The DMCS-BE-QKD protocol executes the following steps.

Quantum communication part:

Key decoding and distillation part:

As depicted in Fig. 1, the decoding rules in step (4) are summarized as follows:

when \Re \left({\alpha }_k\right) > \Im \left({\alpha }_k\right) and {\beta }_y > {\beta }_A C_A, decode key as 0

when \Re \left({\alpha }_k\right) > \Im \left({\alpha }_k\right) and , decode key as 1

when and {\beta }_y > {\beta }_A C_A, decode key as 1

when and , decode key as 0

where C_A = \frac{1}{2} \left(2\Re \left({\alpha }_k\right)+2\Im \left({\alpha }_k\right)\right), and {\beta }_A is the coefficients to give minimum variances of \mathrm{\Delta } X = X_B - {\beta }_A X_A and \mathrm{\Delta } P = P_B - {\beta }_A P_A. When Bob uses the homodyne detector, {\beta }_A = \sqrt{\mathit{T\eta }}, where T is the channel trasmission efficiency and \eta is the efficiency of the detection. When Bob uses the heterodyne detector, {\beta }_A = \sqrt{\mathit{T\eta }/2}. The basic principle of decoding is finding the smaller distance from the Bob's measurement result to the original values of conjugate quadratures. We further discuss several possible situations when Alice conducts the correct and incorrect decoding.

Correct decoding:

when \Re \left({\alpha }_k\right) > \Im \left({\alpha }_k\right), X_B > {\beta }_A C_A or

when , or P_B > {\beta }_A C_A

Incorrect decoding:

when \Re \left({\alpha }_k\right) > \Im \left({\alpha }_k\right), or P_B > {\beta }_A C_A

when , X_B > {\beta }_A C_A or

It should be mentioned that the quantum communication part works the same as the traditional DMCS-CVQKD protocol, while the key decoding and distillation parts run differently.

We divide the overall channel into subchannels, based on Bob's measurement result {\beta }_y. Each subchannel is defined by a specific measurement result {\beta }_y. Then, we can analyze the security of each subchannel to obtain its secret key rate. The secret key rates of subchannels are weighted according to the probability of the subchannel occurrence and summed to obtain the final secret key rate. We can use the probability theory to calculate the classical mutual information between Alice and Bob in the subchannel. For Eve, in the subchannel {\beta }_y = m, the quantum state she obtains when Bob encodes 0 is {\rho }_E^{x=m}, and the quantum state she obtains when Bob encodes 1 is {\rho }_E^{p=m}. Using the density matrix {\rho }_E^{x=m} and {\rho }_E^{p=m}, we can determine the maximum information Eve can obtain in each subchannel. Then, we can easily calcualte the secret key rate of each subchannel and further obtain the overall key rate.

For each subchannel {\beta }_y = m (including X_B = m and P_B = m), the secret key rate of BE-QKD under individual attacks is given bywhere \mathrm{\Pi } represents any group of Eve's positive-operator valued measurements, \mathrm{\Pi } = \left\{{\mathrm{\Pi }}_1,{\mathrm{\Pi }}_2,\dots \right\}. For the subchannel, the secret key rate of BE-QKD under collective attacks is given by [45], where {\chi }_{\mathit{bE}} represents the Holevo bound, the density matrix of the state at E in the subchannel {\beta }_y = m is \begin{array}{c}{\rho }_E^{{\beta }_y=m}=p\left(0_B|{\beta }_y=m\right)\hfill \end{array} \begin{array}{c}{\rho }_E^{x=m}+p\left(1_B|{\beta }_y=m\right){\rho }_E^{p=m}\hfill \end{array}, “ 0_B” represents Bob encodes her key as 0, and “ 1_B” represents Bob encodes her key as 1.

So, the overall key rate of BE-QKD under individual and collective attacks is given by,

We will now discuss the secret key rate of B/QPSK-BE-QKD in the linear Gaussian channel. In the linear Gaussian channel, the channel loss is the coefficient T (i.e., the channel loss can be fully characterized by the coefficient T), and the noise is the additive Gaussian noise that is independent of the input data. The linear Gaussian channel is the most common and important channel in reality, where the attack from Eve is entangling cloner attack [12]. So, we need to discuss the security against individual and collective entangling cloner attacks. The entangling cloner attack is depicted in Fig. 2. Eve first prepares a 2-mode squeezed state (TMSV) with variance V_E = 1 + \frac{\mathit{T\epsilon }}{1-T}, where \epsilon represents the channel excess noise. Then, Eve reserves one mode of TMSV E_2 and coupling another mode E_0 with Alice's outgoing signal B_0 in a beam splitter with transmissivity T. One of the outgoing modes of the beam splitter B_1 is sent to Bob through a lossless channel, and another mode E_1 is reserved by Eve. Finally, Eve performs optimal measurements on the mode E_1 E_2.

