Practical continuous-variable quantum key distribution with composable security.

A quantum key distribution (QKD) system must fulfill the requirement of universal composability to ensure that any cryptographic application (using the QKD system) is also secure. Furthermore, the theoretical proof responsible for security analysis and key generation should cater to the number N of the distributed quantum states being finite in practice. Continuous-variable (CV) QKD based on coherent states, despite being a suitable candidate for integration in the telecom infrastructure, has so far been unable to demonstrate composability as existing proofs require a rather large N for successful key generation. Here we report a Gaussian-modulated coherent state CVQKD system that is able to overcome these challenges and can generate composable keys secure against collective attacks with N ≈ 2 × 108 coherent states. With this advance, possible due to improvements to the security proof and a fast, yet low-noise and highly stable system operation, CVQKD implementations take a significant step towards their discrete-variable counterparts in practicality, performance, and security.

Introduction

Quantum key distribution (QKD) is the only known cryptographic solution for distributing secret keys to users across a public communication channel while being able to detect the presence of an eavesdropper[1,2]. In an ideal case, legitimate QKD users (Alice and Bob) encrypt their messages with the secret keys and exchange them with the assurance that the eavesdropper (Eve) cannot break the confidentiality of the encrypted messages.

In one of the most well-known flavors of QKD, the quantum information is coded in continuous variables[2-5], such as the amplitude and phase quadratures of the optical field, described by an annihilation operator . Alice encodes random bits, e.g., by modulating the optical signal field to obtain a coherent state that follows the relation , with the real [imaginary] part of the complex value αsig equal to the amplitude [phase] quadrature. Bob decodes this information using coherent detection, facilitated by a so-called local oscillator (LO), that yields a quantity for an incoming field operator and with ∣βLO∣2 as the LO intensity.

Figure 1 shows these steps of quantum state preparation, transmission (on a quantum channel) and measurement, which Alice and Bob perform in the beginning of the continuous-variable (CV)QKD protocol. The quantum stage is followed by classical data processing steps and a security analysis, performed in accordance with a mathematical “security” proof, to obtain a key of a certain length. For this purpose, Alice and Bob use an authenticated channel on which Eve cannot modify the communicated messages but can learn their content. Once the classical stage concludes, Alice and Bob use their secret keys to encrypt their messages, and the resulting ciphertexts are exchanged using a communication channel, e.g., a telephone line, and decrypted.

Fig. 1

Composability in continuous-variable quantum key distribution (CVQKD) with coherent states.

Alice and Bob obtain quantum correlations over the quantum channel by means of modulation (MOD) and local oscillator (LO) aided homodyne/heterodyne detection (HD) to prepare and measure, respectively, optical coherent states. After going through the remaining steps of the protocol that involve the authenticated channel, they obtain correlated bitstreams s and s, respectively. Certain criteria associated with correctness, robustness, and secrecy of the protocol must be satisfied, for the application to assure composable security[7,10]. For instance, ϵ-correctness implies that Alice and Bob possess the same symmetric key s( = s = s) except with a probability ϵcor that bounds the probability of them having non-identical keys (Pr[s ≠ s]≤ϵcor). This key can be used for encrypting a message and decrypting the corresponding ciphertext across the communication channel. Dashed lines with arrows indicate classical communication across the channel and local operations. Eve is assumed to control all the channels. Further details of our CVQKD protocol implementation are presented in later sections of this article.

Amongst the many physical considerations included in the security proof, Eve’s actions on the channels (particularly her interaction with the transmitted quantum states) are classified in the form of individual, collective, or general attacks, in increasing order of power and generality[1,2]. For instance, a security proof catering to a collective attack permits Eve to store the result of her interactions with the quantum states in a quantum memory, and later perform a collective measurement. Also, the fact that Alice and Bob cannot avail an infinite number of quantum states in practice adversely affects the key length but such finite-size corrections are essential for the security assurance. Another related property of a secret key is composability[6], which allows specifying the security requirements for combining different cryptographic applications in a unified and systematic way. In the context of practical QKD, composability is of utmost importance because the secret keys obtained from a protocol are used in other applications, e.g. data encryption[7]. A secret key not proven to be composable is thus practically useless.

