Continuous-variable quantum key distribution over multispan links employing phase-insensitive and phase-sensitive amplifiers

Transmission losses through optical fibers are one of the main obstacles preventing both long-distance quantum communications and continuous-variable quantum key distribution. Optical amplification provides a tool to obtain, at least partially, signal restoration. In this work, we address a key distribution protocol over a multi-span link employing either phase-insensitive (PIA) or phase-sensitive (PSA) amplifiers, considering Gaussian modulation of coherent states followed by homodyne detection at the receiver’s side. We perform the security analysis under both unconditional and conditional security frameworks by assuming in the latter case only a single span of the whole communication link to be untrusted. We compare the resulting key generation rate (KGR) for both kinds of amplified links with the no-amplifier protocol, identifying the enhancement introduced by optical amplification. We prove an increase in the KGR for the PSA link in the unconditional scenario and for both PSA and PIA in the conditional security setting depending on position of the attack and the measured quadrature.


Introduction
Thanks to the quantum key distribution (QKD) [1][2][3] it is possible to distill a random secure key between a sender (Alice) and a receiver (Bob), communicating via an untrusted quantum channel under the control of an eavesdropper (Eve).Generally speaking, QKD protocols may be divided into two branches: discrete-variable QKD, in which qubit states are exchanged [4,5], and continuous-variable QKD (CV-QKD), exploiting the quadratures of a quantum optical field [6,7].In particular, CV-QKD provides a powerful resource as it exploits coherent states of radiation and quadrature measurements [8], thus being compatible with modulation and detection systems already employed in standard fiber-optic communications [9].
The milestone of CV-QKD is represented by the GG02 protocol, originally proposed by Grosshans and Grangier [6,7,[10][11][12], in which Alice generates coherent states by sampling a Gaussian distribution and Bob randomly implements a homodyne detection of one of the two orthogonal quadratures of the field.Later, a no-switching scheme has also been proposed in which the single quadrature measurement is replaced by double homodyne detection [13].The GG02 protocol has been widely analyzed in the unconditional security framework [7], exploiting the optimality of Gaussian attacks [14][15][16].In this approach one considers the most general attack allowed by the laws of quantum mechanics, which requires the eavesdropper to possess a quantum computerlike machinery and perform any collective unitary and detection operations on many time slots.In practice, however, one can often restrict the attacks to a reasonable smaller class, either assuming a limited power by the eavesdropper or some level of trust in the infrastructure.For example, in satellite QKD a typical attack consists of detecting some part of the signal that is not captured by Bob's telescope [17].Similarly, for the fiber-based protocols, it is reasonable to assume that an attack is performed on just a single section of the fiber and that attacker cannot easily gain access to the whole cable.For these reasons, more recently, the interest has been directed to the composable security approach, in which every step of the protocol is associated with some error, ultimately leading to an overall ϵ-security [18].Moreover, towards a practical description, within the framework of composable security there have also been included realistic assumptions on the feasible experimental setups, such as wiretap channels [19][20][21], restricted eavesdropping [19] and different trust levels of the setup components [22].
Above all, in CV-QKD a crucial factor restricting security of long-distance secure communication is provided by channel losses.Indeed, a canonical model for optical fibers is provided by the thermal-loss channel, in which the channel transmissivity is exponentially decaying with the transmission distance [23][24][25].To compensate transmission losses and restore the signal, one can employ optical amplifiers [26][27][28] and consider a multispan link, that is, a periodic array of amplifiers connected by many independent thermal-loss channels.So far, multispan links have been investigated with the intent of increasing channel capacity [29][30][31][32], showing that both phase-insensitive amplifiers (PIAs) [31] and phase-sensitive amplifiers (PSAs) [32] induce an exponential enhancement of the ultimate capacity being more appreciable for shortdistance communication.In contrast, in the context of CV-QKD only heralded noiseless linear amplification [33][34][35][36] and quantum repeaters [37][38][39] have been considered.These provide innovative solutions, but are technologically challenging and far from a direct large-scale implementation.
In this paper, we address the problem of performing CV-QKD over a multispan link.We maintain the same modulation and detection schemes of GG02, that is, a Gaussian modulation of coherent states and homodyne detection, but replace the single thermalloss channel of the original proposals with a multispan link of M spans connected via either PIAs or PSAs.In particular we compare three different cases: a PIA link with random homodyne detection of one of the two orthogonal field quadratures and a PSA link with homodyne detection of either the amplified or deamplified quadrature.We compute the key generation rate (KGR), i.e. the length of the secret key per unit time slot, in both the unconditional and the composable security approaches.In the former scenario, we prove that unconditional security is improved in particular regimes only by PSA links followed by homodyne measurement of the deamplified quadrature.On the other hand, we also address composable security under restricted eavesdropping: we assume trusted amplifiers and only a single untrusted span among the whole M ones composing the link.This assumption provides a simplified picture to identify the more vulnerable points of the fiber link.We compare the three discussed cases and show that amplification is helpful if the untrusted node is placed either at the beginning or the end of the link, according to the particular employed amplifier and measured quadrature.Finally, we briefly discuss the case in which Alice and Bob achieve the ultimate capacity limits discussed in [29][30][31][32].This provides us with the ultimate enhancement in the KGR brought by the links under investigation.
The structure of the paper is the following.In Section 2 we present the structure of the multispan links under investigation.Then, in Sections 3 and 4 we perform the security analysis under unconditional and composable security paradigms, respectively, assuming a single untrusted span.Thereafter, in Section 5 we consider the ultimate limits obtained when Alice and Bob achieve the quantum channel capacity.Finally, in Section 6 we draw the final conclusions and summarize the obtained results.

