#  Continuous-Variable QKD with key rates far above Devetak-Winter

Arpan Akash Ray  TU Eindhoven, The Netherlands  Boris Škorić  TU Eindhoven,
The Netherlands

###### Abstract

Continuous-Variable Quantum Key Distribution (CVQKD) at large distances has
such high noise levels that the employed error-correcting codes must have very
low rate. In this regime it becomes feasible to implement random-codebook
error correction, which is known to perform close to capacity.

We propose a random-codebook reverse reconciliation scheme for CVQKD that is
inspired by spread-spectrum watermarking. Our scheme has a novel way of
achieving statistical decoupling between the publicly sent reconciliation data
and the secret key. We provide a theoretical analysis of the secret key rate
and we present numerical results. The best performance is obtained when the
message size exceeds the mutual information $I(X;Y)$ between Alice and Bob’s
measurements. This somewhat counter-intuitive result is understood from a
tradeoff between code rate and frame rejection rate, combined with the fact
that error correction for QKD needs to reconcile only random data. We obtain
secret key lengths that lie far above the Devetak-Winter value
$I(X;Y)-I(E;Y)$.

##  1 Introduction

###  1.1 Error correction in Continuous-Variable QKD

Continuous-Variable Quantum Key Distribution (CVQKD) is a variant of QKD that
works with weak coherent states and quadrature measurements. It is an
attractive QKD variant because of its cost-effectiveness, which is due to the
use of standard telecom equipment.

In Discrete-Variable QKD (DVQKD), propagation of light over long distances
causes photon loss, which leads to non-detection events at the receiver side.
The loss is very easy to deal with: the event is simply discarded. In CVQKD,
in contrast, a quadrature observation always results in a measurement outcome.
The loss of photons causes a deterioration of the signal-to-noise ratio (SNR)
at the receiver’s side. The extremely low SNR has to be dealt with by using
high-performance error correcting codes. Various codes have been considered
for CVQKD. Popular types of code are LDPC codes [1, 2, 3, 4, 5], Turbo codes
and Polar codes [6, 7], all of which approach the Shannon limit. (See [8] for
an overview.) In QKD it is important not only to be able to correct the
errors, but also to do it in real time. This is a particularly tough challenge
for the decoding step, which is the most computationally demanding. LDPC
decoding, for instance, at low rate needs many iterations which cannot be done
in parallel.

###  1.2 Contribution

We propose a reverse reconciliation scheme for long-distance CVQKD. Our scheme
is essentially random codebook error correction. The codewords are random
sequences. Bob performs a modular addition on his measurement sequence $Y$ and
a randomly chosen codeword, and sends the result to Alice, who then tries to
reconstruct the codeword from this data and her own sequence $X$. Alice does a
binary Neyman-Pearson test for each candidate codeword from the codebook. She
rejects unless there is exactly one candidate on the right side of the decsion
threshold. The use of random codebooks is motivated by two observations: (i)
random codebooks get close to the Shannon limit; (ii) at the very low rates
dictated by long-distance CVQKD, the number of codewords in a code is limited
and it becomes feasible to actually implement a random codebook.

In information reconciliation it is advantageous to work with ‘decoupled’
error correction data, i.e. data that is statistically independent from the
secret that Alice and Bob establish. We achieve decoupling by first mapping
Bob’s measurements, which are Gaussian-distributed, to uniform variables on
the interval $(0,1)$ and then adding these values (modulo 1) to the random
codeword entries which are also uniform on $(0,1)$. In Discrete Variable QKD
the equivalent would be to XOR a binary codeword into a binarisation of $Y$.
Our decoupling technique is more versatile than the octonion-based approach of
Leverrier et al [9], and avoids their ‘no go theorem’ that allows only
$8$-dimensional subspaces. Furthermore, our processing of $Y$ retains distance
information that is lost in common techniques like bit slicing [10] and Gray
coding.

We present a theoretical analysis of our scheme as well as numerical results,
working with Gaussian modulation for simplicity and ignoring detector
inefficiency and electronic noise. We focus on small values of the
transmission parameter. Having the option of accepting/rejecting yields an
expression for secret key rate of the form

$P_{\rm acc}\Big{[}\gamma\cdot\big{(}1-h({\rm BER})\big{)}\cdot
I(X_{i};Y_{i})-I(E_{i};Y_{i})\Big{]}.$ (1)

Here $P_{\rm acc}$ is the accept probability, $X_{i}$ is Alice’s $i$’th
quadrature value, $Y_{i}$ is Bob’s corresponding quadrature, $E_{i}$ is Eve’s
quantum system, $I$ stands for mutual information, $h$ is the binary entropy
function, BER is the bit error rate in the accepted blocks, and $\gamma$
represents the rate of our error-correcting code relative to the channel
capacity $I(X_{i};Y_{i})$. It turns out that the highest key rate is obtained
by setting $\gamma>1$, even though this causes a high frame reject rate (low
$P_{\rm acc}$). Setting $\gamma>1$ is allowed because in QKD Bob does not need
to send a predetermined message to Alice; Bob and Alice only have to agree on
a joint noise-free random string, which they can achieve even when the frame
reject rate is close to 100%. (Using a code for CVQKD at a rate above capacity
is a known option [11].)

Notably, the key rate obtained in this way can lie above the Devetak-Winter
value $I(X_{i};Y_{i})-I(E_{i};Y_{i})$ which is often treated as a de facto
upper bound on the secret key rate. The difference grows large if Alice can
increase the laser power without causing problematic noise levels on Bob’s
side. Though surprising, the above-Devetak-Winter result is not mysterious.
The security proof which shows that CVQKD key length $I(X;Y)-I(E;Y)$ is safe
to use also predicts, when adapted to the existence of an accept/reject
mechanism, that (1) is a safe to use key rate for any choice of $\gamma$.

Implementations of our scheme are necessarily brute-force, with limited
opportunity for tricks to improve the computational load of decoding.
Fortunately, the computation of Neyman-Pearson scores lends itself to
massively parallel computation; hence we are cautiously optimistic about the
feasibility of realtime implementation.

The outline of the paper is as follows. Section 2 contains preliminaries. In
Section 3 we give the details of the proposed scheme. In Section 4 we analyse
the scheme, computing statistical properties of the Neyman-Pearson scores and
determining the key rate. Numerical results are presented in Section 5. In
Section 6 we discuss implementation options, and Section 7 ends with
concluding remarks.

##  2 Preliminaries

###  2.1 Notation and terminology

Stochastic variables are written in capital letters, and their numerical
values in lowercase. The notation ${\rm Pr}[X=x]$ stands for the probability
that the random variable $X$ takes value $x$. The expectation over $X$ is
defined as ${\mathbb{E}}_{x}f(x)=\sum_{x}{\rm Pr}[X=x]f(x)$. The Shannon
entropy of a random variable $X$ is denoted as ${\sf H}(X)$. We write $h$ for
the binary entropy function, $h(p)=p\log\frac{1}{p}+(1-p)\log\frac{1}{1-p}$.
The notation ‘log’ is always base 2, and ‘ln’ is the natural logarithm. We
measure all entropies in bits. The mutual information between $X$ and $Y$ is
written as $I(X;Y)$. The entropy of $Y$ given $X$ is written as ${\sf
H}(Y|X)={\mathbb{E}}_{x}{\sf H}(Y|X=x)$.

A quantum state is described by a density matrix $\rho$. We write $S(\rho)$
for the von Neumann entropy of $\rho$. Consider a joint classical-quantum
state of a classical random variable $Y$ and a quantum system E that is
correlated with $Y$. The von Neumann entropy of the quantum system given $Y$
is denoted as $S(E|Y)={\mathbb{E}}_{y}S(E|Y=y)$. The mutual information
between E and $Y$ is $I(E;Y)=S(E)-S(E|Y)$. In CVQKD the following function
often occurs in the calculation of entropies,

$g(x)\stackrel{{\scriptstyle\rm def}}{{=}}(x+1)\log_{2}(x+1)-x\log_{2}x.$ (2)

As the figure of merit of a CVQKD scheme we use the Secret Key Ratio (or
simply key ratio), which equals the length of the constructed secret key
divided by the number of laser pulses. This is different from the key rate
(key bits per second). With the key ratio it is possible to do a fair
comparison between post-processing schemes of CVQKD setups that have a
different number of pulses per second. Note that we do not take into account
any pulses that are used solely for channel monitoring.

###  2.2 CVQKD with Gaussian modulation, homodyne detection and one-way
reverse reconciliation

We briefly review the main facts about the secret key capacity in CVQKD. We
restrict ourselves to the case of Gaussian modulation, since this will
simplify the analysis. We consider the usual attacker model: Eve is allowed to
manipulate the quantum states that Alice sends to Bob, but she cannot access
or influence their laboratories. In particular, Eve has no influence on Bob’s
electronic noise (‘trusted noise’). We will neglect electronic noise. Alice
and Bob can communicate over a classical channel that is noiseless, insecure,
and authenticated.

Alice draws random variables $A_{1},A_{2}\in{\mathbb{R}}$ from a Gaussian
distribution with zero mean and variance $\sigma_{X}^{2}$. She prepares a
coherent state with displacement $(A_{1},A_{2})$ and sends it to Bob. Bob
randomly measures one of the two quadratures. This procedure is repeated $n$
times. Bob’s measurement outcomes are denoted as $Y\in{\mathbb{R}}^{n}$.
Alice’s displacement components that match Bob’s choice of quadratures are
denoted as $X\in{\mathbb{R}}^{n}$.

