s2fieldsofstudy:
Computer Science
Mathematics

text:
Asymptotic security of discrete-modulation protocols for continuous-variable quantum key distribution

We consider discrete-modulation protocols for continuous-variable quantum key distribution (CV-QKD) that employ a modulation constellation consisting of a finite number of coherent states and that use a homodyne-detection receiver. We establish a security proof for arbitrary collective attacks in the asymptotic regime, and we provide a formula for an achievable secret-key rate. Previous works established security proofs for Gaussian-modulation CV-QKD protocols or for discrete-modulation protocols with two or three coherent states. The main constituents of our approach include approximating a complex, isotropic Gaussian probability distribution by a finite-size Gauss-Hermite constellation, applying entropic continuity bounds, and leveraging previous security proofs for Gaussian-modulation protocols. As an application of our method, we calculate secret-key rates achievable over a pure-loss bosonic channel. Our results indicate that in the high-loss regime the achievable key rates scale optimally, i.e., proportional to the channel's transmissivity, and approach that achieved by a Gaussian-modulation protocol as the constellation size is increased.

I. INTRODUCTION
Quantum key distribution (QKD) allows for two distant parties, often called Alice and Bob, to create a shared secret key by employing an insecure and noisy quantum communication channel and an authenticated public classical communication channel [1][2][3]. The security is based on the physical laws of quantum mechanics, in contrast to conventional cryptographic protocols, whose security relies on computational complexitytheoretic assumptions.
There are two basic classes of QKD protocols that have been considered: discrete-variable and continuousvariable (see, e.g., [3] for a review).
In discretevariable QKD (DV-QKD), the information is usually encoded in the polarization or time bin of single photons or weak coherent states (laser-light pulses). Discretevariable QKD requires high-efficiency, low dark-countrate, single-photon detectors, which are expensive and often need extreme cryo-cooling. In the other class of protocols, known as continuous-variable QKD (CV-QKD), the information is encoded in the quadrature amplitudes of coherent states. The transmitter modulates the phase and/or the amplitude of laser-light pulses, and the receiver is based on coherent detection (i.e., homodyne or heterodyne detection). Near shot-noise-limited, low-noise homodyne detection is readily realizable at room temperature using off-the-shelf hardware, unlike the single-photon detectors of DV-QKD. CV-QKD protocols thus possess a major advantage over DV-QKD in terms of the cost and ease of experimental implementation.
However, one major area that DV-QKD currently possesses an advantage over CV-QKD is that the DV modulation involves few levels (e.g., two polarization states of a photon or three amplitude levels of a coherent state in the decoy-state BB84 protocol [4][5][6]), which puts far less burden on the transmitter's modulator compared to that of the traditional Gaussian-modulation CV-QKD protocol. The latter requires modulation using an infinite-size constellation. This also makes the error correction protocols far simpler for DV-QKD, along with much less overhead for random-number generation. Another area where DV-QKD is arguably more advanced is the availability of quantum repeater protocols [7][8][9][10][11] for overcoming the fundamental rate-vs.-loss trade-off of direct-transmission based QKD [12][13][14]. However, there have been recent advances in designs of repeaters for CV-QKD [15][16][17].
In the most common form of CV-QKD, one uses Gaussian modulation of coherent states [18]: Alice modulates laser-light pulses with amplitudes selected randomly from a complex-valued Gaussian distribution with a given variance. Security proofs for this Gaussian modulation CV-QKD protocol have been developed for arbitrary attacks, even in the finite key-length regime [19]. Additionally, a suite of variants of this CV-QKD protocol exist, some of which use squeezed light modulation and two-way transmission [20][21][22][23][24][25][26][27][28]. However, all of their asymptotic security proofs require a Gaussian modulation. Gaussian modulation has obvious drawbacks, which include extreme burden on the transmitter's random number source, as well as computationally demanding and inefficient errorcorrection techniques. Furthermore, no matter how high the extinction ratio of a practically-realizable electro-optic modulator, it is impossible to sample pulse amplitudes from a true Gaussian distribution, on which the security proofs rely.
Despite the fact that Gaussian modulation has made security proofs manageable, it is important-for the practical realizability of CV-QKD-that protocols that use a few pre-determined modulation levels (such as binary phase and quadrature amplitude modulation) are proven secure. Discrete-modulation CV-QKD was introduced in [29][30][31], where the coherent states transmitted in each mode are chosen according to a discrete probability distribution, and it was developed further in [32]. Discretemodulation CV-QKD protocols can leverage the efficient modulation and error correction, and low-overhead random number generation that DV-QKD enjoys, while retaining the ease of implementation of homodyne detection of CV-QKD.
Several discrete-modulation protocols have already been considered [32][33][34][35], and security proofs have been developed in the asymptotic regime, i.e., in the limit of a large number of uses of the quantum channel, hence generating a large-length key (at a given key-bits per channel-use rate). Ref. [32] considered a protocol with binary-phase shift-keying of coherent states along with homodyne detection. However, the secure key rate established there is more than an order of magnitude lower than that which can be achieved with Gaussian modulation. Motivated by [32], Ref. [33] considered ternary-phase shift-keying modulation with homodyne detection, which led to an improvement in the secure key rates, but the resulting secret-key rates are still far from the key rates achievable with Gaussian modulation. Refs. [34,35] established security for discrete-modulation protocols against particular collective attacks that correspond to linear bosonic channels.
This brings us to the long-standing open problem of proving security of a general M -ary discrete-modulation CV-QKD protocol, for M beyond a minimum threshold value, with the feature that the achievable key rate approaches that of Gaussian modulation as M goes to infinity. Such a result is of significant value for the practical usability of CV-QKD. In this paper, we accomplish the aforesaid for security against collective attacks. Establishing a security proof and key-rate lower bounds for discrete modulation CV-QKD protocols with a finite key length is left open for future work. Our proof eliminates the need to consider protocols based on Gaussian modulation in order to have asymptotic security in CV-QKD, with the ability of the user to determine the size of the modulation alphabet based on how close one desires the key rates to be to the Gaussian modulation protocol. In addition, our numerical evaluation of achievable key rates over a pure-loss bosonic channel suggests that, for sufficiently large constellation size, the achievable key rates are proportional to the channel's transmissivity, which is known to be the optimal rate-vs.-loss scaling achievable with any QKD protocol, CV or DV [12]. To establish these results, we make use of two important recent the-oretical advances: the approximation of Gaussian distributions with discrete ones for communication [36,37], especially in the context of bosonic Gaussian states [37], and an entropic continuity bound from [38] for energybounded bosonic states. The idea of approximating a Gaussian modulation with a discrete one for CV-QKD was proposed in [39], but this work did not provide a security proof for CV-QKD with discrete modulation. One of the main tools, beyond the approaches considered in [39] and which allows us to establish a security proof, is the entropic continuity bound from [38]. We also develop methods for using the parameters observed in a discrete-modulation CV-QKD protocol to bound Eve's Holevo information.
This paper is organized as follows: we introduce discrete-modulation CV-QKD in Section II, followed by Section III's detailed list of our assumptions on the collective attack of Eve. We give our security proof in Section IV, and we discuss details of channel estimation in Section V. We then showcase, in Section VI, the secure key rates that our approach lead to when the protocol is conducted over a pure-loss bosonic channel. We end with open questions and future directions in Section VII.

II. PROTOCOL
We begin by outlining the steps of a phasesymmetrized discrete-modulation CV-QKD protocol based on m 2 coherent states and homodyne detection, where m ∈ N. Let X be a random variable with realizations x ∈ {1, 2, . . . , m 2 } and fix α x ∈ C for all x. Let r(x) be the probability associated with the realization x. The steps of the protocol are as follows: 1. Alice prepares the coherent state |α x with probability r(x). She records the value of x in the variable x j , where j ∈ {1, . . . , n} refers to the transmission round. She also records the value √ 2 Re{α x } in the variable q j . Exact expressions for α x and r(x) that we use in the protocol are given in Section V.
2. Alice then picks a phase φ j ∈ {0, π/2, π, 3π/2} uniformly at random, applies it to her channel input mode as the unitary e −inφj , which is physically realized by a phase shifter. The resulting state is then e −inφj |α x = α x e −iφj , which she transmits over the unknown and insecure quantum communication channel N to Bob. At the same time, she communicates the choice φ j to Bob over a public authenticated classical channel and then she locally discards or forgets the choice of φ j . The insecure quantum channel N can be controlled by an eavesdropper Eve. Our assumptions on the insecure quantum channel N are stated in Section III.
3. Upon receiving the output of the quantum channel, namely, the state N (e −inφj |α x α x |e inφj ), as well as the classical choice of φ j from the public authenticated classical channel, Bob applies the reverse phase as the inverse unitary e inφj , and then locally discards or forgets the value of φ j . The resulting state is then as follows: where the phase-symmetrized channel N is defined as with U (k) = e −inπk/2 . The phase symmetrization of the channel N is helpful in reducing the number of parameters that need to be estimated during the channel estimation part of the protocol, as we explain in Section V.
4. Bob then performs position-quadrature or realquadrature homodyne detection on the state N (|α x α x |) and records the result in the variable y j [40].

5.
Steps 1-4 are repeated n times, for n a large positive integer, leading to the sequence {q j } n j=1 , known to Alice, and the sequence {y j } n j=1 , known to Bob. 6. A constant fraction δ of the rounds are used for channel estimation (or parameter estimation), for δ ∈ (0, 1) a small number. That is, for these δn rounds, the following parameters are calculated: where Clearly, the parameter γ 11 can be calculated from Alice's data alone, γ 22 can be calculated from Bob's data alone, but it is necessary to calculate γ 12 from both Alice and Bob's data, and so it is necessary for Bob to share the y j values of these δn rounds with Alice over a public authenticated classical channel. Furthermore, the public authenticated classical channel is used for Alice and Bob to share the values of γ 11 , γ 12 , and γ 22 with each other. The data x j , q j , and y j for these δn channel estimation rounds are then discarded. A detailed analysis of the channel estimation part of the protocol is given in Section V.
7. The remaining x j and y j data are used for final key generation. The final key-generation protocol includes reverse reconciliation, error correction, and privacy amplification (see [3] for a review).

