# Long-distance measurement-device-independent quantum key distribution using
entangled states between continuous and discrete variables

Soumyakanti Bose<EMAIL_ADDRESS>Department of Physics &
Astronomy, Seoul National University, Gwanak-ro 1, Gwanak-gu, Seoul 08826,
Korea  Jaskaran Singh<EMAIL_ADDRESS>Departamento de Física Aplicada II,
Universidad de Sevilla, E-41012 Sevilla, Spain  Adán Cabello<EMAIL_ADDRESS>Departamento de Física Aplicada II, Universidad de Sevilla, E-41012 Sevilla,
Spain  Instituto Carlos I de Física Teórica y Computacional, Universidad de
Sevilla, E-41012 Sevilla, Spain  Hyunseok Jeong<EMAIL_ADDRESS>Department of Physics & Astronomy, Seoul National University, Gwanak-ro 1,
Gwanak-gu, Seoul 08826, Korea

###### Abstract

We introduce a feasible scheme to produce high-rate long-distance entanglement
which uses hybrid entanglement (HE) between continuous variables (CV) and
discrete variables (DV). We show that HE can effectively remove the
experimental limitations of existing CV and DV measurement-device-independent
quantum key distribution (MDI-QKD) protocols. The key idea is using the CV
part, which can be adjusted to be robust against photon losses, for increasing
the transmission distance, while using the DV part for achieving high secure
key rates. We show that, using HE states, MDI-QKD is possible with standard
telecom fibers for $300$ km with a secure key rate which is an order of
magnitude higher than in existing protocols. Our results point out that HE
states provide advantage for practical long-distance high-rate entanglement.

Introduction.—Generation of high-rate entanglement between distant locations
is crucial for fundamental tests of quantum theory and many applications. For
example, it is needed for extending the current distances and rates of
loophole-free Bell tests [1, 2], quantum steering [3], and quantum
teleportation [4], which so far are only feasible for relatively short ranges.
It is also needed for increasing the transmission distance and the key rate of
entanglement-based quantum key distribution (QKD) protocols, most notably
device-independent QKD [5, 6, 7], which currently suffers from both these
issues. Moreover, higher-rates in distant locations will also allow us to
achieve higher detection efficiencies (which are needed both for loophole-free
Bell tests and device-independent QKD) by means of heralded qubit amplifiers
[8] or photonic precertification schemes [9, 10, 11], whose practicality is
currently limited by the rates achieved after transmission.

A benchmark of high-rate entanglement over long distances can be set by their
performance in entanglement-based QKD protocols. More specifically,
measurement-device-independent (MDI) QKD protocols [12, 13, 14, 15, 16, 17,
18] are of particular interest as they can effectively double the distance
over which entanglement can be shared, while also providing a good secure key
rate. Currently, MDI-QKD protocols can potentially share entanglement up to
$220$ kms with a key rate of the order of $10^{-10}$ bits per pulse using
telecommuication wavelength and standard optical fibres [12, 19, 20]. MDI-QKD
protocols are suitable for secure multiuser networks [21, 22] and have been
experimentally demonstrated [19, 23, 20]. Moreover, they are an excellent test
bed to efficiently generate and study entanglement between distant locations
and in networks.

There are two types of MDI-QKD protocols: those that use discrete variable
(DV) systems and those that use continuous variable (CV) systems. For long-
distance MDI-QKD, each type has its own set of advantages and limitations [24,
25]. As an example, DV-MDI-QKD protocols offer composable security proofs with
good key rate. However, they require costly single-photon-sources and precise
Bell-state or single-photon measurements, which are hard to perform even in
laboratory conditions. On the other hand, CV-MDI-QKD protocols generally
require Gaussian states which are comparatively easier to prepare, are robust
against transmission losses, and can share entanglement over long distances.
However, their performance is limited by the requirement of almost ideal
homodyne detectors at telecommunication wavelength [17, 18]. As a consequence,
despite an extensive theoretical and experimental analysis on both types of
systems, the quest for an optimal physical system to share high-rate
entanglement among distant parties remains open.

Nonetheless, there exists a different class of physical systems formally known
as hybrid entangled (HE) states [26, 27, 28, 29, 30]. These strongly
correlated [31, 32, 33] cross-system entangled states play a crucial role in
various quantum information processing tasks, including quantum computation,
communication, and tests of Bell non-locality [34, 35, 36, 37, 38, 39, 33, 40,
41], and have been efficiently generated in a wide range of experimental
setups [42, 43, 44, 45, 46]. Consequently, using these states, it is possible
to share entanglement among distant locations without the limitations faced by
CV and DV systems.

In this Letter, we propose a scheme based on HE states as initial resource
which produces high-rate entanglement between extremely far apart locations
and thus can be efficiently used to generate secure keys. By bringing forth
the best of both CV and DV systems in HE states, we show that it is possible
to share entanglement and achieve secure key rate at a distance of $300$ km by
using practical homodyne detectors with efficiency $\eta_{h}=0.55$ [47, 48,
49, 50, 51] (which is a reasonable value at telecom wavelengths [48]) and on-
off detectors with efficiency $\eta_{0}=0.8$ [52], thereby surpassing earlier
results at telecommunication wavelengths on standard optical fibres. We also
show that the key rate is an order of magnitude higher than previously
reported [12], which is reflective of the quality of the correlations shared.

Our scheme hinges on generating a single-photon DV entangled state between two
distant parties by exploiting CV entanglement swapping by a third party
located midway. It offers three major advantages as compared to earlier CV and
DV-MDI-QKD protocols. These are: (i) Elimination of major limiting factors of
DV-MDI-QKD, which include high precision Bell state or single-photon
measurements as well as the photon-number-splitting attack by an eavesdropper
by considering entanglement swapping over the CV system. (ii) Elimination of
the requirement of near-unit efficiency for the homodyne detectors used for
key generation in CV-MDI-QKD. (iii) Long transmission distance at
telecommunication wavelength stemming from the robustness of the multiphoton
coherent state against transmission losses. Our scheme clearly exhibits the
applicability and the importance of HE states in generating high-rate high-
quality entanglement over $300$ kms using realistic and widely available
equipment.

Hybrid entangled states.—Let $\ket{0}$ and $\ket{1}$ correspond to photon
number states in the Fock basis and $\ket{\alpha}$ correspond to a coherent
state of a quantized light with coherent amplitude $\alpha$. For the remainder
of this paper we will represent the number of photons as a DV system, while
the coherent state represents a CV system. We define a HE state as an
entangled pair, where the entanglement is between the DV and CV degrees of
freedom. Mathematically, such HE states can be written as

$\ket{\psi}_{a_{1}a_{2}}=\frac{1}{\sqrt{2}}\left(\ket{0}_{a_{1}}\ket{\alpha}_{a_{2}}+\ket{1}_{a_{1}}\ket{-\alpha}_{a_{2}}\right),$
(1)

where $a_{1}$ and $a_{2}$ are the two modes pertaining to the DV and CV parts,
respectively. We stress that HE states with small coherent amplitudes
($\alpha\lesssim 1$) are experimentally available. They have been generated
experimentally using photon addition technique and a coherent state [42] as
well as photon subtraction on two squeezed states [43] (see Appendix A for
further detail). While these techniques produce HE states with non-unit
probability, it should be noted that typical methods to generate standard
entangled photon pairs, e.g., the parametric down conversion, also does so
non-deterministically.

Figure 1: (a) Scheme for generating DV entangled states between Alice and Bob
using HE states. The DV part (cyan) and the CV part (red) of the HE state
stand for the single-photon state and coherent state, respectively. Alice and
Bob send the CV part of their individual HE states to Charlie, who then mixes
the incoming signals at a balanced beam splitter (BS1), and uses one of the
output modes for homodyne measurement with efficiency $\eta_{h}$. The other
outgoing signal of BS1 is used for a post-selection measurement by on-off
detectors with efficiency $\eta_{0}$, after mixing it at another balanced BS
(BS2) with the additional coherent signal sent by Bob. Upon declaration of the
results by Charlie, Alice and Bob obtain a DV entangled pair which is used for
secure key generation. (b) Scheme for generating HE states. Two ancilla single
photons (gray, dashed line) are mixed with vacuum and coherent states at the
two BSs. The outgoing ancilla photons are then mixed with each other at a
second BS. When the detector placed at the output of the second BS clicks,
then the HE state between single-photon and the coherent state is obtained.

Protocol.—We consider two distant parties, Alice and Bob, each of them having
access to bipartite HE states $\ket{\psi}_{a_{1}a_{2}}$ and
$\ket{\psi}_{b_{1}b_{2}}$ given by Eq. (1). We consider these as initial
resource states which will be used to share a DV entangled state between the
parties. We provide a step-by-step description of the protocol, schematically
represented in Fig. 1, while a detailed mathematical calculation can be found
in Appendix B.

Step 1: Alice and Bob generate HE states $\ket{\psi}_{a_{1}a_{2}}$ and
$\ket{\psi}_{b_{1}b_{2}}$ in their respective laboratories. Both parties
transmit the CV part of their systems, corresponding to modes $a_{2}$ and
$b_{2}$, respectively, to a third untrusted party, Charlie, who lies midway
between them, through a lossy quantum channel with transmittance $T$ ($0\leq
T\leq 1$). Additionally, Bob also transmits the state $\ket{\sqrt{2}\alpha}$
to Charlie separately through a similar quantum channel. After passing through
noisy channels, Charlie receives the mode $a_{2}$ from Alice, the mode $b_{2}$
from Bob, and the additional state $\ket{\sqrt{2T}\alpha}$ from Bob, which we
label by mode $c$.

Step 2: Charlie mixes the two incoming modes $a_{2}$ and $b_{2}$ via a beam
splitter (BS), labelled as BS1 in Fig. 1 with two output modes which we can
label as $a_{2}^{{}^{\prime}}$ and $b_{2}^{{}^{\prime}}$. In our protocol we
are specifically interested in the vacuum state contributions from the mode
$a_{2}^{{}^{\prime}}$. To extract this contribution, Charlie mixes this mode
though a second BS (BS2) with mode $c$ with output modes labelled as
$a_{2}^{{}^{\prime\prime}}$ and $c^{{}^{\prime}}$. Charlie now performs a
projective measurement, $\mathcal{M}=\\{\Pi_{0},\mathds{1}-\Pi_{0}\\}$, where
$\Pi_{0}=(\mathds{1}-\ket{0}\bra{0})_{a_{2}^{{}^{\prime\prime}}}\otimes(\mathds{1}-\ket{0}\bra{0})_{c^{{}^{\prime}}}$.
This measurement is accomplished by using on-off detectors (that only detect
the presence of photons) on each of the modes $a_{2}^{{}^{\prime\prime}}$ and
$c^{{}^{\prime}}$. Charlie then publicly announces the outcome of the
projective measurement which is considered to be successful only if the result
$\Pi_{0}$ is obtained, i.e., both detectors click. In that case, the protocol
continues. Otherwise, the measurement is deemed unsuccessful and the parties
must repeat the aforementioned steps again. In order to model realistic
detectors, we consider imperfect on-off detectors with efficiency $\eta_{0}$.

Step 3: After a successful projective measurement (as dictated in Step 2),
Charlie performs a homodyne measurement on the mode $b_{2}^{{}^{\prime}}$ and,
again, announces the results publicly. We consider that homodyne measurements
have efficiency $\eta_{h}$.

Step 4: After a public announcement of the results of a successful projective
measurement and the homodyne measurement by Charlie, Alice and Bob end up with
the final normalized single-photon-Bell-state in modes $a_{1}$ and $b_{1}$ as
(Appendix B.3)

$\rho_{a_{1}b_{1}}=\frac{1}{2}\left[\ket{01}\bra{01}+\ket{10}\bra{10}\\\
+f\Big{(}g\ket{01}\bra{10}+g^{*}\ket{10}\bra{01}\Big{)}\right]$ (2)

with probability

$p_{0}=\frac{\left(1-e^{-\eta_{o}T\alpha^{2}}\right)^{2}}{2},$ (3)

where $f=e^{-4(1-T\eta_{h})\alpha^{2}}$,
$g=e^{4\mathsf{i}\sqrt{T\eta_{h}}\alpha p}$, $g^{*}$ is the conjugate of $g$,
and $p$ is the result of the homodyne measurement.

Step 5: For the case in which Alice and Bob share $\rho_{a_{1}b_{1}}$, they
perform two-outcome measurements $\mathcal{M}_{A}$ and $\mathcal{M}_{B}$ on
their respective subsystems to generate a raw key. The choice of measurements
is made prior to starting the protocol and the information about this choice
is usually publicly available. In our protocol, they perform Pauli
measurements corresponding to $\sigma_{Z}$ on their respective subsystems to
generate a raw key. The length of the raw key that the parties can generate is
quantified by the mutual information $I(A:B)$ between them for the observable
$\sigma_{Z}$.