In this section, we discuss the secret key rate of DMCS-BE-QKD in the linear Gaussian channel under individual and collective attacks with an arbitrary modulation. A modulation with M coherent state {\left\{\left|{\alpha }_k\right.〉\right\}}_{k=0,..,M-1} is prepared with probabilities {\left\{p_k\right\}}_{k=0,\dots ,M-1}. Then, we calculate the average value of real and imagine parts for coherent states and sort them from small to large to form the set \mathrm{\Upsilon } = {\left\{{\mathrm{\Delta }}_k^C\right\}}_{k=0,\dots ,M_1-1} while removing the same elements (thus, M_1 \le M), where {\mathrm{\Delta }}_k^C = \frac{1}{2} \left(\Re \left({\alpha }_k\right)+\Im \left({\alpha }_k\right)\right). We also define the set K_{x>p} that includes all the indices whose corresponding coherent states' X value is larger than P value. We define the set that includes all the indices whose corresponding coherent states' X value is samller than P value. We define the set {\Omega }_k^1 that includes all the indices whose corresponding coherent state's {\mathrm{\Delta }}^C is \le {\mathrm{\Delta }}_k^C, and define the set {\Omega }_k^2 that includes all the indices whose corresponding coherent state's {\mathrm{\Delta }}^C is \ge {\mathrm{\Delta }}_k^C.

First, we try to calculate the mutual information between Alice and Bob for DMCS-BE-QKD with an arbitrary modulation. We can easily write down all the conditional probabilities of Bob's meansurement results when using the homodyne detection and ignoring the detection efficiency and the electrical noise,Then, we can calculate the probabilities of the subchannel occurrence and probabilities of Bob encoding the key “0” and “1” under the subchannel, We try to calculate the conditional error rate p \left(1_A|0_B,{\beta }_y=m\right) and p \left(0_A|1_B,{\beta }_y=m\right). We will divide the situation into M_1 + 1 types, namely, , , ,..., , m > 2 \sqrt{T} {\Delta }_{M_1-1}^C.

When , we can obtain that, When ( 0 \le k \le M_1 - 2), we can obtain that, When m > 2 \sqrt{T} {\Delta }_{M_1-1}^C, we can obtain that, and thus, we can obtain that, Above all, the mutual information between Alice and Bob for DMCS-BE-QKD with an arbitrary modulation is given by,When keeping the modulation constellation unchanged, just changing the detecting method as heterodyne detecting or considering the detection efficiency and the electrical noise, we can just obey the rule discussed in Supplementary Note I to replace T and \epsilon in Eqs. 25 to 37.

We can use the completely same process discussed above to calculate the leaked information to Eve under individual and collective attacks with an arbitrary modulation. Finally, we are able to calculate the secret key rate in this situation according to Eqs. 23 and 24.

In this section, we perform the numerical simulation of secret key rates for the B/QPSK-BE-QKD protocol in the linear Gaussian channel under individual and collective attacks by the method described above. We calculate secret key rates for the original B/QPSK-CVQKD in the linear channel under collective attacks according to [6]. Since we mainly focus on the physical characteristics of the proposed protocol, the reconciliation efficiency is set to 1 for both the BE scheme and the original scheme in the following simulations. It is noted that the photon number cutoff and the finite number of subchannels have an impact on the security. We observe that the secret key rate does not depend on the specific value of the photon number cutoff parameter N and the number of subchannels provided that they are both larger than 8. Figure 4 shows the secret key rates of B/QPSK-BE-QKD via the channel loss for different channel excess noises in the linear Gaussian channel under individual attacks. Both BPSK and QPSK BE-QKD protocols show high performance in the noise tolerance and the transmission distance. Meanwhile, QPSK-BE-QKD performs better than the BPSK-BE-QKD under individual attacks.

