Enhancing Continuous-Variable Quantum Key Distribution by State Preparation With Shannon-Kotel ’ nikov Maps

We propose a continuous-variable quantum key distribution protocol that uses Shannon-Kotel’nikov maps for preparing coherent quantum states. Our protocol has similarities with the no-switching protocol in the sense that it requires that both quadratures need to be measured. It is also a Gaussian modulated protocol, because the secret key is to be extracted from Gaussian parameters. The use of this kind of map in the preparation of coherent states allows the increase in the sourceto-distortion ratio (SDR) between Alice and Bob, thus making information reconciliation easier. This increase in SDR is due to the use of nonlinear maps of higher dimension instead of simply raising Alice’s variance. We analyze here two kind of maps: the uniform Archimedes’ spiral and the geodesics on a flat torus. We assess the security of our protocol through simulations. In order to do that, we simulate the optimal feedforward attack together with a maximum-likelihood receiver, then we use Kraskov’s first algorithm to estimate the mutual information.


I. INTRODUCTION
Cryptographic protocols require a shared secret key in order to allow two parties Alice and Bob to communicate in secrecy.By carrying out a quantum key distribution (QKD) protocol successfully, Alice and Bob can share a secret key even if they are far apart and linked through an insecure communication channel.The security of their communication is guaranteed by quantum mechanics [1].QKD can be implemented either with discrete variables or continuous variables.While discrete variables protocols require specialized equipment like APDs, continuous-variable quantum key distribution (CVQKD) protocols can be implemented with standard telecom components [2].
In CVQKD, the information is encoded in the quadratures x and p of a quantized electromagnetic field [3].There is a diversity of continuous-variable protocols which differs on how modulation, state preparation and measurement are realized [2].Protocols with practical implementations are mostly based on the coherent state protocol GG02 [4], [5].In this protocol, the quadratures of a coherent state are modulated according to a Gaussian distribution, then this state is sent to Bob.After receiving it, Bob chooses randomly to measure one of the quadratures by homodyne detection.If X denotes the quadrature sent by Alice and Y denotes the Bob's measured quadrature, then Y = X + Z, where Z is Gaussian with variance σ 2 Z and X has power P .So X and Y are described by a Gaussian channel with signal-to-noise ratio (SNR) given by P/σ 2 Z .In order to get a secret key from the random variables X and Y , it is still necessary to carry out the classical procedures of information reconciliation and privacy amplification.Besides GG02, it is also possible to measure both quadratures of the coherent states as it is done in the noswitching (NS) protocol [6], [7].In this case, both quadratures contribute to generate the secret key at the expense of adding one shot noise unit to the measured outputs.
Security proofs for Gaussian modulated protocols are well established.These protocols are proven secure against collective attacks which turn out to be the most powerful type of attack [8].Thus, at least theoretically, if reverse reconciliation (RR) is employed, it is possible to distribute a secret key for larger distances (hundreds of kilometers) using CVQKD as long as the excess noise is below a given threshold [5].
When considering practical implementations of Gaussian modulated protocols, a more severe limitation for CVQKD is the inefficiency of reconciliation protocols.This is mostly due to the fact that reconciliation protocols for Gaussian variables rely on classical error correcting codes that need to operate close to the channel capacity in order to achieve higher efficiencies [9], [10].Codes that are suitable for reconciliation have long length, which results in a complex and computationally demanding decoding process [11].
Extending CVQKD to larger distances requires efficient reconciliation protocols at low SNRs.In [12], CVQKD was implemented over a 25km link of optical fiber.The reconciliation was accomplished by using multilevel coding and multistage decoding (MLC/MSD) [9] together with low-density parity check (LDPC) codes of 200,000 block length, resulting in an overall reconciliation efficiency β = 0.898 for a SNR of 3.38 (5.3dB).Improvements in reconciliation efficiency were reached in [13] keeping MLC/MSD together with the same block length but employing a different design for LDPC codes.In this case, β = 0.937 was reached for a SNR of 3 (4.77dB).Further improvements can be attained by designing specific codes for each coding level as in [14].In this case, LDPC codes of large length (more than a million bits) allowed a β = 0.934 for a SNR of 0.55 (-2.6dB).For even low SNRs, higher reconciliation efficiencies can be obtained with the multidimensional reconciliation technique [15], [16], allowing practical implementations of CVQKD in a range of 80km [17].
Instead of trying to improve the performance of CVQKD through reconciliation, another possibility is to increase the SNR at Bob's side.This approach became theoretically possible with the concept of a heralded noiseless linear amplifier (NLA) [18].In the context of CVQKD, considering an ideal model and the GG02 protocol, a NLA of gain g could allow 20 log 10 g 2 dB extra losses before the secret key rate drops to zero [19].When imperfections are considered, simulations done for the no-switching protocol show that a non-ideal LNA could still provide gains in distance and tolerable excess noise [20].It is not necessary to build a physical LNA to improve the performance of CVQKD.In [21], [22], it is shown that noiseless amplification operations can be simulated in the classical data postprocessing stage.
In this paper, we follow a different approach in order to improve the performance of CVQKD.We aim to increase the source-to-distortion ratio (SDR) at Bob's side through the use of analog encoding in the preparation of coherent states.In our approach, the SDR plays the role of the SNR for traditional CVQKD protocols.We then make use of a geometrical interpretation of nonlinear modulations given in [23], [24].According to that, the preparation of coherent states can be viewed as a mapping of a given parameter to some point belonging to a curve in a N-dimensional space.The noisy measurement results are projected back in this curve and an estimate of the encoded parameter is obtained.The fidelity between the parameter and its estimate depends on the noise level and properties of the curve like length and curvature.In [25], we proposed a CVQKD protocol using this idea and analyzed it for a uniform Archimedes' spiral mapping under a feedforward attack.Here, we extend our previous analysis by detailing some theoretical aspects and exploring mappings of higher dimension.It is worth saying that such kinds of mappings have been used for security purposes in a totally different scenario.In [26], the physical layer security was analyzed for a wireless classical channel.
The paper is organized as follows: In Sect.II, we describe the theory of Shannon-Kotel'nikov maps and the two kinds of mappings that are used in our scheme.In Sect.III, we review the Gaussian modulated CVQKD protocols and build a simulation model for our protocol.In Sect.IV, our proposed protocol is described.In Sect.V, we discuss some simulation results obtained for our system.Finally in Sect.VI, some conclusions about our work are presented.

