title: Blind information reconciliation with polar codes for quantum key distribution
authors: E. O. Kiktenko A. O. Malyshev A. K. Fedorov
text: 
  
  APS/123-QED
  
  
  	
  	
  	Russian Quantum Center, Skolkovo, Moscow 143025, Russia
  	Moscow Institute of Physics and Technology, Dolgoprudny 141700, Russia
  		Department of Mathematical Methods for Quantum Technologies, Steklov Mathematical Institute of Russian Academy of Sciences, Moscow 119991, Russia
  	NTI Center for Quantum Communications, National University of Science and Technology MISiS, Moscow 119049, Russia
  
  	
  	Russian Quantum Center, Skolkovo, Moscow 143025, Russia
  	Department of Physics, University of Oxford, Oxford OX1 3PG, UK
  
  	
  	Russian Quantum Center, Skolkovo, Moscow 143025, Russia
  	Moscow Institute of Physics and Technology, Dolgoprudny 141700, Russia
  
  	
  	
  	We suggest a new protocol for the information reconciliation stage of quantum key distribution based on polar codes.
  	The suggested approach is based on the blind technique, which is proved to be useful for low-density parity-check (LDPC) codes.
  	We show that the suggested protocol outperforms the blind reconciliation with LDPC codes, especially when there are high fluctuations in quantum bit error rate (QBER).
  	
  
  Blind information reconciliation with polar codes for quantum key distribution
      A.K. Fedorov
      December 30, 2023
  ==============================================================================
  
  
  
  
  
  § INTRODUCTION
  
  Quantum key distribution (QKD) allows growing a secret key between two legitimate users connected by a quantum and authenticated classical channels <cit.>.
  The security of QKD is based on the laws of quantum physics and it is guaranteed to be secure against any unforeseen technological developments, such as quantum computing <cit.>. 
  
  A workflow of QKD devices can be divided into two phases <cit.>. 
  During the first phase, QKD devices encode information in quantum bits (qubits), transmit and measure them, and then discard the records about preparation and measurement events occurred in incompatible bases.
  As a result of this phase, two legitimate parties, Alice and Bob, obtain so-called sifted keys, which are highly correlated but not identical bit strings.
  The measure of discrepancy between sifted keys is characterized by the quantum bit error rate (QBER).
  By virtue of quantum mechanics, QBER allows parties to estimate amount of information intercepted by an adversary Eve in the first phase.
  If it is low enough, parties proceed to the second phase, where they strive to distill a pair of secure keys out from the sifted keys.
  This phase consists of (i) information reconciliation procedure, where Alice and Bob communicate via the public authenticated channel to remove discrepancies in the sifted keys; 
  (ii) privacy amplification, where parties shorten their keys to eliminate the information which Eve has obtained by then.
  
  Information reconciliation methods proposed so far mainly rely on the Cascade method <cit.> 
  or low-density parity-check (LDPC) codes <cit.>.
  The latter approach has been studied in various aspects and it is used in commercial QKD devices.  
  An important LDPC-based information reconciliation technique is the blind method <cit.>, which allows operating without an a priori estimation of QBER.
  Its further improvement <cit.> introduces symmetry into the reconciliation and thus provides high efficiency with small number of communication rounds between parties. 
  We note that this method requires the same level of computational power for both sides of communications.
  In addition, this protocol is applicable only for discrete variables (DV) QKD protocols: in the case of continuous variables (CV) QKD, a one-way reverse reconciliation is required <cit.>.
  
  However, the performance of LDPC-code-based reconciliation schemes substantially degrades in the case of highly fluctuating QBER.
  As we demonstrate below, the probability of successful decoding for LDPC codes is a non-smooth function of disclosed bits number, which undermines the efficiency of the reconciliation.
  To overcome this challenge we construct a novel blind scheme based on polar codes.
  To the best of our knowledge, these codes were previously considered for non-interactive protocols only <cit.>.
  We also show that even though in non-interactive protocols polar codes demonstrate performance similar to that of LDPC codes, in the interactive regime they show a strong advantage, especially in the case of highly fluctuating QBER.
  To validate relevance of such consideration, we provide experimental evidence for high fluctuations of the QBER in real channels.
  
