Quantum key distribution provides secure keys with information-theoretic security ensured by the principle of quantum mechanics. The continuous-variable version of quantum key distribution using coherent states offers the advantages of its compatibility with telecom industry, e.g., using commercial laser and homodyne detector, is now going through a booming period. In this review article, we describe the principle of continuous-variable quantum key distribution system; focus on protocols based on coherent states, whose systems are gradually moving from proof-of-principle lab demonstrations to in-field implementations and technological prototypes. We start by reviewing the theoretical protocols and the current security status of these protocols. Then, we discuss the system structure, the key module, and the mainstream system implementations. The advanced progresses for future applications are discussed, including the digital techniques, system on chip, and point-to-multipoint system. Finally, we discuss the practical security of the system and conclude with promising perspectives in this research field.

## I. INTRODUCTION

Since 1984, quantum key distribution (QKD)^{1} has ushered in an era of secure communications using quantum methods by providing information-theoretic secure key distribution.^{2–8} The combination of this method with one-time-pad encryption provides the ultimate protection for the transmission of confidential messages. In general, for simplified implementations, QKD protocols are formulated in a prepare-and-measure (PM) fashion, where the classical information is encoded on non-orthogonal quantum states: they are randomly prepared by Alice (the sender) and then transmitted to Bob (the receiver) through an insecure quantum channel. At the output of the channel, the states are measured by Bob to retrieve the encoded classical information. The quantum no-cloning theorem dictates that an unknown quantum state cannot be reliably cloned,^{9} ensuring long-term security based on physical principles^{10} against unlimited computational power.

So far, various QKD protocols with discrete variables have been proposed to support the long-distance and practical-secure system implementations,^{1,2,11–28} including the decoy states experiments,^{29–42} the measurement-device-independent (MDI) experiments,^{43–59} the twin-field experiments,^{60–69} the system on chip,^{59,70–75} and so on.^{76–86} Specifically, the twin-field QKD with a 3-station scheme has significantly promoted the development of the long-distance QKD, where the total distance can break the Pirandola, Laurenza, Ottaviani, and Banchi (PLOB) bound.^{87} These achievements have resulted in the long-haul point-to-point connection up to 1000 km,^{69} high-speed metropolitan system,^{88–92} and field deployed QKD network,^{93–97} even with satellite-to-ground links.^{98–103} Furthermore, it is worth noting a distinct category of protocols where the information is encoded on the quadrature of light that is continuous-variable (CV). The use of such continuous-variable quantum information carriers, instead of qubits, constitutes a potent and alternative approach for QKD^{104–112} and more broadly, for quantum information processing.^{108,110,113–120}

Continuous-variable QKD (CV-QKD) using coherent states^{106,107} is now currently experiencing a booming period due to its compatibility with telecom industry, e.g., using commercial continuous-wave laser and coherent receiver. This potential has led to significant advancements in CV-QKD, including the protocol design, security analysis, and system implementation (see Fig. 1). The security of CV-QKD protocol using Gaussian-modulated coherent states was initially proved under asymptotic conditions,^{121,122} and later extended to the finite-size regime with universal composability against collective attack,^{123} and general attacks by exploiting Gaussian de Finetti theorem.^{124} In addition to continuous modulation, the discrete modulation of coherent states has also been well investigated.^{125–129} Along with the improving security proof, the implementation of CV-QKD system has progressed from the initial proof-of-principle demonstration to the second stage with swift advancements in high performance and system robustness. Currently, it has entered the third stage where a modern architecture is evolving with the benefit of being fully compatible with classical optical coherent communication.

During the initial phase of the CV-QKD system, the primary challenge was to overcome the 3 dB limit, which was solved by the reverse reconciliation.^{130} Subsequently, the CV-QKD system progressed toward allowing long-distance transmission to facilitate two-user interconnection across a wide range without a trusted relay. Developments of the reconciliation resulted in enhanced error correction capability even with an extremely low signal-to-noise ratio (SNR),^{131} which played a significant role in the long-distance system covering a distance from 25 (Ref. 132) up to 80 km.^{133} At this stage, both the quantum signal and local oscillator (LO) are generated by the same laser of transmitter and co-propagated in the quantum channel, known as the in-line LO system, which contributes to the suppression of phase noise when the quantum signal and LO interfere for coherent detection. However, a significant challenge toward achieving long-distance and stable transmission is to reduce crosstalk between the strong LO and the weak quantum signal. The most effective current approach is using pulsed signals with high extinction ratio, then combining polarization multiplexing and time-division multiplexing (TDM).^{133–139} This methodology has resulted in the longest lab experiment over 202 km,^{139} the longest field test of 50 km,^{137} the long-term test of a 3-node CV-QKD network in Qingdao, China,^{140} and the first chip-based system.^{138}

In 2015, an alternative scheme was proposed, which relaxed the requirement of the extremely high isolation by generating LO inside the receiver and using a pilot assisted phase recovery to suppress the phase noise introduced by the different laser source.^{141,142} As the pilot signal has significantly lower power compared to the LO, the high-extinction pulse generation for time-division multiplexing is no longer required. Instead, frequency-division multiplexing (FDM) is widely used, which simplifies the signal generation, and sometimes can be combined with polarization multiplexing for better isolation. For higher secret key rate (SKR) and better phase recovery, the repetition rate of the system is gradually enhanced, where digital techniques in classical optical communication systems, such as the pulse shaping and matched filter, are introduced to overcome the limited bandwidth (BW) of devices. Further, more and more digital algorithms for a CV-QKD system are developed, including the de-multiplexing, impairment compensation, synchronization etc., which then drive the innovation in system architecture. To date, the local LO scheme contributes to the high-speed system with the repetition rate of 5 Gbaud, resulting in 190 Mbps secret key rate at 5 km,^{143} as well as a flexible network deployment, which has been demonstrated by the software-defined CV-QKD network in Madrid, Spain.^{144}

The use of digital techniques from classical communications has significantly advanced the development of CV-QKD systems, allowing for the completion of most operations in digital domain, and resulting in a system compatible with classical optical communication in the aspect of both architectures and algorithms.^{145} Meanwhile, the advanced progresses of the homodyne detector integrated on chip have shown the potential of a compact system with high-performance, where the baud rate of the system using chip-based homodyne detector can reach 10 Gbaud.^{146} Additionally, the implementation of a high-rate downstream point-to-multipoint CV-QKD network can facilitate large-scale deployments, enabling multi-user access with low-cost devices and simplified network structures.^{147}

An overview of the typical CV-QKD systems, key techniques, and application scenarios is presented in Fig. 2. These typical system achievements, supported by the advanced reconciliation, digital signal processing (DSP) and chip-based devices have proved that the CV-QKD system is suitable for the metropolitan network and access network, as well as the free space communication and co-existing with the classical optical networks. With these advanced techniques, a large-scale cost-effective QKD network supported by advanced CV-QKD systems is on the way.

In all this panorama, the present review aims to providing an overview of the most important results and the most recent advances in the field of CV-QKD system. After a brief introduction of the general notions, we review the main CV-QKD protocols and security analysis in Sec. II. The system structure and key modules are reviewed in Sec. III, and the typical currently achievable implementations are detailed in Sec. IV, including the in-line LO systems, local LO systems, systems co-existing with classical networks, and so on. We then discuss the advanced progress in future applications, such as the digital continuous-variable system and point-to-multipoint network, in Sec. V. Finally, we will discuss the practical security of the system in Sec. VI and conclude with promising perspectives in this research field in Sec. VII.

## II. CV-QKD PROTOCOL AND SECURITY PROOF

The CV-QKD system relies on a protocol to establish the system's operating procedures, where the security of the protocol is determined by security proof. In this section, we introduce the basic notions, the CV-QKD protocols, and security analysis.

### A. Basic notions of continuous-variable systems

*n*modes in the Hilbert space $ H = \u2297 i = 1 n H i$, there are

*n*pairs of annihilation and creation operators $ { a \u0302 i , a \u0302 i \u2020}$ with $ i = 1 , 2 , \u2026 , n$, which satisfies

*n*-mode vector $ r \u0302 = ( x \u0302 1 , p \u0302 1 , x \u0302 2 , p \u0302 2 , \u2026 , x \u0302 n , p \u0302 n ) T$. Using the standard bosonic canonical commutation relations as well as Eqs. (1) and (2), we can easily get

_{ik}is the generic element of Ω.

*ρ*is a general density operator. Since a state is Gaussian if its Wigner function is Gaussian, it is completely characterized by the first two statistical moments, the mean value

*d*, and the covariance matrix

*γ*.

^{148}

The most common single-mode Gaussian states include vacuum state, coherent states, and squeezed states. The vacuum state is centered at the origin of the phase space and the covariance matrix is an identity matrix. The coherent states are the displaced vacuum state with non-zero displacement vectors $ d = ( d x , d p )$. Thus, the covariance matrices of the coherent states are also identity matrices. The squeezed states can be obtained by squeezing coherent states at one of the two quadratures. Suppose the states are squeezed on *x* quadrature, the conjugate *p* quadrature is anti-squeezed.

^{149}of which the covariance matrix reads

*r*is the squeezed ratio, and

*V*is called the variance of the EPR state. In particular, performing homodyne detection on one of the modes of an EPR state results in the other mode being projected on a squeezed state, while performing heterodyne detection on one of the modes of an EPR state results in the other mode being projected on a coherent state,

^{150}as shown in Fig. 3.

### B. A historical outline of CV-QKD protocols and the current security status

The first CV-QKD protocol was proposed in 1999, using squeezed states to achieve secret key distribution.^{104} However, due to the challenges in preparing squeezed states, a protocol of using coherent states and homodyne detection to distribute secret key was proposed in 2002,^{106} namely, the GG02 protocol. Because the coherent states can be easily generated by a laser, this protocol has received an increasing attention in recent years. Subsequently, the protocol based on Gaussian modulated coherent states got further developments. The no-switching protocol was reported in 2004,^{107} in which the heterodyne detection instead of homodyne detection was used. In 2009, heterodyne detection was also utilized in the Gaussian modulated squeezed-state protocol and an improvement of performance was found.^{161}

Although Gaussian modulated CV-QKD protocols have undergone extensive studies and developments, there remain technical challenges to implementing ideal Gaussian modulation in experiments. Therefore, discrete modulated CV-QKD protocol^{158} was proposed. The initial discrete modulated CV protocol is the four-state modulation protocol, where a modulation method similar to quadrature phase shift keying (QPSK) in classical communications was used. Soon afterward, Leverrier^{186} highlighted that CV protocols can be used for secret key distribution with multi-dimensional discrete modulation. In addition to discrete modulation, other modulation methods are also considered, including unidimensional modulation.^{159} It simplifies the modulation process at the Alice side can be compared with the GG02 protocol when the excess noise is small. Recently, a phase-sensitive multimode protocol is proposed, which achieves higher secret key rate and better excess noise tolerance.^{187} Most of the theoretical analysis of the CV-QKD protocols are based on fiber channels, and recently, the study is extended to the free space scenario for considerations of satellite quantum communications.^{188}

Generally, the classification of standard one-way CV-QKD protocols, in which the quantum state passes through a single channel, can follow the type of the used quantum states (coherent or squeezed), the methods of modulation (Gaussian modulation, unidimensional modulation, or discrete modulation) or the type of measurement (homodyne or heterodyne). In addition to the one-way protocols, various other protocols correspond to different application scenarios are proposed, such as two-way protocols, source-device-independent (SDI) protocols, MDI protocols, and so forth (Table I).^{189}

Protocol . | State . | Modulation . | Measurement . | Best current-available security proof . |
---|---|---|---|---|

Grosshans and Grangier^{106} | Coherent | Gaussian | Homodyne | Asymptotic collective^{151} Finite-size collective ^{152–154} |

Weedbrook et al.^{107} | Coherent | Gaussian | Heterodyne | Finite-size^{123,124,152–154} |

$ K coll \u2009 \epsilon ( N ) \u2248 K coll asympt \u2009 \u2009 for \u2009 practical \u2009 N$ | ||||

$ K \epsilon ( N ) = 0 \u2009 for \u2009 practical \u2009 N$^{155} | ||||

Cerf et al.^{105} | Squeezed | Gaussian | Homodyne | Finite-size^{156,157} |

$ K \epsilon ( N ) > 0$ for practical N | ||||

$ lim N \u2192 \u221e K \epsilon ( N ) < K coll \u2009 asympt$ | ||||

Leverrier and Grangier^{158} | Coherent | QPSK | Homodyne | Asymptotic collective with linear assumption^{158} |

Li et al.^{125} | Coherent | QPSK, arbitrary | Homo/heterodyne | Asymptotic collective^{125} |

Ghorai et al.^{126} | Coherent | QPSK, arbitrary^{128} | Homo/heterodyne | Asymptotic collective^{126,128} |

Lin et al.^{127} | Coherent | QPSK | Homo/heterodyne | Asymptotic collective^{127} |

Usenko and Grosshans^{159} | Coherent | Gaussian 1D | Homodyne | Finite-size collective^{160} |

García-Patrón and Cerf^{161} | Squeezed | Gaussian | Heterodyne | Asymptotic collective^{161} |

Filip^{162,163} | Thermal | Gaussian | Homo/heterodyne | Asymptotic collective^{164} |

Fiurášek and Cerf^{165} Walk et al.^{166} | Coherent | Gaussian | Homo/heterodyne + Gaussian post-selection | Asymptotic collective^{165–167} |

Li et al.^{168} | Coherent | Gaussian + Non-Gaussian Post-selection | Homo/heterodyne | Asymptotic collective^{168} |

Madsen et al.^{169} | Squeezed | Gaussian + Additional Gaussian | Homodyne | Asymptotic collective^{169} |

Protocol . | State . | Modulation . | Measurement . | Best current-available security proof . |
---|---|---|---|---|

Grosshans and Grangier^{106} | Coherent | Gaussian | Homodyne | Asymptotic collective^{151} Finite-size collective ^{152–154} |

Weedbrook et al.^{107} | Coherent | Gaussian | Heterodyne | Finite-size^{123,124,152–154} |

$ K coll \u2009 \epsilon ( N ) \u2248 K coll asympt \u2009 \u2009 for \u2009 practical \u2009 N$ | ||||

$ K \epsilon ( N ) = 0 \u2009 for \u2009 practical \u2009 N$^{155} | ||||

Cerf et al.^{105} | Squeezed | Gaussian | Homodyne | Finite-size^{156,157} |

$ K \epsilon ( N ) > 0$ for practical N | ||||

$ lim N \u2192 \u221e K \epsilon ( N ) < K coll \u2009 asympt$ | ||||

Leverrier and Grangier^{158} | Coherent | QPSK | Homodyne | Asymptotic collective with linear assumption^{158} |

Li et al.^{125} | Coherent | QPSK, arbitrary | Homo/heterodyne | Asymptotic collective^{125} |

Ghorai et al.^{126} | Coherent | QPSK, arbitrary^{128} | Homo/heterodyne | Asymptotic collective^{126,128} |

Lin et al.^{127} | Coherent | QPSK | Homo/heterodyne | Asymptotic collective^{127} |

Usenko and Grosshans^{159} | Coherent | Gaussian 1D | Homodyne | Finite-size collective^{160} |

García-Patrón and Cerf^{161} | Squeezed | Gaussian | Heterodyne | Asymptotic collective^{161} |

Filip^{162,163} | Thermal | Gaussian | Homo/heterodyne | Asymptotic collective^{164} |

Fiurášek and Cerf^{165} Walk et al.^{166} | Coherent | Gaussian | Homo/heterodyne + Gaussian post-selection | Asymptotic collective^{165–167} |

Li et al.^{168} | Coherent | Gaussian + Non-Gaussian Post-selection | Homo/heterodyne | Asymptotic collective^{168} |

Madsen et al.^{169} | Squeezed | Gaussian + Additional Gaussian | Homodyne | Asymptotic collective^{169} |

In 2008, the original two-way protocol was proposed,^{170} in which an optical switch was used to randomly switch between two working statuses “ON” or “OFF.” The tolerable noise on ON mode is higher than that of one-way protocol. However, the use of optical switches cannot meet the demand for high-speed quantum key distribution. Subsequently in 2012, an improved two-way protocol was reported,^{172} in which Alice uses a Gaussian modulated coherent state and a beam splitter to replace the ON–OFF switch and translation operation in the original two-way protocol. Very recently, the protocol is proved to be secure in the finite-size regime.^{171} In addition, the unidimensional two-way CV-QKD protocol is proposed to simplify the system realization and is proved to be secure against collective attack.^{190}

It should be noted, however, that the one-way and two-way protocols can be considered theoretically secure only with the trustworthy equipment. The issue of practical security remains a major concern due to the possible mismatch between practical devices and theoretical assumptions. An optimal solution would be a device-independent protocol, in which system security is not influenced by the trustworthiness of the devices. However, since achieving comprehensive device independence is challenging, semi-device-independence protocols have been developed and well-studied, including the MDI protocols^{176,177} and the source-device-independent (SDI) protocols.^{191} These protocols eliminate certain assumptions regarding the reliability of the devices and, thus, close the corresponding security loopholes.

The CV-MDI QKD was independently proposed by Li *et al.*^{176} and Pirandola *et al.*,^{177} in which Alice and Bob are both senders, preparing coherent states and sending them through two independent channels to the untrusted party, Charlie, to perform Bell-state measurement. Note that there are no assumptions about the trustworthiness on Charlie, which implies that Eve can have complete control over Charlie, and it can withstand all attacks that are based on detector's loopholes. However, the CV-MDI QKD protocol has a limited transmission distance which restricts the long-haul deployment. In 2019, the discrete modulation is used for CV-MDI QKD,^{184} whose secret key rate correspondingly decreases but can still guarantee its security against collective attack. The unidimensional CV-MDI QKD protocol was also proposed,^{182,183} in which more cases are considered in Ref. 182, while the finite-size effect is involved in Ref. 183. The security of the CV-MDI protocol under the source intensity errors is also investigated.^{192} Here, the current security proofs status of the two-way protocols and the MDI protocols are revealed in Table II.