II. SHANNON-KOTEL'NIKOV MAPS
We consider a system as depicted in Fig. 1 in which we want to transmit time-discrete symbols of a continuous source through an additive white gaussian noise (AWGN) channel.These symbols are mapped directly onto channel symbols by the transmitter.The receiver, in turn, produces an estimate of the transmitted symbols in order to satisfy some optimality criterion such as the mean-squared error (MSE).This joint source-channel system can be given a geometric interpretation where a parameter m ∈ R M is mapped onto a point s(m) in a curve in R N [23].Such maps are referred as Shannon-Kotel'nikov (SK) maps [27].When N > M , SK maps act like analog error correcting codes, allowing the reduction of the MSE between the source symbols and their respective estimates.
In this paper, we are interested in 1 : N mappings.More specifically, we map a source real parameter m ∈ [−1, 1] onto N channel coordinates through a chosen nonlinear mapping scheme.Using the well known equivalence between vectors and waveforms, for a given orthonormal basis {ϕ i } N i=1 , channel waveforms can be represented as vectors When m is varied along its support, the tip of the vector s(m) moves along a twisted curve as depicted in Fig. 2.
Analogously, the noise process can be represented by a vector n in such a way that the received signal by the receiver is given by r = s(m) + n.For an AWGN channel with power spectral density σ 2 n , a maximum likelihood (ML) receiver produces an estimate m that maximizes the likelihood function This function is maximized by the value of m that minimizes r−s(m) , that is, the closest point of the curve to the received point.
According to Ziv [28], there is not a single map that reaches the best performance in terms of MSE for all SNRs.The optimal performance theoretically attainable (OPTA) bound gives us a clue on the behavior of optimal maps when dimensions M and N are modified.Considering an AWGN channel with average power P and noise variance σ 2 n , we can define the channel signal-to-noise ratio (CSNR) as P/(N σ 2 n ).Similarly, for a Gaussian source of variance σ 2 m and MSE D between source samples and their estimates, we define the source-to-distortion ratio (SDR) as σ 2 m /D.The OPTA bound is obtained by equating the rate-distortion function and the channel capacity [29].For the Gaussian source and the AWGN channel, the OPTA bound is given by As noted in [27], practical mapping performances are far away from OPTA bounds.However, the trend of better SDR performances for higher CSNRs is still verified.From Eq. 3, we can also see that SDR can be improved for a fixed CSNR if we allow N to grow.Such result is known in classical telecommunications as a trade-off between performance and bandwidth expansion.Expressions for the MSE D of generic mappings are usually obtained under the assumption of low noise levels.In this case, the distance between curve folds must be greater than three or four times N σ 2 n .Assuming that a source symbol m 0 corresponds to a mapped point s(m 0 ).Under the low noise assumption, the received point r will lie close to s(m 0 ) with high probability.In this way, the signal curve can be approximated by the straight line The ML estimate can be approximated by the projection of the received point r onto this line.Then, it can be shown that the conditional MSE is given by ( If the probability density function (pdf) of m is denoted by f m , then the MSE is obtained by averaging Eq. 5 over all values of m, that is It is still necessary to define how source symbols m are mapped onto the signal locus.For a given modulation method, this locus corresponds to a curve of length L. If we introduce an intermediate variable l(m) denoting the length along the locus, it can be shown that [24] The minimum MSE is attained if l(m) is chosen as This operation is referred as a compander or a stretching function.An SK mapping operation is often interpreted as the combination of stretching followed by the bending of the curve.Substituting Eq. 8 into Eq.7, we get an expression for the minimum MSE given by It can be seen in Eq. 9 that the MSE can be reduced by increasing the length of the curve.However, due to the power restriction, increasing curve length makes curve folds get closer.In this situation, the threshold effect appears, which makes the MSE to increase rapidly because received points are decoded in different folds of the curve with high probability.Next, we analyze two SK mappings: the uniform Archimedes' spiral [27] and the geodesics on flat tori [30].The former is a 1 : 2 mapping while the latter is a 1 : 2k (k ≥ 2) one.