  
  
  § LDPC-CODE-BASED BLIND RECONCILIATION
   
  
  Information reconciliation based on LDPC codes works as follows.
  Before start of QKD phases, Alice and Bob agree upon some LDPC code with M× N parity-check matrix . 
  At the beginning of the reconciliation stage, Alice calculates a syndrome s= for her sifted key  of length N and discloses it over the public channel 
  (all operations are performed modulo-2, and both syndrome and keyzsare treated as column-vectors).
  Then Bob employs his N-bit sifted key  and announced syndrome s as input to the decoder.
  If decoding fails, parties drop this pair of keys and proceed to the next one.
  If decoding succeeds, parties verify reconciled keys by comparing their ε-almost universal_2 
  (for details, see Ref. <cit.>).
  If the verification check succeeds, parties put  and  to their storages of the verified key.
  Otherwise, they behave as if decoding has failed.
  
  The main figure of merit for successful reconciliation is called efficiency and is expressed as follows:
  
      f = M/N · h_ bin(q) = 1 - R/h_ bin(q).
  
  Here R=1-M/N is the code rate of the employed LDPC code, q is the QBER, and h_ bin(q)=-qlog_2q-(1-q)log_2(1-q) is the binary entropy function.
  According to the Slepian-Wolf bound <cit.>, decoding may succeed only when syndrome length is greater or equal than N h_ bin(q).
  Meanwhile, exactly M bits leak to Eve, so it is preferable to keep syndrome length as small as possible.
  Hence, the value of f shows how superfluous was the information revealed via the public channel; the closer f is to unity, the more efficient is the protocol.
  
  In practice reconciliation schemes are designed to cover a range of possible QBERs.
  In this case use of only one code with fixed rate R does not provide flexible enough reconciliation.
  For lower q it results in excessive amount of disclosed information, while for higher QBERs it decreases the probability of successful decoding.
  To provide smooth rate adaption one may use a pool of codes, as well as shortening and puncturing techniques widely used in coding theory <cit.>.
  Shortened bits are ones at pre-agreed positions with fixed known values, and punctured are ones at pre-agreed positions with truly random values.
  If s and p are numbers of shortened and punctured bits correspondingly, the resulting rate reads as R = (N-M-s)/(N-s-p).
  We note that usually the total number of auxiliary bits d = s+p is fixed.
  In further text to define d we use a parameter α such that d = Nα.
  
  However, the problem of rate-adaption is still relevant to the case when the actual value of the QBER is unknown, e.g. due to fluctuations of the quantum channel quality.
  To address this issue, it was proposed to adopt an analogue of the hybrid automatic repeat request scheme (HARQ) from the field of wireless communications <cit.>.
  The workflow of the resulting protocol, known as blind reconciliation, is as follows.
  
  Step 0. Alice and Bob choose an LDPC code with M× N parity check matrix  and rate =1-M/N. 
  Parties also choose α, which defines the number of auxiliary bits, and δ, which defines the number of bits disclosed in each additional round (we assume that δ divides α N).
  
  Step 1. Alice and Bob take sifted keys  and  of length (1-α)N and extend them with α N punctured bits.
  Let us denote the resulting N-bit extended key of Alice (Bob) by  ().
  The positions for puncturing are usually chosen with a pseudo-random generator (PRG) initialized with the same seed on both sides. 
  
  Step 3. Alice sends to Bob syndrome s=.
  
  Step 4. Bob tries to perform syndrome decoding and reports to Alice whether he succeeded or failed.
  In the case of success, parties complete the protocol and proceed to the verification stage, otherwise, parties proceed to Step 5.
  
  Step 5. If the remaining number of punctured bits is greater or equal to δ, Alice turns δ punctured bits into shortened by sending Bob values of these δ bits, and parties go back to the Step 4 (the positions for newly shortened bits are chosen with synchronized PRG). 
  Otherwise, parties decide that the whole blind reconciliation protocol failed.
  
  According to the Ref. <cit.>, the efficiency is as follows:
  
      f = M - α N + nδ/N(1- α) · h_ bin(q),
  
  where n is the resulting number of additional communication rounds performed in Step 5.
  We note that during the blind reconciliation the effective code rate R varies in the range
  
      R_max^ LDPC:=/1-α≥R≥-α/1-α =:R_min^ LDPC
  
  (first, the rate R_max^ LDPC is tried, then it is reduced down to R_max^ LDPC-δ/N, R_max^ LDPC-2δ/N, and so on down to R_min^ LDPC).
  