Protocol . | Alice's side . | Bob's side . | Measurement . | Best currently available . | ||
---|---|---|---|---|---|---|

State . | Modulation . | State . | Modulation . | Security proofs . | ||

Pirandola et al.^{170} | Coherent | Gaussian | Coherent | Gaussian | Homo/heterodyne | Finite-size^{171} |

Sun et al.^{172} | Coherent | Gaussian | Coherent | Gaussian | Homo/heterodyne | Asymptotic^{172} |

Zhao et al.^{173} | Coherent | Gaussian + non-Gaussian post-selection | Coherent | Gaussian + non-Gaussian post-selection | Homodyne | Asymptotic collective^{173} |

Li et al.^{174} | Coherent | Gaussian | Coherent | Gaussian | Homo/heterodyne + Gaussian post-selection | Asymptotic collective |

Bian et al.^{175} | Coherent | Gaussian 1D | Coherent | Gaussian | Homodyne | Asymptotic collective^{175} |

Li et al.^{176} | Coherent | Gaussian | Coherent | Gaussian | Bell-state measurement | Finite-size^{178,179} |

$ K \epsilon ( N ) > 0$ for practical N | ||||||

Pirandola et al.^{177} | $ lim N \u2192 \u221e K \epsilon ( N ) < K coll \u2009 asympt$ | |||||

Zhang et al.^{180} | Squeezed | Gaussian | Squeezed | Gaussian | Bell-state measurement | Finite-size^{181} $ K \epsilon ( N ) > 0$ for practical N $ lim N \u2192 \u221e K \epsilon ( N ) < K coll \u2009 asympt$ |

Huang et al.^{182} | Coherent | Gaussian 1D | Coherent | Gaussian 1D | Bell-state measurement | Asymptotic collective^{182,183} |

Ma et al.^{184} | Coherent | QPSK | Coherent | QPSK | Bell-state measurement | Asymptotic collective^{184} |

Zhao et al.^{185} | Coherent | Gaussian + non-Gaussian post-selection | Coherent | Gaussian + non-Gaussian post-selection | Bell-state measurement | Asymptotic collective^{185} |

Protocol . | Alice's side . | Bob's side . | Measurement . | Best currently available . | ||
---|---|---|---|---|---|---|

State . | Modulation . | State . | Modulation . | Security proofs . | ||

Pirandola et al.^{170} | Coherent | Gaussian | Coherent | Gaussian | Homo/heterodyne | Finite-size^{171} |

Sun et al.^{172} | Coherent | Gaussian | Coherent | Gaussian | Homo/heterodyne | Asymptotic^{172} |

Zhao et al.^{173} | Coherent | Gaussian + non-Gaussian post-selection | Coherent | Gaussian + non-Gaussian post-selection | Homodyne | Asymptotic collective^{173} |

Li et al.^{174} | Coherent | Gaussian | Coherent | Gaussian | Homo/heterodyne + Gaussian post-selection | Asymptotic collective |

Bian et al.^{175} | Coherent | Gaussian 1D | Coherent | Gaussian | Homodyne | Asymptotic collective^{175} |

Li et al.^{176} | Coherent | Gaussian | Coherent | Gaussian | Bell-state measurement | Finite-size^{178,179} |

$ K \epsilon ( N ) > 0$ for practical N | ||||||

Pirandola et al.^{177} | $ lim N \u2192 \u221e K \epsilon ( N ) < K coll \u2009 asympt$ | |||||

Zhang et al.^{180} | Squeezed | Gaussian | Squeezed | Gaussian | Bell-state measurement | Finite-size^{181} $ K \epsilon ( N ) > 0$ for practical N $ lim N \u2192 \u221e K \epsilon ( N ) < K coll \u2009 asympt$ |

Huang et al.^{182} | Coherent | Gaussian 1D | Coherent | Gaussian 1D | Bell-state measurement | Asymptotic collective^{182,183} |

Ma et al.^{184} | Coherent | QPSK | Coherent | QPSK | Bell-state measurement | Asymptotic collective^{184} |

Zhao et al.^{185} | Coherent | Gaussian + non-Gaussian post-selection | Coherent | Gaussian + non-Gaussian post-selection | Bell-state measurement | Asymptotic collective^{185} |

Another semi-device-independent protocol, known as the SDI protocol, has also undergone development in addition to the MDI protocol. The CV-SDI QKD protocol was initially proposed in 2013 and has been demonstrated to be resistant to collective attacks.^{191} Furthermore, Zhang *et al.* supplemented the security proof in 2020.^{193} Similar to the CV-MDI QKD, the CV-SDI QKD protocol does not make any assumptions about the source's credibility. In this protocol, an entanglement source is positioned between Alice and Bob as both Alice and Bob are receivers. In addition, there are also some special CV-QKD protocols such as using a thermal state as the source, so-called the passive protocol.^{194}

As shown in Fig. 4, ideal CV-QKD protocols are closer to the theoretical limit, known as the PLOB bound,^{87} which shows the potential of achieving high secret key rate and long transmission distance using CV-QKD. Yet/However, we have to remark that, there is still a gap between the optimal parameters of the existing CV-QKD protocols for practical and ideal situations, where the reconciliation efficiency is normally less than 100% and the optimal modulation variance is limited to less than 5. Therefore, the performance in a practical CV-QKD system still has room to be improved, and more CV-QKD protocols are expected to be proposed for further approaching the theoretical limit.

### C. Security analysis

Before starting the security analysis, it is essential to introduce two equivalent schemes, namely, the prepare-and-measurement (PM) scheme and the entanglement-based (EB) scheme, as shown in Fig. 5. These schemes differ mainly in the method of preparing quantum states. In the PM scheme, Alice generates the states with a light resource, usually a laser, whereas in the EB scheme, Alice generates EPR states. As homodyne (heterodyne) detection performed on one mode of the EPR state has the effect of projecting the other mode onto a squeezed (coherent) state, the transmitter's outputs of both methods are identical for the third party. Therefore, both schemes are equivalent to Bob and Eve, which is an important property.

It is important to note that although both schemes are equivalent, they are used in different application scenarios. For instance, the PM scheme is used for experimental implementation, whereas the EB scheme is used for theoretical analysis due to its ease of calculation. Our analysis is based on the EB scheme in the following part.

Reconciliation is the key technique to make Alice and Bob share a same bit string, which can be categorized into two types, the direct reconciliation and the reverse reconciliation.^{195} In direct reconciliation, the detection data are corrected to the modulation data, however, the tolerable channel loss is limited under 3 dB. Reverse reconciliation is proposed to solve this issue, by correcting the modulation data to the detection data.

In the aspect of an eavesdropper, the attack strategy can be categorized into three types, individual attack, collective attack and coherent attack. In individual attack, Eve manipulates and measures the transmitted states independently and identically. In collective attack, Eve manipulates the transmitted states independently and identically but measures them jointly. While for coherent attack, Eve manipulates and measures the transmitted states jointly. Usually, coherent attack is the strongest one, while in asymptotic case the collective attack is normally the most powerful coherent attack.

#### 1. Gaussian-modulated protocol

The protocols based on Gaussian modulation are the most fundamental among all CV-QKD protocols, which are usually categorized into four types based on types of quantum states (coherent or squeezed) and detection methods (homodyne or heterodyne). So far, the protocols based on Gaussian modulated coherent states, which can be generated by the off-the-shelf laser, have received much attention. Therefore, we detail the security analysis of the Gaussian-modulated coherent state protocol, and briefly introduce the squeezed-state protocol.

^{196}

*I*is the classical mutual information between Alice and Bob, that can be easily estimated, normally written as

_{AB}*V*is the variance of EPR state owned by Alice,

*V*is the variance of the state Bob receives, $ V A | B$ is the conditional variance given Bob's measurement result. $ \chi line = 1 / T \u2212 1 + \epsilon $ is the total channel-added noise expressed in shot noise units (SNUs), relevant to the channel parameters, including the transmittance (

_{B}*T*) and excess noise (

*ε*).

^{197}Since mainstream CV-QKD implementations use reverse reconciliation, where the modulation data are corrected to the detection data, the quantum mutual information between Bob and Eve,

*S*, is the concern.

_{BE}^{198}

*ρ*, and $ S ( E | m B )$ is von Neumann entropy conditional on Bob's measurement result and is determined by the detection method. Based on the fact that the eavesdropper Eve is able to purify the binary quantum system

_{E}*ρ*, Eq. (12) becomes

_{AB}*χ*, usually we use the Gaussian extremity theorem to find its upper bound,

_{BE}^{199}corresponding to the lower bound of the secret key rate. This means there always exists a Gaussian state $ \rho A B G$ with the same covariance matrix as

*ρ*who makes

_{AB}*γ*and $ \gamma A B | m B$, respectively, corresponding to the states

_{AB}*ρ*and $ \rho A B | m B$. Covariance matrix

_{AB}*γ*can be estimated from the modulation and detection data

_{AB}*H*is the symplectic matrix on behalf of the measurement operation on mode

*B*, and can be written, respectively,

*p*quadrature, we use $ P = ( 0 0 0 1 ) )$, and

*MP*represents for the Moore–Penrose pseudo-inverse of a matrix. Notice that

*γ*,

_{A}*γ*, and

_{B}*σ*are the subsmatrices of the covariance matrix

_{AB}*γ*as detailed in Eq. (15).

_{AB}*γ*can be achieved by calculating the eigenvalues of $ i \Omega \gamma $. For the two-mode system, one can easily achieve the analytical solution, as detailed in Table III, where $ S ( \rho A B G )$ can be calculated with $ \lambda 1 , 2$, and $ S ( \rho A B | m B G )$ can be calculated with

*λ*

_{7}for homodyne detection and

*λ*

_{12}for heterodyne detection

States . | Measurement . | I
. _{AB} | Eigenvalues of the covariance matrix before measurement . | Type of reconciliation . | Eigenvalues of the covariance matrix after measurement . | $ \chi B E$ . |
---|---|---|---|---|---|---|

Squeezed | Homodyne | $ 1 2 \u2009 log 2 V + \chi \chi + 1 / V$ | $ \lambda 1 , 2 = 1 2 [ \Delta \xb1 \Delta 2 \u2212 4 D 2 ]$ | Direct | $ \lambda 3 = T 2 ( V + \chi ) ( \chi + 1 / V )$ | $ \u2211 i = 1 2 G ( \lambda i ) \u2212 G ( \lambda 3 )$ |

Reverse | $ \lambda 4 = V ( V \chi + 1 ) ( \chi + V )$ | $ \u2211 i = 1 2 G ( \lambda i ) \u2212 G ( \lambda 4 )$ | ||||

Coherent | Homodyne | $ 1 2 \u2009 log 2 V + \chi \chi + 1$ | Direct | $ \lambda 5 , 6 = 1 2 [ A \xb1 A 2 \u2212 4 B ]$ | $ \u2211 i = 1 2 G ( \lambda i ) \u2212 \u2211 i = 5 6 G ( \lambda i )$ | |

Reverse | $ \lambda 7 = \lambda 4 = V ( V \chi + 1 ) ( \chi + V )$ | $ \u2211 i = 1 2 G ( \lambda i ) \u2212 G ( \lambda 7 )$ | ||||

Squeezed | Heterodyne | $ 1 2 \u2009 log 2 T ( V + \chi ) + 1 T ( \chi + 1 / V ) + 1$ | Direct | $ \lambda 8 = \lambda 3 = T 2 ( V + \chi ) ( \chi + 1 / V )$ | $ \u2211 i = 1 2 G ( \lambda i ) \u2212 G ( \lambda 8 )$ | |

Reverse | $ \lambda 9 , 10 = 1 2 [ A \u2032 \xb1 A \u2032 2 \u2212 4 B \u2032 ]$ | $ \u2211 i = 1 2 G ( \lambda i ) \u2212 \u2211 i = 9 10 G ( \lambda i )$ | ||||

Coherent | Heterodyne | $ \u2009 log 2 T ( V + \chi ) + 1 T ( \chi + 1 ) + 1$ | Direct | $ \lambda 11 = T ( \chi + 1 )$ | $ \u2211 i = 1 2 G ( \lambda i ) \u2212 G ( \lambda 11 )$ | |

Reverse | $ \lambda 12 = T ( V \chi + 1 ) + 1 T ( V + \chi ) + 1$ | $ \u2211 i = 1 2 G ( \lambda i ) \u2212 G ( \lambda 12 )$ | ||||

Notice | $ ( a \u2009 I 2 c \u2009 \sigma z c \u2009 \sigma z b \u2009 I 2 ) = ( V \u2009 I 2 T ( V 2 \u2212 1 ) \u2009 \sigma z T ( V 2 \u2212 1 ) \u2009 \sigma z T ( V + \chi ) \u2009 I 2 ) , \Delta = a 2 + b 2 \u2212 2 c 2 , D = a b \u2212 c 2 , A = 1 a + 1 ( a + b D + \Delta ) , A \u2032 = 1 b + 1 ( b + a D + \Delta ) , B = D a + 1 ( b + D )$, $ B \u2032 = D b + 1 ( a + D ) , G ( x ) = x + 1 2 \u2009 log 2 x + 1 2 \u2212 x \u2212 1 2 \u2009 log 2 x \u2212 1 2$, V is the variance of the EPR state which is also written as V when representing the variance of mode _{A}V. |

States . | Measurement . | I
. _{AB} | Eigenvalues of the covariance matrix before measurement . | Type of reconciliation . | Eigenvalues of the covariance matrix after measurement . | $ \chi B E$ . |
---|---|---|---|---|---|---|

Squeezed | Homodyne | $ 1 2 \u2009 log 2 V + \chi \chi + 1 / V$ | $ \lambda 1 , 2 = 1 2 [ \Delta \xb1 \Delta 2 \u2212 4 D 2 ]$ | Direct | $ \lambda 3 = T 2 ( V + \chi ) ( \chi + 1 / V )$ | $ \u2211 i = 1 2 G ( \lambda i ) \u2212 G ( \lambda 3 )$ |

Reverse | $ \lambda 4 = V ( V \chi + 1 ) ( \chi + V )$ | $ \u2211 i = 1 2 G ( \lambda i ) \u2212 G ( \lambda 4 )$ | ||||

Coherent | Homodyne | $ 1 2 \u2009 log 2 V + \chi \chi + 1$ | Direct | $ \lambda 5 , 6 = 1 2 [ A \xb1 A 2 \u2212 4 B ]$ | $ \u2211 i = 1 2 G ( \lambda i ) \u2212 \u2211 i = 5 6 G ( \lambda i )$ | |

Reverse | $ \lambda 7 = \lambda 4 = V ( V \chi + 1 ) ( \chi + V )$ | $ \u2211 i = 1 2 G ( \lambda i ) \u2212 G ( \lambda 7 )$ | ||||

Squeezed | Heterodyne | $ 1 2 \u2009 log 2 T ( V + \chi ) + 1 T ( \chi + 1 / V ) + 1$ | Direct | $ \lambda 8 = \lambda 3 = T 2 ( V + \chi ) ( \chi + 1 / V )$ | $ \u2211 i = 1 2 G ( \lambda i ) \u2212 G ( \lambda 8 )$ | |

Reverse | $ \lambda 9 , 10 = 1 2 [ A \u2032 \xb1 A \u2032 2 \u2212 4 B \u2032 ]$ | $ \u2211 i = 1 2 G ( \lambda i ) \u2212 \u2211 i = 9 10 G ( \lambda i )$ | ||||

Coherent | Heterodyne | $ \u2009 log 2 T ( V + \chi ) + 1 T ( \chi + 1 ) + 1$ | Direct | $ \lambda 11 = T ( \chi + 1 )$ | $ \u2211 i = 1 2 G ( \lambda i ) \u2212 G ( \lambda 11 )$ | |

Reverse | $ \lambda 12 = T ( V \chi + 1 ) + 1 T ( V + \chi ) + 1$ | $ \u2211 i = 1 2 G ( \lambda i ) \u2212 G ( \lambda 12 )$ | ||||

Notice | $ ( a \u2009 I 2 c \u2009 \sigma z c \u2009 \sigma z b \u2009 I 2 ) = ( V \u2009 I 2 T ( V 2 \u2212 1 ) \u2009 \sigma z T ( V 2 \u2212 1 ) \u2009 \sigma z T ( V + \chi ) \u2009 I 2 ) , \Delta = a 2 + b 2 \u2212 2 c 2 , D = a b \u2212 c 2 , A = 1 a + 1 ( a + b D + \Delta ) , A \u2032 = 1 b + 1 ( b + a D + \Delta ) , B = D a + 1 ( b + D )$, $ B \u2032 = D b + 1 ( a + D ) , G ( x ) = x + 1 2 \u2009 log 2 x + 1 2 \u2212 x \u2212 1 2 \u2009 log 2 x \u2212 1 2$, V is the variance of the EPR state which is also written as V when representing the variance of mode _{A}V. |

Similarly, the case with direct reconciliation or the security analysis of squeezed states protocols can be analyzed, for simplicity, the analytical solutions are concluded in Table III.

#### 2. Discrete-modulated protocol

The earliest investigation on discrete-modulated CV-QKD is in 2009, when the transmission distance of a CV-QKD system is limited to less than 30 km due to the lack of the efficient error correction strategy of Gaussian variable at low SNR, and the proposed discrete-modulated protocol reduces the requirement of error correction, which can be a promising way to enhance the system transmission distance.^{158}

*B*are uncorrelated with the input quadratures

_{P}*X*,

_{in}*P*. Only based on this assumption, the covariance matrix describing the system after the quantum state transmission can be written as

_{in}*V*,

_{M}*T*, and

*ϵ*correspond, respectively, to modulation variance ( $ V M = V \u2212 1$,

*V*is the variance of mode

*A*), the channel transmittance, and the excess noise estimated experimentally in the prepare and measure scenario. Here,

*Z*is a function of

*V*. Once the covariance matrix is achieved, the Gaussian extremity theorem can be used to calculate the upper bound of the eavesdropper's knowledge, which is similar to the security analysis method in Gaussian-modulated protocol. Then, the lower bound of secret key rate can be derived.

