Continuous-variable quantum key distribution system: past, present, and future

I. INTRODUCTION

• CV-QKD using coherent states has advanced from proof-of-principle demonstrations toward robust, fully telecom-compatible architectures supported by improved protocols, security analyses, and implementations.Security progressed from asymptotic Gaussian-modulated proofs to finite-size composable security against collective and general attacks, while discrete modulation was also investigated.Source: §I · p. 2
• Reverse reconciliation overcame the 3 dB limit, while improved reconciliation and LO-signal multiplexing enabled long-distance transmission from 25 km to 80 km and experiments up to 202 km.In-line LO systems suppress phase noise but require crosstalk reduction between strong LO and weak quantum signals, addressed using pulsed, polarization-multiplexed, and time-multiplexed signals.Source: §I · p. 2
• Local-LO architectures use pilot-assisted phase recovery and frequency-division multiplexing, reaching 190 Mbps at 5 km with 5 GBaud repetition and enabling software-defined network deployment.Digital pulse shaping, matched filtering, de-multiplexing, impairment compensation, and synchronization address device-bandwidth limits and support higher secret key rates.Source: §I · p. 2
• Digital processing, chip-based homodyne detection, and downstream point-to-multipoint networking support compact, high-performance, multiuser CV-QKD systems for metropolitan and access networks.Chip-based homodyne detection reaches 10 GBaud, while advanced techniques also target free-space communication and coexistence with classical optical networks.Source: §I · p. 4

II. CV-QKD PROTOCOL AND SECURITY PROOF

• The review covers CV-QKD protocols and security analysis, system structures and key modules, current implementations, future digital and point-to-multipoint applications, and practical security.The protocol’s operating procedures determine system behavior, while its security is established by the corresponding security proof.Source: §I · p. 4, §II · p. 4

A. Basic notions of continuous-variable systems

• A continuous-variable system comprises modes in an infinite-dimensional Hilbert space, with electromagnetic-field quadratures assembled into an n-mode vector obeying bosonic canonical commutation relations and uncertainty constraints.The quadratures are x_i and p_i, with [x_i, x_k] = 0, [p_i, p_k] = 0, and [x_i, p_k] = 2iδ_ik.Source: A. Basic notions of… · pp. 4–5
• Gaussian states are completely characterized by their displacement vector and covariance matrix, subject to the Heisenberg uncertainty relation.Common single-mode states include vacuum, coherent, and squeezed states; coherent states are displaced vacuum states, while squeezing one quadrature anti-squeezes its conjugate.Source: A. Basic notions of… · p. 5
• Two-mode squeezed vacuum, or EPR, states provide a CV resource: homodyne detection on one mode projects the other into a squeezed state, whereas heterodyne detection projects it into a coherent state.These preparation relations are illustrated for one-mode measurements on EPR states in Fig. 3.Source: A. Basic notions of… · p. 5, Figure 3 · p. 5

B. A historical outline of CV-QKD protocols and the current security status

• Coherent-state CV-QKD, especially GG02, gained prominence because laser-generated states are easier to prepare than squeezed states, followed by no-switching heterodyne protocols.Gaussian-modulated squeezed-state protocols later incorporated heterodyne detection and improved performance.Source: B. A historical outline of CV-QKD… · p. 5
• Discrete, unidimensional, and phase-sensitive multimode modulations address experimental Gaussian-modulation challenges, while extending analyses from fiber channels to free-space satellite scenarios.The phase-sensitive multimode protocol improves secret key rate and excess-noise tolerance; unidimensional modulation simplifies Alice’s modulation process when excess noise is small.Source: B. A historical outline of CV-QKD… · p. 6
• CV-QKD protocols are classified by quantum state, modulation, and measurement, and expanded beyond one-way schemes to two-way, MDI, and source-device-independent architectures.These protocol families correspond to different application scenarios and security assumptions.Source: B. A historical outline of CV-QKD… · p. 6
• Practical security remains limited by mismatches between devices and theoretical assumptions, motivating semi-device-independent MDI and SDI protocols that remove selected reliability assumptions.CV-MDI QKD allows an untrusted Charlie under Eve’s control and resists detector loopholes, but its limited transmission distance restricts long-haul deployment.Source: B. A historical outline of CV-QKD… · pp. 6–7
• Ideal CV-QKD approaches the PLOB bound, but practical systems remain below the theoretical limit because reconciliation efficiency is typically under 100% and modulation variance below 5.The review identifies further protocol development as necessary to improve practical secret-key rate and transmission distance.Source: B. A historical outline of CV-QKD… · p. 8