  Performance comparison shows that this approach allows parties to have better rate-adaptability and thus to improve the efficiency of the reconciliation <cit.>.
  Note that the parameter α, which is responsible for the rate-adaptability, should be chosen with care.
  On the one hand, it determines the available range of rates in Eq. (<ref>), and as it is increased, more code rates become available.
  On the other hand, higher values of α lead to smaller blocks of sifted keys being taken during each stage, and therefore to the longer processing time of the whole keys.
  Hence, we can introduce another way to widen the range of available rates by modifying Step 5 as follows.
  
  Step 5*. If the remaining number of punctured bits is greater or equal to δ, Alice turns δ punctured bits into shortened by sending Bob values of these δ bits.
  Otherwise, Alice turns δ sifted key positions into shortened by disclosing them to Bob.
  Then parties go to Step 4 
  (the resulting efficiency is still given by Eq. (<ref>), whichever bits were disclosed in additional rounds).
  
  
  
  The modified blind scheme is indeed able to cope with fluctuating QBER, but its performance deteriorates when fluctuations are too high.
  Bits of Alice's sifted key have conditional entropy of h_ bin(q) < 1 with respect to the bits of Bob's sifted key, while truly random punctured bits have conditional entropy equal to 1.
  Hence, when sifted key bits are disclosed, the gain for successful decoding probability is smaller compared to the case of disclosed punctured bits.
  This issue is captured by simulation results shown in Fig. <ref> (the results for polar codes are discussed in the next sections).
  One can see that the cumulative distribution function (CDF) for the number of disclosed bits required for successful reconciliation has a breakpoint after all punctured bits are spent, and then it increases much slower with the disclosed bits number.
  As a result, the efficiency degrades in the regions of QBER where parties have to disclose bits of sifted keys — we observe this in our numeric experiments, which are discussed below.
  The straightforward way to solve this issue is to increase the value of α, and thus extend the range of achievable rates shown in Eq. (<ref>).
  However, this solution decreases the length of processed sifted keys N(1-α) and thus increases the total number of protocol runs necessary to reconcile a given block of sifted keys reducing net reconciliation throughput.
  In what follows, we propose an original scheme based on polar codes which are free of this drawback.
  
  
  
  
  
  
  § POLAR CODE-BASED BLIND RECONCILIATION
  
  
  Polar codes are linear error-correcting codes which operate as follows. 
  Having N=2^n (with n>0) copies of a real noisy channel W, one can consider N specially constructed virtual channels, capacities of which tend to polarize, i.e. to be close either to zero or to unity.
  The fraction of virtual channels with close to unity capacity equals the capacity of real channel C(W), meanwhile approximately (1 - C(W)) · N channels have capacity near zero.
  Moreover, the higher is the value of N, the more accurate becomes this relation.
  
  Information bits may be sent over C(W) · N channels, which are close to the ideal without any encoding.
  The remaining bits are called frozen and are commonly set to zero.
  To encode information back from virtual channels to real, an N-bit vector consisting of information and frozen bits is multiplied by N × N generator matrix .
  The basic problem of polar codes encoding is how to choose positions of frozen bits.
  It turns out to be a hard problem since the direct calculation of each virtual channel capacity requires 𝒪(2^N) operations.
  However, there are many heuristics developed, allowing to estimate the “quality" of a virtual channel, and thus to choose the worst of them <cit.>.
  Whichever method is in use, its final aim is to derive an order of bit indices 𝒦, arranged from the worst to the best.
  Then first C(W) · N out of them are considered to be frozen ones, while others are information ones.
  
  The use of CRC-aided Tal-Vardy list decoder significantly improves error correction ability of polar codes <cit.>.
  In this approach a c-bit CRC of a transmitted (K-c)-bit message is written in c out of K non-frozen bits.
  The list decoder keeps up to L alternative decoding “paths” at each step of decoding and at the final step chooses output of that decoding path, which has correct CRC for decoded informational bits.
  The decoding algorithm has complexity 𝒪(L · N logN) and pushes error correction ability of polar codes to that of state-of-the-art LDPC and Turbo codes <cit.>.
  
