Low-Dimensional Reconciliation for Continuous-Variable Quantum
Key Distribution
Laszlo Gyongyosi∗1,2,3 and Sandor Imre2

arXiv:1308.1391v3 [quant-ph] 7 Jan 2018

1

School of Electronics and Computer Science, University of Southampton, Southampton,
SO17 1BJ, UK
2
Department of Networked Systems and Services, Budapest University of Technology and
Economics, Budapest, H-1117 Hungary
3
MTA-BME Information Systems Research Group, Hungarian Academy of Sciences,
Budapest, H-1051 Hungary

Abstract
We propose an efficient logical layer-based reconciliation method for continuous-variable
quantum key distribution (CVQKD) to extract binary information from correlated Gaussian
variables. We demonstrate that by operating on the raw-data level, the noise of the quantum
channel can be corrected in the low-dimensional (scalar) space and the reconciliation can be
extended to arbitrary dimensions. The CVQKD systems allow an unconditionally secret communication over standard telecommunication networks. To exploit the real potential of CVQKD
a robust reconciliation technique is needed. It is currently unavailable, which makes it impossible
to reach the real performance of the CVQKD protocols. The reconciliation is a post-processing
step separated from the transmission of quantum states, which is aimed to derive the secret
key from the raw data. The reconciliation process of correlated Gaussian variables is a complex
problem that requires either tomography in the physical layer that is intractable in a practical
scenario, or high-cost calculations in the multidimensional spherical space with strict dimensional limitations. To avoid these issues we define the low-dimensional reconciliation. We prove
that the error probability of one-dimensional reconciliation is zero in any practical CVQKD
scenario, and provides unconditional security. The results allow to significantly improve the
currently available key rates and transmission distances of CVQKD.

1

Introduction

The QKD (Quantum Key Distribution) systems represent one of the most important practical
applications of quantum information theory [1-11], [49-53]. The QKD schemes allow to establish
an unconditionally secret communication between distant parties by exploiting the fundamental
attributes of quantum mechanics [10-14], [34-42], [46-53]. The QKD protocols can be classified into
three main classes [1-11], [49-53]: DVQKD (Discrete-Variable), CVQKD (Continuous-Variable)
and DPR-QKD (Differential Phase Reference) systems. The firstly introduced QKD protocols
were based on discrete variables, such as photon polarization. Since the polarization of single photons cannot be encoded and decoded efficiently because of the technological limitations of current
∗

Email: l.gyongyosi@soton.ac.uk

1

physical devices, the CVQKD systems were proposed. In a CVQKD system, the information is
encoded on continuous variables by a Gaussian modulation, such as in the position or momentum
quadratures of coherent states. In comparison to DVQKD, the modulation and decoding of continuous variables does not require specialized devices and can be implemented efficiently by standard
technologies that are available and in widespread use. The CVQKD systems also provide higher
secret key rates and higher communication distances. The CVQKD protocols can be further classified into one-way and two-way systems. In a one-way CVQKD system, Alice, the sender transmits
her continuous variables to the receiver, Bob, over a quantum channel [9-11]. In a two-way system,
Bob starts the communication, Alice adds her internal secret to the received message, and this is
then sent back to Bob (e.g., one mode of the coupled beam that is outputted from a beamsplitter
is transmitted back to Bob). The two-way CVQKD systems were introduced for practical reasons
to exceed the limitations of one-way CVQKD, such as low key rates and short communication
distances [1-13]. The two-way CVQKD protocols exploit the benefits of multiple channel uses and
allow the leak of only lower valuable information to the eavesdropper. On the other hand, the
achievable distances of one-way CVQKD can be extended by efficient channel-estimation methods
[36], which is important since the one-way protocol currently is still the focus of the research owing
to the easy experimental implementation.
The CVQKD schemes use continuous-variable Gaussian modulation which provably provides
optimal key rates against collective attacks at finite-size block lengths [1-11] and also maximizes the
mutual information between Alice and Bob. The security of CVQKD has also been proven against
collective attacks in the asymptotic regime with infinite block sizes, and against arbitrary attacks
in the finite-size regime [9, 13], [39-40]. One of the most critical points in regard to CVQKD is
the post-processing [1-11], [47]. The post-processing is aimed to correct the errors of the quantum
channel that are cumulated in the raw data. The raw data is a correlated binary bitstring at Alice’s
and Bob’s side, generated by the random quadrature measurements at the parties. Each quadrature
measurement results in a unit in the raw data. The raw data itself is not a secret key; it consists only
of the results of the random quadrature measurements. The secret key is a uniformly distributed
long binary string that will be combined with the raw data elements, and will be added to the
picture only in the stage of logical layer manipulations. The logical layer-based post-processing
phase uses purely classical tools: precisely a classical-authenticated communication channel and
classical error-correction algorithms. This method basically does the same in the logical layer as
the tomography does in the physical layer, and it consists of two main phases: the reconciliation
procedure with several error-correction steps, and privacy amplification. Without loss of generality,
the aim of reconciliation is to extract as much valuable information from the correlated raw data
as possible and to generate an error-free key between Alice and Bob. The privacy amplification
operates on the shared, error-corrected common secret to extract the final key between the parties,
and the aim of this phase is to reduce to zero the possible knowledge of an eavesdropper from the
elements of the key. The implementation of tomography in the physical layer is a complex problem,
and it is intractable in a practical scenario. But, well-characterized solutions can be proposed in
the logical layer for the same purpose of giving an analogous, and also more valuable answer to
the reconciliation of correlated Gaussian variables than the physical-layer tomography ever could.
The theoretical background that makes the logical layer-based reconciliation possible also allow
us to view the noisy physical quantum channel as a binary Gaussian channel in the logical layer
[1-13]. This has the immediate consequence that very efficient binary error-correction tools can
be integrated from the world of traditional communication theory into CVQKD—which would not

2

be available for the physical-layer tomography to extract binary information from the correlated
Gaussian variables.
The raw data shared over the quantum channel is noisy, and this must be corrected to distill the
final secret key. Since a large amount of raw data bits have to be shared between the parties, the
complexity of the post-processing phase is a critical point in CVQKD protocols, and it has to be
in order to be as low as possible. The existing logical layer-based solutions require high-complexity
calculations in the high-dimensional spherical space for the reconciliation of Gaussian variables
[9-11]. Since a complex reconciliation is so undesirable, the aim is to find a more efficient solution
in the logical layer. A slice method is a different reconciliation approach, which is also used in
the current reconciliation steps of CVQKD for short distances, and can be implemented without
spherical operations [41]. Basically, the error correction in the reconciliation phase consists of two
phases: First, the binary-channel codes (such as LDPC – Low Density Parity Check, turbo codes,
polar codes, etc. [22-35]) that are used for the transmission of the classical bits in the reconciliation
phase are corrected. Second, the real Gaussian noise on the received raw-data vector must be
corrected, which noise arises from the effect of the quantum channel (i.e., from Eve’s optimal
Gaussian attack, which is considered in CVQKD protocols [1-11]). In this work we focus on the
second phase of reconciliation, which has crucial role in CVQKD, since this phase makes it possible
to correct the errors incurred on the quantum channel and to share an error-free key between Alice
and Bob. Since the raw data is formulated by continuous real numbers resulted from quadrature
measurements at the parties, the reconciliation problem is analogous to the well-known subject of
binary-channel coding that operates on binary-channel codes. It also follows that the complicated
and difficult to implement physical-layer tomography can be replaced in the logical level by binary
error-correction schemes that are easier to implement. According to a critical security requirement
of QKD, in the reconciliation phase only uniform distribution can be transmitted over the classical
channel, otherwise the information theoretic security of the protocol cannot be proven [1-13]. The
raw data itself follows Gaussian random distribution because these arise from a Gaussian random
source; however, by applying some trivial operations on the raw data units, the desired uniform
distribution can be reached, and the reconciliation can be performed with unconditional security,
as we will show in detail in Section 3.
A relevant difference of DV and CV protocols is that the physical quantum channel that connects the parties is characterized in a different way. For DVQKD the appropriate channel model
is the Binary Symmetric Channel (BSC), which allows the use of the well-known channel-coding
and error-correction tools in the post-processing phase. It also follows that for DVQKD there is a
clear connection between the characteristics of the quantum channel and the world of traditional
communication theory. On the other hand, for a CVQKD system the situation is more complicated,
because the proper description of a Gaussian quantum channel requires several physical parameters
(transmittance, variance, shot noise, excess noise, etc.) which allows no to draw a clear connection.
To solve the situation for one-way CVQKD, the multidimensional reconciliation schemes [9-12] have
been introduced, which made possible the conversion of the physical AWGN (Additive White Gaussian Noise) quantum channel to a logical binary AWGN (BAWGN) channel, where the Gaussian
random noise arises directly from the quantum-level transmission. Precisely, it works only for low
dimensions and the resulted logical channel approximates only a binary Gaussian channel. As the
accuracy of the physical-logical channel conversion gets closer to perfect the resulting logical channel gets closer to a binary Gaussian channel. At low SNRs (Signal-to-Noise Ratio) the capacities
of the Gaussian quantum channel and the binary Gaussian channel coincidence, and this is partic-

3

ularly convenient because for low SNRs the problem of channel conversion can be reduced to the
approximation of a binary Gaussian channel. From this follows, that the efficiency of the channel
conversion procedure can be described by the relevant parameters of the resulting logical binary
channel (such as its variance and capacity). This conversion efficiency has tremendous importance
because it also determines the efficiency of the reconciliation process, i.e., the performance of the
protocol. In the multidimensional reconciliation the conversion procedure required the use of the
spherical space and its sophisticated operations [9-11], which is a complex process. The difficult
computational steps of post-processing just cause further slowing down in the very sensitive key
rates that are so difficult to establish. These requirements of the reconciliation phase are strongly
undesired in a practical CVQKD scenario, so a simpler reconciliation would be desirable—for both
one- and two-way systems. The problem of efficient post-processing is more crucial for two-way
CVQKD, due to its more complex physical architecture.
To exploit the real potential of two-way CVQKD systems, efficient post-processing is needed.
It is still missing, which makes it not possible to attain the true performance of two-way CVQKD.
This is the main reason why the theoretical maximum of key rates and ranges cannot be exceeded
in the current practical scenarios; however, the protocol in its ‘hardware level’ is built to be strong,
and would be capable of more performance than is currently available. To boost up the performance
of the two-way CVQKD protocols over the current limits, we introduce an efficient reconciliation
method that makes it possible to increase the key rates and to extend the currently available distance
ranges. The mathematical apparatus that stands behind the multidimensional reconciliation puts
a strict upper bound on the available dimensions, and limits its maximum [9-11], [42]. The reason
is that in higher dimensions the required spherical division operations do not exist. In our scheme,
we also eliminate this serious drawback and extend the reconciliation of Gaussian variables to
arbitrary high dimensions. The proposed approach also makes possible to get a closer and more
precise approximation of the binary Gaussian channel, in comparison to the multidimensional case.
Since the post-processing phase uses the binary form of the continuous variables, in fact, we
do not have to decode the Gaussian variables in the multidimensional space. As a corollary,
arbitrary high-precision approximation of the logical binary Gaussian channel can be made in the
non-spherical space by using considerable dimensions. We exploit it in this work to construct a
scalar reconciliation that breaks with the traditions of the previously introduced approaches [9-11],
[42,46], and uses only the space of scalar variables. The proposed scalar reconciliation is also able to
transform the physical Gaussian quantum channel into a logical binary Gaussian channel in two-way
CVQKD, and the same benefits can be exploited as in the case of multidimensional reconciliation.
However since our scheme is not limited to eight dimensions, an arbitrary precision can be reached in
the approximation of the logical binary Gaussian channel. As follows, the accuracy of the conversion
between the physical Gaussian quantum channel and the logical Gaussian channel can be improved
beyond the current limits. Another issue in the current approaches is the requirement of spherical
calculations. To make the existing post-processing approaches more efficient, we have to eliminate
the multidimensional operations. The reconciliation of Gaussian variables would be much easier,
if we found a solution that would make it possible to extract the final key from the noisy data by
simple calculations in the level of scalar space. It immediately follows that this would significantly
increase the efficiency of the reconciliation process, and would lead to a negligible complexity and
computational power in the error-correction procedure.
In this paper we define low-dimensional (scalar) reconciliation for CVQKD. It brings significantly higher noise-resistance and information-transmission capability, extended transmission dis-

4

tances, and improved key rates. The proposed method does the reconciliation of Gaussian variables
without the need of any physical-layer tomography or multidimensional operations. We demonstrate the results for two-way CVQKD. The scheme is backward compatible it also can be applied
to one-way CVQKD.
The novel contribution of our paper is as follows:
• The reconciliation process of correlated Gaussian variables is a complex problem that requires
either tomography in the physical layer that is intractable in a practical scenario, or high-cost
calculations in the multidimensional spherical space with strict dimensional limitations.
• To avoid these issues, we propose an efficient logical layer-based reconciliation method for
CVQKD to extract binary information from correlated Gaussian variables.
• We demonstrate that by operating on the raw-data level, the noise of the quantum channel
can be corrected in the low-dimensional scalar space and the reconciliation can be extended to
arbitrary dimensions.
• We prove that the error probability of scalar reconciliation is zero in any practical CVQKD
scenario, and provides unconditional security.
• The results allow to significantly improve the currently available key rates and transmission
distances of CVQKD.
This paper is organized as follows. In Section 2, preliminary findings are summarized. In
Section 3, we introduce the reconciliation scheme. Section 4 provides the theorems and proofs.
In Section 5, a numerical evidence is proposed. Finally, in Section 6, we conclude the paper.
Supplemental information is included in the Appendix.

