Introduction

Quantum key distribution (QKD) allows communicating parties to securely distribute cryptographic keys by harnessing the fundamental properties of quantum mechanics. Theoretically, using QKD together with one-time pad encryption provides information-theoretic secure data transmission that cannot be broken either by current or by future technology1,2. However, any practical realization of QKD is vulnerable to side-channels, resulting mainly from imperfections of physical devices and operational limitations, which may not be taken into account in an idealized security proof. For instance, in discrete variable QKD, typical attacks exploiting side-channels are Trojan horse attacks3,4 and detector control attacks5,6,7.

In continuous variable (CV) QKD, quantum states are encoded into the two orthogonal—phase and amplitude—quadratures of the electromagnetic light field. Prepare-and-measure protocols, where the sender (Alice) prepares coherent quantum states using quadrature modulation, are particularly common as the CVQKD system can be built from telecommunication components2,8,9,10,11,12,13,14. The prepared quantum states are transmitted through an insecure quantum channel, assumed to be fully controlled by an eavesdropper (Eve). At the receiver (Bob), the quantum states are measured in a coherent manner, e.g., using homodyne or heterodyne detection15,16. Finally, the QKD protocol ends with classical data processing and security analysis, characterizing the information advantage of Alice and Bob over Eve. Similar to its discrete variable counterpart, CVQKD is prone to implementational loopholes. For example, attacks on the local oscillator’s intensity and the shot noise calibration have been demonstrated17,18,19,20.

Recently, the impact of side-channel leakage during coherent state preparation in a CVQKD protocol has been theoretically analyzed and experimentally demonstrated in a setup that established the coherent state’s mode in an optical single sideband (OSSB) using in-phase and quadrature (IQ) modulation21,22. In the proof-of-concept experiment, the authors showed that a side-channel is created due to the finite suppression of the quantum-information-carrying image sideband during OSSB modulation. This side-channel can significantly reduce the secret key rate and can even break the security of the system if neglected in the security proof. Therefore, exploring a modulation scheme for quantum state preparation that is information-leakage-free, is of great importance to CVQKD implementations.

Here we report a CVQKD implementation that is capable of removing the modulation leakage vulnerability without considering the practical imperfections of the modulation process in the security proof. We achieve this by implementing an optical baseband modulation scheme using an IQ modulator for quantum state preparation, and radio frequency (RF) heterodyne detection. In contrast to previous implementations22,23,24,25,26, the proposed modulation scheme does not frequency shift the coherent states at a radio frequency but keeps the quantum signal band centered at the optical carrier frequency. Thereby, it removes the side-channel leakage from the suppressed (image) sideband of quantum signals. Simultaneously, our scheme still employs a continuous-wave laser and digital mode shaping and does not require an additional amplitude modulator for pulse carving. We experimentally evaluate the performance of our implementation in terms of the so-called excess noise2,11,27: with the help of digital signal processing (DSP) that includes an optimized high pass filter (HPF) and a machine learning framework for phase carrier recovery25, our implementation achieved one of the lowest-ever reported excess noise of 0.72 × 10−3 photon number units (PNU). In addition, we also achieved a composable secure key fraction28,29 of 0.007 bits/symbol, calculated under the assumption of collective attacks.

Results

Coherent state preparation

To prepare coherent states, quadrature modulation is used in CVQKD systems9. In practice, quadrature modulation can be implemented either by using discrete amplitude and phase modulators or an IQ modulator8,23,24,30. The latter option offers more compact design, cost-effectiveness and potential robustness against Trojan-horse attacks4,22. Since in the IQ modulator the electro-optical modulators are fabricated on a single substrate, they have similar electrical-to-optical transfer functions which is an important property for generating coherent states in OSSBs.