  Next we propose a polar codes-based blind reconciliation protocol, which is 
  the main contribution of our work. 
  It is inspired by the LDPC codes-based version and takes benefit of the fact that virtual channels are sorted with respect to their capacities, what we show with further numeric simulations.
  
  Step 0. Alice and Bob choose a polar code with the rate R_max given by R_max = (K-c)/N, where N, K, and c are frame length, message length, and CRC-code length correspondingly.
  Parties also agree on a number δ which defines the number of bits disclosed in each of additional communication rounds.
  
  Step 1. Alice generates K truly random information bits, calculates a c-bit CRC of them and composes a codeword , with bits in first (N - K - c) positions from  set to zero, and informational plus CRC bits spread among remaining K + c bits in a fashion known to Bob.
  
  Step 2. Alice derives  — a polar image of , calculates = ⊕, where   is the Alice's sifted key of length N, and sends  to Bob via the public channel.
  
  Step 3. Bob calculates = ⊕, where  is Bob's sifted key corresponding to  and performs decoding, taking into account known  values of frozen bits.
  
  Step 4. If upon the end of decoding, output of some decoding path contains a codeword with valid CRC, then the protocol is completed, Bob obtains the recycled key =⊕, where  is an obtained vector of errors, and parties proceed to the verification stage.
  Otherwise, Bob reports failure to Alice and parties proceed to Step 5.
  
  Step 5 Alice announces additional δ bits from yet undisclosed bits. 
  Their positions are δ ones to the right of the most right position of already disclosed bits in the ranking .
  Then Step 4 is repeated.
  
  According to the security analysis performed in Ref. <cit.> the overall efficiency reads as
  
      f = N - K + c + nδ/N · h_ bin(q),
  
  where n is the resulting number of additional rounds.
  
  An important difference in comparison with the LDPC codes-based version is that the proposed protocol has no limit on the number of additional communication rounds.
  In the worst scenario all N bits of  are disclosed.
  During the protocol the effective code rate R varies in range
  
      R_max^ polar := K-c/N≥ R ≥ 0,
  
  so there is no any (unnatural) lower limit on the achievable rate.
  Also we note that length of the processed sifted key in the protocol always equals to N regardless of the covered code range.
  These two features of the interactive polar codes-based protocol appear to be beneficial in the case of highly fluctuating QBER as we show in the next section.
  
  
  
  § PERFORMANCE ANALYSIS
   
  
  To study the performance of the suggested protocol, we conduct two tests: with synthetic data and with experimental data from real QKD setup operating in urban environment.
  In both tests, we compare the performance of LDPC and polar codes-based protocol.
  
  
  
  
  We use two LDPC codes with rates = 0.6, 0.7 and consider three different values of α=0.05, 0.1, 0.15.
  The LDPC codes are constructed with the use of an improved edge-growth algorithm <cit.> with degree distribution polynomials given by Ref. <cit.>.
  The frame length is N=2048.
  To construct polar codes for each pair (, α) we choose value of K such that (K-c)/N=/(1-α), where the length of a CRC code c is 24 bits.
  This choice makes the initial code rates to be the same: R_max^ LDPC = R_max^ polar=:R_max [see Eq. (<ref>) and Eq. (<ref>)].
  
  Number of alternative decoding paths L in the Tal-Vardy list decoder was set to 64.
  During the synthetic data test, we generate pairs of sifted keys with fixed QBER q.
  The performance of two information reconciliation protocols is shown in Fig. <ref>.
  The parameter δ for the LDPC codes-based protocol is set to 30, and for the polar codes-based version δ is set to ⌊ 30/(1-α)⌉ in order to provide the same step with respect to the efficiency [see (<ref>) 
  and (<ref>)].
  For the LDPC code-based blind reconciliation protocol Step 5 is replaced with Step 5* and the region, where all punctured bits are spent (actually, where the difference between Step 5 and Step 5* takes place) is highlighted.
  We also show values of f_R_max(q) = (1-R_max)/h_ bin(q), which correspond to the (theoretical) efficiency of a single-round protocol.
  