A. Uniform Archimedes' spiral
A 1:2 mapping using the uniform Archimedes' spiral is illustrated in Fig. 3.It can be seen that the image of the mapping consists of two intertwined spirals: one for positive source values and the other for negative ones.The distance between spiral's arms is constant and denoted by ∆.Thus, the design of the mapping consists of finding a ∆ that maximizes the performance for a given CSNR subjected to an average channel power restriction P .
Instead of using a stretch function like the one in Eq. 8, it was used in [27] the inverse curve length approximation ϕ(x) = ± |x|/(0.16∆).This choice makes tangent vectors along the curve have equal length, then assuring mutual independence between signal and noise.The spiral map is then given by where sgn (•) is the sign function and g s is a gain factor that is necessary to keep the power constraint.As previously mentioned, we assume that the source values are truncated into the interval m ∈ [−1, 1].This means that source distribution parameters have to be chosen properly so as truncation effects might be neglected.For a gaussian source of variance σ 2 m , g s is given by For a fixed P , a smaller ∆ means a spiral with a larger length (more folds) and, consequently, a better SDR as noted in Eq. 9.However, if ∆ is chosen too small compared to the channel noise, the threshold effect becomes dominant, so degrading the system's performance.So, there is a tradeoff that allows an optimal value for ∆ to be found.In [27], an expression for the optimal ∆ as a function of the CSNR and P is given.For σ m = 0.25, this expression is given by where dB points out decibel units.It should be pointed out that the threshold effect can be quite severe for this mapping if the spiral is used for noise levels above designed thresholds.The reason for this is that jumps in decoded arms may represent transitions between signs for source parameters.