Alice and Bob monitor the noise in the quantum channel. The channel can be
entirely characterised by two parameters [12]: the attenuation $T$ and the
excess noise parameter $\xi$. It holds that $y_{i}=\sqrt{T}x_{i}+N_{\rm
shot}+N_{\rm exc}$ where $N_{\rm shot}$ is shot noise, Gaussian with zero mean
and variance $\frac{1}{2}$, and $N_{\rm exc}$ is excess noise, Gaussian with
zero mean and variance $T\xi/2$. The variance of $Y_{i}$ is

$\sigma_{Y}^{2}=T\sigma_{X}^{2}+\frac{1}{2}+\frac{1}{2}T\xi\quad\quad\quad\sigma_{Y|X}^{2}=\frac{1}{2}+\frac{1}{2}T\xi.$
(3)

Bob informs Alice of his quadrature choices. Bob generates a secret key
$K\in{\mathcal{K}}$, which typically is a hash of some $U$, where $U$ is an
error-correction codeword or a discretisation of $Y$. He computes information
reconciliation data $P$ and sends $P$ to Alice. Typically $P$ contains a seed
for the hash and e.g. the syndrome of the discretised $Y$, or a codeword
xor’ed into $Y$. From $X$ and $P$ Alice reconstructs $K$ by first
reconstructing $U$ and then hashing $U$ with the provided seed.

The maximum achievable size of $K$, in bits, divided by $n$ is called the
secret key capacity. It has been shown [13] that the secret key capacity for
Gaussian modulation and one-way reverse reconciliation is bounded as

$C_{\rm secr}^{\rm Gauss}\geq I(X_{i};Y_{i})-I(Y_{i};E_{i}).$ (4)

The mutual information between the classical $X_{i}$ and $Y_{i}$ follows from
the signal-to-noise ratio,

$I(X_{i};Y_{i})=\frac{1}{2}\log(1+\frac{T\sigma_{X}^{2}}{\sigma_{Y|X}^{2}}).$
(5)

In long-distance CVQKD we have $T\ll 1$. In theory it can be advantageous to
work with high laser power $\propto\sigma_{X}^{2}$, but in practice this
causes phase noise [14], which manifests as excess noise. In order to avoid
such problems we will only consider the regime where $T\sigma_{X}^{2}\ll 1$
and furthermore $\xi\ll\sigma_{X}^{2}$. In this regime, (5) can be
approximated as

$I(X_{i};Y_{i})=T\sigma_{X}^{2}\log e+{\mathcal{O}}(T^{2}).$ (6)

The mutual information $I(Y_{i};E_{i})=S(E_{i})-S(E_{i}|Y_{i})$ follows from
the symplectic eigenvalues $\nu_{1},\nu_{2}$ of Eve’s pre-measurement state
$\rho^{E_{i}}$ and the symplectic eigenvalue $\nu_{3}$ of the (homodyne) post-
measurement state $\rho^{A_{i}}_{y_{i}}$ [12].

$I(Y_{i};E_{i})=g(\frac{\nu_{1}-1}{2})+g(\frac{\nu_{2}-1}{2})-g(\frac{\nu_{3}-1}{2}),$
(7)

with $g$ the thermal entropy function as defined in Section 2.1 and

$\displaystyle\nu^{2}_{1,2}$ $\displaystyle=$
$\displaystyle\frac{\Delta\pm\sqrt{\Delta^{2}-4D}}{2}$ (8)
$\displaystyle\Delta$ $\displaystyle\stackrel{{\scriptstyle\rm def}}{{=}}$
$\displaystyle V^{2}+[2\sigma_{Y}^{2}]^{2}-2T(V^{2}-1)$ (9) $\displaystyle D$
$\displaystyle\stackrel{{\scriptstyle\rm def}}{{=}}$
$\displaystyle\Big{[}V\cdot 2\sigma_{Y}^{2}-T(V^{2}-1)\Big{]}^{2}$ (10)

where $V=1+2\sigma_{X}^{2}$, and

$\nu_{3}^{2}=V\Big{[}V-\frac{T(V^{2}-1)}{2\sigma_{Y}^{2}}\Big{]}.$ (11)

In the limit $T\sigma_{X}^{2}\ll 1$, $\xi\ll\sigma_{X}^{2}$ the mutual
information $I(Y_{i};E_{i})$ behaves as

$I(Y_{i};E_{i})=T\sigma_{X}^{2}\cdot\sigma_{X}^{2}\log\frac{1+\sigma_{X}^{2}}{\sigma_{X}^{2}}+{\mathcal{O}}(T^{2}).$
(12)

The actual key ratio of a CVQKD protocol in practice equals
$\frac{\log|{\mathcal{K}}|}{n}$ multiplied by the success probability of the
error correcting code (1 minus the frame rejection rate $P_{\rm rej}$). The
key ratio is limited by the efficiency $\beta$ of the employed error-
correction code ($\beta<1$) and by the leakage caused by the reconciliation
data $P$,

$R_{\rm key}=(1-P_{\rm rej})\frac{\beta I(X;Y)-I(U;PE)}{n}.$ (13)

A high key ratio is obtained by using a highly efficient error-correcting code
and leakage-free reconciliation data. Good codes for CVQKD achieve
$\beta\approx 0.95$ to $0.99$. Leakage-free reconciliation data is achieved
either by sending a one-time-pad-encrypted syndrome or by the trick described
below in Section 2.3.

###  2.3 Decoupled reconciliation data

######  Lemma 2.1 (Lemma 1 in [9]).

Let $U$ and $P$ be independent classical random variables. Let $E$ be a
quantum system. Then $I(U;PE)\leq I(UP;E)$.

######  Corollary 2.2 (Adapted from [9] to the case of reverse
reconciliation).

Let $X$ and $Y$ be the measurement result of Alice and Bob respectively. Let
$E$ be Eve’s quantum system. Let $U$ be a secret chosen by Bob, independent of
$Y$. Let $P$ be public information reconciliation data computed from $Y$ and
$U$, such that Alice is able to reconstruct $U$ from $P$ and $X$. Let $P$ be
statistically independent from $U$. Then

$I(U;PE)\leq I(Y;E).$ (14)

Proof: Lemma 2.1 gives $I(U;PE)\leq I(UP;E)$. Since $P$ is computed from $U$
and $Y$, it holds that ${\sf H}(UP)\leq{\sf H}(UY)$ and $I(UP;E)\leq I(UY;E)$.
Finally, we use that Bob chooses the $U$ independently of $Y$, which allows us
to write $I(UY;E)=I(Y;E)$. $\square$

Substitution of (14) into (13) gives

$R_{\rm key}^{\rm(decoupled)}\geq(1-P_{\rm FE})\Big{\\{}\beta
I(X_{i};Y_{i})-I(Y_{i};E_{i})\Big{\\}}$ (15)

which provides a particularly easy way to evaluate the key ratio of a
protocol. In [9] the decoupling of $C$ from $U$ is achieved by taking
8-dimensional subspaces and using the algebraic properties of octonions.

###  2.4 Key establishment from classical noisy channels

######  Definition 2.3 (Def. 2 in [15]).

Let $(X,Y,Z)$ be jointly distributed classical variables, where Alice holds
$X$, Bob holds $Y$, and Eve holds $Z$. Consider a sequence of experiments
generating $XYZ$ many times independently. The secret key rate of $X$ and $Y$
with respect to $Z$, denoted as $S(X;Y||Z)$, is the maximum rate at which
Alice and Bob can agree on a secret key, with public discussion, while keeping
the rate at which Eve obtains information about this key arbitrarily small.

######  Lemma 2.4 (Theorems 5 and 6 in [15]).

The secret key rate of $X$ and $Y$ with respect to $Z$ is bounded as

$\displaystyle S(X;Y||Z)$ $\displaystyle\geq$
$\displaystyle\max\Big{[}I(Y;X)-I(Z;X),\;I(X;Y)-I(Z;Y)\Big{]}$ (16)
$\displaystyle S(X;Y||Z)$ $\displaystyle\leq$
$\displaystyle\min\Big{[}I(X;Y),\;I(X;Y|Z)\Big{]}.$ (17)

The capacity lower bound (4) for the case where $Z$ is a quantum system has
the same form as (16).

###  2.5 Useful lemmas

######  Lemma 2.5.

Let $X_{1},\cdots,X_{n}$ be Gaussian random variables with mean $\mu_{i}$ and
unit variance. The distribution of the variable $Z=\sum_{i=1}^{n}X_{i}^{2}$ is
the noncentral chi-square distribution with $n$ degrees of freedom and
noncentrality parameter $\lambda=\sum_{i=1}^{n}\mu_{i}^{2}$. The expected
value of $Z$ is $n+\lambda$, and the variance is $2n+4\lambda$. The cumulative
distribution of $Z$ is given by
$F_{Z}(z)=1-Q_{\frac{n}{2}}(\sqrt{\lambda},\sqrt{z})$, where $Q$ is the Marcum
Q-function.

######  Lemma 2.6 (Adapted111 Temme presents the Q-function in a slightly
different form, $Q_{\mu}(\sqrt{2r},\sqrt{2s})$.  from Eq.(4.3) in [16]).

Let $\mu\in[0,\infty)$. In the limit of large arguments the Marcum Q-function
asymptotically converges to an expansion of the form

$\displaystyle Q_{\mu}(r,s)$ $\displaystyle\sim$ $\displaystyle\frac{1}{2}{\rm
Erfc}(-\chi)+\frac{\exp(-\chi^{2})}{\sqrt{2\pi
rs}}\sum_{j=0}^{\infty}c_{2j}\frac{\Gamma(j+\frac{1}{2})}{\Gamma(\frac{1}{2})}(\frac{2}{rs})^{j}$
(18) $\chi=\sqrt{\frac{1}{2}(r^{2}+s^{2})-\sqrt{r^{2}s^{2}+\mu^{2}}+\mu({\rm
arsinh}\frac{\mu}{rs}-\ln\frac{s}{r})}$ (19)

where the coefficients $c_{2j}$ are complicated functions of $\mu,r,s$.

