Probabilistic Amplitude Shaping for Continuous-Variable Quantum Key Distribution With Discrete Modulation Over a Wiretap Channel

To achieve the maximum information transfer and face a possible eavesdropper, the samples transmitted in continuous-variable quantum key distribution (CV-QKD) protocols are to be drawn from a continuous Gaussian distribution. As a matter of fact, in practical implementations the transmitter has a finite (power) dynamics and the Gaussian sampling can be only approximated. This requires the quantum protocols to operate at small powers. In this paper, we show that a suitable probabilistic amplitude shaping of a finite set of symbols allows to approximate at will the optimal channel capacity also for increasing average powers. We investigate the feasibility of this approach in the framework of CV-QKD, propose a protocol employing discrete quadrature amplitude modulation assisted with probabilistic amplitude shaping, and we perform the key generation rate analysis assuming a wiretap channel and lossless homodyne detection.


I. INTRODUCTION
C URRENT cryptographic systems for communications security are mostly based on either public-key cryptography, providing only conditional security [1], or the one-time pad [2], offering unconditional security (guaranteed by information theory) but with much less practical implementation [3].Thus, a possible solution to the key distribution problem is offered by quantum key distribution (QKD) protocols [4]- [6], in which two distant parties (Alice and Bob) share a secret key by exchanging quantum states through an untrusted quantum channel under the control of an eavesdropper (Eve).
The very laws of quantum mechanics guarantee unconditional security of QKD protocols [7]; any measurement of the Enrico Forestieri, Emanuele Parente and Marco Secondini are with the TeCIP Institute, Scuola Superiore Sant'Anna, I-56124, Pisa, Italy, and also with National Laboratory of Photonic Networks, CNIT, I-56124 Pisa, Italy (e-mail: marco.secondini@santannapisa.it).
Luca Potì is with the National Laboratory of Photonic Networks, CNIT, I-56124 Pisa, Italy.quantum states performed by Eve leaves a trace on the states themselves, allowing Alice and Bob to detect the intrusion, evaluate the amount of information possibly gained by Eve, and discard the key if necessary [8].
A promising approach to QKD is the one based on continuous variables (CVs) [6], [9]- [13].With respect to discretevariable (DV) protocols [4], in which single photons are typically used as information carriers, CV protocols use coherent states [14] (namely, laser pulses) to carry information, exactly as in classical communication systems.Unlike DV-QKD, CV-QKD does not require single-photon sources and detectors and can use the same devices and modulation/detection schemes commonly employed in classical coherent optical communications [15]- [17].Therefore, we expect that the implementation of a CV-QKD system could also benefit from the use of the most effective modulation/detection techniques and digital processing strategies that have been developed for classical systems in the last years.
Nevertheless, an important issue concerning CV-QKD is the modulation of coherent states.Although the first CV-QKD protocols were originally based on discrete modulations [9], [18], [19], in the protocol proposed by Grosshans and Grangier in 2002 (GG02) the states are modulated with a Gaussian distribution [6], [10]- [12].This choice is related to the fundamental objective of maximizing the key generation rate (KGR), that is, the length of the secret key shared by Alice and Bob per unit time [20], [21].Indeed, the actual KGR of a QKD system is limited by the difference between the amount of information that can be reliably transmitted from Alice to Bob per unit time and that obtainable by Eve.The maximization of the first quantity (which yields the channel capacity) is a classical problem in digital communications and is achieved with a Gaussian input distribution.
Although justified on a theoretical level, Gaussian modulation involves several practical difficulties and is never used in classical digital communication systems for a twofold reason [22], [23].The main drawback is that any realistic transmitter may generate signals up to a certain maximum peak power (e.g. by modulating the light emitted by a laser), whereas sampling a Gaussian distribution implies a nonzero probability of drawing a very large sample, and this probability increases with the average input power.Hence, to avoid exceeding the maximum peak power, the system has to be operated at small average power.For example, if we want to generate a zeromean Gaussian symbol  with variance  2 , but we are limited by hardware constraints to the range | | <  max , we must ensure that  max > 6 to make the probability that  exceeds the allowed range negligible (lower than 2 × 10 −6 in this example).This means that the average transmitted power, proportional to  2 , must be at least 36 times (15.6 dB) smaller than the maximum peak power.proportional to  2 max .Furthermore, from the implementation point of view, the inevitable use of analog-to-digital converters with finite resolution and dynamic range at the transmitter introduces a discretization of the sampling distribution.Thus, a more feasible way to perform quantum communication at higher average power without exceeding the transmitter dynamics and available resolution is that of employing discrete modulation formats of appropriate order.