III. ASSUMPTIONS ON THE INSECURE QUANTUM COMMUNICATION CHANNEL
In this section, we outline the various assumptions that we make on the insecure quantum communication channel: 1. Each Alice-to-Bob transmission is assumed to take place over independent identical uses of a quantum channel N , which is unknown to Alice and Bob at the beginning of the protocol. We assume that any deviation of N from the identity map is attributed to the most general adversarial action by Eve. Even though Eve's action-which appears as a noisy quantum channel N to Alice and Bobremains the same for each transmission, she is allowed to make arbitrary collective measurements on her quantum system at the end of the protocol. See below for a mathematical description. This scenario is referred to as a collective attack.
2. The channel is described mathematically as an isometric quantum channel U A→BE , meaning that there exists an isometry U A→BE , satisfying for all input density operators ρ A . The systems A, B, and E are described by separable Hilbert spaces H A , H B , and H E , respectively. The system A corresponds to a single bosonic mode, and system B does also. In particular, the channel can accept coherent states at the input A and is such that the receiver can perform homodyne detection on the system B. The system A is accessible to the sender Alice, the system B is accessible to the receiver Bob, and the system E is in possession of the eavesdropper Eve.
3. The reduced channel from Alice to Bob is given by consists of several bosonic modes E 1 , . . . , E k , then H E could be taken as the total photon number operator n 1 + · · · +n k for all of the k modes.
We note that an immediate consequence of the bounded mean photon number assumption in part three above, by applying the Cauchy-Schwarz inequality, is the following: If Alice inputs a state ρ A with finite mean vector [ q ρ , p ρ ], then the output mean vector for the state of system B is finite. If the input state ρ A has a finite covariance matrix with entries given by whereq 0 ≡q− q ρ andp 0 ≡p− p ρ , then the covariance matrix of the output state N A→B (ρ A ) is finite.

IV. SECRET-KEY RATE LOWER BOUND
The asymptotic secret-key rate K is bounded from below by the Devetak-Winter formula [44,45] as In the above inequality, the Shannon mutual information between Alice's variable X and Bob's variable Y is denoted by I(X; Y ), and the Holevo information between Bob's variable Y and Eve's quantum system E is denoted by I(Y ; E). We suppose that the quantum channel connecting Alice to Bob is not known, satisfies the assumptions given in Section III, and can only be partially estimated from X and the measurement outcomes Y on Bob's side, as we discuss in Section V. This lack of knowledge is an advantage to Eve. Therefore, the inequality in (10) features an optimization of the Holevo information I(Y ; E) over all isometric quantum channels U A→BE of Eve that are compatible with Alice's and Bob's data. Let S be the set of channels that are consistent with the measurement data. We discuss the precise meaning of this statement in Section V. We also suppose that reverse reconciliation [46] is being used in the key-generation protocol, in which the public classical communication is from Bob to Alice, and this accounts for Bob's variable Y appearing in the I(Y ; E) term in (10).
To calculate the lower bound in (10), we first need to calculate the Shannon mutual information I(X; Y ), which can be easily obtained from the observed data of Alice and Bob. The main difficulty is then to perform the optimization over the isometric quantum channels U A→BE of Eve and to bound the Holevo information I(Y ; E) from above. Doing so is the main bottleneck for many security proofs in quantum key distribution.
For protocols involving Gaussian modulation of coherent states, the aforementioned problem was solved in [47,48], with [47] relying on the techniques of [49]. The optimal attack by Eve for such protocols was proved to be a Gaussian attack, which considerably simplifies the security analysis. However, once we consider discretemodulation protocols, the optimal attack by Eve is no longer known, and is unlikely to be Gaussian. To address this problem, novel techniques are required.
In this paper, we provide a security proof for the protocol described in Section II by employing various existing tools: the approximation of Gaussian distributions with discrete ones [36,37], an entropic continuity bound from [38], and the optimality of Gaussian attacks for Gaussian modulation of coherent states [47,48]. The approach that we employ in this paper is rather intuitive: we approximate the Gaussian distribution with a discrete distribution and bound the error introduced due to this approximation in trace norm, by employing the techniques of [36,37]. Then, we expect Eve's Holevo information due to this approximation to be close to Eve's Holevo information resulting from a Gaussian-modulated protocol, with the absolute value of the difference being a function of the error introduced in the approximation.
We now discuss this approach in detail. First, consider a key-generation protocol that employs coherent states with Gaussian modulation. The expected density operator for Alice's transmitted state is a thermal state θ(N S ) with mean photon number N S ≥ 0: The P -function of the thermal state θ(N S ) is a circularly symmetric complex Gaussian [50]. Following the approach of [37], we can approximate the real and imaginary parts of the circularly symmetric Gaussian by the various constellations considered in [36]: Gauss-Hermite, random walk, equilattice, and quantile. The type of constellation fixes |α x and r(x). In this paper, we focus exclusively on the Gauss-Hermite constellation. It is possible to consider other constellations and obtain security proofs for these other constellations using the techniques described below. We obtain the error introduced by this approximation, by employing bounds from [37], and then we apply an entropic continuity bound from [38] to obtain an upper bound on Eve's Holevo information I(Y ; E). We now discuss our security proof for discretemodulation protocols of the form presented in Section II. Suppose that Alice employs the following discretemodulation ensemble of coherent states: with expected density operator: Then depending on the constellation size m 2 and the mean photon number N S of the thermal state being approximated, we obtain the following bound on the normalized trace distance: where θ(N S ) is a thermal state of mean photon number N S and ε(m, N S ) is the approximation error, for which we determine an explicit characterization later in (76), by employing the techniques of [37]. The secret-key rate with reverse reconciliation is given by where β is the reconciliation efficiency [51] and the mutual information quantities are computed with respect to the following ensemble: where with {Λ y } y denoting Bob's POVM and U A→BE the isometric channel satisfying the assumptions of Section III and corresponding to the collective attack of Eve. Since we do not know what collective attack Eve will employ, we minimize the secret-key rate with respect to all collective attacks that are consistent with the measurement data observed by Alice and Bob, i.e., with respect to all isometric channels U A→BE satisfying the assumptions of Section III and in the set S. It is possible to estimate the Shannon mutual information I(X; Y ) from the measurement data of Alice and Bob, but we are left with the following optimization problem for Eve's Holevo information: where the optimization is with respect to all collective attacks of Eve consistent with the measurement data of Alice and Bob, and the subscript notation E ρ indicates that the Holevo information I(Y ; E) between Bob's measurement outcome and Eve's quantum system is being computed with respect to the following ensemble: where From the data processing inequality for trace distance (under the action of the isometric channel U A→BE and Bob's measurement channel), we find that where (27) We then define the following ensemble as that which would arise had Alice employed a Gaussian modulation at the channel input: At this point, we invoke the fourth assumption from Section III: if the mean energy of the input state to the channel Tr B •U A→BE is fixed at some finite mean photon number κ ∈ [0, ∞), then the mean energy of the output state is no larger than κ (κ) ∈ [0, ∞). Supposing that H E is the Hamiltonian for Eve's system E satisfying the properties stated in the fourth assumption from Section III, by applying the continuity bound given in [38,Proposition 27], we find that where P is an upper bound on the mean energy of the states Tr B •U A→BE (ρ A ) and Tr B •U A→BE (θ(N S )) and f (ε, P ) is a function of ε and P , given in [38], with the property that In particular, the function f (ε, P ) is given by for any t ∈ (0, 1 2ε ], where and S(θ E (P/εt)) is the entropy of a thermal state θ E (P/εt) of Eve's system with mean energy P/εt. Due to this uniform bound, we can then apply suprema to find that with the optimizations again taken with respect to collective attacks of Eve consistent with the measurement data of Alice and Bob. The lower bound on the key rate is then given as The Shannon mutual information between X and Y , i.e., the term I(X; Y ), can be calculated from the observed data, as mentioned previously. The term f (ε, P ), introduced due to the continuity of Holevo information, can be estimated from (31). Obtaining an upper bound on the remaining term, the Holevo information sup U A→BE ∈S I(Y ; E) E θ , still requires further development, which we detail in the next section.

V. CHANNEL ESTIMATION
The main objective of this section is to obtain an upper bound on the remaining term, the Holevo information sup U A→BE ∈S I(Y ; E) E θ . The approach that we take to obtain an upper bound can be divided into three parts: estimation of parameters from the actual protocol described in Section II, using these to bound the parameters that would result if a Gaussian-modulation protocol had been employed instead, and finally using these last estimates to bound the Holevo information sup U A→BE ∈S I(Y ; E) E θ from above.