Step 6: Alice and Bob then estimate the amount of information that an
adversary, Eve, can have on their raw key. This information is quantified by
the Holevo bound $\chi(A:E)$ between Alice and Eve. In our protocol we
consider the Holevo bound instead of quantum bit error rate (which is standard
in DV-MDI-QKD protocols), because the the knowledge about the coherent
amplitude $\alpha$, results of the on-off and homodyne measurement are
publicly declared, and actively used in generating the final state between
Alice and Bob. These results can be used by Eve and as such must be taken care
of in the security analysis. As a consequence, we can write the final secure
key rate as

$r\geq p_{0}\left[I(A:B)-\chi(A:E)\right].$ (4)

Simulation results.—Our protocol, as detailed above, comprises of two quantum
channels: one between Alice and Charlie and another between Bob and Charlie.
We assume that the transmittance of both the channels is given by $T_{A}$ and
$T_{B}$, respectively, such that, $T_{A}=10^{-l\frac{L_{AC}}{10}}$ and
$T_{B}=10^{-l\frac{L_{BC}}{10}}$, where $l=0.2$ dB/km is the standard channel
loss for telecom wavelength [12, 16] and $L_{AC}$ and $L_{BC}$ are the
transmission distances between Alice-Charlie and Bob-Charlie respectively. We
assume that Charlie is midway between Alice and Bob such that
$L_{AC}=L_{BC}=L/2$ such that the total transmission distance is $L$. We make
this assumption because it has been shown that DV-MDI QKD is much more
efficient when Charlie is midway between Alice and Bob [25]. The secure key
rate between Alice and Bob is given by Eq. (4). (See Appendix C.1 for the
underlying assumptions made and the evaluation of the secure key rate.)

In Fig. 2, we plot the secure key rate as a function the total transmission
distance $L$. We choose the parameters $\eta_{h}=0.55$, $\eta_{0}=0.8$, and
$p=\frac{\pi}{2}$ to be as realistic as possible. We see that the total
transmission distance can reach upto $300$ km with a secure key rate of the
order of $10^{-9}$ bits/pulses for $\alpha=0.5$ and $l=0.2$ dB/km. For an
ultralow loss fibre [20] with $l=0.16$ dB/km and $\alpha=0.5$ we find that it
is possible to achieve a total transmission distance of $460$ km. However, as
we increase $\alpha$, the key rate is found to decrease drastically. We also
find that decreasing the value of $\alpha$ below $0.5$ also decreases the key
rate as well as the maximum transmission distance leading to an optimal choice
of $\alpha\sim 0.5$ (see Appendix C.2).

Figure 2: Secure key rate as a function of total transmission distance $L$ for
different values of $\alpha$ and channel loss parameter $l$ (dB/km). We assume
detection efficiencies $\eta_{h}=0.55$ for the homodyne detectors,
$\eta_{0}=0.8$ for the on-off detectors, and $p=\frac{\pi}{2}$.

This optimal value for $\alpha$ is in agreement with the observation that it
is also the value of $\alpha$ which is more robust to transmission losses (see
Appendix D). The effect of a quantum state passing through a noisy channel can
be seen as the system undergoing photon loss. Let us denote the photon loss
fraction by $R$ such that $R=0$ and $R=1$ correspond to no photon loss and
complete photon loss, respectively. In Fig. 3, we show that the entanglement
content of an HE state, as given by logarithmic negativity [53], achieves a
maximum value for $0\leq\alpha\leq 1$. For a significantly lossy channel, we
find that the optimal value of $\alpha$ approaches $\alpha=0.5$.

Figure 3: Logarithmic negativity of the HE state undergoing photon-loss over
the CV part as a function of the coherent amplitude $\alpha$. $R$ ($0\leq
R\leq 1$) stands for the normalized strength of loss.

This behaviour of HE states can be qualitatively understood in terms of the
interplay between entanglement and the fragility of the initial HE state.
Starting from the initial separable state at $\alpha=0$, the HE state becomes
more entangled as $\alpha$ increases. An increase in $\alpha$ also corresponds
to an increase in the average number of photons, which can be understood as an
increase in the mean energy of the system. However, with an increase in the
mean energy, the state becomes more vulnerable to decoherence. This behaviour
is similar to what is also shown in Ref. [54] for superposition of coherent
states with increasing values of coherent amplitude. As a consequence, with
increase in $\alpha$ beyond an optimal value, the HE state becomes extremely
fragile under noise leading to a drop in entanglement when the multiphoton
part passes through a noisy quantum channel. See Appendix D for a detailed
analysis.

Conclusions.—We have shown that HE states between CV and DV systems provide a
robust practical solution to the problem of achieving long-distance high-rate
entanglement. Both requirements are fundamental for a number of applications.
We have focused on MDI-QKD, as it is both a fundamental application and a
multipurpose test bed. In a MDI-QKD setup, our results indicate that HE states
bring forth the best of both CV and DV systems, resulting in a secure key rate
of $\sim 10^{-9}$ bits/pulse at a distance of $300$ km. This, in itself,
represents a significant improvement than the best previous results at
telecommunication wavelength (a key rate of $10^{-10}$ bits/pulse at $\sim
220$ km [12]). All this, without using ultralow-loss fibre (with channel loss
$l=0.16$ dB/km at $1550$ nm [20]). With such a fibre, our approach would allow
us to achieve $\sim 10^{-10}$ bits/pulse at a distance of $460$ km.

The feasibility of the protocol relies in the fact that HE states with small
coherent amplitudes ($\alpha<1$) can be generated in the lab by several non-
deterministic techniques [42, 43] and the generation rate is comparable to the
rate of entangled photon pairs in parametric down conversion setups. As an
example, it is possible to prepare HE states where CV and DV parts correspond
to photon number state and coherent state, respectively, with fidelity
$\approx 0.75$ for $\alpha=0.5$ [42]. While the rate of generation in the
source is comparable to that of parametric down conversion sources, losses
during transmission are reduced, so the effective rate at destination
increases. The fidelity of the preparation could be a limiting factor.
However, this can be mitigated by using other forms of HE states, most notably
with the CV and DV modes corresponding to cat states and polarization,
respectively, which offer exceptionally good fidelity of preparation as well
as rate of generation [55, 56, 57, 58, 59].

Our results highlight the significance of HE states as a resource in high-rate
remote entanglement generation, which plays a crucial role in enhancing many
quantum information processing tasks such as quantum internet [21, 60],
quantum digital signature [61, 62], and network steering [63]. We believe that
our scheme has the potential to drive a new generation of experimental
developments in quantum information technology.

This work is supported by QuantERA grant SECRET, by MCINN/AEI (Project No.
PCI2019-111885-2). AC is also supported by MCINN/AEI (Project No.
PID2020-113738GB-I00). HJ is supported by National Research Foundation of
Korea (NRF) grants funded by the Korean government (Grant Nos.
NRF-2020R1A2C1008609, 2023R1A2C1006115 and NRF-2022M3E4A1076099) via the
Institute of Applied Physics at Seoul National University, and by the
Institute of Information & Communications Technology Planning $\&$ Evaluation
(IITP) grant funded by the Korea government (MSIT) (IITP-2021-0-01059 and
IITP-2023-2020-0-01606).

