Upper bounds on secret key agreement over lossy thermal bosonic channels

# Upper bounds on secret key agreement over lossy thermal bosonic channels

Eneet Kaur Hearne Institute for Theoretical Physics, Department of Physics and Astronomy, Baton Rouge, Louisiana 70803, USA    Mark M. Wilde Hearne Institute for Theoretical Physics, Department of Physics and Astronomy, Baton Rouge, Louisiana 70803, USA Center for Computation and Technology, Louisiana State University, Baton Rouge, Louisiana 70803, USA
July 25, 2019
###### Abstract

Upper bounds on the secret-key-agreement capacity of a quantum channel serve as a way to assess the performance of practical quantum-key-distribution protocols conducted over that channel. In particular, if a protocol employs a quantum repeater, achieving secret-key rates exceeding these upper bounds is a witness to having a working quantum repeater. In this paper, we extend a recent advance [Liuzzo-Scorpo et al., Phys. Rev. Lett. 119, 120503 (2017)] in the theory of the teleportation simulation of single-mode phase-insensitive Gaussian channels such that it now applies to the relative entropy of entanglement measure. As a consequence of this extension, we find tighter upper bounds on the non-asymptotic secret-key-agreement capacity of the lossy thermal bosonic channel than were previously known. The lossy thermal bosonic channel serves as a more realistic model of communication than the pure-loss bosonic channel, because it can model the effects of eavesdropper tampering and imperfect detectors. An implication of our result is that the previously known upper bounds on the secret-key-agreement capacity of the thermal channel are too pessimistic for the practical finite-size regime in which the channel is used a finite number of times, and so it should now be somewhat easier to witness a working quantum repeater when using secret-key-agreement capacity upper bounds as a benchmark.

preprint:

year number number identifier LABEL:FirstPage1 LABEL:LastPage102

## I Introduction

One of the main goals of quantum information theory H13book (); H06 (); W15book () is to establish bounds on communication rates for various information-processing tasks. An important application lies in the domain of secret communication, following the development of quantum key distribution bb84 (); E91 (). In recent years, there has been a growing interest in establishing bounds on the secret-key-agreement capacity of a quantum channel, which is the highest rate at which communicating parties can use the channel and public classical communication to distill a secret key TGW14IEEE (); TGW14Nat (); STW16 (); PLOB15 (); Goodenough2015 (); TSW16 (); AML16 (); WTB16 (); Christandl2017 (); Wilde2016 (); BA17 (); RGRKVRHWE17 (); TSW17 (). Such bounds have been proven by exploiting the methods of quantum information theory and can be interpreted as setting the fundamental limitations of quantum key distribution whenever a quantum repeater is not available L15 ().

An important development occurred in TGW14Nat (), in which it was established that there is a fundamental rate-loss trade-off that any repeaterless quantum key distribution protocol cannot overcome. That is, without a quantum repeater, the rate of secret key that can be distilled from a pure-loss bosonic channel (lossy optical fiber or a free-space channel) decreases exponentially with increasing distance TGW14Nat ().

Later, this bound was improved to establish that the secret-key-agreement capacity of a pure-loss bosonic channel of transmissivity is equal to . This bound was claimed in PLOB15 () and rigorously proven in WTB16 (). In particular, let denote the highest rate at which -close-to-ideal secret key can be distilled by making invocations of a pure-loss channel of transmissivity , along with the assistance of public classical communication WTB16 (). In WTB16 (), is called the non-asymptotic secret-key-agreement capacity of the channel . One of the results of WTB16 () is the following fundamental upper bound:

 P↔Lη(n,ε)≤−log2(1−η)+C(ε)n, (1)

where . The bound in (1) is known as a strong converse bound because it converges to the secret-key-agreement capacity in the limit as . We suspect that there is little room for improvement of the bound in (1) and discuss this point further in Appendix A. The bound in (1) is to be contrasted with the following weak-converse bound:

 P↔Lη(n,ε)≤11−ε[−log2(1−η)+h2(ε)n], (2)

which follows as a direct consequence of (WTB16, , Section 8) and (WR12, , Eq. (2)) (see also (MW12, , Eq. (134))). For the benefit of the reader, we explain how to arrive at this weak-converse bound in more detail in Appendix B. In the above,

 h2(ε)=−εlog2ε−(1−ε)log2(1−ε) (3)

denotes the binary entropy. The bound in (2) is a weak-converse bound because it requires the extra limit as after taking the limit as , in order to arrive at the capacity upper bound of . The significance of the bounds in (1) and (2) is that they apply for any finite number of channel uses and key-quality parameter. As such, these bounds can be used to assess the performance of any practical secret-key-agreement protocol conducted over a pure-loss channel.