_{M}The linear channel assumption is adopted since the quadrature measurement of one mode of an EPR state cannot directly map the other mode to a group of discrete-modulated coherent states. This results in the lack of covariance item *Z* in the covariance matrix, leading to the need for an additional assumption. If considering general case without linear channel assumption, the unknown of *Z* will lead to the worst-case estimation of the secret key rate, which is zero. Since the security proof of the discrete-modulated CV-QKD is not perfect, the discrete-modulated CV-QKD system is less concerned for a period of time.

This situation did not change until 2018, as the security proof of discrete-modulated protocols gradually improved and no longer required linear channel assumptions.^{125} The eavesdropping behavior can be bounded through methods such as the uncertainty principle (UP),^{125} the semidefine programming,^{126,127} and the entropy uncertainty,^{129} then the secret key rate of the protocol can be obtained by searching for the lower bound.

Introducing an auxiliary mode into the EB scheme is a feasible strategy to continuously use the security analysis method based on covariance matrix.^{125} Before sending the mode into the unsecured quantum channel, the mode is divided by a beam splitter, and one of the output mode is preserved by the sender. This preserved mode can be used to construct correlations between Alice and Bob. Therefore, the covariance matrix describing the system contains three modes, which weakens the negative influence of the undefined covariance on secret key rate. This works for arbitrary discrete modulation formats, specifically, 256 quadrature amplitude modulation (QAM) with Gaussian probability shaping performs close to the Gaussian modulated protocol, and the 64 QAM system can still support the transmission of more than 100 km.

*γ*can be estimated through the measured data, and only the covariance term $ \kappa A B$ is unknown. Since the covariance matrix

_{B}*γ*for a

_{N}*N*-mode state is constrained by the uncertainty principle [Eq. (7)]. The constraint set $ S \kappa $ which limits the possible value of $ \kappa A B$ can be obtained as

*β*is the reconciliation efficiency.

In 2019, Ghorai *et al.* proposed another security framework based on formulating the above problem as a semidefinite program (SDP) and focused on analyzing the security of a QPSK protocol.^{126} In this framework, SDP is used to search a state bounded by, in particular, designed statistics between modulation and detection data. It can be extended to a high-order modulation format and can be derived with an analytical solution of secret key rate in a symmetric modulation case.^{128}

Soon later in 2019, Lin *et al.* proposed another strategy to analyze the security of a discrete-modulated CV-QKD protocol with SDP.^{127} The security of two QPSK protocols, with homodyne and heterodyne detection, respectively, are analyzed. It adopts a mapping and postselection based on the detection data to construct the positive operator valued measurement of the receiver. In principle, this security framework can also be extended to high-order modulation format, but practically, it is limited by the demand of high computational resource.

*et al.*,

^{127}the secret key rate under collective attacks in the asymptotic limit can be can rewritten as

*ρ*, $Z$ is a completely positive trace preserving map related to the key map, $ \delta EC$ stands for the actual amount of information leakage per signal, and $ p pass$ is the sifting probability.

_{AB}In the transformed formula, only the first term is unknown, so the rate calculation problem has become a convex optimization problem for solving the minimum value of the first term in the formula. The set **S** is the feasible set of the optimization problem, which contains all bipartite density operators *ρ _{AB}* that are compatible with experimental observations.

From the measurement of Bob, the expectation values of the first and second moments of the quadrature operators $ \u27e8 x \u0302 \u27e9 , \u2009 \u27e8 x \u0302 2 \u27e9 , \u2009 \u27e8 p \u0302 \u27e9 , \u2009 \u27e8 p \u0302 2 \u27e9$ can be obtained. In addition, the operators $ n \u0302 = a \u0302 \u2020 a \u0302$ and $ d \u0302 = a \u0302 2 + ( a \u0302 \u2020 ) 2$ to constrain *ρ _{AB}*.

*p*is the probability of sending the corresponding state,

_{k}*M*is the modulation order, and $ \u27e8 q \u0302 \u27e9 k , \u2009 \u27e8 p \u0302 \u27e9 k , \u2009 \u27e8 n \u0302 \u27e9 k , \u2009 \u27e8 d \u0302 \u27e9 k$ denote the corresponding expectation values of operators $ x \u0302 , \u2009 q \u0302 , \u2009 n \u0302 , \u2009 d \u0302$ for the conditional state $ \rho B x$. This security analysis framework is further developed to higher modulation level with various formats.

^{200–207}

In addition to the security analysis methods we mentioned above, there also exists some other strategies that can reach security under finite-size effect, such as the binary modulated protocol,^{208} the QPSK protocol using the entropy accumulation^{209} and the discrete alphabet CV-QKD.^{210} The recent progress of the security analysis of discrete-modulated protocol is shown in Table IV and the performance is shown in Fig. 6. In conclusion, the mainstream strategy to provide a general security analysis of the discrete-modulated protocol is to introduce more correlation between Alice and Bob, which contributes to a tighter bound on the possible eavesdropping behavior.

Security analysis methods . | Years . | Representative results . |
---|---|---|

Uncertainty principle^{125} | 2018 | Arbitrary formats, 256 QAM, QPSK, etc. |

Linear semidefinite program^{126} | 2019 | Arbitrary formats, 256 QAM, QPSK, etc. |

Nonlinear semidefinite program^{127} | 2019 | 12-state double ring, QPSK, etc. |

Entangled photon pairs^{129} | 2021 | 2-state |

Security analysis methods . | Years . | Representative results . |
---|---|---|

Uncertainty principle^{125} | 2018 | Arbitrary formats, 256 QAM, QPSK, etc. |

Linear semidefinite program^{126} | 2019 | Arbitrary formats, 256 QAM, QPSK, etc. |

Nonlinear semidefinite program^{127} | 2019 | 12-state double ring, QPSK, etc. |

Entangled photon pairs^{129} | 2021 | 2-state |

#### 3. Practical protocol with trusted noise

^{132,211,212}Normally, the coherent receiver of a CV-QKD system can be trusted, where the loss and noise inside the detector can be modeled by an EPR state with one mode (denoted as

*F*

_{0}) coupled into the signal path by a beam splitter. The trusted detector module significantly enhances the transmission distance and the secret key rate of the system, which is demonstrated in the early experiment.

^{132}Further, the feasibility of enhancing the system performance using optical amplifiers is proved.

^{213–217}As shown in Fig. 7, here we denote the output mode after the coupling as

*F*, and the other mode of the EPR state as

*G*. The transmittance of the beam splitter,

*η*, reflects the detection efficiency. The variance of the EPR state is written as

*ν*reflects the variance of the electronic noise of a homodyne detector. For heterodyne detection,

_{ele}*ν*should be replaced by $ 2 \nu ele$. The security analysis is based on the covariance matrix

_{ele}*γ*

_{AFGB}*η*and a noise

*ν*due to detector electronics. As we did for the channel, we can define a detection-added noise referred to Bob's input and expressed in shot-noise units that we devote, in general, as

_{ele}*χ*, and is given by the expressions

_{h}*χ*to

_{line}*χ*. The upper bound of Eve's knowledge,

_{tot}*χ*becomes

_{BE}*γ*. $ \lambda 3 , 4 , 5 \u2032$ represent the symplectic eigenvalues of covariance matrix $ \gamma AFGB | m A$ which is given by

_{AB}*γ*and

_{AFG}*σ*are the sub-matrix of

_{AFGB}*γ*. The symplectic eigenvalues can be given by expressions of the form

_{AFGB}*D*are given in Table III.

## III. CV-QKD SYSTEM AND KEY MODULE

In this section, we will provide an overview of the architecture and the details of the main modules in a CV-QKD system. A summary of the current status of the key modules in a CV-QKD system using coherent states can be found in Table V. Generally, CV-QKD system can be categorized into two types, the in-line LO and the local LO. As shown in Fig. 8, of all the differences between these two types of systems, the greatest one is whether the LO is generated inside the receiver. For the in-line LO system, as shown in Fig. 8(a), the light generated by the laser source is divided, where part of the light is modulated and attenuated to quantum level, while the other part of the light is used as the strong LO. The quantum signal and LO are then multiplexed and transmitted to the receiver simultaneously. For the local LO system, displayed in Fig. 8(b), in principal the transmitter only need to modulate and send the quantum signal, and the receiver uses the locally generated LO to perform coherent detection, which simplifies the system structure and prevents the access of LO by Eve. These two different system schemes result in different main noise source, therefore various system architectures are adopted for suppressing the excess noise and raise the secret key rate.

Key module . | Function . | Notes . | ||
---|---|---|---|---|

Transmitter | Source | Pulsed | Pulsed light generation | High extinction ratio of $\u2265$60 dB with narrow linewidth |

Continuous-wave | Continuous-wave light generation | Narrow linewidth $ \u2264 20$ kHz | ||

Modulation | Gaussian modulation | Preparation of coherent states obeying Gaussian distribution | 1 GHz repetition frequency with IQ modulator | |

Discrete modulation | Preparation of coherent states obeying discrete distribution | 1 Gbaud 256 QAM Gaussian probability shaping with IQ modulator | ||

Attenuation | Reducing the power of signals to quantum level for security | Variable optical attenuator or amplitued modulator | ||

Multiplexing | Co-propagation of quantum signal and LO/pilot-tone | TDM, Pol.M, TDM + Pol.M, FDM, FDM + Pol.M, Dual Pol. | ||

Transmitter monitoring | Source monitoring | Source modeling | Detecting a fraction of the modulated signal | |

Injected light monitoring | Closing potential security loopholes | Detecting the injected light | ||

Receiver | Receiver monitoring | LO monitoring | Closing potential security loopholes | Detecting a fraction of the LO |

Injected light monitoring | Detecting the injected light | |||

De-modulation | Sychronization | Keeping the receiver's clock consistent with the sender's clock | Co-propagation or a separately transmission of the clock signal | |

De-multiplexing | Separating the quantum signal and LO (or pilot signal if necessary) before detection | Optical delay line and/or polarization beam splitter before detection | ||

Optical compensation | Suppressing the noise from polarization or phase mismatch | Dynamic polarization controller and/or phase shifter | ||

Detection | Detection balance | Compensation of the imbalance from different optical paths | Variable optical attenuator before photodiodes | |

Hom/het detection | Measurement of the quadrature information | Shot noise limited homodyne detection, heterodyne detection | ||

QRNG | ⋯ | Continuous | Getting continuous-distributed random numbers to support Gaussian modulation | Transmitting from the discrete-distributed random number, or QRNG with continuous output |

Discrete | Getting 0 &1 random numbers for discrete modulation, sifting, and postprocessing | High-speed QRNG, normally based on continuous-variable system | ||

SNU calibration | ⋯ | Two time | Achieving the SNU for data normoalization | Calibrating the total noise and electronic noise |

One time | Calibrating the total noise | |||

DSP | Pulse shaping | ⋯ | Generating signal pulses and raise the spectrum efficiency | RRC filter |

Framing | ⋯ | Quantum signal, LO/pilot tone and frame signal | Frequency division multiplexing | |

Synchronization | Clock | Keeping the receiver's clock consistent with the sender's clock | Co-propagation or a separately transmission of the clock signal | |

Frame | Definition of the starting and ending positions | Data frame in LO or pilot tone | ||

Equalization | Static | Compensation of device imperfections | S21 compensation, matched filter, skew compensation | |

Dynamic | Compensation of transmission impairments | Phase and polarization mismatch with MIMO algorithms | ||

Post-processing | Sifting | ⋯ | Preserving the modulation data with the same detection basis as the detector | Detection basis announcement |

Parameter estimation | ⋯ | Estimation of the secret key rate | Estimating the covariance matrix or system parameters | |

Information reconciliation | Reconciliation | Mapping the continuous data to discrete form | Slice reconciliation and multidimensional reconciliation | |

Error correction | Making the two parties share a same bit string | LDPC and Polar code | ||

Privacy amplification | ⋯ | Distilling the final secret key bits | Toepliz matrix |

Key module . | Function . | Notes . | ||
---|---|---|---|---|

Transmitter | Source | Pulsed | Pulsed light generation | High extinction ratio of $\u2265$60 dB with narrow linewidth |

Continuous-wave | Continuous-wave light generation | Narrow linewidth $ \u2264 20$ kHz | ||

Modulation | Gaussian modulation | Preparation of coherent states obeying Gaussian distribution | 1 GHz repetition frequency with IQ modulator | |

Discrete modulation | Preparation of coherent states obeying discrete distribution | 1 Gbaud 256 QAM Gaussian probability shaping with IQ modulator | ||

Attenuation | Reducing the power of signals to quantum level for security | Variable optical attenuator or amplitued modulator | ||

Multiplexing | Co-propagation of quantum signal and LO/pilot-tone | TDM, Pol.M, TDM + Pol.M, FDM, FDM + Pol.M, Dual Pol. | ||

Transmitter monitoring | Source monitoring | Source modeling | Detecting a fraction of the modulated signal | |

Injected light monitoring | Closing potential security loopholes | Detecting the injected light | ||

Receiver | Receiver monitoring | LO monitoring | Closing potential security loopholes | Detecting a fraction of the LO |

Injected light monitoring | Detecting the injected light | |||

De-modulation | Sychronization | Keeping the receiver's clock consistent with the sender's clock | Co-propagation or a separately transmission of the clock signal | |

De-multiplexing | Separating the quantum signal and LO (or pilot signal if necessary) before detection | Optical delay line and/or polarization beam splitter before detection | ||

Optical compensation | Suppressing the noise from polarization or phase mismatch | Dynamic polarization controller and/or phase shifter | ||

Detection | Detection balance | Compensation of the imbalance from different optical paths | Variable optical attenuator before photodiodes | |

Hom/het detection | Measurement of the quadrature information | Shot noise limited homodyne detection, heterodyne detection | ||

QRNG | ⋯ | Continuous | Getting continuous-distributed random numbers to support Gaussian modulation | Transmitting from the discrete-distributed random number, or QRNG with continuous output |

Discrete | Getting 0 &1 random numbers for discrete modulation, sifting, and postprocessing | High-speed QRNG, normally based on continuous-variable system | ||

SNU calibration | ⋯ | Two time | Achieving the SNU for data normoalization | Calibrating the total noise and electronic noise |

One time | Calibrating the total noise | |||

DSP | Pulse shaping | ⋯ | Generating signal pulses and raise the spectrum efficiency | RRC filter |

Framing | ⋯ | Quantum signal, LO/pilot tone and frame signal | Frequency division multiplexing | |

Synchronization | Clock | Keeping the receiver's clock consistent with the sender's clock | Co-propagation or a separately transmission of the clock signal | |

Frame | Definition of the starting and ending positions | Data frame in LO or pilot tone | ||

Equalization | Static | Compensation of device imperfections | S21 compensation, matched filter, skew compensation | |

Dynamic | Compensation of transmission impairments | Phase and polarization mismatch with MIMO algorithms | ||

Post-processing | Sifting | ⋯ | Preserving the modulation data with the same detection basis as the detector | Detection basis announcement |

Parameter estimation | ⋯ | Estimation of the secret key rate | Estimating the covariance matrix or system parameters | |

Information reconciliation | Reconciliation | Mapping the continuous data to discrete form | Slice reconciliation and multidimensional reconciliation | |

Error correction | Making the two parties share a same bit string | LDPC and Polar code | ||

Privacy amplification | ⋯ | Distilling the final secret key bits | Toepliz matrix |

Generally, the structure of a CV-QKD system can be concluded in Fig. 9. The transmitter and receiver are the optical modules of the system, which are responsible for the information encoding and decoding.

The transmitter consists of the laser source, the modulation module and the monitoring module. The laser source can be pulsed or continuous-wave light. The mostly commonly employed modulation formats are Gaussian and discrete modulation. Additionally, the modulator must modulate and multiplex a classical auxiliary signal with the quantum signal, which is the LO in an in-line LO system and the pilot tone in a local LO system. The quantum signal is multiplexed with LO or pilot tone using time-division, frequency-division, and polarization multiplexing techniques. For security reasons, monitoring is typically employed at the output stage.

At the receiver end, the co-transmitted quantum and classical signals are demodulated and detected by shot-noise-limited balanced homodyne detectors (BHDs). A seperate monitoring module is deployed to ensure the practical security. Several automatic feedback methods are used to calibrate sampling time, polarization, and phase of the quantum states in order to overcome perturbations in the channel due to changing environmental conditions. These calibrations can be realized using either hardware or digital techniques.

To map the output of the detector to the quadrature information, DSP is employed with the aim of achieving maximal correlation between the transmitter and receiver. With the assist of DSP, SNU calibration enables the establishment of a connection between theoretical security analysis and the practical system, a crucial aspect of system security. Finally, postprocessing is processed to extract the secret key bits from the correlation established by the aforementioned procedures. It comprises sifting, parameter estimation, information reconciliation, and privacy amplification. The randomness of the overall system is supported by the quantum random number generator (QRNG), which provides the information of modulation and controls the postprocessing.

### A. Quantum random number generator

Randomness determines the security of a CV-QKD system. In fact, all of the random numbers used in a CV-QKD system should satisfy the true randomness, which is essential to the unconditional security.^{3–6} An outstanding alternative is a QRNG, which exploits the intrinsic random nature of quantum mechanics, acts as a promising method in generating truly random numbers.^{218–220}

The random numbers are used for controlling the modulators so that the sender can prepare random coherent states following a certain modulation format, determining the detection basis during homodyne detection, and constructing mappings or universal hash functions in postprocessing. Specifically, Gaussian distributed random numbers, Rayleigh distributed or uniformly distributed random numbers in continuous-variable form are required in Gaussian modulation of coherent states. Discrete-variable random numbers are required in discrete-modulation, basis selection and postprocessing.

Based on different security levels, the QRNG can be divided into the practical type,^{221,236–240} the semi-device independent type^{241–250} and the device independent type.^{251–254} The QRNG can also be divided into the discrete-variable and continuous-variable types corresponding to different types of entropy source. Normally, the continuous-variable QRNG can support high generation rate with simple structure, where the randomness can come from the amplifier spontaneous emission (ASE) noise,^{233–235,255–258} the phase noise,^{226–231,259–268} and the vacuum noise.^{223–225,269–271} The QRNG based on vacuum noise can achieve high-speed and simple structure, using only a laser source and a homodyne detector.^{223,224,271} The state of the art QRNG based on the vacuum noise can achieve a generation rate of 100 Gbps using photonic integrated circuits,^{272} where the speed, size and scalability can well satisfy the need of a CV-QKD system.^{225} Here, we summarize the most commonly used QRNG implementations as shown in Table VI.