A. Estimation of parameters from the actual discrete-modulation protocol
Alice and Bob calculate the parameters γ 11 , γ 12 , and γ 22 given in (3)-(5) of the sixth step of the protocol, as described in Section II. Then the set S discussed in Section IV consists of all of the isometric channels U N A→BE that are consistent with the calculated values of γ 11 , γ 12 , and γ 22 . In this way, Alice and Bob characterize the attack by Eve.
Since we are operating in the asymptotic regime, such that the number n of rounds is large, it follows that the number δn of channel estimation rounds is also large. Additionally, since Eve is employing a collective attack and the protocol has an i.i.d. structure, it follows that the parameters γ 11 , γ 12 , and γ 22 are given exactly as the expectation of particular random variables.
To determine these random variables, we now give exact expressions for the constellation {α x } m 2 x=1 and distribution r X (x) that are used in the protocol. We begin by recalling the Gauss-Hermite approximation to the normal distribution with zero mean and unit variance, which reproduces the first 2m − 1 moments of the Gaussian distribution [52,Section 3.6]. Let H m be the mth Hermite polynomial, and let L m be a random variable with m realizations l wm , with probability distribution given by r Lm (l wm ), where w ∈ {1, 2, . . . , m}. Then, as defined in [36], the values l wm are set to the roots of the Hermite polynomial H m , and the probability distribution r Lm (l wm ) is defined as .
The P -function of a thermal state with mean photon number N S is a circularly symmetric complex Gaussian [50]. Following [37], we approximate the real and imaginary parts of the thermal-state P -function individually by the constellation described above. Specifically, we choose q wm for w ∈ {1, . . . , m} such that the sequence {q wm / √ N S } w is equal to the zeros of the Hermite polynomial H m , and we choose p tm for t ∈ {1, . . . , m} such that the sequence {p tm / √ N S } t is equal to the zeros of the Hermite polynomial H m . Then the constellation is given by the following distribution: where x = (w, t) ∈ {1, . . . , m} × {1, . . . , m}. The factor √ N S is a scaling factor incorporated so that the mean photon number of the expected density operator for the resulting constellation is equal to the mean photon number of the thermal state θ(N S ).
Let Q A denote the discrete random variable with realizations q A ∈ R, taking values q wm and having a probability distribution as detailed above. Let Q B denote the random variable associated to Bob's homodyne measurement outcome of the position-quadrature operator, taking values in R. Then, for characterizing the isometric channels U A→BE in S, Alice and Bob calculate the parameters γ 11 , γ 12 , and γ 22 from their data. Due to the fact that we are operating in the asymptotic regime (with no finite-size statistical effects), the following equalities hold As stated previously, Alice estimates γ 11 from her preparation data, while Bob estimates γ 22 from his measurement data. Alice calculates γ 12 from the data that is publicly published by Bob. Then S is the set of isometric channels U A→BE that fulfill the constraints in Section III and produce the observed values of γ 12 and γ 22 . As a consequence, Alice and Bob deduce that the attack by Eve yields the observed values of γ 22 and γ 12 . In this way, they are able to restrict the possible attacks that could have been performed by Eve.

B. Estimation of parameters for a hypothetical Gaussian-modulation protocol
Now notice that the remaining Holevo information sup U A→BE ∈S I(Y ; E) E θ from (36) that we want to bound from above is calculated for a thermal state θ(N S ) sent over an isometric channel U A→BE in the set S and Bob performing homodyne detection of the position quadrature. Therefore, we want to obtain an estimate of the parameters γ G 11 , γ G 12 , and γ G 22 , which are defined analogously to (42)- (44), but with the initial random variable Q A replaced by a Gaussian random variable with mean zero and variance equal to N S . The parameters γ G 11 , γ G 12 , and γ G 22 are those that would be observed in a Gaussian modulation protocol when the average channel input of Alice is a thermal state θ(N S ) instead of ρ.
In order to bound the values of the parameters that would be obtained in a Gaussian-modulation protocol with Eve's attack taken from the set S, we can employ the parameters that are observed in the discretemodulation protocol. Before we do so, let us recall the definition of the χ 2 divergence of two states ρ and σ as χ 2 (ρ, σ) ≡ Tr (ρσ −1/2 ) 2 − 1 [53]. Then we have the following proposition: where r G (x) is the P -function for a thermal state with mean photon number N S . If χ 2 (ρ, θ(N S )) ≤ ε 2 and Eve's attack U N A→BE fulfills the constraints in Section III, then, where for some constants c 1 , c 2 > 0.
The proof relies mainly on the properties of trace distance, invoking the Cauchy-Schwarz inequality and the assumption that the fourth moment of the channel output is bounded. For details, please refer to Appendix A. By invoking Proposition 1, we conclude that γ G 22 ∈ [γ 22 − ε 1 , γ 22 + ε 1 ], and γ G 12 ∈ [γ 12 − ε 2 , γ 12 + ε 2 ], where ε 1 and ε 2 are defined above. Now, consider the following scenario corresponding to an entanglement-based (EB) QKD protocol: Alice prepares a two-mode squeezed vacuum state ψ(n) RA withn ≥ 0. She applies a phase e −inπk/2 to her channel input mode A, with k ∈ {0, 1, 2, 3} selected uniformly at random, and she sends the system A to Bob over an isometric channel U N A→BE selected from the set S. She also communicates k to Bob over an authenticated public classical channel. Bob then applies the inverse phase e −inπk/2 . Both Alice and Bob then discard the value of k. Let ρ RB denote the state shared by Alice and Bob at the end, so that the reduced channel N A→B has been phase symmetrized due to the protocol above and with N A→B defined as in (2): Due to the symmetries of the two-mode squeezed vacuum state ψ(n) RA as well as those of the phase-symmetrized channel N A→B , it follows that the covariance matrix of the state ρ RB has the following form: where γ EB 11 , γ EB 12 , γ EB 22 ∈ R such that the above is a legitimate quantum covariance matrix [54], the matrix I 2 is the 2 × 2 identity matrix, and is a rotation matrix. See Appendix B for a proof of this claim. In what follows, we assume that θ = 0, due to the fact that doing so simplifies the protocol, as well as reducing the number of parameters that need to be estimated, and it furthermore does not lead to an increase in Eve's Holevo information, as discussed in [19]. Alice then performs a heterodyne measurement on mode R and Bob performs a homodyne measurement on mode B. As mentioned above, this is the entanglement-based (EB) version of the Gaussian-modulated prepare-measure (PM) protocol with the attacks by Eve constrained to the set S. Now, we want to deduce the parameters γ EB 11 , γ EB 12 , γ EB 22 observed in the EB protocol from the parameters γ G 11 , γ G 12 , γ G 22 observed in the PM version of the Gaussian modulation protocol. As is common in the CV-QKD literature, we consider the EB protocol because it is helpful in analyzing the Holevo information I(Y ; E) that results in the prepare-measure (PM) protocol. The "PM to EB" mapping of the parameters is well known in the literature [55] and is given as follows: Let Σ denote the set of quantum states ρ RB that have covariance matrix of the following form: (60)

C. Upper bound on Eve's Holevo information
By applying purification techniques of quantum information theory, the following equality holds for ρ RB the state in (54) and {p(y), ρ y R } y the ensemble resulting from Bob performing a positionquadrature homodyne detection on the state ρ RB .
As a consequence, the task of obtaining an upper bound on sup U A→BE ∈S I(Y ; E) E θ can be accomplished by obtaining an upper bound on sup ρ RB ∈Σ H(RB) ρ − H(R|Y ) {p(y),ρ y }y .
We then invoke the extremality of Gaussian states [47,49], from which we infer that the Holevo information is optimized by a Gaussian state ρ G RB having the same covariance matrix as ρ RB . Therefore, we obtain the following: where {p G (y), ρ y,G R } is the ensemble obtained if Bob performs a homodyne measurement on mode B of ρ G RB . Then, Eve's Holevo information can be calculated as follows: where the function g(·) is defined in (33), ν 1 and ν 2 are the symplectic eigenvalues of the covariance matrix in (60), and ν 3 = γ EB 11 γ 11 − (γ EB 12 ) 2 γ EB 22 +1 . Numerical checks, similar to those performed and stated in [19], reveal that the Holevo information is a monotonically decreasing function of γ EB 12 , and a monotonically increasing function of γ EB 11 and γ EB 22 . Intuitively, the correlations between Alice and Bob are quantified by γ EB 12 , so that increasing this parameter decreases Eve's Holevo information. Therefore, we conclude that the Holevo information is no larger than that achieved by a Gaussian state ρ RB that has a covariance matrix as follows: With this, we conclude our goal of obtaining an upper bound on the remaining term sup U A→BE ∈S I(Y ; E) E θ .