B. Geodesics on flat tori
Geodesic curves on a flat torus were used for analog error correction in [31].Such curves have constant curvature and turn around a flat torus like a helix on a cylinder.For a flat torus in R 2k , geodesics are generically described by where is a parametrization for the curve and α is the output of a stretching function (Eq.8).A twisted curve requires that the elements ω i be different [30].Besides, specific constraints for θ must be taken in account in designing analog codes.
In the context of CVQKD, we are interested in good performances for low CSNRs.Then, a bigger distance between curve folds is more valuable than simply extending the curve length.In [32], geodesics parameters were optimized so as to achieve good performances for low CSNRs.This was done by maximizing the global circumradius function over θ.The minimum value of the global circumradius function can be interpreted as the radius of a tube centered along the curve that prevents self intersection [33].Thus, the minimum distance between curve folds is guaranteed to be twice the minimum value of the global circumradius function.
The circumradius function may be written as where ∠(•, •) denotes the angle between two vectors.For a smooth curve like the one in Eq. 13, the global circumradius function is given by Then, the minimum distance between curve folds is given by Optimal θ were found in [32] for a given k by maximizing Eq. 16 subjected to the following restrictions: The two first restrictions are usual in designing torus related curves.The third one simplifies the search by restricting it to harmonic frequencies.Finally, the last one avoids the curve to repeat itself at each period by restricting its path length.

III. GAUSSIAN MODULATED CVQKD PROTOCOLS
In Gaussian modulated CVQKD protocols with coherent states, Alice prepares and sends coherent states |x A + ip A to Bob.For these states, the displacement values x A and p A for the quadratures x or p, respectively, are chosen from a Gaussian distribution of zero mean and variance V A N 0 , where N 0 is the shot-noise (vacuum noise) variance and V A is a scale factor.Bob gets his set of data by measuring randomly one quadrature (GG02 protocol) or both quadratures (NS protocol) for each state sent by Alice.After exchanging some classical information through a public authenticated channel, they end up with two sets of correlated data from which they can distill a secret key.In order to achieve this goal, they have to do some classical data processing that involves channel parameters estimation, information reconciliation and privacy amplification.
As CVQKD protocols are usually designed for fiber optics physical channels, the channel model used to describe them is the lossy channel [2].In this case, the channel is characterized by the transmission T (the fraction of power that arrives at Bob's, i.e. 0 ≤ T ≤ 1) and the excess noise ǫ.After estimating these parameters, Alice and Bob can compute their mutual information I AB .As our construction requires measuring both quadratures, we report next some already known results for the NS protocol.
For the NS protocol, I N S AB has the contribution of both quadratures.Assuming that T and ǫ are the same for both x and p, I N S AB is given by [34] where A lower bound to the key generation rate is obtained when we get an upper bound for Eve's knowledge, that means considering an optimal attack that maximizes Eve's information.Eve's bounds depend on the direction of the reconciliation protocol that is being used.When Bob tries to estimate Alice's data from his data set and some side information, reconciliation protocols are said to employ direct reconciliation (DR).When Alice and Bob roles are reversed, reconciliation protocols are said to employ reverse reconciliation (RR).For the NS protocol, the feedforward attack is proven to be an optimal individual attack that reaches the bound for DR, where E 1 and E 2 denote Eve's modes related to the Eve's measured quadratures X E1 and P E2 , respectively.For RR, the bound [35] is given by where The asymptotic secret key rate bounds for the NS protocol when considering individual attacks and perfect reconciliation are then given by where equalities are reached for an optimal attack like the feedforward attack.In an ideal case, ∆I RR > 0 for arbitrary distances if the excess noise is kept below a given threshold.In practical situations, I N S AB is penalized by the reconciliation efficiency β, so that the effective secret key rate for RR is given by As can be seen in Fig. 4, if CVQKD is to be deployed in a given distance, a β < 1 limits Alice's variance V A .In general, a weak signal sent by Alice decreases both I N S AB and I N S BE , but Eve is more affected than Bob.Therefore, the attainability of positive secret key rates for larger distances may be achieved by improving β through reconciliation and limiting V A .
RR versus distance for the NS protocol.If β = 0.9 < 1, as V A is increased, the maximum distance for CVQKD is diminished.
Alice Bob x in , p in x out , p out