C. Security analysis

• Prepare-and-measure and entanglement-based schemes are equivalent to Bob and Eve because EPR-state measurements project the other mode onto coherent or squeezed states.The PM scheme is used experimentally, whereas the EB scheme is preferred for theoretical analysis because it simplifies calculations.Source: C. Security analysis · p. 8, Figure 5 · p. 8
• Reconciliation uses direct or reverse correction, with direct reconciliation limited to channel loss below 3 dB and reverse reconciliation correcting modulation data to detection data.Reverse reconciliation was introduced to address the loss limitation of direct reconciliation.Source: C. Security analysis · p. 8
• Security analyses distinguish individual, collective, and coherent attacks; coherent attacks are strongest generally, while collective attacks are typically the most powerful coherent attacks asymptotically.The categories differ in whether Eve manipulates and measures states independently or jointly.Source: C. Security analysis · p. 8

Gaussian-modulated protocol

• Gaussian-modulated coherent-state protocols receive particular attention because they can be generated with off-the-shelf lasers, while protocols span coherent or squeezed states with homodyne or heterodyne detection.The section focuses on coherent-state security analysis and briefly introduces squeezed-state protocols.Source: §1 · p. 8
• A positive secret key rate indicates that Alice and Bob can distill a secret key under attack; otherwise, the protocol is ineffective.The asymptotic reverse-reconciliation rate depends on Alice–Bob mutual information and Eve’s accessible information.Source: §1 · p. 8
• Reverse-reconciliation security is governed by Bob–Eve quantum mutual information, with channel-added noise χline = 1/T −1 + ε determined by transmittance T and excess noise ε.The relevant variances include the EPR-state variance, Bob’s received-state variance, and the conditional variance given Bob’s measurement.Source: §1 · p. 8
• Eve’s information is bounded by the Holevo quantity, whose conditional entropy depends on the detection method and whose Gaussian extremity bound yields a lower bound on the secret key rate.The relevant entropies are computed from covariance matrices and symplectic eigenvalues for the states before and after Bob’s measurement.Source: §1 · pp. 8–9
• The analytical security solutions distinguish homodyne and heterodyne detection, and analogous formulas cover direct reconciliation and squeezed-state protocols.For two-mode systems, symplectic eigenvalues can be obtained analytically, with detection-specific eigenvalues summarized in Table III.Source: §1 · p. 9, Table III · p. 9

2. Discrete-modulated protocol

• Security proofs initially assumed a linear channel; without it, the unknown covariance term forced worst-case secret-key estimates to zero, limiting adoption.The covariance-matrix approach used Gaussian extremity to bound eavesdropper knowledge and derive a secret-key lower bound under the assumption.Source: §2 · p. 10
• From 2018, uncertainty-principle, semidefinite-programming, and entropy-uncertainty methods removed the linear-channel requirement and bounded eavesdropping to obtain secret-key rates [125, 126, 127, 129].An auxiliary mode and beamsplitter can restore covariance-based analysis for arbitrary discrete modulation formats [125].Source: §2 · p. 10
• 256 QAM with Gaussian probability shaping performs close to Gaussian modulation, while 64 QAM supports transmission beyond 100 km.These results arise from the auxiliary-mode covariance approach, which weakens the effect of undefined covariance terms.Source: §2 · p. 10
• SDP security frameworks analyze QPSK protocols and can extend to higher-order modulation, but high computational-resource demands limit practical scalability [126, 127].The frameworks use constrained states or detection-data mapping and postselection to formulate secret-key estimation as an optimization problem.Source: §2 · pp. 10–11
• The SDP formulation minimizes an entropy-related objective over bipartite states compatible with experimentally measured moments and operator constraints.Constraints include quadrature first and second moments and observables such as photon number and ˆd.Source: §2 · p. 11
• Finite-size security has also been developed for binary modulation, QPSK with entropy accumulation, and discrete alphabets; broadly, added Alice–Bob correlations tighten eavesdropping bounds [208, 209, 210].The review summarizes these developments in Table IV and compares heterodyne-detected security-analysis performance in Fig. 6.Source: §2 · p. 11, Table IV · p. 11, Figure 6 · p. 11

• Trusted detector modeling uses an EPR state coupled through a beamsplitter, with transmittance η representing detection efficiency and electronic noise incorporated into the EPR variance.The detector module is trusted, and its loss and noise are modeled through the receiver-side beamsplitter structure shown in Fig. 7.Source: §3 · p. 11, Figure 7 · p. 12
• The trusted detector module significantly enhances transmission distance and secret key rate, and optical amplifiers have also been shown feasible for improving system performance.Source: §3 · p. 11
• Practical detectors are characterized by efficiency η and electronic noise νele, with heterodyne detection replacing νele by 2νele.Source: §3 · p. 11
• Detection-added noise χh is combined with channel noise as χtot = χline + χh/T, and the mutual-information and Eve-knowledge expressions use χtot in place of χline.Source: §3 · p. 12