VI. NUMERICAL RESULTS FOR A PURE-LOSS BOSONIC CHANNEL
We now proceed with calculating the various terms in (36) for a Gauss-Hermite constellation of size m 2 and for a pure-loss bosonic channel of transmissivity η ∈ [0, 1]. This allows for determining the performance of the discrete-modulation CV-QKD protocol when the underlying channel is a pure-loss channel (however, keep in mind that Alice and Bob are not aware of this when executing the protocol).
The first term that we need to calculate is the Shannon mutual information I(X; Y ). Here, X is a random variable that encodes the choice of coherent state, and Y is the random variable that is associated with the measurement result. The Wigner function associated with the coherent state |α x subjected to a pure-loss channel with transmissivity η is given as where z = q B + ip B , with the real part q B corresponding to the position-quadrature phase-space variable, and the imaginary part p B corresponding to the momentumquadrature phase-space variable. Bob performs homodyne detection with respect to the q B quadrature, which provides the raw data for key generation. Then the various probability distributions are given as With this information in hand, it is easy to calculate  [13,14], which bounds the secret-key rate of any repeaterless quantum key distribution protocol conducted over a pure-loss bosonic channel.
The second term that we need to calculate is the Holevo information sup U A→BE ∈S I(Y ; E) E θ for a keygeneration protocol that uses Gaussian-modulation of coherent states and homodyne detection. To this end, we need to calculate the parameters γ 11 , γ 22 , and γ 12 for the discrete-modulation protocol in order to obtain the covariance matrix in (64). These can be calculated numerically. However, note that θ(N S ) and ρ have the same covariance matrix, due to the second moment of the Gauss-Hermite approximation and Gaussian distribution being the same. Since we are considering the underlying channel as a pure-loss channel, we can calculate the parameters γ 22 and γ 12 that would be observed by Alice and Bob during the protocol. To do so, we follow the calculation given in detail in Section 7 of [55].
When applying Proposition 1, it is necessary to make a choice for the parameters c 1 and c 2 . In our example considered here, we take the conservative choice of c 1 = c 2 = 100. Let us emphasize that the interpretation of this choice is that the parameters 2 ] that would be observed in a hypothetical Gaussian modulation protocol are no larger than 100 times those observed in the discrete modulation protocol. One could certainly criticize this choice and demand that higher values of c 1 and c 2 be chosen. However, we note that it is always possible for Alice and Bob to overcome more conservative choices and achieve the same secret key rates simply by taking the constellation size to be higher than that considered in our example.
Let us denote an additive white Gaussian noise channel with signal to noise ratio s by W s . The action of W s is defined as W s (Z) = √ sZ + G, where G is a normally distributed random variable with unit variance. Then, for Z ∼ N (0, 1) with distribution P Z , a random variable Z m with distribution P Zm as given in (37), Y = W s (Z), and Y m = W s (Z m ), the χ 2 distance is given as with 2κ 2 ≈ 2.36 [36]. Let and θ N S be a thermal state of mean photon number N S . Then with s = N S / N S (N S + 1) − N S [37] and Combining (69) and (72), we obtain the following expression for the approximation error: We can then invoke [38,Proposition 27], which utilizes some techniques from [43], to obtain f (ε, N S ) = ε (2t + r ε (t)) g(P/εt) + 2g(εr ε (t)) + 2h(εt), (77) In the above, we have set P = 10 7 , which is an extremely conservative choice to employ with respect to the fourth assumption on Eve's attack discussed in Section III. We have also supposed that Eve's system is a harmonic oscillator. Even though the mean photon number of the average input state in all example cases that we consider in what follows is many orders of magnitude smaller than P = 10 7 and the actual physical channel being employed is a pure-loss channel, we can still suppose that the mean energy of the eavesdropper's states is extremely large (way beyond what an eavesdropper might reasonably employ in an attack) and we find that the performance of the discrete-modulation protocols approaches that of the Gaussian-modulation protocol relatively quickly as the constellation size m 2 increases. One could choose an even more conservative value for P , higher than what we have taken. However, in our numerics, we have found the same qualitative behavior: that the performance of the discrete-modulation protocol rapidly approaches that of the Gaussian-modulation protocol as the constellation size m 2 increases.
With all these ingredients in hand, we can now numerically evaluate (36) to obtain a lower bound on the secret-key rate for a pure-loss channel with transmissivity η. We take the reconciliation efficiency β = 0.98. Note that the key rates obtained from (36) have a dependence on the mean photon number N S of the input state. Thus, to obtain tight lower bounds on the secretkey rate, we also optimize over N S .
In Figure 1, we present the main results of our analysis. We plot lower bounds for various values of m 2 and compare the obtained lower bounds with the Gaussianmodulation protocol. It is clear that the secure key rate of the discrete-modulation protocol increases as the constellation size m 2 increases.
As explained before, to obtain the lower bound on the rates given in Figure 1, we optimize over the mean photon number N S . For the Gaussian-modulation protocol, we find that the optimal variance for secret-key rates decreases with the increase in loss. Now, the main idea behind the technique presented in this paper is to discretize the Gaussian probability distribution by a finite constellation of size m 2 and calculate the error introduced due to this approximation. We find that as the variance of the Gaussian modulation increases, the number of constellation points required to approximate the distribution to an ε error increases. Therefore, for low losses, this technique requires a large number m 2 of constellation points to closely match the secret key-rates obtained with Gaussian modulation.
A consequence of the aforementioned reasoning is that, with our approach, the lower bound on the secret-key rate does not tend to log m 2 in the limit as η → 1. Certainly, in this limit, the Holevo information with Eve tends to zero, and the key rate is then given as K ≥ I(X; Y ) − f (ε, N S ). We numerically observe that the Shannon mutual information of Alice and Bob saturates towards log m 2 with the increase in variance; however, the approximation error f (ε, N S ) increases with the increase in variance. Due to this trade-off, our technique does not achieve the ideal rate of log m 2 rate in the lowloss limit.
It is possible (and likely) that our rate lower bounds can be improved by other constellation choices or other proof techniques. However, even with our proof, requiring a pair of electro-optic (phase and amplitude) modulators to generate a 90 × 90 size constellation size is much more practical and less demanding compared to asking that we modulate a pulse with a complex amplitude to an extremely high floating point accuracy, which a Gaussian modulation would need.
We note here that we have included in the arXiv posting of this paper the Mathematica files used to perform the numerical calculation of the key rates and to generate Figure 1. We also note here that a similar approach can be used to evaluate secure key rates achievable over a thermal bosonic Gaussian channel.

VII. CONCLUSION
In this paper, we have addressed a long-standing open problem in continuous-variable quantum key distribution (CV-QKD), by establishing a security proof for discretemodulation protocols. Even though many experiments have been performed on discrete-modulation CV-QKD with multiple constellation points (see, e.g., [56][57][58]), no security proofs have been available for them, and the expected key-rate calculations reported based on measured homodyne statistics have been based on assuming Gaussian attacks, which are not known to be optimal for discrete-modulation CV-QKD. We have introduced a discrete-modulation protocol and then obtained rigorous lower bounds on the secret-key rates, secure against collective attacks in the asymptotic key-length regime. The approach that we have used works well in the highloss regime, with the secure key rates being close to the secure key rates achievable with a Gaussian-modulation protocol. Another prominent feature of our approach is that with the increase in the size m 2 of the constellation, the lower bound on the secret-key rate approaches the key rate for the Gaussian-modulation protocol. This result demonstrates that we need not consider the full continuum of the Gaussian distribution in order to obtain key rates achievable with a Gaussian modulation, and we do not need to rely on Gaussian modulation for security proofs of discrete-modulation CV-QKD protocols.
Going forward from here, it is a pressing open question to determine security proofs for discrete-modulation CV-QKD protocols in the non-asymptotic, or finite keylength, regime. It would also be ideal to improve the bound from Proposition 1 to reduce or eliminate its dependence on the parameters c 1 and c 2 .
Note Added : After the first version of our paper was posted to the arXiv [59], the first version of the GGDL19 paper [60] appeared, which discussed a semi-definite programming approach for security of a four-state discretemodulation CV-QKD protocol. The GGDL19 approach was later extended to include discrete-modulation CV-QKD protocols that have an arbitrary number of states, at the expense of an increased complexity of the semidefinite program [61,62]. The second version of our paper (this version) was then posted to include more details of the channel estimation part of our protocol and security proof. In light of the fact that our approach gives a security proof and good performance for large constellation sizes and the approach of GGDL19 gives the same for small constellation sizes, we view our approach and the GGDL19 one as being complementary.

ACKNOWLEDGMENTS
We are grateful to Hari Krovi for discussions about CV-QKD with discrete modulation. We are especially grateful to Anthony Leverrier for his critical reading of the initial version of our paper and for pointing out the need for more details of the channel estimation procedure. We thank Jeffrey H. Shapiro and Xiang-Bin Wang for helpful feedback on our manuscript. This work was supported by the Office of Naval Research program Communications and Networking with Quantum Operationally-Secure Technology for Maritime Deployment (CONQUEST): Raytheon BBN Technologies prime contract number N00014-16-C2069, under subcontracts to Louisiana State University and University of Arizona.
Proof. For simplicity, we prove the claim under the assumption that all random variables have zero mean, and we note that it can be generalized by adopting a shift of the variables involved in the proof.
To prove the equality in (85), consider the following: γ 11 is equal to the variance of the position quadrature that is encoded by Alice during the preparation procedure. Since we are using the Gauss-Hermite approximation of the Gaussian for the encoding, for which the lower moments match those of the Gaussian distribution, it follows that γ 11 = γ G 11 . Due to the multiplicativity of the quantity χ 2 (ρ, σ) + 1, so that and the fact that [37] it follows that which means that To prove the inequality in (86), observe that implies that The second inequality follows from data processing. Now consider where W N ,αx is the associated Wigner function for the state resulting from transmitting a coherent state over the channel N . Let r Q B |X (q B |x) = dp B W N ,αx (q B , p B ), be the probability distribution obtained over the position quadrature when the coherent state α x is sent over a channel N . Then we have the following: which is a consequence of monotonicity of trace distance and (94).
Then we obtain the following: Now using that is the Hellinger divergence and less than the square root of the total variation distance dq B r G Q B (q B ) − r Q B (q B ) , we obtain that To bound the second term we invoke the assumption that the photon number variance of the channel output is bounded. Therefore, where ρ = N (θ(N S )). We thus conclude that To prove the inequality in (87), observe the following: where r(q B |q A , p A ) = dp B W N ,αq A ,p A (p B , q B ), and r Q A ,P A (q A , p A ) = r Q A (q A )r P A (p A ). Then, By similar reasoning as above, we arrive at Then, invoking the assumption that the fourth moments of q A and q B are bounded, we obtain that the second term in the above equation is bounded, such that for some constant c 2 > 0.