The IQ modulator is, in principle, a Mach-Zehnder interferometer with dual nested Mach-Zehnder modulators (MZMs) and a phase modulator (PM), as shown in Fig. 1(a). Given an electric field Ein(t) at the input of an ideal IQ modulator, the electric field at the output can be expressed as31,32,

$${E}_{{{{\rm{out}}}}}(t)=\frac{{E}_{{{{\rm{in}}}}}(t)}{2}\left[\cos \left(\pi \frac{{V}_{{{{\rm{RF1}}}}}(t)+{V}_{{{{\rm{DC1}}}}}}{2{V}_{\pi }}\right)+\cos \left(\pi \frac{{V}_{{{{\rm{RF2}}}}}(t)+{V}_{{{{\rm{DC2}}}}}}{2{V}_{\pi }}\right){e}^{-j\pi \left(\frac{{V}_{{{{\rm{DC3}}}}}}{2{V}_{\pi /2}}\right)}\right],$$
(1)

where VRF1(t) and VRF2(t) are RF waveforms and VDC1,2,3 are direct current (DC) bias voltages applied on the modulators. The latter are usually controlled by an automatic bias controller (ABC). Here, Vπ is the half-wave voltage, i.e., the voltage at which the optical phase changes by π. In CVQKD, the modulator is usually operated in the linear regime. Hence, VRF1(t) and VRF2(t) are typically (at least) an order of magnitude smaller than Vπ and only the first order sidebands of the electric field get significantly excited.

Fig. 1: IQ modulator internal structure and its operation modes.
figure 1

a An IQ modulator consists of two MZMs driven by RF signals VRF1(t) and VRF2(t) with 90∘ phase difference. For OSSB-CS, the two MZMs operate at a dark fringe, e.g., through VDC1 = VDC2 = Vπ, while the PM maintains the relative phase of 90∘ using VDC3. b-e Output spectra of OSSB and baseband operation modes. b Infinite carrier and sideband suppression, and therefore ideal OSSB-CS. c OSSB-CS with finite carrier and sideband suppression due to sub-optimal settings of the DC bias and manufacturing imperfections. d Ideal baseband modulation with carrier suppression. e Practical baseband modulation with finite carrier suppression.

Full size image

For CVQKD purposes, OSSB modulation for the generation of coherent states provides practical advantages as it avoids low-frequency noise by shifting the quantum states with coherent excitation α(t) = I(t) + jQ(t) away from the optical carrier23,25. As illustrated in Fig. 1(b), in an ideal scenario, the optical carrier at ω as well as the (upper) sidebands around ω + Ω are completely suppressed, leading to true OSSB modulation with carrier suppression (OSSB-CS). However, in practice, the IQ modulator is capable of providing only a finite level of OSSB-CS as depicted in Fig. 1(c). In this practical scenario, the output electric field of equation (1) can be expressed as,

$${E}_{{{{\rm{out}}}}}(t)\approx \frac{\mu }{2}\alpha (t){e}^{j(\omega -\Omega )t}+\frac{\delta }{2}{\alpha }^{* }(t){e}^{j(\omega +\Omega )t}+\Delta {e}^{j\omega t},$$
(2)

Here, μ is the modulation index, δ < μ is an effective modulation index including the sideband suppression ratio, and Δ describes the residual electric-field amplitude of the carrier after suppression. A detailed derivation can be found in the Methods section.

The modulation leakage vulnerability gets manifested when Alice and Bob do not account for the finite suppression, i.e., δ > 0, while Eve extracts the not-completely-suppressed sideband (centered at ω + Ω in Fig. 1(d)), using, for instance, an optical filter22. Basically, this allows Eve to gain more information about the secret key without alerting Alice and Bob.

One way to deal with this side-channel while keeping the advantages of OSSB modulation is to consider the information leakage from the suppressed sideband in the security proof. Nevertheless, this approach reduces the range over which a secret key can be obtained, requires additional measurements when characterizing the system and guarantees on the long-term stability of the achieved suppression22. Alternatively, one can completely remove the issue of finite sideband suppression and therefore the modulation leakage vulnerability by considering a modulation scheme in which no suppressed image sideband is generated.