######  Lemma 2.7 (Neyman-Pearson).

Let $X\in{\mathcal{X}}$ be a random variable distributed according to $X\sim
P_{\theta}$, where either $\theta=0$ or $\theta=1$. A hypothesis test function
is a function $f:{\mathcal{X}}\to\\{0,1\\}$ that tries to determine the
parameter $\theta$ from the observed data $x$. Let ${\mathbb{E}}_{X\sim
P_{0}}f(X)$ be the type I error probability of the test function, and
${\mathbb{E}}_{X\sim P_{1}}[1-f(X)]$ the type II error probability. The
likelihood ratio test with threshold $k$ is given by

$\varphi_{k}(x)=\left\\{\begin{array}[]{ll}1:&\frac{P_{1}(x)}{P_{0}(x)}>k\\\
0:&\frac{P_{1}(x)}{P_{0}(x)}<k\end{array}\right..$ (20)

At a fixed type I error probability, the likelihood ratio test (20) has the
lowest type II error probability of all test functions.

######  Lemma 2.8.

A test function obtained by applying a monotone function to the likelihood
ratio $\frac{P_{1}(x)}{P_{0}(x)}$ and to the threshold is equivalent to the
likelihood ratio test.

##  3 The proposed information reconciliation method

The random-codebook error correction serves as a first step that produces a
low-noise binary string, which can then be further corrected using standard
binary codes.

###  3.1 Protocol steps

Preparation.

Alice and Bob agree on a number of public parameters: a variance
$\sigma_{X}^{2}$; sequence length $n$; code size $q$; a random table
$w\in[0,1]^{q\times n}$; an integer $N$; key length $L$. They agree on a
strong extractor function ${\rm Ext}:{\mathcal{R}}\times\\{0,1\\}^{N\log
q}\to\\{0,1\\}^{L}$. Furthermore they agree on a binary error-correcting code
${\mathcal{E}}$ that has codewords of length $N\log q$.

We assume that the channel properties $T,\xi$ are known to Alice and Bob. We
write $F_{Y}$ for the cumulative distribution function of $Y$, where $Y$ is
Gaussian with zero mean and variance $\sigma_{Y}^{2}$. Alice has a (public)
threshold value $\theta$.

Repeated steps (see Fig. 1):

  1. 1.

Alice sends $n$ coherent states to Bob, using Gaussian modulation. The
variance of each quadrature is $\sigma_{X}^{2}$. Alice stores the
displacements.

  2. 2.

For each coherent state, Bob randomly chooses a quadrature to measure. The
result of the homodyne measurement is denoted as $y\in{\mathbb{R}}^{n}$. He
picks a random row index $u\in\\{1,\ldots,q\\}$. For all
$i\in\\{1,\ldots,n\\}$ he computes

$\tilde{y}_{i}=F_{Y}(y_{i})\in(0,1)$ (21)

and

$c_{i}=\tilde{y}_{i}+w_{ui}\mod 1.$ (22)

Bob sends to Alice his quadrature choices and the vector
$c=(c_{1},\ldots,c_{n})$.

  3. 3.

Alice constructs a vector $x\in{\mathbb{R}}^{n}$ that consists of the
transmitted displacements in the direction of Bob’s quadrature choices. For
each candidate row index $\ell\in\\{1,\ldots,q\\}$ she computes a score
$S_{\ell}(x,w,c)$,

$S_{\ell}(x,w,c)=\sum_{i=1}^{n}\left[F_{Y}^{\rm inv}(c_{i}-w_{\ell i}\mod
1)-x_{i}\sqrt{T}\frac{\sigma_{Y}^{2}}{T\sigma_{X}^{2}}\right]^{2}.$ (23)

If there exists exactly one index $\ell$ satisfying $S_{\ell}<\theta$ then
Alice sets $\hat{u}=\ell$ and she accepts. In any other case she rejects.
Alice informs Bob of her accept/reject decision.

Finalization.
Alice and Bob collect the indices $u^{(1)},\ldots,u^{(N)}$ from $N$ accepted
rounds. They convert each of these indices to binary representation and
concatenate them; then they use the code ${\mathcal{E}}$ to get rid of the
leftover errors222 E.g. Bob sends the one-time-padded syndrome of ${\rm
bin}\,u^{(1)}||\ldots||{\rm bin}\,u^{(N)}$ to Alice.  (accept events with
$\hat{u}\neq u$); finally they do privacy amplification. The final QKD key is

${\rm Ext}\left(r,{\rm bin}\,u^{(1)}||\ldots||{\rm
bin}\,u^{(N)}\right)\in\\{0,1\\}^{L}.$ (24)

Here $r$ is a randomly chosen (public) seed, and ‘bin’ stands for
binarisation.

AliceBobGaussian modulation$n$coherent statesRandom quadrature
choices;homodyne meas.
$y\in{\mathbb{R}}^{n}$;$\tilde{y}_{i}=F_{Y}(y_{i})$.Random
$u\in\\{1,\ldots,q\\}$$c_{i}=\tilde{y}_{i}+w_{ui}\;{\rm mod}\;1$$c$,
quadrature choicesComponents $x\in{\mathbb{R}}^{n}$Scores $S_{1},\ldots,S_{q}$
(23)If single score $S_{j}<\theta$set $\hat{u}=j$; acceptelse
rejectaccept/reject Figure 1: Protocol steps for information reconciliation of
one $q$-ary symbol $u$.

###  3.2 Statistical decoupling

The decoupling between the information reconciliation data $(w,c)$ and the
codeword index $u$, required for the use of Corollary 2.2, is ensured by the
uniformity of $\tilde{Y}_{i}$, combined with the modulo-1 addition. Adding the
uniform variable $\tilde{Y}_{i}$ to $w_{ui}$ modulo 1 is the analog version of
a one-time-pad xor mask, and completely hides $w_{ui}$.

######  Lemma 3.1.

Let $C$ be constructed as in Section 3.1, $c_{i}=\tilde{y}_{i}+w_{ui}\mod 1$.
Let $P=(W,C)$. Then the variables $P$ and $U$ are independent.

Proof: $f_{U|WC}(u|wc)=\frac{f_{UWC}(uwc)}{f_{WC}(wc)}$
$=\frac{f_{U}(u)f_{W}(w)f_{C|UW}(c|uw)}{f_{W}(w){\mathbb{E}}_{u^{\prime}}f_{C|UW}(c|u^{\prime}w)}$
$=f_{U}(u)\frac{\prod_{i}f_{\tilde{Y}}(c_{i}-w_{ui}\mod
1)}{{\mathbb{E}}_{u^{\prime}}\prod_{i}f_{\tilde{Y}}(c_{i}-w_{u^{\prime}i}\mod
1)}$

$=f_{U}(u)\frac{1}{{\mathbb{E}}_{u^{\prime}}1}$ $=f_{U}(u)$. Here we have used
that $\tilde{Y}_{i}$ is uniform on $[0,1]$. $\square$

Note that this mechanism for achieving independence between $C$ and $U$ is
more versatile than the trick introduced by [9], which acts only on 8
components of $Y$ at a time. Our procedure works with any sequence length $n$
as a whole.

Furthermore, [9] mentions that decoupling cannot be achieved in dimension
higher than $d=8$, because of the requirement that there must exist exactly
$d-1$ independent vector fields on the unit sphere in ${\mathbb{R}}^{d}$.
However, that line of reasoning applies only because they entirely discard the
radial degree of freedom in ${\mathbb{R}}^{d}$! By not discarding the
information contained in $|Y|$, we give ourselves the freedom to introduce
decoupling as in (22) simply via the uniform $\tilde{y}_{i}$.

###  3.3 Motivation of the score function (23)

Alice is faced with a one-out-of-$q$ decision problem. This type of problem
does not have a known optimal solution. Instead we resort to an often used
alternative: to run $q$ binary decision problems. For each candidate row index
$\ell\in\\{1,\ldots,q\\}$ Alice tests the binary hypothesis “does $u$ equal
$\ell$?” given the data ($x,w,c$) available to her. For the binary hypothesis
test we know that the optimal solution is to use the Neyman-Pearson score
(20), i.e. the likelihood ratio, or a monotone function of it. The $q$
individual scores can then somehow be combined to obtain a one-out-of-$q$
decision. One example would be to decide on the index $\ell$ with the highest
Neyman-Pearson score; this is similar to a Maximum A Posteriori (MAP)
approach. Instead we work with a threshold that is applied to each individual
Neyman-Pearson score. Our motivation for this choice is that it lends itself
to analysis.

Below we show that the score (23) is equivalent to the Neyman-Pearson score.

######  Lemma 3.2.

Consider the hypothesis testing problem of Lemma 2.7. Using the expression
${\rm Pr}[\theta=1|X=x]$ as a score function is equivalent to using the
likelihood ratio as a score function.

Proof:

$\displaystyle\frac{P_{1}(x)}{P_{0}(x)}$ $\displaystyle=$
$\displaystyle\frac{{\rm Pr}[X=x|\theta=1]}{{\rm Pr}[X=x|\theta=0]}=\frac{{\rm
Pr}[X=x]{\rm Pr}[\theta=1|X=x]/{\rm Pr}[\theta=1]}{{\rm Pr}[X=x]{\rm
Pr}[\theta=0|X=x]/{\rm Pr}[\theta=0]}=\frac{{\rm Pr}[\theta=0]}{{\rm
Pr}[\theta=1]}\cdot\frac{{\rm Pr}[\theta=1|X=x]}{{\rm Pr}[\theta=0|X=x]}$ (25)
$\displaystyle=$ $\displaystyle\frac{{\rm Pr}[\theta=0]}{{\rm
Pr}[\theta=1]}\cdot\frac{{\rm Pr}[\theta=1|X=x]}{1-{\rm Pr}[\theta=1|X=x]}.$

It follows that ${\rm Pr}[\theta=1|X=x]=\psi(\frac{P_{1}(x)}{P_{0}(x)})$, with
$\psi(z)=(1+\frac{1}{z}\cdot\frac{{\rm Pr}[\theta=0]}{{\rm
Pr}[\theta=1]})^{-1}$. We use that $\psi$ is a monotone increasing function
and invoke Lemma 2.8. $\square$

######  Lemma 3.3.

${\rm
Pr}[U=\ell|xwc]\propto\exp\left[-\frac{T\sigma_{X}^{2}}{2\sigma_{Y}^{2}\sigma_{Y|X}^{2}}S_{\ell}(x,w,c)\right]$,
with $S_{\ell}$ as defined in (23).