  For each pair of (, α) we can observe three different types of protocol performance depending on the QBER level.
  Let us consider =0.7, α=0.1 as an example.
  If QBER is low (q≤ 0.02), both LDPC and polar codes cope with reconciliation without additional communication rounds.
  Thus their efficiency coincide with f_R_max.
  At moderate QBER values (0.02<q≤ 0.04) additional communication rounds start to be required, and both protocols show almost the same performance (one can see that sometimes polar codes show slightly worse performance than LDPC).
  If QBER is high (q>0.4) and LDPC codes are used, either reconciliation fails (if Step 5 of the original protocol is used), or f and n degrade (if Step 5 is replaced with Step 5*).
  Instead, thanks to smooth CDFs shown in Fig. <ref>, polar codes demonstrate monotone behaviour approaching some asymptotic value of f.
  Therefore we can conclude that the use of polar codes is beneficial in the case of high QBER fluctuations, where the third type of behaviour occasionally takes place.
  
  In the second test, we further support this statement and consider a sifted key generated by the industrial QKD devices.
  These devices operate in urban conditions, which results in high QBER fluctuations <cit.>. 
  In the Fig. <ref>(a) we show the QBER calculated for blocks of 2048 bits.
  
  As in the previous test, we consider LDPC and polar code-based blind reconciliation protocols with Step 5*. 
  We use the same set of parameters except for δ which is varied. 
  For the LDPC codes, we take δ=(10, 20, 30, 40, 50), and for the polar codes we multiply these values by (1-α)^-1.
  Variation of δ allows one to observe the trade-off between the efficiency and the resulting number of communication rounds.
  The results are presented in Fig. <ref>(b).
  The leftmost (rightmost) point for each curve corresponds to the largest (smallest) step size.
  Here we use the mean number of communication rounds per 1 Mbit of sifted key processed as the basic metric.
  It emphasizes the fact that with polar codes one processes sifted keys blocks of fixed length.
  The plot shows that for every combination of α and R_min the polar codes-based protocol outperforms the LDPC codes-based one.
  
  We also provide figures for performance of non-interactive protocols based on LDPC and polar codes.
  We take mean value of the QBER q_ mean=0.036 and choose single LDPC and polar code with respect to every target efficiency f_ target=1, 1.1, …, 1.9.
  In the case of LDPC codes we use pool of codes with rates R=0.55, 0.6, … ,0.75, set α=0.05 and then choose the number of punctured bits p and shortened bits
   s=α N-p to have f_ target≈ (1-R-p/N)/[(1-α)h_ bin(q_ mean)] (the same frame length N=2048 is used).
  Since additional communication rounds are not employed, we use fraction of successful reconciliation stages as the main figure of merit.
  We show the resulting frame error rate (FER) as a function of resulting efficiency calculated for reconciled blocks in Fig. <ref>(c).
  We see that for reasonable FERs the resulting (in)efficiency is much higher than the one for the interactive protocols.
  To compare, we note that for all tested parameters of interactive protocols we obtain at most one frame error for a number of processed blocks varied from 4250 to 5000 depending on protocol parameters.
  So the estimated FER of interactive protocols is of the order of 10^-4.
  Also, we see that polar codes demonstrate slightly worse performance than LDPC ones in the non-interactive setting.
  
  
  
  § CONCLUSION AND OUTLOOK
  
  
  We have proposed a new interactive protocol for the information reconciliation stage in QKD based on polar codes.
  We have shown that even though polar codes show the same or even slightly worth performance compared with LDPC codes in non-interactive protocols, the situation drastically changes in interactive schemes and in the case of high fluctuations of the QBER.
  In contrast to the LDPC code-based analogue, the proposed protocol shows consistent gain in successful decoding probability during the process of rate-adaption.
  In addition, it processes sifted key blocks of a full-frame length.
  These features allow polar codes to outperform LDPC codes in the case of highly unstable QBER level.
  Thus, they appear to be a promising alternative to LDPC codes for QKD setups operating in realistic conditions.
  We also note that polar codes are of interest for CV-QKD systems, where one-way reverse information reconciliation is a must.
  An additional benefit of the suggested protocol is that it uses computational resources of only one communicating side, which opens the perspective for the next generation of QKD networks with star-like topology.
  Moreover, additional optimizations and fine-tuning of parameters (e.g. varying of step size in a way as it was implemented for LDPC codes version <cit.>), can be also considered.
  
  
  
  § ACKNOWLEDGEMENTS
  
  
  We thank J. Martínez-Mateo for useful comments. 
  The work is supported by RFBR (Grant No. 18-37-00096, development of the polar codes; Grant No. 18-37-20033, research on the optimization of LDPC codes).
  