Multispan amplified links
In this work, we address the application of multispan links employing optical amplifiers for CV-QKD.In particular, we employ the quantum amplifiers depicted in Figure 1.We consider an incoming optical mode a, satisfying [a, a † ] = 1, and its associated quadrature operators with [q, p] = 2iσ 2 0 and σ 2 0 being the shot-noise variance [8].Throughout the work we will always consider shot-noise units, namely σ 2 0 = 1.The goal is to amplify the mode a by In both the cases the amplification gain G is related to the squeezing parameter r.The PIA applies the same amplification to both quadratures and introduces additional noise while PSA amplifies one of the quadratures and deamplifies the second rescaling the variances accordingly as seen on the example for a coherent state with amplitude α = α q + iα p .
a gain factor G. The PIA, see Figure 1(a), is implemented by coupling mode a together with an ancillary mode b prepared in the vacuum state |0⟩ and performing a two-mode squeezing operation, namely r ≥ 0 being the squeezing parameter [27,40].The original input mode is then transformed into a → √ G a + √ G − 1 b, with G = cosh 2 r.Thereafter, we trace over mode b, ending up with an amplified signal but at the expense of introducing an ineludible added noise equal to G − 1 to both quadratures variances.PIAs also well describe amplification by a laser medium without optical feedback from a cavity [27,41], being of particular interest for systems working at high powers, whereas their application at the quantum level is more limited due to the introduced excess noise [26].
The issue of noise may be circumvented by employing PSAs, see Figure 1(b), implemented via a unitary single-mode squeezing operation r ≥ 0 [27,40].PSA amplifies the quadrature q by a factor √ G = exp(r) ≥ 1 at the expense of squeezing, i.e. deamplifying, the quadrature p by 1/ √ G ≤ 1.Consequently, the quadrature variances are also amplified and deamplified by G and 1/G, respectively.Crucially, the input commutation relations between the quadratures are preserved without introducing any further noise.Note also the important difference between PIA Figure 2. Scheme of the CV-QKD protocol discussed in the present paper.A two mode squeezed vacuum state (TMSV) is distributed between Alice and Bob.Alice performs a heterodyne measurement on her mode, whereas the mode sent to Bob travels through a loss-thermal channel modeled by a series of M beam splitters with transmissivities T j and added mean thermal number of photons nj .In order to counteract losses the signal after each span B j is amplified by either PIA or PSA with gain G j .Finally, Bob performs a measurement which we assume to be either case I: a random homodyne detection of quadratures q/p, or homodyne detection of either q, IIa, or p, IIb.
and PSA: the former is a noisy operation requiring the introduction of an additional light mode lost to the environment, which, in principle, can be intercepted by a malicious party, whereas the latter amplification scenario assumes unitary evolution which does not leak any information, thus being always trusted.
Given the previous considerations, in Figure 2 we present the protocol discussed in the paper.We start from the GG02 scheme in its entanglement-based version [6,7,[10][11][12].That is, Alice has a two-mode squeezed vacuum state (TMSV) with variance V > 1, that is, where λ = (V − 1)/(V + 1) and |n⟩ being the Fock state with n photons [8].She injects the second branch into the quantum channel while performing heterodyne detection, equivalent to double homodyne, on the remaining mode, such that the conditional state sent to Bob is a coherent state.Ultimately, Bob performs a homodyne measurement on the received pulses, which in the former version of GG02 consists of a random homodyne detection of either q or p quadratures [6,12].Unlike in the standard GG02 protocol, the quantum channel discussed in this work consists of a multispan link with M spans alternated by optical amplifiers.Each span j = 1, . . ., M is modeled as an independent thermal-loss channel with transmissivity T j ≤ 1 and excess noise ϵ j ≥ 0.More precisely, the optical mode entering the j-th link is mixed at a beam splitter with transmissivity T j with a thermal state having nj = T j ϵ j /[2(1 − T j )] mean number of photons [8].Thereafter, the radiation undergoes optical amplification, either phase-insensitive or phase-sensitive, before being injected into the (j +1)-th span.For simplicity, here we assume both identical and equally spaced amplifiers, such that all spans have the same transmissivity T j = T , added thermal noise nj = nT and amplification gain G j = G.Note, however, that this choice may not be the optimal arrangement [31].Then, if the total transmission distance is L, two neighboring amplifiers are spaced by L/M and we have κ = 0.2 dB/km being the typical loss rate of standard optical fibers [23][24][25].Moreover, we assume the added thermal photons in each span to be equal to With these choices, in the absence of optical amplification, that is G = 1, we retrieve the standard GG02 scenario, that is a single-span thermal-loss channel with total transmissivity T n = T M and added noise N n = (1 − T n )/T n + ϵ, ϵ ≥ 0 being the total excess noise [7,12].
Starting from the scheme in Figure 2, we address three different cases, differing from one another by both the employed amplifier and the measurement implemented by Bob: • Case I: PIA link and random homodyne detection of quadratures q/p, • Case IIa: PSA link and homodyne detection of quadrature q, namely the antisqueezed quadrature, • Case IIb: PSA link and homodyne detection of quadrature p, namely the squeezed quadrature.
Note that the presence of a PSA link makes the channel phase-sensitive, thus differentiating the behavior of quadratures q and p.Therefore, in the presence of PSAs Bob may perform homodyne detection of a single quadrature for those experimental runs dedicated to key extraction, while homodyning both q and p for the channel evaluation stage, in order to fully characterize the quantum channel [7].
In the following, we compute the KGR for all three cases under both unconditional and composable security scenarios.To perform the analysis, we adopt the notation introduced in Figure 2. At first Alice has two optical modes A and B 0 excited in the TMSV state (4).Then, the mode B 0 is injected into the sequence of M spans.We denote by B j the optical mode coming out from the j-th span and subsequently amplified by the j-th amplifier.Finally, we refer to the last output mode as B = B M .We start by computing the mutual information shared between Alice and Bob, addressing the cases I and IIp, p = a, b, separately.The whole analysis is carried out following the Gaussian formalism, briefly reminded in Appendix A.