Proof:

$\displaystyle{\rm Pr}[U\\!=\\!\ell|xwc]\\!\\!$ $\displaystyle=$
$\displaystyle\frac{{\rm Pr}[U=\ell]f_{W}(w)f_{X}(x)f_{C|UWX}(c|\ell
wx)}{f_{W}(w)f_{X}(x)f_{C|WX}(c|wx)}=\frac{1}{q}\cdot\frac{f_{C|UWX}(c|\ell
wx)}{f_{C|WX}(c|wx)}$ (26) $\displaystyle\propto$ $\displaystyle
f_{C|UWX}(c|\ell wx)=\prod_{i=1}^{n}f_{\tilde{Y}|X}(c_{i}-w_{\ell i}\,{\rm
mod}\,1|x_{i})$ (27) $\displaystyle\stackrel{{\scriptstyle(a)}}{{=}}$
$\displaystyle\prod_{i}\frac{f_{Y|X}(F_{Y}^{\rm inv}(c_{i}-w_{\ell i}\,{\rm
mod}\,1)\;|x_{i})}{f_{Y}(F_{Y}^{\rm inv}(c_{i}-w_{\ell i}\,{\rm mod}\,1))}$
(28) $\displaystyle\propto$
$\displaystyle\prod_{i}\exp-\left(\frac{[F_{Y}^{\rm inv}(c_{i}-w_{\ell
i}\,{\rm mod}\,1)-x_{i}\sqrt{T}]^{2}}{2\sigma_{Y|X}^{2}}-\frac{[F_{Y}^{\rm
inv}(c_{i}-w_{\ell i}\,{\rm mod}\,1)]^{2}}{2\sigma_{Y}^{2}}\right)$ (29)
$\displaystyle\propto$
$\displaystyle\prod_{i}\exp-\frac{\sigma_{Y}^{2}-\sigma_{Y|X}^{2}}{2\sigma_{Y}^{2}\sigma_{Y|X}^{2}}\left[F_{Y}^{\rm
inv}(c_{i}-w_{\ell i}\,{\rm
mod}\,1)-x_{i}\sqrt{T}\frac{\sigma_{Y}^{2}}{\sigma_{Y}^{2}-\sigma_{Y|X}^{2}}\right]^{2}.$
(30)

In (a) we used that for a monotone function $\varphi$ the pdf of
$Z=\varphi(Y)$ is given by $f_{Z|X}(z|x)=f_{Y|X}(y|x)/\varphi^{\prime}(y)$
$=\frac{f_{Y|X}(\varphi^{\rm inv}(z)\;|x)}{\varphi^{\prime}(\varphi^{\rm
inv}(z))}$. Then the special choice $\varphi=F_{Y}$ yields $f_{Z|X}(z|x)=$
$\frac{f_{Y|X}(F_{Y}^{\rm inv}(z)\;|x)}{f_{Y}(F_{Y}^{\rm inv}(z))}$. Finally,
the $z$ in this expression equals $\tilde{y}_{i}$ given $u=\ell$, $w$ and $c$,
which evaluates to $\tilde{y}_{i}=c_{i}-w_{\ell i}\,{\rm mod}\,1$. $\square$

Finally, since $\exp[-{\rm const}\cdot S_{\ell}]$ is a monotone function of
$S_{\ell}$, our score function (23) is equivalent to the Neyman-Pearson score.
Due to the minus sign, a low score indicates a high likelihood that that the
hypothesis is true.

###  3.4 Thresholding; error types

Alice’s decision procedure leads to a number of cases that can occur, listed
in the table below.

Case | Scores | Decision |
---|---|---|---
1 |  $S_{u}<\theta$, $\forall_{\ell\neq u}S_{\ell}>\theta$ | accept | True Accept
2 |  $S_{u}>\theta$, $\exists_{\mbox{unique }\ell}S_{\ell}<\theta$ | accept | False Accept
3 |  $S_{u}>\theta$; $S_{\ell}<\theta$ for several $\ell$ | reject | justified reject
4 | $\forall_{\ell}S_{\ell}>\theta$ | reject |  $S_{u}$ might be smallest score
5 |  $S_{u}<\theta$, $\exists_{\ell\neq u}S_{\ell}<\theta$ | reject |  $S_{u}$ might be smallest score

An alternative procedure could be to always accept the row index with the
lowest score. In cases 4 and 5 that would be likely to extract correct
information, whereas our scheme discards the data. However, case 3 would
certainly produce a symbol error, and case 4 and 5 would potentially cause a
symbol error. Analysis of different decision procedures is left for future
work.

##  4 Analysis

###  4.1 Statistics of the scores

######  Lemma 4.1.

Consider the score system for given $x,w,u$ and random $Y$. The true-codeword
score $S_{u}$ can be written as

$S_{u}(x,w,C)=\sigma_{Y|X}^{2}A$ (31)

where $A$ follows a noncentral chi-square distribution with parameters
$(n,\lambda_{1})$,

$\lambda_{1}=n\frac{\sigma_{Y|X}^{2}}{T\sigma_{X}^{2}}\cdot\frac{\frac{1}{n}\sum_{i}x_{i}^{2}}{\sigma_{X}^{2}}\approx
n\frac{\sigma_{Y|X}^{2}}{T\sigma_{X}^{2}}.$ (32)

Proof: At $\ell=u$ the expression $F_{Y}^{\rm inv}(C_{i}-w_{\ell i}\,{\rm
mod}\,1)$ evaluates to $F_{Y}^{\rm inv}(\tilde{Y}_{i})$ $=Y_{i}$. This yields
$S_{u}(x,w,C)=\sum_{i}[Y_{i}-x_{i}\sqrt{T}\frac{\sigma_{Y}^{2}}{T\sigma_{X}^{2}}]^{2}$.
We write $Y_{i}=x_{i}\sqrt{T}+\sigma_{Y|X}N_{i}$, where the noise $N_{i}$ is
normal-distributed and independent of all other variables. We get
$S_{u}=\sigma_{Y|X}^{2}\sum_{i=1}^{n}[N_{i}-x_{i}\sqrt{T}\frac{\sigma_{Y|X}}{T\sigma_{X}^{2}}]^{2}$.
This has the form of $\sigma_{Y|X}^{2}$ times a noncentral $\chi^{2}$ variable
with $n$ degrees of freedom and noncentrality parameter
$\lambda=\sum_{i}(x_{i}\sqrt{T}\frac{\sigma_{Y|X}}{T\sigma_{X}^{2}})^{2}$.
$\square$

######  Lemma 4.2.

Consider the score system for given $x,y,u$ and random $W$. Let the table
components $W_{\ell i}$ be independent and uniform on $[0,1]$. Then the wrong-
codeword score $S_{\ell}$ ($\ell\neq u$) can be written as

$S_{\ell}(x,W,C)=\sigma_{Y}^{2}B_{\ell}$ (33)

where the random variables $(B_{\ell})_{\ell\neq u}$ are independent and
follow a noncentral chi-square distribution with parameters $(n,\lambda_{0})$,
with

$\lambda_{0}=n\frac{\sigma_{Y}^{2}}{T\sigma_{X}^{2}}\cdot\frac{\frac{1}{n}\sum_{i}x_{i}^{2}}{\sigma_{X}^{2}}\approx
n\frac{\sigma_{Y}^{2}}{T\sigma_{X}^{2}}.$ (34)

Proof: At $\ell\neq u$ the expression $C_{i}-W_{\ell i}\,{\rm mod}\,1$
evaluates to $\tilde{y}_{i}+W_{ui}-W_{\ell i}\,{\rm mod}\,1$. Since all the
$W_{\ell i}$ are independent and uniform, we find that $F_{Y}^{\rm
inv}(\tilde{y}_{i}+W_{ui}-W_{\ell i}\,{\rm mod}\,1)$ is an independent
Gaussian variable with zero mean and variance $\sigma_{Y}^{2}$. Crucially, it
is independent of $x$. We can write $S_{\ell}=\sum_{i=1}^{n}[\sigma_{Y}M_{\ell
i}-x_{i}\sqrt{T}\frac{\sigma_{Y}^{2}}{T\sigma_{X}^{2}}]^{2}$, where the
$M_{\ell i}$ are independent and normal-distributed. Written as
$S_{\ell}=\sigma_{Y}^{2}\sum_{i=1}^{n}[M_{\ell
i}-x_{i}\sqrt{T}\frac{\sigma_{Y}}{T\sigma_{X}^{2}}]^{2}$ we see that each
score equals $\sigma_{Y}^{2}$ times a noncentral chi-squared variable with $n$
degrees of freedom and noncentrality parameter
$\lambda=\sum_{i}(x_{i}\sqrt{T}\frac{\sigma_{Y}}{T\sigma_{X}^{2}})^{2}$.
$\square$

The two above lemmas will allow us to analytically compute decision error
probabilities under the assumption that the codeword table $W$ is completely
uniform. For pseudorandom $W$, Lemma 4.1 still holds, but Lemma 4.2 breaks
down. Note, however, that for unknown $U,Y$ the argument of $F_{Y}^{\rm
inv}(\tilde{Y}_{i}+W_{Ui}-W_{\ell i}\,{\rm mod}\,1)$ is close to uniform when
the table size $q$ is large (ergodicity of $W$). Thus, even though the scores
$S_{\ell}$ ($\ell\neq u$) are not independent for pseudorandom $W$, the
distribution of each $S_{\ell}$ viewed individually will closely resemble the
chi-square distribution specified in Lemma 4.2.