## References

  * Hensen  _et al._ [2015] B. Hensen, H. Bernien, A. E. Dréau, A. Reiserer, N. Kalb, M. S. Blok, J. Ruitenberg, R. F. L. Vermeulen, R. N. Schouten, C. Abellán, W. Amaya, V. Pruneri, M. W. Mitchell, M. Markham, D. J. Twitchen, D. Elkouss, S. Wehner, T. H. Taminiau, and R. Hanson, Loophole-free Bell inequality violation using electron spins separated by 1.3 kilometres, Nature 526, 682 (2015).
  * Rosenfeld  _et al._ [2017] W. Rosenfeld, D. Burchardt, R. Garthoff, K. Redeker, N. Ortegel, M. Rau, and H. Weinfurter, Event-ready Bell test using entangled atoms simultaneously closing detection and locality loopholes, Phys. Rev. Lett. 119, 010402 (2017).
  * Wittmann  _et al._ [2012] B. Wittmann, S. Ramelow, F. Steinlechner, N. K. Langford, N. Brunner, H. M. Wiseman, R. Ursin, and A. Zeilinger, Loophole-free Einstein–Podolsky–Rosen experiment via quantum steering, New J. Phys. 14, 053030 (2012).
  * Ma  _et al._ [2012] X.-S. Ma, T. Herbst, T. Scheidl, D. Wang, S. Kropatschek, W. Naylor, B. Wittmann, A. Mech, J. Kofler, E. Anisimova, V. Makarov, T. Jennewein, R. Ursin, and A. Zeilinger, Quantum teleportation over 143 kilometres using active feed-forward, Nature 489, 269 (2012).
  * Nadlinger  _et al._ [2022] D. P. Nadlinger, P. Drmota, B. C. Nichol, G. Araneda, D. Main, R. Srinivas, D. M. Lucas, C. J. Ballance, K. Ivanov, E. Y. Z. Tan, P. Sekatski, R. L. Urbanke, R. Renner, N. Sangouard, and J.-D. Bancal, Experimental quantum key distribution certified by Bell’s theorem, Nature 607, 682 (2022).
  * Zhang  _et al._ [2022] W. Zhang, T. van Leent, K. Redeker, R. Garthoff, R. Schwonnek, F. Fertig, S. Eppelt, W. Rosenfeld, V. Scarani, C. C. W. Lim, and H. Weinfurter, A device-independent quantum key distribution system for distant users, Nature 607, 687 (2022).
  * Liu  _et al._ [2022] W.-Z. Liu, Y.-Z. Zhang, Y.-Z. Zhen, M.-H. Li, Y. Liu, J. Fan, F. Xu, Q. Zhang, and J.-W. Pan, Toward a photonic demonstration of device-independent quantum key distribution, Phys. Rev. Lett. 129, 050502 (2022).
  * Gisin  _et al._ [2010] N. Gisin, S. Pironio, and N. Sangouard, Proposal for implementing device-independent quantum key distribution based on a heralded qubit amplifier, Phys. Rev. Lett. 105, 070501 (2010).
  * Cabello and Sciarrino [2012] A. Cabello and F. Sciarrino, Loophole-free bell test based on local precertification of photon’s presence, Phys. Rev. X 2, 021010 (2012).
  * Meyer-Scott  _et al._ [2016] E. Meyer-Scott, D. McCloskey, K. Gołos, J. Z. Salvail, K. A. G. Fisher, D. R. Hamel, A. Cabello, K. J. Resch, and T. Jennewein, Certifying the presence of a photonic qubit by splitting it in two, Phys. Rev. Lett. 116, 070501 (2016).
  * Leger  _et al._ [2022] A. Z. Leger, S. Gambhir, J. Légère, and D. R. Hamel, Amplification of cascaded downconversion by reusing photons with a switchable cavity, arXiv:2209.11668 (2022).
  * Lo  _et al._ [2012] H.-K. Lo, M. Curty, and B. Qi, Measurement-device-independent quantum key distribution, Phys. Rev. Lett. 108, 130503 (2012).
  * Ferreira da Silva  _et al._ [2013] T. Ferreira da Silva, D. Vitoreti, G. B. Xavier, G. C. do Amaral, G. P. Temporão, and J. P. von der Weid, Proof-of-principle demonstration of measurement-device-independent quantum key distribution using polarization qubits, Phys. Rev. A 88, 052303 (2013).
  * Braunstein and Pirandola [2012] S. L. Braunstein and S. Pirandola, Side-channel-free quantum key distribution, Phys. Rev. Lett. 108, 130502 (2012).
  * Ottaviani  _et al._ [2015] C. Ottaviani, G. Spedalieri, S. L. Braunstein, and S. Pirandola, Continuous-variable quantum cryptography with an untrusted relay: Detailed security analysis of the symmetric configuration, Phys. Rev. A 91, 022320 (2015).
  * Pirandola  _et al._ [2015] S. Pirandola, C. Ottaviani, G. Spedalieri, C. Weedbrook, S. L. Braunstein, S. Lloyd, T. Gehring, C. S. Jacobsen, and U. L. Andersen, High-rate measurement-device-independent quantum cryptography, Nat. Photonics 9, 397 (2015).
  * Kumar  _et al._ [2019] C. Kumar, J. Singh, S. Bose, and Arvind, Coherence-assisted non-Gaussian measurement-device-independent quantum key distribution, Phys. Rev. A 100, 052329 (2019).
  * Singh and Bose [2021] J. Singh and S. Bose, Non-Gaussian operations in measurement-device-independent quantum key distribution, Phys. Rev. A 104, 052605 (2021).
  * Tang  _et al._ [2014] Y.-L. Tang, H.-L. Yin, S.-J. Chen, Y. Liu, W.-J. Zhang, X. Jiang, L. Zhang, J. Wang, L.-X. You, J.-Y. Guan, D.-X. Yang, Z. Wang, H. Liang, Z. Zhang, N. Zhou, X. Ma, T.-Y. Chen, Q. Zhang, and J.-W. Pan, Measurement-device-independent quantum key distribution over 200 km, Phys. Rev. Lett. 113, 190501 (2014).
  * Tang  _et al._ [2015] Y.-L. Tang, H.-L. Yin, S.-J. Chen, Y. Liu, W.-J. Zhang, X. Jiang, L. Zhang, J. Wang, L.-X. You, J.-Y. Guan, D.-X. Yang, Z. Wang, H. Liang, Z. Zhang, N. Zhou, X. Ma, T.-Y. Chen, Q. Zhang, and J.-W. Pan, Field test of measurement-device-independent quantum key distribution, IEEE J. Sel. Top. Quantum Electron. 21, 116 (2015).
  * Tang  _et al._ [2016] Y.-L. Tang, H.-L. Yin, Q. Zhao, H. Liu, X.-X. Sun, M.-Q. Huang, W.-J. Zhang, S.-J. Chen, L. Zhang, L.-X. You, Z. Wang, Y. Liu, C.-Y. Lu, X. Jiang, X. Ma, Q. Zhang, T.-Y. Chen, and J.-W. Pan, Measurement-device-independent quantum key distribution over untrustful metropolitan network, Phys. Rev. X 6, 011024 (2016).
  * Fröhlich  _et al._ [2013] B. Fröhlich, J. F. Dynes, M. Lucamarini, A. W. Sharpe, Z. Yuan, and A. J. Shields, A quantum access network, Nature 501, 69 (2013).
  * Yin  _et al._ [2016] H.-L. Yin, T.-Y. Chen, Z.-W. Yu, H. Liu, L.-X. You, Y.-H. Zhou, S.-J. Chen, Y. Mao, M.-Q. Huang, W.-J. Zhang, H. Chen, M. J. Li, D. Nolan, F. Zhou, X. Jiang, Z. Wang, Q. Zhang, X.-B. Wang, and J.-W. Pan, Measurement-device-independent quantum key distribution over a 404 km optical fiber, Phys. Rev. Lett. 117, 190501 (2016).
  * Diamanti  _et al._ [2016] E. Diamanti, H.-K. Lo, B. Qi, and Z. Yuan, Practical challenges in quantum key distribution, npj Quantum Inf. 2, 16025 (2016).
  * Xu  _et al._ [2015] F. Xu, M. Curty, B. Qi, L. Qian, and H.-K. Lo, Discrete and continuous variables for measurement-device-independent quantum cryptography, Nat. Photonics 9, 772 (2015).
  * Jeong [2005] H. Jeong, Using weak nonlinearity under decoherence for macroscopic entanglement generation and quantum computation, Phys. Rev. A 72, 034305 (2005).
  * Li  _et al._ [2006] Y. Li, H. Jing, and M.-S. Zhan, Optical generation of a hybrid entangled state via an entangling single-photon-added coherent state, J. Phys. B: At. Mol. Opt. Phys. 39, 2107 (2006).
  * Liao  _et al._ [2006] J.-Q. Liao, Y. Guo, H.-S. Zeng, and L.-M. Kuang, Preparation of hybrid entangled states and entangled coherent states for a single trapped ion in a cavity, J. Phys. B: At. Mol. Opt. Phys. 39, 4709 (2006).
  * He  _et al._ [2011] B. He, Q. Lin, and C. Simon, Cross-Kerr nonlinearity between continuous-mode coherent states and single photons, Phys. Rev. A 83, 053826 (2011).
  * Hosseini  _et al._ [2012] M. Hosseini, S. Rebic, B. M. Sparkes, J. Twamley, B. C. Buchler, and P. K. Lam, Memory-enhanced noiseless cross-phase modulation, Light: Sci. Appl. 1, e40 (2012).
  * Chen  _et al._ [2002] Z.-B. Chen, G. Hou, and Y.-D. Zhang, Quantum nonlocality and applications in quantum-information processing of hybrid entangled states, Phys. Rev. A 65, 032317 (2002).
  * Park  _et al._ [2012] K. Park, S.-W. Lee, and H. Jeong, Quantum teleportation between particlelike and fieldlike qubits using hybrid entanglement under decoherence effects, Phys. Rev. A 86, 062301 (2012).
  * Kwon and Jeong [2013] H. Kwon and H. Jeong, Violation of the Bell–Clauser-Horne-Shimony-Holt inequality using imperfect photodetectors with optical hybrid states, Phys. Rev. A 88, 052127 (2013).
  * Lee and Jeong [2013] S.-W. Lee and H. Jeong, Near-deterministic quantum teleportation and resource-efficient quantum computation using linear optics and hybrid qubits, Phys. Rev. A 87, 022326 (2013).
  * Andersen  _et al._ [2015] U. L. Andersen, J. S. Neergaard-Nielsen, P. van Loock, and A. Furusawa, Hybrid discrete and continuous-variable quantum information, Nat. Phys. 11, 713 (2015).
  * Omkar  _et al._ [2020] S. Omkar, Y. S. Teo, and H. Jeong, Resource-efficient topological fault-tolerant quantum computation with hybrid entanglement of light, Phys. Rev. Lett. 125, 060501 (2020).
  * Omkar  _et al._ [2021] S. Omkar, Y. S. Teo, S.-W. Lee, and H. Jeong, Highly photon-loss-tolerant quantum computing using hybrid qubits, Phys. Rev. A 103, 032602 (2021).
  * Bose and Jeong [2022] S. Bose and H. Jeong, Quantum teleportation of hybrid qubits and single-photon qubits using Gaussian resources, Phys. Rev. A 105, 032434 (2022).
  * He and Malaney [2022] M. He and R. Malaney, Teleportation of hybrid entangled states with continuous-variable entanglement, Sci. Rep. 12, 17169 (2022).
  * Sheng  _et al._ [2013] Y.-B. Sheng, L. Zhou, and G.-L. Long, Hybrid entanglement purification for quantum repeaters, Phys. Rev. A 88, 022302 (2013).
  * Lim  _et al._ [2016] Y. Lim, J. Joo, T. P. Spiller, and H. Jeong, Loss-resilient photonic entanglement swapping using optical hybrid states, Phys. Rev. A 94, 062337 (2016).
  * Jeong  _et al._ [2014] H. Jeong, A. Zavatta, M. Kang, S.-W. Lee, L. S. Costanzo, S. Grandi, T. C. Ralph, and M. Bellini, Generation of hybrid entanglement of light, Nat. Photonics 8, 564 (2014).
  * Morin  _et al._ [2014] O. Morin, K. Huang, J. Liu, L. H. Jeannic, C. Fabre, and J. Laurat, Remote creation of hybrid entanglement between particle-like and wave-like optical qubits, Nat. Photonics 8, 570 (2014).
  * Ulanov  _et al._ [2017] A. E. Ulanov, D. Sychev, A. A. Pushkina, I. A. Fedorov, and A. I. Lvovsky, Quantum teleportation between discrete and continuous encodings of an optical qubit, Phys. Rev. Lett. 118, 160501 (2017).
  * Sychev  _et al._ [2018] D. V. Sychev, A. E. Ulanov, E. S. Tiunov, A. A. Pushkina, A. Kuzhamuratov, V. Novikov, and A. I. Lvovsky, Entanglement and teleportation between polarization and wave-like encodings of an optical qubit, Nature Communications 9, 3672 (2018).
  * Darras  _et al._ [2023] T. Darras, B. E. Asenbeck, G. Guccione, A. Cavaillès, H. Le Jeannic, and J. Laurat, A quantum-bit encoding converter, Nat. Photonics 17, 165 (2023).
  * Qi  _et al._ [2015] B. Qi, P. Lougovski, R. Pooser, W. Grice, and M. Bobrek, Generating the local oscillator “locally” in continuous-variable quantum key distribution based on coherent detection, Phys. Rev. X 5, 041009 (2015).
  * Jouguet  _et al._ [2013] P. Jouguet, S. Kunz-Jacques, A. Leverrier, P. Grangier, and E. Diamanti, Experimental demonstration of long-distance continuous-variable quantum key distribution, Nat. Photonics 7, 378 (2013).
  * Zou  _et al._ [2022] M. Zou, Y. Mao, and T.-Y. Chen, Rigorous calibration of homodyne detection efficiency for continuous-variable quantum key distribution, Opt. Express 30, 22788 (2022).
  * Zhang  _et al._ [2019] G. Zhang, J. Y. Haw, H. Cai, F. Xu, S. M. Assad, J. F. Fitzsimons, X. Zhou, Y. Zhang, S. Yu, J. Wu, W. Ser, L. C. Kwek, and A. Q. Liu, An integrated silicon photonic chip platform for continuous-variable quantum key distribution, Nat. Photonics 13, 839 (2019).
  * Zhang  _et al._ [2020] Y. Zhang, Z. Chen, S. Pirandola, X. Wang, C. Zhou, B. Chu, Y. Zhao, B. Xu, S. Yu, and H. Guo, Long-distance continuous-variable quantum key distribution over 202.81 km of fiber, Phys. Rev. Lett. 125, 010502 (2020).
  * [52] While a photon-number-resolving-detector (PNRD) measures the number of photons detected, an on-off detector only indicates whether a photon is detected or not. As a consequence, an on-off detector is much less demanding than a PNRD. Recent advances in technology has led to development of single-photon detectors with efficiencies as high as $0.84$–$0.91$ [64, 65, 66] with the use of high-contrast-grating in nanophotonics settings. This, in turn, implies that the efficiency of an on-off detector can be safely approximated upto $0.80$ (if not more).
  * Plenio [2005] M. B. Plenio, Logarithmic negativity: A full entanglement monotone that is not convex, Phys. Rev. Lett. 95, 090503 (2005).
  * Lee and Jeong [2011] C.-W. Lee and H. Jeong, Quantification of macroscopic quantum superpositions within phase space, Phys. Rev. Lett. 106, 220401 (2011).
  * Kwon and Jeong [2015] H. Kwon and H. Jeong, Generation of hybrid entanglement between a single-photon polarization qubit and a coherent state, Phys. Rev. A 91, 012340 (2015).
  * Li  _et al._ [2018] S. Li, H. Yan, Y. He, and H. Wang, Experimentally feasible generation protocol for polarized hybrid entanglement, Phys. Rev. A 98, 022334 (2018).
  * Podoshvedov and An [2019] S. A. Podoshvedov and N. B. An, Designs of interactions between discrete and continuous-variable states for generation of hybrid entanglement, Quant. Inf. Process. 18, 68 (2019).
  * Huang  _et al._ [2019] K. Huang, H. L. Jeannic, O. Morin, T. Darras, G. Guccione, A. Cavaillès, and J. Laurat, Engineering optical hybrid entanglement between discrete- and continuous-variable states, New J. Phys. 21, 083033 (2019).
  * Wen  _et al._ [2021] J. Wen, I. Novikova, C. Qian, C. Zhang, and S. Du, Hybrid entanglement between optical discrete polarizations and continuous quadrature variables, Photonics 8, 552 (2021).
  * Wehner  _et al._ [2018] S. Wehner, D. Elkouss, and R. Hanson, Quantum internet: A vision for the road ahead, Science 362, eaam9288 (2018).
  * Yin  _et al._ [2017] H.-L. Yin, Y. Fu, H. Liu, Q.-J. Tang, J. Wang, L.-X. You, W.-J. Zhang, S.-J. Chen, Z. Wang, Q. Zhang, T.-Y. Chen, Z.-B. Chen, and J.-W. Pan, Experimental quantum digital signature over 102 km, Phys. Rev. A 95, 032334 (2017).
  * Zhao  _et al._ [2021] W. Zhao, R. Shi, J. Shi, P. Huang, Y. Guo, and D. Huang, Multibit quantum digital signature with continuous variables using basis encoding over insecure channels, Phys. Rev. A 103, 012410 (2021).
  * Jones  _et al._ [2021] B. D. M. Jones, I. Šupić, R. Uola, N. Brunner, and P. Skrzypczyk, Network quantum steering, Phys. Rev. Lett. 127, 170405 (2021).
  * Pernice  _et al._ [2012] W. Pernice, C. Schuck, O. Minaeva, M. Li, G. Goltsman, A. Sergienko, and H. Tang, High-speed and high-efficiency travelling wave single-photon detectors embedded in nanophotonic circuits, Nat. Commun. 3, 1325 (2012).
  * Wei  _et al._ [2021] C. Wei, W. Wang, D. Liu, M. Gu, and X. Wu, High-efficiency and large light-receiving area superconducting nanowire single-photon detector integrated with high-contrast grating, Photon. Res. 9, 2253 (2021).
  * Miki  _et al._ [2021] S. Miki, S. Miyajima, F. China, M. Yabuno, and H. Terai, Photon detection at $1$ ns time intervals using $16$-element SNSPD array with SFQ multiplexer, Opt. Lett. 46, 6015 (2021).
  * Barnett  _et al._ [1999] S. M. Barnett, D. T. Pegg, and J. Jeffers, Equivalence of a lossless beam splitter and a nondegenerate parametric amplifier in conditional measurements, Opt. Commun. 172, 55 (1999).
  * Życzkowski  _et al._ [1998] K. Życzkowski, P. Horodecki, A. Sanpera, and M. Lewenstein, Volume of the set of separable states, Phys. Rev. A 58, 883 (1998).

## Appendix

##  Appendix A Generation of the hybrid entangled state

In this section we outline a process, using a setup in line with Ref. [42],
that can be used to experimentally generate a hybrid entangled (HE) state of
the form

$\ket{\psi}_{ab}=\frac{1}{\sqrt{2}}\left(\ket{0}_{a}\ket{\alpha}_{b}+\ket{1}_{a}\ket{-\alpha}_{b}\right)$
(5)

between modes $a$ and $b$, where $\ket{0}$ and $\ket{1}$ correspond to photon
number states, and $\ket{\alpha}$ is the coherent state with coherent
amplitude $\alpha$.

$\ket{n}$ and $\ket{\alpha}$ correspond to, respectively, the energy
eigenstate and coherent state of a quantized electromagnetic field, where $n$
is the number of photons in the state. It is possible to realize the energy
eigenstates as a single-photon qubit by only considering the photon number
states corresponding to $\ket{0}$ and $\ket{1}$. This is our discrete variable
(DV) system and the multiphoton coherent state is our continuous variable (CV)
system. The key idea of HE state generation hinges on conditional photon
addition and erasing the path information of photon addition. There are
several ways of achieving photon addition. This includes a model which uses
single photon sources and beam splitters (BS) and another model which uses a
parametric-down-converter (PDC) with a weak pump. Since the BS setup and the
PDC are equivalent [67], here we use the BS model for photon addition. The
following is a step-by-step description of the generation of the HE state in
Fig. $1$(b) of the main text.