A. Simulation Model
In this paper, we assess the gain and security of our protocol through simulations.Therefore, it is necessary to describe how quadrature variables evolve throughout the channel, beam splitters and measurement devices.As it is often assumed, we follow a common approach in which the Alice to Bob channel does not mix quadratures x and p [35].In this way, quadratures are treated as two independent channels.
In Fig. 5, we give a representation of our model.x A and p A denote quadrature variables chosen by Alice, while x B and p B denote variables measured by Bob.The quadratures of coherent states at the input and output of the channel are indicated by x in , p in and x out , p out , respectively.The relationship among these variables is given by vac denotes the shot noise added to quadrature x in the preparation of coherent states by Alice and • denotes the expectation value.Similar equations are obtained for quadrature p if we replace x by p in Eqs.31-35.Bob's measurement involves splitting the incoming signal in a beamsplitter, followed by a homodyne detection in each output.Assuming an ideal homodyne detector and a real beam splitter with transmissivity 1/2 [36], Bob's measured quadratures are described by where vac and p vac denote the shot noise added to quadratures in the beamsplitter.From Eqs. 36 and 37, it is clear that Bob's measured quadratures are made up of a signal component and noise, so we can define a CSNR representing the Alice to Bob channel as (38) Following a similar approach, Eve's measured quadratures x E and p E can be characterized when she implements the feedforward attack described in Fig. 6.In this kind of attack, Eve reproduces the channel parameters T and ǫ, so remaining undetected.To accomplish this task, Eve has a beamsplitter of transmissivity T E and a gain factor g E for their measurement results that must be set to In the first beamsplitter, the transmitted and reflected quadratures are represented by Expressions for p T E and p RE are obtained by replacing x by p in Eqs.41 and 42, respectively.The reflected part of the signal is measured by Eve, resulting in the outputs x E and p E given by Similarly to Eq. 38, a CSNR representing the Alice to Eve channel is given by As shown in Fig. 6, the remaining part of the feedforward attack consists of applying a gain g E to x E and p E , then  using this result to translate x T E and p T E .Finally, Bob's input quadratures are given by If g E and T E are chosen according to Eqs. 39 and 40, respectively, then Eqs.46 and 47 reproduce the same statistics of the original physical channel.
IV. MAPPINGS IN CVQKD Our idea consists of using the nonlinear mappings like the ones described in Sect.II to prepare the coherent states that are sent by Alice in a Gaussian modulated CVQKD protocol.More specifically, the displacement values x A and p A are now chosen as points in a parametric curve.There is a one to one correspondence between points in these curves and random parameters m, which represent the information exchanged in our protocol.If the selected maps fit the channel noise, we can improve the SDR of the Alice to Bob channel, thus making reconciliation easier.
Our protocol is illustrated in Fig. 7 and it is generically described by the following steps: 1) Alice draws a random number m from a Gaussian distribution N (0, σ 2 m ), then uses this value to get a mapped point s where , then sends them to Bob; 3) Bob measures both quadratures x e p of the received states, then uses the results and the selected curve to obtain an estimate m; 4) A secret key is extracted from m and m after information reconciliation and privacy amplification.The SK maps discussed in Sect.II are designed for AWGN channels.In order to convert quadrature channels onto AWGN channels, we must scale Eqs.36 and 37 as where n x and n p are Gaussian variables of zero mean and variance (2/T +ǫ)N 0 .We assume that Eve knows the mapping  that is being used by Alice and Bob, so she can use it to get her own estimate mE .As it was done for Alice and Bob, the AWGN channel for Alice and Eve is obtained by scaling x E and p E (Eqs.43 and 44) by ∓ 2/(1 − T E ).