Scheme . | Year . | Bandwidth . | Generation rate . |
---|---|---|---|

Vacuum fluctuation | 2011 | 120 MHz | 2 Gbps (real-time)^{221} |

2019 | 1 GHz | 6.83 Gbps (real-time)^{222} | |

2021 | 3.5 GHz | 18.8 Gbps (real-time)^{223} | |

2021 | 400 MHz | 2.9 Gbps (real-time)^{224} | |

2023 | 10 GHz | 100 Gbps (Ref. 225) | |

Laser phase noise | 2010 | 1 GHz | 500 Mbps (Ref. 226) |

2016 | 1 GHz | 5.4 Gbps (real-time)^{227} | |

2014 | 2.5 GHz $ *$ | 20 Gbps (Ref. 228) | |

2015 | 12 GHz | 68 Gbps (Ref. 229) | |

2019 | 1 GHz $ *$ | 8 Gbps (real-time)^{230} | |

2021 | 2.5 GHz $ *$ | 10 Gbps (Ref. 231 | |

2023 | 20 GHz | 218 Gbps (Ref. 232) | |

ASE | 2010 | 7.5 GHz | 12.5 Gbps (Ref. 233) |

2011 | 15 GHz | 20 Gbps (Ref. 234) | |

2020 | 5 GHz | 118.375 Gbps (Ref. 235) |

Scheme . | Year . | Bandwidth . | Generation rate . |
---|---|---|---|

Vacuum fluctuation | 2011 | 120 MHz | 2 Gbps (real-time)^{221} |

2019 | 1 GHz | 6.83 Gbps (real-time)^{222} | |

2021 | 3.5 GHz | 18.8 Gbps (real-time)^{223} | |

2021 | 400 MHz | 2.9 Gbps (real-time)^{224} | |

2023 | 10 GHz | 100 Gbps (Ref. 225) | |

Laser phase noise | 2010 | 1 GHz | 500 Mbps (Ref. 226) |

2016 | 1 GHz | 5.4 Gbps (real-time)^{227} | |

2014 | 2.5 GHz $ *$ | 20 Gbps (Ref. 228) | |

2015 | 12 GHz | 68 Gbps (Ref. 229) | |

2019 | 1 GHz $ *$ | 8 Gbps (real-time)^{230} | |

2021 | 2.5 GHz $ *$ | 10 Gbps (Ref. 231 | |

2023 | 20 GHz | 218 Gbps (Ref. 232) | |

ASE | 2010 | 7.5 GHz | 12.5 Gbps (Ref. 233) |

2011 | 15 GHz | 20 Gbps (Ref. 234) | |

2020 | 5 GHz | 118.375 Gbps (Ref. 235) |

^{273}Box–Muller Transform,

^{274}Central Limit Theorem,

^{275}Piecewise Linear Approximation using Triangular Distributions,

^{276}Rejection methods,

^{277}and so on. Typically, the Box–Muller Transform is one of the most widely used methods. It is based on the independent samples,

*U*

_{1}and

*U*

_{2}, chosen from the uniform distribution on the unit interval (0, 1). Let

*Z*

_{0}and

*Z*

_{1}are independent random variables with a standard normal distribution. A discrete-modulated CV-QKD system can naturally avoid this issue, where the only step using continuous-variable random numbers, the Gaussian modulation, is replaced.

### B. Transmitter

The function of the transmitter of a CV-QKD system is to prepare the modulated quantum signals and the classical auxiliary signals such as the LO and pilot tones. It usually consists of the laser source, the modulation module and the monitoring module.

#### 1. Source

Laser source usually requires the narrow linewidth and low relative intensity noise to achieve high-performance and stability. Among the wide range of lasers, fiber lasers are the most commonly used, which is advanced in monochromaticity, directionality, and stability. The distributed feedback lasers and external cavity lasers are also adopted in some systems.^{278–281}

The laser source can be pulsed or continuous-wave form. The pulsed laser source usually consists of a laser diode with amplitude modulators, while the continuous-wave laser source only requires a narrow-linewidth laser diode. In the early stage of CV-QKD system, pulsed light is naturally used since the separation in time domain provides a clear understanding of different quantum states. Moreover, it is suitable for time division multiplexing to suppress the crosstalk between quantum and classical auxiliary signals. Since the necessary classical auxiliary signal is around 10^{4}–10^{8} photons per pulse, to eliminate the leakage from the classical pulse to quantum signal pulse, the required extinction ratio is normally about 80 dB or more. Usually, a conventional amplitude modulators has an extinction ratio less than 40 dB, therefore, two or more cascaded amplitude modulators are required for pulse generation.^{282}

As the system repetition frequency increases for higher performance, it is harder to achieve pulses with high extinction ratio and high repetition frequency simultaneously, resulting in the demand of directly using continuous-wave laser source. Meanwhile, the local LO system reduces the crosstalk between quantum and classical signals, which relaxes the requirement of the extremely high isolation. Therefore, the continuous-wave laser source without the complex cascaded amplitude modulators is widely used in the recent local LO systems.^{143,283–287} However, for an accurate interference with signals from two different lasers, the laser diodes in an local LO system require narrower linewidth. In addition, a laser locking module can be optionally used to reduce the phase noise.

#### 2. Modulation

The light output from the laser source is then modulated to encode the quantum information, generate the classical signals such as frame signals, and the LO or reference signal, which are combined at the output of the transmitter through various multiplexing techniques. In this part, we will detail the modulation process in three steps, encoding information, controlling the average power of quantum signal and adding classical auxiliary signals.

For encoding information, two mainstream methods are adopted as shown in Figs. 10(a) and 10(b). One is the combination of a phase modulator and an amplitude modulator, and the other is the use of an in-phase quadrature (IQ) modulator. The structure of the modulators used here is detailed in Figs. 10(c)–10(e). The modulation format of a CV-QKD system includes Gaussian modulation and discrete modulation, as shown in Figs. 11(a) and 11(b). Both of them require displacements of coherent states on two quadratures of the phase space. An exception is the unidimensional modulation shown in Fig. 11(c), which only requires the modulation of one quadrature and can be realized with a single amplitude modulator. In addition, the Phase Shift Keying (PSK) discrete-modulation only requires a phase modulator for encoding, as shown in Fig. 11(d).

*I*and

*Q*as the data loaded to the in-phase and quadrature path of the IQ modulator, which corresponds to the

*x*and

*p*quadrature on phase space, they should obey normal distribution as

*N*represents the normal distribution. For phase and amplitude modulators, the information is loaded with a polar coordinate system, therefore requires the Rayleigh distributed amplitude

We remark that, sometimes the *x* or *p* quadrature is also called basis, but it is different to the basis in single-photon protocol since the security of CV-QKD is not determined by quadrature selection. Actually, the security of a coherent state CV-QKD system is ensured by the indistinguishability of coherent states on phase space. There also exists a noval CV-QKD protocol based on the basis encoding, where the secret information is encoded on the random choices of two measurement basis, and the security against individual attack has been proved.^{288} The scheme exhibits the potential to tolerate high excess noise.

For practical implementations, we remark that these two methods require different acquisitions.^{289} In addition to that, the working parameters of the modulators should be accurately adjusted, since the imperfect modulation may increase the excess noise and open security loopholes.^{290}

After the encoding, one should adjust the average power of the prepared quantum states to a proper level. Although in principle, CV-QKD protocols can use the quantum states with high average power, the practical implementations always require the extremely low average power in a few photon number levels, since the practical devices with limited resolution cannot measure the quantum characteristics of the high-power states. Using the variable optical attenuator (VOA) with manual adjustment or automatic control is a general method to adjust the level of attenuation, as shown in Fig. 10. Further, Zhang *et al.* used an amplitude modulator to realize the real time attenuation control. It allows one to flexibly raise the launching power of the frame signals for better SNR, and reduce the power of the quantum signals.^{139}

In addition, the passive-state-preparation CV-QKD without modulation modules has also been proposed, where the transmitter consists of a thermal source, beam splitters, optical attenuators, and homodyne detectors.^{194,291,292}

In the earliest experimental demonstrations, the quantum signals and the LOs are transmitted separately.^{130} Later, in order to avoid any polarization and phase drifts that may occur between the signal and LO over long-distance fiber transmissions, time-division multiplexing scheme was proposed to co-transmit the quantum signals and the LOs in the same fiber.^{132} In another literature, Qi *et al.* also co-transmitted the quantum signals with the LOs, but adopted a scheme combining polarization and frequency-division multiplexing.^{293} In later experimental demonstration, the co-transmission schemes basically adopt the combination scheme of time-division multiplexing and polarization multiplexing.^{133,136,137,139,294} In this way, the leakage from the LOs to the quantum signals can be maximally suppressed, while maintaining a relatively simple implementation structure.

For local LO systems, though LO is generated by the receiver, a classical reference signal is still necessary for phase recovery. Early local LO systems using pulsed laser source is suitable with time division multiplexing, where the quantum signal and the classical pilot tone are alternately transmitted.^{141,142} It can be combined with the polarization multiplexing to suppress the leakage of the pilot tone.^{295} Toward high-speed and continuous-wave system, frequency division multiplexing of quantum signal and pilot tone is widely used.^{283,284,287} Since the power of pilot tone is far lower than that of the LO, the requirement of isolation is relaxed. It can also be combined with polarization multiplexing for higher isolation.^{143,285}

In addition to the LO or reference signal, some classical frame signals are inserted in the quantum signal sequence to provide the essential information for synchronization, phase compensation, etc. These frame signals are usually generated by the same modulation module of quantum signals, and time-division multiplexed.

#### 3. Transmitter monitoring

A source monitor is deployed after the modulation module to evaluate Alice's real output state by detecting a fraction of the signal before entering into the quantum channel. It can be categorized into the active source monitor and the passive source monitor. As shown in Fig. 12(a), the active source monitor adopts the optical switch for getting a part of the signal for monitor, while the passive source monitor uses a beam splitter to divide the quantum signal for monitor, shown in Fig. 12(b).

The monitor module can be a homodyne or heterodyne detector, which provides the statistic of the modulated coherent states, including the modulation variance, which is related to the power of the modulated signals. In addition, for Gaussian modulation, since the modulation variance corresponds to the average photon number, which is related to the optical power, an optical power meter can replace the homodyne or heterodyne detector for source monitor.

*V*is defined as the modulation variance. The average photon number of the output mode, $ n \u0302$, can be achieved by detecting the power of the output signal, denoted as

_{M}*P*. Each photonic has the energy of $ E = h \nu $, where

_{out}*h*is the Plank constant and

*ν*is the frequency. Assuming

*N*pulses are detected, where

*N*is a sufficient large number, and the repetition frequency of the system is

*f*. The average photon number can be achieved by

_{rep}In this way, one can define the data of state preparation on phase space corresponding to the electrical modulation data entered into the modulation module, and the estimated average power of the output quantum states, which is a crucial step for security analysis of a practical system.

The source monitor also contributes to a tight estimation of channel parameters. In a practical system, the laser fluctuation,^{296} imperfect modulation^{290} and other factors introduce source noise into state preparation stage.^{297} It has been shown that the secret key rate may be undermined by the source noise.^{163,298,299} Traditionally, source noise is ascribed into the channel noise to calculate the secret key rate, while in practice it is controlled neither by Eve, nor by legitimate users. So, this untrusted source noise model just overestimates Eve's power and leads to an untight security bound. By real-time monitoring the modulated quantum signals, the source noise can be calibrated and removed from the channel noise, which helps to enhance the system performance.

In addition, for practical security considerations, the monitoring module of the source can help to resist the potential attacks on the system by injecting a strong light, such as the Trojan-horse attack,^{300} which can open a side channel for Eve. The monitoring structure is shown in Fig. 12(c), where a circulator isolates the injected light from the components inside the transmitter, and directs it to the monitoring module, which can be a homodyne detector, or an optical power meter. The specific attack methods and countermeasures are detailed in the section of practical security.

### C. Receiver

The receiver of a CV-QKD system should accurately measure the quadrature of the received state on phase space, which normally contains the monitoring, de-modulation and detection sub-modules, detailed as below.

#### 1. Receiver monitoring

The receiver monitoring module is mainly used to monitor the classical light from the channel, including the wavelength, frequency, power, and amplitude of the LO in an in-line LO system, as well as the pilot tone in a local LO system.^{301}

Receiver monitoring is essential for an in-line LO system, since the LO is transmitted in the quantum channel, which may be manipulated by Eve, and directly participates in the homodyne or heterodyne detection. For an in-line LO system with polarization multiplexed quantum signal and LO, after the de-multiplexing of the received signal, the LO can be divided by an unbalanced beam splitter. The stronger output is sent to the detector and the weaker one is detected by a photodiode (PD) for monitoring.

In addition to that, the monitor also need to ensure that the receiver is not affected by the potential injection of a strong light. Several efficient attacking strategies for the CV-QKD system are aiming at the receiver by injecting a strong light to disturb the detection or SNU calibration process. The attacks and countermeasures are detailed in the section of practical security.

#### 2. De-modulation

The de-modulation module responses for the compensation and de-multiplexing in optical path to well separate the quantum and classical signals, mainly including the polarization^{302,303} and phase compensation,^{304–307} as well as the de-multiplexing of polarization and time. It also includes the synchronization in hardware layer.^{308–312}

Since the quantum signal is transmitted in single-mode fiber while the receiver is a polarization-maintaining system, the compensation of polarization is crucial for reducing the loss of quantum signals. More importantly, it can suppress the excess noise caused by the crosstalk of quantum and classical auxiliary signals in a polarization-multiplexing system. For proof-of-principle experiments, the polarization compensation is realized by a manual polarization controller, while dynamic polarization controller (DPC) with feedback systems is adopted in long-term or field tests.^{137} For simpler deployments, the digital polarization compensation is a crucial technique, where the recently proposed polarization tracking algorithm, in particular, designed for CV-QKD system has shown the possibility of realizing a simple and effective digital polarization compensation for extremely weak quantum signals.^{313}

Phase noise is inevitably introduced in a CV-QKD system, caused by the phase mismatch between quantum signal and LO. Though they are co-transmitted in an in-line system, the differences in transmission paths before and after multiplexing, as well as the disturbance of fiber link, result in different phases. The local LO system is worse, since quantum signal and LO are generated separately. Generally, the phase mismatch consists of the slow-fading and fast-fading ones. The slow-fading phase noise is normally caused by the optical path difference, while the fast-fading phase noise is caused by the channel disturbance and the frequency drift between the two lasers in local LO systems. The slow-fading ones can be compensated with the inserted frame signals, such as the four-state modulated signals. While more reference signals are required for fast-fading phase compensation, such as pilot tones. The phase compensation in optical path is normally realized with a phase modulator. Specifically, for the system with GG02 protocol, phase compensation can be integrated with the phase modulator for detection basis switching.

In a pulsed CV-QKD system, a de-multiplexing operation is usually performed before the homodyne or heterodyne detection to seperate the quantum signals and LO (or pilot tone). After the polarization compensation at the beginning of the receiver, a polarization beam splitter is used to separate the quantum and classical signals in orthogonal polarization directions. Then, for the time-division multiplexed signals, such as the quantum signal and LO, an optical delay line is adopted to align the quantum signal pulse and LO pulse for homodyne detection. In this structure, a phase modulator in the LO path realizes the basis switching and phase compensation as we mentioned before. Finally, the detection results can be used as the raw data.

The continuous-wave system is different, where most of the de-multiplexing and compensation can be realized in digital domain, using the data after the detection. The architecture of the receiver is similar to the integrated coherent receiver (ICR) in classical coherent optical communications, and lots of algorithms participate in the compensation and de-multiplexing process. We will detail this process in the part after detection.

Clock synchronization responses for the alignment of the sampling points at the transmitter and the receiver site. If the sampling points of the receiver are mismatched to those of the transmitter, the correlation between the modulation data and the detection data will be reduced. As for clock synchronization, there are many hardware layer solutions, such as transmitting in a cable,^{314} in a paired fiber,^{315} multiplexing with quantum signal in one fiber by wavelength division multiplex (WDM),^{316} and distilling the synchronization signal from LO. Each of the above options has its advantages and disadvantages. The electric cable is not only expensive and also instable for distant transmission. Transmitting clock signal and quantum signal in the same fiber by WDM can compensate the difference of signal arrival time but may introduce excess noise generated by WDM crosstalk. Distilling the synchronization signal from local oscillator need divide the local oscillator beam. The division of LO power will decrease the maximal transmission distance or require higher gain of homodyne detection to compensate. Transmitting clock signal in another independent fiber will generate the fluctuation between quantum and clock signal.

The recent system normally adopts the clock synchronization in digital domain,^{317} using algorithms to realize the above requirements, which will be detailed in DSP part.

#### 3. Detection

Homodyne detection is the basis of measuring the quantum signals in a CV-QKD system.^{318–329} As shown in Fig. 13(a), the quantum and LO signals are interfered by a 50:50 coupler, then the two output signals are detected by two photodiodes. The two branches of the photocurrent generated by the photodiodes are differentiated and output. The differential current contains the information on the quadrature of the quantum signal. A simple derivation of homodyne detection is shown as below.

*x*quadrature when

*θ*= 0, where

*p*quadrature when $ \theta = \pi / 2$

A homodyne detector can only measure one quadrature at a time but the security analysis requires detection of both quadratures. Therefore, a phase modulator is deployed on the path of the LO, for switching the phase difference between the LO and quantum signal between 0 and $ \pi / 2$ randomly. This can realize the function of switching the detection basis, satisfying the requirement of getting the statistic data of both quadratures. Further, by combining two homodyne detector together, a heterodyne detector which enables the detection of both quadratures of the quantum signal is realized, as shown in Fig. 13(b). It can simultaneously detect the *x* and *p* quadrature of a quantum signal since a phase shift of $ \pi / 2$ is introduced to one path of the LO. To avoid the low frequency noise, the heterodyne detection can also be realized by moving the quantum signal to the intermediate band in frequency domain.^{143,189,283–285,287} Both quadratures can be simultaneously distilled with downconversion in analog domain or digitally, while a full architecture is still required to avoid the image band issue. Here, we remark that the heterodyne detector in CV-QKD represents the dual-homodyne structure, which has different meanings of that in coherent optical communications.

