyle\langle\hat{q}^{2}\rangle$
$\displaystyle=4\langle\mathcal{Q}^{2}\rangle+1=4\tilde{V}_{\mathrm{A}}+1,$
(9) $\displaystyle\langle\hat{p}^{2}\rangle$
$\displaystyle=4\langle\mathcal{P}^{2}\rangle+1=4\tilde{V}_{\mathrm{A}}+1.$
(10)

According to the equation (9):

$V\equiv V(\hat{q})=V(\hat{p})\equiv V=4\tilde{V}_{\mathrm{A}}+1\equiv
V_{\mathrm{A}}+1.$ (11)

In Eq. (11) the transition from the variance of random variable corresponding
to the quadrature distribution to the variance of quadrature operator is
carried out. It should be noted that there is also a shot noise component in
SNU (equal to one).

Combining (6) and (11), we can express the average number of photons over the
ensemble in terms of the variance of quadrature operator

$\langle n\rangle=\frac{1}{2}(V-1)=\frac{1}{2}V_{\mathrm{A}}.$ (12)

After the preparation stage, Alice sends the $|\alpha_{j}\rangle$ state to the
Gaussian quantum channel, after which Bob performs coherent detection and
decodes information about the sent state in the case of heterodyne detection
or the projection of its quadrature components in the case of homodyne
detection. It should be emphasized that in this paper only heterodyne
detection is considered.

###  3.2 Gaussian sequence processing

This subsection briefly describes the stages of classical data post-
processing, which means Alice’s modulation and Bob’s detection results data.

The first step is sifting. Despite sifting is not implied in the case of
heterodyne detection (in which the sequence after the distribution session and
before error correction can be considered as a sifted key), it is worth
mentioning that in CV-QKD with homodyne detection, Alice and Bob choose the
bases they use to prepare and measure the states respectively, using
independently and identically distributed generated random bits. In these
cases, the sifting step eliminates all uncorrelated signals when different
bases were used for preparation and measurement. The presence of signal bases
is more typical for CV-QKD protocols with discrete modulation, however, in
protocols with Gaussian modulation and homodyne detection, sifting means
discarding the quadrature not measured by Bob.

The second step is parameter estimation. After transmitting and detecting a
sequence of states, legitimate parties compare a random subset of their data.
This comparison allows estimating the quantum channel parameters:
transmittance and excess noise of the channel, from which they can calculate a
mutual information $I_{\mathrm{AB}}$ and evaluate an information $\chi$
available to Eve. If $\chi$ is greater than $\beta I_{\mathrm{AB}}$, where
$\beta\in[0,\>1]$ is a reconciliation efficiency, the protocol is aborted at
this point.

If $\beta I_{\mathrm{AB}}>\chi$, users go to the third, information
reconciliation step, which is a form of error correction procedure.

The fourth step is confirmation. After the reconciliation procedure,
legitimate parties perform a confirmation step using a family of universal
hash functions [18] to limit the chance that error correction fails: Alice or
Bob chooses one particular hash function with uniform probability and
announces its choice over the classical channel. Users apply this hash
function to their key to get a hash code. Subsequently, Alice and Bob exchange
and compare their hash codes. If the values are different, the keys are
considered compromised and the protocol is aborted; if the values are equal,
then it is considered that an upper bound on the probability that the keys are
not identical has been obtained. This error rate depends on the length of the
hash codes and the type of hash functions used.

The fifth and final step is privacy amplification. After successfully passing
the confirmation stage, Alice and Bob will have the same bit string with a
very high probability. However, Eve has some information about the key, so to
reduce the chance that she successfully guesses part of the key to an
acceptable value, users perform a privacy amplification protocol by applying a
seeded randomness extraction algorithm to their bit strings, which uses a
family of 2-universal hash functions.

###  3.3 Quantum channel description

The Gaussian quantum channel is characterized by the transmittance coefficient
(taking into account losses directly in the channel, losses in the equipment
and detection efficiency) and noise (on Alice side, in the channel, and on Bob
side). The potential advantage of Eve depends on both characteristics. The
noise in the channel can be expressed as [1, 19, 13]

$\Xi_{\mathrm{ch}}=\frac{1-T_{\mathrm{ch}}}{T_{\mathrm{ch}}}+\xi_{\mathrm{{A}}},$
(13)

where $T_{\mathrm{ch}}$ is a quantum channel transmittance, $\xi_{\mathrm{A}}$
is a excess noise (in SNU).

The excess noise itself includes variances of all noise sources

$\xi_{\mathrm{A}}=\xi_{\mathrm{modul,\>A}}+\xi_{\mathrm{Raman,\>A}}+\xi_{\mathrm{phase,\>A}}+\cdots,$
(14)

where $\xi_{\mathrm{modul,\>A}}$ is a modulation noise,
$\xi_{\mathrm{Raman,\>A}}$ is a Raman noise, and $\xi_{\mathrm{phase,\>A}}$ is
a phase noise.

Similarly, the detector noise can be estimated as [19, 1, 13, 14]

$\displaystyle\Xi_{\mathrm{det}}=\frac{1-T_{\mathrm{rec}}\eta_{\mathrm{det}}}{T_{\mathrm{rec}}\eta_{\mathrm{det}}}+\frac{v_{\mathrm{el}}}{T_{\mathrm{rec}}\eta_{\mathrm{det}}}$
(15)

where $\eta_{\mathrm{det}}$ is a balanced detector efficiency,
$v_{\mathrm{el}}$ is an electronic noise of balanced detector and
$T_{\mathrm{rec}}$ is a transmittance coefficient responsible for losses in
the receiver module.

For a more convenient notation, it can be written as

$\displaystyle T_{\mathrm{det}}\equiv T_{\mathrm{rec}}\eta_{\mathrm{det}}.$
(16)

The total noise related to the channel input is then determined by the sum of
the channel noise and the detector noise normalized to $T_{\mathrm{ch}}$

$\Xi=\Xi_{\mathrm{ch}}+\frac{1}{T_{\mathrm{ch}}}\Xi_{\mathrm{det}}.$ (17)

After the signal state passing through a channel with noise and losses, Bob
measures the total variance of the quadrature operator as [1, 19, 13, 14]

$\displaystyle V_{\mathrm{B}}$
$\displaystyle=V\left(\hat{q}_{\mathrm{B}}\right)=V\left(\hat{p}_{\mathrm{B}}\right)=T_{\mathrm{ch}}T_{\mathrm{det}}(V+\Xi)=$
$\displaystyle=T_{\mathrm{ch}}T_{\mathrm{det}}\left(V+\frac{1-T_{\mathrm{ch}}}{T_{\mathrm{ch}}}+\xi_{\mathrm{A}}+\frac{1}{T_{\mathrm{ch}}}\left(\frac{1-T_{\mathrm{det}}}{T_{\mathrm{det}}}+\frac{v_{\mathrm{el}}}{T_{\mathrm{det}}}\right)\right)=$
$\displaystyle=T_{\mathrm{ch}}T_{\mathrm{det}}V-T_{\mathrm{ch}}T_{\mathrm{det}}+T_{\mathrm{ch}}T_{\mathrm{rec}}\eta_{\operatorname{det}}\xi_{\mathrm{A}}+1+v_{\mathrm{el}}\equiv$
$\displaystyle\equiv TV-T+T\xi_{\mathrm{A}}+1+v_{\mathrm{el}}=$
$\displaystyle=T(V-1)+T\xi_{\mathrm{A}}+1+v_{\mathrm{el}}.$ (18)

Since the parameter $v_{\mathrm{el}}$ is the noise variance in SNU and can be
considered stochastically independent of other noise sources, it can be
considered as another component of excess noise, i.e.
$v_{\mathrm{el}}\equiv\xi_{\mathrm{det}}$, thus

$\displaystyle T\xi_{\mathrm{A}}+\xi_{\mathrm{det}}$
$\displaystyle=T\left(\xi_{\mathrm{A}}+\frac{1}{T}\xi_{\mathrm{det}}\right)\equiv
T\xi_{\mathrm{tot,\>A}}=\xi_{\mathrm{tot,\>B}}\equiv\xi,$ (19) $\displaystyle
V_{\mathrm{B}}$ $\displaystyle=T(V-1)+1+\xi=TV_{\mathrm{A}}+1+\xi.$ (20)

###  3.4 Signal-to-noise ratio and mutual information

The signal-to-noise ratio is expressed as

$\mathrm{SNR}=\frac{P_{\mathrm{S}}}{P_{\mathrm{N}}},$ (21)

where $P_{\mathrm{S}}$ is a total signal power and $P_{\mathrm{N}}$ is a total
noise power.

The purposed model makes it possible to separate the signal and noise
components in the observed by Bob variance of the quadrature operator

$V_{\mathrm{B}}=\frac{T}{\mu}V_{\mathrm{A}}+1+\frac{\xi}{\mu},$ (22)

where $\mu\in\\{1;\>2\\}$ is a homodyne/heterodyne detection system parameter
respectively.

Thus the signal-to-noise ratio for the purposed protocol is

$\mathrm{SNR}=\frac{\frac{1}{\mu}TV_{\mathrm{A}}}{1+\frac{1}{\mu}\xi}.$ (23)

Mutual information between Alice and Bob in this case is evaluated as [13]

$I_{\mathrm{\mathrm{AB}}}=\frac{\mu}{2}\log_{2}(1+\mathrm{SNR})=\frac{\mu}{2}\log_{2}\left(1+\frac{\frac{1}{\mu}TV_{\mathrm{A}}}{1+\frac{1}{\mu}\xi}\right).$
(24)

As it was already mentioned, the purposed protocol assumes a heterodyne
detection method, i.e. $\mu=2$. According to the equation (24), despite the
increase in mutual information by a factor of two (two quadratures per message
are detected at once, instead of one), the signal-to-noise ratio decreases.
Obviously (estimating the rate of increase of logarithmic functions), the
advantage of heterodyne detection in terms of estimating mutual information
will be observed only at large $TV_{\mathrm{A}}$.

##  4 Trusted hardware noise. Holevo bound

After variable $\rho_{\mathrm{AB}}$ has been removed from the shared state
equation, it can be viewed as a pure two-particle state with a common Alice
and Bob on one side and Eve on the other. As such, it can be written in terms
of the Schmidt decomposition

$\left|\Psi_{\mathrm{ABE}}\right\rangle=\sum_{i}\sqrt{\lambda_{i}}\left|\psi_{i}\right\rangle_{\mathrm{AB}}\left|\phi_{i}\right\rangle_{\mathrm{E}},$
(25)

where $\lambda_{j}$ is a real non-negative number.

Taking a partial trace over subsystems gives

$\displaystyle\operatorname{Tr}_{\mathrm{E}}\rho_{\mathrm{AB}}$
$\displaystyle=\rho_{\mathrm{AB}}=\sum_{i}\lambda_{i}|\psi_{i}\rangle_{\mathrm{AB}}\langle\psi_{i}|,$
(26) $\displaystyle\operatorname{Tr}_{\mathrm{AB}}\rho_{\mathrm{AB}}$
$\displaystyle=\rho_{\mathrm{E}}=\sum_{i}\lambda_{i}|\phi_{i}\rangle_{\mathrm{E}}\langle\phi_{i}|.$
(27)

The von Neumann entropy depends only on the $\lambda_{i}$ components, which,
due to the Schmidt decomposition, are the same for $\rho_{\mathrm{AB}}$ and
$\rho_{\mathrm{E}}$. Therefore, the von Neumann entropy of Eve is the same as
the entropy shared by Alice and Bob

$S_{\mathrm{E}}=S_{\mathrm{AB}}=-\sum_{i}\lambda_{i}\log_{2}\lambda_{i}.$ (28)

Then the following transformation is obvious

$\chi_{\mathrm{E}}=S_{\mathrm{E}}-S_{\mathrm{E}\mid\mathrm{B}}=S_{\mathrm{AB}}-S_{\mathrm{A}\mid\mathrm{B}}.$
(29)

In the trusted noise model [12], the noise coming from the Alice’s and Bob’s
equipment is assumed to be trusted, that is, Eve cannot manipulate it. The
same applies to equipment losses. In this context, it is necessary to clarify
the equation (19)

$\xi=T\xi_{\mathrm{pr}}+T_{\mathrm{det}}\xi_{\mathrm{ch}}+\xi_{\mathrm{rec}},$
(30)

where $\xi_{\mathrm{pr}}$ is an Alice excess noise, $\xi_{\mathrm{ch}}$ is a
channel excess noise, and $\xi_{\mathrm{rec}}$ is a Bob excess noise.