One possible candidate for such a modulation scheme is optical baseband modulation33, a technique in which the driving RF waveforms of the IQ modulator are baseband signals, i.e., the signals have not been up-converted to a higher radio frequency. This results in the quantum signal band centered at the optical carrier frequency as shown in Fig. 1(d). In fact, by driving the IQ modulator such that VRF1(t) ∝ Real(α(t)) = I(t) and VRF2(t) ∝ Imag(α(t)) = Q(t) and considering the imperfect bias settings of the MZMs, the electric field at the output of the IQ modulator can be expressed as,

$${E}_{{{{\rm{out}}}}}(t)=\left[\sin \left({\mu }_{1}I(t)+{\phi }_{1}\right)+j\sin \left({\mu }_{2}Q(t)+{\phi }_{2}\right)\right]\frac{{e}^{j\omega t}}{2}\approx \left[{\mu }_{1}I(t)+j{\mu }_{2}Q(t)+{\phi }_{1}+j{\phi }_{2}\right]\frac{{e}^{j\omega t}}{2}\approx \left(\frac{\mu }{2}\alpha (t)+\Delta \right){e}^{j\omega t},$$
(3)

assuming μ1 ≈ μ2 = μ and ϕ1 + jϕ2 = 2Δ. Here, ϕ1 and ϕ2 are phase errors due to bias deviation from Vπ of the MZMs. Note that to simplify, we have neglected the deviation of phase modulation bias in the above. From equation (3), where the approximation \(\sin (\theta )\approx \theta\) is justified due to the low RF modulation depth and minor deviations from the expected DC bias values, it is clear that the output of the IQ modulator is side-channel free and the modulated signal is mixed with the optical carrier component \(\Delta \exp (j\omega t)\) due to the finite carrier suppression, as presented in Fig. 1(e). This carrier component can be easily removed using a digital filter, as we will explain later. Therefore, the use of baseband modulation for quantum state preparation can remove the sideband leakage vulnerability while keeping the advantages of OSSB in high spectral efficiency and better noise performance by avoiding the low-frequency noise using RF heterodyne detection.

The schematic of our CVQKD system is shown in Fig. 2. It consists of an optical module and a DSP module. The sender (Alice) prepared a 20 MBaud baseband quantum signal and frequency multiplexed pilot tone, both encoded into the phase and amplitude quadratures of the electromagnetic light field by an IQ modulator. After suitable attenuation, the optical signal was then sent over a 20 km fiber channel to the receiver (Bob), where RF heterodyne detection was performed. Finally, after data acquisition and by performing several DSP steps, one of which is the proposed digital filtering applied at Alice’s and Bob’s sides to remove low-frequency noise and carrier components, Bob recovered a noisy version of Alice’s quantum symbols. These quantum data symbols were stored as frames by both parties. Further details of the system implementation can be found in the Methods section.

Fig. 2: Optical layout and DSP routine of our modulation-leakage-free CVQKD system.
figure 2

Alice digitally prepared an ensemble of Gaussian-modulated coherent states with a frequency multiplexed pilot tone using her DSP module. The spectrum of the complex digital signal is shown in the inset. The corresponding RF signals were generated using an arbitrary waveform generator (AWG; not shown in the figure) with a 1 GSample/s sampling rate. These signals were then used to drive an IQ modulator modulating light from a 1550 nm continuous-wave laser. For optical carrier suppression, an automatic bias controller (ABC) was used with the IQ modulator. The quantum signal was obtained after the output of the IQ modulator was suitably attenuated using a variable optical attenuator (VOA; input and output pigtails on the same side) driven by a digital-to-analog converter (DAC). At Bob’s station, the polarization of the signal transmitted through a 20 km SMF-28 fiber was corrected with a manual polarization controller (PC) to match the polarization of an independent local oscillator for RF heterodyne detection. The digitized output of the balanced detector (BD) was fed through Bob’s DSP module. The ADC output spectra from 3 different measurements are shown as the input to Bob’s DSP routine. An external 10 MHz clock reference (CLK) was used to synchronize the AWG and ADC.

Full size image

Classical data processing

After the quantum stage of the protocol, Alice and Bob performed information reconciliation (IR) based on a multi-dimensional (MD) scheme using a multi-edge-type low-density-parity-check (MET-LDPC) error correcting code34, assuming they were connected through an authenticated classical channel. Table 1 summarizes the related parameters of the constructed MET-LDPC code, optimized for a binary input additive white Gaussian noise (BI-AWGN) channel. The convergence threshold of the degree distribution of the designed MET-LDPC code (asymptotic threshold \({\sigma }_{{{{\rm{DE}}}}}^{* }\)) of 5.93 was estimated by running the density evolution until the error probability was < 10−10. This threshold indicates how close to the Shannon limit the code can operate: the larger the threshold, the closer to the theoretical limit the MET-LDPC code can operate. The code rate R of the designed MET-LDPC code was 0.02. As the convergence threshold was specified at signal-to-noise ratio (SNR) of -15.46 dB, the asymptotic code efficiency, \({\beta }_{{{{\rm{Code}}}}}^{* }=R/{C({\sigma }_{{\rm{DE}}}^{* })}\), where \(C({\sigma }_{{\rm{DE}}}^{* })\), denotes the Shannon capacity at \({\sigma }_{{\rm{DE}}}^{* }\), was 98.8%.