  1
  
  Gisin2002
  N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden,
  Quantum cryptography,
  https://dx.doi.org/10.1103/RevModPhys.74.145Rev. Mod. Phys. 74, 145 (2002).
  
  Scarani2009
  V. Scarani, H. Bechmann-Pasquinucci, N.J. Cerf, M. Dusek, N. Lütkenhaus, and M. Peev,
  The security of practical quantum key distribution,
  https://dx.doi.org/10.1103/RevModPhys.81.1301Rev. Mod. Phys. 81, 1301 (2009).
  
  Lo2014
  H.-K. Lo, M. Curty, and K. Tamaki,
  Secure quantum key distribution,
  https://dx.doi.org/Nat. Photon. 8, 595 (2014).
  
  Lo2016
  E. Diamanti, H.-K. Lo, B. Qi, and Z. Yuan,
  Practical challenges in quantum key distribution,
  https://dx.doi.org/10.1038/npjqi.2016.25npj Quant. Inf. 2, 16025 (2016).
  
  Shor1997
  P.W. Shor,
  Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer,
  http://dx.doi.org/10.1137/S0036144598347011SIAM J. Comput. 26, 1484 (1997).
  
  Kiktenko2016
  E. Kiktenko, A. Trushechkin, Y. Kurochkin, and A. Fedorov,
  Post-processing procedure for industrial quantum key distribution systems,
  https://doi.org/10.1088/1742-6596/741/1/012081J. Phys.: Conf. Ser. 741, 012081 (2016).
  
  Brassard1994
  G. Brassard and L. Salvail,
  Secret-key reconciliation by public discussion,
  https://dx.doi.org/10.1007/3-540-48285-7_35Lect. Notes Comput. Sc. 765, 410 (1994).
  
  Martinez2015
  J. Martínez-Mateo, C. Pacher, M. Peev, A. Ciurana, and V. Martin,
  Demystifying the information reconciliation protocol cascade,
  https://dblp2.uni-trier.de/db/journals/qic/qic15Quant. Inf. Comp. 15, 453 (2015).
  
  Pedersen2015
  T. Pedersen and M. Toyran,
  igh performance information reconciliation for QKD with CASCADE,
  https://dblp2.uni-trier.de/db/journals/qic/qic15Quantum. Inf. Comput. 15, 419 (2015).
  
  Elkouss2009
  D. Elkouss, A. Leverrier, R. Alleaume, and J.J. Boutros,
  `Efficient reconciliation protocol for discrete-variable quantum key distribution,
  https://dx.doi.org/10.1109/ISIT.2009.5205475
  in Proceedings of the IEEE International Symposium on Information Theory, Seoul, South Korea, (2009), p. 1879 
  
  Martinez2010
  D. Elkouss, J. Martínez-Mateo, and V. Martin,
  Secure rate-adaptive reconciliation,
  https://dx.doi.org/10.1109/ISITA.2010.5650099
  in Proceedings of the IEEE International Symposium on Information Theory and its Applications (ISITA), Taichung, Taiwan (IEEE, 2010), p. 179.
  
  Martinez20102
  J. Martínez-Mateo, D. Elkouss, and V. Martin,
  Improved construction of irregular progressive edge-growth Tanner graphs,
  https://dx.doi.org/10.1109/LCOMM.2010.101810.101384IEEE Comm. Lett. 14, 1155 (2010).
  
  Martinez2012
  J. Martínez-Mateo, D. Elkouss, and V. Martin, 
  Blind reconciliation,
  Quant. Inf. Comp. 12, 791 (2012).
  
  Mink2012
  A. Mink and A. Nakassis, 
  LDPC for QKD Reconciliation,
  https://researchpub.org/journal/cstij/number/vol2-no2/vol2-no2-1.pdfComput. Sci. Technol. Int. J. 2, 2162 (2012).
  
  Martinez2013
  J. Martínez-Mateo, D. Elkouss, and V. Martin,
  Key reconciliation for high performance quantum key distribution,
  https://dx.doi.org/doi:10.1038/srep01576Sci. Rep. 3, 1576 (2013).
  