CV-QKD employing discrete modulation has been approached with uniform phase-shift-keying (PSK) modulation [24]- [36], obtaining a lower KGR with respect to the GG02 scheme.However, in a practical scenario the GG02 protocol exhibits a lower reconciliation efficiency [24], making PSK still worth of interest.Nevertheless, for a large PSK constellation increasing further the number of symbols brings only a negligible advantage [34].To overcome these limitations, also amplitude-phase-shift-keying (APSK) formats have been investigated [37]- [39].
More recently, quadrature-amplitude modulation (QAM) of a regular grid of signals has been proposed as a promising solution [34], [40], [41].Differently from PSK, QAM constellations may employ a non-uniform discrete probability distribution of the symbols that approximates better the Gaussian one, thus obtaining a higher KGR closer to GG02.To implement this non-uniform sampling, probabilistic amplitude shaping (PAS) is a practical coded modulation scheme that combines QAM, probabilistic constellation shaping, and forward error correction (FEC) to closely approach optimal channel capacity [42]- [44].PAS uses a distribution matcher to map uniformly distributed information bits on QAM symbols with the desired target distribution [47]- [49].In particular, a Maxwell-Boltzmann target distribution is considered, which maximizes the source entropy for a given discrete constellation and mean energy per symbol [50] (in practice, lower-energy symbols are used more often than higher-energy symbols, reducing the energy required to achieve a certain information rate).
PAS can be easily combined with the efficient FEC codes and the corresponding decoding algorithms commonly employed in digital communications (e.g., binary LDPC codes with iterative belief propagation), obtaining an excellent tradeoff between performance and complexity [43], [51], [52].Ease of implementation, nearly optimal performance, fine rate tunability, and compatibility with existing devices and techniques make PAS one of the most popular solutions for the latest generation of coherent optical systems.These considerations suggest that a similar solution might be convenient also for CV-QKD.
In this work, we consider a CV-QKD protocol implemented thrugh QAM modulation of coherent states and homodyne detection.We consider both uniform sampling of the coherent states and non-uniform generation assisted with PAS [42], Figure 1.Schematic representation of the CV-QKD protocol discussed in the paper for a discrete modulation format.Alice generates symbols  =   ,   by samping either a uniform distribution P () (case I) or a Maxwell-Boltzmann distribution M  () (case II), encodes them onto |  +   and sends them to Bob through an untrusted pure-loss channel.Bob investigates the channel by performing a homodyne measurement of / , chosen at random.In this scenario, Eve only collects the fraction of the signals lost during the propagation through the channel.[44].To address the performance of the protocol, here we perform a KGR analysis for a quantum wiretap channel [45], [46].In this scenario, Eve does not alter the nature of the quantum channel connecting Alice and Bob, being only limited to collect the lost fraction of the signals exchanged and to hide behind the channel excess noise.Although this assumption is not sufficient to prove unconditional security, it provides a realistic model and a useful benchmark for many practical scenarios (e.g.free space communications) [53].Accordingly, the paper focuses on the task of key rate optimization rather than providing a security analysis under arbitrary eavesdropping attacks.In particular, we consider different QAM constellations [54], [55], optimize the shaping parameter and compare the performance with and without PAS with respect to a PSK modulation with the same number of symbols and the original GG02 scheme.At first, we address the case of a pure-loss channel and, thereafter, discuss the effects of thermal noise on the obtained results.
The structure of the paper is the following.In Sec.II we present our proposal of a CV-QKD scheme employing discrete modulation and based on standard probabilistic shaping, namely, optimizing the discrete probability distribution over the capacity of the channel, whilst in Sec.III we address the effect of the channel excess noise on the obtained results.Then, in Sec.IV we propose a new optimization procedure for PAS and discuss its performance.Finally, in Sec.V we close the paper by drawing some concluding remarks and their future developments.