Case I : PIA link
The initial state before injection into the channel is a TMSV in modes A and B 0 , completely characterized by its covariance matrix (CM) where Z = √ V 2 − 1, 1 2 is a 2 × 2 identity matrix and σ z is the Pauli z-matrix.
The mode B 0 is injected into the noisy channel, which may be modeled via a sequence of completely positive (CP) Gaussian maps as derived in Appendix B. Accordingly, after M nodes applying PIA the state shared between Alice and Bob is still Gaussian with CM where and T being the added noise introduced after the passage though a single span due to the channel thermal noise, while N G = (G−1)/(GT ) is the added noise due to the PIA.Consequently, compared to the scenario in the absence of amplifiers, the PIA link is equivalent to a thermal-loss channel with increased transmissivity T (M ) ≥ T n , but also increased added noise N (M ) ≥ N n .After transmission, Alice performs heterodyne detection on her mode, associated with the CM σ het = 1 2 , while Bob implements a homodyne detection of either quadrature q or p, referred to as subcases a and b, and described by the CMs respectively.Due to the symmetry of ( 8), the resulting statistics for both quadrtures are identical, therefore, we can safely assume that Bob always measures the quadrature q.In turn, the mutual information between Alice and Bob may be obtained directly from (8) as [36]: where we highlighted the dependence on the free parameters V and G.