Composable security in CVQKD was first proven[8] and experimentally demonstrated[9] using two-mode squeezed states, but the achievable communication distance was rather limited since the employed entropic uncertainty relation is not tight. Composable proofs for CVQKD systems using coherent states and dual quadrature detection, first proposed in 2015[10], have been progressively improved[11-15]. Some of these proofs even provide security against general attacks, but all promise keys at distances much longer than in ref. 8 apart from the advantage of dealing with coherent states, which are much easier to generate than squeezed states.

Nonetheless, the strongest proof[16] that actual coherent-state CVQKD implementations, e.g., refs. 17–21, have used so far unfortunately does not include composable definitions. An experimental demonstration of composability in CVQKD has thus remained elusive, and this is due to a combination of the strict security bounds (because of a complex parameter estimation routine), the large number of required quantum state transmissions (to keep the finite-size terms sufficiently low), and the stringent requirements on the tolerable excess noise.

In this article, we demonstrate a CVQKD setup of low complexity that is capable of generating composable keys secure against collective attacks. We achieve this by deriving a method for establishing confidence intervals compatible with collective attacks, which allows us to work on smaller (and thus more practical) block sizes than originally required[10]. Alice produces coherent states by encoding Gaussian information in frequency (side-)bands shifted away from the optical carrier[22] by means of a single electro-optical in-phase and quadrature (IQ) modulator. Bob decodes this information using real LO-assisted radio frequency (RF) heterodyning, implemented with a single balanced detector, followed by digital signal processing (DSP)[23]. By performing a careful analysis to either eradicate or avoid various spurious noise components, and by implementing a machine learning framework for phase compensation[24], we are able to keep the excess noise below the null key length threshold. After taking finite-size effects as well as confidence intervals from various system calibrations into account, we achieve a positive composable key length with merely N ≈ 2 × 108 coherent states (also referred to as ‘quantum symbols’ from hereon) transmitted over a 20 km long fiber-optic channel. With N = 109, we obtain > 41 Mbits worth of key material that is composably secure against collective attacks, assuming worst-case confidence intervals.

Results

Composably secure key

A DSP routine at the end of the quantum stage yields the digital quantum symbols discretized with d bits per quadrature. This stream is divided into M frames for information reconciliation (IR), after which we perform parameter estimation (PE) and privacy amplification (PA); as visualized in Fig. 1. We derive the secret key bound for reverse reconciliation, i.e., Alice correcting her data according to Bob’s quantum symbols .

The (composable) secret key length s for n coherent state transmissions is calculated using tools from refs. 10,15 as well as results presented in the following. The key length is bounded per the leftover hash lemma in terms of the smooth min-entropy of conditioned on the quantum state of the eavesdropper E with ϵ as the smoothing parameter[25]. From this we subtract the information reconciliation leakage leakIR(n, ϵIR) and obtain,The security parameter ϵ characterizes the hashing function and ϵIR describes the failure probability of the correctness test after IR.

The probability that IR succeeds in a frame is related to the frame error rate (FER) by FER. All frames in which IR failed are discarded from the raw key stream, and this step thereby projects the original tensor product state ρ ≡ ρ⊗ into a non i.i.d. state τ. To take this into account, one replaces the smooth min-entropy term in Eq. (1) with the expression[15]:where is the number of quantum symbols remaining after error correction.

The asymptotic equipartition property (AEP) bounds the conditional min-entropy in the following way,whereis an improved penalty (proof provided in the “Methods” section) in comparison to ref. 10,15 and the conditional von-Neumann entropy from Eq. (3) is given by

We estimate the Shannon entropy directly from the data (up to a probability ≤ ϵent, further details in the “Methods” section). The second term is Eve’s Holevo bound with respect to that satisfies,where Y is the continuous version of and is the Holevo information obtained by using the extremality property of Gaussian attacks.

The Holevo information is estimated by evaluating the covariance matrix using worst-case estimates for its entries based on confidence intervals. We improved the confidence intervals of ref. 10 by exploiting the properties of the Beta distribution. Let , , be the estimators for the variance of the transmitted ensemble of coherent states, the received variance and the co-variance, respectively. The true values y and z are bound bywith ϵPE denoting the failure probability of parameter estimation, andbeing the confidence intervals (derived in Supplementary Note 1). In the above equations,where “invcdf” is the inverse cumulative distribution function. As detailed in section “Discussion”, the (length of the) secret key we eventually obtain in our experiment requires an order of magnitude lower N due to these confidence intervals.