II. CV-QKD WITH QAM DISCRETE MODULATION AND
PAS In this paper we investigate the protocol for CV-QKD employing discrete modulation depicted in Fig. 1.The sender, Alice (), encodes the information on several laser pulses described by coherent states |  +   , where   ,   ∈ R are randomly generated according to a discrete-valued probability distribution.These states are sent to the receiver, Bob (), through an untrusted quantum channel which may be attacked by an eavesdropper, Eve ().
Once received the signals, Bob probes them by implementing the measurement of one of the two orthogonal quadratures  or , [, ] = 2 2 0 , where  2 0 represents the shot-noise variance, that is the vacuum fluctuations The QAM16 constellation ( = 4), represented in both the (classical) complex space of coherent amplitudes and the (quantum) phase space.
The measured quadrature is chosen at random and implemented by performing homodyne detection [14].Without loss of generality, to carry on the security analysis we can assume that Bob measures .From now on we will consider shot-noise units, that is  2 0 = 1.Then, Alice and Bob share some correlated classical information through a classical authenticated channel, the so-called reconciliation process: we have either direct or reverse reconciliation (DR) if information is publicly shared by Alice or Bob, respectively [12], [56], [57].After a privacy amplification stage [12], they are finally able to generate a random secure key.
Standard optical fibers are well-modeled by thermal-loss channels [15], [16].However, the numerical analysis of such systems is computationally demanding.Therefore, here we deal with a simpler scenario and assume a pure-loss channel, whilst the impact of a non-zero channel excess noise on the present protocol will be discussed in Sec.III.The pure-loss channel is described by means of a beam splitter with transmissivity  = 10 −0.1  , where  is the transmission distance in km, and  = 0.2 dB/km is the loss rate of common fibers [58]- [60].In this case, it is possible to perform CV-QKD up to a large maximum transmission distance depending only on the imperfect reconciliation process [24]- [26], [34].As a consequence, the goal of this section is to compare the QAM modulation with both the already existing PSK schemes and the Gaussian-modulated GG02 protocol in order to establish a hierarchy between these cases.In fact, the GG02 scheme is the one that maximize the mutual information in key distribution (see App. A), providing a benchmark in evaluating the performance of the presented results.On the other hand, both PSK and QAM represent sub-optimal modulation formats for quantum communications, thus their comparison is worth of interest also for CV-QKD.In the following we will analyze in detail each step of the proposed protocol, performing a complete security analysis.

A. Modulation stage
The QAM format adopted by Alice works as follows [54], [55].She draws each couple (  ,   ) from the finite set contains  = 2  points,  ∈ N, and Δ ∈ R. Therefore, she has the constellation A of  ×  symbols depicted in the left panel of Fig. 2, corresponding to a square lattice with pace Δ.It is worth noting that in the standard communication notation the points in Λ are commonly placed at distance 2Δ between one another [54], with Δ a scaling factor that determines the mean energy per symbol.Here, for the sake of simplicity, we adopt a different convention by letting such a distance be equal to Δ, which is hence referred to indifferently as scaling factor or symbol spacing.Each couple (  ,   ) is then encoded on its corresponding coherent state |  +   , so that the constellation A is mapped into the (quantum) phase space [61] as a square lattice of  ×  coherent states centred in (2 0   , 2 0   ) and with pace 2 0 Δ (right panel of Fig. 2).
Concerning the probability distributions to sample   and   , here we discuss two alternative possibilities.The former, referred to as case I, is the uniform distribution P () =  −1 , ( =   ,   ), commonly exploited in classical communications [54] and quantum-state-discrimination schemes [55].The latter, case II, is the Maxwell-Boltzmann distribution (MB) [50], [62] =   − 2 being the normalization constant.Though being widely deployed in practice, the uniform distribution is largely suboptimal, as it requires up to 1.53 dB more energy per symbol to achieve the same mutual information as the capacity-achieving Gaussian distribution over the additive white Gaussian noise (AWGN) channel [50].On the other hand, the MB distribution is the maximum-entropy distribution for a discrete random variable with given variance (mean energy) [62] and, for a sufficiently large QAM constellation, it has been shown to closely approach channel capacity over the AWGN channel, practically closing the 1.53 dB gap of uniform QAM constellations [42].
The MB distribution depends on the free parameter  (the "inverse temperature") which we shall adjust properly to maximize the performance of the protocol, as discussed in the following subsection.From a practical point of view, the i.i.d.MB-distributed symbols required in case II can be generated by the PAS scheme proposed in [42], where a distribution matcher maps a sequence of uniform i.i.d.random bits (in our case, the raw key generated for instance by a quantum random number generator) to a sequence of QAM symbols with the desired distribution.In particular, different distribution-matching algorithms have been proposed, such as constant composition distribution matching [47], enumerative sphere shaping [49], and hierarchical distribution matching [48], which can approach the ideal target distribution (i.i.d.MB symbols) with arbitrary accuracy for sufficiently long sequences.
Though we do not claim the theoretical optimality of the proposed MB distribution in terms of KGR, in the following we shall show numerically that it provides a significant advantage over the uniform distribution and closely approach the KGR of the original GG02 protocol.In particular, we shall discuss the behavior of the present protocol when Alice has the relevant constellations QAM16 and QAM64, associated with the values  = 4, 8, respectively.