Step 1: A vacuum state $\ket{0}$ in mode $a$ is mixed with a single-photon
state $\ket{1}$ in mode $c$ using a BS (BS1) with transmittivity $T$.
Similarly, a coherent state $\ket{\alpha}$ in mode $c$ is mixed with another
single-photon state in mode $d$ using another BS (BS2) with transmittivity
$T$. The output states from each of these two BSs are

$\ket{\psi}_{ac}^{\rm{BS}_{1}}=\sqrt{1-T}\ket{1}_{a}\ket{0}_{c}+\sqrt{T}\ket{0}_{a}\ket{1}_{c}~{}~{}~{}{\rm{and}}~{}~{}~{}\ket{\psi}_{bd}^{\rm{BS}_{2}}=\sqrt{1-T}\hat{b}^{\dagger}\ket{\alpha}_{b}\ket{0}_{d}+\sqrt{T}\ket{\alpha}_{b}\ket{1}_{d},$
(6)

where $\hat{b}^{\dagger}$ is the creation operator acting on mode $b$ and
$\ket{\psi}_{ac}^{\rm{BS}_{1}}$ is the output state from BS1, while
$\ket{\psi}_{bd}^{\rm{BS}_{2}}$ is the output state from BS2. The BS
transmittivity $T$ can be fine-tuned according to experimental requirements to
yield maximum probability for photon addition. Therefore, the $4$-mode state
at the output of BS1 and BS2 is

$\displaystyle\ket{\psi}_{ab,cd}^{\rm{BS}_{1},\rm{BS}_{2}}$
$\displaystyle=\sqrt{T(1-T)}\left(\ket{1}_{a}\ket{\alpha}_{b}\otimes\ket{0}_{c}\ket{1}_{d}+\ket{0}_{a}\hat{b}^{\dagger}\ket{\alpha}_{b}\otimes\ket{1}_{c}\ket{0}_{d}\right)$
$\displaystyle~{}~{}~{}~{}~{}+(1-T)\ket{1}_{a}\hat{b}^{\dagger}\ket{\alpha}_{b}\otimes\ket{0}_{c}\ket{0}_{d}+T\ket{0}_{a}\ket{\alpha}_{b}\otimes\ket{1}_{c}\ket{1}_{d}.$
(7)

Step 2: The outgoing single-photon modes (shown by gray dashed-lines in Fig.
$1$(b) of the main text) from both BS1 and BS2 are mixed with each other using
a another BS (BS3) with transmittivity $\tau$. This leads to a $4$-mode state
at the output of BS3 which can be written as

$\displaystyle\ket{\psi}_{ab,cd}^{\rm{BS}_{3}}$
$\displaystyle=\sqrt{T(1-T)}\left[\ket{1}_{a}\ket{\alpha}_{b}\otimes\Big{(}-\sqrt{1-\tau}\ket{0}_{c}\ket{1}_{d}+\sqrt{\tau}\ket{1}_{c}\ket{0}_{d}\Big{)}+\ket{0}_{a}\hat{b}^{\dagger}\ket{\alpha}_{b}\otimes\Big{(}\sqrt{1-\tau}\ket{1}_{c}\ket{0}_{d}+\sqrt{\tau}\ket{0}_{c}\ket{1}_{d}\Big{)}\right]$
$\displaystyle~{}~{}~{}+(1-T)\ket{1}_{a}\hat{b}^{\dagger}\ket{\alpha}_{b}\otimes\ket{0}_{c}\ket{0}_{d}+T\ket{0}_{a}\ket{\alpha}_{b}\otimes\Big{(}\sqrt{1-\tau}\ket{2}_{c}\ket{0}_{d}+\sqrt{\tau}\ket{0}_{c}\ket{2}_{d}\Big{)}.$
(8)

Step 3: We now detect the output modes of BS3 via single-photon detectors D1
and D2. Since the total photon number at the output of BS3 is $1$, it
indicates that both D1 and D2 cannot click simultaneously. We post-select the
state when only the detector D1 clicks and discard the runs whenever the
detector D2 clicks. After post-selection, the state between modes $a$ and $b$
is

$\ket{\psi}_{ab}^{\rm{D}_{1}}=\bra{1}_{c}\bra{0}_{d}\ket{\psi}_{ab,cd}^{\rm{BS}_{3}}=\sqrt{T(1-T)}\left(\sqrt{\tau}\ket{1}_{a}\ket{\alpha}_{b}+\sqrt{1-\tau}\ket{0}_{a}\hat{b}^{\dagger}\ket{\alpha}_{b}\right).$
(9)

We can now use the fact that $n$-photon-added coherent state is a good
approximation to another coherent state with amplified amplitude, i.e.,
$\frac{\hat{b}^{\dagger n}}{\sqrt{N}}\ket{\alpha}\approx\ket{g\alpha}$ [42],
where $N$ is the corresponding normalization constant and $g\geq 1$ is the
amplification factor. This leads to the result
$\hat{b}^{\dagger}\ket{\alpha}_{b}\approx\frac{1}{\sqrt{1-\alpha^{2}}}\ket{g\alpha}_{b}$,
where $g$ is properly chosen. Then, by setting
$\tau=\frac{1+\alpha^{2}}{2+\alpha^{2}}$ and using the approximation we get,

$\ket{\psi}_{ab}^{\rm{D}_{1}}\approx\sqrt{\frac{T(1-T)}{2+\alpha^{2}}}\Bigl{(}\ket{1}_{a}\ket{\alpha}_{b}+\ket{0}_{a}\ket{g\alpha}_{b}\Bigr{)}.$
(10)

Step 4: Next, we displace the mode $b$ by performing a displacement operator
on this mode given by
$D_{b}\left(-\frac{\alpha+g\alpha}{2}\right)=\exp\left[-\frac{\alpha+g\alpha}{2}(\hat{b}^{\dagger}-\hat{b})\right]$,
where $\hat{b}$ is the annihilation operator. This leads to the final
normalized HE state

$\ket{\psi}_{ab}=\frac{1}{\sqrt{2}}\left(\ket{0}_{a}\ket{\alpha_{f}}_{b}+\ket{1}_{a}\ket{-\alpha_{f}}_{b}\right),$
(11)

where $\alpha_{f}=\frac{(g-1)\alpha}{2}$.

##  Appendix B States after every step of the protocol

In this section we calculate the the state obtained after performing the
entanglement swapping operation by Charlie. We also calculate the states
obtained after every step of the protocol starting from the initial resource
of HE states. The steps of the protocol are detailed in the main manuscript.

###  B.1 Initial states and channel transmission

We denote the two hybrid entangled states with Alice and Bob as

$\ket{\psi}_{a_{1}a_{2}}=\frac{1}{\sqrt{2}}\left(\ket{0}_{a_{1}}\ket{\alpha}_{a_{2}}+\ket{1}_{a_{1}}\ket{-\alpha}_{a_{2}}\right)~{}~{}{\rm{and}}~{}~{}\ket{\psi}_{b_{1}b_{2}}=\frac{1}{\sqrt{2}}\left(\ket{0}_{b_{1}}\ket{\alpha}_{b_{2}}+\ket{1}_{b_{1}}\ket{-\alpha}_{b_{2}}\right),$
(12)

respectively. The initial $4$-mode resource state can be written as

$\displaystyle\ket{\psi}_{\begin{subarray}{c}a_{1}a_{2}\\\
b_{1}b_{2}\end{subarray}}$
$\displaystyle=\ket{\psi}_{a_{1}a_{2}}\ket{\psi}_{b_{1}b_{2}}$
$\displaystyle=\frac{1}{2}\left(\ket{00}_{a_{1}b_{1}}\ket{\alpha}_{a_{2}}\ket{\alpha}_{b_{2}}+\ket{11}_{a_{1}b_{1}}\ket{-\alpha}_{a_{2}}\ket{-\alpha}_{b_{2}}+\ket{01}_{a_{1}b_{1}}\ket{\alpha}_{a_{2}}\ket{-\alpha}_{b_{2}}+\ket{10}_{a_{1}b_{1}}\ket{-\alpha}_{a_{2}}\ket{\alpha}_{b_{2}}\right),$
(13)

where $\ket{ij}_{a_{1}b_{1}}=\ket{i}_{a_{1}}\ket{j}_{b_{1}}$ $\forall
i,j\in\\{0,1\\}$.

Alice and Bob both send their multiphoton part (modes $a_{2}$ and $b_{2}$) to
a third distant party Charlie for mixing and subsequent measurements through a
noisy/lossy channel with transmittivity $T$. Such channels could be modelled
in terms of an effective beam splitter (BS) with transmittivity $T$, where the
input state is fed at one of the inputs of the BS while the other input is
initialised as a vacuum state. The action of a BS with transmittivity $T$ on
the input modes is given by a unitary $U^{ab}_{T}$ implementing the following
transformation:

$\begin{pmatrix}\hat{a}\\\
\hat{b}\end{pmatrix}\rightarrow\begin{pmatrix}\hat{a}^{\prime}\\\
\hat{b}^{\prime}\end{pmatrix}=\begin{pmatrix}\sqrt{T}&\sqrt{1-T}\\\
-\sqrt{1-T}&\sqrt{T}\end{pmatrix}\begin{pmatrix}\hat{a}\\\
\hat{b}\end{pmatrix}.$ (14)

$T=\frac{1}{2}$ corresponds to a balanced ($50:50$) BS. As a consequence, the
action of the channel on a coherent state ($\ket{\alpha}$) in mode $a$ is
described as
$U^{ab}_{T}\ket{\alpha}_{a}\otimes\ket{0}_{b}\rightarrow\ket{\alpha}_{a^{{}^{\prime}}}\otimes\ket{0}_{b^{{}^{\prime}}}=\ket{\sqrt{T}\alpha}_{a}\otimes\ket{\sqrt{1-T}\alpha}_{b}$,
where $U^{ab}_{T}$ is the corresponding BS unitary operation. Subsequently,
the resultant state is obtained by tracing over the ancillary mode $b$.

Similarly, the noisy transmission of modes $a_{2}$ and $b_{2}$ could be
described by using two BSs with transmittivity $T$, each one in the paths of
modes $a_{2}$ and $b_{2}$ with ancillary modes given by $f_{a}$ and $f_{b}$,
respectively. The resultant noisy/lossy state is obtained by tracing over the
ancillary modes ($f_{a}$ and $f_{b}$). Therefore, the total input state to
Charlie before mixing is

$\displaystyle\ket{\psi}_{\begin{subarray}{c}a_{1},b_{1};a_{2}^{{}^{\prime}},b_{2}^{{}^{\prime}}\\\
f_{a}^{{}^{\prime}},f_{b}^{{}^{\prime}}\end{subarray}}=U_{T}^{(a_{2},f_{a})}\otimes
U_{T}^{(b_{2},f_{b})}\ket{\psi}_{\begin{subarray}{c}a_{1}a_{2}\\\
b_{1}b_{2}\end{subarray}}\otimes\ket{0}_{f_{a}}\ket{0}_{f_{b}}$
$\displaystyle=\frac{1}{2}\left(\ket{00}_{a_{1}b_{1}}\ket{\sqrt{1-T}\alpha}_{f_{a}}\ket{\sqrt{1-T}\alpha}_{f_{b}}\ket{\sqrt{T}\alpha}_{a_{2}}\ket{\sqrt{T}\alpha}_{b_{2}}+\ket{11}_{a_{1}b_{1}}\ket{-\sqrt{1-T}\alpha}_{f_{a}}\ket{-\sqrt{1-T}\alpha}_{f_{b}}\ket{-\sqrt{T}\alpha}_{a_{2}}\ket{-\sqrt{T}\alpha}_{b_{2}}\right.$
$\displaystyle~{}~{}~{}~{}+\left.\ket{01}_{a_{1}b_{1}}\ket{\sqrt{1-T}\alpha}_{f_{a}}\ket{-\sqrt{1-T}\alpha}_{f_{b}}\ket{\sqrt{T}\alpha}_{a_{2}}\ket{-\sqrt{T}\alpha}_{b_{2}}+\ket{10}_{a_{1}b_{1}}\ket{-\sqrt{1-T}\alpha}_{f_{a}}\ket{\sqrt{1-T}\alpha}_{f_{b}}\ket{-\sqrt{T}\alpha}_{a_{2}}\ket{\sqrt{T}\alpha}_{b_{2}}\right),$
(16)

where $U_{T}^{(a_{2},f_{a})}$ and $U_{T}^{(b_{2},f_{b})}$ are the BS unitary
operations corresponding to the respective channels with transmittivity $T$.
Charlie now mixes the incoming multiphoton modes ($a_{2}$ and $b_{2}$) through
a balanced BS ($\rm{BS}_{1}$) leading to the four mode entangled state

$\displaystyle\ket{\psi}^{\rm{BS}_{1}}_{\begin{subarray}{c}a_{1},b_{1};a_{2}^{{}^{\prime\prime}},b_{2}^{{}^{\prime\prime}}\\\
f_{a}^{{}^{\prime}},f_{b}^{{}^{\prime}}\end{subarray}}=U^{(a_{2},b_{2})}_{\rm{BS}_{1}}\ket{\psi}_{\begin{subarray}{c}a_{1},b_{1};a_{2}^{{}^{\prime}},b_{2}^{{}^{\prime}}\\\
f_{a}^{{}^{\prime}},f_{b}^{{}^{\prime}}\end{subarray}}$
$\displaystyle=\frac{1}{2}\left(\ket{00}_{a_{1}b_{1}}\ket{\sqrt{1-T}\alpha}_{f_{a}}\ket{\sqrt{1-T}\alpha}_{f_{b}}\ket{0}_{b_{2}}\ket{\sqrt{2T}\alpha}_{a_{2}}+\ket{11}_{a_{1}b_{1}}\ket{-\sqrt{1-T}\alpha}_{f_{a}}\ket{-\sqrt{1-T}\alpha}_{f_{b}}\ket{0}_{b_{2}^{{}^{\prime}}}\ket{-\sqrt{2T}\alpha}_{a_{2}}\right.$
$\displaystyle~{}~{}~{}~{}\left.+\ket{01}_{a_{1}b_{1}}\ket{\sqrt{1-T}\alpha}_{f_{a}}\ket{-\sqrt{1-T}\alpha}_{f_{b}}\ket{\sqrt{2T}\alpha}_{b_{2}}\ket{0}_{a_{2}}+\ket{10}_{a_{1}b_{1}}\ket{-\sqrt{1-T}\alpha}_{f_{a}}\ket{\sqrt{1-T}\alpha}_{f_{b}}\ket{-\sqrt{2T}\alpha}_{b_{2}}\ket{0}_{a_{2}}\right).$
(17)

It can be seen from Eq. (17) that, in the total $4$-mode entangled state after
mixing by Charlie, the vacuum state contribution in mode $a_{2}$ appears with
probability $1/2$. Our primary aim is to postselect the state (17) in
$\ket{0}_{a_{2}}$.

