With quantum computers threatening to break the security of today’s cryptosystems, the field of quantum communications attracts increasing attention. In this field, continuous variable quantum key distribution (CV-QKD) is very attractive for a practical implementation because it is based on coherent detection and promises to require only commercial off-the-shelf components. However, one crucial difference to classical optical communications is that the received power level is usually less than 1 ph/bit for a discrete modulation [1], translating to a signal to noise ratio (SNR) of less than 0 dB. Additionally, residual phase noise contributes to the excess noise [2], which is the critical performance parameter for CV-QKD [3]. The combination of ultra low SNR and required accuracy makes carrier phase recovery the major challenge in practical CV-QKD. The first approach to deal with this challenge was to avoid phase noise by using a remote local oscillator (LO) [3–6]. The disadvantage is that the remote LO compromises the security and limits the achievable distance [7]. Therefore, it is highly preferable that CV-QKD systems work with a real LO generated by a separate laser source at the receiver site (Bob). Since 2015, various real LO systems have been proposed and experimentally demonstrated [8–17]. In all the proposed systems, carrier phase estimation is based on auxiliary signals, also called pilots, that are generated at the transmitter site (Alice). However, the pilots occupy additional bandwidth and significantly increase the complexity of the system. For example, the system in [16] uses only one polarization for the quantum signal and the orthogonal one for a pilot tone. In [8], two pilot tones are multiplexed with the quantum signal in the frequency domain and occupy more bandwidth than the quantum signal itself. In both cases, the spectral efficiency could at least be doubled without pilots. Another important issue is that pilot tones are not included in the current security proofs for CV-QKD [1, 18]. Despite all these issues, no real LO system without pilot tones has been reported up to now. Regarding the large number of pilot-based systems proposed, it appears as if pilot tones were indispensable in CV-QKD systems with a real LO. However, no convincing argument or experimental demonstration about the necessity of pilots has been made yet. The present article addresses the question of whether or not designing a CV-QKD system without pilot tones is possible with current fiber-optic technology. Our approach is to design and experimentally investigate such a CV-QKD system. In this, the quantum signal is discrete phase modulated with an order of M = 2 or M = 4. The latter corresponds to the most established CV-QKD protocol with a discrete modulation. A Bayesian particle smoother, which is trained using Monte Carlo Markov chain (MCMC) methods, is used for carrier phase estimation at the receiver. As particle smoothing achieves optimum tracking of dynamic variables it is very suitable to investigate the limits of carrier phase estimation in the ultra-low SNR regime. In any CV-QKD protocol, it is absolutely necessary that Alice reveals a fraction of her transmitted symbols via a public classical channel [19]. We demonstrate that these already available symbols can also be used to substantially improve the phase noise mitigation which enables pilotless CV-QKD without any loss of efficiency.

The experimental setup and digital signal processing (DSP) routine is shown in figure 1. The quantum signal is discrete phase-modulated in baseband with a modulation order M = 2 or M = 4 at a symbol rate of 17 GBd. Bob uses a balanced receiver to perform heterodyne detection at an intermediate frequency of . In the DSP routine, Bob first down-converts the signal to baseband and applies the matched filter the signal is down-sampled to 2 samples per symbol (sps) and equalized by the FIR-filter

SMF 28 Alice Bob

Figure 1. Experimental setup and digital signal processing (DSP) routine for the CV-QKD system without pilot tones. The quantum signal is discrete phase-modulated with a modulation order M = 2 or M = 4 at a symbol rate of 17 GBd. The received and digitized signal is recorded for offline processing. For the DSP routine, the total signal is split into blocks with index n. Each block contains symbols. Publicly revealing a randomly selected part of Alice’s symbols is necessary in CV-QKD [4]. Carrier phase estimation is performed by a particle smoother that takes into account these available symbols.

, which is tuned using the constant-modulus algorithm only once for a high SNR. Timing synchronization is performed by the digital filter and square algorithm [20] followed by an extended Kalman filter that tracks the argument of the complex Fourier coefficient where n is the block index of the blockwise DSP procedure. After timing correction (and down-sampling to one sample per symbol, carrier phase estimation is performed by a particle smoother. In order to find the optimum parameters of the state space model, an extended Kalman filter is trained using MCMC methods [21].