B. Choice of the constellation parameters
First of all, we present the procedure employed to assign the appropriate values for  and Δ.We fix the spacing Δ by introducing a constraint on the constellation energy.If the mean energy per symbol is equal to n, the appropriate Δ is obtained by setting the variance of the sampling distribution equal to n/2, namely such that the overall state by Alice is described by the density matrix having mean energy n.For case I, Eq. (2a) leads to the solution: The corresponding mutual information between Alice and Bob reads where   |   and  (I)  are the Shannon entropies associated with Bob's conditional probability distribution namely, and Bob's average probability distribution The Shannon entropy of  (I)  (  ) has to be computed via numeric integration.In particular, in our calculations we exploited the Simpson's rule [63].
On the contrary, Eq. (2b) can be handled numerically for case II and the corresponding numeric solution Δ (II) () exhibits an implicit dependence on the free parameter .Therefore, in this scenario we decided to optimize  to achieve the maximum mutual information between Alice and Bob  as a function of the modulation energy n.For a better clarity we reported on the x-axis also the energy of Bob's signals  n.The black line is the capacity of the channel, achieved with Gaussian modulation (see App. A).In both the plots we fixed  = 10 km (2 dB attenuation).
where  (II)   is the Shannon entropy associated with the distribution to be computed numerically with the Simpson's rule [63].
Thereafter, the maximization of  (II)  () has been performed with a golden-section search algorithm [63].This procedure leads to the optimized inverse temperature  (II) and, consequently, its associated spacing Δ (II) , together with the optimized mutual information The numerical results are shown in Fig. 3 (top panel) for the case of a QAM16 constellation as a function of the mean energy per symbol n and at fixed transmission distance  = 10 km.The behavior is expected to be qualitatively equivalent for all distances.The optimal inverse temperature  (II) is a decreasing function of n.As we can see, for small values of n, only the lowest-energy level of the MB in (1) have nonzero probability,  (II) → ∞, so that the optimal constellation tends to a simple QAM4, i.e. with  = 2; on the other hand, for large n, all the levels of the MB distribution have the same probability,  (II) → 0, so that the optimal constellation tends to a uniform QAM16.Accordingly, the non-uniform sampling of the symbols makes the spacing Δ (II) an increasing function of the energy such that Δ (II) ≥ Δ (I) .
The corresponding mutual information, plotted in the bottom panel of Fig. 3, shows that the MB sampling increases the information shared between Alice and Bob, as  (II)   ≥  (I)  .Moreover, in accordance with the previous considerations, for n 1 all the QAM modulation formats are able to reach the capacity of the channel, achieved with Gaussian modulation (see App. A); the higher , the larger the region where the QAM format performs optimally.Instead, in the large energy regime the sampling distribution becomes more and more uniform and all the curves saturate to the maximum possible entropy of the constellation, namely log 2 ().