Finally, we remark here on a technical limitation arising due to the digitization of Alice’s and Bob’s data. In practice, it is impossible to implement a true Gaussian protocol because the Gaussian distribution is both unbounded and continuous, while realistic devices have a finite range and bit resolution[14,26]. In our work, we consider a range of 7 standard deviations and use d = 6 bits, leading to a constellation with 22 = 4096 coherent states. Per recent results[27,28], this should suffice to minimise the impact of digitization on the security of the protocol. For keeping the analysis simple, we however assume perfect Gaussian modulation.

Experimental implementation

Figure 2 shows the schematic of our setup, consisting of a transmitter and a receiver connected together by a 20 km long standard single mode fiber spool, which formed the quantum channel. We performed optical single sideband modulation with carrier suppression (OSSB-CS) using an optical source (Tx laser) from NKT Photonics, and an IQ modulator plus automatic bias controller (IQmod+ABC) from ixBlue. An arbitrary waveform generator (AWG) was connected to the RF ports to modulate the sidebands. The coherent states were produced in a B = 100 MHz wide frequency sideband, shifted away from the optical carrier[22,29]. Random numbers drawn from a Gaussian distribution obtained by transforming the uniform distribution of a vacuum-fluctuation based quantum random number generator (QRNG) with a security parameter ϵqrng = 2 × 10−6 formed the complex amplitudes of these coherent states[30]. To this broadband ‘quantum data’ signal, centered at f = 200 MHz, we multiplexed in frequency a ‘pilot tone’ at f = 25 MHz for sharing a phase reference with the receiver[23,31-33]. The left inset of Fig. 2 shows the complex spectra of the RF modulation signal.

Fig. 2

Schematic of the experiment.

The transmitter (Tx) and receiver (Rx) were built from polarization maintaining fiber components. The transmitter comprised a 1550 nm continuous-wave laser (Tx laser), an in-phase and quadrature electro-optic modulator (IQmod) with automatic bias controller (ABC) for carrier suppression and single sideband modulation, and a variable attenuator (VATT) and Faraday isolator (FI). An arbitrary waveform generator (AWG) with 16 bit resolution and sampling rate of 1 GSps supplied waveforms RF1 and RF2 for driving IQmod. A quantum random number generator (QRNG) delivered Gaussian-distributed symbols for discrete Gaussian modulation of coherent states. The receiver comprised a laser (Rx laser; same type as Tx laser), a polarization controller (PC) to tune the incoming signal field's polarization, a symmetric beam splitter followed by a homemade balanced detector for RF heterodyning. The detector's output was sampled by a 16 bit analog-to-digital converter (ADC) at 1 GSps. BS: beam splitter, PD: photo detector. Left inset: Power spectrum of the complex waveform RF1 + ι RF2 driving the IQmod. Right inset: Power spectra of the receiver from 3 different measurements described in section “Experimental implementation”. The noise peak at 250 MHz is an interleaving spur of the ADC.

After propagating through the quantum channel, the signal field’s polarization was manually tuned to match the polarization of the real local oscillator (RLO) for heterodyning[Phys. Rev. X. 2015 ">31-33]. The Rx laser that supplied the RLO was free-running with respect to the Tx laser and detuned in frequency by ~ 320  MHz, giving rise to a beat signal, as labeled in the solid-red spectral trace in the right inset of Fig. 2. The quantum data band and pilot tone generated by the AWG are also labeled. Due to finite OSSB[29], a suppressed pilot tone is also visible; the corresponding suppressed quantum band was however outside the receiver bandwidth (we used a low pass filter with a cutoff frequency around 360 MHz at the output of the homemade heterodyne detector[30]). As shown, the Tx and Rx had their clocks synchronized, and the Tx provided a trigger for data acquisition in Rx[34,35].

Separately, we also measured the vacuum noise (Tx laser off, Rx laser on) and the electronic noise of the detector (both Tx and Rx lasers off), depicted by the dotted-blue and dashed-green traces, respectively, in the right inset of Fig. 2. The clearance of the vacuum noise over the electronic noise is > 15 dB over the entire quantum data band.

Noise analysis & calibration

A careful choice of the parameters defining the pilot tone and the quantum data band and their locations with respect to the beat signal is crucial in minimizing the excess noise. A strong pilot tone enables more accurate phase reference but at the expense of higher leakage in the quantum band and an increased number of spurious tones. The latter may arise as a result of frequency mixing of the (desired) pilot tone with e.g., the beat signal or the suppressed pilot tone. As can be observed in the right inset of Fig. 2, we avoided spurious noise peaks resulting from sum- or difference-frequency generation of the various discrete components (in the solid-red trace) from landing inside the wide quantum data band.