As depicted in Fig. 5, the BPSK-BE-QKD both for homodyne and heterodyne detections can withstand the approximately 30- and 7-dB channel loss under collective attacks when the excess noises \epsilon are 0.02 and 0.05, respectively. However, when the excess noise \epsilon is 0.02 or 0.05, the original BPSK-CVQKD cannot code even when the channel loss is 0 dB. Meanwhile, Fig. S4 shows similar results when considering the effect of the detection efficiency and the electrical noise. Key rate curve for BPSK-BE-QKD with more excess noise selections is shown in Supplementary Note VI. It can be seen that BPSK-BE-QKD is less sensitive to the excess noise compared to the original BPSK-CVQKD.

As shown in Fig. 6, QPSK-BE-QKD can withstand the approximately 50- and 10-dB channel loss under collective attacks when the excess noise \epsilon is 0.02 and 0.05, respectively. QPSK-BE-QKD can tolerate approximately 40 dB and 10 more channel loss compared to the original QPSK-CVQKD when excess noises \epsilon are 0.02 and 0.05, respectively (for standard optical fibers, it is equivalent to extending the distance for about 200 and 50 km, respectively). It shows similar results when considering the imperfection of the detection according to Fig. S5. Key rate curve for QPSK-BE-QKD with more excess noise selections is shown in Supplementary Note VI. It is noted that the low bound of the key rate obtained in [6] is not tight enough, and both the BE protocol itself and the security analysis method may contribute to these observed improvements in terms of the tolerable channel loss and excess noise. The exact proportion of the contribution that the above 2 factors make is still unknown and requires further study. In addition, it is noted that Lin et al. [17] reflected the best performance of the current QPSK-CVQKD scheme under the general collective attack. According to the above results, QPSK-BE-QKD with linear Gaussian channel assumption can tolerate several dB more channel loss compared to the result in [17]. We will broadly discuss the performance potential of QPSK-BE-QKD if they are all under general collective attack conditions. Under the general collective attack, we need to traverse all possible states at {\mathit{AB}}_1 and all possible purification of {\rho }_{{\mathit{AB}}_1} (since the state at Eve can be any purification of {\rho }_{{\mathit{AB}}_1}), and then the secret key rate is calculated using the maximum corresponding leaked information. We prove that the leaked information for DMCS-BE-QKD remains unchanged for different purification of {\rho }_{{\mathit{AB}}_1} in Supplementary Note V and conduct the partly traverse for possible {\rho }_{{\mathit{AB}}_1} by the semi-definite programming [17]. As shown in Fig. S6, it can be seen that all the secret key rates for QPSK-BE-QKD under possible collective attacks we partly traversed are not less than the secret key rate under the collective entangling clone attack. This suggests that QPSK-BE-QKD has some potential to have a performance advantage over conventional QPSK-CVQKD under general collective attacks. It can also be seen from Fig. 6 that QPSK-BE-QKD can achieve the higher secret key rate and the longer distance than the BPSK-BE-QKD under collective attacks, which is consistent with the conclusion obtained under individual attacks. This is because the overall mutual information between Alice and Bob for QPSK-BE-QKD and BPSK-BE-QKD can be considered approximately equal (because the overall average bit error rates between Alice and Bob for these 2 protocols are completely the same, where the bit error rate only depends on the absolute value of the difference between the X and P components of each constellation point). At the same time, the constellation diagram of QPSK-BE-QKD will decrease the orthogonality between the conditional quantum states {\rho }_E^{x=m} and {\rho }_E^{p=m} while making it more difficult for Eve to conduct the maximum mutual information discrimination of {\rho }_E^{x=m} and {\rho }_E^{p=m}. Above all, B/QPSK-BE-QKD can quite improve the secure transmission distance and the tolerable channel excess noise.

Figure 7 shows secret key rates of B/QPSK-BE-QKD via the modulation variance in the linear Gaussian channel under collective attacks. The result shows that the modulation variance V_A has its best value for B/QPSK-BE-QKD. The best value of the modulation variance V_A is 0.49 and 1.04 for BPSK-BE-QKD and QPSK-BE-QKD, respectively.