Assuming that the detection devices are well calibrated and reliable,
$T_{\mathrm{rec}}$ and $\xi_{\mathrm{rec}}$ are beyond Eve’s influence. Then
the covariance matrix describing its von Neumann entropy prior to measurement
by Bob is

$\Sigma_{\mathrm{AB}}^{\text{trusted rec.
}}=\left(\begin{array}[]{cc}V\mathbf{1}_{2}&\sqrt{T_{\mathrm{ch}}(V^{2}-1)}\sigma_{z}\\\
\sqrt{T_{\mathrm{ch}}(V^{2}-1)}\sigma_{z}&\left(T_{\mathrm{ch}}(V-1)+1+\xi_{\mathrm{ch}}\right)\mathbf{1}_{2}\end{array}\right).$
(31)

The matrix itself can be represented in the form

$\left(\begin{array}[]{ll}a\mathbf{1}_{2}&c\sigma_{z}\\\
c\sigma_{z}&b\mathbf{1}_{2}\end{array}\right).$ (32)

The symplectic eigenvalues of this matrix are expressed as

$\displaystyle v_{1,\>2}=\frac{1}{2}(z\pm(b-a)),$ (33)

where $z=\sqrt{(a+b)^{2}-4c^{2}}$.

Although in the trusted noise model the quantities $T_{\mathrm{rec}}$ and
$\xi_{\mathrm{rec}}$ do not contribute to $S_{\mathrm{E}}$, though they do
affect Alice measurements and, consequently, Eve entropy
$S_{\mathrm{E}\mid\mathrm{B}}$.

In the trusted noise scenario, the eavesdropper can only manipulate the state
in the channel and carry out purifying in the same place. This means that the
state of the system must be viewed through three distinct subsystems in the
entanglement base scenario. Let the state ”Alice-Bob-Eve” consist of two
entangled states and a thermal state, each of which is uniquely determined by
its variance: one entangled state $\mathrm{EPR}_{\mathrm{AB}}$ with variance
$V$ used for key exchange between Alice and Bob, one entangled state
$\mathrm{EPR}_{\mathrm{ch}}$ with variance $W_{\mathrm{ch}}$ for modeling
noise and loss in the quantum channel and thermal state
$\mathrm{Th}_{\mathrm{rec}}$ with variance $W_{\mathrm{rec}}$ to simulate the
noise and losses of the receiver. The beam splitters, one with
$T_{\mathrm{ch}}$ transmittance and one with $T_{\mathrm{rec}}$ transmittance,
mix the initial Bob’s entangled state modes with the channel state and thermal
state modes, respectively. The general state before the action of beam
splitters can be represented by the covariance matrix

$\displaystyle\Sigma_{\mathrm{tot},\>0}$
$\displaystyle=\mathrm{EPR}_{\mathrm{AB}}\oplus\mathrm{EPR}_{\mathrm{ch}}\oplus\mathrm{Th}_{\mathrm{rec}}=$
$\displaystyle=\left(\begin{array}[]{ccccc}V\mathbf{1}_{2}&\sqrt{V^{2}-1}\sigma_{z}&0&0&0\\\
\sqrt{V^{2}-1}\sigma_{z}&V\mathbf{1}_{2}&0&0&0\\\
0&0&W_{\mathrm{ch}}\mathbf{1}_{2}&\sqrt{W_{\mathrm{ch}}^{2}-1}\sigma_{z}&0\\\
0&0&\sqrt{W_{\mathrm{ch}}^{2}-1}\sigma_{z}&W_{\mathrm{ch}}\mathbf{1}_{2}&0\\\
0&0&0&0&W_{\mathrm{rec}}\mathbf{1}_{2}\end{array}\right).$ (39)

It can be noted here that the eavesdropper attack on the quantum channel
involves only two entangled states, $\mathrm{EPR}_{\mathrm{AB}}$ and
$\mathrm{EPR}_{\mathrm{ch}}$, which guarantees purifying as part of an attack.
Unitary equivalence with complete purifying thus makes it easier to express
the state on Bob’s side: in the general case, it must be represented by
another entangled state [14].

The beam splitter in the channel affects Alice’s mode and one of the
$\mathrm{EPR}_{\mathrm{ch}}$ state modes; the second beam splitter affects
Bob’s mode and the thermal state simulating the detection module

$\displaystyle\mathrm{BS}_{\mathrm{ch}}$
$\displaystyle=\left(\begin{array}[]{ccccc}\mathbf{1}_{2}&0&0&0&0\\\
0&\sqrt{T_{\mathrm{ch}}}\mathbf{1}_{2}&\sqrt{1-T_{\mathrm{ch}}}\mathbf{1}_{2}&0&0\\\
0&-\sqrt{1-T_{\mathrm{ch}}}\mathbf{1}_{2}&\sqrt{T_{\mathrm{ch}}}\mathbf{1}_{2}&0&0\\\
0&0&0&\mathbf{1}_{2}&0\\\ 0&0&0&0&\mathbf{1}_{2}\end{array}\right),$ (45)
$\displaystyle\mathrm{BS}_{\mathrm{rec}}$
$\displaystyle=\left(\begin{array}[]{ccccc}\mathbf{1}_{2}&0&0&0&0\\\
0&\sqrt{T_{\mathrm{det}}}\mathbf{1}_{2}&0&0&\sqrt{1-T_{\mathrm{det}}}\mathbf{1}_{2}\\\
0&0&\mathbf{1}_{2}&0&0\\\ 0&0&0&\mathbf{1}_{2}&0\\\
0&-\sqrt{1-T_{\mathrm{det}}}\mathbf{1}_{2}&0&0&\sqrt{T_{\mathrm{det}}}\mathbf{1}_{2}\end{array}\right).$
(51)

Denoting the sequence of both beam splitters as
$\mathrm{BS}_{\mathrm{tot}}=\mathrm{BS}_{\mathrm{rec}}\mathrm{BS}_{\mathrm{ch}}$,
the total quantum state is transformed as follows

$\Sigma_{\mathrm{tot}}=\mathrm{BS}_{\mathrm{tot}}\Sigma_{\mathrm{tot},0}\mathrm{BS}_{\mathrm{tot}}^{T}.$
(52)

To simplify expressions for the covariance matrix, it should be considered
block by block. Thus, the block describing Alice-Bob subsystem is transformed
as follows

$\Sigma_{\mathrm{AB}}=\left(\begin{array}[]{cc}V\mathbf{1}_{2}&\sqrt{T_{\mathrm{ch}}}\sqrt{T_{\mathrm{det}}}\sqrt{V^{2}-1}\sigma_{z}\\\
\sqrt{T_{\mathrm{ch}}}\sqrt{T_{\mathrm{det}}}\sqrt{V^{2}-1}\sigma_{z}&\left(\begin{array}[]{c}T_{\mathrm{ch}}T_{\mathrm{det}}V\\\
+\left(1-T_{\mathrm{ch}}\right)T_{\mathrm{det}}W_{\mathrm{ch}}\\\
+\left(1-T_{\mathrm{det}}\right)W_{\mathrm{rec}}\end{array}\right)\end{array}\right).$
(53)

Let the variances for entangled states be defined as

$\displaystyle W_{\mathrm{ch}}$
$\displaystyle=\frac{\xi_{\mathrm{ch}}}{1-T_{\mathrm{ch}}}+1,$ (54)
$\displaystyle W_{\mathrm{rec}}$
$\displaystyle=\frac{\xi_{\mathrm{rec}}}{1-T_{\mathrm{det}}}+1.$ (55)

Then the variance of Bob’s quadrature operator is

$\displaystyle V_{\mathrm{B}}$
$\displaystyle=T_{\mathrm{ch}}T_{\mathrm{det}}(V-1)+1+T_{\mathrm{det}}\xi_{\mathrm{ch}}+\xi_{\mathrm{rec}}=$
$\displaystyle=T_{\mathrm{ch}}T_{\mathrm{det}}(V-1)+1+\xi_{\mathrm{ch},B}+\xi_{\mathrm{rec}}.$
(56)

Final expression for Alice-Bob block

$\Sigma_{\mathrm{AB}}=\left(\begin{array}[]{cc}V\mathbf{1}_{2}&\sqrt{T}\sqrt{V^{2}-1}\sigma_{z}\\\
\sqrt{T}\sqrt{V^{2}-1}\sigma_{z}&\left(T(V-1)+1+\xi\right)\mathbf{1}_{2}\end{array}\right).$
(57)

Eve block is described by the matrix

$\Sigma_{\mathrm{E}}=\left(\begin{array}[]{cc}\left(\left(1-T_{\mathrm{ch}}\right)V+T_{\mathrm{ch}}W_{\mathrm{ch}}\right)\mathbf{1}_{2}&\sqrt{T_{\mathrm{ch}}}\sqrt{\mathrm{W}_{\mathrm{ch}}^{2}-1}\sigma_{z}\\\
\sqrt{T_{\mathrm{ch}}}\sqrt{W_{\mathrm{ch}}^{2}-1}\sigma_{z}&W_{\mathrm{ch}}\mathbf{1}_{2}\end{array}\right).$
(58)

This matrix can be described in the form given by Eq. (32), so its symplectic
eigenvalues can be calculated by Eq. (33). It can be verified that the entropy
of Eve $S_{\mathrm{E}}$ is the same as the entropy shared by Alice and Bob and
obtained from their mutual covariance matrix in the trusted receiver noise
scenario from Eq. (31), which is expected when Eve purifies the state of Alice
and Bob, i.e.

$S_{\mathrm{E}}\equiv
S\left(\Sigma_{\mathrm{E}}\right)=S\left(\Sigma_{\mathrm{AB}}^{\text{trusted
rec. }}\right)\equiv S_{\mathrm{AB}}.$ (59)

Now, in order to get $S_{\mathrm{E\mid B}}$, we have to calculate
$\Sigma_{\mathrm{tot\mid B}}$, i.e. the covariance matrix of the common state
of the remaining modes after the projective measurement of the receiver mode.
It is convenient to represent $\Sigma_{\mathrm{tot}}$ so that the Alice’s mode
is located in the last row and column. This can be done by using a permutation
matrix, which allows to rearrange the third and fourth rows (columns) down (to
the right) when multiplied by $\Sigma_{\mathrm{tot}}$ from the left (right)
[14]:

$\displaystyle P_{3,\>4\rightarrow 9,\>10}$
$\displaystyle=\left(\begin{array}[]{ccccc}\mathbf{1}_{2}&0&0&0&0\\\
0&0&\mathbf{1}_{2}&0&0\\\ 0&0&0&\mathbf{1}_{2}&0\\\ 0&0&0&0&\mathbf{1}_{2}\\\
0&\mathbf{1}_{2}&0&0&0\end{array}\right),$ (65)
$\displaystyle\Sigma_{\mathrm{tot}}^{\prime}$ $\displaystyle=P_{3,4\rightarrow
9,10}\Sigma_{\mathrm{tot}}P_{3,4\rightarrow 9,10}^{T}.$ (66)

Since $P_{3,\>4\rightarrow 9,\>10}P_{3,\>4\rightarrow 9,\>10}^{T}=\mathbf{1}$,
the above permutation is a similarity transformation and therefore leaves the
eigenvalues of the matrix $\Sigma_{\mathrm{tot}}$ invariant. The covariance
matrix itself now looks like this:

$\Sigma_{\mathrm{tot}}^{\prime}=\left(\begin{array}[]{cc}\Sigma_{\mathrm{A},\>\mathrm{ch},\>\mathrm{rec}}&\Sigma_{\mathrm{C}}\\\
\Sigma_{\mathrm{C}}^{T}&\Sigma_{\mathrm{B}}\end{array}\right),$ (67)

where $\Sigma_{\mathrm{A},\>\mathrm{ch},\>\mathrm{rec}}\in\mathbb{R}^{8\times
8}$ is a matrix describing the Alice’s mode and the state of the channel and
the detection module, $\Sigma_{\mathrm{B}}\in\mathbb{R}^{2\times 2}$ is a
matrix describing the Bob’s mode, and $\Sigma_{C}\in\mathbb{R}^{8\times 2}$ is
a matrix describing quadrature correlations between
$\Sigma_{\mathrm{A},\>\mathrm{ch},\>\mathrm{rec}}$ and $\Sigma_{\mathrm{B}}$.