###  4.2 Analytic estimates for the error probabilities

We introduce the following notation for error probabilities,

$\displaystyle\pi_{1}$ $\displaystyle\stackrel{{\scriptstyle\rm def}}{{=}}$
$\displaystyle{\rm
Pr}[S_{u}>\theta]=Q_{\frac{n}{2}}(\sqrt{\lambda_{1}},\sqrt{\frac{\theta}{\sigma_{Y|X}^{2}}})$
(35) $\displaystyle\pi_{0}$ $\displaystyle\stackrel{{\scriptstyle\rm
def}}{{=}}$ $\displaystyle{\rm Pr}_{W\sim{\rm
unif}}[S_{\ell}<\theta]=1-Q_{\frac{n}{2}}(\sqrt{\lambda_{0}},\sqrt{\frac{\theta}{\sigma_{Y}^{2}}})\quad\quad\quad\ell\neq
u.$ (36)

Here $Q$ is the Marcum $Q$-function as mentioned in Section 2.5. In words,
$\pi_{1}$ is the probability that the correct index $u$ gets a score that is
on the wrong side of the threshold (high); $\pi_{0}$ is the probability that
an incorrect index $\ell\neq u$ gets a score that is on the wrong side of the
threshold (low).

######  Lemma 4.3.

Under the assumption of uniform $W$, the probability of True Accept (TA) and
False Accept (FA) are given by

$\displaystyle P_{\rm TA}$ $\displaystyle=$ $\displaystyle{\mathbb{E}}_{u}{\rm
Pr}[S_{u}<\theta]\,\prod_{\ell:\ell\neq u}{\rm Pr}[S_{\ell}>\theta]$ (37)
$\displaystyle=$ $\displaystyle(1-\pi_{1})(1-\pi_{0})^{q-1}$ (38)
$\displaystyle P_{\rm FA}$ $\displaystyle=$ $\displaystyle{\mathbb{E}}_{u}{\rm
Pr}[S_{u}>\theta]\sum_{a:a\neq u}{\rm
Pr}[S_{a}<\theta]\prod_{\ell\notin\\{u,a\\}}{\rm Pr}[S_{\ell}>\theta]$ (39)
$\displaystyle=$ $\displaystyle(q-1)\pi_{1}\pi_{0}(1-\pi_{0})^{q-2}.$ (40)

Proof: (37) and (39) follow from the protocol description in Section 3.1.
Lines (38) and (40) follow by substituting (35,36). $\square$

The symbol error rate is defined as the probability of a accepting a row index
other than $u$, conditioned on accept.

$\sigma\stackrel{{\scriptstyle\rm def}}{{=}}{\rm
Pr}[S_{u}>\theta\wedge\exists_{\rm unique\;\ell\neq u}S_{\ell}<\theta\;|\;{\tt
accept}]=\frac{P_{\rm FA}}{P_{\rm TA}+P_{\rm FA}}.$ (41)

######  Corollary 4.4.

Under the assumption of uniform $W$, the symbol error rare is given by

$\sigma=\frac{(q-1)\pi_{0}\pi_{1}}{(1-\pi_{1})(1-\pi_{0})+(q-1)\pi_{0}\pi_{1}}.$
(42)

Proof: Follows from substitution of (38,40) into (41). $\square$

From (38) we see that $\pi_{0}$ must not be larger than
${\mathcal{O}}(\frac{1}{q})$, otherwise the true accept probability goes to
zero.

###  4.3 Asymptotics

Upon accept, Bob has communicated $\log q$ bits of information to Alice. For
some parameter value $\gamma$ we will enforce the condition

$\log q=\gamma I(X;Y).$ (43)

Using (5) we can rewrite this condition as

$\ln
q=\gamma\frac{n}{2}\ln(1+\frac{T\sigma_{X}^{2}}{\sigma_{Y|X}^{2}})\approx\gamma
n\frac{T\sigma_{X}^{2}}{2\sigma_{Y|X}^{2}},$ (44)

where we used $T\sigma_{X}^{2}\ll 1$. Since there is a clear limit to the
value of $q$ that can be implemented in practice, we will treat $q$ as a
constant and use (44) to tune $\sigma_{X}$ as a function of other system
parameters,

$T\sigma_{X}^{2}\approx\frac{2\sigma^{2}_{Y|X}\ln q}{n\gamma}.$ (45)

With (45), we look again at the score statistics. Fig. 2 sketches the pdf of
the true-symbol score $S_{u}$ and the wrong-symbol score $S_{\ell}$ ($\ell\neq
u$).

pdf of $S_{u}$pdf of $S_{\ell}$$\theta$$n$$\sqrt{\rm var}$$\approx
n\sqrt{\frac{\gamma}{2\ln q}}$$\sqrt{\rm var}$$\approx
n\sqrt{\frac{\gamma}{2\ln q}}$ Figure 2: Sketch of the pdf of the true-symbol
score and the wrong-symbol score. The area of the shaded region is $\pi_{0}$.
The distance between the pdfs as well as the width of both pdfs are
approximately linear in $n$.

For the left curve we have (see Lemma 2.5)

$\displaystyle\lambda_{1}$ $\displaystyle\approx$ $\displaystyle
n\frac{\sigma_{Y|X}^{2}}{T\sigma_{X}^{2}}\approx\frac{n^{2}\gamma}{2\ln q}$
(46) $\displaystyle{\mathbb{E}}S_{u}$ $\displaystyle=$
$\displaystyle\sigma_{Y|X}^{2}(n+\lambda_{1})\approx\frac{n}{2}+\frac{n^{2}\gamma}{4\ln
q}+{\mathcal{O}}(n^{2}T\xi)$ (47) $\displaystyle{\rm Var}(S_{u})$
$\displaystyle=$
$\displaystyle\sigma_{Y|X}^{4}(2n+4\lambda_{1})\approx\frac{n}{2}+\frac{n^{2}\gamma}{2\ln
q}+{\mathcal{O}}(n^{2}T\xi).$ (48)

For the right curve we have

$\displaystyle\lambda_{0}$ $\displaystyle\approx$ $\displaystyle
n\frac{\sigma_{Y}^{2}}{T\sigma_{X}^{2}}\approx\frac{n^{2}\gamma}{2\ln
q}+n-{\mathcal{O}}(n^{2}T\xi)$ (49) $\displaystyle{\mathbb{E}}S_{\ell}$
$\displaystyle=$
$\displaystyle\sigma_{Y}^{2}(n+\lambda_{0})\approx\frac{n^{2}\gamma}{4\ln
q}+\frac{3}{2}n+{\mathcal{O}}(1)-{\mathcal{O}}(n^{2}T\xi)$ (50)
$\displaystyle{\rm Var}(S_{\ell})$ $\displaystyle=$
$\displaystyle\sigma_{Y}^{4}(2n+4\lambda_{0})\approx\frac{n^{2}\gamma}{2\ln
q}+\frac{3}{2}n+{\mathcal{O}}(1)-{\mathcal{O}}(n^{2}T\xi).$ (51)

Neglecting $nT\xi\ll 1$, we get the following distance between the pdf
centers,

${\mathbb{E}}S_{\ell}-{\mathbb{E}}S_{u}\approx n.$ (52)

We see that our reconciliation system has to deal with the overlap of two pdfs
whose centers are separated by a distance $n$, while both curves have a width
that is also of order $n$, namely $\approx n\sqrt{\frac{\gamma}{2\ln q}}$.
This scaling is a consequence of the imposed relation (45) between
$\sigma_{X}$, $n$ and $q$. The only way to reduce the overlap (and thereby
improve the reconciliation) is to increase $q$ or to decrease $\gamma$.

Since it is of crucial importance to have a low value of $\pi_{0}$, the
threshold $\theta$ cannot be set far to the right of ${\mathbb{E}}S_{u}$. This
will inevitably result in a non-negligible $\pi_{1}$, potentially even
$\pi_{1}\approx\frac{1}{2}$.

According to the Central Limit Theorem, adding a large number of random
variables yields a sum that is close to gaussian-distributed. Typically the
approximation holds very well near the center of the distribution, but not
necessarily in the tails. Hence, estimating $\pi_{1}$ by taking a Gaussian
approximation of the $S_{u}$ score distribution (near
$\theta={\mathbb{E}}S_{u}$) is highly accurate, but we have to be careful with
the tail of the $S_{\ell}$ distribution. The lemma below shows that we are
lucky, and that in fact the Gaussian approximation works rather well for the
noncentral chi-square distribution.