Table 1 Parameters of the designed MET-LDPC code.
Full size table

To achieve a high IR efficiency with this code rate at a non-optimal SNR of 0.0443, we adopted the rate-adaptive reconciliation protocol, using the so-called puncturing technique to change the code rate of the designed MET-LDPC code34. We should mention that the optimal SNR for MET-LDPC code with a rate of 0.02 is 0.0281. By adding punctured symbols whose values between Alice and Bob are uncorrelated, the mutual information between Alice and Bob data decreases, allowing us to use an error correction code of rate 0.02. The overall MD reconciliation efficiency with puncturing for a dimension \(\dim =8\) was computed as β = Rpunc/CAWGN(s), where Rpunc is the code rate after puncturing. For a codeword of length n and k information bits the original code rate is R = k/n, while after puncturing the final code rate becomes Rpunc = k/(n − p), where p denotes the puncturing length. Table 2 shows simulated IR efficiencies and frame error rates (FERs) for different puncturing lengths. High IR efficiencies up to 96.46 % can be achieved at the cost of high FER, which will significantly reduce the final secret key length. Therefore, as a trade-off between the FER and efficiency, we set the puncturing length to 320,000, which corresponds to an efficiency of 93.04% and FER = 0.215.

Table 2 The reconciliation efficiency and FER for different puncturing lengths.
Full size table

Next, Alice performed parameter estimation to obtain a bound on Eve’s Holevo information, calculating the number of bits expected in the output secret key in the worst-case scenario. This length was communicated together with a seed to Bob. For privacy amplification (PA), the shared seed from the previous step was used to select a random Toeplitz hash function by Alice and Bob, who then employed the high-speed and large-scale PA scheme35 to generate the final secret key.

Experimental investigation

The use of HPFs in Alice’s and Bob’s DSP modules is the key ingredient of our CVQKD implementation. To understand the effect of these HPFs on the security and system performance, we first investigated the normalized auto-correlation functions of received quantum symbols from one frame, demodulated using three different HPFs with the same bandwidth of 190 kHz but different orders, as depicted in Fig. 3. In general, applying these HPFs can introduce correlations between consecutive symbols as indicated by the dip around the correlation peak, clearly seen in the figure in the case of the 1st-order filter. With reference to the spectrum of the RF driving signal in Fig. 2, this correlation could be attributed to the fact that the HPF gives rise to frequency-selective fading, indicated by the notch in the spectrum, and causes inter-symbol interference in the time domain36. Moreover, the inset in Fig. 3 shows that the strength of correlation depends on the filter order: as the order reduces the dip in correlation increases. Therefore, one could also anticipate the same dependence for the filter bandwidth since the delay spread is proportional to the notch bandwidth in the spectrum introduced by the HPF36.

Fig. 3: The effect of HPFs.
figure 3

Plot of normalized autocorrelation functions of demodulated quantum symbols using HPFs of the same bandwidth and different orders.

Full size image

From a security point of view, such correlations can destroy the independent and identically distributed property of the quantum symbols, which would violate an assumption commonly made in the security proofs. Therefore, optimizing filter parameters is extremely important to keep the effect on the independence as small as possible. However, we note, that even without HPF perfect independence cannot be achieved in practice due to the physical properties of the modulator. One way the results suggest for filter optimization is to minimize the correlation coefficient in the vicinity of the correlation peak, as in the case of the 5th-order filter.