The $\Sigma_{\mathrm{tot\mid B}}$ matrix after a projective measurement of the
Bob’s mode depends on whether it performs homodyne or heterodyne detection.

In the case of heterodyne detection, the remaining modes are projected into
the state described by the $8\times 8$ matrix

$\displaystyle\Sigma_{\mathrm{tot}\mid\mathrm{B}}=\Sigma_{\mathrm{A},\>\mathrm{ch},\>\mathrm{rec}}-\frac{1}{V_{\mathrm{B}}+1}\Sigma_{\mathrm{C}}\Sigma_{\mathrm{C}}^{T}.$
(68)

Again, there is no need to evaluate the entire covariance matrix. Instead, one
can evaluate a block describing the eavesdropper information, that is two
modes representing the entangled state that was used to model the noise and
channel loss. The block itself is expressed as follows

$\displaystyle\Sigma_{\mathrm{E\mid B}}$
$\displaystyle=\frac{1}{V_{\mathrm{B}}+1}\left(\begin{array}[]{ll}e_{1}\mathbf{1}_{2}&e_{2}\sigma_{z}\\\
e_{2}\sigma_{z}&e_{3}\mathbf{1}_{2}\end{array}\right),$ (71) $\displaystyle
e_{1}$
$\displaystyle=V\left(\left(1-T_{\mathrm{rec}}\right)W_{\mathrm{rec}}+T_{\mathrm{rec}}W_{\mathrm{ch}}+1\right)+$
$\displaystyle+T_{\mathrm{ch}}\left(W_{\mathrm{ch}}-V\right)\left(1+\left(1-T_{\mathrm{rec}}\right)W_{\mathrm{rec}}\right),$
(72) $\displaystyle e_{2}$
$\displaystyle=\sqrt{T_{\mathrm{ch}}\left(W_{\mathrm{ch}}^{2}-1\right)}\left(T_{\mathrm{rec}}V+\left(1-T_{\mathrm{rec}}\right)W_{\mathrm{rec}}+1\right),$
(73) $\displaystyle e_{3}$
$\displaystyle=\left(1-T_{\mathrm{rec}}\right)W_{\mathrm{ch}}W_{\mathrm{rec}}+T_{\mathrm{rec}}T_{\mathrm{ch}}\left(VW_{\mathrm{ch}}-1\right)+T_{\mathrm{rec}}+W_{\mathrm{ch}}.$
(74)

Considering that the matrix $\Sigma_{\mathrm{E\mid B}}$ can also be
represented in the form of Eq. (32), then the symplectic eigenvalues can also
be represented similarly to the formula (33) as

$\displaystyle v_{3,\>4}$
$\displaystyle=\frac{z\pm\left(e_{3}-e_{1}\right)}{2\left(V_{B}+1\right)},$
(75) $\displaystyle z$
$\displaystyle=\sqrt{\left(e_{1}+e_{3}\right)^{2}-4e_{2}^{2}}.$ (76)

Thus, the necessary values for estimating the Holevo bound in the presence of
collective attacks in the trusted receiver noise scenario have been obtained.
Further, the model will need to be supplemented taking into account the lack
of access of Eve to the noise of Alice in order to consider the full scenario
of trusted noise from trusted nodes.

The noise on Alice side can be composed of noise from laser power fluctuation
and imperfect modulation [20, 13]. Models of such trusted Alice noise for
collective attacks are presented in [21, 22, 23, 14]. This noise is modeled by
analogy with the noise of the channel and the detection module using an
additional thermal state $\mathrm{Th}_{\mathrm{pr}}$ with variance

$W_{\mathrm{pr}}=\frac{\xi_{\mathrm{pr}}}{1-T_{\mathrm{pr}}}+1,$ (77)

where $T_{\mathrm{pr}}$ is a transmittance coefficient of Alice module.

Then the Alice noise measured by Bob will be
$\xi_{\mathrm{pr,\>B}}=T_{\mathrm{ch}}T_{\mathrm{rec}}\xi_{\mathrm{pr}}$. The
thermal state $\mathrm{Th}_{\mathrm{pr}}$ interacts with the Bob’s mode
through a beam splitter with a transmittance $T_{\mathrm{pr}}\rightarrow 1$,
since the initial signal power is assumed already at the output of Alice
module. While the limit $T_{\mathrm{pr}}\rightarrow 1$ would result in
$W_{\mathrm{pr}}\rightarrow\infty$, the noise
$\left(1-T_{\mathrm{pr}}\right)W_{\mathrm{pr}}=\xi_{\mathrm{pr}}+1-T_{\mathrm{pr}}\rightarrow\xi_{\mathrm{pr}}$
of the mode reflected into the channel will be finite and good certain.

The problem can again be reduced to considering only two modes available to
Eve, reducing the eigenvalue problem to a second degree polynomial. This
allows to describe the trusted noise of Alice and Bob using simple analytical
expressions.

The overall initial state now includes the thermal state responsible for the
Alice’s noise

$\Sigma_{\mathrm{tot},0}=\mathrm{EPR}_{\mathrm{AB}}\oplus\mathrm{Th}_{\mathrm{pr}}\oplus\mathrm{EPR}_{\mathrm{ch}}\oplus\mathrm{Th}_{\mathrm{rec}}.$
(78)

Then one should redesignate the sequence of all beam splitters
$\mathrm{BS}_{\mathrm{tot}}=\mathrm{BS}_{\mathrm{rec}}\mathrm{BS}_{\mathrm{ch}}\mathrm{BS}_{\mathrm{pr}}$.
Then the sympectic transformation, analogous to Eq. (52), will change the
block of the covariance matrix related to the eavesdropper as

$\Sigma_{\mathrm{E}}=\left(\begin{array}[]{cc}\left(\left(1-T_{\mathrm{ch}}\right)\left(V+\xi_{\mathrm{pr}}\right)+T_{\mathrm{ch}}W_{\mathrm{ch}}\right)\mathbf{1}_{2}&\sqrt{T_{\mathrm{ch}}}\sqrt{W_{\mathrm{ch}}^{2}-1}\sigma_{z}\\\
\sqrt{T_{\mathrm{ch}}}\sqrt{W_{\mathrm{ch}}^{2}-1}\sigma_{z}&W_{\mathrm{ch}}\mathbf{1}_{2}\end{array}\right).$
(79)

Obviously, the matrices from the expressions (58) and (79) coincide up to the
replacement $V\rightarrow V+\xi_{\mathrm{pr}}$. The symplectic eigenvalues
$v_{1}$ and $v_{2}$ required for calculating $S_{\mathrm{E}}$ are again
obtained by the formula (33). To calculate $v_{3}$ and $v_{4}$ for
$S_{\mathrm{E\mid B}}$, $\Sigma_{\mathrm{tot}\mid\mathrm{B}}$ must be
rearranged according to the modified shared state structure.

Thus, after substitution $T_{\mathrm{pr}}=1$ and with the accuracy of
replacement $V\rightarrow V+\xi_{\mathrm{pr}}$, the Eve’s covariance matrix
after heterodyne detection by Bob has the form in accordance with expression
(71). The symplectic eigenvalues $v_{3}$ and $v_{4}$ are again obtained by the
formulas (72)-(74).

The advantage of this model is that as equipment losses increase, the Holevo
bound decreases faster than mutual information [14].

##  5 Gaussian quantum channel modeling

The Gaussian quantum channel, as already mentioned in this paper, is
characterized by two parameters: the transmittance and excess noise. Often CV-
QKD papers do not provide clarifications on the components of these
characteristics [16, 24, 25]: an analytical assessment has been carried out
only for some components.

Modeling the parameters of the Gaussian channel is necessary to obtain the
value of the signal-to-noise ratio, which will be maintained at a given
distance.

As has already been demonstrated in the previous section, the transmittance is
composite, which is why it cannot be estimated in the aggregate, which, for
example, was done in [26, 24]. This assumption significantly improves the
performance and the amount of allowable losses in the stability analysis but
remains incorrect.

So, given that the quantum channel is an optical fiber channel, the
transmittance can be estimated in accordance with the well-known expression
[27]:

$\displaystyle T_{\mathrm{ch}}=10^{-\zeta L/10},$ (80)

where $\zeta$ is a fiber attenuation in dB/km.

The coefficient $T_{\mathrm{det}}$ can be obtained from equipment loss and
detector efficiency as:

$\displaystyle T_{\mathrm{det}}=\eta_{\mathrm{det}}10^{-\mathrm{losses}/10},$
(81)

where $\mathrm{losses}$ is a cumulative losses on the Alice’s equipment.

Here it should be clarified that $T_{\mathrm{det}}$ is a transmittance in the
signal arm, $T_{\mathrm{det}}^{\prime}$ is a transmittance in LO arm. The
latter will be necessary for estimating the excess noise. Both coefficients
are calculated using the formula (81) taking into account the fact that losses
in both arms are different. For example, the power of LO is expressed as

$\displaystyle P_{\mathrm{LO}}=T_{\mathrm{det}}^{\prime}P_{\mathrm{LO,\>A}},$
(82)

where $P_{\mathrm{LO,\>A}}$ is a power of LO at the output of Alice.

The cumulative losses on the equipment in Bob module are presented in the
Table 1.

Table 1: Cumulative losses in the signal arm and in the arm of LO obtained from [28, 29, 30, 31, 32, 33, 34, 35] Arm | Name of the optical component | Insertion loss, dB
---|---|---
Signal | FC/APC Connectors | 3
CWDM-filter | 0.6
Polarization controller | 0.05
Polarizing beam splitter | 0.6
90-degree hybrid | 3
All components | 7,25
LO | FC/APC Connectors | 3,6
CWDM-filter | 0.6
Polarization controller | 0.05
Polarizing beam splitter | 0.6
Beam splitter 10/90 6 | 0.85
90-degree hybrid | 3
All components | 8.7

In many theoretical works, the excess noise values are approximated and fixed
[36, 25, 37, 38, 14]. This is motivated by the fact that in real CV-QKD
systems, the excess noise, as well as the transmittance, is estimated from
experimental data on the variances of quadrature operators. As far as strictly
theoretical works are concerned, the substitution is necessary only for
illustrative purposes. However, for a theoretical performance evaluation of
the considered CV-QKD system, it is necessary to take into account various
noise sources, which will be further carried out in accordance with the work
[13].

Like the transmittance, excess noise is compound. In this case, the excess
noise components are:

  * •

Alice module noises:

    * –

laser power fluctuations noise;

    * –

DAC noise;

  * •

channel noises:

    * –

phase noise;

  * •

Bob module noises:

    * –

common-mode rejection ratio (CMRR) noise;

    * –

internal noise of the balanced detector;

    * –

ADC noise.