2

System Model

In comparison to one-way CVQKD protocols, in two-way CVQKD the two uses of the quantum
channel lead to superadditive private classical capacity (more precisely, the superadditivity of security threshold leads to a subadditive eavesdropper [1-8], [14]), which makes it possible to decrease
the amount of valuable information leaked to Eve. The subadditive eavesdropper is a consequence
of the multiple uses of the quantum channel. The superadditivity of the security threshold can also
be expressed in terms of tolerable excess noise and the channel transmission [1]. In the two-way
scenario, Eve perturbs the quantum channel N1 , which causes a noise in the transmission that will
have an effect on the success of her second attack. From the two attacks, comparatively lower valuable information will be available to Eve so that she would not have made an attack on N1 . The
reason for this is that the amount of valuable information transmitted over N2 is already decreased
by the attack of N1 . More attacks add more noise into the transmission, which also decreases the
amount of mutual information between Alice and Bob. With the increased number of channel uses
we allow Eve to get as much less valuable information as possible. If Alice encodes her information
into the noisy state that is received from N1 , and then sends it back to Bob over N2 , then the parties
can achieve the desired phenomenon of superadditivity [1-4]. The amount of valuable information
leaked to Eve is also decreased by the multiple uses of the quantum channel. The errors caused by
more channel uses can be corrected in the reconciliation phase by traditional error-correction tools.
5

In fact, by utilizing multiple channel uses, we ‘set a trap’ for Eve, since again and again she will
attack the quantum channel. Eve will also simultaneously decrease the amount of eavesdropped
information by her actions. The idea works well, because in the post-processing phase the parties
can correct the errors caused by Eve, thus, finally, it can be concluded that it was a correct decision
to increase the number of channel uses. Of course, if we had perfect amplifiers and ideal devices,
then, in theory, it would be possible to completely eliminate Eve from the picture in the asymptotic
scenario to make unnecessary the privacy amplification by allowing an infinite amount of channel
uses to maximally exploit the superadditivity property (more precisely, the superadditivity of the
security-threshold parameter hence the strong subadditivity of Eve). However, in practice it is
trivially not possible to circulate over and over the same beam an infinite amount of times, due to
the losses and imperfections of the physical devices.
Let us review the data components of the protocol that are needed for the appropriate description of the scalar reconciliation for the two-way CVQKD protocol. Our description will be as
detailed as desired for further analysis, and will not take into account the particular description
of any components of an experimental protocol. The raw data is generated by the use of noisy
Gaussian channels N1 and N2 , and by the parties’ internal secrets. The aim of the quantumlevel transmission is to generate two nearly identical classical bitstrings between the parties. All
quantum-level interactions are closed at this point, and the post-processing phase, which uses the
raw data of the parties and a classical authenticated channel, is brought to life. The post-processing
phase consists of the processes of reconciliation and privacy amplification. The valuable key will
be generated in the reconciliation phase by using the raw data and a random secret. It consists
of error-correction phases as well. The privacy amplification is geared toward performing security
checks on the elements of the generated key, and it is not part of our description. We will assume
reverse reconciliation (RR), which is desirable since the mutual information between Bob and Eve
is provably lower than between Alice and Eve [1-6], [9-14], [50]. It is because if Bob starts to run
the reconciliation phase using his already noisy raw data, then only lower valuable information can
be leaked to Eve during the procedure in comparison to if Alice would have started to run the
reconciliation, from her ideal raw data (from the perspective of the raw data-level reconciliation,
the noise that arises from the first channel use has no relevance, as will be clarified later, and Alice’s
raw data can be viewed as ideal).
The run of the protocol is sketched as follows. Let us denote Alice’s binary raw data by X,
and Bob’s binary raw data by X 0 , where |X| = |X 0 | =N units. Alice’s raw data is generated by a
random quadrature measurement of M1 . Alice’s selects two random variables x and p each drawn
from a Gaussian distribution, that encodes her position and momentum quadratures and obtains a
phase space vector SAlice = | xA +ipA i . Bob also draws a phase space vector SBob = | xB +ipB i . The
0
noisy SBob
is received by Alice in the first phase via channel N1 in the beam Bout . Alice’s raw data
is defined as follows:
X≡M1 (Bout +SAlice ) =N1 (SBob ) +SAlice .
(1)
The outgoing beam Aout will contain the other mode of the coupled beam. Bob’s raw data is
generated by the M2 random quadrature measurement applied on the beam Aout , as:
0
0
X 0 ≡M2 (Aout ) =Bout
+SAlice
=N2 (N1 (SBob )) +N2 (SAlice ) ,

(2)

where Aout contains the noisy version of the second mode of the beam. A detailed description will
be given in Section 2.1.

6

A simplified view of a PM (Prepare-and-Measure: entanglement-free) two-way CVQKD protocol
with homodyne measurements M1 , M2 at the parties and with RR is shown in Fig. 1. Alice and
Bob are connected by a noisy quantum channel and a classical authenticated channel. The quantum
communication is started by Bob. Alice receives Bob’s quantum message and then couples it with
her quantum message using a BS (Beam Splitter) to create a correlated signal. The first mode of
the beam is measured by Alice, using a random quadrature measurement; the second mode is sent
back to Bob, who will also apply a random quadrature measurement on the received beam. After
the measurements have been performed, the parties inform each other about the used position and
momentum quadratures over the classical channel, and discard the irrelevant data. The resulted
raw data is a collection of correlated Gaussian variables. Since these binary strings follow Gaussian
random distribution, they cannot be transmitted directly over the classical channel. In reverse
reconciliation, Bob has to make the probability distribution of his raw data to uniform. He can do
this by applying an appropriate function C (·) (will be clarified in Section 3) on his j -th raw data
block, denoted by X0j . Bob then generates a random key Uj (the full key vector K
 is granulated
0
0
into several Uj -s), and multiplies it with his raw data C Xj . Alice receives C Xj Uj , and using
her C (Xj ), she computes the noisy U0j . Next, the errors of the secret key that arise from the noise
of the quantum channel will be corrected. This phase is modeled by the scalar reconciliation box
at Alice’s side. The aim of the scalar reconciliation is to share an error-free key K between Alice
and Bob. From Alice, it requires the correction of the noise on U0j to get back Bob’s Uj , using
only scalar operations without the need of the multidimensional spherical space.

2.1

Coding Scheme

In the following description we give a considerable view of the coding of two-way CVQKD, focusing
on the contributions of information theory. Let us denote the quadratures of the i -th signal SAlice,i
in the phase space SA by xA,i , pA,i , and the quadratures of Bob’s signal
SBob,i in the phase space

2
2
SB by xB,i , pB,i , where xA,i , pA,i ∈N 0, σω and xB,i , pB,i ∈N 0, σω are drawn from a Gaussian
random distribution with mean µ= 0, and variance σω2 , where σω2 is the modulation variance [1-10].
The coherent states SAlice,i = | xA,i +ipA,i i ∈SA and SBob,i = | xB,i +ipB,i i ∈SB are encoded by
Gaussian modulation with dedicated centers (xA,i , pA,i ) ∈SA and (xB,i , pB,i ) ∈SB , respectively (Note:

Each Si define a zero-mean, circular symmetric complex Gaussian random variable CN 0, σS2 i
h
i
with variance σS2 i =E |Si |2 in the phase space S, with i.i.d. real and imaginary components

xi , pi ∈N 0, σω2 , thus σS2 i = 2σω2 . The squared magnitude |Si |2 , |Si |2 ≥0 is exponentially distributed




with density f |Si |2 =1/σS2 i exp −|Si |2 /σS2 i . The two beams are correlated at Alice’s BS,
which results in a combined signal in the combined phase space SA×B . The modulation noise
∂∈CN 0, σ∂2 , is precisely centered around (xA,i +xB,i , pA,i +pB,i ) ∈SA×B and (xA,i −xB,i , pA,i −pB,i )
0
∈SA×B in SA×B . After the two beams SAlice,i and SBob,i
are correlated at a BS at Alice’s side,
0
where SBob,i is the noisy version of SBob,i , Alice applies a random quadrature measurement M1
on the first mode of the beam, while the second mode is transmitted back to Bob over quantum
channel N2 . Alice’s state in the combined phase space SA×B is as follows:


(3)
| ϕi i = xA,i +x0B,i +i pA,i +p0B,i ∈CN 0, σϕ2 i ∈SA×B ,

2 , where 2σ 2 is the cumulated modwith Gaussian random quadrature components N 0, 2σω2 +σN
ω
1
2
0
0
ulation variance, σN1 is the variance of N1 , xB,i , pB,i are Bob’s noisy quadratures modified by N1 ,
7

Classical channel

&2

& 2 Aout

Gaussian quantum
channel (AWGN)

C Xaj U j

Bob

C X aj

M2 X a

Uj

K
Secret key

Raw data

SBob
Alice

Scalar
reconciliation

&1 Bout

C Xj

Aout

Raw data

Bout

Gaussian quantum
channel (AWGN)
BS

X

&1

SAlice

M1

Figure 1: Simplified model of a PM-RR two-way CVQKD protocol with the scalar reconciliation.
The modulated Gaussian variables are sent through a Gaussian quantum channel (AWGN) depicted
by N1 and N2 (same physical link). The classical channel is depicted by the dashed line. Bob sends
SBob to Alice over N1 . Alice adds to it her secret SAlice by a BS, and applies measurement M1 ,
which defines her raw data X=M1 (N1 (SBob ) +SAlice ). The other mode is sent back to Bob over
N2 , who applies M2 , which results in his X 0 =M2 (N2 (N1 (SBob ) +SAlice )).
h
i
while σϕ2 i =E |ϕi |2 . Assuming a homodyne measurement M1 , Alice gets an Xi unit of her raw
data, which is a binary string. If she measured in the position quadrature basis she obtains:
Xi =xA,i +x0B,i

(4)

or, if she used the momentum quadrature basis she gets
Xi =pA,i +p0B,i .

(5)

The second mode of the combined signal in SA×B is transmitted directly back to Bob over the noisy
channel N2 , given as:


| φi i = xA,i −x0B,i +i pA,i −p0B,i ∈CN 0, σφ2 i ∈SA×B ,
(6)
h
i

2
2 =E |φ |2 . The Gaussian noise of
with N 0, 2σω2 +σN
Gaussian
random
quadratures,
and
σ
i
φi
1

2
the quantum channel N2 defines a noise vector ∆i ∈CN 0, σ∆
∈SA×B , with noise components
i


2
2
∆xi ∈N 0, σN2 , ∆pi ∈CN 0, σN2 which results in the noisy state | ξi i ∈SA×B as follows:


| ξi i = | φi i +∆i = x0A,i −x00B,i +i p0A,i −p00B,i ∈CN 0, σξ2i ∈SA×B ,
(7)
8

2 +σ 2
with N 0, 2σω2 +σN
N2
1



h
i
distributed Gaussian random quadratures, and σξ2i =E |ξi |2 , where

x0A,i , p0A,i are Alice’s noisy quadratures modified by N2 , while x00B,i , p00B,i are Bob’s noisy quadratures
modified by N2 .
In the next phase, Bob applies a random quadrature measurement M2 (assumed to be homodyne) and gets block Yi . If he used a position quadrature basis, he gets
Yi0 =x0A,i −x00B,i

(8)

and for the momentum quadrature basis he obtains:
Yi0 =p0A,i −p00B,i .

(9)

0

Bob, calibrating his resulted block Yi by 2x00B,i or 2p00B,i (depending on the used quadrature measurement), gets back the noisy version Xi0 of Alice’s raw data unit Xi as:
Xi0 =Yi0 +2x00B,i =x0A,i −x00B,i +2x00B,i =x0A,i +x00B,i ,

(10)

Xi0 =Yi0 +2p00B,i =p0A,i −p00B,i +2p00B,i =p0A,i +p00B,i ,

(11)

and
which is referred as Bob’s raw data unit. The nature of the of error of the quantum channel will
be characterized in detail in Section 4, however at this point we can surmise that the noise of the
quantum channel is analogous to the addition of a non-standard Gaussian random noise vector ∆i
to Alice’s raw data block Xi .
Alice’s and Bob’s modes in the combined phase space SA×B right after being outputted from
the BS are | ϕi i and | φi i , as shown in Fig. 2. Alice obtains the first mode of the beam, | ϕi i , the
second mode | φi i is sent back to Bob. The noise that exists in SA×B arises from the modulation
noise ∂∈CN 0, σ∂2 (already included in the quadrature distributions) and the two channel uses,
2
N1 and N2 . The measurements
performed on | ϕi i and | ξi i result in raw data units Xi ∈N 0, σX

2 . The noise of the first channel changes the Gaussian random distribution of
and Xi0 ∈N 0, σX
0


2
the quadratures from N 0, 2σω2 to N 0, 2σω2 +σN
in the combined phase space SA×B , with
1

2 , and where noise variance σ 2
2
mean µ= 0, and results X raw data level variance σX = 2σω2 +σN
N1
1
arises from the first channel use. The quadraturesof thesecond mode of the coupled beam is also
characterized by the same variance, i.e., | φi i ∈CN 0, σφ2 i . The noise of N2 transforms | φi i ∈SA×B
into | ξi i ∈SA×B and further modifies the distribution.
Finally, Bob’s received quadratures will

2
2
2
follow a Gaussian distribution N 0, 2σω +σN1 +σN2 . The X 0 raw data level variance is evaluated

2 = 2σ 2 +σ 2 +σ 2 , which fact arises from the cumulated Gaussian random noise of N and
as σX
0
1
ω
N1
N2
N2 .
2 and
On the raw data level, only the difference of the variance of Alice’s and Bob’s raw data σX
2
2
has relevance and σN1 vanishes from the picture. This difference is, indeed, σN2 . In the level
of raw data manipulations Alice’s Xi will serve as a reference unit to correct Bob’s noisy unit, Xi0 .
In other words, the first channel use will have no relevance in the raw data-level calculations, hence
the noise of N1 can be excluded from the error-correction process. Precisely, the use of N1 has only

2 , which finally results in N 0, σ 2 on
one consequence: it increases the initial variance 2σω2 by σN
X
1
the level of raw data blocks. In particular, only N2 will have significance, and, in fact, only the
2
σX
0

9

(a)

(b)




Figure 2: The combined signals | ϕi i ∈CN 0, σϕ2 i (a) and | φi i ∈CN 0, σφ2 i (b) in the combined

phase space, SA×B . The modulation
noise ∂∈CN 0, σ∂2 in SA×B is illustrated by the Gaussian

2
curves. The noise ∆i ∈N 0, σN
of quantum channel N2 distorts the distribution of the quadratures
2



2
2
2 +σ 2 . Alice’s raw data variance is σ 2 = 2σ 2 +σ 2 ,
from N 0, 2σω +σN1 into N 0, 2σω2 +σN
ω
N2
X
N
1
1

2 = 2σ 2 +σ 2 +σ 2 .
while Bob’s raw data variance is σX
0
ω
N1
N2
noise of the second channel use has to be corrected in the reconciliation phase. (Note: Throughout
the manuscript, the noise will be modeled on the quadrature-level via a real vector).
In the reconciliation phase, our task is to share an error-free secret key between the parties.
This requires the raw data-level error-correction of the noise that arises from the quantum-level
transmission. First we review the background of the multidimensional reconciliation and then we
introduce our solution.