######  Lemma 4.5.

Let the threshold be set as $\theta={\mathbb{E}}S_{u}+n\alpha$, with
$\alpha<1$. Let $nT\xi\ll 1$. Then asymptotically for large $n$ it holds that

$\pi_{0}\sim\frac{1}{2}{\rm Erfc}\left([1-\alpha]\sqrt{\frac{\ln
q}{\gamma}}\right).$ (53)

Proof: The $\pi_{0}$ is defined according to (36). We use Lemma 2.6 with
$\mu=n/2$, $r=\sqrt{\lambda_{0}}$ $=\sqrt{\frac{n^{2}\gamma}{2\ln q}+n}$ and
$s=\sqrt{\theta/\sigma_{Y}^{2}}$ $\approx\sqrt{\frac{n^{2}\gamma}{2\ln
q}+2\alpha n}$. Note that $r={\mathcal{O}}(n)$ and $s={\mathcal{O}}(n)$. The
expressions contained in the quantity $\chi$ (19) are approximated as follows.
First, $\sqrt{r^{2}s^{2}+\mu^{2}}$ $=rs\sqrt{1+(\frac{\mu}{rs})^{2}}$
$=rs[1+\frac{\mu^{2}}{2r^{2}s^{2}}+{\mathcal{O}}((\frac{\mu}{rs})^{4})]$. This
yields
$\frac{r^{2}+s^{2}}{2}-\sqrt{r^{2}s^{2}+\mu^{2}}=\frac{1}{2}(r-s)^{2}-\frac{\mu^{2}}{2r^{2}s^{2}}+{\mathcal{O}}(\frac{1}{n^{2}})$
$=\frac{\ln q}{\gamma}(-\alpha+\alpha^{2})+{\mathcal{O}}(\frac{1}{n})$.
Furthermore, $\mu\,{\rm
arsinh}\frac{\mu}{rs}=\frac{\mu^{2}}{rs}+{\mathcal{O}}(\frac{1}{n^{2}})$
$=\frac{\ln q}{2\gamma}+{\mathcal{O}}(\frac{1}{n})$. Finally,
$-\mu\ln\frac{s}{r}=\mu\frac{1}{2}\ln\frac{1+\frac{2\ln
q}{n\gamma}}{1+2\alpha\frac{2\ln q}{n\gamma}}$ $=\frac{\ln
q}{2\gamma}(1-2\alpha)+{\mathcal{O}}(\frac{1}{n})$. Combining the pieces
yields $\chi^{2}=\frac{\ln
q}{\gamma}(1-\alpha)^{2}+{\mathcal{O}}(\frac{1}{n})$ and hence
$\chi=(1-\alpha)\sqrt{\frac{\ln q}{\gamma}}+{\mathcal{O}}(\frac{1}{n})$. We
note that the expression $\exp(-\chi^{2})/\sqrt{rs}$ in front of the summation
in (18) is of order ${\mathcal{O}}(\frac{1}{n})$. We mention that
$c_{0}={\mathcal{O}}(1)$. (See [16] for details.) The summation $\sum_{j}$ is
organised such that consecutive terms become smaller and the sum converges to
${\mathcal{O}}(1)$. Hence the entire contribution containing the $\sum_{j}$ is
of order ${\mathcal{O}}(\frac{1}{n})$. As a last step we rewrite
$1-\frac{1}{2}{\rm Erfc}(-\chi)$ as $\frac{1}{2}{\rm Erfc}(\chi)$. $\square$

######  Corollary 4.6.

Let $\alpha$ and $\gamma$ be tuned such that
$\frac{1-\alpha}{\sqrt{\gamma}}=\frac{1}{\sqrt{\ln q}}{\rm Erfc}^{\rm
inv}(2\frac{c}{q-1})$, with $c<1$ a constant. Then
$\pi_{0}\approx\frac{c}{q-1}$, and

$P_{\rm TA}\approx e^{-c}(1-\pi_{1})\quad\quad;\quad\quad P_{\rm FA}\approx
ce^{-c}\pi_{1}\quad\quad;\quad\quad P_{\rm ACC}=e^{-c}[1-(1-c)\pi_{1}]$ (54)
$\sigma\approx\frac{c\pi_{1}}{1-\pi_{1}+c\pi_{1}}.$ (55)

Proof: The value of $\pi_{0}$ follows directly by substituting the provided
$\frac{1-\alpha}{\sqrt{\gamma}}$ into (53). Next we substitute
$\pi_{0}\approx\frac{c}{q-1}$ into (38), (40), and (41), using the limit
$(1-\frac{c}{q-1})^{q-1}\to e^{-c}$ for $q\gg 1$. $\square$

Example: Choosing e.g. $q=2^{20}$ and $c=0.01$ requires
$\frac{(1-\alpha)^{2}}{\gamma}\approx 1.067$, which is not too far away from
$1$ and can be achieved with a slightly negative $\alpha$ and $\gamma$
slightly below $1$. The combination $q=2^{20}$, $c=10^{-3}$ requires
$\frac{(1-\alpha)^{2}}{\gamma}\approx 1.141$.

Note that $\alpha\approx 0$ leads to $\pi_{1}\approx\frac{1}{2}$ which implies
a true acceptance probability $P_{\rm TA}$ considerably smaller than 1. The
symbol error rate, however, is proportional to $c$ and hence it can still be
advantageous to choose $c$ small.

###  4.4 Secret key ratio

####  4.4.1 Secret key ratio at small $T$ in general

Let us first study the general equation (15) for the key ratio. In the regime
$T\sigma_{X}^{2}\ll 1$, $\xi\ll\sigma_{X}^{2}$, we can write

$\beta
I(X_{i};Y_{i})-I(Y_{i};E_{i})=T\log(e)\cdot\sigma_{X}^{2}\left[\beta-\sigma_{X}^{2}\ln(1+\frac{1}{\sigma_{X}^{2}})\right]+{\mathcal{O}}(T^{2}).$
(56)

At given $\beta$ ($\beta<1$), the value of $\sigma_{X}^{2}$ that maximizes
$R_{\rm key}^{\rm(decoupled)}$ scales as
$\sigma_{X}^{2}\approx\frac{1}{\sqrt{3}\sqrt{1-\beta}}$. When $\beta$ is
exactly $1$, it is in theory advantageous to increase $\sigma_{X}$ to
infinity. However, the proportionality $1/\sqrt{1-\beta}$ means that the
optimal $\sigma_{X}^{2}$ drops very rapidly; e.g. at $\beta=0.95$ the optimal
$\sigma_{X}^{2}$ has alreay dropped to ${\mathcal{O}}(1)$.

Let us define

$f_{\beta}(x)=2x[\beta-x\ln(1+\frac{1}{x})],$ (57)

so that $\beta
I(X_{i};Y_{i})-I(Y_{i};E_{i})=\frac{1}{2}T\log(e)f_{\beta}(\sigma_{X}^{2})$.
Note that $\lim_{x\to\infty}f_{1}(x)=1$. Fig.3 shows, as a function of
$\beta$, the value of $x$ that maximizes $f_{\beta}$, as well as the achieved
maximum function value.

$\beta$$x_{\rm opt}$$\max_{x}f_{\beta}(x)$ Figure 3: Solid line:
$\max_{x}f_{\beta}(x)$ as a function of $\beta$. Dotted line: optimal $x$ as a
function of $\beta$.

####  4.4.2 Secret key ratio of our scheme

As mentioned in Section 3.1, the data $u\in\\{1,\ldots,q\\}$ is collected from
$N$ runs, and then a binary error correcting code is applied to get rid of
residual errors, and finally privacy amplification to get rid of the leakage.
We have to take into account that data is added only in case of accept; this
gives an overall factor of $P_{\rm TA}+P_{\rm FA}$, i.e. the accept
probability. (This factor also applies to the leakage, since leakage is
relevant only with respect to accepted data.) Assuming a good code that
performs close to the Shannon limit at low noise level, the error correction
leads to a factor $1-h({\rm BER})$ in the amount of secret data, where BER is
the Bit Error Rate. Note that we have to convert the Symbol Error Rate
$\sigma$ (42) to a BER. This is done as follows. Every symbol
$\ell\in\\{1,\ldots,q\\}$ has a binary representation. Because of the lack of
structure in the table $w$, a symbol error leads to the acceptance of a random
row index $\ell\neq u$; hence each bit in the binary representation has a 50%
probability of being flipped. This gives ${\rm BER}=\sigma/2$. Taking all
these considerations into account, we obtain the following key length $L$,

$L=(P_{\rm TA}+P_{\rm FA})\cdot N\log q\cdot[1-h(\frac{\sigma}{2})]-(P_{\rm
TA}+P_{\rm FA})Nn\cdot I(E_{i};Y_{i}).$ (58)

The secret key ratio is $R=\frac{L}{Nn}$. With $\log q=\gamma
nI(X_{i};Y_{i})$, we get

$\displaystyle R$ $\displaystyle=$ $\displaystyle(P_{\rm TA}+P_{\rm
FA})\left[\gamma[1-h(\frac{\sigma}{2})]I(X_{i};Y_{i})-I(E_{i};Y_{i})\right]$
(59) $\displaystyle\stackrel{{\scriptstyle(\ref{decoupledSmallT})}}{{=}}$
$\displaystyle(P_{\rm TA}+P_{\rm
FA})T\log(e)\cdot\sigma_{X}^{2}\left[\gamma[1-h(\frac{\sigma}{2})]-\sigma_{X}^{2}\ln(1+\frac{1}{\sigma_{X}^{2}})\right]+{\mathcal{O}}(T^{2}).$
(60)

This expression is of the form (56), with the acceptance probability $P_{\rm
TA}+P_{\rm FA}$ as a prefactor, and with
$\beta=\gamma[1-h(\frac{\sigma}{2})]$. Note furthermore that the
parametrisation (45), $n\sigma_{X}^{2}\approx\frac{\ln q}{T\gamma}$, fixes
only the product $n\sigma_{X}^{2}$ at given $T$, $q$, $\gamma$, which seems to
imply that we can choose $\sigma_{X}^{2}$ at will, and $n$ will adapt.
However, we cannot indefinitely increase $\sigma_{X}^{2}$ as that would cause
$n$ to decrease to the point where the various terms that we have neglected,
such as terms of order $\frac{1}{n}$ and $nT\xi$, become non-negligible.

Note that according to (60), the optimisation of $\gamma,\alpha,\sigma_{X}$ at
$T\ll 1$ has practically no dependence on $T$. This will be apparent in
Section 5.