Laser power fluctuations noise contains of two components, signal and LO ones

$\displaystyle\xi_{\mathrm{RIN},\>\mathrm{sig}}$
$\displaystyle=V_{\mathrm{A}}\sqrt{\mathrm{RIN}_{\mathrm{sig}}B_{\mathrm{sig}}},$
(83) $\displaystyle\xi_{\mathrm{RIN},\>\mathrm{LO}}$
$\displaystyle=\frac{1}{4}\mathrm{RIN}_{\mathrm{LO}}B_{\mathrm{LO}}V,$ (84)
$\displaystyle\xi_{\mathrm{RIN}}$
$\displaystyle=\xi_{\mathrm{RIN},\>\mathrm{LO}}+\xi_{\mathrm{RIN},\>\mathrm{sig}}$
(85)

where $\mathrm{RIN}_{\mathrm{sig}}$ is a relative intensity noise (RIN) of
signal, $\mathrm{RIN}_{\mathrm{LO}}$ is a relative intensity noise of LO,
$B_{\mathrm{sig}}$ is a signal spectrum width, and $B_{\mathrm{LO}}$ is a LO
spectrum width.

It is important to note that due to the fact that both the signal and LO emit
from the same laser, the spectral width and relative intensity noise for them
will be the same [13], i.e. $B_{\mathrm{sig}}=B_{\mathrm{LO}}\equiv B$,
$\mathrm{RIN}_{\mathrm{sig}}=\mathrm{RIN}_{\mathrm{LO}}\equiv\mathrm{RIN}$.

The excess noise caused by noise from the modulating voltage side is expressed
by the inequality [13]

$\displaystyle\xi_{\mathrm{DAC}}\leqslant
V_{\mathrm{A}}\left(\pi\alpha\frac{\sqrt{V_{\mathrm{q}}}}{V_{\pi}}+\frac{1}{2}\pi^{2}\alpha^{2}\frac{V_{\mathrm{q}}}{V_{\pi}^{2}}\right)^{2},$
(86) $\displaystyle
V_{\mathrm{q}}=\mathrm{LSB}^{2}/12=V_{\mathrm{FS}}^{2}/(12\cdot
2^{2N_{\mathrm{res}}(f_{\mathrm{rep}})}).$ (87)

where $V_{\pi}$ is a voltage required to reverse the phase by $\pi$, $\alpha$
is a DAC gain coefficient, $V_{\mathrm{q}}$ is a converter output voltage
variance, LSB is aleast significant bit, $V_{\mathrm{FS}}$ is a full-scale
voltage range of the converter, and $N_{\mathrm{res}}$ is a DAC resolution.

Coherent quantum signal detection requires a well calibrated phase and
frequency relationship between the signal and LO. In addition, the signal
initially carries a certain level of phase noise. This phase noise, as well as
relative phase shifts, can be compensated with a strong reference sent by
Alice [39, 40, 41, 42]. The reference (or pilot) signal carries well-known
phase with a fixed phase relation to the original signal pulse. Bob performs
heterodyne detection of the reference signal by measuring its quadratures $q$
and $p$. It can determine the deviation from a fixed and time-constant
reference phase. Any of such measured phase shift is used to appropriately
correct the measured phase of the quantum signal. The remaining phase noise is
then expressed as [13]

$\xi_{\mathrm{PR}}=\frac{1}{2}V_{\mathrm{A}}\frac{V_{\mathrm{pt}}}{N_{\mathrm{pt}}\left\langle
N_{\mathrm{pt}}\right\rangle},$ (88)

where $V_{\mathrm{pt}}$ is a variance of the quadrature operator of the
reference signal, $N_{\mathrm{pt}}$ is a number of the reference signals,
$\left\langle N_{\mathrm{pt}}\right\rangle$ is a the average number of photons
in the reference pulse.

It should be noted that at purposed paper, it is assumed that for each signal
message there is a reference signal, i.e. the number of reference signals is
half of the total number of messages.

It is convenient to express the internal noise of a balanced detector in terms
of a characteristic called clearance $C$, which is defined as the ratio of the
total experimental variance of a zero power signal (dispersion shot noise
$V_{0}(\hat{q})$ and electronic noise of dispersion
$V_{\operatorname{det}}(\hat{q})$) and variance
$V_{\operatorname{det}}(\hat{q})$ caused only by detector electronic noise:

$\displaystyle
C=\frac{V_{0}(\hat{q})+V_{\operatorname{det}}(\hat{q})}{V_{\operatorname{det}}(\hat{q})}.$
(89)

The shot noise variance depends linearly on the power of LO, which, however,
is limited by the saturation limit of the detector’s PIN diodes.
Experimentally, the numerator of the Eq. (89) can be determined by measuring
the quadrature variance of LO when it is mixed with the vacuum inlet. The
denominator is the remaining quadrature variance after LO is disconnected from
the detector. In SNU by definition $V_{0}(\hat{q})=1$, and the equation
becomes

$\displaystyle
C=\frac{1+V_{\mathrm{det}}(\hat{q})}{V_{\mathrm{det}}(\hat{q})}=\frac{1+\xi_{\mathrm{det}}}{\xi_{\mathrm{det}}}.$
(90)

Thus, the noise of a balanced detector relative to the clearance, taking into
account one/two detectors in homo-/heterodyne detection respectively, is

$\displaystyle\xi_{\mathrm{det}}=\mu\frac{1}{C-1}.$ (91)

An experimental evaluation of $\xi_{\mathrm{det}}$ was carried out for the
General Photonics OEM Balanced Detector (BPD-003) with an operating frequency
band of 200 MHz (see Figure 2). The choice of the detector was based on the
following parameters for the optimal signal-to-noise ratio:

  * •

low noise equivalent power — indicates the possibility of detecting signals
with a power comparable to that of shot noise;

  * •

high gain coefficient — allows detection of low power signals with high
attenuation of LO;

  * •

high CMRR — shows the gain quality;

  * •

a wide operating frequency band — allows to increase the frequency of sending
states, which, in accordance with the current technical level, should be about
MHz [26, 16, 24]. The established relationship between the excess noise of the
detector and its operating frequency band is linear [13], so a too large range
can lead to a high level of internal detector noise.

The dependence of excess noise of the detector and, as a result, the signal-
to-noise ratio on the operating frequency band does not have a minimum due to
linearity, however, as can be seen in Figure 2, the obtained noise level in
the considered detector is quite low and corresponds to the level established
by [13, 24]. So, for example, with a total loss of 13.7 dB (5 dB in the
channel and 8.7 dB in LO arm), $\xi_{\mathrm{det}}=0.093$ is observed in [13]
at operating frequency band of the detector is 250 MHz. In [24]
$\xi_{\mathrm{det}}\sim 10^{-1}$, based on the given data.

Figure 2: Dependence of excess noise of the balanced detector on the input
power of LO for General Photonics OEM Balanced Detector (BPD-003).

According to the obtained dependence of the excess noise of the balanced
detector on the input power of LO, one can observe an increase in the
contribution of the noise with a decrease in its values. In practice, a
decrease in power is associated with an increase in losses. The resulting
dependence will be used later in the overall assessment of the total excess
noise. The experimental background of the obtained formula is related to the
fact that the proposed models do not take into account the full composition of
the balanced detector.

A realistic differential amplifier will amplify not only the difference
current with a coefficient $g$, but also to a small extent with a coefficient
$g_{\mathrm{CM}}$ their average value of the input photocurrents in the
subtractive circuit. As a characteristic for estimating such amplification,
CMRR [43] is used:

$\displaystyle\mathrm{CMRR}$
$\displaystyle=\left|\frac{g}{g_{\mathrm{CM}}}\right|.$ (92)

Noise dependent on CMRR is calculated as [13]:

$\displaystyle\xi_{\mathrm{CMRR}}=\frac{\mu}{4\mathrm{CMRR}^{2}}\left(\frac{hfV_{\mathrm{A}}^{2}}{4\tau
P_{\mathrm{LO}}}\mathrm{RIN}_{\mathrm{sig}}B_{\mathrm{sig}}+\frac{\tau}{hf}P_{\mathrm{LO}}\mathrm{RIN}_{\mathrm{LO}}B_{\mathrm{LO}}\right),$
(93)

where $P_{\mathrm{LO}}$ is a LO power, $\tau$ is a pulse duration, $f$ is an
optical frequency and $h$ is a Planck’s constant.

The incoming signal pulse will be received and amplified by Bob’s balanced
detector, where the output voltage will be proportional to the measured
quadrature. However, if the output voltage is quantized by DAC, it will
introduce additional error into the measured signal, thereby contributing to
excess noise as [13]:

$\xi_{\mathrm{ADC}}=\mu\frac{\tau
V_{\mathrm{q}}}{hf\mathrm{~{}g}^{2}\rho^{2}P_{\mathrm{LO}}}$ (94)

where $g$ is a gain coefficient of the electrical circuit of balanced detector
and $\rho$ is a photodiode responsivity.

It should be noted that in the equations (86) and (94) the output voltage
variance of DAC and ADC are equal, because they are selected with the same
scope and resolution.

The calculation of the components of the total excess noise was carried out in
accordance with the parameters specified in Table LABEL:tab:parameters. The
substantiation of the variance of the quadrature operator is given below in
Sec. 6.1. It is important that in the considered case of transmitted LO (see
Figure 1), the power of the LO, as well as the signal power, depends
significantly on the losses on equipment and in the channel, which must be
taken into account in assessing the excess noise related to the receiver.

Table 2: Parameters used in modeling excess noise obtained from Refs. [13, 44]. | Parameter
---
Description | Value |  | Units
---
$V_{\mathrm{A}}$ |  | Alice’s modulation
---
variance
6.77 | SNU
$\mathrm{RIN}$ |  | RIN
---
$10^{-14.5}$ | Hz-1
$B$ | laser spectrum width | $10^{4}$ | Hz
$V_{\pi}$ |  | voltage required to
---
reverse the phase by $\pi$
5 | V
$\alpha$ | DAC gain | 8 | a.u.
$V_{\mathrm{q}}$ |  | variance of output voltage of converter
---
1.94$\cdot 10^{-11}$ | V
$V_{\mathrm{FS}}$ | full-scale voltage range of DAC | 1 | V
$N_{\mathrm{res}}$ | DAC resolution | 16 | bit
$V_{\mathrm{pt}}$ |  | variance of pilot signal
---
1.2 | SNU
$n_{\mathrm{pt}}$ | number of pilot signals | $3\cdot 10^{8}$ | –
$\left\langle N_{\mathrm{pt}}\right\rangle$ |  | mean photon number in pilot puls
---
600 | –
$\mu$ |  | homo-/heterodyning parameter
---
2 | –
$P_{\mathrm{LO},\>A}$ |  | Alice’s output LO power
---
2$\cdot 10^{-3}$ | W
$T_{\mathrm{det}}$ |  | transmittance of
---
signal arm
$10^{-0,745}$ | a.u.
$T_{\mathrm{det}}^{\prime}$ |  | transmittance of
---
LO arm
$10^{-0,89}$ | a.u.
$\tau$ | pulse duration | 3$\cdot 10^{-9}$ | s
$f$ | optical frequency | 1.934 $\cdot 10^{14}$ | Hz
$h$ | Planck’s constant | 6.63$\cdot 10^{-34}$ | J$\cdot$s
$g$ |  | balanced detector’s gain
---
105 | V/A
$\rho$ | photodiode responsivity | 0.85 | A/W
$\mathrm{CMRR}$ | CMRR | 30 | dB

##  6 Evaluation and monitoring of experimental parameters

This subsection describes the procedure for assessing, optimizing and
monitoring the key parameters of the CV-QKD. Since the selection of parameters
directly affects the secure key generation rate, it is necessary to introduce
a boundary with respect to which the calculation will be carried out.

In the general case, the secure key generation rate $K$ is determined by

$K=f_{\mathrm{sym}}\cdot r,$ (95)

where $f_{\mathrm{sym}}$ is a repetition rate and $r$ is a secure key
fraction.

The asymptotic secure key generation rate in terms of a message with ideal
post-processing for the CV-QKD system in the case of collective attacks is
given by the Devetak-Winter bound [45] as

$r_{\mathrm{coll}}^{\mathrm{asympt}}\geqslant I_{\mathrm{AB}}-\chi.$ (96)

Given the non-ideal reverse reconciliation, the bound can be refined as

$r_{\mathrm{coll}}^{\mathrm{asympt}}\geqslant(1-\mathrm{FER})\left(\beta
I_{\mathrm{AB}}-\chi_{\mathrm{EB}}\right),$ (97)

where $\mathrm{FER}\in[0,\>1]$ is a frame error rate (FER).