2.2

Uniform Distribution in the Spherical Space

In this section we review the background of the multidimensional approaches, and the properties
of Gaussian random vectors in the spherical space. The multidimensional reconciliation processes
for CVQKD were not implementable without the use of spherical codes and a high-dimensional
spherical space.
First, let us clarify how a d -dimensional Gaussian random vector is formulated in the framework
of a two-way CVQKD protocol. The outcoming beam from Alice (and Bob) can be regarded as a
collection of Gaussian random variables. A standard Gaussian random variable g∈N (0, 1) ∈R is a
real variable selected from a Gaussian distribution. A standard Gaussian variable g∈N (0, 1) has
probability density function [15, 18]:
1 −g2
f (g) = √ e 2 .
2π
10

(12)


A non-standard Gaussian random variable g ∗ ∈N µ, σ 2 ∈R with nonzero mean µ6=0, and variance
σ 2 , can be expressed from g∈N (0, 1) as g ∗ =gσ+µ. A non-standard Gaussian random variable g ∗
has probability density function:
1

∗

e
f (g ) = √
2πσ 2

2
−(g ∗ −µ)
2σ 2

.

(13)

In Alice’s raw data, a d -dimensional Gaussian vector
2
Xj =(Xj,0 , . . . ,Xj,d−1 )T ∈N 0, σX


d

∈Rd

(14)

is a collection of d independent Gaussian random variables Xj,0 , . . .,Xj,d−1 , where each Xj,i is a real
2 . Alice’s Gaussian vector is revariable R drawn from a Gaussian random distribution N 0, σX

2
d
2
ferred by Xj ∈N 0, σX d ∈R , and its noisy version at Bob’s side is denoted by X0j ∈N 0, σX
∈Rd .
0
d
The values of Bob’s units are affected by the Gaussian noise that arises from the quantum channel.
First, let us evaluate why the normalized vector structure has importance in the multidimensional scenario. The reason: the normalized d -dimensional Gaussian vectors change the probability
distribution from Gaussian random to uniform on the d -dimensional unit sphere, Γd−1 . It has a
relevance, since only uniform distribution is allowed in the reconciliation phase. The result clearly
follows from the Rayleigh law [18], the application of Stirling’s formula [19], Gersho’s conjecture
[22], and Sakrison’s result [23], which are connected to the contributions of spherical coding [24].

T


0 , . . . ,X 0
2
d , where X 0 ∈N 0, σ 2
We formulate d-length blocks X0j = Xj,0
∈N 0, σX
∈R
0
0 ∈R,
j,i
j,d−1
X
d
for i∈ [d]. The d -length Gaussian random vector X0j has norm X0j , mean
r
E



X0j





X0j

=σX 0

and variance
var



≤

d−

1
2

(15)

2
σX
0
.
2

(16)

We step further from this point. Since the variance of X0j is not unit, the covariance
matrix C X0j

0 are uncorrelated, thus C X0 is diagonal.
is not equal to identity, but the random units Xj,i
j
q
q
0
0
2
2
The normalized vector Xj / dσX 0 with norm Xj / dσX 0 , can be identified on the unit sphere
q
q
0
2
2 is
Γd−1 [18, 24], with radius r= X0j / dσX
.
The
mean
of
X
/
dσX
0
0
j

E

X0j

r

q
q
1
2
2 .
0
=σ
d−
/
dσX
/ dσX
0
0
X
2

(17)

q
2 on the unit sphere Γd−1 is identified as
The vector X0j / dσX
0
q
0
0
2
q
0
X
/
dσX
0 Xj
j
Xj
0
2
Xj / dσX 0 =r
=
.
X0j
X0j
Precisely, the normalized quantity

X0j

q
q
h
i σ2
0
2
2
2
X0
/ dσX 0 has variance var Xj / dσX
0 ≤ 2 /dσX 0 .
11

(18)

From the spherical symmetry, it follows that if d→∞, the normalized random vector X0j /

q
2
dσX
0

will be equipped with uniform distribution on Γd−1 . The background of this phenomenon is as
follows.
q
2 will tend to one, i.e.,
First, for d→∞, the mean E [·] of the normalized quantity X0j / dσX
0
q
σX 0 d− 12
 = lim q
= 1.
lim E  q
d→∞
d→∞
2
2
dσX 0
dσX
0


Second, the variance var [·] of X0j /

X0j



(19)

q
2 will tend to zero,
dσX
0


X0j



1 2
σ
 = lim 2 X 0 = 0.
lim var  q
2
d→∞
d→∞ dσX
2
0
dσX
0

(20)

q
2 becomes uniThese implies that for d→∞, the normalized Gaussian random vector X0j / dσX
0
formly distributed
on the unit sphere Γd−1 . Third, as the dimension increases the distribution of the
q
norm of X0j /

2 (i.e., the radius on Γd−1 ) will approximate the Dirac distribution D (d) [9-11],
dσX
0
q
q
0
2
2
[18], and it will also converge to one, r= limd→∞ X0j / dσX
dσX
0 = 1. The unit norms of Xj /
0
play exactly the role of unit fading-coefficients for a logical
binary Gaussian channel, q
since during
q
2 the unit norms r= X0 / dσ 2
the transmissions of the messages generated from X0j / dσX
0
j
X0 = 1
are also transmitted [11, 21].
To be more exact, the unit norms are only approximated and the distribution of the unit norms
also depends on d, and as d→∞, it precisely can be described by the Dirac distribution

√ 
2
2
Dd (x) = 1/a π e−(x−r) /a ,

(21)

X0j
r= lim q
= 1.
d→∞
2
dσX
0

(22)

√
where a=1/ d and

From Dd (x) it immediately follows, that the unit norms of the normalized random Gaussian vectors
gets closer to 1, as q
d goes to infinity [18]. As follows from these, for low values of d the uniform

2 cannot be achieved.
distribution of X0j / dσX
0
In comparison to the multidimensional reconciliation where the required mathematical operations (the spherical division operator at Alice’s side) exist only in d= 1, 2, 4 or 8 dimensions [9-11],
[18], the scalar reconciliation process are also existent for arbitrary high dimensions, which makes
possible to give a more closer approximation, however it will not refer to the Dirac distribution.
2 > 1,
Analyzing the situation if the noisy raw dataq
follows Gaussian random distribution
with σX
0
q
h
i
h
i
0
0
2
2
the speed of convergence of the mean E Xj / dσX 0 and variance var Xj / dσX 0 will be lower
2 = 1 would have hold.
for any d, in comparison if σX
0
2 = 1, the situation for various dimensions of X0 is summarized in Fig. 3.
For σX
0
j

12

q
2 and the norm
Figure 3: The mean E [·], variance var [·] of the normalized quantity X0j / dσX
0
q
q
2
2 . Vector X0 is formulated
of the normalized Gaussian random vector X0j / dσX
X0j / dσX
0
0
j
0 elements of Bob’s noisy raw data X 0 . The approximation of the logical
from d number of Xj,i
binary Gaussian gets more precise as the norm approaches to one, which requires the use of higher
dimensions.

As we have mentioned, the multidimensional approaches are limited in the dimension, specifically, d= 8 in [9-11]. In this case, the Gaussian random vectors form the so-called octonions
8
[20]. In the level of
 Gaussian random raw data, an octonion Oj ∈R is built up from eight units
2
Xj,0...j,7 ∈N 0, σX , as:
Oj =Xj,0 Re+Xj,1 Im1 + · · · +Xj,7 Im7 ,
(23)
where Re∈R stands for the real part, while Imi ∈C, f or i= 1,i≤7 indentifies the i -th imaginary units,

0 Re+X 0 Im + · · · +X 0 Im , where X 0
2
respectively. Bob’s noisy O0 j is O0 j =Xj,0
1
j,7
7
j,0...7 ∈N 0, σX 0 .
j,1
In the multidimensional case the uniformity of the d -dimensional Gaussian random raw data vectors
Xj ∈Rd , d≤8, can be achieved only in the multidimensional spherical space, over the unit sphere
Γd−1 . The process requires complex operations and transformations [9-11] that are undesirable in a
practical CVQKD scenario. In comparison to these approaches, our proposed scalar reconciliation
uses only simple scalar operations on the raw data, which makes it possible to eliminate the spherical
calculations from the reconciliation phase.

3

Low-Dimensional Reconciliation

We start our description from the point at which the quantum states are completely transmitted
through the quantum channel from Alice to Bob. At this point all interactions with the quantum
channel are closed, and the post-processing phase is being started. First, Alice and Bob exclude from
the raw data those measurements that have been performed in different quadratures that results in
the N-unit length raw data vectors. Then formulate N/d number of d -dimensional vectors Xj ∈Rd ,
X0j ∈Rd . These quantities are introduced as follows.
13

3.1

Notations

Let X∈RN and X 0 ∈RN the N -unit length raw data of Alice and Bob. The d -dimensional vectors
Xj ∈Rd and X0j ∈Rd , f or j=0, j≤ (N/d) −1, of Alice and Bob are defined as:
2
Xj =(Xj,0 , . . . ,Xj,d−1 )T ∈N 0, σX

and
0
0
X0j = Xj,0
, . . . ,Xj,d−1

T



(24)

d


2
∈N 0, σX
,
0
d

(25)

where

2
Xj,i ∈N 0, σX
∈R

(26)


0
2
Xj,i
∈N 0, σX
0 ∈R

(27)

and
refer to the i -th unit of the j -th vector, respectively. Alice and Bob have to share a common
secret by using their correlated raw data. For this purpose, they establish a proper code-alphabet
A= {a, b}, where a∈R and b∈R are two public variables (i.e., Eve also has access to it). In the
reverse reconciliation these will be selected uniformly at random in the form of several Uj ∈ {a, b}-s
at Bob’s side, with Pr (a) = Pr (b) = 0.5.
A secret d -dimensional key vector Uj is drawn from a uniform distribution U and built up from
d units, Uj,i ∈R, as:
Uj ∈Rd :(Uj,0 , . . . ,Uj,d−1 )T , f or j= 0, j≤ (N/d) −1.
(28)
The d units Uj,i ∈U of Uj are uniform random variables, and define Uj ∈R as follows:
Uj =

d−1
X

Uj,i ∈U.

(29)

i=0

The noisy version of (29), Uj0 , is defined as
Uj0 =

d−1
X

0
Uj,i
.

(30)

i=0

From (29) follows, that (28) can be rewritten as Uj ∈ {A, B} ∈Rd , with vectors A, B as:
(d−1
)
(d−1
)
X
X
T
T
A:(aj,0 , . . . ,aj,d−1 ) ,
aj,i =a , B:(bj,0 , . . . ,bj,d−1 ) ,
bj,i =b .
i=0

(31)

i=0

As follows, Bob granulates the selected a or b into d number of uniformly random variables Uj,i ,
so that the sum of the units will be equal to the selected value.
The full key K is built up as:
T
K∈RN/d : U0 , . . . ,U(N/d)−1 .
(32)
Alice and Bob first agree on d. Bob then sends the d blocks of



T
0
0
C X0j Uj = C Xj,0
Uj,0 , . . . ,C Xj,d−1
Uj,d−1 ∈Rd ,
14

(33)

f or j= 0, j≤ (N/d) −1, over a classical channel.
 
C Xj0 Uj are evaluated as
C (Xj ) =

d−1
X

C (Xj,i )∈R, C

 
The scalar quantities C (Xj ), C Xj0 , and

Xj0



=

i=0


0
C Xj,i
∈R,

(34)

i=0

and
C

d−1
X

Xj0



Uj =

d−1
X


0
C Xj,i
Uj,i ∈R,

(35)

i=0

respectively.
0 units, and by the addition of the d units, and via the application
Alice receives the d noisy Uj,i
0
of C (Xj ) she computes Uj as
Uj0 =

d−1
X


0
Uj,i
=C Xj0 Uj

i=0

=

d−1
X

1
C (Xj )

! d−1
d−1
X
X

0
C Xj,i
/
C (Xj,i )
Uj,i .

i=0

i=0

(36)

i=0

Thus, Alice has to make an error-correction to remove the noise from Uj0 to get achieve Uj .