The pure-loss channel is somewhat of an ideal model for a communication channel, even if it does have a strong physical underpinning in the context of free-space communication YS78 (); S09 (). In particular, a working assumption of the model is that the channel input interacts with an environment prepared in the vacuum state. However, in practical setups, we might expect the environment to be modeled as a thermal state of a fixed mean photon number S09 (), and in such a case, the channel is called a thermal channel and denoted by  (also called thermal-lossy channel, as in RGRKVRHWE17 ()). This added thermal noise is often called excess noise NH04 (); LDTG05 (), which can serve as a simple model of tampering by an eavesdropper. Additionally, there are realistic effects in communication schemes, such as dark counts of photon detectors that can be modeled as arising from thermal photons in the environment S09 (); RGRKVRHWE17 (). As such, it is an important goal to establish upper bounds on the secret-key-agreement capacity of the thermal channel in order to assess the performance of practical secret-key-agreement protocols, and the main contribution of the present paper is to establish upper bounds on the non-asymptotic secret-key-agreement capacity of the thermal channel , which improve upon the prior known bounds from PLOB15 (); WTB16 () in certain regimes.

Prior works established that

 −log2([1−η]ηNB)−g(NB) (4)

is an upper bound on the secret-key-agreement capacity of a thermal channel with transmissivity and thermal mean photon number . This bound was claimed in PLOB15 () and rigorously proven in WTB16 (). In this expression,

 g(NB)=(NB+1)log2(NB+1)−NBlog2NB (5)

is the entropy of a thermal state of mean photon number . In particular, the following bound was given in (WTB16, , Section 8)

 P↔Lη,NB(n,ε)≤−log2([1−η]ηNB)−g(NB)+√2Vη,NBn(1−ε)+C(ε)n, (6)

where

 Vη,NB=NB(NB+1)log22(η[NB+1]/NB), (7)

and the following weak-converse bound is a direct consequence of (WTB16, , Section 8) and WR12 (); MW12 () (explained also in Appendix B):

 P↔Lη,NB(n,ε)≤11−ε[−log2([1−η]ηNB)−g(NB)+h2(ε)n]. (8)

Again, the value of these bounds is that they apply for any finite number of channel uses and key-quality parameter . However, by inspecting (6), we see that the order and lower terms are strictly positive.

The main contribution of the present paper is to improve the bound in (6) in such a way that the order term is negative whenever , representing the backoff from capacity incurred by using the channel a finite number of times while allowing for non-zero error. In fact, we find the following improved bound for several realistic values of and :

 P↔Lη,NB(n,ε)≤−log2([1−η]ηNB)−g(NB)+√V′η,NBnΦ−1(ε)+O(logn)n, (9)

where is a channel-dependent parameter that we discuss later and denotes the inverse of the cumulative normal distribution function (see (41)), for which we have that whenever . We should note that the bound in (9) applies only for sufficiently large (such that is proportional to ), as it relies on the Berry–Esseen theorem KS10 (); S11 (), but many prior works have shown that first- and second-order terms like the above one serve as an excellent approximation for non-asymptotic capacities even for small polyanskiy10 (); P10 (); MW12 (); P13 (); TBR15 (). The main new tool that we use to establish this result, beyond those used and introduced in WTB16 (), is a recent development in LMGA17 () regarding teleportation simulation of single-mode phase-insensitive bosonic channels using finite-energy resource states. Figure 1 plots this bound for several realistic values of the distance (related to transmissivity ) and thermal mean photon number , and we point to Section IV for a more detailed discussion of these figures.

In the remainder of the paper, we argue how to arrive at the bound in (9). In what follows, we review the formalism of quantum Gaussian states and channels adesso14 (); S17 (), and we also review information quantities needed, such as quantum relative entropy and relative entropy variance. We then review the critical tool of teleportation simulation of a quantum channel BDSW96 (); WPG07 (); NFC09 (); Mul12 () and how it can be used with (WTB16, , Eq. (4.34)) and ideas from LMGA17 () in order to arrive at (9). We finally close with a summary and some open questions.

## Ii Preliminaries

### ii.1 Quantum Gaussian states and channels

The main class of quantum states in which we are interested in this paper are quantum Gaussian states adesso14 (); S17 (). In our brief review, we consider -mode Gaussian states, where is some fixed positive integer. Let denote each quadrature operator ( of them for an -mode state), and let denote the vector of quadrature operators, so that the first  entries correspond to position-quadrature operators and the last  to momentum-quadrature operators. The quadrature operators satisfy the following commutation relations:

 [^xj,^xk]=iΩj,k,whereΩ=[01−10]⊗Im, (10)

and is the identity matrix. We also take the annihilation operator . Let be a Gaussian state, with the mean-vector entries , and let denote the mean vector. The entries of the covariance matrix  of are given by