B. CHANNEL SYMMETRIZATION
We now show that by performing a discrete phase symmetrization in Steps 2-3 of the key distribution protocol from Section II, it is possible to simplify the form of the covariance matrix of the state that Alice and Bob share at the end of the EB protocol to a symmetrized form.
Let N A→B be a single-mode bosonic channel. Alice and Bob can make this channel phase covariant by applying a random phase rotation and its inverse at the channel input and output, respectively, resulting in the following symmetrized channel: If the state input to the phase randomized channel is one share of a two-mode squeezed vacuum ψ(n) RA = |ψ(n) ψ(n)| RA , defined from then it follows that N A→B (ψ(n) RA ) = 1 4 3 k=0 e −in R πk/2 ⊗ e in B πk/2 N A→B (ψ(n) RA ) e in R πk/2 ⊗ e −in B πk/2 , where we have applied the fact that e −in A πk/2 |ψ(n) RA = e −in R πk/2 |ψ(n) RA .
We would now like to determine the covariance matrix elements of the phase-randomized state τ RB ≡ N A→B (ψ(n) RA ): where we assume for simplicity that τ RB has zero mean, but we note here that the more general case can be incorporated by a shift. Given an initial covariance matrix with elements


extfieldsofstudy:
Computer Science
Mathematics

text:
Spatially Coupled Generalized LDPC Codes: Asymptotic Analysis and Finite Length Scaling

Generalized low-density parity-check (GLDPC) codes are a class of LDPC codes in which the standard single parity check (SPC) constraints are replaced by constraints defined by a linear block code. These stronger constraints typically result in improved error floor performance, due to better minimum distance and trapping set properties, at a cost of some increased decoding complexity. In this paper, we introduce spatially coupled generalized low-density parity-check (SC-GLDPC) codes and present a comprehensive analysis of these codes, including: (1) an iterative decoding threshold analysis of SC-GLDPC code ensembles demonstrating capacity approaching thresholds via the threshold saturation effect; (2) an asymptotic analysis of the minimum distance and free distance properties of SC-GLDPC code ensembles, demonstrating that the ensembles are asymptotically good; and (3) an analysis of the finite-length scaling behavior of both GLDPC block codes and SC-GLDPC codes based on a peeling decoder (PD) operating on a binary erasure channel (BEC). Results are compared to GLDPC block codes, and the advantages and disadvantages of SC-GLDPC codes are discussed.

I. INTRODUCTION
Low-density parity-check (LDPC) block codes, with iterative message passing decoding, were introduced by Gallager in 1963 [1] as a class of codes whose decoder implementation complexity grows only linearly with block length, in contrast to maximum likelihood (ML) and maximum a posteriori (MAP) decoding methods whose complexity typically has exponential growth. As a result of the low-density constraint on the parity-check matrix H, the minimum distance of LDPC block codes is sub-optimal. However, Gallager showed that regular constructions, where the variable and check node degrees of the Tanner graph representation of H are fixed, maintain linear minimum distance growth with block length, i.e., they are asymptotically good, although their iterative decoding thresholds are bounded away from capacity. Irregular constructions, introduced by Luby et al. in 2001 [2], where the node degrees are not fixed and can be numerically optimized, have capacity-approaching thresholds, but typically involve a large fraction of degree two variable nodes that can preclude linear distance growth. As a result, irregular codes perform best in the waterfall, or low signal-to-noise ratio (SNR), portion of the bit-error-rate (BER) performance curve, while regular codes perform better at high SNRs, i.e., in the error floor region of the BER curve.
Generalized LDPC (GLDPC) block codes, first proposed by Tanner in 1981 [3], are constructed by replacing some/all of the single parity-check (SPC) constraint nodes in the Tanner graph of a conventional LDPC code by more powerful generalized constraint (GC) nodes corresponding to an (n, k) linear block code. The n variable nodes connected to a GC node in the Tanner graph of a GLDPC code are then considered as the code bits of the corresponding (n, k) code, and the sub-code associated with each GC node is referred to as a constraint code. In message passing decoding of GLDPC codes, the constraint codes are decoded using standard block code decoders which, in the case of simple constraint codes such as Hamming codes [4] or Hadamard codes [5], can be ML or MAP decoders. GLDPC codes have many potential advantages compared to conventional SPC/LDPC codes, such as large minimum distance [4], [6], low error floors [7], and fast iterative decoding convergence [8].
Spatially coupled LDPC (SC-LDPC) codes, also known as LDPC convolutional codes, were introduced by Jimenez-Felstrom and Zigangirov in 1999 [9]. SC-LDPC codes can be viewed as a sequence of LDPC block codes whose graph representations are coupled together over time, resulting in a convolutional structure with block-to-block memory. A remarkable property of SC-LDPC codes, established numerically in [10] and analytically in [11], [12], is that their iterative message passing decoding threshold is equal to the MAP decoding threshold of the underlying LDPC block code ensemble, a phenomenon known as threshold saturation. In other words, the (exponential complexity) MAP decoding performance of the underlying block code can be achieved by its coupled version with (linear complexity) message passing decoding.
Thus motivated to combine the threshold improvement of spatial coupling with the improved distance properties of generalized constraints, this paper proposes spatially coupled versions of GLDPC codes, denoted SC-GLDPC codes, and presents both asymptotic (threshold and distance) and finite-length analyses of SC-GLDPC code ensembles. A principle contribution of this paper is to extend the results of [13], [14], [15], [16] and present a unified treatment and analysis of SC-GLDPC codes. We first extend the threshold analysis of protograph-based SC-LDPC code ensembles in [10] to GLDPC code ensembles and use this to perform an iterative decoding threshold analysis of SC-GLDPC codes ensembles. This method is used to show numerically that threshold saturation is achieved for SC-GLDPC code ensembles, i.e., their thresholds coincide with the maximum a-posteriori (MAP) decoding threshold of the underlying GLDPC block code ensemble. 1 This is followed by a minimum distance analysis of terminated and tail-biting SC-GLDPC code ensembles and a free distance analysis of unterminated ensembles, both of which demonstrate that the ensembles are asymptotically good and have large distance growth rates. In order to study the finite-length scaling properties of SC-GLDPC code ensembles, a method to analyze the finite-length scaling behavior of GLDPC block codes over the binary erasure channel (BEC) with peeling decoding (PD) is first introduced. We then extend this approach to study SC-GLDPC code ensembles and demonstrate robust finite-length scaling performance.

II. PROTOGRAPH-BASED SC-GLDPC CODES
A protograph [19] is a small bipartite graph that connects a set of n v variable nodes V = {v 1 , v 2 , . . . , v nv } to a set of n c constraint nodes C = {c 1 , c 2 , . . . , c nc } by a set of edges E. The edges connected to a variable node v j of degree ∂(v j ) or a constraint node c i of degree ∂(c i ) are labeled by e v j,a or e c i,b , respectively, where a = 1, . . . , ∂(v j ) and b = 1, . . . , ∂(c i ). If the a-th edge associated with v j is the b-th edge associated with c i , then e v j,a = e c i,b . 2 In a protograph-based GLDPC code ensemble, each constraint node c i can represent an arbitrary block constraint code C i with parity-check matrix H c i , length n c i , and m c i linearly independent parity-check equations.
The design rate of the GLDPC code ensemble is then given by A protograph can be represented by means of an n c × n v bi-adjacency matrix B, which is called the base matrix of the protograph. The nonnegative integer entry B ij in row i and column j of B is equal to the number of edges that connect nodes c i and v j in the protograph. In order to construct ensembles of protograph-based GLDPC codes, a protograph can be interpreted as a template for the Tanner graph of a derived code, which is then obtained by a copy-and-permute or graph lifting operation [19]. In matrix form, the protograph is lifted by replacing each nonzero  ( If we suppose both the constraint nodes are (7,4) Hamming codes with parity-check matrix where the constraint code length is n c = 7 and the row rank of H c is m c = 3, then the resulting ensemble has design rate R = 1/7. Note that even though both constraints are defined by the same (7, 4) Hamming code, a different ordering of columns can be used. In Fig. 1, the column of H c that the variable node is connected to is shown on the edge.

A. Unterminated SC-GLDPC codes
An unterminated SC-GLDPC code can be described by a convolutional protograph [20] with base matrix where w denotes the syndrome former memory or coupling width of the code and the b c × b v component base matrices B i , i = 0, 1, . . . , w, represent the edge connections from the b v variable nodes at time t to the b c (generalized) constraint nodes at time t + i. An ensemble of (in general) time-varying SC-GLDPC codes can then be formed from B [0,∞] using the protograph construction method described above with lifting factor M . The decoding constraint length of the resulting ensemble is given by ν s = (w + 1)M b v , the design rate is given by and at each time instant t the encoder creates a block v t of M b v symbols resulting in the Starting from a b c ×b v base matrix B of a block code ensemble, one can construct SC-GLDPC code ensembles with the same variable and check node degrees as B. This is achieved by an edge spreading procedure [20] that divides the edges connected to each variable node in the base matrix B among w + 1 component base matrices B i , i = 0, 1, . . . , w, such that the condition We now give some examples of constructing SC-GLDPC code ensembles.
Example 2: For w = 1, we can apply the edge spreading technique to the (b c , b v ) = (2, 7)regular block code base matrix in (2) to obtain the following component base matrices The convolutional protograph associated with the resulting base matrix B [0,∞] defined in (4) (3) and that the constraint nodes c 1 and c 2 represent shortened codes.) After lifting, the constraint length of the resulting SC-GLDPC code ensemble is ν s = 14M and the design rate is R = 1/7.
We will refer to this SC-GLDPC code ensemble as Ensemble A 7 . An extension to the Ensemble ... To illustrate the flexibility of SC-GLDPC code designs, multiple edges can also be introduced in the block protograph. The protograph-based braided block code (BBC) ensembles considered in [21] are another example of SC-GLDPC code ensembles. These can be derived by using the Tanner graph of a tightly BBC [22] as a protograph. The component base matrices of such an SC-GLDPC code can be identified as where i = 1, . . . , w, e i = (0, . . . , 0, 1, 0, . . . , 0) is the length w vector with a one at the i th position and zeros elsewhere, 0 is the all-zero vector, and i the all-one vector, of length w. We   will use the term Ensemble C n c when referring to such SC-GLDPC code ensembles based on constraint codes of length n c = 2w + 1.
Example 4: For the (b c , b v ) = (2, 7)-regular GLDPC base matrix with (7, 4) Hamming constraint codes and design rate R = 1/7 from Example 1, the convolutional protograph resulting from the tightly BBC construction of (9) with w = 3, n c = 7, and m c = 3, corresponding to Ensemble C 7 , is illustrated in Fig. 4, where the upper constraint nodes correspond to the "horizontal constraints" and the lower constraint nodes correspond to the "vertical constraints" of the braided construction. Its girth is equal to eight, which follows from the structure of the array and is true for any SC-GLDPC code resulting from a tightly BBC protograph.
Observe that the sum of the component base matrices in (9) is equal to the base matrix B in (2) of the corresponding GLDPC code, i.e., the all-one matrix of dimension b c × b v = 2 × 7.
This reflects the fact that the graph in Fig. 4 can be obtained by repeating the GLDPC graph in where L is called the coupling length. The matrix B [0,L−1] is then the base matrix of a terminated SC-GLDPC code. The corresponding terminated convolutional protograph is slightly irregular, with lower constraint node degrees at both ends. This is illustrated for the A 7 ensemble of where m c denotes the (constant) number of independent parity checks associated with each constraint code and ∆ ≥ 0 accounts for a possible rate increase due to the shortened constraint ...
...  The generalized convolutional base matrix B [0,∞] can also be terminated using tail-biting [23], [24], resulting in the base matrix of a tail-biting generalized LDPC (TB-GLDPC) code ensemble. Here, for any λ ≥ w, the last b c w rows of the terminated parity-check matrix B [0,λ −1] are removed and added to the first b c w rows to form the λb c × λb v tail-biting parity-check matrix 4 We assume here the simplified case where each generalized constraint code is described by a parity-check matrix Hc with m c independent parity checks. Under this assumption, the rate formula in (1) for GLDPC block codes becomes R = 1 − bcm c /bv.
Note that, if w = 1 and λ = 1, the tail-biting base matrix is simply the original block code base matrix, i.e., B (1) in such a way preserves the design rate of the ensemble, i.e., tb has exactly the same degree distribution as the original block code base matrix B.