As a next step, we explored the tolerance of the optimized HPFs to finite carrier suppression provided by the ABC. To do this, we performed regular heterodyne measurements while varying the amount of carrier suppression by tuning the dither amplitude applied by the ABC on MZM1 and MZM2. As a figure of merit for the HPF’s performance, Fig. 4 shows the total noise, i.e., the sum of the trusted electronic noise (t) and the untrusted noise (u) contributed by Eve, as a function of the carrier suppression. Each data point in the plot is represented by the mean and standard deviation over 200 frames. It is clear that the HPF has no significant performance degradation over 10 dB carrier suppression, implied by the highly overlapping error bars. This result confirms the effectiveness of the optimized HPF over a relatively wide range of carrier suppression. We note that as the ABC cannot provide lower than 9 dB carrier suppression, we were not able to reach the performance breaking point.

Fig. 4: Total noise versus carrier suppression.
figure 4

Error bars represent one standard deviation, while squares depict the average value.

Full size image

Finally, to demonstrate the practical feasibility of modulation-leakage-free CVQKD, we generated a secret key over the 20 km fiber considering composable security and collective attacks29. Table 3 summarizes the main experimental parameters used for secret key generation. Alice sent 109 coherent states with a modulation strength of 0.27 mPNU to Bob. After channel parameter estimation, a total noise u + t = 0.73 + 31.40 = 32.13 mPNU and a total average transmittance η ⋅ τ = 0.24 ⋅ 0.68 = 0.16 were measured. Here, η is the untrusted channel transmission and τ is the trusted detection efficiency. As our CVQKD system uses a local local oscillator37, the main contributor to untrusted channel noise u is the excess noise due to the residual phase noise, \({\xi }_{{{{\rm{phase}}}}}=2{V}_{{{{\rm{a}}}}}\left(1-{e}^{-\frac{{V}_{{{{\rm{est}}}}}}{2}}\right)\), where Vest is the variance of the residual phase after phase noise compensation38,39. In comparison to29, the untrusted noise u achieved here is lower because our system operated at a lower modulation strength, resulting in a lower ξphase. Also, careful optimization of our DSP chain played a significant role to obtain such noise performance. We note that η is relatively small for a 20 km fiber channel with a physical transmission of ≈0.38, which could be attributed to the polarization optimization after the fiber channel.

Table 3 Overview of experimental parameters for composable security.
Full size table

As for IR, Alice and Bob used 9.8 × 108 complex symbols to perform reverse reconciliation with an efficiency β = 93.04% with the IR code described above in frames of 1024 × 103 bits. The total number of corrected symbols after IR was reduced to 7.7 × 108 due to FER = 0.215. The maximum iteration number of the MET-LDPC decoder was set to 500. Joining data from both I and Q quadratures, we obtained a total of 2 × 7.7 × 108 symbols. Finally, we calculated the composable secret key length l = 1 × 108 bits, which translates into a secret key fraction of 0.007 bits/symbol. The security parameters of calibration (ϵcal) and parameter estimation (ϵPE) were both set to 10−10 while ϵIR was set to 10−12.

Figure 5 (a) shows the composable secret key fraction as a function of the number N of available quantum symbols (before IR) both for the average (black squares) and worst-case (red dots) scenarios – the latter given by the considered confidence intervals29. Likewise, the measured untrusted noise with a worst-case estimator is shown in Fig. 5 (b). A positive key fraction was obtained for N ≳ 6 × 108, corresponding to a null key fraction threshold of ≈ 1.8 mPNU. From an experimental point of view, the reason for being able to achieve a positive key fraction with a relatively small number of symbols could be attributed to our system noise performance, implying the practical feasibility of our implementation. Also considering an estimated η of 0.24, a composable secret key for a long distance can be achieved by optimizing the polarization control circuit.

Fig. 5: Experimental results demonstrating the CVQKD system performance.
figure 5

a Composable secret key fraction versus number of quantum symbols. b Measured excess noise and its worst-case estimator.

Full size image

Discussion

In this work, we demonstrated a practical CVQKD system that is free of the modulation leakage vulnerability. This was enabled by means of optical baseband modulation for coherent states preparation and RF heterodyne reception together with carefully designed DSP. Our system showed low noise performance with high tolerance to finite carrier suppression of the IQ modulator due to the use of digital HPFs. This allowed us to generate a composable secret key secure against collective attacks over 20 km fiber channel. However, careful optimization of the HPFs is necessary to avoid intersymbol interference, which may leak more information to Eve.