Case II : PSA link
For cases IIp, p = a, b, we obtain the CM of the state shared between Alice and Bob as: where and with N = (1 − T )(1 + 2n T )/T .Unlike case I, the PSA link is a phase-sensitive channel.Indeed, in the presence of PSA, the quadrature q exhibits an increased transmissivity T ≥ N n .As we discuss in the following, under appropriate conditions this allows Bob to hide behind the increased noise to reduce the amount of information intercepted by an eventual eavesdropper.The mutual information for the two subcases p = a, b then reads: In the next sections, we will perform a security analysis of the above protocols by considering both the cases of unconditional security, where the entire channel is untrusted, and composable security, assuming that only a single span is untrusted and may be intercepted by Eve.In both scenarios, we take as a benchmark the security of the associated protocol in the absence of optical amplifiers, referred to as the "no-amplifier protocol", in which we assume Bob to perform a random homodyne measurement of either quadrature q or p as in GG02.The results of the standard no-amplifier protocol can be retrieved from both cases I and II by fixing G = 1.

Unconditional security
At first, we analyze the performance of the discussed protocol under the unconditional security approach, where the whole transmission line is supposed to be attacked by Eve.In this framework, all elements of the multispan link are assumed to be untrusted and the most powerful attack is the so-called purification attack [7,12].That is, Eve intercepts all the lost photons and collects modes associated with the channel noise and purifies the final state shared between Alice and Bob, such that the tripartite system ABE is pure [7].Under these conditions employing PIAs is useless because Eve would have access also to their purification, denoted by mode b in Fig. 1(a), and extract more information with respect to the no-amplifier protocol.In contrast, case II is still worth of interest due to the unitarity of phase-sensitive amplification.
Considering reverse reconciliation [7,12], for cases IIp, p = a, b, the KGR is given by where β ≤ 1 is the reconciliation efficiency and χ E|B is the Holevo information between Bob and Eve [42], S E and S A|B are the Von Neumann entropies of Alice and Bob's bipartite state and Alice's conditional state, respectively.These two latter quantities can be retrieved from the CM (13), leading to: where d 1 and d 2 are the symplectic eigenvalues of (13) and d In particular, we have: .
Finally, we perform optimization over the free parameters V and G, obtaining subject to the set of constraints providing that throughout the channel the squeezing operation does not amplify the total optical power over its input value [31,32].Since we assume all amplifiers are characterized by the same gain , it suffices to verify condition (23)   In this security paradigm, the no-amplifier protocol is described by a single-span quantum channel with transmissivity T n and added noise N n , which coincides with the GG02 protocol.The benchmark key rate K (n) u is obtained as: The obtained numerical results suggest that the optimized gain for case IIa is equal to u and measuring the anti-squeezed quadrature q does not increase the key rate of the discussed protocol.On the contrary, the case IIb improves the security for large values of excess noise ϵ, as depicted in Figure 3(a).In this case, PSA links offer a higher KGR and, remarkably, increase the achievable maximum transmission distance, although the enhancement is relevant only for large excess noise, namely ϵ ≳ 0.05 [43,44].
The optimized gain G (IIb) u obtained from the maximization procedure is plotted in Figure 3(b).For small L, constraint (24) max and the gain increases with link length, whereas for larger L it becomes a decreasing function approaching 1 asymptotically.Moreover, G (IIb) u decreases with the number of spans M , as expected.Finally, the optimized modulation V (IIb) u is a decreasing function of the link length such that is the optimized modulation of the no-amplifier protocol.The physical explanation of the previous results is the following.When measuring the squeezed quadrature p, Bob observes a higher added noise with respect to the standard protocol, that is, N (M ) 2 ≥ N n , and a reduced effective transmissivity T (M ) 2 ≤ T n , as depicted in Figure 4.In this way, he hides himself behind the noise, increasing the conditional entropy S (b) E|B , according to (21), with the overall consequence of reducing the Holevo information extractable by Eve.As one may expect, the existence of the optimized gain emerges from the tradeoff between the increased noise and the reduced transmissivity, both affecting the fraction of Alice's signal actually received by Bob.In light of this, the advantage introduced by PSAs shall increase with the number of spans M .In particular, we may obtain the maximum increase in KGR in the continuousamplification limit, M ≫ 1.Since T M = T n is fixed, in this limit, up to a leading order in M , we have T ≈ 1, 1 − T ≈ − ln T = −(ln T n )/M , and G M = G ∞ .Consequently, the effective transmissivities and added noises read and we obtain the KGR by (22).These channel parameters, calculated for the resulting optimized gain G ∞ , are plotted in Figure 4.Note also that even a few spans allow one to approach the continuous amplification limit.Finally, we calculate the maximum tolerable excess noise ϵ max as a function of the transmission distance, reported in Figure 5.It represents the maximum acceptable amount of noise to maintain a positive KGR.Consistently with the previous results, the exploitation of PSAs increases the maximum tolerable excess noise with respect to the no-amplifier scheme in the metropolitan-distance regime, as ϵ As expected, the advantage introduced increases with the number of nodes.