The achievable key rate and distance of any CV-QKD system is very sensitive to the excess noise power normalized to shot noise units because it could provide information to an eavesdropper. To obtain an accurate excess noise estimate after the quantum communication, receiver noise calibration and quantum signal power estimation are required in CV-QKD. Therefore, excess noise estimation is also an important part of our experimental

investigation. One can write the mean power of the received symbols

where are the quantum signal power, the shot noise power, the electrical receiver noise power and the excess noise power in arbitrary units respectively. The excess

noise in shot noise units is calculated as

To calibrate , the quantum signal is deactivated. The total noise power and the electrical noise power are calibrated in separate measurements with activated and deactivated LO respectively. This is done after each quantum signal measurement. To estimate in our experiments, we evaluate the correlation between and

Generally in CV-QKD, to estimate and other important parameters such as the channel transmission and the mutual information shared between Alice and Bob, Alice has to reveal a randomly selected subset of her transmitted symbols after the quantum signal

transmission [19]. More precisely, she publicly reveals the vector

That means that for each individual quantum symbol, there is a probability revealed after the quantum communication. As a side effect of symbol revelation, the particle smoother can take advantage of the revealed symbols to improve the accuracy of phase estimation. Depending on the value of each element , the particle smoother adapts its measurement model accordingly. This means that phase estimation can only take place after Alice’s symbol revelation. However, as the sequence is already down-sampled to one sample per symbol, it is no additional effort to store the sequence compared to since the continuous variable must be stored for error correction anyway, which takes place after Alice’s symbols have been revealed [3], this approach does not affect the feasibility nor the efficiency of the CV-QKD system in any way.

The noise calibration not only enables the excess noise estimation but also the estimation of the electrical to shot noise ratio and the receiver efficiency . These are important

Figure 2. Block diagram for the simulations. The measured phase was obtained using the experi- mental setup where the SNR of the quantum signal was . The transmission model corresponds to an ideal AWGN channel. For phase estimation, the same particle smoother as in the experiments is used. All other impairments that are present in the experiments such as timing errors, chromatic dispersion, bandwidth limitations and other linear distortions are excluded from the simulations.

characteristics as they not only have an impact on the secret key rate but also on the relation

between received optical power in photons per symbol and the SNR of

In the present setup, which results in corresponding to a penalty for compared to an ideal heterodyne receiver with and

To initialize the quantum communication, all symbols of the first signal block are revealed by Alice. This helps the particle smoother to obtain an accurate initial estimate quantum channel frequency even at ultra low SNR. After the first block, the downconversion frequency is updated with and the quantum communication begins.

A residual phase noise in induces excess noise that is proportional to the received quantum signal power [22]. This means that with decreasing the impact of phase errors on the excess noise is reduced. At ultra low , the excess noise can be relatively small, even if the carrier phase estimation fails completely. However, in this case the mutual information between Alice and Bob drops drastically which prevents a successful key generation. Therefore, in order to verify a successful signal demodulation at ultra low we also evaluate the hard decision mutual information and compare it to its theoretical value.

In addition to the experiments, we carried out simulations to isolate the impact of phase noise and to investigate the phase noise limited performance of our system. A block diagram

Figure 3. Resulting system performance for M = 4 in terms of the mutual information between Alice and Bob and the excess noise in Bob’s received symbols . Experimental results are shown on the left hand side (a). Simulation results are shown on the right hand side (b).

of the simulation model is shown in figure 2. As only additive noise and laser phase noise are included in the simulation model, it does indeed correspond to a phase noise limited system. The phase noise sequence used in the simulations is taken from a measurement with the experimental setup. Thus, the performance of the simulation model corresponds to the best that could be achieved with the laser sources in use.

The experimental and simulation results for M = 4 and M = 2 are shown in figures 3 and 4 respectively. A typical value of [6] but in principle it could also be lower. Bob’s phase estimation should only use the transmitted symbols that are revealed anyway. Therefore, we investigate our system for a low . Additionally, we investigate the cases represents an upper bound for the performance of phase estimation, shows the achievable performance without symbol revelation. Also, the case could be interesting for other fields than CV-QKD where symbol revelation

Figure 4. Resulting system performance for M = 2 in terms of the mutual information between Alice and Bob and the excess noise in Bob’s received symbols . Experimental results are shown on the left hand side (a). Simulation results are shown on the right hand side (b). The small and solid markers indicate negative values.

is not possible.