3.2

Achieving the Uniform Distribution

In comparison to the multidimensional reconciliation, the scalar reconciliation uses a fundamentally
different solution to achieve the uniform distribution of the raw data. While the former is based
on sophisticated multidimensional spherical operations, our solution requires only the use of a
simple function in the scalar space. In our scheme, the uniform distribution of the correlated
raw data units is achieved by the Gaussian Cumulative Distribution Function (CDF) [26], [43-45].
Another important difference is that the approximation of the logical binary Gaussian channel can
be achieved by arbitrary dimension with arbitrary accuracy, which is justified by the Central Limit
Theorem (CLT) [26], [43-45].
3.2.1

Gaussian Cumulative Distribution Function

On Alice’s and Bob’s side, the Gaussian CDF function can be used to reach the uniform distribution
of the correlated raw data. Since we assumed reverse reconciliation let us to start the description

0 with Gaussian random distribution N 0, σ 2 .
from Bob’s perspective. Let Bob’s raw data unit Xj,i
X0
0 is as follows:
The Gaussian CDF-transformation C (·) :R→R for a unit Xj,i



0
X

1
j,i 
0
C Xj,i
= 1+erf  q
, f or i∈ [d] ,
(37)
2
2σ 2
X0

where




q
Z X 0 / 2σ2 0
0
j,i
Xj,i
X
2
2
 =√
erf  q
e−t dt
π 0
2
2σX
0
15

(38)



0
is the Gauss error function, and C Xj,i
∈R is a real variable from the range of [0, 1], with U


0
uniform distribution (for a plausible example Section 5). The quantity C Xj,i
will be referred as
the CDF-transformed unit.
2
Alice also applies the CDF transformation, and takes into account her raw data variance σX
for the units of Xj,i to get C (Xj,i ):



Xj,i 
1
, f or i∈ [d] ,
(39)
C (Xj,i ) = 1+erf  q
2
2σ 2
X



0
and the result of (37) and (39) is the correlated uniform raw data C (Xj,i ) ≈C Xj,i
. In the reconciliation process, only Alice can correct Uj0 into Uj , because nobody knows the CDF-transformed
raw data units C (Xj,i ), except Alice.
For a given Xj ∈Rd , the CDF function C (·) :R→R reads as



Xj,i
1
1+erf √
∈R, f or i∈ [d] ,
(40)
C (Xj ) =C (Xj,0 ) , . . . ,C (Xj,d−1 ) =
2
2σ 2
Applying the results for Bob’s raw data the CDF-transformed vector is:

 0 
Xj,i
 1


0
0
0
C Xj =C Xj,0 , . . . ,C Xj,d−1 =
1+erf √
∈R, f or i∈ [d] .
(41)
2
2σ 2

The CDF-transformed C (Xj ), C X0j raw data vectors each consist of d real R variables as:


T
0
0
C (Xj ) =(C (Xj,0 ) , . . . ,C (Xj,d−1 ))T , C X0j = C Xj,0
, . . . ,C Xj,d−1
.
3.2.2

(42)

Central Limit Theorem

In the multidimensional case, the precision of the approximation of the logical binary Gaussian
channel (i.e., the quality of the physical-logical channel conversion) was quantified by the Dirac
distribution [9-11]. Since in the scalar reconciliation the spherical space is eliminated, a different
solution was needed to analyze the accuracy of the conversion between the physical-logical Gaussian
channels. Our answer for the problem is the Central Limit Theorem [26], [43-45] and a mathematical
result from the 19th century – the so-called Lyapunov-condition [26,45]. The accuracy of the
physical-logical conversion of scalar reconciliation can be maximized and it can be made in arbitrary
high dimensions as it is being stated in Lemma 1.
Lemma 1 The noise variance of the converted logical binary Gaussian channel asymptotically
coincidences with the noise variance of the physical quantum channel, which allows to reach the
theoretical maximum of the capacity of the converted logical binary channel.
0 ∈R the j -th units of Alice’s and Bob’s raw data, respectively. For
Proof. Let Xj,i ∈R and Xj,i
T

0 , . . . ,U 0
a d -dimensional vector Uj = Uj,0
, the sum of the independent noise {δj,0 , . . . ,δj,d−1 }
j,d−1
0 =U +δ
units on the secret noisy key units Uj,i
j,i
j,i will approximate a zero-mean Gaussian random

16

variable with mean E [δj,i ] =µδj,i = 0, noise variance var [δj,i ] =σδ2j,i (see Section 3.1 and Section 3.3
for a detailed derivation) as follows:
!
d−1
X
1
1
δj = qP
CLT: qP
δj,i →N (0, 1)d
d−1 2
d−1 2
σ
σ
i=0
i=0 δj,i
i=0 δj,i
(43)
!
!
d−1
d−1


X
X
δj =
δj,i →N 0,
σδ2j,i =N 0, σδ2j,i .
i=0

d

i=0

To show that (43) holds for the d -dimensional noise parameter δj , we exploit the Lyapunovcondition [26]. Applying the standard mathematical description of the Lyapunov condition [45],
let L> 0, then
d−1 h
i
X
1
2+L
E |δj,i |
=0
(44)
lim q
Pd−1 2 2+L
d→∞
i=0
σ
i=0 δj,i
is satisfied for any d→∞, by theory. As follows, the noise on Uj ∈Rd will converge to
!
d−1


X
δj =
δj,i ∈N 0, σδ2j ,
d

i=0

(45)

and the resulting logical channel will be equivalent to a logical binary Gaussian channel with noise
variance σδ2j . By the same argumentation, the variance of the resulting logical binary Gaussian
2 for N →∞.
channel will converge to the variance of the physical Gaussian quantum channel σN
2
Let again L> 0, and d is an appropriate dimension for which (44) is satisfied, and let the
2 . Then
expected variance of δj is var [δj ] =σN
2
(N/d)−1

1

lim 
N →∞ qP

X

(N/d)−1 2
σ N2
j=0

2+L

h
i
E |δj |2+L = 0,

(46)

j=0

is satisfied by theory, from which




(N/d)−1

1

CLT: qP

X

(N/d)−1 2
σ N2
j=0



(N/d)−1

X






δj  →N (0, 1)N/d

j=0



(N/d)−1

δj  →N 0,

j=0

X

(47)


2 
2
σN
=N 0, σN
2
2


N/d

,

j=0

follows, which proves the statement. Hence one can readily recognize that



2
lim var δ0...(N/d)−1 = σN
.
2 N/d
N →∞

(48)

P(N/d)−1
To conclude the situation, in (43) and (47) the variances of δj and j=0
δj , indeed, are not
scaled up by d and N/d, which makes possible to convert the physical Gaussian quantum channel
2 for arbitrary d.
to a logical binary Gaussian channel with noise variance dσδ2j ≈σN
2
17

These results allow for one to obtain the lowest noise variance and hence, the highest SNR of
the logical channel that is possible by theory. At the resulting SNR, the capacity of the logical
binary Gaussian channel also picks up its maximum. From this one can immediately conclude,
that, in fact, it is a favorable result because the logical channel is indeed a binary Gaussian channel
which is equipped with the same capacity at low SNRs (which is the situation in an experimental
long-distance scenario) than the physical Gaussian quantum channel. In our solution, the lower
2 is precisely reached and is justified by the Lyapunov-condition, which means that
bound σδ2j =σN
2
our conversion provides the best approximation that is possible.
3.2.3

Application

In comparison to the multidimensional approaches, here, one can recognize that these results make
no necessary the use of the multidimensional spherical space. The key idea is as follows: do the
reconciliation in the scalar space to reduce the problem from Γd−1 of Rd into R. The main drawback
of the multidimensional reconciliation approaches is the use of spherical space Γd−1 of Rn to achieve
the uniform distribution. As we have found in a CVQKD scenario it is not a required condition,
and completely can be eliminated. The uniformly distributed elements of Rd have to be transmitted
over the classical authenticated channel, but it per se, does not imply that the reconciliation has
to be executed in the spherical space. The spherical correction of the errors of the raw data is a
completely undesirable and unwanted event in a practical CVQKD, because it would just cause a
further decrease in the very fragile, sensitive, and so strenuously established secret key rates. The
use of Γd−1 of Rd served only one purpose in the multidimensional reconciliation: to guarantee
the security requirements of the QKD post-processing phase. From this it immediately can be
concluded that the use of spherical space is, in fact, unnecessary, and a mathematically equivalent
and more efficient solution exists in the scalar space of R.
One can recognize two improvements in our proposed scheme in comparison to the existing
approaches. First, the uniform distribution will be reached by a simple operation, the GaussianCDF function applied separately on each unit of the raw data. Second, the approximation of the
Gaussian channel will be justified by the CLT, using arbitrary dimensional vectors. As follows,
the physical-logical channel conversion can be established with arbitrary high precision, since the
d≤8 limitation has also been eliminated from the picture. To conclude, the spherical space can
be replaced by the CDF transformation on the raw data units, and the Dirac distribution can be
replaced by the CLT. It is clear now that the existing reconciliation methods require a revision
since its application just leads to further slow-down in a practical CVQKD scenario. By these
reasons, we drop away the spherical space, and instead of it, use the CDF-transformed units. These
improvements allow very efficient decoding and error-correction, however, this step does not modify
any property of the code: in other words, it keeps the desired uniform distribution and guarantees
the arbitrary high-precision in the approximation of the logical binary Gaussian channel. Finally,
we have to emphasize again that the whole reconciliation procedure is implemented through the
logical layer only, without any need of physical-layer tomography.

3.3

Run of Scalar Reconciliation

The run of scalar reconciliation (assuming reverse reconciliation) is sketched as follows. Bob divides

T
0 , . . . ,X 0
his N -unit length raw data X 0 into n=N/d number of d -dimensional vectors X0j = Xj,0
j,d−1

18

0 in the raw data.
∈Rd , where d is the length of the vectors measured in units Xj,i
0 ∈R of X0 , f or i= 0, i≤d−1,
Then for each X0j , applies CDF transformation C on the units Xj,i
j

T
d
f or j= 0, j≤ (N/d) −1. Bob generates Uj =(Uj,0 . . .Uj,d−1 ) ∈R , Uj,i ∈R, computes C X0j Uj
 



T
0
0
= C Xj,0
Uj,0 , . . . ,C Xj,d−1
Uj,d−1 , and sends it to Alice over the classical authenticated
channel.
Alice also divides her N -unit length raw data X, into n=N/d number of d -dimensional vectors
Xj =(Xj,0 , . . . ,Xj,d−1 )T ∈Rd , computes the CDF-transformed C (Xj ) =(C (Xj,0 ) , . . . ,C (Xj,d−1 ))T ∈Rd
and using (29), (34) and (35) computes as

1
C (Xj )
d−1
d−1
X
X
0
0
=
Xj,i
Uj,i
Uj,i


Uj0 =C Xj0 Uj

=

i=0
Pd−1
i=0 C

(49)

i=0



Pd−1
i=0



0
Xj,i
Uj,i

C (Xj,i )

.

Next, she corrects the Gaussian noise on Uj0 to get Uj . From these she rebuilds the error-free full
key
T
K∈RN/d : U0 , . . . ,U(N/d)−1 .
(50)

3.4

Security

The scalar reconciliation provides unconditional security. It will be demonstrated for reverse reconciliation.
The security of scalar reconciliation is guaranteed by the fact that the transmitted

C X0j Uj messages follow uniform distribution, and the multiplied Uj and X0j vectors are also
uniform and independent.
The following conditional probability holds for each Uj , Uj =U0...1 (see also (29),(34) and (35)):
  1
Pr Uj =U0...1 | C Xj0 Uj = .
2

(51)


Since C X0j Uj are uniformly distributed, and also independent [11], it follows that:

and



 1
0
0
Pr C Xj,i
=C Xj,0
. . .C X 0 j,N −1 =
N

(52)

1
Pr (Uj =U0...1 ) = .
2

(53)

Since the overall number of d -dimensional Uj ∈Rd vectors is N/d, the probability that Eve obtains
the full key K is

T 
1
= N/d .
(54)
PrEve K= U0 , . . . ,U(N/d)−1
2

19

3.5

Noise on the Data

This section reveals the mathematical description of the noise vector of the Gaussian quantum
channel N2 and its impacts on Bob’s raw data and Alice’s received secret key. We also can exploit
that in the evaluation of the noise vector only the second channel use N2 has to be taken in to
consideration in the error correction.

2
The d -dimensional noise vector ∆j ∈ N 0, σN
∈ Rd of the Gaussian channel N2 on the j -th
2 d
X0j is a Gaussian random vector defined as:

2
∆j =X0j −Xj = {∆j,0 , . . . ,∆j,d−1 } ∈N 0, σN
∈Rd ,
(55)
2 d

2
where ∆j,i ∈N 0, σN
∈R identifies the Gaussian noise on the i -th unit Xi of X0j as:
2

0
2
∆j,i =Xj,i
−Xj,i ∈N 0, σN
∈R.
(56)
2
The noise vector ∆j is added to Alice’s Xj , hence Bob’s noisy X0j is:
X0j j =Xj +∆j ∈Rd .