###  B.2 State after the on-off measurement

The additional coherent state sent be Bob to Charlie
$\left(\ket{\sqrt{2}\alpha}\right)$ becomes $\ket{\sqrt{2T}\alpha}$ as a
result of transmission through lossy channel. As is described in [42], for
this purpose Charlie first mixes the outgoing $a_{2}$ mode with this
additional state $\left(\ket{\sqrt{2T}\alpha}\right)$ in mode $c$ through the
second balanced beam splitter ($\rm{BS}_{2}$). Consequently, the state after
the mixing at $\rm{BS}_{2}$ is given by

$\displaystyle\ket{\psi}^{\rm{BS}_{2}}_{\begin{subarray}{c}a_{1},b_{1};b_{2}^{{}^{\prime\prime}}\\\
f_{a}^{{}^{\prime}},f_{b}^{{}^{\prime}}\\\
a_{2}^{{}^{\prime\prime\prime}},c^{{}^{\prime}}\end{subarray}}$
$\displaystyle=U^{(a_{2},c)}_{\rm{BS}_{1}}\ket{\psi}^{\rm{BS}_{1}}_{\begin{subarray}{c}a_{1},b_{1};a_{2}^{{}^{\prime\prime}},b_{2}^{{}^{\prime\prime}}\\\
f_{a}^{{}^{\prime}},f_{b}^{{}^{\prime}}\end{subarray}}\otimes\ket{\sqrt{2T}\alpha}_{c}$
$\displaystyle=\frac{1}{2}\left(\ket{00}_{a_{1}b_{1}}\ket{\sqrt{1-T}\alpha}_{f_{a}}\ket{\sqrt{1-T}\alpha}_{f_{b}}\ket{0}_{b_{2}}\ket{2\sqrt{T}\alpha}_{a_{2}}\ket{0}_{c}\right.$
$\displaystyle~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}+\left.\ket{11}_{a_{1}b_{1}}\ket{-\sqrt{1-T}\alpha}_{f_{a}}\ket{-\sqrt{1-T}\alpha}_{f_{b}}\ket{0}_{b_{2}}\ket{0}_{a_{2}}\ket{-2\sqrt{T}\alpha}_{c}\right.$
$\displaystyle~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}+\left.\ket{01}_{a_{1}b_{1}}\ket{\sqrt{1-T}\alpha}_{f_{a}}\ket{-\sqrt{1-T}\alpha}_{f_{b}}\ket{\sqrt{2T}\alpha}_{b_{2}}\ket{\sqrt{T}\alpha}_{a_{2}}\ket{-\sqrt{T}\alpha}_{c}\right.$
$\displaystyle~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}+\left.\ket{10}_{a_{1}b_{1}}\ket{-\sqrt{1-T}\alpha}_{f_{a}}\ket{\sqrt{1-T}\alpha}_{f_{b}}\ket{-\sqrt{2T}\alpha}_{b_{2}}\ket{\sqrt{T}\alpha}_{a_{2}}\ket{-\sqrt{T}\alpha}_{c}\right).$
(18)

As it can be seen from Eq. (18), if both the detectors at the output of
$\rm{BS}_{2}$ click then the contribution can arise only from the respective
part in (18), i.e., from the part containing $\ket{0}_{a_{2}}$.
Experimentally, this could be achieved unambiguously by performing the
operation
$\Pi_{0}=(\mathbf{I}-\ket{0}\bra{0})\otimes(\mathbf{I}-\ket{0}\bra{0})$ on
(18) using two on-off detectors at both the output ports of $\rm{BS}_{2}$.

However, here we consider non-ideal detectors with efficiency $\eta_{o}$
($0\leq\eta_{o}\leq 1$). Similar to the case of transmission channels, this
could be analysed by considering two additional BS with transmittivity
$\eta_{o}$ and two ancillary modes $g_{a}$ and $g_{c}$ for modes $a_{2}$ and
$c$, respectively. Therefore, before the on-off detectors, the total state is
given by

$\displaystyle\ket{\psi}^{tot}_{\begin{subarray}{c}a_{1},b_{1};b_{2}^{{}^{\prime\prime}}\\\
f_{a}^{{}^{\prime}},f_{b}^{{}^{\prime}},g_{a}^{{}^{\prime}},g_{c}^{{}^{\prime}}\\\
a_{2}^{{}^{\prime\prime\prime\prime}},c^{{}^{\prime\prime}}\end{subarray}}=U^{(a_{2},g_{a})}_{\eta_{o}}\otimes
U^{(c,g_{c})}_{\eta_{o}}\ket{\psi}^{\rm{BS}_{2}}_{\begin{subarray}{c}a_{1},b_{1};b_{2}^{{}^{\prime\prime}}\\\
f_{a}^{{}^{\prime}},f_{b}^{{}^{\prime}}\\\
a_{2}^{{}^{\prime\prime\prime}},c^{{}^{\prime}}\end{subarray}}\otimes\ket{0}_{g_{a}}\ket{0}_{g_{c}}$
$\displaystyle=\frac{1}{2}\left[\ket{00}_{a_{1}b_{1}}\ket{0}_{b_{2}^{{}^{\prime\prime}}}\ket{\sqrt{1-T}\alpha}_{f_{a}}\ket{\sqrt{1-T}\alpha}_{f_{b}}\ket{2\sqrt{T(1-\eta_{o})}\alpha}_{g_{a}}\ket{0}_{g_{c}}\ket{2\sqrt{T\eta_{o}}\alpha}_{a_{2}}\ket{0}_{c}\right.$
$\displaystyle~{}~{}~{}~{}+\left.\ket{11}_{a_{1}b_{1}}\ket{0}_{b_{2}}\ket{-\sqrt{1-T}\alpha}_{f_{a}}\ket{-\sqrt{1-T}\alpha}_{f_{b}}\ket{0}_{g_{a}}\ket{-2\sqrt{T(1-\eta_{o})}\alpha}_{g_{c}}\ket{0}_{a_{2}}\ket{-2\sqrt{T\eta_{o}}\alpha}_{c}\right.$
$\displaystyle~{}~{}~{}~{}+\left(\ket{01}_{a_{1}b_{1}}\ket{\sqrt{2T}\alpha}_{b_{2}}\ket{\sqrt{1-T}\alpha}_{f_{a}}\ket{-\sqrt{1-T}\alpha}_{f_{b}}+\ket{10}_{a_{1}b_{1}}\ket{-\sqrt{2T}\alpha}_{b_{2}}\ket{-\sqrt{1-T}\alpha}_{f_{a}}\ket{\sqrt{1-T}\alpha}_{f_{b}}\right)$
$\displaystyle~{}~{}~{}~{}\left.\ket{\sqrt{T(1-\eta_{o})}\alpha}_{g_{a}}\ket{-\sqrt{T(1-\eta_{o})}\alpha}_{g_{c}}\ket{\sqrt{T\eta_{0}}\alpha}_{a_{2}}\ket{-\sqrt{T\eta_{o}}\alpha}_{c}\right]$
$\displaystyle=\frac{1}{2}\left[\ket{00}_{a_{1}b_{1}}\ket{0}_{b_{2}}\ket{\sqrt{T^{\prime}}\alpha}_{f_{a}}\ket{\sqrt{T^{\prime}}\alpha}_{f_{b}}\ket{2\sqrt{T\eta_{o}^{\prime}}\alpha}_{g_{a}}\ket{0}_{g_{c}}\ket{2\sqrt{T\eta_{o}}\alpha}_{a_{2}}\ket{0}_{c}\right.$
$\displaystyle~{}~{}~{}~{}+\left.\ket{11}_{a_{1}b_{1}}\ket{0}_{b_{2}}\ket{-\sqrt{T^{\prime}}\alpha}_{f_{a}}\ket{-\sqrt{T^{\prime}}\alpha}_{f_{b}}\ket{0}_{g_{a}}\ket{-2\sqrt{T\eta_{o}^{\prime}}\alpha}_{g_{c}}\ket{0}_{a_{2}}\ket{-2\sqrt{T\eta_{o}}\alpha}_{c}\right.$
$\displaystyle~{}~{}~{}~{}+\left(\ket{01}_{a_{1}b_{1}}\ket{\sqrt{2T}\alpha}_{b_{2}}\ket{\sqrt{T^{\prime}}\alpha}_{f_{a}}\ket{-\sqrt{T^{\prime}}\alpha}_{f_{b}}~{}+~{}\ket{10}_{a_{1}b_{1}}\ket{-\sqrt{2T}\alpha}_{b_{2}}\ket{-\sqrt{T^{\prime}}\alpha}_{f_{a}}\ket{\sqrt{T^{\prime}}\alpha}_{f_{b}}\right)$
$\displaystyle~{}~{}~{}~{}\left.\ket{\sqrt{T\eta_{o}^{\prime}}\alpha}_{g_{a}}\ket{-\sqrt{T\eta_{o}^{\prime}}\alpha}_{g_{c}}\ket{\sqrt{T\eta_{0}}\alpha}_{a_{2}}\ket{-\sqrt{T\eta_{o}}\alpha}_{c}\right],$
(19)

where $T^{\prime}=1-T$ and $\eta_{o}^{\prime}=1-\eta_{o}$.

Charlie is now supposed to make the measurement of
$\Pi_{0}^{a_{2},c}=(\mathds{1}-\ket{0}\bra{0})_{a_{2}}\otimes(\mathds{1}-\ket{0}\bra{0})_{c}$
on the state in Eq. (19). After the measurement of these operators ($\Pi_{0}$)
the total state collapses to
$\rho_{a_{1},b_{1};b_{2}}^{0}={\rm{tr}}_{\begin{subarray}{c}f_{a},f_{b}\\\
g_{a},g_{c}\\\
a_{2},c\end{subarray}}\Big{(}\ket{\psi_{0}}\bra{\psi_{0}}\Big{)}/N_{0}$, where
$\ket{\psi_{0}}=\Pi_{0}^{a_{2},c}\ket{\psi}^{tot}_{\begin{subarray}{c}a_{1},b_{1};b_{2}^{{}^{\prime\prime}}\\\
f_{a}^{{}^{\prime}},f_{b}^{{}^{\prime}},g_{a}^{{}^{\prime}},g_{c}^{{}^{\prime}}\\\
a_{2}^{{}^{\prime\prime\prime\prime}},c^{{}^{\prime\prime}}\end{subarray}}$
and the normalization constants are
$N_{0}={\rm{tr}}_{\begin{subarray}{c}a_{1},b_{1},a_{2},b_{2},c\\\
f_{a},f_{b},g_{a},g_{c}\end{subarray}}\Big{(}\ket{\psi_{0}}\bra{\psi_{0}}\Big{)}$.
It must be noted that the state $\rho_{a_{1},b_{1};b_{2}}^{0}$ is obtained
with probability $P_{0}={\rm{tr}}_{\begin{subarray}{c}a_{1},b_{1}\\\
b_{2}\end{subarray}}\left(\rho_{a_{1},b_{1};b_{2}}^{0}\right)$.