A. Archimedes' spiral
For the Archimedes' spiral, each parameter m is mapped onto two points according to Eq. 10.This pair of points is used to prepare the coherent state |x A(1) + ip A(1) that is sent to Bob.In order to have curves of finite length, we restrict the support of the source to the interval [−1, 1].We assume that our information source is Gaussian with zero mean and variance σ 2 m = (0.25) 2 .By making this choice, truncation effects may be neglected.The variance of quadratures x and p is controlled by adjusting the gain g S (Eq.11).We set the average channel power P to V A N 0 .This choice results in an average CSNR per quadrature equals to Eq. 38, thus allowing to compare our protocol to the NS protocol.
We design a spiral for each transmission value T , that means calculating a ∆ opt (Eq.12) for each T .The CSNR used in these calculations is given by

B. Geodesics on a flat torus
Our simulations regarding curves on a flat torus were carried out for N = {4, 6}.That means that a point in a curve is used to prepare two or three coherent states.As before, our source has support restricted to the interval [−1, 1] and is Gaussian with zero mean and variance σ 2 m = (0.25) 2 .Before mapping the source symbols, it is necessary passing them through a compander (Eq.8).For the sake of comparison to other protocols, we scale the vectors generated according to Eq. 13 by √ P , where P is the average input channel power.If we set P = N V A N 0 , the average CSNR per quadrature equals to Eq. 38.Unlike the spiral mappings that are designed for each value of T , a single curve on a torus is used for all values of T in a simulated range (N fixed).A direct consequence of this choice is that the threshold effect is more pronounced for small values of T .

C. Maximum likelihood decoding
When Bob measures both quadratures of the k coherent states sent by Alice, he ends up with the vector Before using the ML receiver, he has to scale the components of q B as done in Eqs.48 and 49, so getting q ′ B .For an AWGN channel, the ML receiver chooses m as the value of m for which the Euclidean distance between q ′ B and s(m) is minimum.Analogously, when Eve implements the feedforward attack, she ends up with the vector q E .After scaling q E and getting q ′ E , she uses her knowledge about the curve to get her own estimate mE .

D. Security analysis
As we consider only individual attacks in this paper, a secret key can be distilled from shared data if the secret key rate given by Eqs. 29 or 30 is positive.In our case, we replace the mutual information bounds for the NS protocol by simulated values for our protocol.More specifically, in order to calculate the secret key rate for our protocol, it is necessary to calculate the mutual information among the variables m, m and mE .We define the followings mutual information for our protocol: I SK AB = I(m; m), I SK AE = I(m; mE ) and I SK BE = I( m; mE ).In our setup, we assume that Eve implements the feedforward attack, an optimal individual attack for the NS protocol.The quadratures measured by Eve are processed with a ML receiver, then she gets her own estimate of Alice's parameters.From Alice's data together with Bob's and Eve's estimates, the secret key rates for our protocol under DR and RR are given respectively by It is worth saying that the feedforward attack with parameters given by Eqs.39 and 40 may not be optimal for our protocol.This happens because the nonlinear structure of the SK maps makes the distribution of Alice's quadratures non-Gaussian.In this way, further analyses are required in order to treat Eqs.51 and 52 as optimal bounds for our protocol.Here, sp stands for spiral while 4D and 6D stand for the geodesics dimension.It is possible to note the trend of higher gains with higher dimension maps.