####  4.4.3 A remark on the secrecy capacity lower bound

Consider a CVQKD scheme that derives the secret key $K\in\\{0,1\\}^{L}$ by
hashing a discretisation of $Y$, and where Bob sends a one-time-padded
syndrome to Alice . Asymptotically, use of the Leftover Hash Lemma against
quantum adversaries yields that the QKD key is secure if $L<S(Y|E)$. If an
accept/reject mechanism exists for parts (blocks) of $Y$, then this condition
is modified to $L<P_{\rm ACC}S(Y|E)=P_{\rm ACC}[H(Y)-I(E;Y)]$. The achievable
secret key ratio is given by $R=(L-\mbox{syndrome size})/n$, where the size of
the syndrome is subtracted because key material is spent to mask the syndrome.
The information reconciliation pertains only to the accepted blocks of $Y$;
hence the syndrome size also carries a factor $P_{\rm ACC}$. Let us write the
syndrome size as $P_{\rm ACC}H(Y|X)\cdot b$. Then333 Typically $b>1$, meaning
that more data is sent than the strictly necessary amount $H(Y|X)$, resulting
in $\beta<1$. A perfect code has $b=1$ and $\beta=1$. A code that tries to
send a message above the channel capacity has $b<1$, resulting in $\beta>1$.
the provably safe key ratio is $R<P_{\rm ACC}[H(Y)-bH(Y|X)-I(E;Y)]/n$ $=P_{\rm
ACC}[\beta I(X;Y)-I(E;Y)]/n$. Hence (15), with the proper relation between
$\beta$ and $P_{\rm ACC}$ inserted, represents a lower bound on the secrecy
capacity for any value of $\beta$, even $\beta>1$. Depending on the code, it
may happen that (15) achieves a maximum at $\beta>1$ and that the value
exceeds $I(X_{i};Y_{i})-I(E_{i};Y_{i})$.

####  4.4.4 Secrecy capacity upper bound

We conjecture that inequality (17), with the classical $Z$ replaced by Eve’s
quantum system E, represents an upper bound on the secrecy capacity of CVQKD.

$\mbox{Conjecture: }\quad C_{\rm secr}^{\rm Gauss}\leq I(X_{i};Y_{i}|E_{i}).$
(61)

######  Lemma 4.7.

The conditional mutual information $I(X;Y|E)$ can be written as the Devetak-
Winter value plus $S(E|X)$,

$I(X;Y|E)=I(X;Y)-I(E;Y)+S(E|X).$ (62)

Proof: We write $I(X;Y|E)=H(Y|E)-H(Y|XE)$ and then repeatedly use the chain
rule to re-express entropies conditioned on E as von Neumann entropies of E
conditioned on classical variables. Substituting $H(Y|E)=H(Y)+S(E|Y)-S(E)$ and
$H(Y|XE)=H(X)+H(Y|X)+S(E|XY)-S(EX)$ $=H(Y|X)+S(E|XY)-S(E|X)$, we get
$I(X;Y|E)=H(Y)-H(Y|X)-[S(E)-S(E|Y)]-S(E|XY)+S(E|X)$
$=I(X;Y)-I(E;Y)-S(E|XY)+S(E|X)$. Finally, we note that the post-measurement
state $\rho^{E}_{xy}$ is a pure state, yielding $S(E|XY)=0$. $\square$

The entropy $S(E|X)$ is computed similarly to $S(E|Y)$.

######  Lemma 4.8.

$S(E_{i}|X_{i})=g(\frac{\nu-1}{2}),\mbox{ with
}\nu^{2}=2\sigma_{Y}^{2}\Big{(}1-T+\frac{T}{1+2\sigma_{X}^{2}}+T\xi\Big{)}.$
(63)

Proof: Since E is a purification of the AB system, we can write
$S(E_{i}|X_{i})=S(B_{i}|X_{i})$. We derive the covariance matrix $B^{\prime}$
of the Wigner function for B’s post-measurement state after a homodyne
measurement on A. (Note that this covariance matrix does not depend on $x$.)
The pre-measurement covariance matrix of AB is

$\left(\begin{array}[]{cc}A&C\\\
C^{T}&B\end{array}\right)=\left(\begin{array}[]{cc}{\bf
1}V&\sigma_{z}\sqrt{T}\sqrt{V^{2}-1}\\\ \sigma_{z}\sqrt{T}\sqrt{V^{2}-1}&{\bf
1}\cdot 2\sigma_{Y}^{2}\end{array}\right).$ (64)

We have [12] $B^{\prime}=B-C^{T}(XAX)^{\rm inv}C$, where $X={1\;0\choose
0\;0}$ and ‘inv’ stands for the Moore-Penrose inverse. This yields

$B^{\prime}=\left(\begin{array}[]{cc}2\sigma_{Y}^{2}-\frac{T(V^{2}-1)}{V}&0\\\
0&2\sigma_{Y}^{2}\end{array}\right).$ (65)

The symplectic eigenvalue $\nu$ of $B^{\prime}$ is given by $\nu^{2}=\det
B^{\prime}$. In part of the expression we use
$2\sigma_{Y}^{2}=1+2T\sigma_{X}^{2}+T\xi$. $\square$

######  Corollary 4.9.

It holds that

$S(E_{i}|X_{i})=T\frac{\sigma_{X}^{2}}{2}(\frac{1}{1+1/2\sigma_{X}^{2}}+\frac{\xi}{\sigma_{X}^{2}})\log\Big{[}\frac{2e}{T\sigma_{X}^{2}}(\frac{1}{1+1/2\sigma_{X}^{2}}+\frac{\xi}{\sigma_{X}^{2}})^{-1}\Big{]}+{\mathcal{O}}(T^{2}\log\frac{1}{T}).$
(66)

Note that the function $x\ln\frac{e}{x}$ reaches a maximum value 1 at $x=1$.
For $T\ll 1$ it follows that $S(E_{i}|X_{i})\lesssim\log e$, with the maximum
achieved at $\sigma_{x}^{2}\approx 2/T$. Note that the information content per
photon scales as $S(E_{i}|X_{i})/\sigma_{X}^{2}\propto T$, which is what we
are used to see in Discrete-Variable QKD.

##  5 Numerical results

We present numerical results on the key ratio. At a given $T$, we parameterize
the scheme by setting $\sigma_{X}^{2}$, $q$, $\gamma$ and $\alpha$. We then
set the excess noise to be proportional to the laser power,
$\xi=0.01\cdot\sigma_{X}^{2}$. $\lambda_{1}$ and $\lambda_{0}$ follow from
(32, 34). The $n$ follows from (43), $n=\frac{\log q}{\gamma I(X_{i};Y_{i})}$.
The threshold $\theta$ follows from $\theta={\mathbb{E}}S_{u}+n\alpha$
$=\sigma_{Y|X}^{2}(n+\lambda_{1})+n\alpha$. The error probabilities
$\pi_{0},\pi_{1}$ are computed via (35,36). The $P_{\rm ACC}$ and $\sigma$
follow from Lemma 4.3 and Corollary 4.4. Finally, the secret key ratio is
given by (59).444 We do not use the large-argument approximations of the
Marcum Q function shown in Section 4.3, since it turns out that rather small
values of $n$ give good results.  We have evaluated the equations numerically
using Wolfram Mathematica.

We will denote the Devetak-Winter value (4), which is a function of the
channel properties and $\sigma_{X}^{2}$, by DW. We write maxDW for
$\max_{\sigma_{X}}DW$ at $\xi\to 0$. Without providing details we mention that
the numbers shown here are consistent with simulation results.

###  5.1 Secret key ratio ‘landscape’

Fig. 4 shows how the SKR (59) behaves as a function of the parameters $\alpha$
and $\gamma$ at $T=0.001$. At smaller $T$ the picture is very similar. There
is a long diagonal steep slope in the $(\alpha,\gamma)$-plane, to the
‘northeast’ of the maximum, where the SKR plummets below zero. Note that the
SKR is negative at $\gamma<1$. This is caused by the large modulation
variance, which gives rise to a factor $\approx\beta-1$ in (56). Fig. 5 shows
cross sections through the contour plot. Fig. 6 shows dependence on
$\sigma_{X}^{2}$. It is clear that $\sigma_{X}^{2}$ nontrivially influences
the SKR maximisation over $\alpha,\gamma$ (or vice versa). Fig. 7 shows how
the SKR decreases if $\sigma_{X}^{2}$ and the other scheme parameters are kept
constant while the distance increases.

Figure 4: Contour plots of the Secret Key Ratio as a function of $\alpha$ and
$\gamma$. Negative SKR is shown as white.

(a) Secret key ratio as a function of $\gamma$ for different $\alpha$.

(b) Secret key ratio as a function of $\alpha$ for different $\gamma$.

Figure 5: Secret key ratio as a function of $\alpha$ and $\gamma$. The
$T,\sigma_{x}^{2},q$ are fixed. Figure 6: Secret key ratio as a function of
$\sigma_{x}^{2}$ for different $\gamma$ and $\alpha$.

Figure 7: Secret key ratio as a function of distance for fixed scheme
parameters.

###  5.2 Optimisation with unrestricted modulation variance

Table 1 shows secret key ratios that we have obtained by tweaking
$\alpha,\gamma,\sigma_{X}^{2}$ for different values of the transmission $T$
and codebook size $q$. As observed before, the optimal $\alpha$ and $\gamma$
do not change much when the distance is increased, but the optimal
$\sigma_{X}^{2}$ scales as $1/T$ as predicted in Section 4.4.4. The obtained
SKR values are practically constant as a function of $T$. This is consistent
with the idea of an almost-constant upper bound $I(X_{i};Y_{i}|E_{i})$ on the
secrecy capacity. Note that our SKR lies far below the asymptote $\log
e\approx 1.44$ for the conjectured upper bound.

At $T<10^{-7}$ it seems that Wolfram Mathematica suffers from numerical
instabilities.