Let us look at the result first

$\displaystyle\Pi_{0}^{a_{2},c}\ket{\alpha}_{a_{2}}\ket{\beta}_{c}$
$\displaystyle=\Big{(}\mathds{1}_{a_{2}}\otimes\mathds{1}_{c}-\ket{0}_{a_{2}}\bra{0}\otimes\mathds{1}_{c}-\mathds{1}_{a_{2}}\otimes\ket{0}_{c}\bra{0}+\ket{0}_{a_{2}}\bra{0}\otimes\ket{0}_{c}\bra{0}\Big{)}\ket{\alpha}_{a_{2}}\ket{\beta}_{c}$
$\displaystyle=\ket{\alpha}_{a_{2}}\ket{\beta}_{c}-e^{-\alpha^{2}/2}\ket{0}_{a_{2}}\ket{\beta}_{c}-e^{-\beta^{2}/2}\ket{\alpha}_{a_{2}}\ket{0}_{c}+e^{-(\alpha^{2}+\beta^{2})/2}\ket{0}_{a_{2}}\ket{0}_{c}.$
(20)

This leads to the results

$\displaystyle\Pi_{0}^{a_{2},c}\ket{\alpha}_{a_{2}}\ket{0}_{c}$
$\displaystyle=\Pi_{0}^{a_{2},c}\ket{0}_{a_{2}}\ket{\alpha}_{c}=\rm{null}~{}~{}{\rm{and}}~{}~{}$
$\displaystyle\Pi_{0}^{a_{2},c}\ket{\alpha}_{a_{2}}\ket{-\alpha}_{c}$
$\displaystyle=\ket{\alpha}_{a_{2}}\ket{-\alpha}_{c}-e^{-\alpha^{2}/2}\ket{0}_{a_{2}}\ket{-\alpha}_{c}-e^{-\alpha^{2}/2}\ket{\alpha}_{a_{2}}\ket{0}_{c}+e^{-\alpha^{2}}\ket{0}_{a_{2}}\ket{0}_{c}.$
(21)

Now, deploying the results of Eq. (21) in Eq. (19), we obtain

$\displaystyle\ket{\psi_{0}}=\Pi_{0}^{a_{2},c}\ket{\psi}^{tot}_{\begin{subarray}{c}a_{1},b_{1};b_{2}^{{}^{\prime\prime}}\\\
f_{a}^{{}^{\prime}},f_{b}^{{}^{\prime}},g_{a}^{{}^{\prime}},g_{c}^{{}^{\prime}}\\\
a_{2}^{{}^{\prime\prime\prime\prime}},c^{{}^{\prime\prime}}\end{subarray}}$
$\displaystyle=\frac{1}{2}\left[\ket{00}_{a_{1}b_{1}}\ket{0}_{b_{2}}\ket{\sqrt{T^{\prime}}\alpha}_{f_{a}}\ket{\sqrt{T^{\prime}}\alpha}_{f_{b}}\otimes\ket{2\sqrt{T\eta_{o}^{\prime}}\alpha}_{g_{a}}\ket{0}_{g_{c}}\times\rm{null}\right.$
$\displaystyle~{}~{}~{}~{}+\left.\ket{11}_{a_{1}b_{1}}\ket{0}_{b_{2}}\ket{-\sqrt{T^{\prime}}\alpha}_{f_{a}}\ket{-\sqrt{T^{\prime}}\alpha}_{f_{b}}\otimes\ket{0}_{g_{a}}\ket{-2\sqrt{T\eta_{o}^{\prime}}\alpha}_{g_{c}}\times\rm{null}\right.$
$\displaystyle~{}~{}~{}~{}+\left(\ket{01}_{a_{1}b_{1}}\ket{\sqrt{2T}\alpha}_{b_{2}}\ket{\sqrt{T^{\prime}}\alpha}_{f_{a}}\ket{-\sqrt{T^{\prime}}\alpha}_{f_{b}}+\ket{10}_{a_{1}b_{1}}\ket{-\sqrt{2T}\alpha}_{b_{2}}\ket{-\sqrt{T^{\prime}}\alpha}_{f_{a}}\ket{\sqrt{T^{\prime}}\alpha}_{f_{b}}\right)\otimes\ket{\sqrt{T\eta_{o}^{\prime}}\alpha}_{g_{a}}\ket{-\sqrt{T\eta_{o}^{\prime}}\alpha}_{g_{c}}\otimes$
$\displaystyle~{}~{}~{}~{}\left.\left(\ket{\sqrt{\eta_{o}T}\alpha}_{a_{2}}\ket{-\sqrt{\eta_{o}T}\alpha}_{c}-e^{-\eta_{o}T\alpha^{2}/2}\ket{0}_{a_{2}}\ket{-\sqrt{\eta_{o}T}\alpha}_{c}-e^{-\eta_{o}T\alpha^{2}/2}\ket{\sqrt{\eta_{o}T}\alpha}_{a_{2}}\ket{0}_{c}+e^{-\eta_{o}T\alpha^{2}}\ket{0}_{a_{2}}\ket{0}_{c}\right)\right]$
$\displaystyle=\frac{1}{2}\left(\ket{01}_{a_{1}b_{1}}\ket{\sqrt{2T}\alpha}_{b_{2}}\ket{\sqrt{T^{\prime}}\alpha}_{f_{a}}\ket{-\sqrt{T^{\prime}}\alpha}_{f_{b}}+\ket{10}_{a_{1}b_{1}}\ket{-\sqrt{2T}\alpha}_{b_{2}}\ket{-\sqrt{T^{\prime}}\alpha}_{f_{a}}\ket{\sqrt{T^{\prime}}\alpha}_{f_{b}}\right)\otimes$
$\displaystyle~{}~{}~{}~{}\ket{\sqrt{T\eta_{o}^{\prime}}\alpha}_{g_{a}}\ket{-\sqrt{T\eta_{o}^{\prime}}\alpha}_{g_{c}}\otimes\ket{\Psi}_{a_{2}c},$
(22)

where

$\ket{\Psi}_{a_{2}c}=\ket{\sqrt{\eta_{o}T}\alpha}_{a_{2}}\ket{-\sqrt{\eta_{o}T}\alpha}_{c}-e^{-\eta_{o}T\alpha^{2}/2}\ket{0}_{a_{2}}\ket{-\sqrt{\eta_{o}T}\alpha}_{c}-e^{-\eta_{o}T\alpha^{2}/2}\ket{\sqrt{\eta_{o}T}\alpha}_{a_{2}}\ket{0}_{c}+e^{-\eta_{o}T\alpha^{2}}\ket{0}_{a_{2}}\ket{0}_{c}.$
(23)

Now, it can be shown that

$\displaystyle{\rm{tr}}\Big{(}\ket{\Psi}_{a_{2}c}\bra{\Psi}\Big{)}={\rm{tr}}\left[\left(\bra{\sqrt{\eta_{o}T}\alpha}\ket{\sqrt{\eta_{o}T}\alpha}_{a_{2}}\bra{-\sqrt{\eta_{o}T}\alpha}\ket{-\sqrt{\eta_{o}T}\alpha}_{c}+e^{-\eta_{o}T\alpha^{2}}\bra{0}\ket{0}_{a_{2}}\bra{-\sqrt{\eta_{o}T}\alpha}\ket{-\sqrt{\eta_{o}T}\alpha}_{c}\right.\right.$
$\displaystyle~{}~{}~{}~{}+\left.\left.e^{-\eta_{o}T\alpha^{2}}\bra{\sqrt{\eta_{o}T}\alpha}\ket{\sqrt{\eta_{o}T}\alpha}_{a_{2}}\bra{0}\ket{0}_{c}+e^{-2\eta_{o}T\alpha^{2}}\bra{0}\ket{0}_{a_{2}}\bra{0}\ket{0}_{c}\right)\right.$
$\displaystyle~{}~{}~{}~{}+2\left(-e^{-\eta_{o}T\alpha^{2}/2}\bra{0}\ket{\sqrt{\eta_{o}T}\alpha}_{a_{2}}\bra{-\sqrt{\eta_{o}T}\alpha}\ket{-\sqrt{\eta_{o}T}\alpha}_{c}-e^{-\eta_{o}T\alpha^{2}/2}\bra{\sqrt{\eta_{o}T}\alpha}\ket{\sqrt{\eta_{o}T}\alpha}_{a_{2}}\bra{0}\ket{-\sqrt{\eta_{o}T}\alpha}_{c}\right.$
$\displaystyle~{}~{}~{}~{}+\left.e^{-\eta_{o}T\alpha^{2}}\bra{0}\ket{\sqrt{\eta_{o}T}\alpha}_{a_{2}}\bra{0}\ket{-\sqrt{\eta_{o}T}\alpha}_{c}\right)~{}+~{}2\left(e^{-\eta_{o}T\alpha^{2}}\bra{\sqrt{\eta_{o}T}\alpha}\ket{0}_{a_{2}}\bra{0}\ket{-\sqrt{\eta_{o}T}\alpha}_{c}\right.$
$\displaystyle\left.~{}~{}~{}~{}-e^{-3\eta_{o}T\alpha^{2}/2}\bra{0}\ket{0}_{a_{2}}\bra{0}\ket{-\sqrt{\eta_{o}T}\alpha}_{c}\right)~{}-~{}2\left.e^{-3\eta_{o}T\alpha^{2}/2}\bra{0}\ket{\sqrt{\eta_{o}T}\alpha}_{a_{2}}\bra{0}\ket{0}_{c}\right]$
$\displaystyle=\left(1+e^{-\eta_{o}T\alpha^{2}}+e^{-\eta_{o}T\alpha^{2}}+e^{-2\eta_{o}T\alpha^{2}}\right)+2\left(-e^{-\eta_{o}T\alpha^{2}}-e^{-\eta_{o}T\alpha^{2}}+e^{-2\eta_{o}T\alpha^{2}}\right)+2\left(e^{-2\eta_{o}T\alpha^{2}}-e^{-2\eta_{o}T\alpha^{2}}\right)-2e^{-2\eta_{o}T\alpha^{2}}$
$\displaystyle=1-2e^{-\eta_{o}T\alpha^{2}}+e^{-2\eta_{o}T\alpha^{2}}=\left(1-e^{-\eta_{o}T\alpha^{2}}\right)^{2}.$
(24)

Hence,

$\displaystyle{\rm{tr}}_{\begin{subarray}{c}f_{a},f_{b}\\\ g_{a},g_{c}\\\
a_{2},c\end{subarray}}\Big{(}\ket{\psi_{0}}\bra{\psi_{0}}\Big{)}$
$\displaystyle=\frac{\left(1-e^{-\eta_{o}T\alpha^{2}}\right)^{2}}{4}{\rm{tr}}_{f_{a},f_{b}}\left[\left(\ket{01}_{a_{1}b_{1}}\bra{01}\otimes\ket{\sqrt{2T}\alpha}_{b_{2}}\bra{\sqrt{2T}\alpha}\otimes\ket{\sqrt{T^{\prime}}\alpha}_{f_{a}}\bra{\sqrt{T^{\prime}}\alpha}\otimes\ket{-\sqrt{T^{\prime}}\alpha}_{f_{b}}\bra{-\sqrt{T^{\prime}}\alpha}\right.\right.$
$\displaystyle~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}+\ket{10}_{a_{1}b_{1}}\bra{10}\otimes\ket{-\sqrt{2T}\alpha}_{b_{2}}\bra{-\sqrt{2T}\alpha}\otimes\ket{-\sqrt{T^{\prime}}\alpha}_{f_{a}}\bra{-\sqrt{T^{\prime}}\alpha}\otimes\ket{\sqrt{T^{\prime}}\alpha}_{f_{b}}\bra{\sqrt{T^{\prime}}\alpha}$
$\displaystyle~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}+\ket{01}_{a_{1}b_{1}}\bra{10}\otimes\ket{\sqrt{2T}\alpha}_{b_{2}}\bra{-\sqrt{2T}\alpha}\otimes\ket{\sqrt{T^{\prime}}\alpha}_{f_{a}}\bra{-\sqrt{T^{\prime}}\alpha}\otimes\ket{-\sqrt{T^{\prime}}\alpha}_{f_{b}}\bra{\sqrt{T^{\prime}}\alpha}$
$\displaystyle~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}+\left.\left.\ket{10}_{a_{1}b_{1}}\bra{01}\otimes\ket{-\sqrt{2T}\alpha}_{b_{2}}\bra{\sqrt{2T}\alpha}\otimes\ket{-\sqrt{T^{\prime}}\alpha}_{f_{a}}\bra{\sqrt{T^{\prime}}\alpha}\otimes\ket{\sqrt{T^{\prime}}\alpha}_{f_{b}}\bra{-\sqrt{T^{\prime}}\alpha}\right)\right]$
$\displaystyle~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}{\rm{tr}}_{g_{a},g_{c}}\left[\ket{\sqrt{T\eta_{o}^{\prime}}\alpha}_{g_{a}}\bra{\sqrt{T\eta_{o}^{\prime}}\alpha}\otimes\ket{-\sqrt{T\eta_{o}^{\prime}}\alpha}_{g_{c}}\bra{-\sqrt{T\eta_{o}^{\prime}}\alpha}\right]$
$\displaystyle=\frac{\left(1-e^{-\eta_{o}T\alpha^{2}}\right)^{2}}{4}\left[\ket{01}_{a_{1}b_{1}}\bra{01}\otimes\ket{\sqrt{2T}\alpha}_{b_{2}}\bra{\sqrt{2T}\alpha}+\ket{10}_{a_{1}b_{1}}\bra{10}\otimes\ket{-\sqrt{2T}\alpha}_{b_{2}}\bra{-\sqrt{2T}\alpha}\right.$
$\displaystyle~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}+\left.\left(\ket{01}_{a_{1}b_{1}}\bra{10}\otimes\ket{\sqrt{2T}\alpha}_{b_{2}}\bra{-\sqrt{2T}\alpha}+\ket{10}_{a_{1}b_{1}}\bra{01}\otimes\ket{-\sqrt{2T}\alpha}_{b_{2}}\bra{\sqrt{2T}\alpha}\right)e^{-4(1-T)\alpha^{2}}\right],$
(25)

where ${\rm{tr}}\Big{(}\ket{\alpha}\bra{-\alpha}\Big{)}=e^{-2\alpha^{2}}$. The
corresponding probability and normalization constant are