V. SIMULATION RESULTS
In order to assess the gains of our protocol, we compare the SDR between Alice's and Bob's variables to the CSNR for the NS protocol (Eq.38).Thus, we define SDR AB = σ 2 m / (m − m) 2 , where the denominator represents the distortion between m and m.From the previously defined I SK AB , I SK AE and I SK BE , we calculate the ratios β DR lim (SK) = I SK AE /I SK AB and β RR lim (SK) = I SK BE /I SK AB that represent the minimum necessary reconciliation efficiencies for DR and RR, respectively.Similarly, for the NS protocol, we have the ratios β DR lim (N S) = I N S AE /I N S AB and β RR lim (N S) = I N S BE /I N S AB for DR and RR, respectively.In this case, the ratios are calculated according to bounds given in Sect.III.Mutual information was estimated using Kraskov's first algorithm [37].This algorithm is based on entropy estimates from p-nearest neighbor distances.In our simulations, we set p = 5 for blocks of 10,000 samples.With these choices, we can achieve an estimation error of order 10 −3 while keeping a reasonable simulation time.
In our simulations, we set V A = 50 and we used ǫ = 0.0015V A ( [14]) for the excess noise.For the Archimedes' spiral, simulations were done for transmission values T ∈ [0.1, 1].As previously mentioned, a spiral is designed for each value of T .When dealing with curves on a flat torus, we extended the transmission values to the interval T ∈ [0.05, 1].If we consider an optical fiber with a 0.2 dB/km attenuation, T = 0.1 and T = 0.05 correspond to maximum distances d = 50km and d = 65km, respectively.For the geodesics on a flat torus, we started from the optimized parameters given in [32] and we made some adjustments in the curves length.When N = 4, we have θ = {0.8165,0.5773, 0.7071, 1.4142} and L = 7.74.When N = 6, we have θ = {0.69,0.63, 0.3564, 0.5584, 1.1169, 1.6753} and L = 10.2.
In Figs. 8 and 9, we compare the SDR AB for the spiral and the geodesics (N = 4 and N = 6) to the CSNR for the NS protocol.It is possible to verify the trend of higher gains Here, sp stands for spiral while 4D and 6D stand for the geodesics dimension.It is possible to note the trend of higher gains with higher dimension maps.with higher dimension maps.Besides, geodesics have a more steep graph in low CSNR regions.For N = 6, there is a 3.3dB gain in SDR AB compared to CSN R AB for T = 0.05.For the same N , when T is doubled, the gain increases to 8.47dB.
In Fig. 10, we plot mutual information for the simulated points.In general, plots exhibit the same tendency of bounds given in Eqs.21, 22 and 23.For DR, the 3dB point happens around T = 0.6.Similarly, for RR, I SK AB > I SK BE in the simulated range.It is worth noting that mutual information values increases with dimension.This is a direct consequence of higher SNR gains for higher dimensions.
In Fig. 11, we plot the ratios β DR lim (SK) and β RR lim (SK) for our protocol.It is possible to note that SK maps also help Eve to improve her mutual information, thus making necessary the use of more efficient reconciliation protocols for a given T .To compensate this growth in reconciliation efficiency, we could use a lower value for V A .For V A = 50, geodesics with N = 6 requires β DR lim (SK) 6D = 98.6% for a CSN R AB = 0.96dB (T = 0.05), resulting in a SDR AB = 4.27dB.If we have V A = 12.5 for the same CSN R AB = 0.96dB (now T = 0.20), we will still have a similar SDR AB , but now with β DR lim (SK) 6D = 93.4%.This new required efficiency is lower than the ones reported in [14] for this SNR, thus allowing the extraction of a secret key from shared data for our protocol.The cost of lowering V A in this example was the increase of T .In order to keep low values for T we could use maps of higher dimensions like the geodesics on a flat torus with N = 8 or higher.
In Fig. 12, we plot the maximum secret key rates (β = 1) for our protocol considering the RR scenario.It is possible to note that these simulated curves are below the bound for the NS protocol (Eq.30).This happens because the mapping also helps Eve to get more information.However, with our protocol, these secret key bits are to be extracted in a higher SNR, which may likely improve the effective secret key rate because it is easier to get a higher β for a higher SNR.  .Simulated values are compared to the NS protocol (solid red lines).It is possible to note that our protocol requires more efficient reconciliation protocols for a given T .This effect becomes more evident for higher CSNRs. .Simulated values for the secret key rate (RR) are compared to the bound given by Eq. 30 for the NS protocol.Here, sp stands for spiral while 4D and 6D stand for the geodesics dimension.Distances were calculated considering an optical fiber of 0.2 dB/km attenuation.