C. KGR analysis
Given the parameters  and Δ, we perform the KGR analysis for the quantum wiretap channel [45], [46], [53].In particular, we focus on the relevant case of reverse reconciliation.We remark that the present analysis is not sufficient to guarantee unconditional security, as Eve in principle may attack the channel and insert some suitable non-Gaussian features without being intercepted by Alice and Bob.A complete security analysis for this protocol may be carried on by exploiting the optimality of Gaussian attacks [34], [64]- [67] and will be the object of future publications.Nevertheless, wiretap channels are gaining interest as they represent a realistic eavesdropping model, being feasible with the current technologies [46], [53].
Moreover, we note that the uniform distribution may be retrieved from Eq. ( 1) by fixing  = 0. Thus, for the sake of simplicity in the following we will perform the entire analysis by considering the sole MB distribution, assuming that cases I and II correspond to  = 0 and  =  (II) , respectively.
As depicted in Fig. 1, the pure-loss quantum wiretap channel is modeled as a beam splitter of transmissivity  in which Eve has only access to its second port, intercepting the reflected fraction 1 −  of Alice's signal.In where  ≤ 1 is the reconciliation efficiency [26], [30] and is the Holevo information shared between Bob and Eve [68].
We recast the problem in the prepare-and-measure picture [6], [10], [11], [67], where the Holevo information reads where is the overall Eve's state, (  ) is Bob's probability distribution in Eq.s ( 8) and (10),  To calculate these quantum states we start from the joint state of Bob and Eve,  depicted in Fig. 1.After straightforward calculation we get Then, Eve's state reads [61] and, if Bob gets the outcome   Eve's conditional state writes The resulting  (p) is plotted in Fig. 4 as a function of the mean energy n at a fixed transmission distance  = 100 km.As expected for CV-QKD with imperfect reconciliation, all the curves reach a maximum  (p) max for a finite value of n and ultimately become negative [24]- [26], [34].Remarkably, the MB sampling increases the maximum value of KGR with respect to the uniform one, but the curves decrease faster towards negative values.This behaviour may be interpreted as follows.For large n, the larger spacing between symbols Δ (II) ≥ Δ (I) makes them more "distinguishable", allowing Eve to retrieve more information with respect to case I. On the other hand, if n is small, the shot noise becomes relevant increasing the overlap among the encoded symbols and the larger spacing is beneficial to achieve a better approximation of the Gaussian modulation.
Moreover, in Fig. 4 we also compare the performance of the QAM formats with two relevant benchmarks: the corresponding PSK constellations having the same number of symbols [24]- [26], [55] and the GG02 protocol discussed in App. A. The PSK constellation with  symbols is constructed by generating uniformly the coherent states {| exp[(2 + 1)/)] } =0,...,  −1 , and  = √ n > 0 [55].However, by performing the above analysis with PSK, the numerical results show that increasing the size of the constellation brings a negligible increase in the KGR for large  [34], and, for PSK16 and PSK64, they are almost indistinguishable.On the contrary, in the presence of QAM, increasing the number of symbols allows to improve further the KGR, thus approaching incrementally the GG02 protocol.Thus, in principle it is always possible to find a finite  ×  QAM alphabet, with sufficiently large  and optimized MB distribution, to approach with arbitrary accuracy the GG02.
The previous analysis may be performed to retrieve the maximum achievable KGR  (p) max , p = I, II, as a function of the transmission distance , together with the associated maximum modulation energy n(p) max .Plots of  (I) max are depicted in Fig. 5 (top panel).As we can see, the QAM formats outperform the corresponding PSK ones and are closer to the GG02 protocol.Furthermore, exploiting PAS allows to increase further the performance, as shown in the bottom panel of Fig. 5 for the case QAM64.
To quantify the improvement introduced by PAS, we compute the ratio plotted in the top panel of Fig. 6.The trend is similar for both QAM16 and QAM64.For small , R exhibits a bump after which it decreases until to reach an asymptotic value for  ≥ 80 km.We note that in this asymptotic regime the results obtained show numerical fluctuations.These are induced by a limitation of the optimization procedure described in Sec.II-B.Indeed, for small transmissivity  1, the overall state received by Bob has a so weak average energy  n 1, that the mutual information for cases I and II is nearly identical to the channel capacity (see Fig. 3, bottom panel).In turn,  (II)   () is almost independent of  and the maximization algorithm used in Sec.II-B introduces numerical fluctuations on the optimized inverse temperature  (II) .Although these fluctuations do not affect the mutual information itself, they do have a relevant effect when computing the KGR, as appears in the plots of Fig. 6.To avoid this intrinsic limitation, we estimate the asymptotic ratio by calculating the average of the data obtained for  ≥ 80 km, bringing us to an increase of ≈ 3% and ≈ 12% for QAM16 and QAM64, respectively.
Finally, for the sake of completeness, the bottom panel of Fig. 6 reports the maximum modulation energy n(p) max , p = I, II, which is a decreasing function of the distance and saturates as  increases.As one may expect, increasing the size of the constellation increases also n(p) max , until to reach the value of the GG02 scheme [34].Moreover, we have n(II) max ≤ n(I) max , that is the MB reaches its maximum KGR for lower energies, in accordance with Fig. 4.
As a final remark, we note that the KGR analysis performed here does not focus on the actual error correction code and algorithm employed for information reconciliation, but simply uses the reconciliation efficiency parameter  [26], [30] to Scheme of the CV-QKD protocol in the presence of the channel excess noise.Differently from the pure-loss scenario, Eve performs an entangling-cloner attack, that is she injects one arm of a TMSV state into the channel beam splitter, retrieving the final output state.account for deviations from the KGR achievable with ideal reconciliation.The study of ad hoc information reconciliation protocols, the impact of possible error propagation when inverting the mapping performed by the distribution matcher, and the comparison between the complexity and efficiency of the information reconciliation protocols available for Gaussian modulations and for the proposed discrete modulation are left for future study.