 Vρj,k≡⟨{^xj−μρj,^xk−μρk}⟩ρ. (11)

A matrix is symplectic if it preserves the symplectic form: . According to Williamson’s theorem W36 (), there is a diagonalization of the covariance matrix of the form,

 Vρ=Sρ(Dρ⊕Dρ)(Sρ)T, (12)

where is a symplectic matrix and is a diagonal matrix of symplectic eigenvalues such that for all . We say that a quantum Gaussian state is faithful if all of its symplectic eigenvalues are strictly greater than one (this also means that the state is positive definite). Faithfulness of Gaussian states is required to ensure that is non-singular. We can write the density operator of a faithful state in the following exponential form PhysRevA.71.062320 (); K06 (); H10 () (see also H13book (); S17 ()):

 ρ=(Zρ)−1/2exp[−12(^x−μρ)TGρ(^x−μρ)], (13) withZρ≡det([Vρ+iΩ]/2) (14) andGρ≡−2ΩSρ[arcoth(Dρ)]⊕2(Sρ)TΩ, (15)

where with domain . Note that we can also write

 Gρ=2iΩarcoth(iVρΩ), (16)

so that is represented directly in terms of the covariance matrix . By inspection, the and matrices are symmetric. In what follows, we adopt the same notation for quantities associated with a density operator , such as , , , , , and .

A two-mode Gaussian state with covariance matrix in “standard form” has a covariance matrix as follows DGCZ00 (); S00 ():

 Vρ=[accb]⊕[a−c−cb]. (17)

The symplectic diagonalization of the covariance matrix  simplifies as well SIS04 ():

 V=S(D⊕D)ST, (18)

where

 S =(I2⊕σZ)S⊕20(I2⊕σZ), (19) S0 =[ω+ω−ω−ω+],ω±=√a+b±√y2√y, (20) D (21) y =(a+b)2−4c2, (22)

and denotes the standard Pauli matrix. Given a two-mode state with covariance matrix in standard form as in (17), it is a separable state if

 c≤csep≡√(a−1)(b−1), (23)

which can be determined from the condition given in (AI05, , Eq. (14)). We return to this condition when we discuss the relative entropy of entanglement for quantum Gaussian states.

A quantum Gaussian channel is one that preserves Gaussian states CEGH08 (); adesso14 (); S17 (). The action of a quantum Gaussian channel on an input state is characterized by two matrices and , which transform the covariance matrix of as follows:

 Vρ→XVρXT+Y, (24)

where is the transpose of the matrix . In this formalism, the thermal channel with transmissivity and thermal mean photon number is given by

 X=√ηI2,Y=(1−η)(2NB+1)I2, (25)

where is the identity matrix. Our principal focus in this paper is on the thermal channel.

### ii.2 Teleportation simulation and reduction by teleportation

Teleportation simulation of a channel BDSW96 (); WPG07 (); NFC09 (); Mul12 () is a key tool used to establish the upper bounds in (1), (2), (6), and (8). The basic idea behind this tool is that channels with sufficient symmetry can be simulated by the action of a teleportation protocol PhysRevLett.70.1895 (); prl1998braunstein (); Werner01 () on a resource state  shared between the sender  and receiver . More generally, a channel with input system and output system is defined to be teleportation simulable with associated resource state if the following equality holds for all input states :

 NA′→B(ρA′)=TA′AB(ρA′⊗ωAB), (26)

where is a quantum channel consisting of local operations and classical communication between the sender, who has systems and , and the receiver, who has system ( can also be considered a generalized teleportation protocol, as in Werner01 ()). The definition in (26) was first given in WTB16arxiv (), based on many earlier developments BDSW96 (); Werner01 (); WPG07 (); NFC09 (); Mul12 (). The implication of channel simulation via teleportation is that the performance of a general protocol that uses the channel times, with each use interleaved by local operations and classical communication (LOCC), can be bounded from above by the performance of a protocol with a much simpler form: the simplified protocol consists of a single round of LOCC acting on copies of BDSW96 (); NFC09 (); Mul12 (). This is called reduction by teleportation. Of course, a secret-key-agreement protocol is one particular kind of protocol of the above form, as considered in PLOB15 (); WTB16 (), and so the general reduction method of BDSW96 (); NFC09 (); Mul12 () applies.

For continuous-variable bosonic systems, the teleportation simulation of a single-mode bosonic Gaussian channels was considered in NFC09 (), and the simulation therein only simulates the channel exactly in the limit in which the resource state is the result of transmitting one share of an infinitely-squeezed, two-mode squeezed vacuum state S17 () through the channel (this resource state is sometimes called the Choi state of the channel S17 (), and we use this terminology in what follows). Thus, when applying this argument to bound the rates of secret-key-agreement protocols as discussed above, one must take care with an appropriate limiting argument, as pointed out in N16 () and handled already in WTB16 (). This teleportation simulation argument with an infinitely-squeezed resource state is one of the core steps used to establish the bounds in (1), (2), (6), and (8).