The homodyne detector can be divided into two types, with direct output and the integral output.^{331,335,336} The integral-output homodyne detector is widely used in the early CV-QKD system since the signal and LO are both pulsed light. Therefore, it requires the integration of each laser pulse and output a field quadrature signal. At this stage, the homodyne detector is heading toward the high bandwidth, balance, and common mode rejection ratio (CMRR).^{325,330,337–339} Later, since the CV-QKD system adopts the continuous-wave light, the direct-output homodyne detector is enough, which has less requirement on the balance, and it is easier to realize a high-speed homodyne detection.

The bandwidth, detection efficiency, electronic noise and quantum to classical noise ratio (QCNR) are the key parameters of homodyne detectors. The bandwidth of the receiver directly affects the settings of the system in frequency domain, including the multiplexing and processing of the quantum and phase reference signals. The detection efficiency is another crucial parameter of the practical homodyne detector, corresponding to the detector parameter *η* in Eq. (28). It is limited by the photodiodes, and the balance of the two arms of the homodyne detectors. The electronic noise of the practical homodyne detector is vital in the CV-QKD systems, which corresponds to *ν _{ele}* in Eq. (28). Since the power of the quantum signal is extremely small, a high electronic noise can significantly reduce the SNR, therefore resulting in a low-quality detection. The last parameter that are normally used to describe the homodyne detector is the QCNR. The QCNR demonstrate how good the weak quantum signals can be amplified while suppressing the electronic noise. The general requirement for the QCNR is that it should be at least 10 dB. We also list some reported homodyne detectors with their parameters in Table VII, common-mode rejection ratio is introduced to reflect the balance of the detector.

. | Year . | BW . | QCNR (dB) . | CMRR (dB) . |
---|---|---|---|---|

Bulk | 2011 | 104 MHz | 13 | 46 (Ref. 323) |

2011 | 100 MHz | 13 | 52.4 (Ref. 324) | |

2013 | 300 MHz | 14 | 54 (Ref. 326) | |

2015 | 5 MHz | 37 | 75.2 (Ref. 330) | |

2018 | 40 MHz | 14.5 | // (Ref. 331) | |

2018 | 1.2 GHz | 18.5 | 57.9 (Ref. 328) | |

On chip | 2019 | 1–10 MHz | 5 | // (Ref. 138) |

2021 | 750 MHz | 26.82 | 40 (Ref. 332) | |

2021 | 2.6 GHz | 21.1 | 50 (Ref. 333) | |

2021 | 1.5 GHz | 28 | 80 (Ref. 272) | |

2021 | 1.7 GHz | 14 | 52 (Ref. 334) | |

2023 | // | 19.42 | 86.9 (Ref. 335) |

. | Year . | BW . | QCNR (dB) . | CMRR (dB) . |
---|---|---|---|---|

Bulk | 2011 | 104 MHz | 13 | 46 (Ref. 323) |

2011 | 100 MHz | 13 | 52.4 (Ref. 324) | |

2013 | 300 MHz | 14 | 54 (Ref. 326) | |

2015 | 5 MHz | 37 | 75.2 (Ref. 330) | |

2018 | 40 MHz | 14.5 | // (Ref. 331) | |

2018 | 1.2 GHz | 18.5 | 57.9 (Ref. 328) | |

On chip | 2019 | 1–10 MHz | 5 | // (Ref. 138) |

2021 | 750 MHz | 26.82 | 40 (Ref. 332) | |

2021 | 2.6 GHz | 21.1 | 50 (Ref. 333) | |

2021 | 1.5 GHz | 28 | 80 (Ref. 272) | |

2021 | 1.7 GHz | 14 | 52 (Ref. 334) | |

2023 | // | 19.42 | 86.9 (Ref. 335) |

The homodyne detector can be integrated on chip driven by the photonics integrated circuit techniques, as shown in Fig. 14. The highly balanced photonics circuit, photodiode with high detection efficiency, and the low noise transimpedance amplifier are the core issues. The 3 dB bandwidth of the chip-based homodyne detector can break 1.5 GHz, the clearance between the shot noise and the electronic noise can reach 28 dB, and the common-mode rejection ratio can reach 80 dB.^{272} These meaningful parameters show that the homodyne detectors on chip have achieved high-speed, low electronic noise and excellent balance.

### D. Shot noise unit calibration

As we mentioned before, the electrical modulation data are transformed to the phase space based on the source monitoring. Correspondingly, the electrical detection data also requires the transformation, which is realized by SNU calibration.

SNU is defined as the variance of the shot noise. In security analysis, the variance of the quantum fluctuation on phase space is defined as unity, while in a practical system, this fluctuation can be measured and recorded as electrical signals, simply by measuring the vacuum. With enough electrical detection data of vacuum state, the variance of the shot noise measurement result can be estimated in a practical system and used for the normalization of the detection data of coherent states. In this way, the electrical detection output can be transformed to the data for security analysis. Therefore, accurate SNU calibration is crucial for the security of the CV-QKD system.^{336}

However, SNU calibration of a practical system needs to consider the additive electronic noise, which is introduced inevitably by a practical measurement, shown in Fig. 15. Usually, the variance of electronic noise, *V _{ele}*, can be calibrated independently. Therefore, SNU can be achieved in a practical CV-QKD system with twice measurements. As shown in Fig. 16(a), the electronic noise in the CV-QKD systems can be directly calibrated as follows: first, turn-on the electric power of the homodyne detector, and cutoff the two optical input ports, the measured variance is the raw electronic noise. Then, total noise can be calibrated with LO on, shown in Fig. 16(b). The difference of the two variables is the SNU, denoted as

*u*.

*η*, the detection results of the quantum signal before normalization can be written as

_{d}*X*are the quadrature information of quantum signal, vacuum state (shot noise), and electronic noise.

_{ele}*X*represents the effect of LO, and

_{LO}*A*is the amplification coefficient of circuits. Therefore, the SNU calibrated with the method we mentioned before is $ ( A X L O ) 2$. In this way, after normalization, we can get

*ν*, is the variance of $ X ele / ( A X L O )$. The scheme of the trusted detector is shown in Fig. 17(a).

_{ele}In fact, this SNU calibration method has been widely applied in the early experimental demonstrations^{134,340} through different implementation schemes. However, the LO power and electronic noise are not constant in the practical CV-QKD operations, it tends to drift with the time or temperature changes. Thus, the SNU calibration should be performed in real-time. For example, in Ref. 340, the SNU calibration is performed before the CV-QKD operation, which is called a pre-calibration scheme. The SNU would be calibrated through the above method, the raw data which is obtained in the later running of the CV-QKD can be normalized by using the calibrated SNU. This implementation scheme is surely fine in the proof-of-principle demonstrations, but in reality, the fading of SNU may cause severe security issues. Therefore, monitor scheme that can trace the SNU change should be applied.

The implementation scheme based on the combination of the pre-calibration scheme as well as the LO monitor scheme is adopted.^{133,134} In this scheme, the pre-calibration still runs before the CV-QKD operation. Also, before the system running, Bob will measure a series of SNU according to different powers of the LO transmitted from Alice. These data would later form a linear relation between the optical power and the SNU. During the CV-QKD system operating, a small portion of the LO is separated and constantly measured. Then, based on the obtained optical power, Bob adjusts the SNU according to the linear relation that has been formed previously. The raw data obtained from the CV-QKD operation can be then normalized by the modified SNU.

Although the conventional SNU calibration method has been applied in many experimental demonstrations, there are still several issues that are unsolved. First, the SNU calibration process is rather complicated, two steps are required at the optical paths. Additionally, with the deeper studies on the practical security of CV-QKD, it makes us realize that the existing SNU calibration method can have security loopholes.

^{297,341,344–345}Therefore, we get

*V*is the variance of the electronic noise before normalization. Further, we can get the output after the normalization with $ SNU \u2032$ as $ x out \u2032 = X out / u \u2032 .$ If we use another vacuum state to represent the electronic noise as $ X ele = V ele x \u0302 v \u2032$, then we can get

_{ele}^{341}

With this novel SNU calibration method, it is possible to achieve a real-time SNU calibration, since we only need to monitor the power of the split LO, without the demand of constantly measuring the electronic noise to finish the calibration procedure. Several experimental demonstrations^{137,341} have successfully adopted this SNU calibration methods. A conclusion of the SNU calibration methods in CV-QKD systems is shown in Table VIII.

Calibration . | Strategy . | Procedures . |
---|---|---|

Traditional two-time^{340} | Pre-calibration | (1) Calibration of electronic noise |

(2) Calibration of total noise | ||

(assuming a stable SNU) | ||

Traditional two-time^{133,134} | Real-time | (1) Calibration of electronic noise |

(2) Calibration of total noise with different LO power (monitoring the real-time LO power) | ||

One-time^{137,341} | Real-time | (1) Calibration of total noise with different LO power before system operation (monitoring the real-time LO power) |

Calibration . | Strategy . | Procedures . |
---|---|---|

Traditional two-time^{340} | Pre-calibration | (1) Calibration of electronic noise |

(2) Calibration of total noise | ||

(assuming a stable SNU) | ||

Traditional two-time^{133,134} | Real-time | (1) Calibration of electronic noise |

(2) Calibration of total noise with different LO power (monitoring the real-time LO power) | ||

One-time^{137,341} | Real-time | (1) Calibration of total noise with different LO power before system operation (monitoring the real-time LO power) |

### E. Digital signal processing

For the early systems, DSP is mainly used for the compensation in optical layer, such as providing the feedback information for phase and polarization control. Later in the high-speed local LO systems, the DSP is gradually becoming widely used, which is applied to the transmitter and receiver, including the clock synchronization, the static equalization, the dynamic equalization and the frame synchronization. The ultimate purpose of DSP in a CV-QKD system is to maximize the data correlation between the transmitter and receiver, which is consistent with the traditional optical communication algorithm to improve SNR. Therefore, CV-QKD system can widely use the algorithms in classical optical communications, and finally form the current routine, as shown in Fig. 18.

At the transmitter site, for raising the accuracy of the modulation, upsampling is performed before the Root-Raised-Cosine (RRC) pulse shaping.^{346} Then, the pulse shaping of the quantum signal is processed to reduce the correlation between each quantum signal and satisfying the definition of a quantum pulse in a CV-QKD protocol. Practically, the signal pulse should be bounded in frequency domain so that the modulation and detection with limited bandwidth will not affect the shape of the signal in time domain. Yet/However, this will result in the infinite expansion in time domain. The mostly used solution is the RRC filter, where the integration of each two quantum signal pulse is 0 in time domain while the frequency band is limited, which both satisfies the requirements of the temporal mode of a CV-QKD protocol and the practical implementation. After that, the quantum signal is digitally shifted in frequency domain at the transmitter site, and the pilot tone for phase reference is added. Also, for frame synchronization, a Constant Amplitude Zero Auto-Correlation (CAZAC) sequence is added at the beginning of each frame. The widely used CAZAC sequence is the Zadoff–Chu sequence.

For the receiver, the frequency-division multiplexed quantum and pilot signal are first separated from the output of the detection data, then the quantum signals are down-converted to the baseband corresponding to the frequency shift at the transmitter. Second, clock synchronization is processed, which is a digital alternative to the hardware solution mentioned before. Subsequently, the static equalization algorithms are performed to compensate the impairments, including the IQ imbalance compensation and S21 compensation, and to recover the signal pulse with matched RRC filter. Down-sampling at the best sampling point is then performed to achieve the information with the best SNR. Then, the dynamic equalization is processed to compensate the phase and polarization mismatch, normally using Multiple-Input Multiple-Output (MIMO) algorithms.^{304–306,347–350} Finally, frame synchronization is performed to align the beginning of the modulation and detection data. The final output of the DSP is treated as the raw data, which is then sent to the postprocessing process.

The order of the DSP steps can be exchanged for the linearity of the algorithms. The state-of-the-art DSP routines are shown in Fig. 19. The coefficients in DSP is normally adjusted dynamically with the system situation for better performance, especially in long-distance or high-noise scene. For this purpose, machine learning (ML) is recently introduced to achieve consistently excellent phase estimation under a wide range of pilot SNR.^{342,343} The compatibility with classical coherent optical algorithms significantly promotes the development of CV-QKD, which provides a large number of tools and experience when developing toward high speed and long distance.

### F. Postprocessing

The quantum stage is followed by classical data processing steps (normally called postprocessing) as is illustrated in Fig. 20, which includes four steps: base sifting, information reconciliation, parameter estimation, and privacy amplification.^{351–353} For this purpose, Alice and Bob use an authenticated channel on which Eve cannot modify the communicated messages but can learn their content. Also, after the steps in postprocessing process, Alice and Bob will perform verification to ensure that the step is successful processed.^{354}

#### 1. Sifting

Base sifting is required for systems with homodyne detection or squeezed states, where only one quadrature can used for each measurement. Bob announces the detection basis after a round, and Alice save the corresponding quadrature data. Further developments of CV-QKD systems such as the heterodyne detection scheme can save the data of both quadratures, resulting in a system without sifting. The procedure is significantly simplified since the switching and sifting of detection basis is removed.

#### 2. Parameter estimation

*B*

_{0}is projected onto a Gaussian state with

*x*and

*p*quadrature corresponds to the modes after a 50:50 beam splitter, where

*A*is one mode of the EPR state,

*N*is the mode of vacuum state. $ A x$ and $ A p$ are the two modes after the beam splitter. $ ( x A x , p A p )$ are the

*x*and

*p*quadrature of $ A x$ and $ A p$, respectively. Therefore, the calibrated data $ ( D x B 0 , D p B 0 )$ can be converted to $ ( D x A x , D p A p )$. With $ ( D x A x , D p A p )$ and $ ( D x B , D p B )$, the covariance and variance of $ x A x , \u2009 p A p , \u2009 x B$, and $ p B$ can be estimated. Since mode

*A*and

_{x}*A*are symmetric, the covariance and variance of

_{p}*x*,

_{A}*p*, $ x B$, and $ p B$ can be further estimated, which results in the covariance matrix

_{A}*γ*.

_{AB}*B*can be expressed as below

*T*and

*ε*are the two parameters related to the system security, estimated from the modulation and detection data.

Based on the security analysis with analytical solution we detailed in Sec. II, the secret key rate can be calculated. For a fiber channel, the loss and noise corresponds to the physical meanings of *T* and *ε*, which can be used for simulating the system performance.

*n*/

*N*represents the proportion of the preserved data, since part of the data, $ m = N \u2212 n$, is publicized for parameter estimation. $ \chi B E \u03f5 P E$ is the Holevo bound considering the effect of finite size, and the probability that the expression is wrong is

*ϵ*, meaning that the true parameters lie within a certain confidence interval around the estimated channel parameters.

_{PE}*t*and $ \sigma max 2$, which lead to the worst-case secret key rate. Here,

_{min}*t*means the minimum square root of the channel transmittance, and $ \sigma max 2$ means the maximum of the variance of noise. Specifically,

_{min}*erf*is the error function.

*H*corresponds to the Hilbert space of the raw key, $ \u03f5 \xaf$ is a smoothing parameter, and

_{X}*ϵ*is the failure probability.

_{PA}^{356}

#### 3. Information reconciliation

*β*

*H*(

*X*) is the Shannon information of the target bit string,

*leak*represents the information leakage during the public transmission (usually the syndrome), and

*I*is the mutual information between Alice and Bob. The efficiency of information reconciliation plays a crucial role in the final system's secret key rate and the maximal transmission distance, which are seriously affected by the reconciliation strategy. We remark that, the purpose of the reconciliation in a practical system is to optimize the whole system, rather than simply chasing the highest efficiency. It is necessary to balance all resources of the system under a given hardware condition to maximize the transmission distance or secret key rate. The comprehensive optimization method proposed by Ma

_{AB}*et al.*which considers the simultaneous optimization of the modulation variance and error correction matrix achieves a significant improvement of the system performance by at least 24% compared with the previously used optimization methods.

^{357}

The early reconciliation strategy corrects the detection data to make it consistent with the modulation data, so-called the direct reconciliation.^{106} However, the system cannot go beyond 3 dB loss since the potentially leaked information is larger than the information can be utilized be the receiver, which corresponds to the 15 km fiber transmission distance. Aiming at this problem, reverse reconciliation is proposed, where the modulation data are corrected to match the detection data. This enables the system to break the 3 dB limit, making reverse reconciliation the most common information reconciliation strategy in CV-QKD system. The main parameters of the information reconciliation in a CV-QKD system includes the reconciliation efficiency, the frame error rate, the throughput and the SNR range. Different approaches have been explored to increase the reconciliation efficiency for a Gaussian modulation, especially in the regime of a low SNR, detailed in Table IX.