III. ROLE OF THE CHANNEL EXCESS NOISE
In this section we approach the more realistic scenario that addresses the impact of a thermal channel excess noise on the results of Sec.II.Here the quantum channel is still modelled as a beam splitter with transmissivity , but now a thermal state is injected in the other port.Such a state is characterized by n = /[2(1 − )] mean photons,  ≥ 0 being the introduced excess noise.In turn, the states probed by Bob are no longer coherent (pure) states but rather displaced thermal (mixed) states [14] and the conditional homodyne probability (6) should be modified accordingly as with an increased variance  2  =  2 0 (1 + ).Generally speaking, the presence of a channel excess noise is detrimental for CV-QKD, as secure communication only holds up to a maximum transmission distance  max , after which the KGR becomes negative [11]- [13], [15], [16].The value of  max depends on both the amount of noise and the employed constellation [24], [34].
For the protocol under investigation, the corresponding wiretap channel non-zero excess noise is depicted in Fig .where Eve is assumed to the added thermal noise by performing an entangling cloner attack [46], [67].In more detail, she prepares a two-mode squeezed vacuum state (TMSV) with variance   = 1 + 2 n on two modes E = ( 1 ,  2 ), namely with  = √︁ (  − 1)/(  + 1) and | being the Fock state containing  photons [14].Thereafter, she injects branch  1 into the channel beam splitter, impinging with the pulse sent by Alice, and, ultimately, collects the output reflected state.Thanks to this strategy, she gets undetected by Alice and Bob, being fully hidden behind the observed excess noise.Indeed, after performing partial trace over modes E, the present scheme is equivalent to a thermal-loss channel with excess noise  [67].
As in the previous section, we present the analysis of the KGR addressing only the MB distribution, retrieving cases I and II by fixing  = 0 and optimizing  with the methods of Sec.II-B, respectively.The mutual information between Alice and Bob reads where is the Shannon entropy of Bob's overall probability distribution On the contrary, the computation of the Holevo information () is not straightforward and requires the Gaussian formalism [69], [70], summarized in App.B. In particular, if Alice samples the coherent state |  +  , both Eve's overall and conditional states  E (  ,   ) and  E|   (  ,   ), respectively, are Gaussian states, whose expressions are derived in App. C. In turn, we have The Holevo information then reads that can be computed numerically by suitably expanding states (22) as shown in App.B [70].The resulting KGR, namely: optimized over the modulation energy leads to the maximum achievable rates  (p) max (), p = I, II, that are reported in the top and bottom panels of Fig. 8, respectively, for a QAM16 constellation with different values of .
As one may expect, the presence of the excess noise results in a lower  Remarkably, employing PAS is beneficial to increase both the KGR and the value of the maximum distance, as  (II)  max ≥  (I) max : for  = 0.03 we have  (I)  max ≈ 125 km and  (II) max ≈ 130 km, while, for  = 0.05,  (I)  max ≈ 70 km and  (II) max ≈ 75 km.

IV. A MORE SOPHISTICATED OPTIMIZATION PROCEDURE
In the previous sections we have addressed case II by choosing the optimal values  (II) and Δ (II) that maximize the mutual information between Alice and Bob.However, given the previous discussion, a feasible alternative emerges, in which the values of the free parameters are selected to maximize directly the KGR, instead of the sole mutual information  (II)   ().Here we investigate this procedure and, for the sake of simplicity, we only consider the case of a pure-loss channel.
As in the strategy of Sec.II-B, the spacing Δ (II) () is obtained as a function of the inverse temperature  thanks to the energy constraint of Eq. (2b).However, differently from that strategy, the proper figure of merit becomes the KGR in Eq. ( 12), namely, with the quantities  (II)  () and  (II)  =  (II)  () introduced in Eq.s ( 9) and (13), respectively, and where the dependence on  has been highlighted.The optimal inverse temperature is obtained as together with the optimal spacing Δ (II) and the optimal KGR Such a task is straightforward but not trivial to implement for the scenario discussed in this paper.Indeed, if we wanted to implement a golden-section-search method as in Sec.II-B, max for QAM16 as a function of the transmission distance , expressed in km.For  80 km there is an improvement of ≈ 10% (see the inset).The reconciliation efficiency is  = 0.95. in any step of the numerical algorithm we should compute not only  (II)   () but also the density matrices   and   |   , with a much higher computational cost.Here, for simplicity, we only consider a QAM16 constellation and compare the KGRs  (p) , p = I, II, and  (II) for distances up to 100 km.We report in the top panel of Fig. 9 the KGRs at  = 100 km as a function of the modulation energy.As one may expect, we have  (II) ≥  (p) .For small n,  (II) (solid blue line) is close to case II (solid orange line), then it achieves a maximum and decreases approaching the KGR of case I (dashed orange line).Remarkably, the present optimization increases further the maximum KGR achievable at a fixed distance.Thus, following the procedure outlined in Sec.II-C, for each distance  we choose the optimal modulation energy and retrieve the maximum achievable value  (II)  max .The comparison between  (II)  max and  (II) max in depicted Fig. 9 (bottom panel).For  80 km there is an improvement of ≈ 10%.At the same time, these results prove themselves as a validation for the mutual information optimization method, which is close to the optimization of the overall key rate, although being a sub-optimal procedure.