Compared with phase-diverse intradyne or homodyne CVQKD systems, where the security is not affected by the sideband modulation leakage as Bob measures both sidebands, our system provides a cost-effective solution since it does not require a 90-degree optical hybrid nor an amplitude modulator in the transmitter to generate pulses. Besides, like OSSB CVQKD systems, our implementation facilitates spectral efficiency and better noise performance by avoiding the low-frequency noise at the detection side. The proposed baseband modulation together with the DSP chain is also suitable for other CVQKD systems based on modulated coherent states, including measurement-device-independent CVQKD40. We anticipate that our implementation can be a potential solution to protect future CVQKD systems against side-channels from modulation leakage with better system performance, and remove the need for a complex characterization of the leakage and the risk of a failure in system security due to long-term stability issues which may increase the leakage over time.

Methods

Derivation of Eq. (2). In the practical OSSB modulation, where the bias voltages of IQ modulator deviate from the optimal condition, e.g., \({V}_{D{C}_{1}}={V}_{D{C}_{2}}=-{V}_{\pi }+{{{{\rm{dV}}}}}_{{{{\rm{MZM}}}}}\), and \({V}_{D{C}_{3}}=-{V}_{\frac{\pi }{2}}+{{{{\rm{dV}}}}}_{{{{\rm{PM}}}}}\), the output electric field of equation (1) can be expressed as,

$$\begin{array}{lll}{E}_{{{{\rm{out}}}}}(t)=\frac{{E}_{{{{\rm{in}}}}}(t)}{2}\left[\sin \left({\theta }_{1}(t)+\phi \right)+j\sin \left({\theta }_{2}(t)+\phi \right){e}^{j{{\Phi }}}\right]\\ \qquad\quad\;=\frac{{E}_{{{{\rm{in}}}}}(t)}{2}\left[\sin \left({\theta }_{1}(t)\right)\cos \left(\phi \right)+\cos \left({\theta }_{1}(t)\right)\sin \left(\phi \right) \right. \\ \qquad\qquad\,\; \left.+\;j{e}^{j{{\Phi }}}\left(\sin \left({\theta }_{2}(t)\right)\cos \left(\phi \right)+\cos \left({\theta }_{2}(t)\right)\sin \left(\phi \right)\right)\right].\end{array}$$
(4)

Here, \(\phi =\frac{\pi }{2{V}_{\pi }}{{{{\rm{dV}}}}}_{{{{\rm{MZM}}}}}\) and \({{\Phi }}=\frac{\pi }{2{V}_{\frac{\pi }{2}}}{{{{\rm{dV}}}}}_{{{{\rm{PM}}}}}\) captures the phase error due to non-optimal bias voltages setting and \({\theta }_{i}(t)=\frac{\pi }{2{V}_{\pi }}{V}_{{{{\rm{RF}}}}i}(t)\) for i = 1 or 2. For very small θi(t), we can take the second-order Taylor series expansion of (4) as,