  Kiktenko2017
  E.O. Kiktenko, A.S. Trushechkin, C.C.W. Lim, Y.V. Kurochkin, and A.K. Fedorov, 
  Symmetric blind information reconciliation for quantum key distribution,
  http://dx.doi.org/10.1103/PhysRevApplied.8.044017Phys. Rev. Applied 8, 044017 (2017).
  
  Liu2020
  Z. Liu, Z. Wu, and A. Huang,
  Blind information reconciliation with variable step sizes for quantum key distribution,
  https://doi.org/10.1038/s41598-019-56637-ySci. Rep. 10, 171 (2020).
  
  Nakassis2014
  A. Nakassis and A. Mink,
  Polar codes in a QKD environment,
  https://doi.org/10.1117/12.2050919Proc. SPIE 9123, 912305 (2014).
  
  Jouguet2014
  P. Jouguet and S. Kunz-Jacques,
  High performance error correction for quantum key distribution using polar codes,
  https://doi.org/10.5555/2600508.2600516Quantum Inf. Comput. 14, 329–338 (2014).
  
  Nakassis2017
  A. Nakassis,
  Polar codes for quantum key distribution,
  https://doi.org/10.6028/jres.122.042J. Res. Natl. Inst. Stan. 122:42 (2017).
  
  Yan2018
  S. Yan, J. Wang, J. Fang, L. Jiang, and X. Wang,
  An improved polar codes-based key reconciliation for practical quantum key distribution,
  https://doi.org/10.1049/cje.2017.07.006Chinese J. Electron. 27 250 (2018).
  
  Lee2018
  S. Lee, J. Park, and J. Heo,
  Improved reconciliation with polar codes in quantum key distribution,
  Quantum Info. Comput. 18, 795 (2018).
  
  Lee2018b
  S. Lee and J. Heo,
  Efficient reconciliation protocol with polar codes for quantum key distribution,
  https://doi.org/10.1109/ICUFN.2018.84367872018 Tenth International Conference on Ubiquitous and Future Networks (ICUFN) 40-43 (2018).
  
  Arikan2008
  E. Arikan,
  Channel polarization: A method for constructing capacity-achieving codes,
  https://dx.doi.org/10.1109/CCNC.2014.6940497in Proceedings of the IEEE International Symposium on Information Theory, Las Vegas, NV (IEEE, 2011), p. 1. 
  
  Fedorov2018
  A.K. Fedorov, E.O. Kiktenko, and A.S. Trushechkin,
  Symmetric blind information reconciliation and hash-function-based verification for quantum key distribution,
  https://doi.org/10.1134/S1995080218070107Lobachevskii J. Math. 39, 992 (2018).
  
  Slepian1973
  D. Slepian, and J. Wolf,
  Noiseless coding of correlated information sources,
  https://dx.doi.org/10.1109/TIT.1973.1055037IEEE Trans. Inf. Theory 19, 471-480 (1973).
  
  Tal2015
  I. Tal and A. Vardy,
  “List Decoding of Polar Codes,”
  IEEE Transactions on Information Theory, vol. 61, no. 5, pp. 2213-2226, May 2015.
  
  
  He2018
  G. He, J.-C. Belfiore, X. Liu, Y. Ge, R. Zhang, I. Land, Y. Chen, R. Li, J. Wang, G. Yang, and W. Tong,
  Beta-expansion: A theoretical framework for fast and recursive construction of polar codes,
  https://dx.doi.org/10.1109/GLOCOM.2017.8254146
  in Proceedings of the IEEE Global Communications Conference, Singapore (IEEE, 2018), 17506378.
  
  Polar_HARQ
  K. Chen, K. Niu, and J. Lin, 
  “Capacity-achieving rateless polar codes,” 
  https://doi.org/10.1007/s10946-018-9697-1IEEE Comm. Lett. 17, 1996 (2013).
  
  Duplinskiy2018
  A.V. Duplinskiy, E.O. Kiktenko, N.O. Pozhar, M.N. Anufriev, R.P. Ermakov, A.I. Kotov, A.V. Brodskiy, R.R. Yunusov, V.L. Kurochkin, A.K. Fedorov, and Y.V. Kurochkin,
  Quantum-Secured Data Transmission in Urban Fiber-Optics Communication Lines,
  https://doi.org/10.1007/s10946-018-9697-1J. Russ. Laser Res. 39, 113 (2018).
  
  
  