In CVQKD, it is well known that Alice needs to optimize the modulation strength of the coherent state alphabet at the input of the quantum channel to maximize the secret key length. For this, we connected the Tx and Rx directly, i.e., without the quantum channel, and performed heterodyne measurements to calibrate the mean photon number μ of the coherent states’ ensemble. The AWG electronic gain and the variable attenuator (VATT) provided a fine-grained knob to control the modulation strength.

Since we conducted our experiment in the non-paranoid scenario[1,26], i.e., we trusted some parts of the overall loss and excess noise by assuming them to be beyond Eve’s control, some extra measurements and calibrations for the estimation of trusted parameters become necessary. More specifically, we decomposed the total transmittance and excess noise into respective trusted and untrusted components. In Supplementary Note 4, we present the details of the calibration of the receiver efficiency (trusted transmittance) τ = 0.69 and trusted noise from the detector ξ = 25.71  × 10−3 photon number unit (PNU). Let us remark here that in our work, we express the noise and other variance-like quantities, e.g., the modulation strength, in PNU as opposed to the traditional shot noise unit (SNU). The former is independent of quadratures and facilitates a comparison with discrete-variable (DV) QKD systems[36], highlighted using μ in Table 1. A simple factor of 2 relates these units: 1 photon number unit (PNU) corresponds to a variance of 2 shot noise units (SNU). Finally, note that we recorded a total of 1010 ADC samples for each of the calibration measurements, and all the acquired data was stored on a hard drive for offline processing.

Table 1

Comparison of notable parameters from prepare-and-measure QKD experiments conducted in the last decade with similar physical channels, as indicated by the column showing loss and length

	Protocol implementation keywords	Loss/ Length [dB/km]	μ [PNU]	ξu [PNU]	ξQ [%]	B [MHz]	N( × 109) [symbols]	SKF [bits/symbol]
Huang et al. (ref. 33)	CV, Gaussian, Homodyne via RLO	5.0/25.0	2.00	0.025*		100	0.02	0.0010*
Xu et al. (ref. 40)	DV, phase coding, Avalanche diode	4.5/20.0	0.37		2.73	5	7.84	0.0001*
Islam et al. (ref. 41)	DV, time-bin coding, Superconducting	4.0/20.0	0.45		5.49	2500	62.5	0.0105
Wang et al. (ref. 20)	CV, Gaussian, Heterodyne via RLO	5.0/25.0	1.62	0.011		100	0.01	0.0185
Zhang et al. (ref. 21)	CV, Gaussian, Homodyne via TLO	4.4/27.3	7.19	0.002		5	100	0.0560
Current work	CV, Gaussian, Heterodyne via RLO	4.6/20.3	1.45	0.005		100	1	0.0471

Values with a superscript * may be somewhat inaccurate as they were inferred from a graph. μ, mean photon number of the quantum state alphabet; ξ, untrusted noise (referred to channel output); ξ, quantum bit error rate; B, repetition rate in pulsed or quantum data bandwidth in CW implementations; N, number of transmitted quantum data symbols or pulses in the experiment; secret key fraction (SKF), secret key length in bits divided by N. It is possible to parametrize ξ and ξ by the same quantity, namely the mean number of noise photons from the channel, in CV and DV systems, respectively[36]. Also, assuming symmetry between the quadratures, 1 photon number unit (PNU) corresponds to a variance of 2 shot noise units (SNU).

R/TLO: real/transmitted LO.

Protocol operation

After setting μ = 1.45 PNU, we connected the Tx and Rx using the 20 km channel, optimized the signal polarization, and then collected heterodyne data using the same Gaussian distributed random numbers as mentioned above. Offline DSP[24] provided the symbols that formed the raw key. The preparation and measurement was performed with a total of 109 complex symbols. After discarding some symbols due to a synchronization delay, Alice and Bob had a total of NIR = 9.88 × 108 correlated symbols at the beginning of the classical phase of the protocol, the implementation of which we describe below. Note that we assumed the existence of an authenticated channel for these steps.

IR was based on a multi-dimensional scheme[37] using multi-edge-type low-density-parity-check error correcting codes[38]. As shown in Fig. 1, Bob sent the mapping and the syndromes, together with the hashes computed using a randomly chosen Toeplitz function, to Alice, who performed correctness confirmation and communicated it to Bob. We obtained a reconciliation efficiency β = 94.3% and FER = 12.1% for the experimental data. In Supplementary Note 5, we provide further details about the operating regime and the performance of these codes. Due to the non-zero FER, Alice and Bob had NPA = 8.69 × 108 complex symbols for distilling the secret key via PA.