Table 1:  Optimised scheme parameters for various values of $T$ and $q$, without restriction on the modulation variance. The maxDW stands for the maximally achievable Devetak-Winter value at $\xi\to 0$ and depends only on $T$. The relation between $T$ and distance assumes a loss of 0.22 dB/km.  $T$ (Distance) MaxDW | $q$ | $\alpha$ | $\gamma$ | $\sigma_{X}^{2}$ | $n$ | $P_{\rm TA}$ | $P_{\rm FA}$ | SER | SKR
---|---|---|---|---|---|---|---|---|---
$10^{-3}$ (136 km) $7.2\times 10^{-4}$ | $2^{10}$ | $-0.51$ | 1.42 | 163 | 35 | 0.047 | 0.002 | 0.045 | $0.0015$
$2^{20}$ | $-0.32$ | 1.27 | 210 | 55 | 0.059 | 0.001 | 0.020 | $0.0021$
$2^{30}$ | $-0.25$ | 1.23 | 225 | 91 | 0.070 | 0.0009 | 0.013 | $0.0022$
$10^{-6}$ (273 km) $7.2\times 10^{-7}$ | $2^{10}$ | $-0.52$ | 1.42 | $1.7\times 10^{5}$ | 34 | 0.046 | 0.002 | 0.046 | $0.0015$
$2^{20}$ | $-0.33$ | 1.27 | $2.5\times 10^{5}$ | 54 | 0.057 | 0.001 | 0.020 | $0.0021$
$2^{30}$ | $-0.25$ | 1.23 | $2.2\times 10^{5}$ | 92 | 0.070 | 0.0009 | 0.013 | $0.0022$

##  6 Implementability

The main implementation hurdle is the sheer size of the codebook $w$: it has
$q\times n$ entries, where $q$ is exponential in the message size. One could
consider storing the whole codebook in a memory. The drawback is (a) huge
memory requirements; (b) long access times fetching table entries. A more
practical approach is to pseudorandomly generate codebook entries on the fly
without accessing RAM. PRNG algorithms have been reported that generate 64 to
128 bits of pseudorandomness per nanosecond per core [17, 18]. Let $b$ denote
the baud rate, i.e. the numer of pulses per second. In the time $1/b$ between
pulses, a whole $q$-element column of the codebook needs to be generated.
Hence the required PRNG speed is $q\cdot b$ codebook entries per second, where
each entry consists of multiple bits depending on the fine-grainedness of the
implementation. Taking for example $q=2^{10}$, $b=2^{22}$ results in $2^{32}$
required entries per second, versus the $\approx 2^{37}$ bits per second that
one core can generate. For higher baud rates and larger $q$ many parallel
PRNGs will be needed, e.g. implemented on FPGAs.

Note that the quality of the pseudorandom bits may not need to be high. Good
error-correcting properties are perhaps achievable with PRNGs that do not pass
randomness test suites, and which produce far more bits per clock cycle.

Another computational bottleneck is that Alice needs to evaluate the function
$F_{Y}^{\rm inv}$ for every single codebook entry. Fortunately, all sub-scores
can be computed in parallel. The process can be speeded up by first
determining all the possible discrete values of $c_{i}-w_{\ell i}$ and then
storing all the possible values of $F_{Y}^{\rm inv}(c_{i}-w_{\ell i}\mod 1)$
in a lookup table (LUT). The squaring operation can similarly be precomputed.
This would result in a two-dimensional LUT of sub-score values indexed by
discrete values for $x_{i}$ and $c_{i}-w_{\ell i}\mod 1$. Computing the score
$S_{\ell}$ then reduces to counting how often each entry in the LUT occurs in
the $\sum_{i=1}^{n}$ summation. It may be possible to store the whole LUT in
cache, which can be accessed much faster than general RAM. Similarly, the
scores $S_{1},\ldots,S_{q}$ can be kept in cache while ‘under construction’.

##  7 Discussion

The idea of random codebooks is very simple but completely impractical under
normal circumstances. In long-distance CVQKD, however, it becomes feasible to
consider implementing random codebooks, because of the extremely low code
rates. We have investigated this idea, making two design choices: (i) analog
xor-ing of $Y$ and a random codeword on the interval $[0,1]$; (ii) working
with a threshold and accepting only if there is a single candidate condeword
at the correct side of the threshold. The scoring system is somewhat
nontrivial but does not count as a design choice since it follows from
standard hypothesis testing.

The analog xor on $[0,1]$ achieves statistical decoupling of $C$ and $U$ in a
particularly simple way, without needing 8-component parts of $Y$. The choice
to work with a score threshold was motivated mostly by the wish to define a
scheme that can easily be analysed. It has the advantage that it creates a
straightforward option for rejecting blocks, hence allowing for trying
$\beta>1$. An alternative method would be to reject if there are no candidate
symbols below the threshold, and otherwise accept the symbol with the lowest
score.

The numerical analysis shows that secret key ratios can be obtained above the
Devetak-Winter value, provided that the modulation variance can be set higher
than in current CVQKD setups. For very low $T$ the predicted optimal ratio is
orders of magnitude above Devetak-Winter, but it also requires much larger
modulation variance $\sigma_{X}^{2}\propto 1/T$. Technical obstacles could
occur at such large modulation variance. We note that the optimal key ratio is
essentially constant as a function of $T$, which is consistent with the
conjectured upper bound (66). The amount of QKD key material per photon scales
as $T$, which is what happens in Discrete-Variable QKD.

We mention a number of topics for future work.

  * •

Discretisation. The numerics presented in Section 5 assume a very fine-grained
discretisation of the interval $[0,1]$, essentially a continuum. For actual
implementation it needs to be determined how coarse the discretisation can be
made while still keeping good error-correction performance.

  * •

A more extensive secret key rate analysis, taking into account electronic
noise, quantum efficiency and finite size (non-asymptotic) effects.

  * •

Optimized software and hardware implementation, with good parameter choices,
pseudorandom generators etc and a binary code for the final error correction
step.

  * •

Pseudorandomness. The statistical analysis in Section 4 assumes fully random
and independent codebook entries. Simulations should show how much of the
analysis stays valid in the case of pseudorandomness, as a function of the
seed size and the ‘quality’ of the PRNG.

  * •

Alternative scoring and decision procedures.

  * •

The (im)practicality of increased modulation variance.

### Acknowledgements

We gratefully acknowledge discussions with João dos Reis Frazão, Kadir Gümüş,
and Basheer Joudeh. Part of this work was supported by Groeifonds QDNL KAT-2
and by the Forwardt project (NWO CS.001).

## References

  * [1] S.J. Johnson, V.A. Chandrasetty, and A.M. Lance.  Repeat-Accumulate codes for reconciliation in Continuous Variable Quantum Key Distribution.  In 2016 Australian Communications Theory Workshop (AusCTW), pages 18–23.
  * [2] M. Milicevic, C. Feng, L.M. Zhang, and P.G. Gulak.  Key reconciliation with Low-Density Parity-Check codes for long-distance quantum cryptography.  2017\.  https://arxiv.org/pdf/1702.07740.pdf.
  * [3] X. Jiang, S. Yang, P. Huang, and G Zeng.  High speed reconciliation for CVQKD based on spatially coupled LDPC codes.  IEEE Photon. J., 10:1–10, 2018.
  * [4] D. Guo, C. He, T. Guo, Z. Xue, Q. Feng, and J. Mu.  Comprehensive high-speed reconciliation for continuous-variable quantum key distribution.  Quantum Information Processing, 19, 2020.  Article number 320.
  * [5] K. Gümüş, T.A. Eriksson, M. Takeoka, M. Fujiwara, M. Sasaki, L. Schmalen, and A. Alvarado.  A novel error correction protocol for continuous variable quantum key distribution.  Scientific Reports, 11, 2021.  article number 10465.
  * [6] P. Jouguet and S. Kunz-Jacques.  High performance error correction for quantum key distribution using polar codes.  Quantum Information & Computation, 14(3-4):329–338, 2014.
  * [7] M. Zhang, H. Hai, Y. Feng, and X.-Q. Jiang.  Rate-adaptive reconciliation with polar coding for continuous-variable quantum key distribution.  Quantum Information Processing, 20, 2021.  Article number 318.
  * [8] S. Yang, Z. Yan, H. Yang, Q. Lu, Z. Lu, L. Cheng, X. Miao, and Y. Li.  Information reconciliation of continuous-variables quantum key distribution: principles, implementations and applications.  EPJ Quantum Technology, 10, 2023.  article number 40.
  * [9] A. Leverrier, R. Alléaume, J. Boutros, G. Zémor, and P. Grangier.  Multidimensional reconciliation for a continuous-variable quantum key distribution.  Phys.Rev.A, 77:042325, 2008.
  * [10] G. Van Assche, J. Cardinal, and N.J. Cerf.  Reconciliation of a quantum-distributed Gaussian key.  IEEE Transactions on Information Theory, 50(2):394–400, 2004.
  * [11] S.J Johnson, A.M Lance, L. Ong, M. Shirvanimoghaddam, T.C. Ralph, and T. Symul.  On the problem of non-zero word error rates for fixed-rate error correction codes in continuous variable quantum key distribution.  New J. of Physics, 19:023003, 2017.
  * [12] Anthony Leverrier.  Theoretical study of continuous-variable quantum key distribution.  Phd thesis, Télécom ParisTech, November 2009.
  * [13] I. Devetak and A. Winter.  Distillation of secret key and entanglement from quantum states.  Proc.R.Soc.A, 461:207–235, 2005.
  * [14] A. Marie and R. Alléaume.  Self-coherent phase reference sharing for continuous-variable quantum key distribution.  Phys.Rev.A, 95:012316, 2017.
  * [15] Ü. Maurer.  Secret key agreement by public discussion from common information.  IEE Trans. on Information Theory, pages 733–742, 1993.
  * [16] N.M. Temme.  Asymptotic and numerical aspects of the noncentral chi-square distribution.  Computers Math. Applic., 25(5):55–63, 1993.
  * [17] S. Vigna.  Further scramblings of Marsaglia’s xorshift generators.  Journal of Computational and Applied Mathematics, 315:175–181, 2017\.
  * [18] MWC256 algorithm. https://prng.di.unimi.it/.