III. CV-QKD SYSTEM AND KEY MODULE

• CV-QKD systems use in-line or local local-oscillator architectures, differing mainly in whether the receiver generates the local oscillator and consequently in their dominant noise sources.Local-oscillator systems simplify the transmitter and prevent Eve from accessing the local oscillator, while both architectures require excess-noise suppression.Source: §III · p. 12
• The transmitter encodes quantum information with laser, modulation, monitoring, and multiplexing, while the receiver performs shot-noise-limited balanced homodyne detection and practical-security monitoring.Auxiliary signals are multiplexed using time-, frequency-, or polarization-division techniques, and feedback calibrates sampling time, polarization, and phase.Source: §III · p. 14
• DSP maximizes transmitter–receiver correlation, SNU calibration connects practical detection data to security analysis, and postprocessing extracts keys through sifting, estimation, reconciliation, and privacy amplification.The overall randomness is supplied by QRNGs, which support modulation and postprocessing control.Source: §III · p. 14, Figure 9 · p. 14

A. Quantum random number generator

• True randomness is essential for unconditional security, making QRNGs a promising source because they exploit quantum-mechanical intrinsic randomness.QRNGs are categorized by security level into practical, semi-device-independent, and device-independent types, and by entropy source into discrete- and continuous-variable types.Source: A. Quantum random number generator · p. 14
• QRNG outputs control coherent-state modulation, homodyne detection-basis selection, and postprocessing mappings or universal hash functions, requiring Gaussian, Rayleigh, uniform, or discrete-variable randomness.Continuous-variable QRNGs can use ASE noise, phase noise, or vacuum noise and generally offer high generation rates with simple structures.Source: A. Quantum random number generator · p. 14
• 100 Gbps generation has been achieved by a vacuum-noise QRNG using photonic integrated circuits, meeting CV-QKD needs for speed, size, and scalability.Vacuum-noise QRNGs use only a laser source and homodyne detector, enabling high-speed operation with a simple structure.Source: A. Quantum random number generator · p. 14
• Because most QRNGs produce uniform randomness, Gaussian-modulated CV-QKD requires a uniform-to-Gaussian transformation such as Box–Muller, whereas discrete modulation avoids this continuous-variable conversion.The review also lists CDF inversion, central-limit, piecewise-linear, and rejection methods as alternatives.Source: A. Quantum random number generator · p. 15

B. Transmitter

• The transmitter prepares modulated quantum signals and auxiliary LO and pilot signals through laser, modulation, and monitoring modules.Source: B. Transmitter · p. 15

1. Source

• Laser sources require narrow linewidth and low relative intensity noise; fiber lasers are most common, while distributed-feedback and external-cavity lasers are also used.These requirements support high performance and stability.278–281Source: §1 · p. 15
• Pulsed sources support temporal state separation and time-division multiplexing but require about 80 dB extinction, often using at least two cascaded amplitude modulators.Auxiliary signals contain approximately 10^4 to 10^8 photons per pulse, whereas conventional amplitude modulators typically provide less than 40 dB extinction.282Source: §1 · p. 15
• Continuous-wave sources are increasingly used in local-LO systems because they avoid complex cascaded modulators, while narrower linewidth and optional laser locking support accurate interference and lower phase noise.The local LO reduces crosstalk between quantum and classical signals and relaxes the need for extremely high isolation.143,283–287Source: §1 · p. 15

2. Modulation

• Information encoding uses either phase-and-amplitude modulators or an IQ modulator, with Gaussian and discrete formats requiring two-quadrature displacements, while unidimensional and PSK formats use one modulator.Figure 10 details the modulator structures, and Figure 11 illustrates Gaussian, 16-QAM, unidimensional, and PSK formats.Source: §2 · pp. 15–16, Figure 10 · p. 16, Figure 11 · p. 16
• IQ modulation represents independent Gaussian data on the x and p quadratures, whereas phase-and-amplitude modulation uses polar coordinates with Rayleigh-distributed amplitude and uniformly distributed phase.The two implementations are different representations of a two-dimensional distribution.Source: §2 · p. 16
• Modulator parameters must be accurately adjusted because imperfect modulation can increase excess noise and create security loopholes; passive-state preparation is an alternative without modulation modules.194,289,290–292Source: §2 · pp. 16–17
• Variable optical attenuators reduce quantum signals to few-photon levels, while amplitude modulation can independently raise frame-signal power for improved SNR and lower quantum-signal power.Practical detectors cannot reliably measure the quantum characteristics of high-power states, so attenuation is manually or automatically controlled.139Source: §2 · pp. 16–17