During PE, Alice estimated the entropy of the corrected symbols, and together with the symbols from the erroneous frames, i.e., frames that could not be reconciled successfully (and were publicly announced by Bob), Alice evaluated the covariance matrix. This was followed by evaluating the channel parameters using the receiver calibration data, performing the ‘parameter estimation test’ (refer Theorem 2 in ref. 10), and getting a bound on Eve’s Holevo information. Subtracting ξ from the total excess noise of 30.9 mPNU yielded the mean untrusted noise ξ = 30.9 − 25.7 = 5.2 mPNU, while dividing the total transmittance of 0.25 by τ gives us the mean untrusted transmittance η = 0.25/0.69 = 0.36.

Alice calculated a secret key length l = 41378264 bits in the worst-case scenario by substituting in Eq. (1) the security parameters ϵ = ϵent = ϵcal = ϵ = ϵPE = 10−10 and ϵIR = 10−12, and n = 2NPA (factor of 2 owing to data from both I and Q quadratures). As shown in Fig. 1, this length was communicated together with a seed to Bob to select a random Toeplitz hash function. Alice and Bob then employed the high-speed and large-scale PA scheme[39] to generate the final secret key s( = s = s). Note that the final security parameter ϵ(coll) quantifying composable security against collective attacks is a linear summation of the various epsilons mentioned before; see Supplementary Note 2 for an exact expression.

Discussion

Using the equations presented in section “Composably secure key”, we can calculate the composably secure key length for a certain number n of the quantum symbols. We partitioned N = 109 in 25 blocks, estimated the key length considering the total number N of symbols accumulated from the first k blocks, for k ∈ {1, 2, …, 25}. Dividing this length by N yields the composable secret key fraction (SKF) in bits/symbols. If we neglect the time taken by data acquisition, DSP, and the classical steps of the protocol, i.e., only consider the time taken to modulate N = N coherent states at the transmitter (at a rate B = 100 MSymbols/s), we can construct a hypothetical time axis to show the evolution of the CVQKD system.

Figure 3a depicts such a time evolution of the SKF after proper consideration to the finite-size corrections due to the average and worst-case (black and red data points, respectively) values of the underlying parameters. Similarly, Fig. 3b shows the experimentally measured untrusted noise ξ (lower squares) together with the worst-case estimator (upper dashes) calculated using N in the security analysis. To obtain a positive key length, the worst-case estimator must be below the maximum tolerable noise—null key fraction threshold—shown by the dashed line, and this occurs at N/B ≈ 2.0 s.

Fig. 3

Composable SKF results.

a Pseudo-temporal evolution of the composable SKF with the time parameter calculated as the ratio of the cumulative number N of complex symbols available for the classical steps of the protocol and the rate B = 100 MHz at which these symbols are modulated. b Variation of untrusted noise ξ measured in the experiment (lower point) and its worst-case estimator (upper point), and the noise threshold to beat to get a positive composable SKF. The deviation of the simulation traces in (a) from the experimental data between 1 and 5 s is due to the slight increase in ξ. c, d Comparison of confidence intervals derived in this manuscript (Beta; solid-red trace and Gaussian; dotted-green trace) with those derived in the original composable security proof (ref. 10; dashed-blue trace) as a function of N. Using the confidence intervals from ref. 10 leads to no key generation until almost the end (filled-blue square in (a) at N/B ≈ 10).

Note that in reality, the DSP and classical data processing consume a significantly long time: In fact, we store the data from the state preparation and measurement stages on disks and perform these steps offline. The plots in Fig. 3 therefore may be understood to be depicting the time evolution of the SKF and the untrusted noise if the entire protocol operation was in real time.

Referring to Fig. 3a, the solid-red and dashed-black traces simulate the SKF in the worst-case and average scenarios, respectively, while the dotted-orange trace shows the asymptotic SKF value (with FER taken into account) obtainable with the given channel parameters. Per projections based on the simulation, the worst-case composable SKF should be within 5% of the asymptotic value for N ≈ 1011 complex symbols.