The quantities $I_{\mathrm{AB}}$ and $\chi_{\mathrm{EB}}$ are respectively
obtained by the formulas (24) and (29). The dependence of these quantities on
losses in the quantum channel is shown in Figure 3.

Figure 3: Mutual information $I_{\mathrm{AB}}$ and the Holevo bound
$\chi_{\mathrm{BE}}$ versus losses in the quantum channel.

It can be seen that the Holevo bound does not exceed the mutual information at
large distances, thereby keeping the secure key generation rate positive (see
Figure 3). Such an assessment poorly reflects reality, because with an
infinite number of messages, and, hence, with an infinite sample for
estimating the parameters and an infinite number of reference signals, the
excess noise in the channel is very small. At the same time, the excess noise
and losses on Bob side are still large. Limitations on the quantum channel
length, as, for example, in [14], are due to the fact that the excess noise
model uses not analytical expressions, but approximate fixed values. It can
also be noted that when using error correction codes over an alphabet of size
$q$, each symbol of the code corresponds to $\log_{2}q$ bits, and for a given
code rate $R$, which is selected based on the channel parameters, one can
write [13]:

$R\log_{2}q=\beta I_{\mathrm{AB}}.$ (98)

Figure 4: Dependence of secure key generation rate in the asymptotic limit on
losses in the quantum channel considering the presence of collective attacks.

###  6.1 Mean photon number optimization

Obviously, an increase in the variance of the Alice’s quadrature operator
$V_{\mathrm{A}}$, which specifies the average number of photons over an
ensemble of states (see Eq. (12)), will lead to a proportional increase in the
signal-to-noise ratio (see Eq. (21)). That is, an increase in the average
number of photons in the signal will give better discrimination of Gaussian
states up to the limits provided by the detector. However, it must be taken
into account that in this case Eve will also receive more information. In this
regard, it is necessary to estimate the value of $V_{\mathrm{A}}$ by
maximizing the value of the secure key fraction $r$ at the target distance.

Thus, with a target loss in the quantum channel of 5 dB and the efficiency of
the reconciliation procedure $\beta=0.95$, the optimal value $V_{\mathrm{A}}$
is 6.77 SNU, which is obtained by maximizing the adjusted value of $r$ from
the expression (121). It is important to note that this parameter is
significantly affected by the total number of states $n_{\mathrm{states}}$,
which, in turn, determines the limit for the number of reference signals.

###  6.2 Parameter estimation

The Bob measurement data does not initially correspond to Gaussian quantum
information terminology. For this reason, it is necessary to introduce a
conversion coefficient $\phi$, expressed in V2/SNU, which converts the
original data to SNU. To keep track of possible changes to the calibration
parameters, this procedure should be repeated during the key exchange step.
Instead of the variance of the quadrature operator, Bob measures the voltage
variance (see Eq. (22))

$V(U)=\phi V\left(\hat{q}_{\mathrm{B}}\right).$ (99)

Alice and Bob randomly jointly select $n_{\mathrm{pe}}$ from
$n_{\mathrm{states}}$ distributed signals and publicly disclose the
corresponding $\mu n_{\mathrm{pe}}$ value pairs. Under the collective Gaussian
attack assumption, these pairs are independent and equally distributed
Gaussian variables. In accordance with the maximum likelihood method, the
following estimate can be obtained from the sample

$V(U)=\langle U^{2}\rangle-\langle U\rangle^{2}=\frac{1}{\mu
n_{\mathrm{pe}}}\sum_{i=1}^{\mu n_{\mathrm{pe}}}U_{i}^{2}-\left(\frac{1}{\mu
n_{\mathrm{pe}}}\sum_{i=1}^{\mu n_{\mathrm{pe}}}U_{i}\right)^{2},$ (100)

where $U_{i}$ is a measured voltage value.

Approximately the parameter $\phi$ can be estimated as

$\phi\approx P_{\mathrm{LO}}\rho^{2}g^{2}B_{\mathrm{BD}}hf,$ (101)

where $B_{\mathrm{BD}}$ is an operating frequency of the balanced detector.

However, the coefficient $\phi$ must be determined experimentally more
precisely. To do this, Bob disables the signal input
($TV_{\mathrm{A}}=\xi_{\mathrm{ch}}=0$) and instead measures the quadratures
of the vacuum state. Then the variance of Bob quadrature operator is

$\displaystyle V\left(\hat{q}_{B}\right)$
$\displaystyle=1+\frac{\xi_{\mathrm{rec}}}{\mu},$ (102) $\displaystyle V(U)$
$\displaystyle=\phi+\phi\frac{\xi_{\mathrm{rec}}}{\mu}\equiv\phi+N_{\mathrm{rec}}.$
(103)

It should be noted that $\phi$ is linearly directly proportional to LO power,
while the detector noise is inversely proportional, as shown in the expression
(94) and as can be seen from Figure (2) (the analytical formula for the
detector noise is presented in [13]). Therefore, the product of two is
constant with respect to $P_{\mathrm{LO}}$

$\displaystyle\phi$ $\displaystyle\propto P_{\mathrm{LO}},$ (104)
$\displaystyle\xi_{\mathrm{rec}}$
$\displaystyle\propto\frac{1}{P_{\mathrm{LO}}},$ (105)
$\displaystyle\frac{\partial N_{\mathrm{rec}}}{\partial P_{\mathrm{LO}}}$
$\displaystyle=\frac{\partial\left(\phi\xi_{\mathrm{rec}}\right)}{\partial
P_{\mathrm{LO}}}=0.$ (106)

Thus, in the case of $P_{\mathrm{LO}}=0$, the coefficient $\phi$ will become
zero, but $N_{\mathrm{rec}}$ will remain unchanged, since it does not depend
on LO power. Therefore, when not only the signal but also LO input are
disabled, the expression (103) becomes

$V(U)=N_{\mathrm{rec}}.$ (107)

Now, for a given voltage dispersion $V(U)$, obtained with a given non-zero LO
power, we can write the final formula for $\phi$:

$\phi=V(U)-N_{\mathrm{rec}}.$ (108)

The quantity $\phi$ is a quadratic measure of the voltage of exactly one SNU,
still assuming that only the vacuum input is measured, i.e.
$TV_{\mathrm{A}}=0$. For subsequent parameter estimation, Bob divides his
measured voltages representing $q$ and $p$ by $\sqrt{\phi}$ and any calculated
voltage variance by $\phi$, so that all his data will be represented in SNU
system.

###  6.3 Confidence intervals

Depending on the chosen security model (trusted or untrusted noise), when
estimating the parameters, it is necessary to set certain confidence
intervals. Since the noise of the equipment is assumed to be trusted in the
model under consideration, the total transmittance for Bob (in the expression
(82)) must be estimated in terms of the best case, while the transmittance and
excess noise of the channel — in terms of the worst.

As already mentioned, Alice and Bob have a sample of $\mu n_{\mathrm{pe}}$
independent and equally distributed pairs $\\{x_{i},\>y_{i}\\}_{i=1}^{\mu n_{\
mathrm{pe}}}$, where $x_{i}$ and $y_{i}$ are Gaussian variables, which are
related by the ratio of the channel with additive white Gaussian noise:

$\displaystyle y=\sqrt{T}x+\mathcal{N}(0,\>\xi).$ (109)

For pairs of values, estimates of the transmittance and excess noise are
determined:

$\displaystyle\hat{T}$ $\displaystyle=\frac{\sum_{i=1}^{\mu
n_{\mathrm{pe}}}x_{i}y_{i}}{\sum_{i=1}^{\mu n_{\mathrm{pe}}}x_{i}^{2}},$ (110)
$\displaystyle\hat{\xi}$ $\displaystyle=\frac{1}{\mu
n_{\mathrm{pe}}}\sum_{i=1}^{\mu n_{\mathrm{pe}}}(y_{i}-\hat{T}x_{i}).$ (111)

It should be taken into account that corrections must be introduced, depending
on the belonging of the noise for a correct assessment of the mutual
information and the Holevo bound. At the same time, the channel model with
additive noise is preserved. The corrections themselves are expressed as [38]:

$\displaystyle\operatorname{Corr}_{\xi,\>j}$
$\displaystyle=w\sqrt{\operatorname{Var}(\hat{T}_{j}^{1/2})}=w\frac{\xi_{j}+\mu}{\sqrt{2\mu
n_{\mathrm{pe}}}},$ (112) $\displaystyle\operatorname{Corr}_{T,\>j}$
$\displaystyle=w\sqrt{\operatorname{Var}(\hat{\xi}_{j})}=2w\sqrt{\frac{2T_{j}^{2}+T_{j}(\xi_{j}+\mu)/V_{\mathrm{A}}}{\mu
n_{\mathrm{pe}}}},$ (113)

where $w$ is a confidence factor, $m$ is a number of signals for parameter
estimation and $j$ is a parameter that defines belonging to Alice/channel/Bob.

Such approximations are correct up to $O(n_{\mathrm{pe}}^{-1})$. The
expression $\operatorname{Var}(\hat{T}^{1/2})$ can be further approximated for
large $n_{\mathrm{pe}}$, so a more optimistic estimate can be written

$\displaystyle\operatorname{Corr}_{T,\>j}$
$\displaystyle=2w\xi_{j}/V_{\mathrm{A}}\sqrt{T_{j}/(\mu n_{\mathrm{pe}})}.$
(114)

However, the estimate from the expression (113) will be used for performance
analysis.

Thus, it is necessary to carry out the replacement as follows

$\displaystyle T_{\mathrm{det}}^{\prime}$ $\displaystyle\longrightarrow
T_{\mathrm{det}}^{\prime}+\operatorname{Corr}_{T,\>\mathrm{full}},$ (115)
$\displaystyle T_{\mathrm{ch}}$ $\displaystyle\longrightarrow
T_{\mathrm{ch}}-\operatorname{Corr}_{T,\>\mathrm{ch}},$ (116)
$\displaystyle\xi_{\mathrm{ch}}$
$\displaystyle\longrightarrow\xi_{\mathrm{ch}}+\operatorname{Corr}_{\xi,\>\mathrm{ch}}.$
(117)

Each of these estimates limits the corresponding actual value to within the
error probability $\varepsilon_{\mathrm{pe}}$, if denote

$w=\frac{\sqrt{2}}{\operatorname{erf}\left(1-2\varepsilon_{\mathrm{pe}}\right)}\approx\sqrt{2\ln\left(1/\varepsilon_{\mathrm{pe}}\right)}.$
(118)

Approximation in Eq. (118) is allowed for small
$\varepsilon_{\mathrm{pe}}\leqslant 10^{-17}$.

##  7 Estimating the finite-length secure key generation rate

After parameter estimation, each initial sequence of $n_{\mathrm{states}}$
dimensions goes into $n$ symbols to be processed into the final key using
error correction and privacy amplification procedures. For each information
block, errors are successfully corrected with a probability of
$1-\mathrm{FER}$. The value of this probability depends on the signal-to-noise
ratio, the target reconciliation efficiency $\beta$, and the
$\varepsilon$-criteria correctness $\varepsilon_{\mathrm{cor}}$. The latter
limits the probability that local bitstrings of Alice and Bob are different
after error correction and successful execution of the validation procedure.

On average, $n(1-\mathrm{FER})$ signals from the information block remain for
the privacy amplification procedure. This final step is implemented with the
$\varepsilon$-security parameter $\varepsilon_{\mathrm{sec}}$, which limits
the trace distance between the final key and the ideal key, which has no
correlation with the eavesdropper. In the QKD paradigm, it is necessary to
take into account the pessimistic assessment of information distributed among
users. In this case not Shannon entropies, but smoothed Rényi min-entropies
are used, which are reduced to the former through the asymptotic equipartition
property [46]. The smoothness determines the allowable error fluctuations. In
turn, $\varepsilon$-security is technically decomposed as:

$\displaystyle\varepsilon_{\mathrm{sec}}=\varepsilon_{\mathrm{s}}+\varepsilon_{\mathrm{h}},$
(119)

where $\varepsilon_{\mathrm{s}}$ is a min-entropy smoothing parameter and
$\varepsilon_{\mathrm{h}}$ is a parameter that determines the match of hash
codes after privacy amplification procedure.