References . | Year . | Method . | SNR (dB) . | Reconciliation efficiency . | Frame error rate (FER) . |
---|---|---|---|---|---|

Van Assche et al.^{351} | 2004 | Slice, turbo | ⋯ | ⋯ | ⋯ |

Lodewyck et al.^{132} | 2007 | Slice, LDPC | ⋯ | 88.7% | ⋯ |

Jouguet et al.^{358} | 2011 | MD, LDPC | 0.4, −7.93, −11.25, −15.38, −18.39, −21.4 | 93.6%, 93.1%, 95.8%, 96.9%, 96.6%, 95.9% | ⋯ |

Jouguet et al.^{359} | 2014 | Slice, LDPC | 0, 4.77, 7.09, 11.63, 18.2 | 94.2%, 94.1%, 94.40%, 95.80%, 94.8% | ⋯ |

Bai et al.^{360} | 2017 | Slice, LDPC | 0, 4.77 | 95.02%, 95.26% | ⋯ |

Wang et al.^{361} | 2018 | MD, LDPC | −15.24 | 96.46% | ⋯ |

Milicevic et al.^{362} | 2018 | MD, LDPC | −15.47, −7.93 | 99.0%, 93.0% | 0.883, 0.04 |

Zhao et al.^{363} | 2018 | MD, polar | −0.46, −0.97, −1.55 | 81%, 88.4%, 97.9% | 0.013, 0.019, 0.04 |

Zhou et al.^{364} | 2019 | MD, raptor | 0, −4, −8, −12, −16, −20 | 95.0%, 95.0%, ∼96.0%, ∼96.0%, ∼97.0%, 98.0% | ⋯ |

Li et al.^{365} | 2020 | MD, LDPC | −7.93, −11.19, −15.23 | 92.9%, 94.6%, 93.8% | 0.17, 0.25, 0.32 |

Yang et al.^{366} | 2020 | Slice, LDPC | 0, 4.77 | 93.0%, 93.06% | 0.14, 0.09 |

Zhang et al.^{139} | 2020 | MD, raptor | −26.38 | 98% | 0.9 |

MD, LDPC | −15.11, −7.43, −3.35 | 96.0%, 96.0%, 96.0% | 0.1, 0.1, 0.1 | ||

Slice, polar | 0.3, 4.48 | 95%, 95% | 0.5, 0.5 | ||

Mani et al.^{367} | 2021 | MD, LDPC | −8.16, −11.34, −15.46, −18.45 | 97.5%, 97.8%, 98.8%, 97.7% | ⋯ |

Jeong et al.^{368} | 2022 | MD, LDPC | −15.25, −14.25, −14.2 | ⋯ | ⋯ |

References . | Year . | Method . | SNR (dB) . | Reconciliation efficiency . | Frame error rate (FER) . |
---|---|---|---|---|---|

Van Assche et al.^{351} | 2004 | Slice, turbo | ⋯ | ⋯ | ⋯ |

Lodewyck et al.^{132} | 2007 | Slice, LDPC | ⋯ | 88.7% | ⋯ |

Jouguet et al.^{358} | 2011 | MD, LDPC | 0.4, −7.93, −11.25, −15.38, −18.39, −21.4 | 93.6%, 93.1%, 95.8%, 96.9%, 96.6%, 95.9% | ⋯ |

Jouguet et al.^{359} | 2014 | Slice, LDPC | 0, 4.77, 7.09, 11.63, 18.2 | 94.2%, 94.1%, 94.40%, 95.80%, 94.8% | ⋯ |

Bai et al.^{360} | 2017 | Slice, LDPC | 0, 4.77 | 95.02%, 95.26% | ⋯ |

Wang et al.^{361} | 2018 | MD, LDPC | −15.24 | 96.46% | ⋯ |

Milicevic et al.^{362} | 2018 | MD, LDPC | −15.47, −7.93 | 99.0%, 93.0% | 0.883, 0.04 |

Zhao et al.^{363} | 2018 | MD, polar | −0.46, −0.97, −1.55 | 81%, 88.4%, 97.9% | 0.013, 0.019, 0.04 |

Zhou et al.^{364} | 2019 | MD, raptor | 0, −4, −8, −12, −16, −20 | 95.0%, 95.0%, ∼96.0%, ∼96.0%, ∼97.0%, 98.0% | ⋯ |

Li et al.^{365} | 2020 | MD, LDPC | −7.93, −11.19, −15.23 | 92.9%, 94.6%, 93.8% | 0.17, 0.25, 0.32 |

Yang et al.^{366} | 2020 | Slice, LDPC | 0, 4.77 | 93.0%, 93.06% | 0.14, 0.09 |

Zhang et al.^{139} | 2020 | MD, raptor | −26.38 | 98% | 0.9 |

MD, LDPC | −15.11, −7.43, −3.35 | 96.0%, 96.0%, 96.0% | 0.1, 0.1, 0.1 | ||

Slice, polar | 0.3, 4.48 | 95%, 95% | 0.5, 0.5 | ||

Mani et al.^{367} | 2021 | MD, LDPC | −8.16, −11.34, −15.46, −18.45 | 97.5%, 97.8%, 98.8%, 97.7% | ⋯ |

Jeong et al.^{368} | 2022 | MD, LDPC | −15.25, −14.25, −14.2 | ⋯ | ⋯ |

Usually, the detection data are converted to discrete format first, then the error correction code for discrete data are used. A first approach is the slice reconciliation using multilevel coding and multistage decoding, as shown in Fig. 21. It is suitable for the detection signal with large SNR, normally more than 0 dB. In principle, this method can extract more than 1 bit of information per pulse. When slice reconciliation is used, the SNR of each layer of data are different, so different error correction codes need to be used for subsequent error correction steps, such as the low density parity check (LDPC) code or the Polar code.

The other method called multidimensional (MD) reconciliation was proposed to be employed for low SNRs, i.e., below 0 dB,^{131,369} which reduces the Gaussian variables reconciliation problem to the discrete variable channel coding problem, shown in Fig. 22. It is suitable for the SNR lower than 0, even to −26 dB, which is the crucial technique for a long-distance CV-QKD system. The multidimensional reconciliation can be combined with the LDPC code or the other codes such as the Raptor codes.^{366} The final reconciliation efficiency one obtains with such a scheme depends on two things: The intrinsic efficiency of the error correcting code used on the virtual channel on the Binary Input Additive White-Gaussian-Noise Channel (BIAWGNC). The quality of the approximation between the virtual channel and the BIAWGNC. One can therefore improve the reconciliation efficiency based on these two points.

In a long distance system where the SNR is low, LDPC code is usually used.^{370–376} The graphical representation of a typical multi-edge-type (MET) LDPC code is shown in Fig. 23. The state-of-the-art decoding throughput can reach 1.44 and 0.78 Gbps for the code rates 0.2 and 0.1, which can support the real-time secret key generation with the speed of 71.89 and 9.97 Mbps in 25 and 50 km.^{376,377} Toward the practical application, the rate adaptive error correction is proposed to support the system with fading SNR.^{378–381} In addition, to raise the utilization rate of the raw data, exchanging the order of parameter estimation and reconciliation is proposed. One can process the parameter estimation after the error correction. In this way, the abandoned data for parameter estimation can be reduced.

#### 4. Privacy amplification

The output of the error correction is a same bit string between Alice and Bob, which can be denoted as *K _{n}* with

*n*bits. Privacy amplification is finally processed to realize the distillation of secret key, of which the requirements are consistent between CV-QKD and DV-QKD. The initial proposed method is aiming at the case of asymptotic limit,

^{382}after that, the leftover hashing is used which extends the it to the finite-size case.

^{383}We denote this operation as

*G*, which is a universal hash function mapping the bit string with length

*N*to

*L*. If the mutual information between eavesdropper and

*K*is known, a proper privacy amplification can make the eavesdropper's knowledge on the final secret key, $ K l = G ( K n )$, close to 0. For practical implementation, the speed of privacy amplification is crucial.

_{n}^{384,385}

## IV. MAINSTREAM IMPLEMENTATIONS

The main purpose of the early CV-QKD systems is to demonstrate the feasibility of the Gaussian modulation and shot-noise limited homodyne detection.^{130} After that, the enhancement of system performance begins. The efficient error correction successfully supports the long distance systems, from 80 and up to 202 km. Meanwhile, different system strctures are proposed and implemented to suppress the excess noise, where the most representative one is the local LO scheme. The overview of the CV-QKD system development is shown in Fig. 24.

The CV-QKD system is heading toward high secret key rate at long distance. For the early CV-QKD systems, the quantum signal and LO are generated by the same laser in the transmitter and co-propagate through the quantum channel. However, the longer transmission distance raises the requirement of the power of LO, which leads to more excess noise caused by the LO leakage. Meanwhile, the transmission of LO in an unsecure quantum channel makes it easy for the manipulation of LO by an eavesdropper, leading to a security loophole. To solve the issues above, the local LO system with the LO generated at the receiver side is proposed. Here, the LO no longer needs to be transmitted through the quantum channel, therefore it never affects the quality of quantum signals and the practical security of the system. However, the system is seriously affected by the phase mismatch between the LO and quantum signal since they are not generated from the same laser source, thus a classical pilot tone generated by the transmitter is necessary in most of the local LO systems for phase recovery.

Though the local LO system still requires the co-propagation of quantum and classical signals, the leakage of the pilot tone will not seriously affect the excess noise, since the requirement of the power of the pilot tone is much lower than the LO. Therefore, the multiplexing of the quantum signal and pilot tone is more flexible. Various multiplexing schemes are proposed to adapt to different hardware configurations and system requirements, such as using the frequency division multiplexing, or further combined with polarization multiplexing in high isolation scenarios. Naturally, raising the repetition frequency contributes to the accuracy of phase tracking and phase noise suppression as we mentioned before. To compensate the influence from the limited hardware resources, DSP is introduced. A highly digitized system can compensate both of the polarization and phase change in digital domain, which significantly simplifies the system structure and leads to a more practical system. In this section, we review the development of the in-line LO and local LO systems, as well as the system co-existed with classical network and the other system schemes such as the free space system and the entanglement-based systems.

### A. In-line LO systems

The main feature of the in-line LO CV-QKD system is that the quantum signal and LO are generated by the same laser, therefore the interference at the receiver is not seriously affected by the signal mismatch. However, the large power difference between the quantum signal and LO makes the leakage of LO significantly affect the quantum signal, which is the main noise source of the system. For instance, the average photon number of a quantum signal is no more than 20, but the average photon number of LO is usually higher than 10^{7} at the receiver site to provide sufficient power for a high-quality shot-noise limited homodyne detection. The leakage of LO leads to the increase in excess noise. Moreover, longer transmission distance requires higher LO launch power. Therefore, higher isolation between quantum signal and LO is required by the long-distance in-line LO system.

The key to reduce the LO leakage is using multiplexing including time-division multiplexing, the polarization multiplexing and the frequency-division multiplexing. The quantum signal and LO are encoded on different dimensions for co-transmission in fiber (that is why we call the in-line LO), and de-multiplexed in physical layer at the receiver.^{130,132–139,293,294,386–388} Now, we review the development of in-line LO CV-QKD systems, including the early systems, the long-distance achievements, the chip-based systems, and the field tests. The details of the representative in-line LO system experiments are concluded in Table X.

. | Years . | Key modules . | Key indicators . | |||
---|---|---|---|---|---|---|

Multiplexing . | Reconciliation . | β (%)
. | L
. _{max} | SKR . | ||

Lab system | 2003 | Transmitting separately | Slice | 85 | 3.1 dB | 75 kbps (Ref. 130) |

2007 | Time | Slice | 89.8 | 25 km | 2 kbps (Ref. 132) | |

2007 | Polarization and frequency | Slice | 89.8 | 5 km | 0.3 bit/pulse (Ref. 293) | |

2013 | Time and polarization | MD | 95 | 80 km | 0.2 kbps (Ref. 133) | |

2016 | Time and polarization | MD | 95.6 | 100 km | 0.5 kbps (Ref. 136) | |

2020 | Time and polarization | MD | 98 | 202.81 km | 6.214 bps (Ref. 139) | |

Field test system | 2012 | Time and polarization | Slice | ∼90 | 17.7 km | 0.3 kbps (Ref. 134) |

2016 | Time and polarization | MD | ∼95 | 17.52 km | 0.2 kbps (Ref. 135) | |

2019 | Time and polarization | MD | 95.1 | 49.85 km | 5.77 kbps (Ref. 137) | |

Chip-based system | 2019 | Time and polarization | MD | 97.99 | 2 m | 0.25 Mbps (Ref. 138) |

. | Years . | Key modules . | Key indicators . | |||
---|---|---|---|---|---|---|

Multiplexing . | Reconciliation . | β (%)
. | L
. _{max} | SKR . | ||

Lab system | 2003 | Transmitting separately | Slice | 85 | 3.1 dB | 75 kbps (Ref. 130) |

2007 | Time | Slice | 89.8 | 25 km | 2 kbps (Ref. 132) | |

2007 | Polarization and frequency | Slice | 89.8 | 5 km | 0.3 bit/pulse (Ref. 293) | |

2013 | Time and polarization | MD | 95 | 80 km | 0.2 kbps (Ref. 133) | |

2016 | Time and polarization | MD | 95.6 | 100 km | 0.5 kbps (Ref. 136) | |

2020 | Time and polarization | MD | 98 | 202.81 km | 6.214 bps (Ref. 139) | |

Field test system | 2012 | Time and polarization | Slice | ∼90 | 17.7 km | 0.3 kbps (Ref. 134) |

2016 | Time and polarization | MD | ∼95 | 17.52 km | 0.2 kbps (Ref. 135) | |

2019 | Time and polarization | MD | 95.1 | 49.85 km | 5.77 kbps (Ref. 137) | |

Chip-based system | 2019 | Time and polarization | MD | 97.99 | 2 m | 0.25 Mbps (Ref. 138) |

#### 1. Early systems

The first CV-QKD system implementation is realized in 2003, as shown in Fig. 25(a), where the secret key rate can reach 1.7 Mbps in a loss free channel and 75 kbps in a channel with 3.1 dB loss.^{130} The system is based on the free space optical devices, working at the wavelength of 780 nm. Reverse reconciliation is first implemented to support a secret key distillation beyond 3 dB limit. The quantum signal and LO are generated from the same laser, where the light outputs from Alice's laser is first divided, part of the light is Gaussian modulated as the quantum signal of coherent states, and the other part of the light is used to provide the LO signal. The Gaussian modulation is realized based on the amplitude and phase modulation method with pulsed light. To compensate the phase difference between quantum signal and LO since they go through different path, training sequence is introduced. These features are reserved and improved in the later fiber based CV-QKD systems.

The first all-fiber CV-QKD system is realized in 2007, where 2 kbps secret key rate is achieved with a 25 km (5.2 dB) optical fiber channel.^{132} The most important enhancement is that the quantum signal and the LO are co-transmitted in the same fiber to reduce the accumulation of phase noise caused by the seperate transmission. As shown in Fig. 25(b), the multiplexing strategy is the time division multiplexing using an unbalanced Mach Zender interferometer (MZI) structure. Specifically, the light from the pulsed laser is divided by a 1:99 beam splitter, where the 1% weak light path is used to generate the modulated coherent states with amplitude and phase modulators, and the strong light is used as the LO. With a variable optical attenuator, the modulated coherent states are attenuated to the quantum level, which is then time-division multiplexed with the LO by combining with a 99:1 coupler, and then transmitted to the receiver side. The optical delay line deployed in the LO path is used to adjust the gap between quantum signal and LO. This time division multiplexing strategy is reserved in the long distance system to enhance the isolation between quantum signal and LO. The de-multiplexing is realized with an unbalanced beam splitter (10:90) to reduce the loss of quantum signal, where the quantum signal with high power is interfered with the low power LO after the beam splitter. A delay line is deployed at the quantum signal path to align the signal pulses. In addition, the automatic system control is introduced into the system, where the average power of the quantum signal is monitored and real-time adjusted to adapt the SNR requirement of error correction. The training sequence is used for synchronizing Alice and Bob, and determining the relative phase between the signal and the LO. An automatic adjustment of the bias voltages that need to be applied to the amplitude modulators in Alice's site is performed in every 10 s. The repetition rate of the system is 350 kHz, the detection efficiency of the detector is 0.606. The modulation variance of the system is 18.5, and the excess noise is 0.005.

Qi *et al.* realized a CV-QKD system over 5 km fibers using polarization and frequency division multiplexing to co-transmit the quantum signals and LO.^{293} The final secret key rate at 5 km is 0.3 bit/pulse. As shown in Fig. 25(c), the quantum signals and LO in different polarizations are combined with a polarization coupler, and de-multiplexed at the receiver by another polarization beam splitter. The frequency division multiplexing is realized with an acousto-optic modulator. By applying both polarization and frequency division multiplexing, the isolation between quantum signal and LO comes up to 70 dB, well preventing the LO leakage. An isolator is placed in the signal arm of Bob's MZI to reduce the noise due to multiple reflections of LO. The phase compensation on hardware layer is replaced by a digital compensation at Alice's site. The noise from the receiver is assumed to be independent from Eve's control, which contributes to the performance enhancement.

#### 2. Long distance achievements

In 2013, the first long-distance CV-QKD system shown in Fig. 26(a) is realized by Jouguet *et al.*, which achieves the secret key rate of over 100 bps at 80 km.^{133} Such an improvement is supported by the optimized reconciliation strategy and system architecture. The multi-dimensional reconciliation first introduced into the practical experiment significantly enhances the reconciliation efficiency of a CV-QKD system, from no more than 90% to 95%. This promotes the developments of long-distance CV-QKD system and supports all of the long-distance CV-QKD system until now. The main features of this experimental system include the polarization and time division multiplexing, the trusted detection noise, the polarization control using a dynamic polarization controller and the clock synchronization with part of the LO. The multiplexing scheme used in this system is widely used for achieving high isolation between quantum signal and LO in most of the long-distance systems.

As shown in Fig. 26(b), Huang *et al.* later realized a CV-QKD system with transmission distance over 100 km and more than 300 bps secret key rate by controlling the excess noise to low level.^{136} An efficient scheme is proposed to perform high-precision phase compensation under low SNR conditions which contributes to the excess noise of 0.015. For system hardware, they developed a low-noise detector, which reduces the requirement of the high LO power.

As shown in Fig. 26(c), the CV-QKD system with the longest transmission distance is realized by Zhang *et al.* at 2020, where the transmission distance can reach 202.81 km, which doubles the previous transmission distance record.^{139} In this work, two amplitude modulators are used for generating pulsed light, then an amplitude and a phase modulator are used for Gaussian modulation, and an amplitude modulator is used to attenuate the modulated light signal to quantum level, as well as enhancing the SNR of frame sequence. Time-division multiplexing and polarization multiplexing are used to ensure sufficient isolation between the co-transmit of quantum signals and LO. Moreover, LO is amplified at the receiver site therefore the requirement of the launch power of LO at the transmitter site is reduced, which is beneficial for reducing the crosstalk. Automatic feedback systems are used to overcome the channel perturbations, and high-precision phase compensation is adopted to supress the excess noise and highly efficient postprocessing is realized to achieve long transmission distances at sufficiently high secret key rates. In addition to the transmission distance of 202.81 km, the system was also tested with the link distance of 27.27, 49.30, 69.53, 99.31, and 140.52 km, where the secret key rate reached 278, 62, 4.28, 1.18, and 0.318 kbps.