(57)

In terms of raw-data vector units, the Gaussian noise vector ∆j,i is described as follows:
0
Xj,i
=Xj,i +∆j,i ∈R,

(58)

and (57) can be rewritten as:
 0
0
X0j = Xj,0
, . . . ,Xj,d−1

(59)

= {Xj,0 +∆j,0 , . . . ,Xj,d−1 +∆j,d−1 } .

P
0
In the scalar reconciliation, the error-correction is performed on the level of unit sums Uj0 = d−1
i=0 Uj,i

0
in R as follows. Alice receives the d -dimensional C Xj Uj from Bob, from which she obtains
 
C Xj0 Uj (see (35)) and divides it by her C (Xj ) (see (34)). The effect of Gaussian noise [9]
results in a distorted secret Uj0 ∈R as:
Uj0 =

d−1
X
i=0

Pd−1
0
Uj,i
=

i=0



0
C Xj,i
Uj,i

Pd−1
i=0

C (Xj,i )

=

d−1
X
i=0

Uj,i +

d−1
X

δj,i =Uj +δj ∈R,

(60)

i=0

where δj,i is the noise on Uj,i (for a plausible example, see Section 5):


Uj,i
δj,i =
C (∆j,i ) ∈N 0, σδ2j,i ,
C (Xj,i )

(61)

where σδ2j,i is the variance of the distribution of δj,i , while C (∆j,i ) is the noise of the CDFtransformed raw data units:

0
C (∆j,i ) =C Xj,i
−C (Xj,i ) ∈R,
(62)





2
2
where C (∆j,i ) ∈N 0, σC(∆
, and C (∆j ) =C X0j −C (Xj ) ∈Rd , with a N 0, σC(∆
distrij,i )
j)
0 as follows:
bution. The error-corrected Uj can be expressed from the noisy Uj,i

Uj =

d−1
X
i=0

0
Uj,i
−

d−1
X
i=0

20

ςj,i =Uj −ςj ∈R,

d

(63)



where ςj,i ∈N 0, σς2j,i characterizes the same amount of noise as (61), i.e., and ςj,i =δj,i , however it


0 , C X0
is evaluated from the noisy raw-data units Uj,i
j,i as:
ςj,i =

U0
 j,i  C (∆j,i ) ∈R,
0
C Xj,i

(64)



with ςj,i ∈N 0, σς2j,i . The d -dimensional vector U0j ∈Rd can be expressed as:
→
−
U0j =Uj + δj ∈Rd ,

(65)

→
−
where the noise vector δj = {δj,0 , . . . ,δj,d−1 } ∈Rd is as follows:




→
−
Uj
δj =
C (∆j ) ∈N 0, σδ2j =N 0, σδ2j,0 ,...,δj,d−1 .
C (Xj )
d

(66)

0 in U0 ∈Rd is evaluated by a
According to the CLT, the sum of independent noise on units Uj,i
j
Gaussian random variable as:
!
Pd−1
d−1
d−1
X
X
C
(∆
)
U
j,i
j,i
i=0
(67)
δj =
σδ2j,i .
δj,i = P
∈N 0, σδ2j =
d−1
C
(X
)
j,i
i=0
i=0
i=0

The d -dimensional vector Uj ∈Rd can be expressed as
−
Uj =U0j −→
ςj ∈Rd ,

(68)

−
and the noise vector →
ςj = {ςj,0 , . . . ,ςj,d−1 } ∈Rd is as follows:
→
−
ςj =



U0j
2
C (∆j ) ∈N 0, σ−
→
ςj d .
C (Xj ) +C (∆j )

0 of U0 ∈Rd can also be identified as:
The sum of independent noise on units Uj,i
j
!
P
d−1
d−1
d−1
0
X
X
i=0 C (∆j,i ) Uj,i

 =N 0, σς2j =
ςj =
ςj,i = P
σς2j,i .
d−1
0
i=0
i=0
i=0 C Xj,i

(69)

(70)

From the physical properties of a Gaussian quantum channel [1-11], we know exactly what happens
0 has
during the transmission of the coherent combined signal from Alice to Bob. The noise on Xj,i

2 .
a non-standard Gaussian random distribution ∆j,i ∈N 0, σN
2

2
We have to analyze in detail the properties of the noise vector. The vector ∆j ∈N 0, σN
∈Rd
2 d
of N2 that generates the noisy X0j from Xj is characterized as follows. First we decompose the
noise vector ∆j into its components:
∆j =Aj Λj ,
(71)
where matrix Aj represents a linear transformation in Rd , while Λj is a the standard Gaussian
noise vector Λj ∈N (0, 1)d ∈Rd . The probability density function of Λj is:
f (Λj ) = √

1
2π

21

d e

−

kΛj k
2

2

,

(72)

q
where kΛj k = Λ2j,0 + · · · +Λ2j,d−1 is magnitude, in other words, the Euclidean distance from the
origin to Λj ∈Rd . This type of noise exhibits different behavior than the real Gaussian noise of
a quantum channel, and it is characterized by the same magnitude kΛj k in every direction. This
property is connected to the standard Gaussian random noise, and it cannot be applied in a realistic
CVQKD scenario, because it does not properly describe the noise characteristic of the quantum
channel. The probability density function of ∆j ∈Rd is:
f (∆j ) = √

1 T
T −1
1
e− 2 ∆j (Aj Aj ) ∆j ,
d q
2π
detAj ATj

(73)

2 , i.e., in
where Aj ATj stands for the C (∆j ) covariance matrix of ∆j , and it analogous of σN
2


T
0
T
0
a more precise form C (∆j ) =E ∆j ∆j =Aj Aj . The noise on the units Xj,i of Xj at Bob’s
side arises from the quantum-level transmission
of the combined phase space states | φj,i i ∈SA×B ,

2
and vectors Λj ∈N (0, 1)d and ∆j ∈N 0, σN
is
built up by d components, Λj,i ∈N (0, 1) ∈R and
2 d

2
0 is as follows:
∆j,i ∈N 0, σN2 ∈R. The error ∆j,i on the i -th unit Xj,i

∆j,i =Aj,i Λj,i , f or i= 0, i≤d−1,

(74)

where Aj,i is a linear transformation that scales Λj,i . The probability density function of Λj,i is:
2

kΛj,i k
1
f (Λj,i ) = √ e− 2 ,
2π

(75)

q
where kΛj,i k = Λ2j,i is the magnitude of Λj,i . The probability density function of ∆j,i is:
f (∆j,i ) = √

1 T
T −1
1
q
e− 2 ∆j,i (Aj,i Aj,i ) ∆j,i ,
2π detAj,i ATj,i

(76)



where Aj,i ATj,i =E ∆j,i ∆Tj,i = C (∆j,i ).
n From Λj,i and
o ∆j,i , the correction of Bob’s noisy secret Uj can be approached by the units

0 , . . . ,U 0
0
Uj,0
j,d−1 , because the noise of N2 is survived in the raw data level and lives also on Uj,i ,
but in a modified form, see (61).
Let us denote by | φj,i i the phase-space representation of Alice’s noise-free raw data unit Xj,i
0 of Bob, from (7). (State | φ i is the second
given by (6), and by | ξj,i i the noisy raw data unit Xj,i
j,i
mode of the combined beam, while | ξj,i i is its noisy version).
The effect of the real Gaussian noise of the quantum channel is shown in Fig. 4. The noise
2
vector ∆j ∈N 0, σN
∈SA×B of the quantum channel is a non-standard Gaussian random vector,
2 d
which distorts the density. The circles of Λj,i ∈N (0, 1) are scaled by Aj,i resulting in ellipses. The
magnitude k∆j,i k of ∆j,i is not preserved in all directions, which leads to different density. The x
and p quadratures of | φj,i i ∈SA×B are modified by ∆x and ∆p in | ξj,i i ∈SA×B .

22

Figure 4: The real Gaussian noise of the quantum channel N2 causes a rotation and rescaled vector
in the combined phase space SA×B (x : position quadrature,
p: momentum quadrature). The

2
magnitude k∆j,i k of the noise vector ∆j,i ∈N 0, σN
is
not
preserved,
since the noise characteristic
2
describes an ellipse in the combined phase space.

4

Theorems and Proofs

First we show that Alice’s noisy secret can be corrected in the v vector space of Rd by using an
error-correction rule based on the apparatus provided by the maximum-likelihood decision [15-19],
[24,25], which renders unnecessary the use of the spherical space of Γd−1 .
Proposition 1 (Vector reconciliation
of correlated
Gaussian variables). The Gaussian noise δj
o
n
0
d
0
0
on the received vector Uj ∈R : Uj,0 , . . . ,Uj,d−1 can be corrected in the vector space v of Rd .
Pd−1
Uj,i =a
Proof. First, Bob selects the d -dimensional vector Uj ∈ {Uj,0 , . . . ,Uj,d−1 } ∈Rd where i=0

Pd−1
0
U
=b,
U
∈U
and
sends
C
X
U
over
the
classical
channel.
Alice
uses
her
CDFor
j,i
j
j
i=0 j,i
0
d
transformed raw data C (Xj ) = {C (Xj,0 ) , . . . ,C (Xj,d−1 )} to obtain Uj ∈R . Since Alice knows a,
qP
d−1
2
b and d, she can draw two vectors A=(A0 , . . . ,Ad−1 )T ∈Rd , with norm kAk =
i=0 (Ai ) , where
qP
nP
o
nP
o
d−1
T
d−1
2
d−1
d , with kBk =
A
=a
,
A
∈U
and
B=(B
,
.
.
.
,B
)
∈R
B
=b
,
(B
)
,
where
i
i
0
i
i
d−1
i=0
i=0
i=0
Bi ∈U. She then corrects the noise on U0j by the following error-correction rule [15-19]:
Uj =A: U0j −A < U0j −B ,

(77)

Uj =B: U0j −A > U0j −B ,

(78)

where the quantity U0j −Uj , Uj ∈ {A, B} is evaluated as
v
v
ud−1 
d−1 
2 u
uX
uX
0
t
t
0
Uj −Uj =
Uj,i −Uj,i =
i=0

i=0

2
Uj,i
C (∆i,j )
C (Xj,i )

v
ud−1
uX
→
−
=t
(δj,i )2 = δj ,
i=0

23

(79)

which precisely coincidences with the norm of the Gaussian noise in (67). However, since Alice does
not know Bob’s Uj,i , in (79) an additional noise, Υj , also brings up, i.e., U0j −Uj = kδj +Υj k. The
−
→
2 is independent from the real noise on U 0 . This problem
noise vector Υj with expected variance σ−
→
j,i
Υj

will be resolved in Theorem 1 and will be shown that this quantity completely vanishes from the
picture.
n
o
0
0 , . . . ,U 0
d
Alice receives the d -dimensional vectors U0j ∈ Uj,0
j,d−1 ∈R , and corrects Uj into Uj
T
and then from the components she rebuilds the full key K= U0 , . . . ,U(N/d)−1 ∈RN/d . The error→
−
vector δj ∈Rd on a given noisy U0j is
!!
T
T


→
−
Uj
Uj
2
C (∆j )∈N 0, σ−
C (∆j )
δj =δj,i =
→ =C
δj
C (Xj )
C (Xj )
d
!!
(80)

T
U
j,i
2
d
=N 0, σδj,i = C
C (∆j,i )
∈R , 0≤i≤d−1,
C (Xj,i )
The covariance matrix of (80) is expressed as:

!
!T 
T

T

T

 
Uj
Uj
Uj
2
C (∆j ) =E 
C (∆j )
C (∆j )  = σ−
C
→
δj d
C (Xj )
C (Xj )
C (Xδ )

(81)

along with

δj,i =

Uj,i
C (Xj,i )

T
C (∆j,i ) ∈N

0, σδ2j,i = C



Uj,i
C (Xj,i )

!!

T

∈R,

C (∆j,i )

and (82) is characterized by covariance matrix



T !
Uj,i
Uj,i
Uj,i
C
C (∆j,i ) =E
C (∆j,i )
C (∆j,i )
=σδ2j,i .
C (Xj,i )
C (Xj,i )
C (Xj,i )

(82)

(83)

The error-corrected Uj can be expressed as:
−
Uj =U0j −→
ςj ∈Rd ,

(84)

where

→
−
ςj =

U0j
C (Xj ) +C (∆j )

T
C (∆j )∈N

2
0, σ−
→
ςj


=N


=C

0, σς2j = C



U0j
C (Xj ) +C (∆j )

T

!!
C (∆j )

0
Uj,i
C (∆j,i )
C (Xj,i ) +C (∆j,i )

d



∈Rd , 0≤i≤d−1.