All declared $\varepsilon$-security parameters are set small (for example,
$2^{-33}\approx 10^{-10}$) and form a general security criteria

$\displaystyle\varepsilon=2(1-\mathrm{FER})\varepsilon_{\mathrm{pe}}+\varepsilon_{\mathrm{cor}}+\varepsilon_{\mathrm{sec}}.$
(120)

###  7.1 Satisfying the composability criteria of CV-QKD protocol in the
presence of collective attacks

Taking into account the finiteness of the keys and the requirement that the
protocol under consideration be composable in the presence of collective
attacks, the boundary from the expression (97) is refined, and the secure key
generation rate in terms of the message is expressed as [37, 38]

$\displaystyle r_{\mathrm{coll}}^{\mathrm{finite}}$
$\displaystyle\geqslant\frac{n(1-\mathrm{FER})}{n_{\mathrm{states}}}\left(\beta
I_{\mathrm{AB}}(w)-\chi_{\mathrm{EB}}(w)-\frac{\Delta_{\mathrm{AEP}}}{\sqrt{n}}+\frac{\Theta}{n}\right),$
(121) $\displaystyle\Delta_{\mathrm{AEP}}$
$\displaystyle=4\log_{2}(2\sqrt{d}+1)\sqrt{\log_{2}\left(\frac{18}{(1-\mathrm{FER})^{2}\varepsilon_{\mathrm{s}}^{4}}\right)},$
(122) $\displaystyle\Theta$
$\displaystyle=\log_{2}\left[(1-\mathrm{FER})\left(1-\varepsilon_{\mathrm{s}}^{2}/3\right)\right]+2\log_{2}\sqrt{2}\varepsilon_{\mathrm{h}},$
(123)

where $n$ is a number of characters left to process the final key,
$n_{\mathrm{states}}$ is the number of states, $\Delta_{\mathrm{AEP}}$ is a
correction according to asymptotic equipartition property [46], $\Theta$ is a
correction coefficient that combines hash mismatch accounting after privacy
amplification procedure according to Lemma 2 of [47] and a leak on the error
correction procedure [37, 38], $d$ is a size of the effective alphabet after
the final digitization of the continuous variables of Alice and Bob and
$\varepsilon_{j}$ is the security parameter.

To improve performance, $\Delta_{\mathrm{AEP}}$ can be refined as [38, 48]

$\displaystyle\Delta_{\mathrm{AEP}}$
$\displaystyle=4\log_{2}(\sqrt{d}+2)\sqrt{\log_{2}\left(\frac{18}{(1-\mathrm{FER})^{2}\varepsilon_{\mathrm{s}}^{4}}\right)}.$
(124)

The value of $n$, in turn, is obtained from $n_{\mathrm{states}}$ as follows

$\displaystyle n=n_{\mathrm{states}}-(n_{\mathrm{pt}}+n_{\mathrm{pe}}),$ (125)

where $n_{\mathrm{pt}}$ — number of reference signals and $n_{\mathrm{pe}}$ —
number of signals given for parameter estimation.

###  7.2 Security of CV-QKD protocol against coherent attacks

So far, the security of the CV-QKD protocol with Gaussian modulation in the
presence of Gaussian collective attacks has been substantiated. The level of
security for a protocol with heterodyne detection can be extended to security
against coherent attacks using the mathematical apparatus from [49].

Let the protocol $\mathcal{P}$, which uses coherent states as information
carriers, be $\varepsilon$-secure with a secure key generation rate of finite
length $r_{\mathrm{coll}}^{\mathrm{finite}}$ in the presence of collective
Gaussian attacks, and $\mathcal{P}$ can be symmetrized with respect to the
representation of the group of unitary matrices in the Fock space. This
symmetrization is equivalent to applying an identical random orthogonal matrix
to the classical continuous variables [49], which is certainly possible for a
protocol that implies heterodyne detection. The symmetrized protocol can be
denoted as $\tilde{\mathcal{P}}$.

Then it can be assumed that users jointly perform the so-called energy tests
on the sample $n_{\mathrm{et}}=f_{\mathrm{et}}n$ from random inputs for some
coefficient $f_{\mathrm{et}}<1$. In each test, the parties measure a local
average of the number of photons, which can be extrapolated from the data, and
calculate the average over the $n_{\mathrm{et}}$ tests. If these averages
exceed the specified thresholds ($d_{\mathrm{A}}$ for Alice and
$d_{\mathrm{B}}$ for Bob), the protocol is aborted. Setting
$d_{\mathrm{A}}\geqslant V_{\mathrm{A}}/2+O(n_{\mathrm{et}})$ guarantees
almost successful passing of the test with probability $p_{\mathrm{et}}\approx
1$ in typical scenarios, where the signals are attenuated and the noise is not
too high, at large values of $n_{\mathrm{et}}$ [37]. Also, for a channel with
losses and a sufficiently small excess noise, the average number of photons
reaches Bob, which is clearly less than in the state prepared by Alice, which
means that a successful value for $d_{\mathrm{B}}$ can be chosen to be
$d_{\mathrm{A}}$, i.e. relies $d_{\mathrm{A}}=d_{\mathrm{B}}\equiv
d_{\mathrm{et}}$.

Thus, the parties are moving to a symmetrized $\tilde{\mathcal{P}}$ protocol,
which will now use $\tilde{n}=n_{\mathrm{states}}-n_{\mathrm{coh}}$ signals to
generate secret quantum keys, where $n_{\mathrm{coh}}\equiv
n_{\mathrm{pt}}+n_{\mathrm{pe}}+n_{\mathrm{et}}$.

Moreover, additional privacy amplification is required, reducing the output
key string by [49, 37, 38] $\Phi_{n}$

$\displaystyle\Phi_{n}$
$\displaystyle=2\left[\log_{2}\left(\begin{array}[]{c}K_{n}+4\\\
4\end{array}\right)\right],$ (128) $\displaystyle K_{n}$
$\displaystyle=\max\left\\{1,2\tilde{n}d_{\mathrm{et}}\frac{1+2\sqrt{\vartheta}+2\vartheta}{1-2\sqrt{\vartheta/f_{\mathrm{et}}}}\right\\},$
(129) $\displaystyle\vartheta$
$\displaystyle=(2\tilde{n})^{-1}\ln(8/\varepsilon).$ (130)

Assuming that the original protocol has $\varepsilon$ security criteria
against collective Gaussian attacks, otherwise the security criteria for the
symmetrized protocol against coherent attacks goes to [49]

$\displaystyle\varepsilon^{\prime}=K_{n}^{4}\varepsilon/50.$ (131)

It should be noted that a very strict limitation on $\varepsilon$-parameters
is implied. In particular, this means that $\varepsilon_{\mathrm{pe}}$ must be
sufficiently small (for example, $10^{-43}$, as suggested by [25, 37]), and
the corresponding coefficient confidence $w$ must be calculated using Eq.
(118).

Given the changed length of the input sequence and the change in the security
criteria, Eq. (121) is rewritten as

$\displaystyle r_{\mathrm{coh}}^{\mathrm{finite}}$
$\displaystyle\geqslant\frac{\tilde{n}(1-\mathrm{FER})}{n_{\mathrm{states}}}\left(\beta
I_{\mathrm{AB}}(w)-\chi_{\mathrm{EB}}(w)-\frac{\Delta_{\mathrm{AEP}}}{\sqrt{n}}+\frac{\Theta-\Phi_{n}}{n}\right).$
(132)

###  7.3 Analysis of the potential performance of CV-QKD system

The dependence of the finite-length secure key generation rate in the presence
of collective and coherent attacks on losses in the quantum channel is shown
in Figure 5. The corresponding parameters are presented in the tables
LABEL:tab:parameters and LABEL:tab:parameters-2. A significant contribution to
the performance of any system CV-QKD is made by the number of states, while
increasing this parameter imposes a limit on the computing resource. In the
case under consideration, this value was estimated from the calculation of
memory characteristics and information processing speed, i.e. the number of
states was chosen as large as possible to fully record information about them
in high-speed memory of the type DDR. It is supposed to use the Kria K26
computing module from Xilinx with a memory of 4 GB, of which 2 GB is allocated
for data. With a further increase in the number of states, information will
need to be recorded in a larger, but low-speed memory, using which the final
rate of generation of the secret quantum key will be lower. For this reason,
there is a limitation on the amount of recorded information about states in
memory caused by the use of high-speed memory.

The marginal losses in the quantum channel in CV-QKD in the presence of
collective attacks are 10.2 dB, in the presence of coherent — 7.5 dB.

Figure 5: Dependence of the secure key generation rate of finite length in the presence of collective and coherent attacks on losses in the quantum channel. Table 3: Parameters used to evaluate the performance of the CV-QKD system. Security parameters are selected in accordance with the work [36, 25, 37, 38]. | Parameter
---
Description |  | Value
---
(collective
attacks)
| Value
---
(coherent
attacks)
| Units
---
$n_{\mathrm{states}}$ | number of states | $6\cdot 10^{8}$ | $6\cdot 10^{8}$ | –
$\beta$ |  | reconciliation
---
efficiency
0,95 | 0,95 | a.u.
$\mathrm{FER}$ |  | frame error rate
---
0,03 | 0,03 | a.u.
$d$ |  | size of the
---
effective
alphabet
$10^{4}$ | $10^{4}$ | bit
$n_{\mathrm{pe}}$ |  | number of signals
---
for parameter
estimation
$6\cdot 10^{7}$ | $6\cdot 10^{7}$ | –
$f_{\mathrm{et}}$ |  | fraction os states
---
for energy tests
0,2 | 0 | a.u.
$w$ |  | confidence
---
6,34 | 14,07 | a.u.
$\varepsilon_{\mathrm{s}}$ |  | smoothness
---
parameter
$10^{-10}$ | $10^{-43}$ | a.u.
$\varepsilon_{\mathrm{h}}$ |  | parameter that determines
---
hash code match
$10^{-10}$ | $10^{-43}$ | a.u.
$\varepsilon$ |  | general security
---
parameter
$5,6\cdot 10^{-9}$ | $1,3\cdot 10^{-9}$ | a.u.

Ensuring the security of the CV-QKD protocol with Gaussian modulation against
coherent attacks, in turn, requires not only a significant limitation on
security criteria, but also an increase in the number of messages to maintain
the proper performance level.

According to the collective attack security criteria set in p. 7.1 (see also
table LABEL:tab:parameters-2), the number of states is $6\cdot 10^{8}$. Each
quantum signal pulse is followed by a reference pulse in such a way that the
total number of quantum signal pulses and reference pulses is $6\cdot 10^{8}$
for each block. For each quantum message, the random number generator
generates 32 bits: 16 bits each to determine the value of each of the
quadratures.

Alice in the process of generating the message writes the package number
without taking into account the reference pulses, using 27 bits for this (5
bits are laid down for redundancy to align the word to 4 bytes), as well as a
4-byte number obtained using a software random number generator implemented on
the basis of the FPGA Alice module. Bob detects both quadratures of each
message received from the channel. Given that half of the states are reference
pulses and two quadrature values are recorded for each state, legitimate users
within each block write down information about $6\cdot 10^{8}$ quantum state
quadrature values. During detection, Bob writes the number of the message
(which accounts for 4 bytes) and 4 bytes of information about the two
registered values of quadratures of quantum messages to high-speed DDR memory,
as well as 4 bytes of information about the two registered values of the
quadratures of the reference pulses.