Then, we further study the relationship between the modulation constellation and the secret key for BPSK-BE-QKD. As shown in Fig. 8A, we translate the constellation points along the y = x axis. The calculation of the mutual information between Alice and Bob in this situation is detailed in Supplementary Note I. The calculation of the leaked information to Eve for this situation is completely the same with the discussion above, because changing the constellation diagram only changes {\alpha }_k in Eq. 12, and we can still use Eqs. 3, 12, to 22 to calculate the leaked information. Figure 9A shows secret key rates of BPSK-BE-QKD via the translation distance \mathrm{\Delta }. It can be seen that translating the constellation points along the y = x axis will not influence the secret key rate for BPSK-BE-QKD. Because no matter how the constellation points are translated along the y = x axis, the probability density curves of the corresponding detection values when Bob performs the X and P measurements are always exactly the same. So, translation along the y = x axis will not affect the performance of judging whether Bob performs an X or P measurement for both Alice and Eve and thus will not affect the secret key rate. Then, we rotate the constellation points around the original point as depicted in Fig. 8B. The calculation of the mutual information between Alice and Bob for this constellation is detailed in Supplementary Note I. As shown in Fig. 9B, the more rotations relative to the y = - x axis, the lower the secret key rate is. When constellation points are located at y = - x, i.e., the rotation angle is 0, the secret key rate achieves its maximum. We can find that the symmetry relative to the y = x axis is beneficial for BPSK-BE-QKD. Because as the rotation angle increases, the difference between the probability density curves of the corresponding detection values when Bob performs the X and P measurements will become larger. This will help Eve gain an information advantage in the base selection information, resulting in a relatively lower secret key rate.

We finally study the relationship between the modulation constellation and the secret key for QPSK-BE-QKD. We translate the constellation points in 2 different ways. As depicted in Fig. 10A, in the first way, we translate all the constellation points along the y = x axis while fixing the constellation as a regular prism. In the second way, we translate 2 of the constellation points along the y = x axis while fixing the other 2 constellation points at ( - a, 0) and (0, - \mathit{ai}), as shown in Fig. 10B. As depicted in Fig. 11A, we observe that translating all the constellation points along the y = x axis does not affect the secret key rate, similar to the protocol property observed in BPSK-BE-QKD. It is because of the similar reason discussed for Fig. 9A, i.e., the probability density curves of the corresponding detection values when Bob performs the X and P measurements are always exactly the same while translating all the constellation points along the y = x axis. As shown in Fig. 11B, we know that if we fix 2 constellation points and translate the other 2 constellations along the y = x axis, the secret key rate has its maximum value and the translation distance has its best value (i.e., the modulation constellation has its best shape). We can find that in this situation, the best shape of the modulation constellation is the rectangle. This is because only translating 2 of the constellation diagram's 4 points along the y = x axis will cause the amount of information leaked to Eve to first decrease and then increase. Meanwhile, the overall mutual information between Alice and Bob can be seen as approximately equal, because the overall average bit error rate between Alice and Bob remains completely unchanged. Thus, the secret key rate will first increase and then decrease.

To verify the feasibility of the BE-QKD protocol, we conduct an experiment demonstration of QPSK-BE-QKD under the 50.5-km optical fiber. The experiment step of QPSK-BE-QKD is demonstrated in Fig. 12. At the Alice site, a narrow-linewidth continous-wave (CW) laser with 100-Hz linewidth (NKT Koheras BASIK X15) is used to generate the optical carrier, followed by an optical isolator (ISO) to prevent the reflected light transmitting into the laser. Then, the optical light is splitted into 2 parts by the 50:50 beam splitter 1 (BS1). One part is transmitted to the Bob site to serve as a local osillator (LO), and the 90:10 BS3 is deployed to monitor the power of the LO. The other part served as the signal (SIG). Here, we used the pilot sequence scheme [48], where we alternately generate the pilot signal and the quantum signal. The amplitude of the pilot signal is 10 times larger than the quantum signal. It is used as the reference signal with the fixed amplitude and phase to help find the peak point of the pulse for Bob and correct the fast phase drift of quantum signals [48] due to the inconsistency in the arrival time of LO and SIG light at the receiver. SIG light is first sent into the phase modulator (PM; EOSPACE) to achieve the QPSK modulation (modulated as 4 states \left|a\right.〉, \left|\mathit{ai}\right.〉, \left|-a\right.〉, and \left|-\mathit{ai}\right.〉, where a = \sqrt{V_A/2}). Meanwhile, an arbitrary wave generator (AWG; Tektronix, AWG5200) is used to output a electronic analog signals \theta \left(t\right) with the 50-MHz symbol rate to the PM, where \theta \left(t\right) is controlled by random number data. When the random number is \left\{0,1,2,3\right\}, \theta \left(t\right) = \left\{0,\frac{V_{\pi }}{2},V_{\pi },-\frac{V_{\pi }}{2}\right\}, where V_{\pi } is the half-wave voltage for PM. An ultra-high-extinction-ratio amplitude modulator (AM; EOSPACE) is deployed to cut the CW SIG light into pulse light with the 20% duty cycle. It is also controlled by the electronic analogy signal generated by the AWG, and its direct current (DC) bias voltage is provided by a DC stabilized power. Moreover, the phase of the modulation of the pilot signal is fixed to 0 (i.e., \theta \left(t\right) = 0), and we make its amplitude 10 times that of the quantum signal by the AM. Then, the SIG light is attenuated by variable optical attenuator (VOA) to control the modulation variance V_A. A 90:10 BS2 monitors the channel input optical power in real time, followed by a 50.5-km fiber channel with 11 dB. It is noted that the channel is assumed to be fully controlled by Eve.