3. Transmitter Monitoring

• Real-time transmitter monitoring estimates the prepared optical state and source noise, enabling tighter security bounds and improved system performance.Active monitors use optical switches, whereas passive monitors use beamsplitters; homodyne, heterodyne, or—under Gaussian modulation—optical power measurements provide modulation statistics.Source: §3 · pp. 17–18
• Transmitter monitoring can also detect injected strong light, including Trojan-horse attacks, by directing it through a circulator to a homodyne detector or optical power meter.The monitoring structure isolates injected light from transmitter components and supports practical-security countermeasures.Source: Figure 12 · p. 17, §3 · p. 18

C. Receiver

• The receiver measures incoming quadratures through monitoring, de-modulation, and detection modules, with receiver monitoring focused on classical light such as the in-line LO or local-LO pilot tone.In-line LO monitoring is essential because the transmitted LO can be manipulated by Eve and directly participates in homodyne or heterodyne detection.Source: C. Receiver · p. 18, §1 · p. 18

1. Receiver Monitoring

• Receiver monitoring must also guard against strong-light attacks that disturb detection or shot-noise-unit calibration.Several attack strategies target the receiver by injecting strong light, with countermeasures addressed in the practical-security discussion.Source: §1 · p. 18

2. De-modulation

• De-modulation compensates polarization and phase, separates quantum and classical signals, and synchronizes hardware to preserve signal quality and detection security.Polarization compensation reduces quantum-signal loss and suppresses crosstalk excess noise; manual, feedback-controlled, and digital approaches serve proof-of-principle, field, and simpler deployments.Source: §2 · p. 18
• Phase compensation addresses slow- and fast-fading mismatch using frame references or pilot tones, while pulsed systems use polarization beamsplitters and optical delays to separate and align signals.For GG02 systems, phase compensation can be integrated with basis switching; homodyne and heterodyne detection strategies are illustrated in Fig. 13.Source: §2 · p. 18, Figure 13 · p. 19
• Clock synchronization aligns transmitter and receiver sampling, but cable, independent-fiber, WDM, and LO-derived solutions trade cost, stability, crosstalk, power, and distance.Recent systems increasingly perform synchronization digitally with algorithms, and continuous-wave systems similarly move much de-multiplexing and compensation into the digital domain.Source: §2 · pp. 18–19

• Balanced homodyne detection interferes quantum and local-oscillator signals at a 50:50 coupler, and differential photocurrent carries the quantum-signal quadrature.Source: §3 · p. 19
• A homodyne detector measures one quadrature at a time, so random LO phase shifts between 0 and π/2 switch detection bases for both quadratures.Source: §3 · pp. 19–20
• Combining two homodyne detectors realizes heterodyne detection, which simultaneously detects both quadratures through a π/2 LO phase shift and may use analog or digital down-conversion.Source: §3 · p. 20
• Homodyne detectors evolved from integral-output designs for pulsed light toward direct-output designs for continuous-wave systems, emphasizing bandwidth, balance, and common-mode rejection.Source: §3 · p. 20
• Chip-based homodyne detectors achieve 3 dB bandwidth above 1.5 GHz, 28 dB shot-to-electronic-noise clearance, and 80 dB common-mode rejection ratio.Source: Figure 14 · p. 20, §3 · p. 20
• Key detector parameters are bandwidth, detection efficiency, electronic noise, and QCNR, with QCNR generally required to reach at least 10 dB.Source: §3 · p. 20

• SNU is estimated from vacuum shot-noise variance and used to normalize coherent-state detection data for security analysis.Accurate SNU calibration is therefore crucial to CV-QKD security.Source: D. Shot noise unit calibration · p. 21
• Conventional calibration subtracts independently measured electronic noise from total noise, with electronic noise measured using blocked optical inputs and total noise measured with LO input.The difference gives the SNU and enables a trusted detector model after normalization.Source: D. Shot noise unit calibration · p. 21, Figure 16 · p. 21
• Pre-calibrated SNU can drift with time or temperature, so practical systems monitor LO power and adjust SNU in real time using a previously established linear relation.A small LO fraction is continuously measured during operation to update normalization.Source: D. Shot noise unit calibration · p. 22
• One-time SNU calibration measures only total noise, significantly simplifying the procedure and enabling real-time calibration by monitoring split-LO power.This approach has been adopted in experimental demonstrations137,342.Source: D. Shot noise unit calibration · p. 22
• One-time calibration treats electronic-noise loss as untrusted because electronic noise is not separately estimated, causing slightly lower protocol performance than traditional calibration.Its security model uses beamsplitters for detection efficiency and electronic noise, with the electronic-noise output mode untrusted.Source: D. Shot noise unit calibration · p. 22