(85)
The covariance matrix of (85) is as follows:

!
!T 

T

T

T
U0j
U0j
U0j
C
C (∆j ) =E 
C (∆j )
C (∆j ) 
C (Xj ) +C (∆j )
C (Xj ) +C (∆j )
C (Xj ) +C (∆j )
 
2
= σ−
→
ςj
d

(86)
24

and

0
Uj,i
ςj,i =
C (∆j,i ) ∈N
C (Xj,i ) +C (∆j,i )

along with


0
Uj,i
C (∆j,i ) =E
C
C (Xj,i ) +C (∆j,i )



2
0, σςj,i = C

0
Uj,i
C (∆j,i )
C (Xj,i ) +C (∆j,i )

0
Uj,i
C (∆j,i )
C (Xj,i ) +C (∆j,i )




,

(87)

T !
0
Uj,i
C (∆j,i )
C (Xj,i ) +C (∆j,i )

=σς2j,i .
(88)
0 are evaluated as follows:
From (82) and (87) the quantities Uj,i and Uj,i
0
Uj,i =Uj,i
−

and
0
Uj,i
=

U0
0
 j,i  C (∆j,i ) =Uj,i
−ςj,i ∈R,
0
C Xj,i

(89)



0
C Xj,i

Uj,i =Uj,i +δj,i ∈R.
(90)
C (Xj,i )
→
− −
→
Let us denote by ν the standard deviation of δj +Υj =δj,i +Υj,i , 0≤i≤d−1, which is evaluated from
2 as
(86) and σ−
→
Υj
s

2
2
ν=
σ−
.
(91)
→ +σ−
→
Υj

δj

d

The maximum-likelihood-based correction rules can be given in the form of:
2

Uj =A:

1
(π2ν 2 )d/2

e

−

kU0j −Ak
2ν 2

and:
1

−

kU0j −Ak

≥

1
(π2ν 2 )d/2

−

e

2

1

−

kU0j −Bk

2

,

2ν 2

kU0j −Bk

2

≤
.
e
e
(π2ν 2 )d/2
(π2ν 2 )d/2
The error probability for the case of decoding vector Uj =A, is
!


− −
2
→
− −
→
− −
→
→
→ 2 
kA−Bk2
T →
= Pre (A−B) δj +Υj < −
Pre
δj +Υj > A+ δj +Υj −B
.
2
Uj =B:

2ν 2

(92)

2ν 2

For the case of correction of Uj =B, the error probabilities are evaluated as
!


− −
2
→
− −
→
− −
→ 2 
→
→
kB−Ak2
T →
Pre
δj +Υj > B+ δj +Υj −A
= Pre (B−A) δj +Υj < −
.
2

(93)

(94)

(95)

The decision regions can be separated into two hyperplanes H1 and H2 along B−A, which separate
Uj =A and Uj =B. In other words, the correction-condition of a given noisy U0j is reduced to the
following decision problem:

A, if U0j ∈H1 ,
Uj =
(96)
B, if U0j ∈H2 .
25

As follows, by applying the procedure Alice can retrieve Uj ∈ {A, B} from the noisy Uj in the
vector spacev of Rd . From the error-corrected Uj components, Alice finally rebuilds the full key
T
vector K= U0 , . . . ,U(N/d)−1 ∈RN/d , which concludes the proof.
Proposition 1 demonstrated that there is no need for the use of Γd−1 of Rd in the error correction,
however the corrected noise is not precisely a Gaussian. Theorem 1 reveals that the reconciliation
process, in fact, does not require vector operations in Rd , and the noise is a real Gaussian noise in
the scalar space R.
Theorem 1 (Scalar reconciliation of correlated Gaussian variables). The Gaussian noise δj on the
P
0
received scalar Uj0 = d−1
i=0 Uj,i can be corrected in R.


0 -s is δ = Uj,i C (∆ ) ∈N 0, σ 2
Proof. We exploit that the noise on Uj,i
j,i C(Xj,i )
j,i
δj,i , while on the sum


Pd−1
of the noise of the d units is a zero-mean Gaussian random variable i=0 δj,i ∈N 0, σδ2j , that is
justified by the CLT and the Lyapunov-condition. Alice will correct the units in the following form:
Pd−1  0 
d−1
X
i=0 C Xj,i Uj,i
0
=Uj +δj ∈R.
(97)
Uj0 =
Uj,i
= Pd−1
i=0 C (Xj,i )
i=0
First, expresses the secret vector Uj ∈Rd as follows:
1
Uj =x (A−B) + (A+B) ,
2

(98)

where x∈ {−0.5, 0.5} ∈R is a scalar. From this, Alice can also rewrite the noisy U0j as:
→
−
1
U0j =x (A−B) + (A+B) + δj .
2

(99)

From (99) follows that:

d−1 
X
1
x (Ai −Bi ) + (Ai +Bi ) +δj,i
2
i=0

d−1 
X
1
=
x (Ai −Bi ) + (Ai +Bi ) +δj
2

Uj0 =

=

i=0
d−1
X

(100)

0
Uj,i

i=0

Uj
C (∆j ) ,
C (Xj )
P
Pd−1
Pd−1
Pd−1
where C (Xj ) = d−1
i=0 C (Xj,i ), C (∆j ) =
i=0 C (∆j,i ), Uj =
i=0 Uj,i and δj =
i=0 δj,i .
In fact, Alice does not have to use all elements from (100), because she can apply a simpler
process. For this purpose, she draws a new vector, d:
=Uj +

d=

A−B
,
kA−Bk
26

(101)

qP
2
d−1
where kA−Bk =
i=0 (Ai −Bi ) is the effective distance of A and B. A useful property of vector
d drawn in (101), that any independent noise [15] (i.e., independent from the noise on U0j ) could
live only in the orthogonal directions to d, i.e., (n1 , . . . ,nl ) ⊥d. It immediately follows, that the
n1 , . . . ,nl orthogonal directions will have no further importance for Alice in the decoding [15-19].
Since x is a scalar and in (99) the term 21 (A+B) is a constant, Alice introduces vector χ∈v as
follows:
→
−
1
χ≡U0j − (A+B) =x (A−B) + δj .
(102)
2
She also draws an orthogonal matrix M, which contains d and the orthogonal directions n1 , . . . ,nl
with unit norm as:
 
d
n1 
 
 
M = n2 
(103)
.
.
.
nl
By multiplying M with χ leads to:


x kA − Bk


0




0
Mχ = 
 + M~δj .


..


.

(104)

0
→
−
From (104), it clearly follows that only x kA−Bk and the first component of M δj have relevance
in the error-correction process, because all of the other components are orthogonal to d [15]. Since
the evolution of d is a trivial process on Alice’s side, the received U0j can be projected by P onto
the direction of d, since all valuable information including the real noise is carried only by this
direction. The projection P on U0j is made by dT χ, which then results in:

P U0j =dT χ


→
−
A−B T 
=
x (A−B) + δj
(105)
kA−Bk


1
=dT U0j − (A+B) .
2

P
The projected vector P U0j is analogous to the scalar representation Uj = d−1
i=0 Uj,i in R, and
makes it possible to correct the noise in the scalar space R. The received Uj0 =Uj +δj has mean
b
µa =a or µb =b, and the decision boundary is µa +µ
2 , which defines a separator in R.
According to the previously obtained calculations, (104) can be rewritten as follows:
 qP

d−1
2
x
(A
−
B
)
i
i
i=0




0



 + δj .
0
Mχ = 
(106)



..


.
0
27

→
−
As follows, only the first component of M δj has relevance in the error-correction, which in particular
Pd−1
P
i=0 C(∆j,i )Uj,i
P
coincidences with the scalar quantity δj = d−1
δ
=
shown in (79). Putting the
j,i
d−1
i=0
i=0 C(Xj,i )

0
pieces together, P Uj is evaluated as:
v
ud−1
d−1
uX
X

0
P Uj =xt
(Ai −Bi )2 +
δj,i ,
(107)
i=0

i=0

which contains all sufficient information for the error correction in R; the proof is concluded here.
In Theorem 2 the error probability of scalar reconciliation is proposed in an exact form.


1
Theorem 2 The error probability Pr (error) =Q |a−b|
2 η of scalar reconciliation depends only on




|a−b| 1
1
|a−b|, where Q |a−b|
2 η = Pr
2 η <g is the Q-function (tail function), g is a standard Gaussian
qP
q
d−1 2
random variable g∈N (0, 1), and η= σδ2j =
i=0 σδj,i is the standard deviation of the Gaussian
noise δj . The Pr (error) exponentially converges to zero for any |a−b| > 2η.
Pd−1
Pd−1
P
Proof. Let Uj = d−1
i=0 C (∆j,i ). Exi=0 C (Xj,i ) and C (∆j ) =
i=0 Uj,i from (100), C (Xj ) =
ploiting the result of Theorem 1, in the scalar reconciliation process Alice decides on the scalar
quantity Uj0 =a, if:


Pr Uj =a| Uj0 ≥Pr Uj =b| Uj0 .
(108)
Similarly, she decides on Uj0 =b, if:


Pr Uj =b| Uj0 ≥Pr Uj =a| Uj0 .

(109)


Conditioned on a or b, the received Uj0 has mean µa =a or µb =b, with N µa , η 2 and N µb , η 2 .
Applying the maximum-likelihood-based correction rule [15-19], Alice calculates with the following
inequalities:
2!
2!
(Uj0 −a)
(Uj0 −b)
−
−
1
1
2η 2
2η 2
p
e
≥p
e
(110)
2
2
2πη
2πη
and:

2!

1
p
e
2πη 2

−

(Uj0 −b)
2η 2

1
≥p
e
2πη 2

−

(Uj0 −a)
2η 2

2!

,

(111)

which then leads to (for a comparison see (77) and (78)):
Uj0 −a < Uj0 −b

(112)

Uj0 −a > Uj0 −b .

(113)

and:
The received Uj0 has mean µa =a or µb =b, hence one obtains the following conditional probability
for an error event, conditioned on Bob has sent Uj =a:




 |µa −µb |
Uj
µa +µb
0
0
Pr Uj =
C (∆j ) <
Uj =a = Pr Uj −Uj >
,
(114)
C (Xj )
2
2
28





|a−b| 1
|a−b| 1
b|
assigns
a
decision
boundary.
The
tail
function
Q
=
P
r
<
g
, where
where |µa −µ
2
2 η
2 η
g ∈ N (0, 1), has exponential decay for any |a − b| > 2η, hence:
 




|a−b| 1 2
|a−b| 1 2


η
η
2
2
1
1
1
|a−b|


−
2
2
<e−
<Q
,
(115)
2  e
√  |a−b| 1  1− 
2
η
|a−b|
1
2π
2 η
2

η

which clearly demonstrates that the error probability of scalar reconciliation exponentially converges
to zero. As
 one can readily obtain from (115), for arbitrary large differences between a and b,
|a−b| 1
Q
2 η →0 [15-17]. Then, by applying the maximum-likelihood decision theory and the Bayes’
rule [15-19], for a given Uj one obtains error probability via the tail function:




µa +µb
|a−b| 1
0
Pr Uj <
Uj =a =Q
2
2 η


|a−b| 1
(116)
<g
= Pr
2 η
= Pr (error) ,
where g∈N (0, 1) is a standard Gaussian random variable such that Q (x) = Pr (x<g),which clearly
demonstrates that Pr (error) depends only on the distance |a−b| of a and b.
The exponential decay of Pr (error) is depicted in Fig. 5.

Figure 5: The error probability of the scalar reconciliation process. It converges exponentially to
zero as |a−b| > 2η.
The condition |a−b| > 2η can be trivially satisfied by the parties in any practical CVQKD
scenario; the proof is concluded here.

29

5

Numerical Evidence and Noise Model

5.1

Reconciliation Characteristics

In this section, we analyze the performance of the proposed reconciliation for Gaussian modulation,
in terms of secret key rates (bits/pulse) and distances. The excess noise N of the Gaussian quantum
channel is expressed as

N= σω2 E −1 (1−T ) T −1 ,
(117)
where T is the transmission, and σω2 E is Eve’s modulation variance [1].
Assuming reconciliation efficiency 0≤β≤1, the key rate can be rewritten as
R=βI (A:B) −χ (B:E) ,

(118)

where I (A:B) is the mutual information between Alice and Bob, while χ (B:E) is the Holevo
information between Bob and Eve, respectively, with relation
χ (B:E) <χ (A:E) ,

(119)

where χ (A:E) is the Holevo information between Alice and Eve at a direct reconciliation [1-13].
At a given SNR, the mutual information of Alice and Bob is [1-8]
χ (A:B) ≥1/2log2 (1 + SNR) ,

(120)

2
SNR =σφ2 /σN
,
2

(121)

where
2 is the variance of N , which has parameters that
where σφ2 is the transmit signal’s variance, σN
2
2
can be calculated from T and N.
In Fig. 6(a) the dσδ2j quantities of the converted logical binary Gaussian channel for various
dimensions are shown. As depicted by the red line, the Lyapunov-condition can be exploited to get
variance





2
lim dvar δ0...N/d = var δ0...N/d ≈ σN
(122)
2 d
N/d→∞

for arbitrary d to maximize the
2
SNR =σX
/σδ2j

(123)

of the converted logical channel.
As depicted in Fig. 6(b), for d→∞, the efficiency converges to one, β→1, because the noise
perfectly converges to a zero-mean Gaussian random variable.

The numerical analysis uses a PM-RR two-way CVQKD protocol, with homodyne measure2 = 1.06, channel
ments. The parameters are as follows. Excess noise N= 0.015, T = 0.8, variance σX
correlation nC = 0.5, which parameter describes the correlation of the Gaussian attacks of Eve in
the range of 0≤nC ≤1 [7, 8]. (Note: If nC = 0, there is no correlation between her attacks of N1
and N2 ).
In Fig. 7 the SNR of the logical binary Gaussian are depicted for various dimensions.

30

(a)

(b)

Figure 6: (a): The SNR of the resulting logical binary channel is maximized by the Lyapunovcondition (red line). It makes possible to convert the physical Gaussian quantum channel to a logical
channel with the same noise variance for arbitrary d. For the blue line the Lyapunov-condition is
not satisfied. (b): The capacity of the logical channel for various dimensions. At low SNRs the
capacity of the physical Gaussian quantum channel (dashed line) coincidences with the capacity
of the binary Gaussian channel (red). For d= 16, the capacity of the logical channel is very close
to the capacity of a binary Gaussian channel, and at low SNRs it perfectly coincidences with the
capacity of the Gaussian quantum channel. The reconciliation efficiency at d= 16 is β= 0.97. The
curves for lower d -s do not exist because the resulting logical channels are not Gaussian, since the
Lyapunov-condition is not satisfied in the low-regimes.