III. THRESHOLD ANALYSIS OF SC-GLDPC CODES
We assume belief propagation (BP) decoding, with log-likelihood ratios (LLRs) acting as messages. At every iteration , first all constraint nodes and then all variable nodes are updated.
The outgoing messages computed at a constraint node c i at iteration are then equal to is the LLR received at constraint node c i from the variable node connected to e c i,b at iteration , and we have partitioned C i into the sets C b,0 corresponds to the b-th extrinsic output generated by an optimal a posteriori probability (APP) decoder for component code C i , which is computed from the incoming messages L to constraint node c i . The incoming messages of the first iteration are initialized by the channel LLRs L ch (v j ) of the neighboring variable nodes, i.e., where v j is the variable node connected to e c i,b . The outgoing messages computed at a variable node v j at iteration are equal to where a, a ∈ {1, . . . , ∂(v j )}.

A. Density evolution for GLDPC code ensembles
For transmission over a binary erasure channel (BEC), the messages that are passed between the nodes represent either an erasure or the correct symbol values 0 or 1. In this case the BP decoder is particularly simple and exact density evolution can be described explicitly. Let . . , ∂(c i )}, denote the probabilities that the incoming messages to c i computed in the previous iteration are erasures. For a GLDPC code ensemble, where c i corresponds to an arbitrary block code, (15) can be replaced by the general expression where f C i b is a multi-dimensional input/output transfer function that characterizes the APP decoder that computes the messages L ( ) c (e c i,b ) corresponding to (13). Note that, for generalized codes, which implies that the ordering of edges can affect the performance of the ensemble. A method for computing explicit expressions for the APP decoder output distributions that can be used in (16) was presented in [25]. This method is based on a Markov chain analysis of the decoder metrics using a trellis representation of the block code C i .
The variable to check node message sent along edge e v j,a is an erasure if all incoming messages from the channel and from the other neighboring check nodes are erasures. Thus we have where a, a ∈ {1, . . . , ∂(v j )} and is the erasure probability of the BEC. The largest channel value for which (16) and (17) converge, denoted BP , is the threshold of the BP decoder for the GLDPC code ensemble.
B. Bounding MAP thresholds from above with BP extrinsic information transfer functions The extrinsic probability p BP,extr (v j , ) that a symbol associated with variable node v j remains erased after iterations of BP decoding can be expressed as Note that here the product is over all incoming messages to v j and the channel erasure probability does not appear in the expression but implicitly involved in the calculation of q ( ) (e v j,a ). The BP extrinsic information transfer (EXIT) function h BP ( ) [26] is given by the average of p BP,extr (v j , ) over all transmitted variable nodes v j . 6 Example 5: Consider the (2, 7)-regular protograph-based GLDPC block code ensemble with Hamming component codes of length n c = 7 from Example 1. The BP EXIT function h BP ( ) of this ensemble is shown in Fig. 6. The vertical line indicates the channel value at which the grey area below the curve is equal to the rate of the ensemble, which forms an upper bound MAP = 0.856 on the threshold of an optimal MAP decoder. This follows from the area theorem [27] and the fact that h BP ( ) can never be below the EXIT function of the MAP decoder. In this case, the calculated BP threshold is given by BP = 0.756, and we see that there exists a large gap between the BP and the MAP thresholds, which indicates the suboptimality associated with BP decoding. 7 2

C. Threshold saturation of terminated SC-GLDPC code ensembles
Assume now that we start encoding at time t = 0 and terminate after L time instants. As a result we obtain the terminated base matrix B [0,L−1] from (10). These terminated SC-GLDPC codes can be interpreted as GLDPC block codes that inherit the structure of convolutional codes.
The length of these codes depends not only on the lifting factor M but also on the coupling length L. For a fixed L, the BEC density evolution thresholds BP corresponding to codes with 6 Punctured nodes which are not transmitted are excluded. 7 A detailed analysis of unstructured irregular ensembles, including results on the tightness of this bound, can be found in [26]. For structured protograph ensembles, this technique has been applied in [28].  Fig. 8. Analogously to SC-LDPC codes (see [20]) with SPC constraints, it can be observed that, as L → ∞, the BP thresholds numerically coincide with the upper bounds on the MAP decoding thresholds of the underlying block code ensembles, thus exhibiting the threshold saturation phenomenon (see [10], [11]).
The BP EXIT functions of the terminated codes from ensemble A 7 are shown in Fig. 9, where it can be seen that, with increasing L, the BP and the MAP thresholds of the terminated SC-GLDPC code ensembles are converging. Moreover, the MAP thresholds (and hence the BP thresholds) of the terminated SC-GLDPC code ensemble can also be observed to converge to the MAP threshold MAP = 0.856 of the underlying GLDPC block code ensemble with increasing L.
We note that, while the numerical convergence of the BP thresholds of the terminated SC-GLDPC code ensemble to the MAP threshold of the underlying GLDPC block code ensemble implies threshold saturation in the conventional sense [11], the converging BP and MAP thresholds of the terminated SC-GLDPC codes is a stronger result. This implies that, asymptotically, BP decoding of SC-GLDPC codes provides optimal (MAP) decoding performance.
Further, we note that large values of L are realistic in conjunction with sliding window decoders, like those suggested in [29], where decoding delay and storage requirements depend on the window size W , which is independent of the coupling length L (typically W L) of the transmitted code sequences. For shorter values of L, which induce rate loss, BP decoding of terminated SC-GLDPC codes is suboptimal but still provides a flexible adjustment between code rate and threshold (see Fig. 8).

IV. DISTANCE ANALYSIS OF SC-GLDPC CODES
A. Minimum distance analysis of terminated SC-GLDPC codes In [30], Abu-Surra, Divsalar, and Ryan presented a technique to calculate the average weight enumerator and asymptotic spectral shape function for protograph-based GLDPC block code ensembles. The spectral shape function can be used to test if an ensemble is asymptotically good, i.e., if the minimum distance typical of most members of the ensemble is at least as large as δ min n, where δ min is the minimum distance growth rate of the ensemble and n is the block length.
Example 6: Consider the (2, 7)-regular GLDPC block code protograph with base matrix B from (2) and the generalized constraint nodes shown in Fig. 1. If we suppose the constraint codes to be (7, 4) Hamming codes with parity-check matrix H c from (3), then the resulting ensemble has design rate R = 1/7, is asymptotically good, and has growth rate δ min = 0.186 [30]. 2 We now consider the associated (2, 7)-regular terminated SC-GLDPC code ensembles A 7 discussed above in Sections II and III, whose protograph is shown in Fig. 2, with constraints corresponding to the (7, 4) Hamming code with parity-check matrix H c . After termination, the design rate of the ensemble is given by where ∆ = 2 in this case because the two leftmost (shortened) constraint nodes in Fig. 2 correspond to shortened codes with rate 1/3, i.e., the number of parity checks in these two constraint nodes is 2, while all the other constraint nodes have m c = 3 parity-checks. These ensembles were shown to have thresholds numerically indistinguishable from the MAP threshold of the underlying GLDPC block code ensemble as L → ∞ in Section III.
The evaluation of the asymptotic weight enumerators for SC-GLDPC codes is complex, since the conjecture regarding simplification of the numerical evaluation proposed in [30] cannot be applied to SC ensembles. This conjecture relies on grouping together nodes of the same type and optimizing them together. However, in the SC-GLDPC case, nodes from different time instants must be optimized separately, even if they are of the same type.  with coupling lengths L = 7, 8, 10, 12, 14, 16, 18, and 20. Also shown are the asymptotic spectral shape functions for "random" codes with the corresponding rates R L calculated using (see [1]) where H(δ) = −(1 − δ) ln(1 − δ) − δ ln(δ) is the binary entropy function. We observe that the SC-GLDPC code ensembles A 7 are asymptotically good and have relatively large minimum distance growth rates, ranging from about 25% to 65% of the (optimal) random coding growth rates. This indicates that long codes chosen from these ensembles have, with probability near one, a large minimum distance. As L increases, the design rate R L approaches R = 1/7 and the minimum distance growth rate decreases, as was also observed in the case of SC-LDPC codes with SPC constraints (see [20]).