$p_{0}=N_{0}={\rm{tr}}_{\begin{subarray}{c}a_{1},b_{1}\\\
b_{2}\end{subarray}}\left[{\rm{tr}}_{\begin{subarray}{c}f_{a},f_{b}\\\
g_{a},g_{c}\\\
a_{2},c\end{subarray}}\Big{(}\ket{\psi_{0}}\bra{\psi_{0}}\Big{)}\right]=\frac{\left(1-e^{-\eta_{o}T\alpha^{2}}\right)^{2}}{2}.$
(26)

This leads to the normalized state

$\displaystyle\rho^{0}_{a_{1},b_{1},b_{2}}=\frac{1}{N_{0}}{\rm{tr}}_{\begin{subarray}{c}f_{a},f_{b}\\\
g_{a},g_{c}\\\
a_{2},c\end{subarray}}\Big{(}\ket{\psi_{0}}\bra{\psi_{0}}\Big{)}$
$\displaystyle=\frac{1}{2}\left[\ket{01}_{a_{1}b_{1}}\bra{01}\otimes\ket{\sqrt{2T}\alpha}_{b_{2}}\bra{\sqrt{2T}\alpha}+\ket{10}_{a_{1}b_{1}}\bra{10}\otimes\ket{-\sqrt{2T}\alpha}_{b_{2}}\bra{-\sqrt{2T}\alpha}\right.$
$\displaystyle~{}~{}~{}~{}~{}~{}~{}+\left.\left(\ket{01}_{a_{1}b_{1}}\bra{10}\otimes\ket{\sqrt{2T}\alpha}_{b_{2}}\bra{-\sqrt{2T}\alpha}+\ket{10}_{a_{1}b_{1}}\bra{01}\otimes\ket{-\sqrt{2T}\alpha}_{b_{2}}\bra{\sqrt{2T}\alpha}\right)e^{-4(1-T)\alpha^{2}}\right].$
(27)

###  B.3 State after the homodyne measurement

Charlie now performs the homodyne measurement along the quadrature
$X_{\theta}$ on mode $b_{2}$. Here also we consider that that the homodyne
instruments are not perfect. Rather the efficiency of the homodyne detector is
given by $\eta_{h}$. Similar to the earlier cases here also the imperfect
homodyne detector could be modeled as a passive beam splitter with
transmittivity $\eta_{h}$. Now the action of the imperfect homodyne
measurement along quadrature $X_{\theta}$ will lead to the resultant
unnormalized state
$\rho_{\rm{un}}^{\rm{hom},0}=\bra{X_{\theta}}_{b_{2}}{\rm{tr}}_{h_{b}}\left[\left(U_{\eta_{h}}^{h_{b},b_{2}}\right)\rho_{a_{1},b_{1};b_{2}}^{0}\otimes\ket{0}_{h_{b}}\bra{0}\left(U_{\eta_{h}}^{h_{b},b_{2}}\right)^{\dagger}\right]\ket{X_{\theta}}_{b_{2}}$
with normalization
$N_{0}^{\rm{hom}}={\rm{tr}}_{a_{1},b_{1}}\left(\rho_{\rm{un}}^{\rm{hom},0}\right)$,
where $X_{\theta}$ in a mode $a$ is defined as
$X_{\theta}=(ae^{\mathsf{i}\theta}+a^{\dagger}e^{-\mathsf{i}\theta})/2$ and
with the eigenvalue equation as $X_{\theta}$ defined as
$X_{\theta}\ket{X_{\theta}}=x_{\theta}\ket{X_{\theta}}$.

Thus, after the homodyne measurement by Charlie, the residual normalized state
between Alice and Bob will be

$\rho_{a_{1},b_{1}}=p_{0}\frac{\rho_{\rm{un}}^{\rm{hom},0}}{N_{0}^{\rm{hom}}}=p_{0}\rho_{a_{1},b_{1}}^{\rm{hom},0}.$
(28)

In this work we consider the measurement of quadrature operator for the choice
of $\theta=\frac{\pi}{2}$, i.e., we consider the momentum-like quadrature
operator $P$. Now the measurement of $P$ for a coherent state $\ket{\alpha}$
is
$\bra{P}\ket{\alpha}=\frac{1}{\pi^{1/4}}e^{-p^{2}/2}e^{-\alpha^{2}-\mathsf{i}\sqrt{2}\alpha
p}$.

$\displaystyle{\rm{tr}}_{h_{b}}\left[\left(U_{\eta_{h}}^{h_{b},b_{2}}\right)\rho_{a_{1},b_{1};b_{2}}^{0}\otimes\ket{0}_{h_{b}}\bra{0}\left(U_{\eta_{h}}^{h_{b},b_{2}}\right)^{\dagger}\right]$
$\displaystyle=\frac{1}{2}{\rm{tr}}_{h_{b}}\left\\{\left(U_{\eta_{h}}^{h_{b},b_{2}}\right)\left[\ket{01}_{a_{1}b_{1}}\bra{01}\otimes\ket{\sqrt{2T}\alpha}_{b_{2}}\bra{\sqrt{2T}\alpha}+\ket{10}_{a_{1}b_{1}}\bra{10}\otimes\ket{-\sqrt{2T}\alpha}_{b_{2}}\bra{-\sqrt{2T}\alpha}\right.\right.$
$\displaystyle~{}~{}~{}~{}~{}+\left.\left.\left(\ket{01}_{a_{1}b_{1}}\bra{10}\otimes\ket{\sqrt{2T}\alpha}_{b_{2}}\bra{-\sqrt{2T}\alpha}+\ket{10}_{a_{1}b_{1}}\bra{01}\otimes\ket{-\sqrt{2T}\alpha}_{b_{2}}\bra{\sqrt{2T}\alpha}\right)e^{-4(1-T)\alpha^{2}}\right]\otimes\ket{0}_{h_{b}}\bra{0}\left(U_{\eta_{h}}^{h_{b},b_{2}}\right)^{\dagger}\right\\}$
$\displaystyle=\frac{1}{2}{\rm{tr}}_{h_{b}}\left[\ket{01}_{a_{1}b_{1}}\bra{01}\otimes\ket{\sqrt{2T\eta_{h}}\alpha}_{b_{2}}\bra{\sqrt{2T\eta_{h}}\alpha}\otimes\ket{\sqrt{2T\eta_{h}^{\prime}}\alpha}_{h_{b}}\bra{\sqrt{2T\eta_{h}^{\prime}}\alpha}\right.$
$\displaystyle~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}+\left.\ket{10}_{a_{1}b_{1}}\bra{10}\otimes\ket{-\sqrt{2T\eta_{h}}\alpha}_{b_{2}}\bra{-\sqrt{2T\eta_{h}}\alpha}\otimes\ket{-\sqrt{2T\eta_{h}^{\prime}}\alpha}_{h_{b}}\bra{-\sqrt{2T\eta_{h}^{\prime}}\alpha}\right.$
$\displaystyle~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}+\left(\ket{01}_{a_{1}b_{1}}\bra{10}\otimes\ket{\sqrt{2T\eta_{h}}\alpha}_{b_{2}}\bra{-\sqrt{2T\eta_{h}}\alpha}\otimes\ket{\sqrt{2T\eta_{h}^{\prime}}\alpha}_{h_{b}}\bra{-\sqrt{2T\eta_{h}^{\prime}}\alpha}\right.$
$\displaystyle~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}+\left.\left.\ket{10}_{a_{1}b_{1}}\bra{01}\otimes\ket{-\sqrt{2T\eta_{h}}\alpha}_{b_{2}}\bra{\sqrt{2T\eta_{h}}\alpha}\otimes\ket{-\sqrt{2T\eta_{h}^{\prime}}\alpha}_{h_{b}}\bra{\sqrt{2T\eta_{h}^{\prime}}\alpha}\right)e^{-4(1-T)\alpha^{2}}\right]$
$\displaystyle=\frac{1}{2}\left[\ket{01}_{a_{1}b_{1}}\bra{01}\otimes\ket{\sqrt{2T\eta_{h}}\alpha}_{b_{2}}\bra{\sqrt{2T\eta_{h}}\alpha}+\ket{10}_{a_{1}b_{1}}\bra{10}\otimes\ket{-\sqrt{2T\eta_{h}}\alpha}_{b_{2}}\bra{-\sqrt{2T\eta_{h}}\alpha}\right.$
$\displaystyle~{}~{}~{}+\left.\left(\ket{01}_{a_{1}b_{1}}\bra{10}\otimes\ket{\sqrt{2T\eta_{h}}\alpha}_{b_{2}}\bra{-\sqrt{2T\eta_{h}}\alpha}+\ket{10}_{a_{1}b_{1}}\bra{01}\otimes\ket{-\sqrt{2T\eta_{h}}\alpha}_{b_{2}}\bra{\sqrt{2T\eta_{h}}\alpha}\right)e^{-4T(1-\eta_{h}^{\prime})\alpha^{2}}e^{-4(1-T)\alpha^{2}}\right]$
$\displaystyle=\frac{1}{2}\left[\ket{01}_{a_{1}b_{1}}\bra{01}\otimes\ket{\sqrt{2T\eta_{h}}\alpha}_{b_{2}}\bra{\sqrt{2T\eta_{h}}\alpha}+\ket{10}_{a_{1}b_{1}}\bra{10}\otimes\ket{-\sqrt{2T\eta_{h}}\alpha}_{b_{2}}\bra{-\sqrt{2T\eta_{h}}\alpha}\right.$
$\displaystyle~{}~{}~{}+\left.\left(\ket{01}_{a_{1}b_{1}}\bra{10}\otimes\ket{\sqrt{2T\eta_{h}}\alpha}_{b_{2}}\bra{-\sqrt{2T\eta_{h}}\alpha}+\ket{10}_{a_{1}b_{1}}\bra{01}\otimes\ket{-\sqrt{2T\eta_{h}}\alpha}_{b_{2}}\bra{\sqrt{2T\eta_{h}}\alpha}\right)e^{-4(1-T\eta_{h})\alpha^{2}}\right],$
(29)

which leads to

$\displaystyle\rho_{\rm{un}}^{\rm{hom},0}=\bra{P}_{b_{2}}{\rm{tr}}_{h_{b}}\left[\left(U_{\eta_{h}}^{h_{b},b_{2}}\right)\rho_{a_{1},b_{1};b_{2}}^{0}\otimes\ket{0}_{h_{b}}\bra{0}\left(U_{\eta_{h}}^{h_{b},b_{2}}\right)^{\dagger}\right]\ket{P}_{b_{2}}$
$\displaystyle=\frac{1}{2}\bra{P}_{b_{2}}\left[\ket{01}_{a_{1}b_{1}}\bra{01}\otimes\ket{\sqrt{2T\eta_{h}}\alpha}_{b_{2}}\bra{\sqrt{2T\eta_{h}}\alpha}+\ket{10}_{a_{1}b_{1}}\bra{10}\otimes\ket{-\sqrt{2T\eta_{h}}\alpha}_{b_{2}}\bra{-\sqrt{2T\eta_{h}}\alpha}\right.$
$\displaystyle~{}~{}~{}+\left.\left(\ket{01}_{a_{1}b_{1}}\bra{10}\otimes\ket{\sqrt{2T\eta_{h}}\alpha}_{b_{2}}\bra{-\sqrt{2T\eta_{h}}\alpha}+\ket{10}_{a_{1}b_{1}}\bra{01}\otimes\ket{-\sqrt{2T\eta_{h}}\alpha}_{b_{2}}\bra{\sqrt{2T\eta_{h}}\alpha}\right)e^{-4(1-T\eta_{h})\alpha^{2}}\right]\ket{P}_{b_{2}}$
$\displaystyle=\frac{e^{-p^{2}}}{2\sqrt{\pi}}\left[\ket{01}_{a_{1}b_{1}}\bra{01}e^{-4T\eta_{h}\alpha^{2}}+\ket{10}_{a_{1}b_{1}}\bra{10}e^{-4T\eta_{h}\alpha^{2}}\right.$
$\displaystyle~{}~{}~{}~{}~{}~{}~{}~{}~{}+\left.\left(\ket{01}_{a_{1}b_{1}}\bra{10}e^{-4T\eta_{h}\alpha^{2}-4\mathsf{i}\sqrt{T\eta_{h}}\alpha
p}+\ket{10}_{a_{1}b_{1}}\bra{01}e^{-4T\eta_{h}\alpha^{2}+4\mathsf{i}\sqrt{T\eta_{h}}\alpha
p}\right)e^{-4(1-T\eta_{h})\alpha^{2}}\right]$
$\displaystyle=\frac{e^{-p^{2}}e^{-4T\eta_{h}\alpha^{2}}}{2\sqrt{\pi}}\left[\ket{01}_{a_{1}b_{1}}\bra{01}+\ket{10}_{a_{1}b_{1}}\bra{10}+\left(\ket{01}_{a_{1}b_{1}}\bra{10}e^{-4\mathsf{i}\sqrt{T\eta_{h}}\alpha
p}+\ket{10}_{a_{1}b_{1}}\bra{01}e^{4\mathsf{i}\sqrt{T\eta_{h}}\alpha
p}\right)e^{-4(1-T\eta_{h})\alpha^{2}}\right],$ (30)

with
$N_{0}^{\rm{hom}}={\rm{tr}}_{a_{1},b_{1}}\left(\rho_{\rm{un}}^{\rm{hom},0}\right)=\frac{e^{-p^{2}}e^{-4T\eta_{h}\alpha^{2}}}{\sqrt{\pi}}$.
Therefore,

$\displaystyle\rho_{a_{1},b_{1}}^{\rm{hom},0}$
$\displaystyle=\frac{\rho_{\rm{un}}^{\rm{hom},0}}{N_{0}^{\rm{hom}}}$
$\displaystyle=\frac{1}{2}\left[\ket{01}_{a_{1}b_{1}}\bra{01}+\ket{10}_{a_{1}b_{1}}\bra{10}+\left(\ket{01}_{a_{1}b_{1}}\bra{10}e^{-4\mathsf{i}\sqrt{T\eta_{h}}\alpha
p}+\ket{10}_{a_{1}b_{1}}\bra{01}e^{4\mathsf{i}\sqrt{T\eta_{h}}\alpha
p}\right)e^{-4(1-T\eta_{h})\alpha^{2}}\right].$ (31)

##  Appendix C Assumptions and secure key rates

###  C.1 Assumptions in measurement-device-independent quantum key
distribution

In the protocol presented in the main text we have made the following
assumptions which conform with those of the measurement-device-independent
(MDI) quantum key distribution (QKD) paradigm:

(i) We assume that Alice and Bob have access to secure laboratories. Secure
laboratories are assumed to be immune to any side-channel attack since no
unwanted system may enter or exit these laboratories. As such, these
laboratories should not take part directly in either state preparation or
state detection. In the protocol, the DV modes $a_{1}$ and $b_{1}$ with Alice
and Bob, respectively, are assumed to be in these secure laboratories and do
not directly take part in the state preparation and transmission. On the other
hand, the CV modes $a_{2}$ and $b_{2}$ are not assumed to be in secure
laboratories.