Information about the registered reference pulse quadratures is used to
compensate for the phase shift of quantum messages as a result of transmission
over a quantum channel, after which this information is deleted from memory.
Every ten states, Bob randomly selects one to be used for channel
characterization (for the parameter estimation procedure). For the remaining
messages, insignificant bits are discarded in the part containing information
about quadratures, as a result of which eight bits remain out of 32 bits of
information. On average, each package has 5.3 bytes of information. The time
taken for detection and storage is 12 seconds.

To evaluate the channel, states are disclosed for which insignificant bits
have not been discarded. After that, errors are corrected using multi-level
encoding and multi-stage decoding [50, 51, 52]. During error correction, three
of the four bits are revealed, thereby reducing the bit sequence to a length
of $5.4\cdot 10^{8}$ bits.

After the error correction is completed, universal hashing is used to
exhaustively verify that all Alice and Bob sequences are the same
(confirmation procedure). Hashing of the key with corrected errors is
performed both in Alice’s and Bob’s blocks. As a result of hashing, users
still have hash codes on their hands. Bob sends the received hash code to
Alice. She then compares the values of two hash codes: the one calculated in
her block and the one received from Bob. The result of the comparison is then
transmitted to him. If the values do not match, then the processing of this
sifted key stops without generating a secret key. The key that has not passed
the confirmation procedure is erased from memory on both sides.

A 2-universal hash function is used at the privacy amplification step. The
input is a key with corrected errors. The corrected key is loaded in blocks.
The ratio of the length of the output sequence after privacy amplification
procedure to the length of the input sequence is 1:66.

Since the post-processing of the sequence is faster than writing information
to memory during detection, these processes can be performed in parallel.

##  8 Conclusion

In this paper, we have carried out a theoretical analysis of the performance
of a realistic CV-QKD system. Our estimates show that performance can be
maintained with losses as low as 10 dB in the most common assumption of
collective attacks. In the presence of coherent attacks, there is a noticeable
drop in allowable losses (down to 7 dB), and at the same time, tougher
security criteria must be taken into account, which are still quite difficult
to satisfy in practice. Further work will be focused on creating an
experimental setup in accordance with what is described in the article and
evaluating the performance of a real system.

## Acknowledgements

The work was done by Leading Research Center ”National Center for Quantum
Internet” of ITMO University by order of JSCo Russian Railways.

## References

  * [1] S. Pirandola, U. L. Andersen, L. Banchi, M. Berta, D. Bunandar, R. Colbeck, D. Englund, T. Gehring, C. Lupo, C. Ottaviani, J. L. Pereira, M. Razavi, J. Shamsul Shaari, M. Tomamichel, V. C. Usenko, G. Vallone, P. Villoresi, and P. Wallden, “Advances in quantum cryptography,” Advances in Optics and Photonics, vol. 12, p. 1012, 12 2020.
  * [2] C. H. Bennett and G. Brassard, “Quantum cryptography: Public key distribution and coin tossing,” Theoretical Computer Science, vol. 560, pp. 7–11, 12 2014.
  * [3] C. H. Bennett, G. Brassard, and N. D. Mermin, “Quantum cryptography without Bell’s theorem,” Physical Review Letters, vol. 68, pp. 557–559, 2 1992\.
  * [4] T. C. Ralph, “Continuous variable quantum cryptography,” Phys. Rev. A, vol. 61, no. 1, p. 010303, 1999.
  * [5] N. J. Cerf, M. Lévy, and G. V. Assche, “Quantum distribution of Gaussian keys using squeezed states,” Physical Review A, vol. 63, p. 052311, 4 2001.
  * [6] F. Grosshans, G. Van Assche, J. Wenger, R. Brouri, N. J. Cerf, and P. Grangier, “Quantum key distribution using gaussian-modulated coherent states,” Nature, vol. 421, pp. 238–241, 1 2003.
  * [7] A. Leverrier, F. Grosshans, and P. Grangier, “Finite-size analysis of a continuous-variable quantum key distribution,” Physical Review A, vol. 81, p. 062343, 6 2010.
  * [8] A. Leverrier, “Composable Security Proof for Continuous-Variable Quantum Key Distribution with Coherent States,” Physical Review Letters, vol. 114, p. 070501, 2 2015.
  * [9] S. Ghorai, P. Grangier, E. Diamanti, and A. Leverrier, “Asymptotic Security of Continuous-Variable Quantum Key Distribution with a Discrete Modulation,” Physical Review X, vol. 9, p. 021059, 6 2019.
  * [10] J. Lin, T. Upadhyaya, and N. Lütkenhaus, “Asymptotic Security Analysis of Discrete-Modulated Continuous-Variable Quantum Key Distribution,” Phys. Rev. X, vol. 9, 12 2019.
  * [11] A. Denys, P. Brown, and A. Leverrier, “Explicit asymptotic secret key rate of continuous-variable quantum key distribution with an arbitrary modulation,” Quantum, vol. 5, p. 540, 9 2021.
  * [12] V. Usenko and R. Filip, “Trusted Noise in Continuous-Variable Quantum Key Distribution: A Threat and a Defense,” Entropy, vol. 18, p. 20, 1 2016\.
  * [13] F. Laudenbach, C. Pacher, C.-H. F. Fung, A. Poppe, M. Peev, B. Schrenk, M. Hentschel, P. Walther, and H. Hübel, “Continuous-Variable Quantum Key Distribution with Gaussian Modulation-The Theory of Practical Implementations,” Advanced Quantum Technologies, vol. 1, p. 1800011, 8 2018.
  * [14] F. Laudenbach and C. Pacher, “Analysis of the Trusted-Device Scenario in Continuous-Variable Quantum Key Distribution,” Advanced Quantum Technologies, vol. 2, p. 1900055, 11 2019.
  * [15] C. Weedbrook, A. M. Lance, W. P. Bowen, T. Symul, T. C. Ralph, and P. K. Lam, “Quantum Cryptography Without Switching,” Physical Review Letters, vol. 93, p. 170504, 10 2004.
  * [16] D. Huang, P. Huang, D. Lin, and G. Zeng, “Long-distance continuous-variable quantum key distribution by controlling excess noise,” Scientific Reports, vol. 6, p. 19201, 5 2016.
  * [17] C. H. Bennett, “Quantum cryptography using any two nonorthogonal states,” Physical Review Letters, vol. 68, pp. 3121–3124, 5 1992.
  * [18] J. Carter and M. N. Wegman, “Universal classes of hash functions,” Journal of Computer and System Sciences, vol. 18, pp. 143–154, 4 1979.
  * [19] V. Scarani, H. Bechmann-Pasquinucci, N. J. Cerf, M. Du\ifmmode \checks\else š\fiek, N. Lütkenhaus, and M. Peev, “The security of practical quantum key distribution,” Reviews of Modern Physics, vol. 81, pp. 1301–1350, 9 2009\.
  * [20] P. Jouguet, S. Kunz-Jacques, E. Diamanti, and A. Leverrier, “Analysis of imperfections in practical continuous-variable quantum key distribution,” Physical Review A, vol. 86, p. 032309, 9 2012.
  * [21] R. Filip, “Continuous-variable quantum key distribution with noisy coherent states,” Physical Review A, vol. 77, p. 22310, 2 2008.
  * [22] V. C. Usenko and R. Filip, “Feasibility of continuous-variable quantum key distribution with noisy coherent states,” Physical Review A, vol. 81, p. 022318, 2 2010.
  * [23] C. Jacobsen, T. Gehring, and U. Andersen, “Continuous Variable Quantum Key Distribution with a Noisy Laser,” Entropy, vol. 17, pp. 4654–4663, 7 2015\.
  * [24] Y. Zhang, Z. Chen, S. Pirandola, X. Wang, C. Zhou, B. Chu, Y. Zhao, B. Xu, S. Yu, and H. Guo, “Long-Distance Continuous-Variable Quantum Key Distribution over 202.81 km of Fiber,” Physical Review Letters, vol. 125, p. 010502, 6 2020.
  * [25] N. Hosseinidehaj, A. M. Lance, T. Symul, N. Walk, and T. C. Ralph, “Finite-size effects in continuous-variable quantum key distribution with Gaussian postselection,” Physical Review A, vol. 101, p. 052335, 5 2020\.
  * [26] P. Jouguet, S. Kunz-Jacques, A. Leverrier, P. Grangier, and E. Diamanti, “Experimental demonstration of long-distance continuous-variable quantum key distribution,” Nature Photonics, vol. 7, no. 5, pp. 378–381, 2013\.
  * [27] G. P. Agrawal, Fiber-optic communication systems, vol. 222.  John Wiley & Sons, 2012.
  * [28] “Polarization Insensitive Isolator (ISO) http://www.lightcomm.com/product/view/typeid/235/id/268.html.”
  * [29] “Polarization Maintaining Fused Standard Coupler (PMC) http://www.lightcomm.com/home/product/view/typeid/189/id/206.html,.”
  * [30] “Intensity Modulators https://photonics.ixblue.com/store/lithium-niobate-electro-optic-modulator/intensity-modulators.”
  * [31] “Phase Modulators https://photonics.ixblue.com/store/lithium-niobate-electro-optic-modulator/phase-modulators,”
  * [32] “Polarization Beam Combiner/Splitter (PBC/PBS) http://www.lightcomm.com/product/view/typeid/190/id/212.html.”
  * [33] “90-Degree Optical Hybrid http://www.optoplex.com/Optical_Hybrid.htm.”
  * [34] “Polarization Maintaining Isolator (PMISO) http://www.lightcomm.com/product/view/typeid/190/id/211.html.”
  * [35] “HIGH SPEED POLARIZATION CONTROLLER-SCRAMBLER (OEM VERSION) https://www.ozoptics.com/ALLNEW_PDF/DTS0143.pdf,.”
  * [36] N. Hosseinidehaj, N. Walk, and T. C. Ralph, “Optimal realistic attacks in continuous-variable quantum key distribution,” Physical Review A, vol. 99, pp. 1–11, 5 2019.
  * [37] S. Pirandola, “Limits and security of free-space quantum communications,” Physical Review Research, vol. 3, p. 013279, 3 2021.
  * [38] S. Pirandola, “Composable security for continuous variable quantum key distribution: Trust levels and practical key rates in wired and wireless networks,” Physical Review Research, vol. 3, p. 043014, 10 2021.
  * [39] B. Qi, P. Lougovski, R. Pooser, W. Grice, and M. Bobrek, “Generating the Local Oscillator “Locally” in Continuous-Variable Quantum Key Distribution Based on Coherent Detection,” Physical Review X, vol. 5, p. 041009, 10 2015.
  * [40] D. B. Soh, C. Brif, P. J. Coles, N. Lütkenhaus, R. M. Camacho, J. Urayama, and M. Sarovar, “Self-referenced continuous-variable quantum key distribution protocol,” Physical Review X, vol. 5, no. 4, pp. 1–15, 2015.
  * [41] S. Kleis, M. Rueckmann, and C. G. Schaeffer, “Continuous variable quantum key distribution with a real local oscillator using simultaneous pilot signals,” Optics Letters, vol. 42, p. 1588, 4 2017.
  * [42] F. Laudenbach, B. Schrenk, C. Pacher, M. Hentschel, C.-H. F. Fung, F. Karinou, A. Poppe, M. Peev, and H. Hübel, “Pilot-assisted intradyne reception for high-speed continuous-variable quantum key distribution with true local oscillator,” Quantum, vol. 3, p. 193, 10 2019.
  * [43] J. Szynowski, “CMRR analysis of instrumentation amplifiers,” Electronics Letters, vol. 19, no. 14, p. 547, 1983.
  * [44] X. Tang, R. Kumar, S. Ren, A. Wonfor, R. Penty, and I. White, “Performance of continuous variable quantum key distribution system at different detector bandwidth,” Optics Communications, vol. 471, p. 126034, 9 2020.
  * [45] I. Devetak and A. Winter, “Distillation of secret key and entanglement from quantum states,” Proceedings of the Royal Society A: Mathematical, Physical and Engineering Sciences, vol. 461, pp. 207–235, 1 2005.
  * [46] M. Tomamichel, R. Colbeck, and R. Renner, “A fully quantum asymptotic equipartition property,” IEEE Transactions on information theory, vol. 55, pp. 5840–5847, 12 2009.
  * [47] M. Tomamichel, C. Schaffner, A. Smith, and R. Renner, “Leftover Hashing Against Quantum Side Information,” IEEE Transactions on Information Theory, vol. 57, pp. 5524–5535, 8 2011.
  * [48] M. Tomamichel, Quantum Information Processing with Finite Resources.  Cham: Springer International Publishing, 2016.
  * [49] A. Leverrier, “Security of Continuous-Variable Quantum Key Distribution via a Gaussian de Finetti Reduction,” Physical Review Letters, vol. 118, p. 200501, 5 2017.
  * [50] G. Van Assche, J. Cardinal, and N. Cerf, “Reconciliation of a Quantum-Distributed Gaussian Key,” IEEE Transactions on Information Theory, vol. 50, pp. 394–400, 2 2004.
  * [51] H. Mani, Error Reconciliation Protocols for Continuous-Variable Quantum Key Distribution.  PhD thesis, Technical University of Denmark, 2021.
  * [52] X. Wen, Q. Li, H. Mao, X. Wen, and N. Chen, “Rotation Based Slice Error Correction Protocol for Continuous-variable Quantum Key Distribution and its Implementation with Polar Codes,” arXiv preprint arXiv:2106.06206, pp. 1–17, 6 2021.