With , the receiver sensitvity in the experimental system is This is in very good agreement with the simulation, where the signal demodulation completely fails at an Thus, despite the narrow linewidth fiber lasers, the receiver sensitivity is limited by phase noise. In terms of received optical power, at least 1.5 ph/sym would be required. This is too high for the discrete phase modulation scheme with M = 4, where the transmitted optical power should usually be lower than 0.5 ph/sym [1]. However, even a small revelation probability of is sufficient to enable successful signal demodulation down to at least an . In the experiment, the SNR was not decreased further because the receiver calibration was not accurate enough to allow for a reliable evaluation of and the excess noise in that regime. The experimentally confirmed receiver sensitivity of is sufficient for CV-QKD over 26 km and more. In the simulation results, it can be seen that the carrier phase estimation can be successful down to an . However, there is already an increased probability of failure above as can be seen in the simulations for M = 2 shown in figure 4, where the minimum . Therefore, we take this higher value as the receiver sensitivity.

The simulations show the phase noise limited performance. At an is no difference in the resulting excess noise between different probabilities of revelation. Apparently, in that case the uncertainty about the carrier phase is not increased by the discrete phase modulation. This is the SNR regime of classical communications where symbol error rates are low and the modulation could also be canceled effectively before carrier phase estimation. In the quantum regime of , the modulation clearly affects the carrier phase estimation and hence the excess noise. With exhibits a constant slope of about 3 dB per decade. This is the result of a decreasing quantum signal power decreasing the excess noise while at the same time decreasing the SNR increases the carrier phase uncertainty which induces additional excess noise. With , in the regime of , there is a net increase of with decreasing until the demodulation fails completely. Interestingly, for , there is not much value of the revelation around . In this regime, the unrevealed symbols still provide significant information about the carrier phase. But in the regime of , the slope of the one of the case . In this regime, the revealed symbols provide more information about the carrier phase than the unrevealed ones and the difference between can be interpreted as a difference of the effective symbol rate. Due to this, there is a relatively constant excess noise penalty of about a factor of regime between , the slope is flattened.

Looking at the experimental results for the excess noise, we observe a much higher level than in the simulations. Also, there is a proportional relation between slightly flattens below an This confirms that the excess noise mainly originates from signal distortions. The signal to distortion ratio can be quantified for , which is relatively low and could be improved by optimizing the equalization concept.

For M = 2, the results are shown in figure 4. The main difference to M = 4 is that the receiver sensitivity for the case is much lower. In the simulations it was and in the experiment compared to the The difference between experiment and simulations seems quite large. However, there is still

Figure 5. Achievable key rates for , taking into account the polynomial fits for the excess noise in figure 3 as well as the experimental parameters A reconciliation efficiency of 95 % and a fiber loss of 0.2 dB/km was assumed. The launch power was optimized based on the security analysis in [1].

a significant probability of successful demodulation below these values in the experiments and simulations. This indicates that the probability of failure increases less steep with decreasing as in the case of , the transition to relying only on the revealed symbols for phase estimation is much wider for M = 2 compared to M = 4. Even at , the excess noise is slightly lower with M = 2 compared to M = 4. However, there is no significant difference between these two cases in terms of experimental excess noise which is dominated by other signal distortions.

In order to address the question of whether or not the performance of the investigated system with a real LO and without pilots is sufficient for CV-QKD, we calculated asymptotic secret key rates. The calculations are based on the well established security proofs [23] and [1]. These assume a linear Gaussian channel and are therefore not fully general. Recently, a security proof that does not incorporate these assumptions has been presented [24]. However, the question of how to get rid of the linear Gaussian assumption is still under discussion.

We optimized the transmitted optical power with respect to a maximum key rate. For this, we used the polynomial fits for the excess noise in the case of plotted in the figures 3 and 4. An additional constraint of the optimization was that is not allowed to be lower than in the experiments and simulations respectively and also not allowed to be lower than the receiver sensitivity. The measured receiver efficiency electronic noise ratio as well as the fiber length are also included in the secret key rate calculations. The reconciliation efficiency is assumed to be 95 %.