V. CONCLUSION
In this paper we have proposed a CV-QKD protocol employing the discrete QAM modulation formats typically exploited in classical telecommunications.In our proposal, the sender has only a finite set of coherent pulses available, constituting a square constellation of  ×  states, generated by sampling either a uniform (case I) or a Maxwell-Boltzmann (case II) distribution.The receiver performs a homodyne measurement of /, chosen at random, on his received signal.For case II, by exploiting PAS, we have evaluated the optimized sender probability distribution to maximize the shared mutual information.
We have performed the KGR analysis for a pure-loss quantum wiretap channel in reverse reconciliation and compared the obtained KGR with both the associated PSK protocols and the GG02 scheme.We proved QAM modulation as a powerful resource to better approximate the Gaussian modulation and quantified the advantage brought by non-uniform sampling.Thereafter, we have addressed the role of a non-zero channel excess noise, whose main detriment is to reduce the KGR, introducing a maximum transmission distance.We compared cases I and II, showing PAS to be more robust with respect to uniform sampling, allowing to reach larger distances.Finally, we have proposed a better optimization strategy, based on the direct maximization of the KGR instead of the sole mutual information.We showed this method to outperform both cases I and II, although case II may still be considered as a feasible sub-optimal scheme.
We also remark that in our analysis we focused on the asymptotic limit where an infinite dataset is shared between Alice and Bob.In a practical scenario considering finite-size effects, modulation formats that are closer to the continuous modulation may exhibit a lower performance, since there are more terms in the key rate calculation and the convergence can be slower.
Our results prove that a suitable PAS of a discrete constellation allows to overcome the finite transmitter dynamics and to approximate the performance of the standard CV-QKD based on CM also for increasing average powers.Moreover, they pave the way for the design of feasible schemes compatible with the currently exploited telecom techniques.
Further improvements may be obtained by improving also the detection stage and investigating the role of non-Gaussian measurements for CV-QKD, such as state-discrimination optimized receivers [55], [71]- [76].Nevertheless, in this case the analysis shall be restricted to a wiretap channel since a security analysis for a fully non-Gaussian protocol is still an open problem.

APPENDIX A CV-QKD WITH GAUSSIAN MODULATION: THE GG02 PROTOCOL
The most relevant protocol of CV-QKD is the so called GG02, proposed by Grosshans and Grangier in 2002 and employing Gaussian modulation [6], [10]- [12].In GG02, Alice encodes information on a continuous ensemble of coherent states |  +   , where   ,   ∈ R are sampled from the normal distribution N Σ 2 , namely, Therefore, the overall state generated by Alice reads that is a pseudo-thermal state n = 2Σ 2 being the mean energy per symbol and | representing the Fock state with  photons [14].
For the scheme investigated in this paper, that is a pure-loss channel followed by homodyne detection by Bob, the mutual information reads [6], [11], [62] which coincides with the capacity of an AWGN channel as derived in the Shannon-Hartley theorem [20], [21], [77], [78].By performing the security analysis in a reverse reconciliation scenario, if Eve exploits an entangling cloner attack, the Holevo information reads [6], [10], [12]  (GG)   = log 2 where The resulting KGR writes Finally, as discussed in the main text, for each transmission distance it is possible to optimize Eq. ( 34) over the modulation energy, obtaining the maximum achievable KGR  (GG) max and the maximum energy n(GG) max .

APPENDIX B A BRIEF OUTLINE OF THE GAUSSIAN FORMALISM
The Gaussian state formalism is a useful tool to perform the KGR analysis in the presence of a thermal-loss channel.