Recently, an important development in the theory of the teleportation simulation of quantum Gaussian channels has taken place LMGA17 (). In particular, the authors of LMGA17 () have shown that all single-mode, phase-insensitive quantum Gaussian channels other than the pure-loss channel can be simulated via the action of teleportation on a finite-energy Gaussian resource state that has the same amount of entanglement as the Choi state of the channel. In LMGA17 (), the authors quantified the amount of entanglement in the resource state using an entanglement monotone H42007 () called logarithmic negativity, which is the same entanglement measure considered in NFC09 (). In our paper, we show how the main idea of their paper leads to strengthened bounds on the performance of secret-key-agreement protocols conducted over single-mode phase-insensitive bosonic Gaussian channels.

To describe the result of LMGA17 () in more detail, let and be the matrices representing the action of a single-mode phase-insensitive Gaussian channel on an input state, as in (24). In what follows and as in LMGA17 (), we exclusively consider the case when . In order for the map to be a completely positive, trace-preserving map (i.e., a legitimate quantum channel), the following inequality should hold S17 ()

 y≥|1−τ|. (27)

The main contribution of LMGA17 () is that every single-mode phase-insensitive Gaussian channel in the above class, besides the pure-loss channel, can be simulated by the action of a continuous-variable teleportation protocol on a finite-energy, two-mode resource state with the same amount of entanglement as the Choi state of the channel. An additional contribution of LMGA17 () is a converse bound: it is not possible to use a resource state with logarithmic negativity smaller than that of the Choi state, in order to simulate the channel. This follows directly from the facts that the teleportation simulation protocol should simulate the channel, teleportation is an LOCC, and logarithmic negativity is an entanglement monotone (it is non-increasing with respect to an LOCC). This converse bound holds, by the same argument, for all measures of entanglement (such as relative entropy of entanglement).

In more detail, the teleportation simulation of LMGA17 () begins with the sender and receiver of the channel sharing a two-mode Gaussian state in the standard form in (17). The sender mixes the input of the channel and her share of the resource state on a 50-50 beam splitter. The sender then performs ideal homodyne detection of the position quadrature of the first mode and ideal homodyne detection of the momentum quadrature of the second mode, leading to measurement outcomes and . The sender communicates these real values over ideal classical communication channels to the receiver, and the receiver performs displacement operations of his mode by and , for some . The result of all of these operations is to implement a quantum Gaussian channel of the following form on the input state:

 X =gI2, (28) Y =[g2a+2gc+b]I2, (29)

where we note the different sign convention from (LMGA17, , Eq. (7)), due to our slightly different convention for the standard form in (17). If , then the channel implemented is a single-mode phase-insensitive Gaussian channel with

 τ=g2,y=g2a+2gc+b. (30)

If , then one can postprocess the output according to a unitary Gaussian channel with and (a phase flip channel), such that the overall channel is a single-mode phase-insensitive Gaussian channel with and as in (30). A generalization of these steps beyond two-mode states is given in WPG07 ().

Where LMGA17 () departs from prior works is to solve an inverse problem regarding teleportation simulation. Given values of and corresponding to a physical channel different from the pure-loss channel, the authors of LMGA17 () proved that there exists a finite-energy, two-mode Gaussian state in standard form satisfying (30), having its smaller symplectic eigenvalue equal to one, and having its logarithmic negativity equal to that of the Choi state of the channel. It should be stressed that the states found in LMGA17 () have an analytical form, which has to do with the form of the above constraints.

### ii.3 Information quantities and bounds for secret-key-agreement protocols

The basic information quantities that we need in this paper are the quantum relative entropy U62 (); Lindblad1973 (), the relative entropy variance li12 (); TH12 (), and the hypothesis testing relative entropy BD10 (); WR12 (). For two states and defined on a separable Hilbert space with the following spectral decompositions:

 ρ =∑xλx|ϕx⟩⟨ϕx|, (31) σ =∑yμy|ψy⟩⟨ψy|, (32)

the quantum relative entropy Lindblad1973 () and the relative entropy variance  li12 (); TH12 () are defined as

 D(ρ∥σ) (33) V(ρ∥σ) (34)

For quantum Gaussian states, the quantities PhysRevA.71.062320 (), PLOB15 () and BLTW16 () can be expressed in terms of their first and second moments. For simplicity, let us suppose that and are zero-mean quantum Gaussian states. Then Refs. PhysRevA.71.062320 (), PLOB15 () established that

 D(ρ∥σ)=log2(Zσ/Zρ)/2−Tr{ΔVρ}/4ln2, (35)

where , and Ref. BLTW16 () established that

 V(ρ∥σ)=18ln22[Tr{ΔVρΔVρ}+Tr{ΔΩΔΩ}]. (36)

In the above, we should note that our convention for normalization of covariance matrices is what leads to the different constant prefactors when compared to the expressions in PhysRevA.71.062320 (); PLOB15 (); BLTW16 ().