Composable security under restricted eavesdropping: only one untrusted span
We now discuss the second instance under investigation, the restricted eavesdropping case.In this scenario we assume Eve to attack only a single span of the link, whilst all the remaining ones as well as the employed amplifiers are considered to be trusted, thus letting our analysis to belong to the composable security framework.In turn, only a fraction 1/M of the whole fiber link is untrusted.The scheme for the eavesdropping strategy under investigation is depicted in Figure 6.Across the whole channel, only the k -th link, k = 1, . . ., M , is untrusted and may be attacked via entangling cloner attack by Eve [7,19], performing active eavesdropping.That is, Eve hides herself behind the thermal noise nk = nT , equal to (6), by generating a TMSV state with variance V ϵ = 1 + 2n T in two modes E = (E 1 , E 2 ) and injecting mode E 1 into the second input port of the beam splitter modeling the k-th span, retrieving the reflected output state.In this way she gets undetected by Alice and Bob, as performing partial trace over modes E introduces an additive thermal noise with exactly nT mean number of photons.In order to perform the security analysis under the above paradigm we shall compute the quantum state in Eve's possession after the entangling cloner attack.We proceed as follows, starting with the case I.
Since all nodes j = 1, . . ., k − 1 are trusted, the quantum state shared by Alice and Bob injected into the k-th span is in the form (8), namely: Instead, the CM of Eve's initial TMSV state reads: with After the interference at the beam splitter, joint quantum state of Alice, Bob and Eve is described by the CM: where and is the symplectic matrix associated with the beam splitter operation [40,45].Thereafter, we let the transmitted signal pass through the remaining M − k spans, applying the techniques described in Appendix B. Ultimately, the tripartite joint state after the channel is associated with the CM: with the σ AB in Equation (8) and being the CM of Eve's overall state and the correlation matrix between Alice and Bob and Eve, respectively, with Subsequently, after Bob's measurement Eve is left with the conditional state associated with: Similarly as in the unconditional security case, the KGR resulting from the present composable security analysis is given by the difference between the appropriately c , q = I, IIa, are presented in Figure 7 for links with M = 5 (a) or M = 10 (b) amplifiers and different positions k = 1, . . ., N of the untrusted span, and compared to K for no-amplifier protocol.We underline that the results for M = 5 and M = 10 can be only qualitatively compared, as we keep the assumption that only one span is untrusted and, in turn, by increasing M Eve becomes more and more restricted.
In general, one can observe that, when Bob measures the amplified quadrature, both PIAs and PSAs improve the KGR with respect to the no-amplifier protocol only if Eve attacks one of the first spans of the fiber link.The case k = 1, where the first span is the untrusted one, represents the best-case scenario, where the key rate is increased by several orders of magnitude.Indeed, in this scenario the signal intercepted by Eve has not been amplified yet.Thus, Eve's overall state, described by the CM σ (q) E , is independent of the gain G and the only effect of amplification is the reduction of the conditional entropy S (q) E|B appearing in the Holevo information Eqs.(38) and (42).On the other hand, for k ≥ 2, amplifying Bob's received signal also increases Eve's overall entropy S (q) E .In turn, the benefits of optical amplification are more and more reduced with increasing k.To better quantify this effect, we compute the ratio: which is presented in Figure 7(c-d).All ratios are initially equal to 1 up to a threshold distance, that is, min , thereafter for k ≥ 2 they reach a and then decrease towards an asymptotic value.Moreover, the key ratio R (q) decreases with increasing k and there exists a threshold value k th such that for k ≥ k (q) th we have R (q) ≡ 1.Therefore, if Eve attacks a span located further, k ≥ k th .This is a direct consequence of the additional noise introduced by the phase-insensitive amplification process.
The optimized gain G c and modulation V c , q = I, IIa, are depicted in Figure 8(a) and (b), respectively.Consistent with the results from the previous paragraph, it is optimal to not amplify the signal, i.e.G (q) c = 1, for short distances L ≤ L (q) min .For longer link lengths the optimal gain initially increases with L, following constraints (24) and (40), and then ultimately decreases towards an asymptotic value.The optimal gain G (q) c also decreases with k, similarly to the key ratio.On the other hand, the behavior of optimal modulation V (q) c is quite peculiar.For k = 1 it is a monotonous decreasing function of the transmission distance L, as obtained in Section 3. The presence of optical amplifiers increases the modulation value with respect to the no-amplifier protocol, as c .On the contrary, when k ≥ 2 the situation is completely different and in the long-distance regime the optimized modulation turns out to be an increasing function of L. In fact, if Eve attacks one of the last spans of the communication link she intercepts a weak pulse, therefore it is possible to safely increase the input modulation variance without preventing secure communication between Alice and Bob.
When the amplified quadrature is measured, the effective transmissivity probed by Bob, namely T (M ) and T (M ) 1 for cases I and IIa respectively, is larger with respect to the no-amplifier protocol, T (M ) , T (M ) 1 ≥ T n .This leads to an increase of both mutual information between Alice and Bob, and, at the same time, Holevo information on Eve's side.This is because for k ≥ 2 she also receives an amplified signal.In turn, when performing optimization over the free parameters, there emerges a tradeoff between these two types of information, resulting in the key rates shown in Figure 7.In particular, for short-distance communication, L ≤ L (q) min , one obtains that optical amplification is useless, G (q) c = 1.The difference between cases I and IIa is due to the different impact of the added noise.In fact, for case IIa the added noise is rescaled with respect to the no-amplifier protocol, N (M ) 1 ≤ N n , whilst for case I the noise is increased because of the additive contribution N G due to phase-insensitive amplification, N (M ) ≥ N n .In the latter case the (incoherent) added contribution N G detriments the mutual information between Alice and Bob, being less than its counterpart of case IIa.Ultimately, this leads to a reduced performance of PIA links with respect to PSA ones.for the Bob's measurement of the deamplified quadrature, IIb, is depicted in Figure 9 for links with M = 5 (a) or M = 10 (b) amplifiers and different positions k = 1, . . ., M of the untrusted span, together with the key ratio The scenario is reversed with respect to the previous section.Indeed, when Bob probes the squeezed (i.e.deamplified) quadrature, PSA links improve the resulting KGR if Eve attacks one of the last spans of the channel.The best-case scenario is provided by k = M , in which the KGR increases by more than an order of magnitude.Consequently, and in contrast to the results from Section 4.1, one observes enhancement in the key ratio R (IIb) with increasing k.In this scenario the PSA becomes useless if Eve attacks the first span for all M , namely R (IIb) ≡ 1, since in this case she intercepts the pulse before all amplifiers and therefore, deamplifying the signal only reduces the mutual information between Alice and Bob, maintaining a higher Holevo information at Eve's side.On the other hand, for k ≥ 2, deamplifying Bob's signal also reduces Eve's extracted information, thus leading to R (IIb) ≥ 1.In particular, there exists a threshold attack location k all key ratios exhibit a maximum and then decrease towards an asymptotic value, equal to 1 for locations closer to the threshold value or greater than 1 for those placed further, implying an improvement of security in the long-distance regime brought by the PSA link.
In Figure 10 respectively.We see that amplification is not beneficial, G ≡ 1 , for eavesdropping performed on initial spans k ≤ k (IIb) th , whereas for attacks on latter spans the optimal gain increases with the link length following constraint (24), until finally decreasing towards an asymptotic value.In accordance with the previous results, one needs to employ the stronger optimal amplification the further the eavesdropped span is located.The optimized modulation increases with respect to the no-amplifier protocol V Similarly to the results obtained in Section 4.1, it is a decreasing function of the link length if the attack is performed on the first span, whilst it becomes non-monotonous for k ≥ 2, increasing in the long-distance regime.
The physical meaning of these results is analogous to these obtained in Section 3. Indeed, the case IIb is associated with a reduced transmissivity with respect to the no-amplifier protocol, T