(ii) We also consider a third party, Charlie, who is assumed to be untrusted
and can collaborate with an eavesdropper, Eve. In the worst case scenario, we
assume that he is identified as Eve herself. The QKD protocol, as described in
the main text, dictates that Charlie performs certain measurements and
publicly declare the outcomes so that Alice and Bob can share an entangled
state. In principle, as an eavesdropper, we assume that Charlie may not
perform the operations as dictated by the protocol. However, it is required
for him to supply some outcomes to the specified measurements to activate the
correlations between Alice and Bob. However, if these outcomes are tampered
with or even fabricated, the correlations between Alice and Bob will decrease.
It is then possible for Alice and Bob to detect the presence of Eve by various
methods including state tomography since the parties know the final state they
should potentially share. More details on this assumption and the concept of
secure laboratories can be found in Ref. [14].

###  C.2 Calculation of the key rates

In this subsection we provide a detailed analysis of the secure keyrate. The
secure key rate is evaluated for the final state that Alice and Bob share
after Charlie performs the entanglement swapping operation as dictated in the
main text. After performing the steps of the protocol, Alice and Bob will
share a DV entangled state in modes $a_{1}$ and $b_{1}$. The final state is

$\rho_{a_{1}b_{1}}=\frac{1}{2}\left[\ket{01}\bra{01}+\ket{10}\bra{10}+f\Big{(}g\ket{01}\bra{10}+g^{*}\ket{10}\bra{01}\Big{)}\right],$
(32)

where $f=e^{-4(1-T\eta_{h})\alpha^{2}}$,
$g=e^{4\mathsf{i}\sqrt{T\eta_{h}}\alpha p}$, $g^{*}$ is the conjugate of $g$
and $p$ is the result of the homodyne measurement. In the expression of Eq.
(32), the first and second subsystems correspond to modes $a_{1}$ and $b_{1}$
with Alice and Bob, respectively. Since the outcome $\Pi_{0}$ for the
projective measurement occurs with non-unit probability, Alice and Bob share
the state $\rho_{a_{1}b_{1}}$ with probability (See Sec B.2 for a detailed
derivation),

$p_{0}=\frac{\left(1-e^{-\eta_{o}T\alpha^{2}}\right)^{2}}{2}.$ (33)

In order to evaluate the secure keyrate, we assume the existence of an
eavesdropper Eve with system $E$. We assume that Eve can potentially
collaborate with the untrusted party Charlie while also having access to the
two quantum channels which are used to transmit the CV systems.

The secure key rate $r$ between Alice and Bob is

$r\geq p_{0}\left[I(A:B)-\chi(A:E)\right],$ (34)

where we have multiplied the expression with the probability of sharing the
final resource.

Evaluating the mutual information between Alice and Bob is relatively simple
and is accomplished by using their observed joint statistics. We consider that
Alice and Bob choose the observable $\sigma_{Z}$ to perform their measurements
on the state $\rho_{a_{1}b_{1}}$. In this case we obtain $I(A:B)=1$ bit.

In order to evaluate the Holevo bound, we assume that Eve has access to a
purification of the state $\rho_{a_{1}b_{1}}$, which we denote by
$\rho_{a_{1}b_{1}E}$, such that
$\rho_{E}=\text{tr}_{a_{1}b_{1}}(\rho_{a_{1}b_{1}E})$ is the reduced state of
Eve. Moreover, we also assume that Alice’s measurement outcomes are
represented by rank-1 operators. Since $\rho_{a_{1}b_{1}E}$ is pure by
definition, we have $S(\rho_{a_{1}b_{1}})=S(\rho_{E})$, where $S(X)$ is the
Von Neumann entropy of a system $X$.

Moreover, if Alice’s measurement outcomes are represented by rank-1 operators,
then the reduced state of Bob and Eve conditioned on Alice’s outcome $x$,
given by $\rho_{b_{1}E}(x)$, is also pure. Therefore, by definition of Von
Neumann entropy, we have $S(\rho_{E}(x))=S(\rho_{b_{1}}(x))$. The Holevo bound
can then be written as [14]

$\displaystyle\chi(A:E)$
$\displaystyle=S(\rho_{a_{1}b_{1}})-\sum_{x}p(x)S\left(\rho_{b_{1}}(x)\right)$
(35) $\displaystyle=S(\rho_{a_{1}b_{1}}),$

where for the last equality we have used the fact that $S(\rho_{b_{1}}(x))=0$
for all outcomes $x$ of Alice for the observable $\sigma_{Z}$ by construction
of the state in Eq. (32).

Therefore, the final form of the secure key rate can be written as

$r\geq p_{0}\left[1-S\left(\rho_{a_{1}b_{1}}\right)\right],$ (36)

where, because of the construction of the final state, the secure keyrate is
only a function of its von Neumann entropy. It should be noted that the state
itself is a function of the detection efficiencies $\eta_{h}$ and $\eta_{0}$,
the result of the homodyne measurement $p$, the coherent amplitude $\alpha$,
and the transmission coefficient $T$.

Generally, for an experimental realization of the QKD protocol, the labs of
Alice and Bob are fixed at some distance $L$. While in the main text we show
how the secure key rate behaves with varying $L$, there is another important
parameter that we keep fixed. The key rate is also a function of the coherent
amplitude $\alpha$. As seen in the main text, $\alpha$ cannot be chosen
arbitrarily, as there exists an optimal value which can either maximize the
key rate or the total transmission distance. In Fig. 5, we plot the secure key
rate as a function of the coherent amplitude for a fixed value of the
transmission distance. We see that there exists an optimal value
$\alpha\approx 0.5$ which maximizes the total secure key rate for any value of
transmission distance. Coincidentally, we find that the same value also
maximizes the total transmission distance for fixed value of secure key rate
as seen in Fig. 5. Therefore, this is the value of $\alpha$ that we use in the
main text to show the security of our protocol.

Figure 4: Secure key rate as a function of the coherent amplitude $\alpha$ for
different values of transmission distance. We fix the channel loss at $l=0.2$
dB/km, which corresponds to losses in standard optical fibres. The value of
$\alpha$ which maximizes the key rate is found to be the same in each case.

Figure 5: The total transmission distance as a function of the coherent
amplitude for different values of the secure key rate. We fix the channel loss
at $l=0.2$ dB/km which corresponds to losses in standard optical fibres. The
optimal value of $\alpha$ which maximizes the transmission distance is found
to be the same in each case. The unit for the secure key rate $r$ is
bits/pulse.

##  Appendix D Logarithmic negativity of hybrid entangled states undergoing
photon loss

In our protocol we use the CV part of the HE state for transmission via a
lossy quantum channel. It can be shown that under photon losses in the CV
part, an HE state can still retain correlations for a particular value of
$\alpha$.

We analyse the amount of correlations that a HE state retains after its CV
system is transmitted via a lossy quantum channel. Upon transmission the CV
part undergoes photon loss which is directly dependent on the value of
$\alpha$ chosen. We show that the correlations in a HE state after its CV part
has undergone transmission loss is a non-monotonic function of its coherent
amplitude. Specifically, we evaluate the logarithmic negativity [68, 53] of
the initial HE state as a function of transmission loss. We find that for
$\alpha\approx 0.5$, the HE state is highly robust against noise.

Let us consider the HE state

$\ket{\psi}_{ab}=\frac{1}{\sqrt{2}}\Big{(}\ket{0}_{a}\ket{\alpha}_{b}+\ket{1}_{a}\ket{-\alpha}_{b}\Big{)}.$
(37)

Suppose that the mode $b$ undergoes photon loss. The process of photon loss
can be equivalently modeled as passage through a beam splitter with
reflectivity $R$ ($0\leq R\leq 1$) while the other input to the beam splitter
is taken to be vacuum. In such a case, the beam splitter matrix is
$\begin{pmatrix}\sqrt{1-R}&\sqrt{R}\\\ -\sqrt{R}&\sqrt{1-R}\end{pmatrix},$
where $R=0$ and $R=1$ stand for zero photon loss and complete photon loss,
respectively. To that end, let us consider that the mode $b$ passes through
such a beam splitter while the other input is at $\ket{0}$ in mode $c$. As a
consequence, the total state after passage through the beam splitter becomes

$\ket{\psi}_{ab}\otimes\ket{0}_{c}\xrightarrow{\rm{bs}}\frac{1}{\sqrt{2}}\left(\ket{0}_{a}\ket{\sqrt{1-R}\alpha}_{b}\ket{\sqrt{R}\alpha}_{c}+\ket{1}_{a}\ket{-\sqrt{1-R}\alpha}_{b}\ket{-\sqrt{R}\alpha}_{c}\right).$
(38)

Subsequently, the two-mode state in modes $a$ and $b$ after photon loss is
obtained by tracing over the ancillary mode $c$ as

$\displaystyle\rho_{ab}^{\rm{loss}}$
$\displaystyle={\rm{tr}}_{c}\left[\frac{1}{2}\left(\ket{0,\sqrt{1-R}\alpha}_{ab}\bra{0,\sqrt{1-R}\alpha}\otimes\ket{\sqrt{R}\alpha}_{c}\bra{\sqrt{R}\alpha}+\ket{1,-\sqrt{1-R}\alpha}_{ab}\bra{1,-\sqrt{1-R}\alpha}\otimes\ket{-\sqrt{R}\alpha}_{c}\bra{-\sqrt{R}\alpha}\right.\right.$
$\displaystyle~{}~{}~{}\left.\left.+\ket{0,\sqrt{1-R}\alpha}_{ab}\bra{1,-\sqrt{1-R}\alpha}\otimes\ket{\sqrt{R}\alpha}_{c}\bra{-\sqrt{R}\alpha}+\ket{1,-\sqrt{1-R}\alpha}_{ab}\bra{0,\sqrt{1-R}\alpha}\otimes\ket{-\sqrt{R}\alpha}_{c}\bra{\sqrt{R}\alpha}\right)\right]$
$\displaystyle=\frac{1}{2}\left(\ket{0,\sqrt{1-R}\alpha}_{ab}\bra{0,\sqrt{1-R}\alpha}+\ket{1,-\sqrt{1-R}\alpha}_{ab}\bra{1,-\sqrt{1-R}\alpha}+e^{-2R\alpha^{2}}\ket{0,\sqrt{1-R}\alpha}_{ab}\bra{1,-\sqrt{1-R}\alpha}\right.$
$\displaystyle~{}~{}~{}~{}\left.+e^{-2R\alpha^{2}}\ket{1,-\sqrt{1-R}\alpha}_{ab}\bra{0,\sqrt{1-R}\alpha}\right)$
$\displaystyle=\frac{1}{2}\left[\ket{0}_{a}\bra{0}\otimes\ket{\sqrt{1-R}\alpha}_{b}\bra{\sqrt{1-R}\alpha}+\ket{1}_{a}\bra{1}\otimes\ket{-\sqrt{1-R}\alpha}_{b}\bra{-\sqrt{1-R}\alpha}\right.$
$\displaystyle~{}~{}~{}~{}\left.+e^{-2R\alpha^{2}}\left(\ket{0}_{a}\bra{1}\otimes\ket{\sqrt{1-R}\alpha}_{b}\bra{-\sqrt{1-R}\alpha}+\ket{1}_{a}\bra{0}\otimes\ket{-\sqrt{1-R}\alpha}_{b}\bra{\sqrt{1-R}\alpha}\right)\right].$
(39)

In order to evaluate the entanglement content in this state, we use
logarithmic negativity as a measure of entanglement. For a bipartite state
$\rho_{ab}^{\rm{loss}}$ it is defined as
$E_{N}\left(\rho_{ab}^{\rm{loss}}\right)=\log_{2}\left|\left|\left(\rho_{ab}^{\rm{loss}}\right)^{\rm{P.T.}}\right|\right|_{1}$,
where $\left|\left|.\right|\right|_{1}$ is the trace norm and P.T. stands for
partial transpose over any one of the modes $a$ or $b$. We evaluate the
logarithmic negativity for the state after photon loss in Eq. (39) numerically
and is shown in the main text.