The hypothesis testing relative entropy is defined as BD10 (); WR12 ()

 DεH(ρ∥σ)=−log2infΛ{Tr{Λσ}:0≤Λ≤I∧Tr{Λρ}≥1−ε} (37)

By the reasoning in DPR15 () and Appendix C, we have the following bound holding for faithful states and such that and :

 DεH(ρ⊗n∥σ⊗n)≤nD(ρ∥σ)+√nV(ρ∥σ)Φ−1(ε)+O(logn), (38)

where li12 (); TH12 ()

 T(ρ∥σ)=∑x,y∣∣⟨ψy|ϕx⟩∣∣2λx∣∣log2(λx/μy)−D(ρ∥σ)∣∣3, (39)

and

 Φ(a) =1√2π∫a−∞dx exp(−x22) (40) Φ−1(ε) =sup{a∈R | Φ(a)≤ε}. (41)

We note here that the finiteness of for finite-energy, faithful Gaussian states is essential to the main result of our paper. Inspecting the proof given in Appendix C, we see that the condition allows us to invoke the Berry-Esseen theorem KS10 (); S11 (), which in turn leads to the improved upper bound in (9).

The relative entropy of entanglement of a bipartite state is defined as follows VP98 ():

 ER(A;B)ρ=infσAB∈SEP(A:B)D(ρAB∥σAB), (42)

where denotes the set of separable (unentangled) states W89 (). Analogously, we have the -relative entropy of entanglement BD11 ():

 EεR(A;B)ρ=infσAB∈SEP(A:B)DεH(ρAB∥σAB). (43)

For a two-mode Gaussian state in standard form, one can always choose the separable state to be in standard form with the same values for and but with chosen to saturate the inequality in (23), such that PLOB15 (). By definition, for this suboptimal choice, we have that

 ER(A;B)ρ ≤D(ρAB∥σ′AB), (44) EεR(A;B)ρ ≤DεH(ρAB∥σ′AB), (45)

and this is the choice made in PLOB15 (); WTB16 () to arrive at various upper bounds on secret-key-agreement capacity. In what follows, we refer to as the suboptimal relative entropy of entanglement of .

In (WTB16, , Eq. (4.34)), the following bound was established on the non-asymptotic secret-key-agreement capacity of a channel  that is teleportation simulable with associated resource state :

 P↔N(n,ε)≤1nEεR(An;Bn)ω⊗n≤1nDεH(ω⊗nAB∥σ⊗nAB). (46)

The argument for the first inequality critically relies upon the connection between secret-key-agreement protocols and private-state distillation protocols established in HHHO05 (); HHHO09 () and some other results contained therein, in addition to the teleportation reduction argument discussed in Section II.2. The second inequality follows from the definition in (43), with being an arbitrary separable state. Thus, any resource state for the teleportation simulation of a channel can be used to give an upper bound on its non-asymptotic secret-key-agreement capacity. In particular, if and are faithful quantum Gaussian states of finite energy such that , then the conditions and hold, such that (38) applies and we find that

 P↔N(n,ε)≤D(ωAB∥σAB)+√V(ωAB∥σAB)nΦ−1(ε)+O(lognn). (47)

The quantities and are finite for faithful quantum Gaussian states of finite energy, which holds by inspecting (35) and (36), and in Appendix D, we argue that the quantity is finite as well.

Note that both (6) and (9) can be derived from (46). The point of deviation in the two derivations is that it is possible, on the one hand, to invoke the Berry–Esseen theorem KS10 (); S11 () in order to arrive at (9), due to the results of LMGA17 () and our arguments in Appendices C and D. That is, LMGA17 () showed how to perform teleportation simulation of a single-mode phase-insensitive thermal bosonic channel using a finite-energy resource state, and our Appendix D argues how is finite for finite-energy Gaussian states. Thus, the Berry–Esseen theorem can be invoked as shown in Appendix C and so (38) applies. On the other hand, for the derivation of (6), the ideal infinite-energy Choi state of the channel is used as the resource state, but it is not known if is finite in such a scenario. Hence, unless this is proven, we cannot invoke (38). Therefore, other techniques, such as the Chebyshev inequality, were used in WTB16 () to arrive at (6).

