protocol against Gaussian attacks. In particular, the secret key rate for the symmetrized protocol is equal to the secret key rate against Gaussian attacks [@HL07; @SAA07].

Although the variational distance between the $Q$-functions is a weaker criterion than the usual trace distance between the states, one can argue that this distance makes sense when considering CV QKD protocols. Indeed, if two states have $2\epsilon$-close $Q$-functions (for the variational distance), it means that the probability to successfully distinguish them using heterodyne detection is bounded by $1/2+\epsilon$.

Sampling from the Haar measure on $K(n)$ for $n$ large might be quite unpractical. Methods to achieve it in complexity $O(n^2)$ are known [@LG11; @JKL11]. Fortunately, for our purpose, it is sufficient to sample from the different measure on $K(n)$ provided that the symmetrized state can be made arbitrary close to the state $\mathcal{S}\left( \rho^{\otimes n}\right)$ of Eq. \[symm\_state\]. This can be achieved by means of quantum $k$-designs as presented in Appendix \[design\]. In particular, it is reasonable to conjecture that this can be done in complexity $O(n \log n)$, which would be compatible with a practical implementation.

One could wonder why the symmetrization has to be *active* here in contrast to protocols such as 