The key modules of an in-line LO CV-QKD system are the multiplexing module and the reconciliation module. It can be seen that the development of the reconciliation directly supports the long-distance transmission, where the long transmission distance always combines with high reconciliation efficiency. The multiplexing scheme finally evolves into the time and polarization multiplexing, since this is the simplest method to achieve sufficient isolation between quantum signal and LO.

In addition to the reconciliation and multiplexing, the modulation, monitoring, sampling and compensation techniques are also well developed. The generation of light pulses with high extinction ratio is demonstrated in 2015,^{282} where the extinction ratio overpasses 80 dB by using a double cascaded MZI modulation. Later, the imperfect quantum state preparation is theoretically and experimentally investigated in 2017, which demonstrates that the incorrect calibration of the working parameters for the amplitude modulator and phase modulator can lead to a significant increase in the excess noise and misestimate of the channel loss. Schemes for calibrating the working parameters of the modulators are proposed and demonstrated to solve the imperfect state preparation issue. An LO monitoring scheme is proposed to enhance the practical security of a CV-QKD system.^{301} The LO is monitored by the balanced photodiode, and the SNU is real-time calibrated. The excess noise in the system and its impact on the performance is also investigated.^{388} Finite sampling bandwidth of the analog-to-digital (AD) converter may lead to inaccurate results of pulse peak sampling, which is solved by a dynamic delay adjusting module and a statistical power feedback-control algorithm.^{389}

As for polarization compensation, a feedback algorithm is proposed to stable the system, where a polarization feedback signal is produced by an amplified Root Mean Square to Direct Current conversion by picking out a 10% portion of the LO light in real time.^{390} With the output data, one can estimate the mean value and the standard deviation of the polarization drift. Then, a dynamic polarization controller is deployed at the receiver's site to stable the polarization automatically. For phase noise compensation, a widely used scheme is to insert one frame of training sequence into the quantum signal path, to calculate the expectations and evaluate the phase difference.^{390} Long term stable phase locking is employed to seperately compensate the fast-fading and the slow-fading phase mismatch by adjusting the phase modulator and fiber length.^{391} Later, a novel phase compensation scheme based on an optimal iteration algorithm is proposed to realize the fast-fading phase compensation accurately.^{304}

#### 3. Field tests

In addition to the system in laboratory, field tests of the in-line CV-QKD system are also widely performed. The first field test CV-QKD system is realized by Fossier in 2009,^{340} the system structure is shown in Fig. 27(a). It was automatically operated over 57 h, and achieved a secret key rate of 8 kbps over a 3 dB loss optical fiber. The system is part of the Secure Communication based on Quantum Cryptography (SECOQC) network,^{94} where its practical fiber length is 9 km. Later, the system was used for the encryption of point-to-point communications, which demonstrated the reliability of a CV-QKD system over a long period of time in a server room environment.^{134} The map of the CV-QKD link is shown in Fig. 27(b). The stability of this field test system is studied in detail, and the results show that, the birefringence, and consequently the polarization, in the installed fiber typically varied ten times slower than a laboratory fiber spool of equivalent length, while the phase drift linked to temperature changes in the devices is typically of $ 2 \pi $ every 30 s and these vibrations have a typical frequency of 50–1000 Hz.

A full-mesh 4-node CV-QKD field test is realized in 2016 by Huang *et al.*,^{135} where 6 point-to-point CV-QKD links with distances of 19.92, 35.35, 37.44, 15.34, 17.52, and 2.08 km connect 4 nodes together, as shown in Fig. 27(c). This work adopts wavelength division multiplexing to co-transmit the quantum signal and the essential classical signals for clock synchronization and the forward and backward classical data communication. The reflection caused by the connectors of the field fiber links is well studied, and the results show that the connectors feature a nominal reflectance of −40 dB, and more than 20 reflective events are measured in the experiments.

The longest field test of CV-QKD system is realized in 2019, by Zhang,^{137} through 49.85 km commercial fiber, as shown in Fig. 27(d). By applying an efficient calibration model with one-time evaluation, a rate-adaptive reconciliation method which maintains high reconciliation efficiency with high success probability in fluctuated environments, and a fully automatic control system which stabilizes system noise, a secret key rate which is two orders-of-magnitude higher than the previous field test demonstrations is achieved.

Later, the first network application demonstration with clear application scenarios over a long period of time through existing commercial optical fiber links is tested in Qingdao, China, as shown in Figs. 28(a) and 28(b).^{140} The performance of the 3-node network is tested for a month, where the total length of the application demonstration link is 71.03 km, with a trusted relay in the middle. As shown in Fig. 28(c), the average secret key rate achieves higher than 12.00 kbps over 71.03 km optical fiber line, which paves the way to deploy CV-QKD in metropolitan settings.

#### 4. Systems on chip

Photonic integrated circuit is a promising way to realize a large scale and cost effective system. After the design is finalized, the production cost of the chip will sharply decrease with the increase in production. Therefore, in addition to miniaturizing the system, chipization can also greatly promote the low-cost mass production for the cost sensitive CV-QKD system. The earliest attempt to chip-based CV-QKD systems is in 2015, where a silicon photonic chip comprising all major CV-QKD components as well as complete subsystems are designed and fabricated.^{392}

Later the first chip-based CV-QKD platform is demonstrated in 2019,^{138} where most of the active devices such as the phase modulator, amplitude modulator, optical variable attenuator and homodyne detector are integrated on Silicon-On-Insulator chip, as shown in Fig. 29. The phase and amplitude modulator have a 90% switching time of 2.5 ns, corresponding to a 200 MHz modulation frequency. However, the homodyne detector limits the bandwidth of the system to 10 MHz, mainly affected by the two-stage transimpedance amplifier. The shot noise is 5 dB higher than the electronic noise, and the detection efficiency is 0.498. With these on-chip devices, an in-line LO system is demonstrated. A grating coupler introduces the light from an external laser source into the chip, then an 1:99 directional coupler splits it into two path, where the weak one is used for quantum signal modulation, while the stronger one is the LO. After that, the Gaussian modulated quantum signal and LO are multiplexed into two orthogonal polarization states with a 2D grating coupler, and output to the channel. The receiver uses a 2D grating coupler to separate the quantum signal and LO, then the quantum signal is homodyne detected. The system is tested with a 2 m fiber for proof-of-principle demonstration, the secret key rate can reach 0.25 Mbps.

This work demonstrates that the Silicon-On-Insulator platform can basically satisfy the requirement of a CV-QKD system. A two-dimensional grating coupler integrated on chip can be directly used for the polarization multiplexing and de-multiplexing. The pulse generation, the Gaussian modulation, the variable optical attenuator and the detector are all realized with chip-based components. The insertion loss of the grating coupler, the detection efficiency and the bandwidth of the chip-based detector are the concerns, where a part of these issues are solved in the later works, and we detailed them in the local LO system part. A comparison of the secret key rate of different systems is shown in Fig. 30.

#### 5. Other in-line LO systems

In addition to Gaussian modulation, discrete modulation and unidimensional modulation is also realized with in-line LO system, as shown in Fig. 31. The discrete modulation format has lower requirement for digital to analog conversion, and the unidimensional modulation can be realized with a single amplitude modulator, which are suitable for cost-effective applications. Polarization multiplexing is also used in these systems. The four-state modulation CV-QKD system from Wang *et al.* can reach 1 kbps secret key rate with the transmission distance of 30.2 km,^{393} the four-state modulation CV-QKD system from Hirano *et al.* can reach 50 kbps secret key rate with the transmission distance of 10 km,^{394} and the unidimensional modulated system achieves 5.4 and 0.7 kbps secret key rate at 30 and 50 km.^{395}

### B. Local LO systems

Though the in-line LO system has developed for a long time, some problems are still inevitable. The most critical issue is the security loophole caused by the LO accessible to a potential eavesdropper.^{405–408} The manipulation of LO can make the sender and receiver perform parameter estimation mistakenly, leading to an overestimate of secret key rate. Monitoring the LO can defend part of the attacks, but the loophole still exists and more attacking strategies aiming at it can be continuously developed. In addition, from the system development, when we hope to achieve high key rate by raising the repetition frequency or achieve long distance overcoming the large channel loss, the crosstalk from LO to quantum signal will increase, which weakens the system performance. Therefore, after more than a decade of development, the local LO CV-QKD system without the transmission of LO is proposed.

The local LO system is first proposed in 2015, intends to solve the problems above by generating LO inside the receiver, which is a once and for all solution. Since the quantum signal and the LO are generated by different lasers, a fast-fading phase noise is introduced, leading to the increase in excess noise. The key of a local LO system is to establish a reliable phase reference between the sender and receiver, usually realized by a classical reference signal, namely, pilot tone. When heading toward high-speed system with high repetition rate, the pulsed system with time division multiplexing is no more effective. Considering that the power of pilot tone is low enough so that its leakage is not as much as the in-line transmitted LO, the frequency division multiplexed quantum and pilot tone signals with continuous-wave light becomes the mainstream scheme of the local LO system. In addition, the DSP is introduced to the local LO system for more accurate phase recovery, high speed modulation with continuous-wave light and simpler detection. A review of the evolution of local LO CV-QKD system is shown in Table XI, including the typical systems with different settings, and there are also some noteworthy local LO systems.^{409–411}

. | Years . | Key modules . | Key indicators . | ||||
---|---|---|---|---|---|---|---|

Modulation format . | Modulator . | Multiplexing . | f
. | L
. _{max} | SKR . | ||

Lab systems | 2017 | 8-PSK | DP-MZM | Frequency | 40 Mbaud | 40 km | 0.006 bit/symbol (Ref. 284) |

2020 | Gaussian | AM + PM | Frequency and polarization | 100 MHz | 25 km | 7.04 Mbps (Ref. 285) | |

2022 | QPSK | IQ modulator | Frequency and polarization | 5 Gbaud | 10 km | 133.6 Mbps (Ref. 143) | |

2022 | 256 QAM | IQ modulator | Frequency | 600 Mbaud | 25 km | 24 Mbps (Ref. 145) | |

2022 | 256 QAM | IQ modulator | Frequency and polarization | 1 Gbaud | 50 km | 9.212 Mbps (Ref. 286) | |

2022 | Gaussian | Sagnac fiber loop | Time | 10 MHz | 50 km | 0.08 Mbps (Ref. 396) | |

2023 | Gaussian | IQ modulator | Frequency | 100 MHz | 20 km | 0.0471 bit/symbol (Ref. 287) | |

2023 | 16 state | IQ modulator | Frequency | 2.5 Gbaud | 80 km | 2.11 Mbps (Ref. 397) | |

2023 | Gaussian | IQ modulator | Frequency and polarization | 1 GHz | 100 km | 0.51 Mbps (Ref. 398) | |

2024 | Gaussian | IQ modulator | Frequency | 100 Mbaud | 100 km | 0.0254 Mbps (Ref. 399) | |

Field tests | 2019 | // | // | // | // | 3.9 km | 0.07 Mbps (Ref. 144) |

2023 | Gaussian | // | // | 12.5 Mbaud | 22.5 dB | 0.01 kbps (Ref. 400) | |

2023 | Gaussian | Sagnac fiber loop | Time | 50 kHz | 10.4 km | 1.6 kbps (Ref. 401) | |

Chip-based systems | 2023 | Gaussian | IQ modulator | Frequency | 100 MHz | 6.9 km | 0.28 Mbps (Ref. 402) |

2023 | Gaussian | IQ modulator | Time | 8 MHz | 11 km | 0.4 Mbps (Ref. 403) | |

2023 | Gaussian | IQ modulator | Time | 0.25 Gbaud | 50 km | 0.75 Mbps (Ref. 404) |

. | Years . | Key modules . | Key indicators . | ||||
---|---|---|---|---|---|---|---|

Modulation format . | Modulator . | Multiplexing . | f
. | L
. _{max} | SKR . | ||

Lab systems | 2017 | 8-PSK | DP-MZM | Frequency | 40 Mbaud | 40 km | 0.006 bit/symbol (Ref. 284) |

2020 | Gaussian | AM + PM | Frequency and polarization | 100 MHz | 25 km | 7.04 Mbps (Ref. 285) | |

2022 | QPSK | IQ modulator | Frequency and polarization | 5 Gbaud | 10 km | 133.6 Mbps (Ref. 143) | |

2022 | 256 QAM | IQ modulator | Frequency | 600 Mbaud | 25 km | 24 Mbps (Ref. 145) | |

2022 | 256 QAM | IQ modulator | Frequency and polarization | 1 Gbaud | 50 km | 9.212 Mbps (Ref. 286) | |

2022 | Gaussian | Sagnac fiber loop | Time | 10 MHz | 50 km | 0.08 Mbps (Ref. 396) | |

2023 | Gaussian | IQ modulator | Frequency | 100 MHz | 20 km | 0.0471 bit/symbol (Ref. 287) | |

2023 | 16 state | IQ modulator | Frequency | 2.5 Gbaud | 80 km | 2.11 Mbps (Ref. 397) | |

2023 | Gaussian | IQ modulator | Frequency and polarization | 1 GHz | 100 km | 0.51 Mbps (Ref. 398) | |

2024 | Gaussian | IQ modulator | Frequency | 100 Mbaud | 100 km | 0.0254 Mbps (Ref. 399) | |

Field tests | 2019 | // | // | // | // | 3.9 km | 0.07 Mbps (Ref. 144) |

2023 | Gaussian | // | // | 12.5 Mbaud | 22.5 dB | 0.01 kbps (Ref. 400) | |

2023 | Gaussian | Sagnac fiber loop | Time | 50 kHz | 10.4 km | 1.6 kbps (Ref. 401) | |

Chip-based systems | 2023 | Gaussian | IQ modulator | Frequency | 100 MHz | 6.9 km | 0.28 Mbps (Ref. 402) |

2023 | Gaussian | IQ modulator | Time | 8 MHz | 11 km | 0.4 Mbps (Ref. 403) | |

2023 | Gaussian | IQ modulator | Time | 0.25 Gbaud | 50 km | 0.75 Mbps (Ref. 404) |

#### 1. Early systems

The early experiments adopt a pulsed laser source with LiNbO3 amplitude and phase modulators for generating quantum and pilot tone signals.^{141,142} In the work finished by Qi *et al.*,^{141} the quantum signals and pilot tones are time-division multiplexed and then detected by receivers using heterodyne detection. The sender's and receiver's LO laser sources are free running without any connections, and the heterodyne detection results of the pilot tone provide the phase reference for data rotation. In Soh's work,^{142} the signal and LO are generated from one laser for proof-of-principle demonstration. Homodyne detection is used for detecting the quantum signal and pilot tone. Each pilot tone is sent twice in a pair for the receiver to get both quadratures with homodyne detection.

In the above works, continuous-wave LO signals are adopted, while in Huang's work,^{280} an amplitude modulator is deployed inside the receiver side for generating pulsed LO. The quantum and pilot tone signals are also generated by the same modulation module with time division multiplexing. The commonalities of these early systems are using pulsed light, and time-division multiplexed quantum and pilot tone signals are generated by the same modulation module. The key role of these early systems is verifying the possibility of compensating the phase mismatch between the quantum and LO signal with high precision required in a CV-QKD system using a pilot tone.

#### 2. Systems with continuous-wave light

As we mentioned above, the most crucial issue of a local LO CV-QKD system is the phase recovery with pilot tone. To improve the accuracy of the phase recovery, raising the repetition frequency of the quantum and pilot tone signals for a more accurate track of the phase shift is a direct and effective way. However, the pulsed system with time division multiplexing significantly limits the system repetition frequency. Therefore, it is a general trend to use continuous-wave light instead of pulsed light to support a high speed system.^{283,284} Without time division multiplexing, the repetition rate of the system is significantly enhanced, resulting in a high-rate system with 1 GHz repetition rate.^{143,285,286}

In addition, for the multiplexing of quantum signal and pilot tone, since the high power pilot tone is not necessary required, the quantum signal and pilot tone can be modulated simultaneously with the same modulation module in a frequency division multiplexed scheme.^{283,284} Naturally, by introducing a frequency difference between the quantum signal and LO, a digital heterodyne detection can be realized, where we can use the detection results from one homodyne detector to recover both information of quadratures.^{143,283–286,398} In this way, the experimental demonstration of the system is significantly simplified.

Brunner *et al.* demonstrated a local LO CV-QKD system as shown in Fig. 32(a).^{283} The 4-state discrete modulation of coherent states is realized with quadrature phase-shift keying modulation used in classical communications, and a variable optical attenuator is used to adjust the power to the quantum level. No amplitude modulator for pulse generation is used, instead, a RRC filter in the digital domain completes the pulse shaping. Moreover, combined with an analog electronic low-pass filter at the output of the digital-to-analog (DA) convertor, the quantum signal is concentrated in the 10 MHz bandwidth. Digitally, the quantum signal is up-converted and combined with a pilot tone. To reduce the quantization noise since the weak quantum signal is produced and detected together with a much stronger pilot tone, the DA and AD convertor bit width are 16 and 14 bits, respectively. The heterodyne detection is also performed digitally, the LO is set to have a frequency difference with the quantum signal, and a downconversion in digital domain is then performed to recover the information on both quadratures.

As shown in Fig. 32(b), Kleis *et al.* realized a complete system with the simultaneous modulation of 8 phase-shift keying discrete modulated quantum signal and two pilot tones using a dual-parallel Mach–Zehnder modulator (MZM).^{284} Digital heterodyne detection is used to get both quadratures with a single homodyne detector. This work achieved the secret key rate of $ 6 \xd7 10 \u2212 3$ bit/symbol at 40 km, which shows the way of low-complexity QKD system demonstration within metropolitan distances. The core ideas of the above works is to realize CV-QKD system with continuous-wave light and a structure similar to the classical coherent communications, DSP is widely used in the system, which opens the new way of CV-QKD systems.