$$\begin{array}{lll}{E}_{{{{\rm{out}}}}}(t)\approx \frac{{E}_{{{{\rm{in}}}}}(t)}{2}\left[{\theta }_{1}(t)\cos \left(\phi \right)+\left(1-\frac{1}{2}{\theta }_{1}^{2}(t)\right)\sin \left(\phi \right)+j{e}^{j{{\Phi }}}\left({\theta }_{2}(t)\cos \left(\phi \right)+\left(1-\frac{1}{2}{\theta }_{2}^{2}(t)\right)\sin \left(\phi \right)\right)\right]\\ \approx \frac{{E}_{{{{\rm{in}}}}}(t)}{2}\left[\left({\theta }_{1}(t)+j{e}^{j{{\Phi }}}{\theta }_{2}(t)\right)\cos \left(\phi \right)+\left(1+j{e}^{j{{\Phi }}}\right)\sin \left(\phi \right)-\frac{1}{2}\left({\theta }_{1}^{2}(t)+j{e}^{j{{\Phi }}}{\theta }_{2}^{2}(t)\right)\sin \left(\phi \right)\right]\\ \approx \frac{{E}_{{{{\rm{in}}}}}(t)}{2}\left[\left({\theta }_{1}(t)+j{e}^{j{{\Phi }}}{\theta }_{2}(t)\right)\cos \left(\phi \right)+\left(1+j{e}^{j{{\Phi }}}\right)\sin \left(\phi \right)\right]\\ \approx \frac{{E}_{{{{\rm{in}}}}}(t)}{2}\left[{e}^{j\frac{{{\Phi }}}{2}}\cos \left(\phi \right)\left({\theta }_{1}(t){e}^{-j\frac{{{\Phi }}}{2}}+j{e}^{j\frac{{{\Phi }}}{2}}{\theta }_{2}(t)\right)+\left(1+j{e}^{j{{\Phi }}}\right)\sin \left(\phi (t)\right)\right]\\ \approx \frac{{E}_{{{{\rm{in}}}}}(t)}{2}\left[{e}^{j\frac{{{\Phi }}(t)}{2}}\cos \left(\phi \right)\left({\theta }_{1}(t)(\cos \left(\frac{{{\Phi }}}{2}\right)-j\sin \left(\frac{{{\Phi }}}{2}\right))+\left.j(\cos \left(\frac{{{\Phi }}}{2}\right)+j\sin \left(\frac{{{\Phi }}}{2}\right)){\theta }_{2}(t)\right)\right.+\left(1+j{e}^{j{{\Phi }}}\right)\sin \left(\phi \right)\right]\\ \approx \frac{{E}_{{{{\rm{in}}}}}(t)}{2}\left[{e}^{j\frac{{{\Phi }}}{2}}\cos \left(\phi \right)\left(({\theta }_{1}(t)+j{\theta }_{2}(t))\cos \left(\frac{{{\Phi }}}{2}\right)-j({\theta }_{1}(t)-j{\theta }_{2}(t))\sin \left(\frac{{{\Phi }}}{2}\right)\right)+\left(1+j{e}^{j{{\Phi }}}\right)\sin \left(\phi \right)\right]\\ \approx \frac{{E}_{{{{\rm{in}}}}}(t)}{2}\left[\frac{\pi {e}^{j\frac{{{\Phi }}}{2}}\cos \left(\phi \right)}{2{V}_{\pi }}\left(({V}_{{{{\rm{RF1}}}}}(t)+j{V}_{{{{\rm{RF2}}}}}(t))\cos \left(\frac{{{\Phi }}}{2}\right)-j({V}_{{{{\rm{RF1}}}}}(t)-j{V}_{{{{\rm{RF2}}}}}(t))\sin \left(\frac{{{\Phi }}}{2}\right)\right)+\left(1+j{e}^{j{{\Phi }}}\right)\sin \left(\phi \right)\right],\end{array}$$
(5)

therefore, for OSSB, where the driving signal of IQ modulator can be expressed as VRF1(t) + jVRF2(t) = α(t)e−jΩt, the output of the IQ modulator can be written as,

$${E}_{{{{\rm{out}}}}}(t)\approx \frac{\mu }{2}\alpha (t){e}^{j(\omega -\Omega )t}+\frac{\delta }{2}{\alpha }^{* }(t){e}^{j(\omega +\Omega )t}+\Delta {e}^{j\omega t}.$$
(6)

Details of the experimental setup

Sender (Alice). We digitally generated baseband RF driving signals using Alice’s DSP module as shown in Fig. 2. As a first step, a quantum random number generator (QRNG) with a security parameter ϵqrng = 2 × 10−6 was employed to generate uniformly distributed random bit sequences41. Then, the inversion sampling method based on the cumulative distribution function was used to map the uniformly distributed sequences to Gaussian distributed integers with 6 bits resolution covering 7 standard deviations29. Afterwards, the quantum symbols Ai = Ii + jQi were drawn from these Gaussian distributed integers at rate B = 20 MBaud. These symbols were upsampled to 1 GSample/s and pulse-shaped by a root raised cosine (RRC) filter with a roll-off factor of 0.2 to obtain the baseband quantum signal \(q(t) = h(t)\, * \, {\Sigma}_{i} {A}_{i}{\delta}(t-iT)\). Here, h(t) is the impulse response of the RRC filter. A 5th-order Butterworth high pass filter (HPF) with a cut-off frequency of 190 kHz was applied to the quantum signal for the purpose of temporal mode shaping. A reference pilot tone at a frequency of 60 MHz was multiplexed with the quantum signal for frequency offset estimation and phase noise compensation. Figure 2 (left inset) shows the complex spectrum of V(t), the output of Alice’s DSP module. Finally, the RF driving waveforms, VRF1(t) = Real(V(t)) and VRF2(t) = Imag(V(t)) were uploaded to a dual-channel arbitrary waveform generator (AWG) with 16 bit resolution and sampling frequency of 1 GSample/s.