B. Free distance analysis of SC-GLDPC code ensembles
In Fig. 10 we saw that the minimum distance growth rates of terminated SC-GLDPC codes decrease as the coupling length L increases. However, since SC-GLDPC codes can be decoded as unterminated (no preset coupling length) convolutional codes by employing a sliding window decoder, a more appropriate distance measure for assessing their ML decoding performance is DRAFT the free distance growth rate of the SC-GLDPC ensemble. In this section, we first calculate the minimum distance growth rates of TB-GLDPC code ensembles and show that, for sufficiently large coupling lengths, the growth rates coincide with those calculated for the terminated SC-GLDPC code ensembles in Section IV-A. We then show that the growth rates of the TB-GLDPC code ensembles and the terminated SC-GLDPC code ensembles can be used to obtain lower and upper bounds on the free distance growth rate of the unterminated SC-GLDPC code ensemble, respectively.

1) Minimum distance analysis of TB-GLDPC code ensembles:
We now consider terminating the protograph in Fig. 2 as a TB-GLDPC code with coupling length λ. Unlike the previous termination technique, this results in a (2, 7)-regular protograph with design rate R λ = 1/7 for all λ. The minimum distance growth rates of the TB-GLDPC code ensembles are presented in Fig. 11 alongside those corresponding to the terminated SC-GLDPC code ensembles. We observe that the TB-GLDPC growth rates remain constant at δ min = 0.186 (the growth rate of the original GLDPC block code ensemble) for λ = 1, 2, . . . , 8, and then begin to decay to zero as λ → ∞. Also, as a result of the convolutional structure, we observe that the TB-GLDPC and SC-GLDPC growth rates coincide for L, λ ≥ 10. This is the same behavior observed for TB-LDPC and SC-LDPC codes with SPC constraints [31].
2) Free distance bounds for SC-GLDPC code ensembles: Now consider an ensemble of periodically time-varying unterminated SC-GLDPC codes with rate R = 1 − b c m c /b v and period T constructed from a convolutional protograph with base matrix B [0,∞] (see (4)) as described in Section II-A. Using a modification of the proof techniques in [31], [32], we can show that the average free distance of this ensemble is bounded below by the average minimum distance of an ensemble of TB-GLDPC codes derived from the base matrix B Proof. There is a one-to-one relationship between members of the periodically time-varying unterminated SC-GLDPC code ensemble and members of the corresponding terminated SC-GLDPC code ensemble with coupling length L = T . For any such pair of codes, every codeword in the terminated SC-GLDPC code can also be viewed as a in the unterminated code. It follows that the free distance d  Since there is no danger of ambiguity, we will henceforth drop the overline notation when discussing ensemble average distance measures.
3) Free distance growth rates of SC-GLDPC code ensembles: For unterminated SC-GLDPC codes, it is natural to define the free distance growth rate with respect to the decoding constraint length ν s , i.e., as the ratio of the free distance d free to ν s . By bounding d free we observe that, for T ≥ 10, the upper and lower bounds coincide, indicating that, for these values of the period T , δ (T ) free = 0.805, significantly larger than the minimum distance growth rate δ min = 0.186 of the underlying GLDPC block code ensemble. 9 In addition, we note that, at the point where the upper and lower bounds on δ (T ) free coincide, the minimum distance growth rates for both termination methods also coincide. Recall that the TB-GLDPC code ensembles all have rate 1/7, wheras the rate of the SC-GLDPC code ensembles is a function of the coupling length L given by (19). This general technique can be used to bound the free distance growth rate above and below for any regular or irregular periodically time-varying protograph-based unterminated SC-GLDPC code ensemble.
While large free distance growth rates are indicative of good ML decoding performance, when predicting the iterative decoding performance of a code ensemble in the high SNR region other graphical objects such as trapping sets, pseudocodewords, absorbing sets, etc., come into effect. Based on results from the SPC case [31], we would expect SC-GLDPC codes with large minimum/free distance growth rates to also have large trapping set growth rates, indicating good iterative decoding performance in the high SNR region.

V. FINITE-LENGTH ANALYSIS OF GLDPC BLOCK AND SC-GLDPC CODES
To analyze the finite-length performance of LDPC codes over the BEC, a decoding method called peeling decoding (PD) can be employed [33]. PD is a simple algorithm that is initialized by removing all of the correctly received variable nodes, as well as their attached edges, from the Tanner graph of H after BEC transmission. The algorithm then iteratively removes degreeone check nodes from the graph, along with their attached variable nodes and edges. We now describe an extension of PD to GLDPC block and terminated SC-GLDPC codes, referred to as generalized peeling decoding (GPD). 9 Note that the free distance growth rate may also be calculated with respect to the encoding constraint length νe, which corresponds to the maximum number of transmitted symbols that can be affected by a single nonzero block of information digits. As a result of normalizing by the decoding constraint length, it is possible to have free distance growth rates larger than 0.5. For further details, see [31]. DRAFT

A. Type vectors and initialization of GPD
Recall that represents the set of edges in a given protograph. In the Tanner graph of a resulting lifted constraint matrix H (resp. H [0,L−1] ), we say that a particular edge is of type e v j,a if it connects a variable node and a constraint node that are copies of the two nodes that edge e v j,a connects in the protograph. For a variable node v in the Tanner graph of H (resp. H [0,L−1] ), we also define the variable node type by a binary |E|-dimensional vector t v , where each entry is a "1" iff a particular edge type is connected to variable node v. Similarly, for a constraint node c, we define its type by a binary |E|-dimensional vector t c . We denote the set of variable and constraint node types in the Tanner graph of H (resp. H [0,L−1] ) by F tv and F tc , respectively. Note that the sets F tv and F tc are determined from the connectivity of the protograph, as will be illustrated in Example 7 below. Finally, we let L tv and R tc represent the number of variable and constraint nodes of type t v and t c in H (resp. H [0,L−1] ), respectively.
The details of the GPD algorithm are presented in Section V-B. We first discuss GPD initialization, which is identical to PD initialization: the correctly received variable nodes of H (resp. H [0,L−1] ) and their attached edges are removed from the graph. After initialization, the residual graph contains constraint nodes with types that are not included in F tc , the set of constraint node types in the original graph, but the set of variable node types F tv remains the same. We now define D(t c ) as the set of constraint node types that can appear in the graph of H (resp. H [0,L−1] ) after GPD initalization when a constraint node of type t c ∈ F tc loses one or more edges. The extended set of all possible constraint node types which are present in the residual graph after GPD initialization is then given by F tc = tc∈F tc D(t c ). then the type vector for c 1 is t c 1 = (1, 1, . . . , 1, 0, 0, . . . , 0) ∈ F tc and the type vector for c 2 is t c 2 = (0, 0, . . . , 0, 1, 1, . . . , 1) ∈ F tc . 10 Both vectors are of length |E| = 14, the number of edges in the protograph, and have weight n c = 7, the length of the constraint code. In any lifted graph with lifting factor M , there are precisely M copies of each edge, variable node, or constraint node of a given type, where the types are defined from the protograph as described above.
Corresponding to each of the constraint node types in this example, 2 7 = 128 residual types can appear in the graph when edges are removed. Thus, in total, F tc contains 256 constraint node types. 2 According to the above definitions, the expected degree distribution (DD) of the residual graph after initialization can be expressed as follows: for t v ∈ F tv and t c ∈ F tc , where L tv (0) (resp. R t c (0)) represents the number of variable (resp. constraint) nodes of type t v (resp. t c ) after GPD initialization and |t c | (resp. |t c |) is the weight of the vector t c (resp. t c ).

B. Decodable constraint nodes and the GPD
In general, each constraint node type in the protograph B (resp. B [0,L−1] ) of a GLDPC code can be associated with a different constraint code. Let C tc be the constraint code associated with the constraint nodes in the base matrix B (resp. B [0,L−1] ) of type t c ∈ F tc . By extension, each constraint node in the graph of H (resp. H [0,L−1] ) is associated with a constraint code according to its type. After GPD initialization, the type of a given constraint node can be modified from t c to t c , where |t c | < |t c |, and we say that t c is the input erasure pattern seen by the constraint code C tc . The question now is if, by decoding the constraint code C tc associated with a constraint node of type t c in the residual graph using a given decoding algorithm, for instance ML decoding or some suboptimal algorithm, we are able to recover the |t c | variables still connected to the constraint node. In general, for each constraint code C tc , only a subset of input erasure patterns can be decoded. This subset is denoted by A(t c ) ⊂ D(t c ). If a constraint node in the residual graph is of type t c ∈ A(t c ), then we say it is a decodable constraint node and t c a decodable constraint node type. For example, if all the constraint codes are SPCs, then only constraint node types with input erasure patterns containing exactly one erasure are decodable. However, if the constraint code is a (7,4) Hamming code with ML decoding, then all input erasure patterns with one and two erasures and some input erasure patterns of weight three are decodable.
The set of all decodable constraint node types is defined as A .
= ∪ tc∈F tc A(t c ) ⊂ F tc . Given the discussion above, the GPD algorithm can now be seen as a straightforward extension of PD for LDPC codes to GLDPC codes. After the graph is initialized, GPD chooses one constraint node at random from the graph that is decodable. This constraint node, all connected variable nodes, and all attached edges are then removed from the graph. GPD continues in this way until there are no further constraint nodes that can be removed from the graph, which corresponds to a decoding failure, or until there are no variable nodes left in the graph, which corresponds to successful decoding.