VI. CONCLUSION
In this paper, we proposed a CVQKD protocol that uses nonlinear SK maps for the preparation of quantum coherent states.Our idea was to increase the SDR between Alice and Bob by exploiting the error correcting properties of these maps.We assessed the security of our protocol for the feedforward attack optimized for the NS protocol.Simulations have shown that our construction really increases the SDR between Alice and Bob and allows the extraction of a secret key from shared data.The downside of our method is that it also helps Eve to get more information.This fact is inferred from the increase in the minimum necessary reconciliation efficiency when compared to the NS protocol.As suggested in Sect.V, we could lower the required reconciliation efficiency by lowering Alice's variance combined with maps of higher dimension, keeping the geodesics structure.
Some possibilities are envisaged in order to improve our results.One of these would be to include in the design criteria of maps some restriction to confuse Eve.This could prevent Eve of getting the benefits given by maps.The other one would be to conceive a protocol that requires only one quadrature to be measured.This would allow us to get rid of the 3dB penalty of measuring both quadratures.

2 Fig. 2 .
Fig. 2. Representation of a general two-dimensional mapping.Source symbols m ∈ [−1, 1] are mapped onto channel waveforms.The tip of the vector s(m) goes through the signal locus.

Fig. 3 .
Fig. 3. General plot of an uniform Archimedes' spiral.Dashed line represents negative parameters while solid line represents positive parameters.In this picture, we set P = 10, ∆ = 2.45 and σm = 0.25.

Fig. 5 .
Fig. 5. Simplified model for quadrature variables.Alice's and Bob's quadratures are denoted respectively by (x A , p A ) and (x B , p B ). (x in , p in ) and (xout, pout) denote the quadratures at the channel input and output, respectively.

Fig. 6 .
Fig. 6.Feedforward attack.Eve captures a fraction 1−T E of the input signal, then she measures both quadratures of this fraction.Measurement results are used to translate the transmitted fraction T E of the input.

Fig. 7 .
Fig. 7. Block diagram of our protocol.A mapped point of a curve is used for state preparation.Bob and Eve get each an estimate of the parameter sent by Alice through the use of a ML receiver.

Fig. 8 .
Fig.8.Simulated values for SDR AB and CSN R AB are plotted against the transmission T .Here, sp stands for spiral while 4D and 6D stand for the geodesics dimension.It is possible to note the trend of higher gains with higher dimension maps.

Fig. 9 .
Fig.9.Simulated values for SDR AB are plotted against CSN R AB .Here, sp stands for spiral while 4D and 6D stand for the geodesics dimension.It is possible to note the trend of higher gains with higher dimension maps.

Fig. 10 .
Fig. 10.Simulated mutual information for our protocol.On the left side, it is shown the DR scenario.On the right side, it is shown the RR scenario.(a) and (b) were obtained for the Archimedes' spiral.(c),(d) and (e),(f) were obtained for geodesics on a flat torus with N = 4 and N = 6, respectively.

Fig. 11 .
Fig. 11.Minimum necessary reconciliation efficiencies are displayed for DR (a) and RR (b).Simulated values are compared to the NS protocol (solid red lines).It is possible to note that our protocol requires more efficient reconciliation protocols for a given T .This effect becomes more evident for higher CSNRs.

Fig. 12
Fig.12.Simulated values for the secret key rate (RR) are compared to the bound given by Eq. 30 for the NS protocol.Here, sp stands for spiral while 4D and 6D stand for the geodesics dimension.Distances were calculated considering an optical fiber of 0.2 dB/km attenuation.