The resulting secret key rates for are shown in figure 5. As a reference, the case of zero excess noise is also plotted. The simulation corresponds to the case of the excess noise being dominated by carrier phase uncertainty. In this case, distances of up to 72 km could be achieved with M = 4 and 32 km with M = 2. This shows that laser phase noise is not an insurmountable obstacle for designing a CV-QKD system with a real LO and without pilots. Even for the experimental system, where the excess noise is much higher due to other signal distortions, CV-QKD could be performed successfully with M = 4 at a key rate of over the experimental distance of 26 km. With M = 2, the experimental performance is not sufficient for CV-QKD. The worse performance of M = 2 is due to stricter requirements regarding the transmitted power and excess noise [1]. The experimental key rate can be improved towards the simulation by reducing signal distortions in the experiment. This can be achieved by improving the equalization concept of the system. To achieve the long distances that are possible as shown by the simulations, the receiver calibration should be improved. We expect that this can be achieved by reducing the time difference between calibration and quantum signal transmission in order to mitigate fluctuations of the receiver noise and LO power. If the system is optimized such that it is limited by phase noise, the parameter can be increased which directly reduces the excess noise for even higher key rates and longer distances. Also, increasing can enable the use of lasers with stronger phase noise while keeping the achievable distance.

To conclude, we investigated a fiber-based quantum communication system for CV-QKD that employs a real LO and works without any pilot tones. As Bob’s clock and LO are free running, he relies only on the modulated quantum signal itself to perform carrier phase estimation and timing recovery. Except for the fact that the signal is attenuated before it is transmitted, the physical implementation is identical to classical coherent systems. For the first time it could be demonstrated experimentally, that such a system can be feasible for CV-QKD. An important factor to achieve this is the particle smoother that is used for carrier phase estimation, which is optimized using Monte Carlo Markov chain methods. Based on the experimental results, the achievable key rate over a distance of corresponding to 9.2 Mbit/s. The simulation results indicate that this performance can even be largely improved. Possible ways to achieve this is by reducing other signal distortions than phase noise and by improving the receiver calibration. The achieved results are an important milestone for CV-QKD. Also, the achieved receiver sensitivities without symbol revelation (M = 2 have, to our knowledge, never been reached before. Therefore, the novel techniques are also beneficial in other coherent systems where the SNR can be extremely low, such as optical satellite communications.

The transmitter laser and LO are continuous wave DFB fiber lasers of type NKT Koheras E15. Only one polarization of the dual polarization modulator is used, the orthogonal one is biased to the zero transmission point. The baseband quantum signal contains AliceâĂŹs symbols that are pulse-shaped by the root raised cosine filter with a roll-off factor of 0.1 and a bandwidth of 17 GHz.

For each experimental scenario, defined by the transmitted optical power and modulation order, Bob’s receiver is calibrated after quantum signal transmission. For this, the quantum signal is deactivated to record the total receiver noise. After that, the LO is also deactivated to record only the electrical receiver noise. The noise signals undergo the same DSP routine as the quantum signal but with deactivated timing recovery and phase estimation because these methods do not alter the evaluated mean power of the received noise sequence. The signals are recorded with a time difference of about 3 s. For each quantum and noise signal, a total number of 100 blocks are evaluated corresponding to does not include the first signal block that is used to initialize . The transmitted optical power in the initialization block is the same as for the subsequent quantum communication.

In the simulations, the number of evaluated quantum symbols is the same as in the experiment. The true phase is directly accessible. Excess noise due to inaccuracies in

the estimated phase can be calculated as [22]

In the simulations, only the total noise power is specified. To calculate

assume a specific electrical to shot noise ratio to calculate

Here, which corresponds to the value that was measured in the experiments.

The particle smoother is a Bayesian method that requires a measurement model and a dynamic model formulated as probability densities. A detailed general description of particle smoothing can be found in [21]. The transmitted symbols are M-ary phase modulated,

meaning that

In an AWGN channel, Bob’s measurement signal at the input of the particle smoother can

be written as

where is a complex white Gaussian noise sequence with mean power dynamic laser phase. The normalization of Bob’s signal such that it matches performed using the noise power that is known from receiver calibration. Thus, for the case

, the measurement probability density can be written as

Here, is a Gaussian probability density with mean and covariance matrix denotes the 2-dimensional identity matrix. If , the transmitted symbol is known to Bob and the measurement probability density reduces to There are no unknown parameters in the measurement model.

The state space model describes the dynamics of the variable

it as

The variable is a normalized frequency that models a drift of the differential laser frequency as a random walk with variance [25]. Additionally, is affected by a random walk with variance . Based on the stated measurement and dynamic model, the particle smoother is implemented as a bootstrap filter with N = 200 particles in combination with a backward-simulation particle smoother with 10 trajectories. The resampling condition of the bootstrap filter is is the effective number of particles.