In the optical module, a continuous wave (CW) laser at 1550 nm with a line-width of ≈100 Hz was used as the optical carrier. Random coherent states were prepared using a commercial off-the-shelf IQ modulator driven by the AWG. The DC bias voltages of the IQ modulator were controlled using a commercial ABC to achieve optical baseband modulation with finite carrier suppression. For such an ABC the amount of carrier suppression can be controlled by tuning parameters such as the dither signal amplitude and the feedback photodiode gain of the bias circuit. To reduce the effect of the laser intensity noise, after the IQ modulator the optical signal was suitably attenuated using an electro-optic variable optical attenuator (VOA) driven by a digital-to-analog converter so that the modulated laser beam was shot-noise limited. To avoid back reflections and thus Trojan-horse attacks4, a Faraday isolator was added before the input of the quantum channel, which was a 20 km standard single mode fiber.

Receiver (Bob). After the quantum channel, a manual polarization controller was used to optimize the polarization of the optical signal for RF heterodyne detection with a free-running local oscillator (LO), generated by a CW laser with a frequency offset of ≈ 200 MHz with respect to Alice’s laser. A home-made broadband balanced detector with a bandwidth of ≈ 365 MHz detected the interference between the LO and the transmitted optical signal. The output of the balanced detector was then digitized at a sampling rate of 1 GSample/s using an analog-to-digital converter (ADC), which was clock synchronized to Alice’s AWG using a 10 MHz external reference.

The measurement time was divided into frames, each containing 107 samples. Three individual measurements were performed. In order, these were: modulated signal measurement, vacuum noise measurement where Alice’s laser was switched off while Bob’s laser was on, and finally an electronic noise measurement in which both Alice’s and Bob’s lasers were switched off. To avoid the effect of the LO power fluctuation on the measurement, particularly on vacuum measurement, an autonomous system based on python code has been developed to perform the modulation process and data acquisition. Figure 2 (right inset) shows the labeled spectral traces from these measurements, evaluated for one frame each, as input to Bob’s DSP module. The clearance of the vacuum noise with respect to the electronic noise was ≈ 15 dB. It should also be mentioned that for the modulation strength (Va) calibration, we performed a back-to-back measurement, i.e., the transmitter and the receiver were directly connected without the quantum channel. The modulation strength, described as the mean photon number of a thermal state, was ≈ 0.27 PNU, where PNU stands for photon number units15,29.

To recover Alice’s modulated quantum symbols, Bob’s DSP module, shown in Fig. 2, was applied offline. Whitening filter coefficients were first created by taking the inverse Fourier transform of the averaged frequency response of the vacuum noise. The whitening filter was then applied to electronic, vacuum and quantum signal traces to obtain a flat response across the entire spectrum. The frequency offset was estimated by means of a Hilbert transform of the pilot tone and a linear fit of the extracted phase profile. Using the estimated frequency offset, the pilot tone and the quantum signal were downconverted to baseband. The baseband pilot signal was used as input to an unscented Kalman filter (UKF) for carrier phase estimation25. Afterward, the quantum signal was corrected by the obtained phase estimate from the UKF. Temporal synchronization was achieved through the cross-correlation between transmitted and received reference symbols. As a result of baseband modulation, the baseband quantum signal contained undesirable low-frequency components, namely, the optical carrier (beat signal) after down-mixing and the ABC dither signals. To remove these components and measure the same temporal mode as the transmitted coherent states, a HPF with the same type, order and bandwidth as Alice’s HPF was applied to the quantum signal as well as the vacuum and electronic noise measurements. We should mention that the bandwidth of the HPFs mainly relies on the spectral width of the beat signal, and the dither frequencies of the ABC. Finally, the received quantum symbols were obtained after RRC matched filtering and downsampling.