E. Digital signal processing

• DSP maximizes transmitter–receiver data correlation by applying classical optical-communication algorithms for synchronization, equalization, and signal recovery.Its scope expanded from early optical-layer compensation to transmitter and receiver processing, improving SNR in high-speed local-LO systems.Source: E. Digital signal processing · pp. 23–24
• Transmitter DSP uses upsampling and RRC pulse shaping to improve modulation accuracy while limiting bandwidth and preserving quantum-pulse requirements.Frequency shifting, pilot-tone insertion, and CAZAC framing—often with Zadoff–Chu sequences—support phase reference and frame synchronization.Source: E. Digital signal processing · p. 23
• Receiver DSP separates and down-converts multiplexed signals, synchronizes clocks, compensates static and dynamic impairments, and outputs raw data for postprocessing.Static processing includes IQ-imbalance and S21 compensation with matched RRC filtering; dynamic phase and polarization compensation commonly uses MIMO algorithms.Source: E. Digital signal processing · p. 23
• DSP coefficient order can be exchanged and coefficients dynamically adjusted for system conditions, while machine learning enables robust phase estimation across pilot SNR ranges.These adaptations target long-distance or high-noise operation and extend classical coherent-optical processing techniques to CV-QKD.Source: E. Digital signal processing · pp. 23–24

F. Postprocessing

• CV-QKD postprocessing comprises base sifting, information reconciliation, parameter estimation, and privacy amplification over an authenticated channel, followed by verification [353–356].The complete workflow converts modulation, transmission, and detection correlations into final secret-key bits.Source: F. Postprocessing · p. 24, Figure 20 · p. 25

1. Sifting

• Heterodyne detection can eliminate sifting by retaining both quadratures, unlike homodyne or squeezed-state systems that select one quadrature per measurement.This removes detection-basis switching and sifting [s22 passage does not contain a bibliography marker].Source: §1 · p. 24

2. Parameter estimation

• Parameter estimation derives the covariance matrix and security parameters T and ε from calibrated modulation and detection data, linking channel loss and noise to secret-key-rate calculations.The procedure converts phase-space data between prepare-and-measure and entanglement-based descriptions, then estimates relevant covariances and variances.Source: §2 · p. 24
• Finite-size parameter estimation treats estimated channel parameters probabilistically, using confidence intervals and worst-case transmittance and noise to calculate conservative secret-key rates.A portion m = N − n of the data is publicized for estimation, with finite-size corrections governed by εPE and privacy-amplification security terms [358].Source: §2 · pp. 24–25

3. Information reconciliation

• At least 24% improvement in system performance was achieved by jointly optimizing modulation variance and the error-correction matrix rather than maximizing reconciliation efficiency alone.The optimization balances system resources under hardware constraints to improve secret key rate or transmission distance.Source: §3 · pp. 25–26
• Reverse reconciliation surpasses the 3 dB loss limit that restricts direct reconciliation to about 15 km, making it the predominant strategy for CV-QKD.Reconciliation efficiency, frame error rate, throughput, and SNR range determine practical performance.Source: §3 · p. 26
• Multidimensional reconciliation targets SNR below 0 dB, down to -26 dB, by converting Gaussian reconciliation into discrete-variable channel coding for long-distance systems.It can be combined with LDPC or Raptor codes; its efficiency depends on code performance and the approximation to the virtual channel.Source: §3 · p. 26
• LDPC decoding reaches 1.44 Gbps at code rate 0.2 and 0.78 Gbps at rate 0.1, supporting real-time secret-key generation at 71.89 Mbps over 25 km and 9.97 Mbps over 50 km.Rate-adaptive error correction addresses fading SNR, while reordering parameter estimation after correction reduces discarded raw data.Source: §3 · p. 26

4. Privacy amplification

• Privacy amplification maps the reconciled n-bit string to a shorter secret key through a universal hash function, extending from asymptotic security to finite-size operation via leftover hashing.The final key can make the eavesdropper’s knowledge close to zero when the relevant mutual information is known, while processing speed remains crucial.Source: §4 · p. 26
• Toeplitz matrices provide a practical privacy-amplification implementation whose output length is determined by the secret-key rate after parameter estimation.Their diagonal and parallel-diagonal structure enables straightforward construction.Source: §4 · pp. 26–27

IV. MAINSTREAM IMPLEMENTATIONS

• CV-QKD systems advanced from feasibility demonstrations to efficient error-corrected transmission over 80–202 km, while local-LO architectures reduced LO leakage and related security concerns.The development emphasizes high secret-key rates at long distance and suppression of excess noise.Source: §IV · pp. 27–28
• Local-LO systems use receiver-generated local oscillators with transmitter pilots for phase recovery, while multiplexing and DSP compensate hardware, polarization, and phase limitations.Frequency-division and polarization multiplexing enable flexible integration, and digitization simplifies practical system structures.Source: §IV · p. 28