C. Expected graph evolution
We now define the normalized DD at time τ as where is the GPD iteration index, R tc (τ ) (resp. L tv (τ )) is the number of constraint (resp. variable) nodes in the graph of type t c (resp. t v ) at time τ , and n = M b v (resp. M b v L) is the block (resp. termination) length. Following the methodology developed in [33] to analyze the BEC finite-length performance of LDPC block codes, we can investigate the BEC finite-length performance of GLDPC codes by analyzing the statistical evolution of the normalized DD in (26) during the decoding process. As shown in [33], the expected value of r tc (τ ) and l tv (τ ), denoted byr tc (τ ) andl tv (τ ), respectively, can be computed as the solution to the following system of differential equations: i.e., the derivative ofr tc (τ ) w.r.t. τ in (28) can be evaluated by computing the variation in the number of constraint nodes of type t c with GPD iteration given that the normalized DD at time τ is at its mean {l tv (τ ),r tc (τ )} tv∈F tv ,tc∈F tc . A similar interpretation holds for (27). Further, the solution to (27) and (28) is unique and, with probability 1 − O(e − √ n ), any particular realization of the normalized DD in (26) deviates from its mean by a factor of less than n −1/6 for the initial conditionsr which can be computed from (24) and (25) [33]. The actual computation of the expectations in (27) and (28) is described in [15]. The GPD threshold is defined as the maximum value of for which the expected fraction of decodable constraint nodeŝ is positive for any τ ∈ [0, ), whereâ(τ ) is the mean of the random process Finally, we can compute the expected fraction of variable nodes in the graph at any time τ , denoted byv(τ ), asv In addition to characterizing the asymptotic behavior, i.e., to computing the GPD threshold ensemble, the solution to the system of equations given by (27) and (28) can be used to determine the quantities needed to assess the finite-length performance of GLDPC block and terminated SC-GLDPC codes. We refer to critical points as the points in time for whichâ(τ ) has a local minima.
As shown in [33], the average (over the ensemble of codes) error probability is dominated by the probability that the process a(τ ) survives, i.e., does not go to zero around the critical points.
Therefore, characterizing the critical points and the expected fraction of decodable constraint nodes in the graph at those points in time are the parameters needed to determine the GLDPC block or terminated SC-GLDPC code finite-length performance, and they can be computed from (27) and (28).

D. Numerical results: GLDPC block codes
With the tools described above, we can now investigate the asymptotic and finite-length performance of GLDPC code ensembles. We start by considering the uncoupled (2, 7)-regular GLDPC block code ensemble from Example 1. Example 8: Consider the (2, 7)-regular GLDPC block code ensemble of Example 1. Assume that a (7, 4) Hamming code is associated with each of the two constraint nodes and that the constraint codes are decoded using ML decoding. The design rate of this ensemble is R = 1/7.
All constraint node types with one or two erasures can be decoded, as well as some constraint node types with three erasures. Fig. 12 shows the evolution of the expected fraction of decodable constraint nodesâ(τ ) versus the expected fraction of variable nodesv(τ ) in the graph for different values. 11 We also include a set of 10 simulated trajectories of a(τ ) for = 0.69 to demonstrate that they concentrate around the predicted mean. Note first thatâ(τ ) has a single critical point atv(τ * ) ≈ 0.43. Indeed, we can compute the threshold * as the maximum value of for which the minimum is exactly zero, and in this case we obtain * ≈ 0.7025.
The finite-length error probability is dominated by the statistics of a(τ ) around τ * . Following 11 Note that the time variable τ runs backwards in this figure (right to left), in the sense that small values of τ correspond tov(τ ) on the right, where the graph still contains a relatively large fraction of variable nodes, whereas large values of τ correspond to small values ofv(τ ) on the left. [33], for each n and pair, we can estimate the finite-length error probability as whereâ(τ * ) is the expected value of a(τ ) at τ * and Var[a(τ * )] represents its variance.â(τ * ) was computed using numerical integration of the system of differential equations in (27)-(28), and Var(a[τ * ]) was estimated using Monte Carlo simulation. 12 Also in [33], the authors showed that the ratio of the expected number of degree-one constraint nodes to the standard deviation at the critical point approximately scales as α √ n( * − ), where α is a scaling parameter that only depends on the DD. In the GLDPC case, simulated trajectories for a(τ ) suggest that the same scaling holds and that the performance for any pair (n, ) can be estimated as After computingâ(τ * )/ Var(a(τ * )) for a given (n, ) pair, we estimate α by equating the arguments in (34) and (35), so that .
For the (2, 7)-regular GLDPC block code ensemble with (7, 4) Hamming constraint codes and an ML decoder, we thus obtain α = 1.8024. In Fig. 13, we plot the simulated performance versus (35), where we observe that the estimate is very accurate for a sufficiently large lifting factor. 2

E. Numerical results: SC-GLDPC codes
We now investigate the asymptotic and finite-length performance of a terminated version of the coupled A 7 SC-GLDPC code ensemble from Example 2.
Example 9: Following a similar procedure as in Example 8, we now analyze the finite-length behavior of terminated SC-GLDPC codes. In Figure 14, we show the evolution of the expected fractionâ(τ ) of decodable check nodes during iterations of the GPD for a terminated version of the A 7 SC-GLDPC code ensemble of Example 2 (corresponding to the GLDPC block code ensemble of Example 1) with coupling lengths L = 50, 100, and 150, lifting factor M = 1000, and a channel parameter = 0.75. Also included is a set of simulated decoding trajectories 12 Var(a[τ * ]) can be obtained from the solution of the covariance evolution system of differential equations, first presented in [33] for LDPC code ensembles  of a(τ ), computed for L = 150. Unlike the GLDPC block code, the expected evolutionâ(τ ) displays a constant critical phase that corresponds to a decoding wave traveling towards the central positions of the graph. Further, the critical valueâ(τ * ) during such a phase does not depend on L, and the length of the critical phase is roughly proportional to L. The threshold * is given by the maximum value of for which the critical value is exactly zero, and in this case we obtain * = 0.8. 13 Similar effects were first described in [34] for (non-generalized) terminated SC-LDPC codes.
As also suggested in [34], using simulated decoding trajectories we should observe that Var[a(τ )] is fairly flat during the critical phase and that the covariance CoVar[a(τ ), a(ξ)] decays exponentially fast with |τ − ξ|, with a rate of decay that we denote by θ. Fig. 15 demonstrates that this is indeed the case. In Fig. 15(a), we show the empirical variance of the process a(τ ) computed from 500 simulated trajectories with L = 100 and M = 2000. In Fig. 15(b), we show the empirical covariance CoVar[a(τ ), a(ξ)] of the process obtained from the same set of simulations, where the covariance is normalized by Var[a(ξ)] so that the maximum value is equal to one. Observe that an exponentially decaying function provides an accurate estimate of the normalized covariance, in which the parameter θ = 0.87 was obtained by a least squares fit.
Based on this evidence, the survival probability of the a(τ ) process during the critical phase follows a scaling law of the same form as the one proposed in [34], and thus the block error probability P Block can be estimated as where Φ(z) is the c.d.f. of the standard Gaussian distribution, N (0, 1), L is the length of the critical phase, and, as in the uncoupled case, α √ M ( * − ) corresponds to the ratio of the expected number of decodable constraint nodes during the critical phase to the standard deviation of a(τ ).
Both θ and α are parameters that depend on the underlying GLDPC block code and the edge spreading. Given the results in Fig. 14 and Fig. 15, we estimate that α ≈ 5.66. 13 The threshold * = 0.8 computed here for GPD differs from the value * ≈ 0.85 obtained earlier for the terminated A7 ensemble with L = 150 (see Fig. 8) due to a difference in the method of decoding the constraint codes (ML decoding in this example vs. BCJR decoding in Fig. 8). If we change the component decoder from ML to BCJR, the scaling law in (37) that predicts the finite-length performance of the SC-GLDPC code will be the same, but with different scaling parameters. Var[a(ξ)] so that the maximum value is equal to one. Fig. 16 shows a comparison between the simulated performance (solid lines) and estimated error probability using (37) (dashed lines) for the terminated A 7 SC-GLDPC code ensemble with L = 50 and (7, 4) Hamming constraint codes decoded with ML decoding. We again note that, as the lifting factor M increases, the performance estimate becomes very accurate. 14 We also show the corresponding results for the uncoupled (2, 7)-regular GLDPC block code ensemble of Fig. 1 with ML-decoded (7, 4) Hamming constraint codes and comparable lifting factors.
Besides the advantage enjoyed by the SC-GLDPC codes in decoding threshold, we see that they also exhibit better finite-length scaling behavior than GLDPC block codes, in the sense that their performance converges more quickly to the threshold.

VI. CONCLUDING REMARKS
Generalized LDPC (GLDPC) codes can offer significant performance improvements when compared to LDPC codes with SPC constraints at the expense of a modest increase in decoding complexity (depending on the particular constraint codes and decoders chosen), albeit with the advantage of a typically smaller number of message passing iterations. In this paper, we presented a comprehensive study of spatially coupled generalized LDPC (SC-GLDPC) codes, including both asymptotic and finite-length analyses. Specifically, terminated SC-GLDPC code ensembles were shown to achieve threshold saturation with near-capacity iterative decoding thresholds, thus assuring SC-GLDPC codes of having better waterfall performance than their underlying GLDPC block codes. They were also shown to be asymptotically good and to possess large minimum distance growth rates, thus assuring them of also having excellent error floor performance. Finally, terminated SC-GLDPC codes were shown to outperform their GLDPC block code counterparts in the finite length regime. Based on these results, we believe SC-GLDPC codes are an attractive choice for applications requiring excellent performance throughout the entire range of decoded error rates with a limited number of decoding iterations. DRAFT November 1, 2019