## Iii Methods

Given the background reviewed above, we are now in a position to discuss the main contribution of our paper. We modify the finite-energy teleportation simulation approach of LMGA17 () in the following way: Given a thermal channel with and , we find a finite-energy, two-mode Gaussian state in standard form such that

1. it satisfies (30),

2. its smaller symplectic eigenvalue is just larger than one, and

3. its suboptimal relative entropy of entanglement is equal to the suboptimal relative entropy of entanglement of the Choi state of the channel, the latter of which is given by (4).

Any resource state that simulates the channel should satisfy the first constraint. We impose the second constraint to ensure that the state we find is a faithful Gaussian state, such that its relative entropy and relative entropy variance to a separable Gaussian state can be easily evaluated using the formulas in (35) and (36). As discussed above, the relative entropy of entanglement of the resource state should at least be equal to that of the Choi state, in order to simulate a channel. In order to ensure that we find a good upper bound on the secret-key-agreement capacity, we have imposed the third constraint on suboptimal relative entropy of entanglement. We find these states by numerically solving the above constraints with the aid of a computer program 111Mathematica files are available in the source files of our arXiv post., and we remark that finding an analytical solution in this case appears to be far more complicated than for the case from LMGA17 (), due to the fact that the suboptimal relative entropy of entanglement is a much more complicated function of the covariance matrix elements. In some cases, it is possible to find multiple solutions for the states that satisfy these constraints. For our purpose, any of these states can be chosen. We also note that the flexibility afforded by having a teleportation simulation with negative gain , as discussed in Section II.2, is critical for us to solve these constraints by numerical search. With these finite-energy states in hand, we then numerically compute the relative entropy variance in (36) and can apply the bound in (47).

## Iv Results

In Figure 1, we plot upper bounds on the asymptotic secret-key-agreement capacity of the thermal channel given by (4) (dashed line) and upper bounds on the non-asymptotic secret-key-agreement capacity given by (9) (solid line) versus the number of channel uses. It is important to stress that the latter bound is only an approximation (known as the normal approximation) if is not sufficiently large (i.e., should be proportional to in order for the bounds to really apply). At the same time, many prior works have shown that the normal approximation is an excellent approximation for non-asymptotic capacities even for small polyanskiy10 (); P10 (); MW12 (); P13 (); TBR15 (). In each case, we choose the key-quality parameter to be , in accordance with the same conservative value chosen in TCGR12 (). In the plots, we select , (hence the corresponding distance ) and the thermal mean photon number as indicated above each figure. The distance can be related to the transmissivity of the thermal channel as , where is the fiber attenuation length RGRKVRHWE17 (). In the plots, we consider  km RGRKVRHWE17 (). The thermal mean photon number relevant in experimental contexts, whenever thermal noise is due exclusively to dark counts, is given by the dark counts per second times the integration period . In the plots, the lowest we consider corresponds to a dark count rate of per second and  ns (RGRKVRHWE17, , Section VI). For completeness, we also consider higher values of , which could occur due to excessive background thermal radiation or tampering by an eavesdropper.

As noted in the introduction of our paper, these upper bounds can be interpreted to serve as benchmarks for quantum repeaters L15 (). That is, the upper bounds on secret-key-agreement capacity hold for any protocol that uses the channel and LOCC but is not allowed to use a quantum repeater. As such, exceeding these upper bounds constitutes a demonstration of a quantum repeater L15 (). What our results indicate is that the previous upper bounds from PLOB15 (); WTB16 () on the asymptotic secret-key-agreement capacity are too pessimistic of a benchmark for protocols that are only using the channel a finite number of times. As such, the burden of demonstrating a quantum repeater is now somewhat relieved in comparison to what was previously thought would be necessary.

From an experimental perspective, it could be of interest to perform a test using the results of our paper in order to demonstrate a working quantum repeater. A convincing approach for doing so would be to conduct an actual secret-key-distillation protocol over some finite number of uses of the channel and determine what secret-key rates can be achieved. (RGRKVRHWE17, , Section IV) details methods for determining secret-key rates that are achievable in particular physical setups. For a given rate and number of channel uses, one can then compare the results with our plots (or other plots generated via the same method for different parameter values) to determine if the rate is achieved is larger than the upper bounds in our plots; if it is the case, then one can claim a working quantum repeater, albeit with the understanding that our upper bounds are the normal approximations of the true finite-length upper bounds (as discussed previously). This approach is to be contrasted with those that estimate the quantum bit-error rate from just a few channel uses and then use this parameter to calculate an asymptotic key rate (see the review in SBCDLP09 () for discussions of such approaches).