A. In-line LO systems

• In-line LO systems generate the quantum signal and LO from one laser, but LO leakage is the main noise source, requiring multiplexing and high isolation.Time-, polarization-, and frequency-division multiplexing encode the signal and LO on different dimensions for co-transmission and receiver de-multiplexing.Source: A. In-line LO systems · p. 28

1. Early systems

• The first CV-QKD demonstrations progressed from 1.7 Mbps loss-free operation in 2003 to 2 kbps over 25 km fiber in 2007.The 2007 all-fiber system co-transmitted the quantum signal and LO using time-division multiplexing to reduce accumulated phase noise.Source: §1 · p. 29, Figure 25 · p. 30
• Polarization- and frequency-division multiplexing achieved 0.3 bit/pulse at 5 km with 70 dB signal–LO isolation, while digital phase compensation replaced hardware compensation.The system also used an isolator to reduce multiple-reflection noise and assumed receiver noise was independent of Eve’s control.Source: §1 · pp. 29–30, Figure 25 · p. 30

2. Long distance achievements

• Long-distance systems reached over 100 bps at 80 km, over 300 bps beyond 100 km, and 202.81 km by combining efficient reconciliation, multiplexing, noise suppression, and automation.Multidimensional reconciliation raised reconciliation efficiency from no more than 90% to 95%; the 202.81 km system also produced 278 to 0.318 kbps across shorter tested links.Source: §2 · pp. 30–31, Figure 26 · p. 31
• System engineering further addressed imperfect state preparation, LO monitoring, finite sampling bandwidth, polarization drift, and phase mismatch through calibration, feedback, and compensation techniques.Reported measures include over 80 dB pulse extinction, real-time shot-noise calibration, dynamic delay adjustment, polarization control, and training-sequence-based phase estimation.Source: §2 · p. 31

3. Field tests

• The longest field test reached 49.85 km commercial fiber with a secret-key rate two orders of magnitude above prior field demonstrations, while a 3-node 71.03 km network averaged over 12.00 kbps.These demonstrations used adaptive reconciliation, one-time calibration, automatic noise stabilization, and a trusted relay for metropolitan deployment.Source: Figure 27 · p. 31, Figure 28 · p. 32, §3 · p. 32
• The first field test operated automatically for 57 hours at 8 kbps over 3 dB loss and 9 km practical fiber, demonstrating long-term point-to-point reliability.Installed-fiber polarization varied more slowly than an equivalent laboratory spool, while device-linked phase drift was typically 2π every 30 seconds.Source: Figure 27 · p. 31, §3 · p. 32
• A 2016 full-mesh field network connected four nodes through six links spanning 2.08–37.44 km and co-transmitted quantum and classical signals using wavelength-division multiplexing.Connector reflections were characterized at nominal reflectance of -40 dB, with more than 20 reflective events measured.Source: Figure 27 · p. 31, §3 · p. 32

4. Systems on chip

• Silicon photonic integration combines major CV-QKD components, enabling miniaturization and potentially low-cost mass production after design finalization397.The platform integrates modulation, attenuation, detection, and polarization multiplexing or demultiplexing on chip.Source: §4 · pp. 32–33
• An SOI chip integrated phase and amplitude modulators, an optical variable attenuator, and a homodyne detector for an in-line-LO system, reaching 0.25 Mbps over 2 m fiber.The modulators operated at 200 MHz, while the homodyne detector limited system bandwidth to 10 MHz and had 0.498 detection efficiency.Source: §4 · p. 33

5. Other in-line LO systems

• Alternative in-line-LO formats reached 1 kbps over 30.2 km, 50 kbps over 10 km, and 5.4 kbps and 0.7 kbps over 30 and 50 km, respectively398–400.Discrete modulation lowers digital-to-analog conversion requirements, while unidimensional modulation uses a single amplitude modulator; both support cost-effective systems.Source: §5 · p. 33

B. Local LO systems

• Local-LO CV-QKD avoids transmitting the LO to address LO-access security loopholes and LO-to-signal crosstalk, but independent lasers introduce fast-fading phase noise requiring a reliable pilot-tone phase reference410–413.Continuous-wave frequency-division multiplexing and DSP became the mainstream approach for high-speed local-LO systems.Source: B. Local LO systems · pp. 33–34

1. Early systems

• Early local-LO experiments verified precise phase-mismatch compensation using pilot tones, employing pulsed light and time-division multiplexed quantum and pilot-tone signals141,142.The experiments used heterodyne or homodyne detection with free-running or shared lasers to establish the phase reference.Source: §1 · pp. 34–35