A. Gaussian states
A quantum state  is a Gaussian state if its associated Wigner function is Gaussian, namely where  = ⊕  =1  1 and The expansion of a Gaussian state  onto the Fock basis has been recently derived in [70].To this aim, we introduce the matrices where

B. Gaussian dynamics
Gaussian dynamics is provided by unitary evolution generated by bilinear Hamiltonians and is associated with a symplectic matrix .Given an input Gaussian state  in with (x in ,  in ), the evolved state  out is still Gaussian with FM and CM given by [69] x out =  x in and  out =   in  T (44) respectively.Finally, we discuss the case of conditional dynamics [69].We consider a bipartite system , composed of   an   optical modes, respectively, prepared in a Gaussian state   with x = (x  , x  ) and CM (written in block form)

APPENDIX C CALCULATION OF EVE'S STATES FOR A THERMAL-LOSS WIRETAP CHANNEL
Here we derive explicitly the quantum states  E (  ,   ) and  E |  (  ,   ) introduced in Sec.III.The entire computation is based on the Gaussian formalism outlined in the previous appendix.
In the presence of a thermal-loss wiretap channel, Eve generates a TMSV state with variance   = 1 + 2 n , n = /[2(1 − )], with zero FM, x (0) E = 0, and the CM with   = √︁  2  − 1 and   being the Pauli -matrix.Moreover, if Alice samples the coherent state |  +   , she gets a single-mode Gaussian state with FM x (0)  = 2 0 (  ,   ) and CM  (0)  =  2 0 I 2 .Thereafter, Alice's pulse interferes at the channel beam splitter with Eve's mode  1 , resulting in a tripartite Gaussian state  E (  ,   ) characterized by FM and CM equal to with  =  BS ⊕ I 2 and being the symplectic matrix associated with the beam splitter operation [69].
In turn, Eve's overall state  E (  ,   ) is characterized by (x E ,  E ), whilst her conditional state after Bob's homodyne measurement  E|   (  ,   ) is associated with FM x E|   and  E|   equal to Eq. ( 46), with x  = (  , 0) and being the CM associated with homodyne detection [69].

Figure 3 .
Figure 3. (Top) Optimal inverse temperature  (II) and spacing Δ (p) , p = I, II, as a function of the mean energy per symbol n for a QAM16 constellation ( = 4).(Bottom) Optimized mutual information  (p) |   is Eve's conditional state after Bob's measurement, and [] = −Tr( log 2 ) denotes the von Neumann entropy associated with the density matrix  [55].

Figure 4 .
Figure 4. Plot of  (p) , p = I, II, as a function of the mean energy n for  = 100 km (20 dB attenuation).The reconciliation efficiency is  = 0.95.

Figure 5 .
Figure 5. (Top) Log plot of  (I) max as a function of the transmission distance , expressed in km, for  ≥ 100 km.The plot for smaller  is depicted in the inset.(Bottom) Log plot of  (I) max and  (II) max for QAM64 ( = 8) as a function of the transmission distance .The exploitation of PAS increases the KGR, coming closer to the GG02 protocol.The reconciliation efficiency is  = 0.95.The symbols (circles and triangles) refer to the numerical calculations at fixed  and the lines to the corresponding interpolations.

Figure 6 .
Figure 6.(Top) Plot of the ratio R as a function of the transmission distance , expressed in km.The black dotted lines are the average of the values obtained for  ≥ 80 km.For large distances PAS introduces an increase in the KGR equal to ≈ 3% and ≈ 12% for QAM16 and QAM64, respectively.(Bottom) Log plot of the maximum modulation energy n(p) max , p = I, II, as a function of the transmission distance .The reconciliation efficiency is  = 0.95.

Figure 7 .
Figure 7.Scheme of the CV-QKD protocol in the presence of the channel excess noise.Differently from the pure-loss scenario, Eve performs an entangling-cloner attack, that is she injects one arm of a TMSV state into the channel beam splitter, retrieving the final output state.
) with respect to the pure-loss channel one, exhibiting a reduced maximum transmission distance  (p) max .
Figure 8. (Top) Log plot of  (I) max (  ) as a function of the transmission distance , expressed in km, for different values of the excess noise  .(Bottom) Log plot of  (II) max (  ) as a function of , for different  .The black dashed lines are the corresponding KGRs of case I. PAS turns out to be beneficial to increase both the KGR and the maximum transmission distance  (p) max , being more robust against the channel thermal noise.The reconciliation efficiency is  = 0.95.