## V Conclusion

In this paper, we showed how to extend the teleportation simulation method of LMGA17 () to the relative entropy of entanglement measure. By combining with prior results in WTB16 () regarding non-asymptotic secret-key-agreement capacity, this extension leads to improved bounds on the non-asymptotic secret-key-agreement capacity of a thermal bosonic channel, in certain parameter regimes. Given that upper bounds on secret-key-agreement capacity have been advocated as a way to assess the performance of a quantum repeater, our results indicate that previous bounds from PLOB15 (); WTB16 () are too pessimistic, and it should be somewhat easier to demonstrate a working quantum repeater in the realistic regime of a finite number of channel uses.

We remark that our approach can be extended to quantum amplifier channels, but we did not discuss these channels in any detail because they appear to be most prominently physically relevant in exotic relativistic communication scenarios bradler2012quantum (); bradler2015black (); QW16 (). Our approach also applies to single-mode additive-noise Gaussian channels.

Going forward from here, it would be interesting to generalize our results to multimode bosonic communication channels CEGH08 () or channels that are not phase-insensitive. As discussed previously TSW16 (); TSW17 (); WTB16 (), it would also be good to determine bounds on performance when there is an average energy constraint at the input of each channel use. One should expect to find improved upper bounds due to this extra constraint.

###### Acknowledgements.
We are grateful to Gerardo Adesso, Boulat Bash, Mario Berta, Zachary Dutton, Jens Eisert, Saikat Guha, Jonathan P. Dowling, Jeffrey H. Shapiro, and Marco Tomamichel for discussions. We also thank the anonymous referees for their constructive comments that helped to improve our paper. We acknowledge support from the Office of Naval Research.

## Appendix A Little room for improving the strong converse bound in (1)

Here we argue why we think it will not be possible to improve upon the upper bound in (1), up to lower-order terms. Before proceeding, recall that the conditional quantum entropy and conditional entropy variance TH12 () are defined for a bipartite state as

 H(A|B)ρ ≡−D(ρAB∥IA⊗ρB), (48) V(A|B)ρ ≡V(ρAB∥IA⊗ρB). (49)

The coherent information is defined as PhysRevA.54.2629 () and its corresponding variance is . In (WTB16, , Section 6.2), the following achievability bound was established for a finite-dimensional channel:

 P↔N(n,ε)≥Irev(N)+√Vεrev(N)nΦ−1(ε)+O(lognn) (50)

where is the following quantity (DJKR06, , Section 5.3) (sometimes called the channel’s reverse coherent information):

 Irev(N)≡max|ψ⟩AA′∈HAA′I(B⟩A)θ, (51)

, and is the channel’s reverse conditional entropy variance:

 Vεrev(N)≡⎧⎨⎩ccminψAA′∈ΠrevV(B⟩A)θfor ε<1/2maxψAA′∈ΠrevV(B⟩A)θfor ε≥1/2. (52)

The set is the set of all states achieving the maximum in (51).

The inequality in (50) follows from a one-shot coding theorem (WTB16, , Proposition 21), followed by an expansion of the hypothesis testing relative entropy as li12 (); TH12 ()

 DεH(ρ⊗n∥σ⊗n)≥nD(ρ∥σ)+√nV(ρ∥σ)Φ−1(ε)+O(logn). (53)

A critical step employed in the above expansion is the Berry–Esseen theorem KS10 (); S11 (). Rather than employing the Berry–Esseen theorem, we can modify the proof of Theorem 2 in li12 () (therein instead picking ) to employ the Chebyshev inequality and instead find the following expansion:

 DεH(ρ⊗n∥σ⊗n)≥nD(ρ∥σ)−√nV(ρ∥σ)ε. (54)

For these theorems to hold in separable infinite-dimensional Hilbert spaces, it remains to show how to connect the coding theorem in (WTB16, , Proposition 21) to the inequality in (54), but we strongly suspect that this should be possible. If everything holds, we would obtain the following achievability theorem for an infinite-dimensional channel :

 P↔N(n,ε)≥Irev(N)−√Vεrev(N)nε+O(1n). (55)

The above would hold for all finite-energy two-mode, squeezed vacuum states passed through the channel, and one could then take a limit as the photon number approaches infinity. The term converges to PLOB15 (). Below we show that the relative entropy variance term converges to zero. This would then give the following bound

 P↔Lη(n,ε)≥−log2(1−η)+O(1n), (56)

leading us to our conclusion that there is little room for improving the upper bound in (1). We stress that this remains to be worked out in detail.