2. Systems with continuous-wave light

• Continuous-wave local-LO systems eliminate time-division limits, enable repetition rates up to 1 GHz143,285,286, and achieved 6 × 10−3 bit/symbol at 40 km with digital heterodyne detection284.Frequency-division multiplexing, DSP, and classical coherent-communication structures simplify high-speed CV-QKD demonstrations.Source: §2 · p. 35

4. Recent progresses

• CV-QKD systems achieved 233.87, 133.6, and 21.53 Mbps at 5, 10, and 25 km, while other demonstrations realized composable security and transmission beyond 100 km.The composable-security system reached 0.0471 bits/symbol at 20.3 km, and the long-distance system reached 7.55, 1.87, and 0.51 Mbps at 50, 75, and 100 km.Source: §4 · pp. 36–37, Figure 34 · p. 36

C. CV-QKD systems co-existed with classical communication environment

• CV-QKD can coexist with classical optical signals, tolerating realistic channel powers and supporting 18.3 Tbps data channels over 25 km.A 90 kbps secret key rate was supported over 20 km with 2 mW multiplexed optical power, while Raman scattering and four-wave mixing were identified as impairments.Source: C. CV-QKD systems co-existed with… · p. 37, Figure 35 · p. 37

D. Others

• The review identifies free-space links for long-distance and access-network applications and entanglement-based systems for channels with high excess noise.Free-space deployment requires new coding and phase-compensation methods because atmospheric effects impair secure key generation.Source: D. Others · p. 37, §1 · p. 37

1. Free space systems

• Free-space CV-QKD addresses satellite links and access networks but must mitigate atmospheric fading, beam wandering, phase noise, and transmittance fluctuations.A passive-state-preparation system achieved 1.015 Mbps with a simulated −15 dB free-space transmittance, while higher-orbit satellite links may yield no secure keys under finite-size effects.Source: §1 · pp. 37–38, D. Others · p. 37

2. Entanglement-based systems

• Entanglement-based CV-QKD can distill secret keys under excess noise that prevents coherent-state protocols, with reported rates of 84 kbps, 3 kbps, and 0.03 (0.01) bit per sample.The 84 kbps and 3 kbps rates corresponded to 80% and 40% channel transmission efficiencies, while the later rates corresponded to excess noise levels of 0.01 and 0.1.Source: §2 · p. 38

V. THE ADVANCED CV-QKD SYSTEM PROGRESS FOR FUTURE APPLICATIONS

• Future CV-QKD systems target high speed, compact integration, full-scale DSP, photonic-chip integration, and point-to-multipoint quantum access networks.Digital impairment compensation simplifies and stabilizes systems, and the latest reported achievement reached a 10 GBaud baud rate.Source: §V · p. 38, A. Digital CV-QKD systems · p. 39, Figure 38 · p. 39

A. Digital CV-QKD systems

• Digital CV-QKD uses pulse shaping, down-conversion, timing recovery, filtering, polarization compensation, and phase compensation to improve performance and simplify hardware.Static equalization requires proper shot-noise-unit calibration, while dynamic equalization compensates transmission-induced polarization and phase mismatch; linear DSP security was proved in 2023.Source: A. Digital CV-QKD systems · p. 39
• 91.8 Mbps at 9.5 km and 24 Mbps at 25 km were achieved by a dual-polarization local-LO CV-QKD system using digital compensation and an integrated coherent receiver.The system used probability-shaped discrete-modulated 64- and 256-QAM and eliminated the optical polarization controller.Source: A. Digital CV-QKD systems · p. 39

B. Chip-based local LO systems

• 0.7 Gbps over 5 km and 0.3 Gbps over 10 km were achieved using a silicon on-chip receiver at 10 GBaud, demonstrating compact high-performance CV-QKD.The receiver also reached over 2 GHz bandwidth in another implementation, while a 250 MHz receiver achieved 280 kbps under 1.38 dB untrusted loss and excess noise 0.1102 at Alice’s side. [146,448,407]Source: B. Chip-based local LO systems · p. 40
• The Silicon-On-Insulator platform supports low-cost, dense integration through mature CMOS processing and high refractive-index contrast, but suffers coupling losses and lacks high-performance integrated lasers.Low-loss grating or edge couplers can address coupling efficiency, whereas integrated light sources remain challenging on silicon. [407]Source: B. Chip-based local LO systems · p. 40
• III-V and heterogeneous integration address silicon’s laser limitation: an InP transmitter integrated an electro-absorption modulator, IQ modulator, and variable optical attenuator with bandwidth above 1 GHz.The InP transmitter achieved 0.4 Mbps over 11 km and 2.3 Mbps back-to-back, verifying feasibility for CV-QKD. [408]Source: B. Chip-based local LO systems · p. 40
• A Si3N4 on-chip external-cavity laser reached 0.75 Mbps over 50 km with excess noise 0.0579, supporting integrated light sources for fully chip-based CV-QKD. [409]Overall or heterogeneous III-V integration is presented as a route toward large-scale, small-size, cost-effective deployment.Source: B. Chip-based local LO systems · p. 40