Ultimate key rate limits
In the analysis above, we considered the entanglement-based CV-QKD protocol where Alice and Bob perform heterodyne and homodyne detection, respectively, which in the prepare-and-measure picture is equivalent to considering coherent-state encoding followed by quadrature detection [6,7,10].In turn, the resulting mutual information depends only on the signal-to-noise ratio, according to the Shannon-Hartley theorem [46], as derived in (12) and (16).However, from the perspective of quantum communication, we may also consider the fundamental quantum limit, namely the Holevo information between Alice and Bob [42].This ultimate capacity provides an upper bound on the achievable mutual information which has been also investigated for multispan links employing either PIAs or PSAs [31,32].
We embed this approach within the CV-QKD framework by considering an equivalent protocol to that of Figures 2 and 6, in which Bob still performs the homodyne measurement of quadratures q and p, but Alice replaces her heterodyne detection with the proper measurement achieving the Holevo bound.In this way, we compute the Holevo information χ AB by interpreting Bob's measurement as a state-preparation process.Ultimately, we obtain an upper bound on the KGR which allows to highlight the ultimate limits on KGR of multispan links.For the sake of simplicity, here we will discuss only the case of a PIA link under restricted eavesdropping with the same assumptions as in Section 4, namely a single untrusted span.
For case I, the ultimate KGR reads: with the χ The maximization procedure is, once again, subject to constraint (40).It is seen in Fig. 11(a) that there is a considerable gap between the upper bound K (I) c and the performance of heterodyne receiver K (I) c for few attacks performed on few initial nodes.For further spans, the difference disappears, as indicated by the key ratios R with respect to the associated no-amplifier protocol, depicted in Fig. 11(b).This means that, even in the best theoretical scenario, the advantage originating from PIA vanishes for attacks on further parts of the link.A possible remedy may be to employ PSA but obtaining the ultimate bound in such a scenario requires considerable effort since the resulting quantum channel is phase sensitive [32,47].

