## 3 Security Analysis  
In this section, we address the security of CVQKD protocols with the assumption that [PERSON] and [PERSON]'s labs, and equipment, are trusted. Note that this does not require that their source or detectors are perfect, but rather that their potential imperfections are well understood and can be modeled properly. For instance, [PERSON]'s detectors could have imperfect efficiency or add electronic noise. Such models can be easily incorporated into the security analysis. However, we exclude side-channel attacks from the present analysis and will only discuss them in Section 5. Security analysis for quantum key distribution protocols has evolved in a tremendous manner in the last decade. For a long time, the standard was to consider collective attacks in the asymptotic limit on infinitely long keys, and the goal was to compute the corresponding asymptotic collective key rate \(K_{\rm coll}^{\rm asympt}\), given by [27, 28]:  
\[K_{\rm coll}^{\rm asympt}=I(A;B)-\chi(B;E), \tag{1}\]  
where \(I(A;B)\) is the mutual information between [PERSON] and [PERSON]'s measurements outcomes and \(\chi(B;E)\) is the Holevo information between [PERSON]'s string and [PERSON]'s quantum system. Note that \(\chi(B;E)\) should be replaced by \(\chi(A;E)\) for protocols with direct reconciliation. In a realistic setting, [PERSON] and [PERSON] cannot extract all of the information from their data, and it is usual to replace \(I(A;B)\) by \(\beta I(A;B)\), where the factor \(\beta<1\) is the so-called reconciliation efficiency. The Devetak-Winter formula, Equation (1), is usually assumed to hold for continuous-variable protocols, and the challenge was therefore to compute \(\chi(B;E)\) or at least an upper bound for it. Indeed, the quantity \(\beta I(A;B)\) can be directly observed in an experiment. The asymptotic limit assumption is very helpful for obtaining an upper bound on \(\chi(B;E)\). Indeed, one is in the situation where a given state can be observed a large number of times and can therefore be precisely estimated. In particular, one typically assumes that the covariance matrix \(\Gamma_{AB}\) of the bipartite state \(\rho_{AB}\) shared by [PERSON] and [PERSON] is known. Then, using the optimality properties of Gaussian states [29], one can show that \(\chi(B;E)\) is upper bounded by its value computed for the Gaussian state of covariance matrix \(\Gamma_{AB}\)[30, 31]:  
\[\chi(B;E)\leq f(\Gamma_{AB}), \tag{2}\]  
where \(f\) is an entropic function depending on the symplectic eigenvalues of \(\Gamma_{AB}\) and \(\Gamma_{A|b}\), the covariance matrix of [PERSON]'s state conditioned on [PERSON]'s measurement result. This last step completes the analysis of the security of one-way CVQKD protocols against collective attacks in the asymptotic limit. More recently, a new paradigm for evaluating the security of QKD protocols has been put forward, notably by [PERSON] [32], following the universal composability framework of [PERSON] [33]. In this paradigm, the QKD protocol is seen as a completely positive and trace-preserving map that takes as input an arbitrary bipartite state \(\rho_{A^{N}B^{N}}\) consisting of \(N\) quantum systems, _a priori_ unknown to [PERSON] and [PERSON], and returns a final state \(\rho_{S_{A}S_{B}E}\) where \(S_{A},S_{B}\) correspond to [PERSON] and [PERSON]'s final keys and \(E\) denotes [PERSON]'s quantum register. The aim of this framework is to assign a number, \(\varepsilon\), to quantify the security of the protocol: \(\varepsilon=0\) corresponding to perfect security. Moreover, we still want our notion of security to be composable (as was already the case with the Devetak-Winter approach), meaning that a protocol obtained by composing two subprotocols with respective security parameters \(\varepsilon_{1}\) and \(\varepsilon_{2}\) should have a security parameter \(\varepsilon\leq\varepsilon_{1}+\varepsilon_{2}\). Such a requirement is achieved by taking \(\varepsilon\) to be an upper bound on the distance between the protocol under study and an ideal protocol.