The particle smoother is capable of performing optimum phase estimation, given that the state space model is an accurate representation of the measurement and laser dynamics. Thus, optimizing the set of unknown parameters is essential. For this, we used Monte Carlo Markov chain methods which are based on minimizing the energy function . The energy function has the property . Therefore, minimizing it leads to the parameters that provide the most accurate description of the true phase dynamics. We performed the minimization based on a received signal using an extended Kalman filter to calculate The extended Kalman filter is based on the same state space model as the particle smoother. The minimum was found using the simplex search method [26]. The resulting optimized

For signal processing, the total signal is split into consecutive blocks of length L = symbols with index n. The digital filter and square algorithm for timing recovery is implemented as described in [20] and calculates the complex Fourier coefficient one complete block. From the argument of , the current timing offset can be obtained. The SNR of scales approximately as in the regime of the accuracy of timing recovery can be improved by increasing L. However, the timing experiences a relatively constant drift of 0.032 symbol periods per block due to a clock offset between Alice and Bob of which means that the block length cannot be arbitrarily increased. At the given block length, pulse shape and at an resulting which is too low to obtain sufficiently low excess noise. Therefore, our approach is to track the argument using an extended Kalman filter. As this is very similar to the problem of carrier phase tracking, the same state space model is used.

For mutual information estimation, Bob performs a hard decision on his symbols, meaning that each is mapped to the symbol of the discrete alphabet with the smallest euclidean distance. Bob’s symbols after this mapping are denoted as . Based on the measured probabilities we calculate the mutual information, where all transmitted and received symbols are taken into account.

Assuming an ideal AWGN channel, the received symbols can be written as is Alice’s transmitted symbol and is a white Gaussian noise sequence with a mean power of 1. The probability density of the phase

By numerical integration of over each decision region and for each transmitted symbol, we obtain the theoretical probabilities that are required to calculate the theoretical value of

For excess noise estimation, the quantum signal power must be estimated. In our

experiments, this is done by calculating

where K is the total number of evaluated symbols. For the estimation of , all transmitted

and received symbols are used to obtain an estimate that is accurate regardless of

[10] B. Qi, P. Lougovski, R. Pooser, W. Grice, and M. Bobrek, Generating the Local Oscillator

[11] D. B. Soh, C. Brif, P. J. Coles, N. Lütkenhaus, R. M. Camacho, J. Urayama, and M. Sarovar,

[12] B. Schrenk and H. Hübel, Pilot-Assisted Local Oscillator Synchronisation for CV-QKD, in 6th

[13] A. Marie and R. Alléaume, Self-coherent phase reference sharing for continuous-variable quan-

[14] B. Schrenk, F. Laudenbach, C.-H. F. Fung, C. Pacher, A. Poppe, R. Lieger, D. Hillerkuss,

[15] L. C. Comandar, H. H. Brunner, F. Karinou, F. Fung, S. Bettelli, D. Hillerkuss, S. Mikroulis,

[16] F. Laudenbach, B. Schrenk, C. Pacher, M. Hentschel, C.-H. F. Fung, F. Karinou, A. Poppe,

[17] T. Wang, P. Huang, Y. Zhou, W. Liu, H. Ma, S. Wang, and G. Zeng, High key rate continuous-

[18] S. Fossier, E. Diamanti, T. Debuisschert, R. Tualle-Brouri, and P. Grangier, Improvement of

[19] F. Grosshans, N. J. Cerf, J. Wenger, R. Tualle-Brouri, and P. Grangier, Virtual Entanglement

[20] M. Oerder and H. Meyr, Digital Filter and Square Timing Recovery, IEEE Transactions on

[22] S. Kleis and C. G. Schaeffer, Improving the Secret Key Rate of Coherent Quantum Key Dis-

[23] A. Leverrier and P. Grangier, Continuous-variable quantum key distribution protocols with a

[24] S. Ghorai, P. Grangier, E. Diamanti, and A. Leverrier, Asymptotic security of continuous-

[25] M. Piels, M. I. Olmedo, W. Xue, X. Pang, C. Schaffer, R. Schatz, G. Jacobsen, I. T. Monroy,

[26] J. C. Lagarias, J. A. Reeds, M. H. Wright, and P. E. Wright, Convergence Properties of the