Conclusions
In this paper we have addressed the exploitation of multispan amplified links for CV-QKD.In particular, we have discussed three cases: PIA link with random homodyne detection of q/p quadratures and PSA link with measurement of either quadrature q or p.In the unconditional security approach we showed that the KGR is improved with respect to the standard no-amplifier protocol only for the scenario in which Bob measures the deamplified quadrature.This enhancement is noticeable especially in the presence of large excess noise, ϵ ≳ 0.05.
We have also investigated the KGR in the composable security framework, by assuming that all amplifiers and spans except one are trusted.We showed that the position of the untrusted span greatly affects the potential enhancement offered by amplification.In particular, for the cases with PIA and random homodyne measurement and with PSA and measurement of the amplified quadrature one observes an enhancement in the KGR only if one of the first spans is attacked, namely k ≤ k (q) th , whereas for case with PSA and detection of the deamplified quadrature the improvement is present if the attacked span is in the latter part of the link, k ≥ k (IIb) th .Finally, we have addressed the case in which Alice and Bob achieve the Holevo capacity, thus providing an upper bound for the security, highlighting the ultimate enhancement that may be brought by PIA links.
The results of the paper present a detailed analysis of the improvement and the limits offered by optical amplifiers for quantum secure communications under realistic assumptions and pave the way for future developments in the framework of composable security CV-QKD.In particular, the advantage given by PSA, being a phase-sensitive operation, may be potentially further boosted by employing squeezed states [48,49].