From a theoretical perspective, the reason for being able to generate a positive composable key length with a relatively small number of coherent states (N ≈ 2 × 108) can mainly be attributed to the improvement in confidence intervals during PE; refer Eqs. (6) and (7). Figure 3c and d quantitatively compare the scaling factor in the RHS of these equations, respectively, as a function of N for three different distributions. The estimators , , for this purpose are the actual values obtained in our experiment and we used an ϵPE = 10−10. The difference between the confidence intervals used in ref. 10 (suitably modified here for a fair comparison) with those derived here, based on the Beta distribution, is quite evident at lower values of N, as visualized by comparing the dashed-blue trace with the solid-red one.

Since the untrusted noise has a quadratic dependence on the covariance in contrast to variance where the dependence is linear, a method that tightens the confidence intervals for the covariance can be expected to have a large impact on the final composable SKF. In fact, if we had used the confidence intervals of Ref. 10, our implementation would not have produced any composable key until N = 109, at which the worst-case SKF would have been 6.04 × 10−4, i.e., almost two orders of magnitude lower than what we have achieved here (single blue data point in bottom-right corner of Fig. 3a).

On the practical front, a reasonably large transmission rate B = 100 MSymbols/s of the coherent states together with the careful analysis and reduction of untrusted noise (refer section “Noise analysis & calibration” for more details) enables an overall fast, yet low-noise and highly stable system operation, critical in quickly distributing raw correlations of high quality and keeping the finite-size corrections minimal. Table 1 provides a comparison of results from our proof-of-concept experiment with three other Gaussian-modulated CVQKD experiments[20,21,33] that provide security against collective attacks but do not include composable security definitions. Table 1 also lists two[40,41] of (multiple) DVQKD experiments that have been able to prove composable security against general attacks in a realistic finite size regime—the holy grail for any QKD system. In the “Methods” section, we discuss the challenges for our CVQKD implementation in achieving this security criterion.

In conclusion, our results have demonstrated composability and protection against collective attacks while ensuring robustness against finite-size effects in a coherent-state CVQKD protocol, operating in laboratory conditions, over a 20 km long quantum channel. With an order of magnitude larger N and half the current value of ξ, we expect to obtain a non-zero length of the composable key while tolerating channel losses around 8 dB, i.e., distances up to ~ 40 km (assuming an attenuation factor of 0.2 dB/km). This should be achievable with some improvements in the hardware as well as the digital signal processing. We therefore expect that in the future, users across a point-to-point link could use the composable keys from our implementation to enable real applications such as secure data encryption, thus ushering in a new era for CVQKD.

Methods

Penalty from the asymptotic equipartition property

In ref. 25, the asymptotic equipartition property bound is proven in Corollary 6.5:whereand

In the following, we use the fact that is non-negative for our classical-quantum state, a proof of which is given in Supplementary Note 2.where d denotes the number of bits per quadrature used during discretization.

Using the above relations in Eq. (10) allows us to bound v:

Now we can easily check that for d > 1,and that

Putting all together we finally obtain

Penalty from entropy estimation

The entropy in Eq. (5) can be estimated from the empirical frequencywhere is the number of times a specific complex symbol is obtained, and is the total number of exchanged and corrected quantum symbols. One can define an entropy estimatorwhich is linked to by the following inequality[10,42]:This holds true up to a probability smaller than ϵent.

Composable security against general attacks

For CVQKD with coherent states, the only known proofs providing composable security against general attacks[11,15] requires dual quadrature detection. This rules out the experiment in ref. 21, as despite recording the largest N = 1011 symbols and the lowest ξ value amongst all CVQKD works in Table 1, it used homodyning. On the upside, the proofs permit the assumption that the underlying quadrature data follows a Gaussian distribution, which somewhat relaxes the requirements on N. For instance, in the case of confidence intervals, one can observe the dotted-green traces in Fig. 3c and d show the best performance.

Nevertheless, to achieve composable security against general attacks, one needs ϵ(gen) ~ O(N4)ϵ(coll) as the final security parameter. A reasonable ϵ(gen) of 10−9 assuming N ~ 108 then requires ϵ(coll) < 10−41 but this is not the case with our current setup as ϵ(coll) ≳ ϵqrng = 2 × 10−6 actually. This limitation, due to the ADC digitization error in the QRNG, could be improved using longer measurement periods[30]. Yet another issue is the symmetrization requirement, a procedure in which Alice and Bob need to multiply their respective symbol trains by an identical random orthogonal matrix of size N × N, which poses a major computational challenge.