C. Point-to-multipoint systems

• 128 end users were supported beyond 100 km in simulation through parallel key distillation, where all users generate independent keys simultaneously despite inter-user correlations. [147]Each prepared quantum state can be measured by all users, while correlation-suppression techniques protect overall performance; the corresponding result is shown in Fig. 40.Source: Figure 40 · p. 41, C. Point-to-multipoint systems · p. 41
• Point-to-multipoint quantum access networks use active optical switching or passive optical networks, but PON splitting increases user loss and requires upstream user multiplexing. [453–455]A downstream PON-based multiuser CV-QKD scheme was proposed to address these limitations. [147]Source: C. Point-to-multipoint systems · p. 41
• Multiuser parameter estimation combines Alice’s disclosed modulation data with all Bobs’ detection data to construct a joint covariance matrix for tighter security analysis and per-user key rates.The joint covariance matrix γAB1B2...BN contains all trusted modes, enabling secret-key-rate calculation between Alice and each Bob.Source: C. Point-to-multipoint systems · p. 41
• 4.1 Mbps per user was achieved at 15 km for four users, while eight-user operation reached 7.44 Mbps at 6 km and 3.20 Mbps at 15 km. [468,456,469]The access network multiplexes quantum and pilot signals by frequency and polarization, with separate heterodyne detection at the receivers; the architecture is illustrated in Fig. 41 and Fig. 42.Source: C. Point-to-multipoint systems · p. 41, Figure 41 · p. 41, Figure 42 · p. 41

VI. PRACTICAL SECURITY

• Practical CV-QKD security requires countermeasures because imperfect sources, detectors, and LOs create exploitable loopholes despite ideal-device security proofs.Attacks target the LO, source, and measurement devices, and current schemes can be defended.Source: §VI · p. 42, A. Attacks and countermeasures · p. 42

A. Attacks and countermeasures

• LO attacks bias shot-noise-unit and excess-noise estimates, while monitoring LO intensity mean and variance provides a defense; local LO systems shift vulnerabilities to transmitted pilot tones.Representative attacks include LO fluctuation, calibration, and polarization attacks, while pilot-tone attacks remain relevant for local-LO systems.Source: A. Attacks and countermeasures · p. 42
• Source attacks, including Trojan-horse attacks, can reveal modulation information, while optical isolators and source-monitoring detectors protect injected-light and output channels.Trojan-horse attacks analyze reflected bright pulses carrying optical-modulator markings that can expose part of the key.Source: A. Attacks and countermeasures · pp. 42–43
• Detector saturation and wavelength attacks exploit nonlinear detection or wavelength-dependent beamsplitter ratios, countered by detector-state and channel-transmittance monitoring, filters, and real-time LO monitoring.Saturation can suppress excess-noise signatures and conceal interception-retransmission behavior.Source: A. Attacks and countermeasures · p. 43
• Countermeasure evaluation should balance defense effectiveness against equipment price, integration and implementation difficulty, computational demands, and sacrificed key material across application scenarios.The review describes four effectiveness levels and emphasizes a trade-off between defense cost and effectiveness.Source: A. Attacks and countermeasures · p. 43

B. Measurement-device-independent systems

• Semi-device-independent CV-QKD offers a compromise between the stronger security of device-independent protocols and their low key rates and demanding loophole-free Bell-test experiments.CV-MDI QKD treats the relay detector as untrusted, making it naturally immune to receiver-side attacks.Source: B. Measurement-device-independent… · p. 43
• CV-MDI QKD performance improves when the untrusted relay is near one legitimate party, and implementations progressed from a 2015 proof of principle to fiber links exceeding 0.19 bit/pulse over 10 km in 2022.The 2015 demonstration used 1064 nm free-space devices and achieved a secret-key-rate increase of 3 orders of magnitude over qubit-based protocols at metropolitan distances.Source: B. Measurement-device-independent… · p. 44

VII. SUMMARY AND OUTLOOK

• Later CV-MDI systems removed frequency and optical phase locking through polarization-based relays and DSP, achieving 600 kbps over a 2 dB loss channel, while future systems require better protocols, integration, speed, distance, and practical security.Key priorities include photonic integration, low-noise coherent detection, high-throughput error correction, compensation of high-frequency excess noise, codes operating near -30 dB SNR, and closing transmitter side channels with accurate SNU calibration.Source: B. Measurement-device-independent… · p. 44, §VII · pp. 44–45