Figure 1 .
Figure 1.Schemes of the phase-insensitive amplifier (PIA) (a) and phase-sensitive amplifier (PSA) (b) employed throughout the paper.In both the cases the amplification gain G is related to the squeezing parameter r.The PIA applies the same amplification to both quadratures and introduces additional noise while PSA amplifies one of the quadratures and deamplifies the second rescaling the variances accordingly as seen on the example for a coherent state with amplitude α = α q + iα p .

1 ≥
T n and reduced added noise N (M ) 1 ≤ N n , while the quadrature p shows a reduced transmissivity T (M ) 2 ≤ T n with increased added noise N (M ) 2 E|B being the Von Neumann entropies of Eve's overall state and Eve's conditional state after Bob's measurement, respectively.Due to the purification attack and the fact that Bob's measurement is represented by a 1-rank operator, we have S E = S AB and S (p) E|B = S (p) A|B , where S AB and S (p)

Figure 3 .
Figure 3. (a) Optimized KGR as a function of the transmission link length L for different level of external noise and number of amplifiers M .The case M = 0 refers to the no-amplifier protocol.(b) Optimal amplifier gain G (IIb) u as a function of link length L for different number of amplifiers M .The dashed lines represent the maximum attainable gain G (II) max computed with the optimized modulation V (IIb) u, presented in the inset.We set ϵ = 0.05 and β = 0.95.

Figure 4 .
Figure 4. Noise (a) and effective link transmission (b) as a function of link length for different number of amplifiers M for ϵ = 0.05 and β = 0.95.The case M = 0 refers to the no-amplifier protocol.

Figure 5 .
Figure 5. Maximum tolerable noise as a function of the link length for different number of amplifiers M for β = 0.95.The case M = 0 refers to the no-amplifier protocol.

Figure 6 .
Figure 6.Scheme of the CV-QKD protocol under restricted eavesdropping.All the amplifiers are trusted, and Eve is allowed to attack only the k-th span, k = 1, . . ., M , via active eavesdropping, that is, by injecting one arm of a TMSV state into the span, hiding herself behind the introduced excess noise.

Figure 7 .
Figure 7. Optimized KGR and key ratio for cases I and IIa as a function of the transmission link length L for different locations of the eavesdropper for M = 5 (a) and (c) and M = 10 (b) and (d) respectively.We set ϵ = 0.05 and β = 0.95.

Figure 8 .
Figure 8. Optimal amplifier gain (a) and modulation (b) for cases I and IIa as a function of the link length L for different locations of the untrusted span k for M = 10, ϵ = 0.05 and β = 0.95.
signal amplification is no longer beneficial.For link parameters values κ = 0.2 dB/km, ϵ = 0.05 and β = 0.95 one obtains k (I) th = 2 and k (IIa) th = 3 for M = 5, while for M = 10 one gets k (I) th = 5 and k (IIa) th= 8. Importantly, note that the performance of PIA links is always lower than PSA ones, as R (I) ≤ R(IIa) , d

4. 2 .
Case IIb : measuring the deamplified quadrature The KGR K (IIb) c one has R (IIb) ≡ 1, being equal to k (IIb) th = 1 for M = 5 and k (IIb) th = 2 for M = 10.For eavesdropping performed on a span located further within the link k ≥ k (IIb) th

Figure 9 .
Figure 9. Optimized KGR and key ratio for case IIb as a function of the transmission link length L for different locations of the eavesdropper for M = 5 (a) and (c) and M = 10 (b) and (d) respectively.We set ϵ = 0.05 and β = 0.95.

2 ≤) 2 ≥
T n , and amplified added noise N (M N n .Therefore, for k ≥ 2 by employing PSAs Bob accepts to reduce the extracted mutual information, in order to increase the conditional entropy S (IIb) E|B , resulting in a lower Holevo information between Eve and himself.The tradeoff between these two quantities is such that for k ≥ k (IIb) th one has G (IIb) c ≥ 1 and PSA links increase the obtained KGR.

10 .
Optimal amplifier gain (a) and modulation (b) for case IIb as a function of the link length L for different locations of the untrusted span k for M = 10, ϵ = 0.05 and β = 0.95.

Figure 11 .
Figure 11.Upper bound on KGR (a) and corresponding key ratio (b) for PIA as a function of link length for M = 10 nodes, ϵ = 0.05 and β = 0.95.