  Continuous-variable quantum key distribution exploits coherent measurements
of the electromagnetic field, i.e., homodyne or heterodyne detection. The most
advanced security proofs developed so far relied on idealised mathematical
models for such measurements, which assume that the measurement outcomes are
continuous and unbounded variables. As physical measurement devices have finite
range and precision, these mathematical models only serve as an approximation.
It is expected that, under suitable conditions, the predictions obtained using
these simplified models are in good agreement with the actual experimental
implementations. However, a quantitative analysis of the error introduced by
this approximation, and of its impact on composable security, have been lacking
so far. Here we present a theory to rigorously account for the experimental
limitations of realistic heterodyne detection. We focus on collective attacks,
and present security proofs for the asymptotic and finite-size regimes, the
latter within the framework of composable security. In doing this, we establish
for the first time the composable security of discrete-modulation
continuous-variable quantum key distribution in the finite-size regime. Tight
bounds on the key rates are obtained through semi-definite programming and do
not rely on a truncation of the Hilbert space.