We now evaluate the variance for the reverse coherent information when sending in a two-mode squeezed vacuum to a pure-loss channel of transmissivity . Recall that the quantity of interest is

 V(B⟩A) =Tr{ρAB[logρAB−logρA]2} (57) −[H(AB)ρ−H(A)ρ]2 (58) =Tr{ρAB[logρAB]2} −2Tr{ρABlogρABlogρA}+Tr{ρAB[logρA]2} −[H(AB)ρ−H(A)ρ]2 (59) =Tr{ρAB[logρAB]2}−H(AB)2ρ −2[Tr{ρABlogρABlogρA}−H(A)ρH(AB)ρ] +Tr{ρA[logρA]2}−H(A)2ρ. (60)

The first and last terms we can evaluate easily using the following formula for the entropy variance of a thermal state with mean photon number (WRG15, , Appendix A):

 V(NS)=NS(NS+1)[log(1+1NS)]2. (61)

For the first, using the notion of purification, purifying with , and observing that is a thermal state with mean photon number , we find that

 Tr{ρAB[logρAB]2}−H(AB)2ρ =Tr{ψE[logψE]2}−H(E)2ψ (62) =(1−η)NS((1−η)NS+1)[log(1+1(1−η)NS)]2. (63)

For the last term, we observe that is a thermal state with mean photon number , which implies that

 (64)

So it remains to handle the middle term. Consider that

 Tr{ρABlogρABlogρA} =Tr{ψABElogρABlogρA} (65) =Tr{ψABElogψElogρA} (66) =Tr{ψAElogψElogρA}. (67)

Consider that we can write

 ψE =[(1−η)NS+1]−1(1+1(1−η)NS)−^nE, (68) ρA =[NS+1]−1(1+1NS)−^nA, (69)

where and are the number operators. This means that

 Tr{ψAElogψElogρA} =Tr{ψAElog⎡⎣[(1−η)NS+1]−1(1+1(1−η)NS)−^nE⎤⎦ ×log[[NS+1]−1(1+1NS)−^nA]} (70) =Tr{ψAElog⎡⎣[(1−η)NS+1](1+1(1−η)NS)^nE⎤⎦ ×log[[NS+1](1+1NS)^nA]} (71)
 =log[(1−η)NS+1]log[NS+1]+log[[(1−η)NS+1]]log[(1+1NS)]Tr{ψAE^nA}+log[1+1(1−η)NS]log[NS+1]Tr{ψAE^nE}+log[1+1(1−η)NS]log[1+1NS]Tr{ψAE(^nA⊗^nE)} (72)
 =log[(1−η)NS+1]log[NS+1]+NSlog[[(1−η)NS+1]]log[(1+1NS)]+(1−η)NSlog[1+1(1−η)NS]log[NS+1]+log[1+1(1−η)NS]log[1+1NS]×Tr{ψAE(^nA⊗^nE)}. (73)

We note that the third equality follows by applying the identity for positive scalars and and a positive operator . So we need to evaluate the term . Consider that sending a number state through a beamsplitter of transmissivity leads to the following transformation:

 |n⟩⟨n|A′→n∑k=0(nk)(1−η)kηn−k|k⟩⟨k|E. (74)

The two-mode squeezed vacuum at the input has the following form:

 1√NS+1∞∑n=0√(NSNS+1)n|n⟩A|n⟩A′. (75)

However since we are evaluating , and and are diagonal in the number basis, this is equivalent to the following:

 1NS+1∞∑n=0n∑k=0(NSNS+1)n(nk)(1−η)kηn−k× Tr{(|n⟩⟨n|A⊗|k⟩⟨k|)(^nA⊗^nE)} =1NS+1∞∑n=0n∑k=0(NSNS+1)n(nk)(1−η)kηn−knk (76) =1NS+1∞∑n=0n(NSNS+1)nn∑k=0(nk)(1−η)kηn−kk. (77)

Consider that the expression is equal to the mean of a binomial random variable with parameter , and so

 n∑k=0(nk)(1−η)kηn−kk=n(1−η), (78)

implying that the last line above is equal to

 (1−η)1NS+1∞∑n=0n2(NSNS+1)n. (79)

This is then equal to the second moment of a geometric random variable with parameter , so that

 =(1−η)(NS(NS+1)+N2S) (80) =(1−η)NS(2NS+1). (81)

Plugging into the above, we find the reduction

 =log[(1−η)NS+1]log[NS+1]+NSlog[[(1−η)NS+1]]log[(1+1NS)]+(1−η)NSlog[1+1(1−η)NS]log[NS+1]+(1−η)NS(2NS+1)log[1+1(1−η)NS]log[1+1NS]. (82)

From this we should subtract the following quantity

 H(A)ρH(AB)ρ =g(NS)g((1−η)NS) (83) =[(NS+1)log(NS+1)−NSlogNS]× [((1−η)NS+1)log((1−η)NS+1)−(1−η)NSlog(1−η)NS] (84) =[NSlog(1+1NS)+log(NS+1)]× [(1−η)NSlog(1+1(1−η)NS)+log((1−η)NS+1)] (85)
 =(1−η)N2Slog