# On a group-theoretical generalization of the Euler’s totient function

Marius Tărnăuceanu

(October 26, 2021)

###### Abstract

Let $G$ be a finite group and $\varphi(G)=|\\{a\in G\mid o(a)=\exp(G)\\}|$,
where $o(a)$ denotes the order of $a$ in $G$ and $\exp(G)$ denotes the
exponent of $G$. Under a natural hypothesis, in this note we determine the
groups $G$ such that $\forall\,H,K\leq G$, $H\subseteq K$ implies
$\varphi(H)\mid\varphi(K)$. This partially answers Problem 5.4 in [6].

MSC 2020 : Primary 20D60, 11A25; Secondary 20D99, 11A99.

Key words : Euler’s totient function, finite group, order of an element,
exponent of a group, nilpotent group, Schmidt group.

##  1 Introduction

Given a finite group $G$, we consider the function

$\varphi(G)=|\\{a\in G\mid o(a)=\exp(G)\\}|$

introduced in our previous paper [6]. Since
$\varphi(\mathbb{Z}_{n})=\varphi(n)$, for all $n\in\mathbb{N}^{*}$, it
generalizes the well-known Euler’s totient function. In [7], the function
$\varphi$ was used to provide a nilpotency criterion for finite groups, namely

$G\mbox{ is nilpotent if and only if }\varphi(S)\neq 0\mbox{ for any section
}S\mbox{ of }G.$

This has been extended to a $p$-nilpotency criterion by A.D. Ramos and A.
Viruel [3]. We recall that the weaker condition

$\varphi(S)\neq 0\mbox{ for any subgroup }S\mbox{ of }G$ (1)

does not guarantee the nilpotency of $G$, as it is shown in [7].

In the current note, we will describe finite groups $G$ such that
$\forall\,H,K\leq G$, $H\subseteq K$ implies $\varphi(H)\mid\varphi(K)$. To
avoid the case in which $\varphi(H)=0$, we will assume the condition (1) to be
satisfied. Thus, we partially answer Problem 5.4 in [6].

Our main result is stated as follows.

######  Theorem 1.1.

Let $G$ be a finite group satisfying the condition (1). Then

$\forall\,H,K\leq G,H\subseteq K\mbox{ implies }\varphi(H)\mid\varphi(K)$ (2)

if and only if $G$ is nilpotent and its Sylow subgroups are cyclic, $Q_{8}$ or
$\mathbb{Z}_{p}\times\mathbb{Z}_{p}$ with $p$ prime.

Next we recall two important classes of finite groups that will be used in our
note:

  * $\bullet$

A generalized quaternion $2$-group is a group of order $2^{n}$ for some
positive integer $n\geq 3$, defined by the presentation

$Q_{2^{n}}=\langle a,b\mid
a^{2^{n-2}}=b^{2},a^{2^{n-1}}=1,b^{-1}ab=a^{-1}\rangle.$

These groups are the unique finite non-cyclic $p$-groups all of whose abelian
subgroups are cyclic, or equivalently the unique finite non-cyclic $p$-groups
possessing exactly one subgroup of order $p$ (see e.g. (4.4) of [5], II).

  * $\bullet$

A Schmidt group is a non-nilpotent group all of whose proper subgroups are
nilpotent. By [4] (see also [1, 2]), such a group $G$ is solvable of order
$p^{m}q^{n}$ (where $p$ and $q$ are different primes) with a unique Sylow
$p$-subgroup $P$ and a cyclic Sylow $q$-subgroup $Q$, and hence $G$ is a
semidirect product of $P$ by $Q$. Moreover, we have:

    * -

if $Q=\langle y\rangle$, then $y^{q}\in Z(G)$;

    * -

$Z(G)=\Phi(G)=\Phi(P)\times\langle y^{q}\rangle$, $G^{\prime}=P$,
$P^{\prime}=(G^{\prime})^{\prime}=\Phi(P)$;

    * -

$|P/P^{\prime}|=p^{r}$, where $r$ is the order of $p$ modulo $q$;

    * -

if $P$ is abelian, then $P$ is an elementary abelian $p$-group of order
$p^{r}$ and $P$ is a minimal normal subgroup of $G$;

    * -

if $P$ is non-abelian, then $Z(P)=P^{\prime}=\Phi(P)$ and $|P/Z(P)|=p^{r}$.

We mention that $G/Z(G)$ is also a Schmidt group of order $p^{r}q$ which can
be written as semidirect product of an elementary abelian $p$-group of order
$p^{r}$ by a cyclic group of order $q$, and that it does not have cyclic
subgroups of order $pq$.

Most of our notation is standard and will not be repeated here. Basic
definitions and results on group theory can be found in [5].

##  2 Proof of Theorem 1.1

First of all, we prove two auxiliary results.

######  Lemma 2.1.

Let $G$ be a finite $p$-group satisfying the condition (2). Then $G$ is
cyclic, $Q_{8}$ or $\mathbb{Z}_{p}\times\mathbb{Z}_{p}$.

###### Proof.

Assume first that $G$ is abelian. If it is not cyclic, then there exists
$H\leq G$ such that $H\cong\mathbb{Z}_{p}^{2}$. Let $K$ be a subgroup of order
$p^{3}$ of $G$ which contains $H$. Then either $K\cong\mathbb{Z}_{p}^{3}$ or
$K\cong\mathbb{Z}_{p}\times\mathbb{Z}_{p}^{2}$. It follows that
$\varphi(H)=p^{2}-1$ divides either $\varphi(\mathbb{Z}_{p}^{3})=p^{3}-1$ or
$\varphi(\mathbb{Z}_{p}\times\mathbb{Z}_{p^{2}})=p^{2}(p-1)$, a contradiction.
Thus such a subgroup $K$ does not exist, showing that either $G$ is cyclic or
$G=H\cong\mathbb{Z}_{p}^{2}$.

Assume now that $G$ is not abelian. Since the condition (2) is inherited by
subgroups, we infer that all abelian subgroups of $G$ are either cyclic or of
type $\mathbb{Z}_{p}^{2}$. Suppose that $G$ has an abelian subgroup
$H\cong\mathbb{Z}_{p}^{2}$. Then $H$ is contained in a subgroup $K$ of order
$p^{3}$ of one of the following types:

  * -

$\mathbb{Z}_{p}^{3}$;

  * -

$\mathbb{Z}_{p}\times\mathbb{Z}_{p^{2}}$;

  * -

$M(p^{3})=\langle x,y\mid x^{p^{2}}=y^{p}=1,y^{-1}xy=x^{p+1}\rangle$;

  * -

$E(p^{3})=\langle x,y\mid x^{p}=y^{p}=[x,y]^{p}=1,[x,y]\in
Z(E(p^{3}))\rangle$;

  * -

$D_{8}$.

It is easy to see that in all cases $\varphi(H)$ does not divide $\varphi(K)$,
contradicting our hypothesis. Consequently, all abelian subgroups of $G$ are
cyclic, implying that $G\cong Q_{2^{n}}$ for some $n\geq 3$. If $n\geq 4$,
then $G$ has a subgroup of type $Q_{8}$ and so

$6=\varphi(Q_{8})\mid\varphi(G)=2^{n-2},$

a contradiction. Hence $G\cong Q_{8}$, as desired. ∎

######  Lemma 2.2.

Let $G$ be a finite group satisfying the conditions (1) and (2). Then $G$ is
nilpotent.

###### Proof.

Assume that $G$ is a counterexample of minimal order. Then all proper
subgroups of $G$ also satisfy the conditions (1) and (2), and therefore $G$ is
a Schmidt group. Suppose that it has the structure described in Introduction.
By Lemma 2.1, we distinguish the following three cases:

  * a)

$P$ is cyclic

Then $\exp(G)=p^{m}q^{n}$ and so the condition $\varphi(G)\neq 0$ implies that
$G$ is cyclic, a contradiction.

  * b)

$P\cong\mathbb{Z}_{p}\times\mathbb{Z}_{p}$ with $p$ prime

Then $Z(G)=\langle y^{q}\rangle$ and $\exp(G)=pq^{n}$. Since $\varphi(G)\neq
0$, there exists a cyclic subgroup $M\leq G$ of order $pq^{n}$. Note that we
have $Z(G)\subset M$. It follows that the Schmidt group $G/Z(G)$ of order
$p^{2}q$ contains the cyclic subgroup $M/Z(G)$ of order $pq$, a contradiction.

  * c)

$P\cong Q_{8}$

We have $|{\rm Aut}(Q_{8})|=24$. Since $G$ is a non-trivial semidirect product
of $Q_{8}$ and $\mathbb{Z}_{q^{n}}$, we get $q=3$ and so $G\cong
Q_{8}\rtimes\mathbb{Z}_{3^{n}}$. Similarly with b), we obtain that the Schmidt
group $G/Z(G)\cong A_{4}$ has a cyclic subgroup of order $6$, a contradiction.

Hence such a group $G$ does not exist, as desired. ∎

We are now able to prove our main result.

Proof of Theorem 1.1. The direct implication follows from Lemmas 2.1 and 2.2.
Conversely, we observe that it suffices to prove the condition (2) for cyclic
$p$-groups, $Q_{8}$ or $\mathbb{Z}_{p}\times\mathbb{Z}_{p}$ with $p$ prime
because a nilpotent group is the direct product of its Sylow subgroups. This
is obvious, completing the proof.∎

## References

  * [1] A. Ballester-Bolinches, R. Esteban-Romero and D.J.S. Robinson, On finite minimal non-nilpotent groups, Proc. Amer. Math. Soc. 133 (2015), 3455-3462.
  * [2] V.S. Monakhov, The Schmidt subgroups, its existence, and some of their applications, Ukraini. Mat. Congr. 2001, Kiev, 2002, Section 1, 81-90.
  * [3] A.D. Ramos and A. Viruel, A $p$-nilpotency criterion for finite groups, Acta Math. Hung. 157 (2019), 154-157.
  * [4] O.Yu. Schmidt, Groups whose all subgroups are special, Mat. Sb. 31 (1924), 366-372.
  * [5] M. Suzuki, Group theory, I, II, Springer Verlag, Berlin, 1982, 1986.
  * [6] M. Tărnăuceanu, A generalization of the Euler’s totient function, Asian-Eur. J. Math. 8 (2015), article ID 1550087.
  * [7] M. Tărnăuceanu, A nilpotency criterion for finite groups, Acta Math. Hung. 155 (2018), 499-501.

Marius Tărnăuceanu

Faculty of Mathematics

“Al.I. Cuza” University

Iaşi, Romania

e-mail<EMAIL_ADDRESS>