Subsequently, the discrete local LO CV-QKD system is extended to high-order modulation formats for better performance. As theoretically analyzed, the increasing of modulation order results in higher secret key rate with most of the security framework of discrete-modulation CV-QKD. Moreover, when the constellation is similar to the Gaussian distribution, the secret key rate of the system can be better than the constellation with uniform distribution. In this guidance, a high-order discrete modulated CV-QKD system is realized with 16-order two-ring phase shift key modulated coherent states.^{397} Compared with the high-order quadrature amplitude modulation, 16-order two-ring phase shift key modulation can be realized with less DA requirements, contributing to suppressing the modulation noise. The achieved secret key rates are 49.02, 11.86, and 2.11 Mbps over 25, 50, and 80 km optical fiber. 67.4%, 70.0%, and 66.5% of the performance of a Gaussian modulated protocol can be achieved with this simpler scheme.

#### 3. Systems with polarization multiplexing

In addition to modulating the quantum signals together with pilot tone, the quantum signals can also be modulated individually and combined with the pilot tone in different polarization directions.^{285,295,398,412,413}

As shown in Fig. 33(a), the optical carrier is first amplitude modulated to generate 250 MHz signal pulses, then sent into the dual-polarization IQ modulator for the modulation of the discrete coherent states and the pilot tone. The quantum signal and pilot tone are multiplexed in different frequency and polarization directions. The receiver performs heterodyne detection of both polarizations after the compensation of a polarization controller. This scheme can help to reduce the excess noise since the isolation between the quantum signal and pilot tone is more sufficient than the frequency division multiplexed method.

Further, a Gaussian modulated system with frequency division multiplexing and polarization multiplexing is realized by Wang *et al.*,^{285} shown in Fig. 33(b). Digital heterodyne detection is used for detecting quantum and pilot tone signals, respectively. It can achieve 7.04 Mbps asymptotic-limit secret key rate at 25 km and 1.85 Mbps with finite-size.

#### 4. Recent progresses

Based on the digital modulation and detection scheme, local LO CV-QKD system is heading toward high secret key rate,^{143} composable security,^{287} and long distance.^{343}

As shown in Fig. 34(a), in Wang's work,^{143} using frequency division multiplexing and polarization multiplexing to transmit the quantum and pilot signal, as well as two digital heterodyne detector for measuring, a system with 4-state discrete modulated coherent states achieved 233.87, 133.6, and 21.53 Mbps secret key rate at 5, 10, and 25 km. This increases the asymptotic secret key rate to sub-Gbps level, which can satisfy the one-time pad cryptographic task. The further investigation on optimizing the practical system parameters shows an effective way to the high-performance system.^{357}

Jain's system with composable security realized 0.0471 bits/symbol secret key rate at 20.3 km with extremely simple devices shown in Fig. 34(b), an IQ modulator produces frequency division multiplexed quantum and pilot signals which are detected by a digital heterodyne detector.^{287} The system is able to generate composable secret keys with $ 2 \xd7 10 8$ coherent states, which is far less than the previous requirements due to improvements to the security proof.

A recent work with the structure shown in Fig. 34(c) can realize a transmission distance over 100 km, and the asymptotic secret key rate can reach 7.55, 1.87, and 0.51 Mbps over transmission distance of 50, 75, and 100 km.^{398} This work significantly increases the transmission distances of a local LO CV-QKD system, and shows a promising way to realize long-distance and high-speed QKD using telecom devices.

### C. CV-QKD systems co-existed with classical communication environment

The homodyne and heterodyne detection in CV-QKD system act as a matched filter since the LO naturally introduces a frequency selection on the received signal, therefore the filter in time and frequency domain is unnecessary. Moreover, the devices in a CV-QKD system is compatible with the classical coherent optical communications. Therefore, CV-QKD is suitable for coexisting with classical signals, which is easy for deployments.

The test of the system co-existing with classical channels was first demonstrated in 2010,^{418} and has been further developed in recent years.^{278,414,419–422} The further test results show that, over a 25 km fiber, a CV-QKD operated over the 1530.12 nm channel can tolerate the noise arising from up to 11.5 dB m classical channel at 1550.12 nm in the forward direction and 9.7 dB m in backward.^{278} The system with 75 km transmission distance can work in the channel with −3 dBm forward classical signals or −9 dBm backward classical signals. These results demonstrate the outstanding capacity of CV-QKD to coexist with classical signals of realistic intensity in optical networks. In 2018, the spontaneous Raman scattering noise of a CV-QKD system co-exisiting with classical channels is investigated, which is the most dominant impairment in a wavelength division multiplexed co-existence environment for CV-QKD.^{414} The setting of the quantum signal and the classical signals in frequency domain is shown in Fig. 35. The influence of the spontaneous Raman scattering noise on a CV-QKD system under different transmission situation is investigated, resulting in a scheme which can support a secret key rate of 90 kbps over 20 km, for an ideal QKD system multiplexed with 2 mW optical power.

A CV-QKD system co-propagates with large-scale C-band dense WDM (DWDM) channels is investigated in 2019.^{423} By operating the quantum signals in S- or L-band, the number of co-propagating channels is doubled. 56 density WDM channels with a total launch power of 14.5 dB m are co-propagated with the quantum signal at the distance of 25 km. Meanwhile, CV-QKD system co-existing with 18.3 Tbps data channels is tested, which contains 100 WDM channels, more than 90 times higher classical bit rate than the previous results,^{279} shown in Fig. 35(b). In 2020, Chu *et al.* investigated the LO quality of an in-line LO system in a co-existing environment, which is normally ignored in former studies. It is shown that, four-wave mixing in excess noise analysis is a visible factor causing LO fluctuation characterized by the statistical properties of the power evolution of LO.^{424}

### D. Others

In this part, we introduce the free space and the entanglement based CV-QKD systems. The free space CV-QKD is crucial for the wide range CV-QKD, which is a promising way to connect two distant parties by using the satellite as the relay. On the other hand, for accessing multiple users in complex environment, free space links can be used to construct an access network with simple system structure. For the value in the long-distance and access network applications, the free space CV-QKD is studied, and some results have been achieved. The entanglement-based CV-QKD systems are suitable to distill secret key bits against the high excess noise, which can be used in the scenario with worse channel situation.

#### 1. Free space systems

Compared to the fiber link, the free space link suffers from the disturbance of atmosphere, leading to the fading channel and the beam wandering. The fluctuation of transmission efficiency and induced extra-excess noise will seriously deteriorate the secure key generation. The atmospheric effects on CV-QKD are studied,^{153,188,425–427} where beam wandering, broadening, deformation, and scintillation are found to be the primary effects to lead to transmittance fluctuation of horizontal link within the boundary layer, and effect of arrival time fluctuations will induce phase excess noise. Except for the fast fading of the channel parameters such as the channel loss and excess noise, the fading of phase also increases the difficulty of phase recovery. Therefore, new coding strategy and phase compensation methods should be developed.

In 2014, a free space continuous-variable quantum communication is demonstrated with a point-to-point free space link of 1.6 km in urban conditions.^{428} Later, a satellite to ground experiment on the quantum limited measurement of the quadrature information is demonstrated,^{413} as shown in Fig. 36(a). A series of technologies are developed to support the measurement of the coherent state generated by the laser communication terminal on the geostationary Earth orbit, including the pointing, acquisition, and tracking system of the Transportable Adaptive Optical Ground Station, the adaptive optics system to process the phase front distortions for launching the beam into a single mode fiber, and an optical phase lock loop to lock the phase between the signal and the LO, where the LO is generated by the laser source inside the ground station. The feasibility of secret key establishment in a satellite-to-ground downlink configuration based on CV-QKD is further examined theoretically, where positive secret key rate can be achieved for low-Earth-orbit scenario. While for higher orbits, no secure keys will be generated when considering the finite-size effects.^{429}

In 2019, the effective resistance against background noise of CV-QKD is theoretically and experimentally demonstrated.^{430} In 2020, as shown in Fig. 36(b), a phase compensation strategy is developed and experimental demonstrated.^{416} This work checks the correlation between data held by Alice and Bob in a free space channel, and proves that the fluctuation of transmittance disappears in the correlation, thus enabling phase compensation for signals over fluctuant channels. Later, a series of methods for free space polarization compensation,^{431} data and transmittance synchronization,^{432} data acquisition^{433} are proposed, and the feasibility of secure key distribution with free space CV-QKD through fog is experimentally demonstrated.^{434} Recently, a passive-state-preparation CV-QKD system shown in Fig. 36(c) with free space channel is experimentally demonstrated.^{417} Thermal-state polarization multiplexing transmitted LO, synchronized channel transmittance monitoring and fine-grained phase compensation techniques are proposed to support a secret key rate of 1.015 Mbps with a free space channel of −15 dB simulated transmittance.

#### 2. Entanglement-based systems

The entanglement-based systems have also been developed in recent years as an alternative approach of the CV-QKD system implementation.^{169,421,435–440} The first entanglement-based CV-QKD system is realized in 2009, a pair of bright EPR entangled beams produced from a non-degenerate optical parametric amplifier is used as the source. The secret key rates of 84 and 3 kbps are achieved agianst collective attack with the channel the transmission efficiency of 80% and 40%.^{435} Later in 2012, a system using modulated fragile entangled states is realized. The system can generate secret key bits against the excess noise of 0.45, which is unable for any coherent state protocols to distill secret key bits.^{169} In 2018, the performance of the entanglement-based CV-QKD system is further enhanced, which can achieve an asymptotic secret key rate of 0.03 (0.01) bit per sample at a channel excess noise level of 0.01 (0.1).^{437}

## V. THE ADVANCED CV-QKD SYSTEM PROGRESS FOR FUTURE APPLICATIONS

The future CV-QKD system will head toward the high-speed and compact integration, rely on full scale DSP and integration with photonic chip. In addition to that, the point-to-multipoint CV-QKD system will be widely applied to support a high-speed quantum access network for end-user access.

### A. Digital CV-QKD systems

Impairment compensation on digital domain can significantly simplify the system structure, contributing to a simple and stable system. The study on classical coherent communications promotes the DSP algorithms in a CV-QKD system. For instance, at the transmitter side, the pulse shaping algorithm is used to raise the availability of the frequency band. For the receiver, the frequency shift is recognized and the downconversion is completed in digital domain, time recovery algorithm is used to obtain the optimal sampling points, digital filter is used to reduce the spectrum mismatch between the transmitter and receiver site, and various of algorithms are developed to distill the parameters of polarization compensation and phase compensation. Thanks to the wide application of DSP in CV-QKD systems, the speed of the system is becoming higher and higher, the latest achievement reaches the baud rate of 10 Gbaud.^{146}

With more DSP algorithms being introduced to the CV-QKD system, the security of the DSP is getting more concerns. The security of the linear DSP algorithms in CV-QKD application is proved in 2023, based on the continuous-mode quantum optics theory.^{441}

For the transmitter, the modulation based on the continuous-wave light and the pulse shaping can be seen as a sequence of coherent states with different temporal modes, which raises the requirement that the pulse shaping function in different period should be integrated orthogonality. The commonly used RRC pulse shaping function can satisfy this defination.

For the receiver, the pilot tone is individually processed for distilling the parameter for impairment compensation of quantum signals. Various algorithms can be used to raise the accuracy of distilling compensation parameters, since the process of pilot tone does not affect the quantum signal, only how to use the parameters for compensation matter. While the processing of quantum signals has two main steps, including the static and dynamic equalization. The static equalization aims to compensating the imperfections of the measurement process to provide the right quadrature measurement results, in which a proper SNU normalization is crucial. After that, the dynamic equalization is performed to compensate the mismatch of the polarization and phase during the transmission in quantum channel. This can be easily mapped to linear quantum optics, for instance, the phase or polarization rotation and beam splitters (attenuation). Therefore, the key of the security is the static equalization, to obtain a reasonable quadrature measurement result.

*t*period, $ D \u0302 t j N$, is defined by a linear function of multiple sampled data $ { D \u0302 t j \u2212 k + i}$

_{j}*θ*to LO) with certain temporal mode, $ \Xi DSP t j$, defined by the hardware features and equalization algorithms:

With digital polarization compensation, the polarization-diversity integrated coherent receiver (ICR) can be used to simplify the system, in which optical polarization controller is no longer required, as shown in Fig. 37. Recently, a dual-polarization local LO CV-QKD system is experimentally demonstrated.^{145} It performs the probability-shaping discrete-modulated 64 and 256 QAM with dual-polarization IQ modulator, and the polarization-diversity ICR is used at receiver side. With all compensation finished in digital domain, it can achieve 91.8 Mbps of secret key rate at 9.5 km and 24 Mbps at 25 km, which can support the high-speed connection within metropolitan distances.

### B. Chip-based local LO systems

The advanced local LO CV-QKD system is developing toward compact module with photonics integration, benefiting from stability and scalability, which enables cost-effective deployments in large-scale. Recently, a series of investigations have been carried out on high-performance chip-based transmitter and receiver for local LO CV-QKD system.^{146,335,402–404,442–445} There are two mainstream fabrication platforms, Silicon-On-Insulator and III–V.

The Silicon-On-Insulator platform has the advantages of low cost and good ductility, which can utilize mature silicon CMOS processes to manufacture optical devices. The refractive index of the silicon waveguide is 3.42, which can form a significant refractive index difference with silicon dioxide, ensuring that the silicon waveguide can have a smaller waveguide bending radius, which is beneficial for high-density device integration. In 2023, a Silicon-On-Insulator CV-QKD receiver for a digital system is tested. The bandwidth is significantly enhanced to 250 MHz which makes detect the frequency division multiplexed quantum and pilot signal possible.^{402} The maximal detection efficiency of the overall receiver is 0.26, with a shot noise-to-electronic-noise ratio of 20 dB at low frequencies and more than 7 dB for 250 MHz. Under the untrusted loss of 1.38 dB, a secret key rate of 280 kbps is achieved with excess noise of 0.1102 at Alice's side. The photonics chip shown in Fig. 38(a) is the CV-QKD receiver designed by Bian *et al.*, which achieves the bandwidth of over 2 GHz and the quantum to classical noise ratio of 5 dB at 2 GHz.^{446} Using the silicon based on-chip receiver with high-efficiency Ge photodiodes, a high-speed system at 10 Gbaud is realized,^{146} as shown in Fig. 38(b). The system is able to generate high secret key rates exceeding 0.7 Gbps over a distance of 5 km and 0.3 Gbps over a distance of 10 km, paving the way of the high-performance and compact CV-QKD system.

However, the Silicon-On-Insulator platform also suffers some issues, such as the low coupling efficiency for the optical signal input, which limits the detection efficiency, and the lack of an integrated high performance light source. The first issue can be solved through device optimization, such as low loss grating couplers and edge couplers. The latter issue is quite challenging, since silicon is not suitable for producing high performance integrated lasers.

One promising solution is using III–V platform such as InP, the other way is making heterogeneous integration, where the III–V chip-based laser is combined with the silicon chip via bonding or growing. Some recent research have shown the feasibility of implementing the above two technical routines. Aldama *et al.* has demonstrated a InP CV-QKD transmitter^{403} including an electro-absorption modulator, an IQ modulator and a variable optical attenuator. These three devices are cascaded and integrated on one chip, supporting more than 1 GHz bandwidth. 0.4 and 2.3 Mbps secret key rate is achieved via a test with 11 km fiber and back-to-back connection, which verifies the possibility of using InP platform to produce a transmitter satisfying the requirement of CV-QKD. Once the laser diode is integrated to the InP chip, a fully integrated CV-QKD chip can be realized.

For chip-based laser diode, Li *et al.* have demonstrated two high-performance on-chip external cavity lasers based on Si3N4 platform for local LO CV-QKD system.^{404} The secret key rate can reach 0.75 Mbps within 50 km fiber and the excess noise is controlled at 0.0579. In conclusion, the last obstacle to the fully chip-based CV-QKD system, which is the integrated light source, is expected to be solved through III–V platform with an overall or heterogeneous integration. The chip-based CV-QKD system is a promising way to realize large-scale, small-size and cost-effective applications.

### C. Point-to-multipoint systems

Quantum access network is an efficient way to realize the point-to-multipoint connection between a network node and massive end users.^{447} There are two mainstream routines, using optical switch with active time-multiplexing control between different end users,^{400} or passive optical network (PON) with simpler network facilities. However, the $ 1 \xd7 N$ beam splitter in a PON significantly increases the equivalent channel loss for individual end users. Moreover, multiplexing techniques are required to seperate different users for upstream configuration.^{448,449} Recently, a downstream point-to-multipoint CV-QKD scheme based on PON is proposed to solve the problems above.^{147} The performance is significantly improved with a multiuser protocol, shown in Fig. 39.

The state preparation and measurement are similar to the Gaussian modulated protocols. One of the key points of this protocol is the multi-user parameter estimation and security analysis, in which all Bobs work together with Alice for a tighter estimation of the potential channel eavesdropping behavior. Specifically, Alice discloses part of the modulation data, denoted as *X ^{est}*, and all Bobs disclose their corresponding detection data, $ Y 1 est , Y 2 est , \u2026 , Y N est$. With these data, the correlations between Alice and Bobs can be estimated, which forms a covariance matrix $ \gamma A B 1 B 2 \u2026 B N$ consists of all trusted modes. Further, the secret key rate between Alice and each Bob can be calculated with $ \gamma A B 1 B 2 \u2026 B N$.

The other key point is the parallel key distillation for all end users, which enhances the secret key rate of the overall network. In this protocol, each prepared quantum state can be measured by all users. Several techniques are developed to suppress the negative influence of the correlation between different end users on system performance. Therefore, all users can generate independent secret keys with the sender at the same time. The simulation results in Bian *et al.* show the ability of supporting 128 end users with more than 100 km distance (see Fig. 40), which can well satisfy the multiuser interconnection requirements within metropolitan distances.^{147}

A high-rate CV-QKD access network is realized, as shown in Fig. 41. For the transmitter, quantum signal is generated with an IQ modulator, which is multiplexed with pilot tone signal with frequency division multiplexing and polarization multiplexing. For the receiver, the de-multiplexing is realized by a polarization controller and a polarization beam splitter. Then, quantum signal and pilot tone are seperately detected by heterodyne detection. The average secret key rate of each user can reach 4.1 Mbps at 15 km when the network capacity is 4, with the repetition frequency of 500 MHz.^{462} When the capacity of the network is extended to 8, the secret key rate for each user can reach 7.44 Mbps at 6 km,^{450} and 3.20 Mbps at 15 km.^{463} This result can well support the quantum access network, such as linking the end users within a campus (see Fig. 42).