2 = 1.06. As the dimension increases the
Figure 7: The SNRs of the logical channel at variance σX
variance of the logical channel reaches the variance of the physical quantum channel. At d= 16 the
variances perfectly coincidence.

31

Figure 8: The performance of scalar reconciliation in two-way PM-RR CVQKD at d= 16 (homodyne measurement at both sides). Excess noise: N= 0.015, transmittance: T = 0.8, Eve’s variance
σω2 E = 1.06, channel correlation: nC = 0.5, signal variance σφ2 = 20.
The performance of scalar reconciliation is summarized in Fig. 8. The performance of the
simulated protocol without scalar reconciliation with reconciliation efficiency β= 0.9, is depicted
by the blue curve [7, 8]. At d= 16, improved the reconciliation efficiency to β= 0.97, which resulted
in significantly higher transmission distances and secret key rates.
The scalar reconciliation applied on the two-way CVQKD protocol resulted in approximately
160 km of achievable transmission distance (for the computations of the secret key rate, and the
detection parameters see the derivations of [1], and [7, 8]). The results indicate that the range of
the current two-way CVQKD without our post-processing technique can be significantly extended,
and the maximal 80.5 km range of the current one-way CVQKD systems [12] can be doubled,
and almost tripled compared with existing two-way CVQKD systems [7, 8]. The reason behind
the phenomenon is the possibility of the conversion of the Gaussian quantum channel to a logical
binary Gaussian channel, similar to the multidimensional reconciliation approaches developed for
one-way CVQKD.
The favorable properties of the multidimensional solutions are preserved here, however the
proposed scalar reconciliation does not require any multidimensional spherical calculations [9-11]
and can be extended to arbitrary high dimensions thanks to the fact that it completely eliminates
the spherical operations. From the use of higher dimensions a more precise approximation of the
logical binary Gaussian channel has also become available which resulted in significantly higher
reconciliation efficiency in comparison to current two-way CVQKD reconciliation methods.
The proposed scalar reconciliation is available at low SNRs, and the transmission ranges of
experimental long-distance CVQKD can significantly be improved because at low SNRs the capacity
of the logical binary Gaussian channel coincidences with the capacity of the Gaussian quantum
channel, and the logical channel resulted from the conversion can approximate it with arbitraryhigh precision.
32

5.2

Noise Analysis

5.2.1

Noise on the Raw Data

The following example demonstrates the change of behavior of the probability distribution of raw
data units and the CDF-transformed units, and serves only demonstration purposes.
0
For an illustrative example, let N = 1000 units, the amount of sample raw data units Xj,i , Xj,i
(the units are resulted from random quadrature measurements) taken from Alice’s and Bob’s raw
data, respectively. The Gaussian random units Xj,i are characterized with zero mean and variance
2 = 100.
σX
In Fig. 9(a) the distribution of the Xj,i Gaussian random raw data units is shown. Fig. 9(b)
depicts the result of the C (·) Gaussian CDF function applied on Xj,i . The Gaussian random
behavior is eliminated and is changed into uniform.
Alice’s raw data units,
70

Alice’s CDF-transformed units, C

X j ,i

1

50

0.8
0,8
Value

30

Value

X j ,i

10
-10
-30

0,6
0.6

0.4
0,4
0,2
0.2

-50

0

-70

0

200

400

600

800

0

1000

Raw data unit index

200

400

600

800

1000

Raw data unit index

(a)

(b)

Figure 9: (a) The distribution of Alice’s raw data units. The units follow Gaussian random
distribution. (b) The distribution of the CDF-transformed units. The probability distribution has
changed into uniform in the range of [0, 1].

2
The distribution of the Gaussian noise vector ∆j,i ∈N 0, σN
of the quantum channel N2 , at
2
2 = 4 is shown in Fig. 10.
σN
2


0 and the CDF-transformed C X 0
At Bob’s side, the received noisy units Xj,i
j,i units have a
2 =σ 2 +σ 2 = 104, as depicted in Fig. 11. The Gaussian noise
modified distribution with variance σX
0
 X N2
2 .
on the units is added by ∆j,i ∈N 0, σN
2

This example showed that the uniform distribution of the Gaussian random raw data can be
achieved by trivial operations, without any multidimensional calculations or coding.

33

Noise vector units,
10

% j ,i

Value

5

0

-5

-10

0

200

400

600

800

1000

Raw data unit index

Figure 10: The distribution of the units of the noise vector of the Gaussian quantum channel. The
noise affects the combined state in the phase space and the resulting raw data units on Bob’s side.
Bob’s raw data units,
70

X ja,i

Bob’s CDF-transformed units,
1

50

0,8
0.8

Value

30

Value

C X ja,i

10
-10
-30

0,6
0.6
0.4
0,4
0.2
0,2

-50

00

-70

0

200

400

600

800

1000

0

Raw data unit index

200

400

600

800

1000

Raw data unit index

(a)

(b)

Figure 11: (a) The distribution of the noisy raw data units on Bob’s side. (b) The CDF-transformed
raw data units have uniform distribution in [0, 1].
5.2.2

Noise on the Random Secret

This example demonstrates that the noise δj =

Pd−1
i=0 C(∆j,i )Uj,i
P
d−1
i=0 C(Xj,i )

on the secret Uj0 =

Pd−1
i=0

0 is inherUj,i

ited from the Gaussian quantum channel and by applying the Central Limit Theorem (CLT),
the noise of the logical binary channel can be approximated by a Gaussian random variable
P
2
δj = d−1
i=0 δj,i ∈N 0, σδj .
0 . The quantity C (∆ )
Let N = 1000 units, the amount of sample raw data units Xj,i , Xj,i
j

34



=C X0j −C (Xj ) measures the difference of C X0j and C (Xj ), i.e., the noise of Bob’s CDF2 = 100 and X0 ∈N 0, σ 2 = 104 . The example uses an d= 16
transformed data. Let Xj ∈N 0, σX
j
X0
dimensional approximation.


0
The distribution of the error C (∆j,i ) of the CDF-transformed raw data units C Xj,i
, C (Xj,i )
are depicted in Fig. 12.

C %j ,i  C X ja,i  C X j ,i

0.4
0,4
0.3
0,3
0.2
0,2

Value

0.1
0,1

00
-0.1
-0,1
-0.2
-0,2
-0.3
-0,3
-0.4
-0,4

0

200

400

600

800

1000

Raw data unit index



0
−C (Xj,i ) on the CDF-transformed raw
Figure 12: The distribution of the error C (∆j,i ) =C Xj,i
data units.


0
/C (Xj,i ) of the CDF-transformed units is shown in Fig. 13(a). In the ideal
The ratio C Xj,i
(noise-free) case the ratio equals to 1. In Fig. 13(b) the distribution of the quantity C (∆j,i )/C (Xj,i )
is shown.
0 is shown, assuming that Bob selects
In Fig. 14(a) the distribution of noise δj,i on units Uj,i
Uj,i ∈ {−400/16, 400/16}.
Pd−1
In Fig. 14(b) the distribution of δj on Uj0 , using Uj = i=0
Uj,i ∈ {−400, 400} is depicted. The


distribution of δj is given by the formula of N 0, σδ2j , and the approximation of the binary
Gaussian logical channel is justified by the CLT and the Lyapunov-condition.

The results make it possible to achieve a high-precision conversion of the physical Gaussian
quantum channel into a logical binary Gaussian channel. Precisely, only an approximation is
possible by the logical layer manipulations, which gets closer to perfect as d→∞. At d=
 16 the

Pd−1 0
0
approximation is almost perfect, and the noise on Uj = i=0 Uj,i is a real Gaussian noise N 0, σδ2j .
35

C X ja,i

4

3

3

1

2

-3

0

-5
200

400

600

800

C X j ,i

-1

1

0

C % j ,i

5

Value

Value

5

C X j ,i

0

1000

200

400

600

800

1000

Raw data unit index

Raw data unit index
(a)

(b)

Figure 13: (a) The distribution of the ratio of the raw data level noise and Alice’s CDFtransformed raw data units. It equals to 1 for a noise-free case. (b) The distribution of quantity
C (∆j,i )/C (Xj,i ).

Ej

40

40

20

20
Value

Value

E j ,i

0
0

200

400

600

800

1000

-20
-40

U ja,i

0

-20
-40

d 1
(a)

U ja 

d 1

 i 0U ja,i

d  16

(b)

0 , U ∈ {−25, 25}, σ 2 = 100,
Figure 14: (a) The distribution of the unit-level noise δj,i on Uj,i
j,i
X


Pd−1
Pd−1 0
2
2
0
σX 0 = 104. (b) The noise δj = i=0 δj,i ∈N 0, σδj on Uj = i=0 Uj,i at d= 16. The precision
of the physical-binary channel conversion gets closer to perfect as d→∞.

6

Conclusions

The CVQKD protocols are based on Gaussian modulation, and powerful post-processing is needed
to maximize the extractable valuable information from the correlated raw data. The physical
layer solutions for the reconciliation of Gaussian variables require tomography that is intractable
36

in a practical CVQKD scenario. The reconciliation is also possible in the level of the logical
layer by a classical authenticated communication channel and by traditional algorithmical tools.
The multidimensional approaches were developed for this purpose, however the use of complex
multidimensional calculations is also not desirable in a practical scenario. The proposed scalar
reconciliation eliminates the use of multidimensional spherical space along with the dimensional
boundaries. The scalar reconciliation process neither requires any physical-layer tomography, and
only standard operations and calculations needed in the level of raw data. The method provides an
easy implementation to maximize the extractable valuable binary information from the correlated
raw data to significantly boost up the key rates and to improve the distance ranges of CVQKD.

Acknowledgements
This work was partially supported by the GOP-1.1.1-11-2012-0092 project sponsored by the EU
and European Structural Fund, by the Hungarian Scientific Research Fund - OTKA K-112125, by
the COST Action MP1006, and by the National Research Development and Innovation Office of
Hungary (Project No. 2017-1.2.1-NKP-2017-00001).

References
[1] S. Pirandola, S. Mancini, S. Lloyd and S. L. Braunstein, Continuous-variable quantum cryptography using two-way quantum communication, Nature Phys. 4 726, (2008).
[2] S. Pirandola, R. Garcia-Patron, S. L. Braunstein and S. Lloyd, Direct and Reverse Secret-Key
Capacities of a Quantum Channel, Phys. Rev. Lett. 102 050503. (2009)
[3] S. Pirandola, A. Serafini and S. Lloyd, Correlation matrices of two-mode bosonic systems,
Phys. Rev. A 79 052327. (2009).
[4] S. Pirandola, S. L. Braunstein and S. Lloyd, Characterization of Collective Gaussian Attacks
and Security of Coherent-State Quantum Cryptography, Phys. Rev. Lett. 101 200504 (2008).
[5] C. Weedbrook, S. Pirandola, S. Lloyd and T. Ralph, Quantum Cryptography Approaching
the Classical Limit, Phys. Rev. Lett. 105 110501 (2010).
[6] C. Weedbrook, S. Pirandola, R. Garcia-Patron, N. J. Cerf, T. Ralph, J. Shapiro, and S. Lloyd,
Gaussian quantum information, Rev. Mod. Phys. 84, 621 (2012).
[7] M. Sun, X. Peng, Y. Shen, H. Guo, Security of a new two-way continuous-variable quantum
key distribution protocol, Int. J. Quant. Inf. 10 1250059 (2012).
[8] M. Sun, Xiang Peng and Hong Guo, An improved two-way continuous-variable quantum key
distribution protocol with added noise in homodyne detection, J. Phys. B: At. Mol. Opt.
Phys. 46 085501 (2013)
[9] P. Jouguet, S. Kunz-Jacques, and A. Leverrier, Long-distance continuous-variable quantum
key distribution with a Gaussian modulation, Phys. Rev. A 84, 062317 (2011).