At the Bob site, a polarization controller (PC) is deployed to adjust the polarization of the SIG light to minimize the component on the V polarization of the SIG light as much as possible. Then, the LO and SIG lights are injected into the integrated conherent receiver (ICR; FUJITSU) circuit to measure the X and P quadratures, and randomly choose one of them as final measurement results. The detected signals are sampled by a real-time oscilloscope (OSC; Lecroy, WaveRunner 9404M-MS) with 1 GSamples/s sampling rate (20 sample points for one symbol). In the end, Bob announces the measurement results publicly and Alice tries to guess the measurement bases according to the decoding rule. The quantum efficiency is \eta = 0.48. The electrical noise v_{\mathit{el}} = 0.0997 (shot noise units), which is calibrated by sampling data without connecting the LO. Moreover, the frame length we used is10⁵.

Then, we first need to find the peak point for each pulse. We calculate the power of the first 4 × 10⁵ sampling data and find its maximum value P_i. The corresponding index i mod 20 is the optimal sampling position. Then, we can extract the final sampling data at every 20 points from the optimal sampling position. Then, we use the pilot signal data to correct the fast phase drift of the quantum signal data. We directly use the phase angle of the 2 pilot signals to rotate the quantum signal and recover the quantum signal with the following formula: where x_j^p and p_j^p are the X and P component of the jth pilot signal, and x_j^q and p_j^q are the X and P components of the jth quantum signal.

In order to obtain the correlation between modulation data and receive data, we need to achieve the precise frame synchronization. We use a robust synchronizaion method proposed in [49] to find the frame header. The synchronization result is shown in Fig. 13. We observe that the correlation between the frame synchronization sequence and the received frame reaches its peak at index 48159, which is significantly higher than other indices. So, we successfully achieve the frame synchronization to get the correlation between modulation data and receive data. Then, we compensate the slow phase drift due to the slow fluctuation of the transmission path length [50]. We also analyze the occurrence probabilities and the bit error rate between Alice and Bob for different measurement results {\beta }_y, as depicted in Fig. 14. The results show that the experimental value is consistent with the theoretical curve, where the theortical curve can be calculated according to the mutual information analysis above. Finally, we conduct the parameter evaluation, and the measured excess noises of 30 frames are shown in Fig. 15. We get that the mean modulation variance V_A is 1.003 and the mean excess noise \epsilon is 0.02716. Meanwhile, we use a high-efficient information reconcilization algorithm [51] to make the reconcilization efficiency \beta reach 96.58%. Based on the calculation method for the secret key rate discussed above, we finally obtain the 13.12-kbps secret key rate under the 50.5-km optical fiber with 11-dB loss, as shown in Fig. 16. Based on the estimated parameters in the experiment, our QPSK-BE-QKD can theoretically sustain secure key generation under the 33-dB channel loss. It is noted that based on the same parameters estimated in our experiment except the modulation variance V_A (we set its V_A to the optimal value obtained through traversal), the original QPSK-CVQKD can only tolerate a maximum channel loss of approximately 10 dB.