37

[10] P. Jouguet, S. Kunz-Jacques, E. Diamanti, and A. Leverrier, Analysis of imperfections in
practical continuous-variable quantum key distribution, Phys. Rev. A 86, 032309 (2012).
[11] A. Leverrier, R. Alleaume, J. Boutros, G. Zemor, and P. Grangier, Multidimensional reconciliation for a continuous-variable quantum key distribution, Phys. Rev. A 77, 042325 (2008).
[12] P. Jouguet, S. Kunz-Jacques, A. Leverrier, P. Grangier, E. Diamanti, Experimental demonstration of long-distance continuous-variable quantum key distribution, arXiv:1210.6216v1
(2012).
[13] A. Leverrier, R. Garcia-Patron, R. Renner, and N. J. Cerf, Security of continuous-variable
quantum key distribution against general attacks, Phys. Rev. Lett. 110, 030502 (2013).
[14] S. Imre and L. Gyongyosi. Advanced Quantum Communications - An Engineering Approach.
Wiley-IEEE Press (StateNew Jersey, USA), (2012).
[15] D. Tse and P. Viswanath. Fundamentals of Wireless Communication, Cambridge University
Press, (2005).
[16] J. Hamkins and K. Zeger. Asymptotically efficient spherical codes—Part I: Wrapped spherical
codes, IEEE Trans. Inform. Theory, vol. 43, pp. 1774–1785, (1997).
[17] P. F. Swaszek and J. B. Thomas. Multidimensional spherical coordinates quantization, IEEE
Trans. Inform. Theory, vol. IT-29, pp. 570–576, (1983).
[18] K. Miller. Multidimensional Gaussian Distributions. New York: Wiley, (1964).
[19] J. Hamkins. Design and analysis of spherical codes, Ph.D. dissertation, Univ. Illinois at
Urbana-Champaign, (1996).
[20] J. H. Conway and D. A. Smith, On Quaternions and Octonions: Their Geometry, Arithmetic,
and Symmetry, A K Peters/CRC Press, (2003).
[21] T. Richardson and R. Urbanke, Modern Coding Theory, (Cambridge University Press, New
York, NY, USA), (2008).
[22] A. Gersho. Asymptotically optimal block quantization, IEEE Trans. Inform. Theory, vol.
IT-25, pp. 373–380, (1979).
[23] D. J. Sakrison. A geometric treatment of the source encoding of a Gaussian random variable,
IEEE Trans. Inform. Theory, vol. IT-14, pp. 481–486, (1968).
[24] J. Hamkins and K. Zeger. Gaussian Source Coding With Spherical Codes, IEEE Trans.
Inform. Theory, vol. 48, no 11, (2002).
[25] L. Hanzo, H. Haas, S. Imre, D. O’Brien, M. Rupp, L. Gyongyosi. Wireless Myths, Realities, and Futures: From 3G/4G to Optical and Quantum Wireless, Proceedings of the IEEE,
Volume: 100, Issue: Special Centennial Issue, pp. 1853-1888. (2012).
[26] J. Rice. Mathematical Statistics and Data Analysis (Second ed.), Duxbury Press, ISBN 0534-20934-3) (1995).
38

[27] Botsinis, Panagiotis, Alanis, Dimitrios, Ng, Soon Xin and Hanzo, Lajos Low-Complexity
Soft-Output Quantum-Assisted Multi-User Detection for Direct-Sequence Spreading and Slow
Subcarrier-Hopping Aided SDMA-OFDM Systems. IEEE Access, PP, (99) (2014).
[28] Botsinis, Panagiotis, Ng, Soon Xin and Hanzo, Lajos Fixed-complexity quantum-assisted
multi-user detection for CDMA and SDMA. IEEE Transactions on Communications, vol.
62, (no. 3), pp. 990-1000 (2014).
[29] L. Gyongyosi, S. Imre, Geometrical Analysis of Physically Allowed Quantum Cloning Transformations for Quantum Cryptography, Information Sciences, Elsevier, DOI: 10.1016/j.ins.2014.07.010
(2014).
[30] L. Gyongyosi, S. Imre: Algorithmic Superactivation of Asymptotic Quantum Capacity of
Zero-Capacity Quantum Channels, Information Sciences, Elsevier, ISSN: 0020-0255; (2011).
[31] L. Gyongyosi, S. Imre: Superactivation of Quantum Channels is Limited by the Quantum Relative Entropy Function, Quantum Information Processing, Springer, ISSN: 1570-0755, ISSN:
1573-1332, (2012).
[32] L. Gyongyosi, S. Imre, Adaptive multicarrier quadrature division modulation for long-distance
continuous-variable quantum key distribution, Proc. SPIE 9123, Quantum Information and
Computation XII, 912307; doi:10.1117/12.2050095, From Conference Volume 9123, Quantum
Information and Computation XII, Baltimore, Maryland, USA (2014).
[33] S. Imre, F. Balazs: Quantum Computing and Communications – An Engineering Approach,
John Wiley and Sons Ltd, ISBN 0-470-86902-X, 283 pages (2005).
[34] D. Petz, Quantum Information Theory and Quantum Statistics, Springer-Verlag, Heidelberg,
Hiv: 6. (2008).
[35] R. V. Meter,Quantum Networking, John Wiley and Sons Ltd, ISBN 1118648927, 9781118648926
(2014).
[36] L. Ruppert, V. C. Usenko, R. Filip, Long-distance continuous-variable quantum key distribution with efficient channel estimation, Physical Review A 90, 062310 (2014).
[37] Lloyd, S. Capacity of the noisy quantum channel. Physical Rev. A 55, 1613–1622 (1997).
[38] R. Renner and J. I. Cirac , de Finetti Representation Theorem for Infinite-Dimensional Quantum Systems and Applications to Quantum Cryptography, Physcal Review Letters 102, 110504
(2009).
[39] F. Furrer, T. Franz, M. Berta, A. Leverrier, V. B. Scholz, M. Tomamichel, and R. F. Werner,
Continuous Variable Quantum Key Distribution: Finite-Key Analysis of Composable Security
against Coherent Attacks, Physcal Review Letters 109, 100502 (2012).
[40] A. Leverrier, Composable Security Proof for Continuous-Variable Quantum Key Distribution
with Coherent States, Physcal Review Letters 114, 070501 (2015).
[41] G. Van Assche, J. Cardinal, N. J. Cerf, Reconciliation of a quantum-distributed Gaussian key,
IEEE Transactions on Information Theory 50, 394 (2004).
39

[42] A. Leverrier, P. Grangier, Continuous-variable quantum-key-distribution protocols with a nonGaussian modulation, Physical Review A 83, 042312 (2011).
[43] D. Zwillinger, S. Kokoska, Standard Probability and Statistics Tables and Formulae, CRC
Press. ISBN 978-1-58488-059-2 (2010).
[44] J. E. Gentle, Computational Statistics, Springer. ISBN 978-0-387-98145-1. Retrieved 201008-06 (2009).
[45] P. Billingsley, Probability and Measure (Third ed.), John Wiley & sons, ISBN 0-471-00710-2
(1995).
[46] A. Leverrier, P. Grangier, Unconditional Security Proof of Long-Distance Continuous-Variable
Quantum Key Distribution with Discrete Modulation, Physical Review Letters 102, 180504
(2009).
[47] L. Gyongyosi, Improved Long-Distance Two-way Continuous Variable Quantum Key Distribution over Optical Fiber, 2013 Frontiers in Optics/Laser Science XXIX (FiO/LS), 6-10
October 2013, Orlando, Florida, USA.
[48] L. Gyongyosi, S. Imre, Proceedings Volume 8997, Advances in Photonics of Quantum Computing, Memory, and Communication VII; 89970C; doi: 10.1117/12.2038532 (2014).
[49] Bennett, C. H., Brassard, G., Quantum Cryptography: public key distribution and coin tossing, Proceeding of IEEE International Conference on Computer, Systems Signal Processing
175–179 (1984).
[50] Scarani, V. et al., The security of practical quantum key distribution. Rev. Mod. Phys. 81,
1301-1350 (2009).
[51] Inoue, K., Waks, E. & Yamamoto, Y. Differential-phase-shift quantum key distribution using
coherent light. Phys. Rev. A 68, 022317 (2003).
[52] Stucki, D., Brunner, N., Gisin, N., Scarani, V. & Zbinden, H. Fast and simple one-way quantum key distribution. Appl. Phys. Lett. 87, 194108 (2005).
[53] Bacco D. et al., Two-dimensional distributed-phase-reference protocol for quantum key distribution, Sci. Reports 6:36756 (2016).

40

A
A.1

Appendix
Spherical Code

A d -dimensional spherical code X is defined
over the d -dimensional unit sphere Γd−1 , given by

d−1
d
Γ = x= (x0 , x1 , . . . ,xd−1 ) ∈R : kxk = 1 , and kxk = 1 is the unit norm. The (d−1)-dimensional


R∞
surface S Γd−1 of Γd−1 is defined as S Γd−1 =2π d/2 /G (d/2), where G (d/2) = 0 t(d/2)−1 e−t dt
is the gamma function [24]. The number of codewords of the code is |X |, the smallest dimension
dmin of any Euclidean space for the spherical code X is dmin = dimn|X |, while
o the minimum distance
2
between any two elements x and y of X ⊆Γd−1 , x6=y, is D= min kx−yk .

A.2

Gaussian Random Spherical Vectors

Let X = (X0 , . . . ,Xd−1 )T ∈Rd be a Gaussian
random vector with independent components, and with

norm kXk drawn from an N 0, σ 2 memoryless Gaussian source. Over the d -dimensional unit
sphere Γd−1 , spherical Gaussian random vector E [kXk] (X/kXk) ∈Γd−1 ∈Rd has radius r=E kXk,
where E is the mean of the norm kXk, defined [24] as
√
 √
2σ 2 G d+1
2πσ 2
2

,
E [kXk] =
=
(A.1)
G d2
β d2 , 12
i
h
2
where β (x, y) = G(x)G(y)
=dσ 2 . The Gaussian random vector
,
is
the
beta
function,
while
E
kXk
G(x+y)
X∈Rd over Γd−1 has a probability density function
−r 2

2rd−1 e 2σ2
f (X) =
,

G k2 (2σ 2 )k/2
and variance

(A.2)

2πσ 2
.
(A.3)
β 2 d2 , 12
√
√
For d→∞, E X/ dσ 2 →1, and r= limd→∞ X/ dσ 2 →1. The distribution of r approximates
the Dirac distribution Dd (x), and gets to arbitrary close for d→∞.
var [X] =dσ 2 −

A.3

Abbreviations

AWGN Additive White Gaussian Noise
BAWGN Binary Additive White Gaussian Noise
BS Beam Splitter
BSC Binary Symmetric Channel
CDF Cumulative Distribution Function
CLT Central Limit Theorem

41

CV Continuous-Variable
DPR Differential Phase Reference
DV Discrete-Variable
LDPC Low Density Parity Check
PM Prepare-and-Measure: entanglement-free protocol
RR Reverse Reconciliation
SNR Signal-to-Noise Ratio

A.4

Notations

The notations of the manuscript are summarized in Table A.1.
Table A.1: Summary of notations.
Notation

Description

| ϕi i

The first mode of the combinedbeam, phase space vector, expressed as
| ϕi i = xA,i +x0B,i +i pA,i +p0B,i ,
where xA,i , x0B,i and pA,i , p0B,i are the position and momentum quadratures.

| φi i

The second mode of the combined
 beam, phase space vector, expressed as
| φi i = xA,i −x0B,i +i pA,i −p0B,i ,
where xA,i , x0B,i and pA,i , p0B,i are the position and momentum quadratures.

| ξi i

The noisy version of phase space
 state | φi i , with the noisy quadratures,
| ξi i = x0A,i −x00B,i +i p0A,i −p00B,i .

X

Alice’s N -unit length raw data generated by N random quadrature measurements. Binary string, consists of N/d number of d -dimensional Gaussian random vectors, Xj ∈Rd .

X0

Bob’s N -unit length raw data generated by N random quadrature measurements. Binary string, consists of N/d number of noisy d -dimensional
Gaussian random vectors X0j ∈Rd .

Xi

Alice’s raw data unit, obtained from a random quadrature measurement,
Xi =xA,i +x0B,i ,
Xi =pA,i +p0B,i ,
where xA,i , x0B,i and pA,i , p0B,i are the position and momentum quadratures.

Xi0

Bob’s noisy raw data unit, obtained from a random quadrature measurement and by a correction +2xB,i or +2pB,i ,
Xi0 =x0A,i +x00B,i ,
Xi0 =p0A,i +p00B,i ,
while x0A,i , x00B,i and p0A,i , p00B,i are the noisy position and momentum quadratures.

42

Xj

Alice’s d -dimensional Gaussian random vector (d unit length Gaussian random vector),
Xj ∈Rd : {Xj,0 , Xj,1 , . . .Xj,d−1 },
where Xj,i is a Gaussian random variable.

0
Xj,i ∈R, Xj,i
∈R

The i -th unit of j -th vector Xj and X0j .

X0j

Bob’s noisy
random vector (d unit length vector),
n d -dimensional Gaussian
o
0
d
0
0
0
Xj ∈R : Xj,0 , Xj,1 , . . .Xj,d−1 ,
0
0
where Xj,i
=x0A,i +x00B,i or Xj,i
=p0A,i +p00B,i is a Gaussian random units obtained from a quadrature measurement.

K

Bob’s
 secret key vector,
K= U0 , . . .U(N/d)−1 ∈RN/d .
The full key is granulated into N/d number of Uj ∈Rd vectors,
Uj = {Uj,0 , Uj,1 , . . .Uj,d−1 } ∈Rd ,
where Uj ∈ {a, b} ∈R.

X0j Uj ∈Rd

Bob’s d -dimensional vector sent to the classical channel.

0
Xj,i
Uj,i ∈R

A unit of Bob’s d -dimensional message sent to the classical channel.

C (·)

The Gaussian CDF function.

C (·)

Covariance matrix.

Dd (·)

Dirac distribution of a d -dimensional vector.

L

Lyapunov coefficient, LB0.

Uj0

The noisy version of Bob’s secret Uj ,
Pd−1 0
Uj0 = i=0 Uj,i
,
where a unit Uj,i isas
0
0
Uj,i
= C Xj,i
Uj,i C(X1j,i ) .
Pd−1 0
Noise on Uj0 = i=0 Uj,i
, and on unit Uj,i .
r 
→
−
Standard deviation of the noise vector δj , η =
σδ2j .

δj , δj,i
η

d

Λj , Λj,i

Standard Gaussian random noise vector, and the noise of the i -th unit of
the j -th block Xj,i , Λj =N (0, 1)d ∈Rd , and Λj,i =N (0, 1) ∈R.

∆j

Gaussian random
noise vector of the quantum channel N2 on Xj ,

∆j =N 0, σ22 d ∈Rd .

∆j,i

The i -th unit of j -th noise vector,
that results raw data unit

0
Xj,i
=Xj,i +∆j,i , where ∆j,i =N 0, σ22 ∈R.

43

