Low-Dimensional Reconciliation for Continuous-Variable Quantum Key Distribution

Abstract

We propose an efficient logical layer-based reconciliation method for continuous-variable quantum key distribution (CVQKD) to extract binary information from correlated Gaussian variables. We demonstrate that by operating on the raw-data level, the noise of the quantum channel can be corrected in the low-dimensional (scalar) space, and the reconciliation can be extended to arbitrary dimensions. The CVQKD systems allow an unconditionally secret communication over standard telecommunication networks. To exploit the real potential of CVQKD a robust reconciliation technique is needed. It is currently unavailable, which makes it impossible to reach the real performance of the CVQKD protocols. The reconciliation is a post-processing step separated from the transmission of quantum states, which is aimed to derive the secret key from the raw data. The reconciliation process of correlated Gaussian variables is a complex problem that requires either tomography in the physical layer that is intractable in a practical scenario, or high-cost calculations in the multidimensional spherical space with strict dimensional limitations. To avoid these issues, we define the low-dimensional reconciliation. We prove that the error probability of one-dimensional reconciliation is zero in any practical CVQKD scenario, and provides unconditional security. The results allow for significantly improving the currently available key rates and transmission distances of CVQKD.

1. Introduction

The QKD (Quantum Key Distribution) systems represent one of the most important practical applications of quantum information theory [1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18]. The QKD schemes allow for establishing an unconditionally secret communication between distant parties by exploiting the fundamental attributes of quantum mechanics [19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53]. The QKD protocols can be classified into three main classes [1,2,3,4,5,6,7,8,9,10,11,49,50,51,52,53]: DVQKD (Discrete-Variable), CVQKD (Continuous-Variable), and DPR-QKD (Differential Phase Reference) systems. The firstly introduced QKD protocols were based on discrete variables, such as photon polarization. Since the polarization of single photons cannot be encoded and decoded efficiently because of the technological limitations of current physical devices, the CVQKD systems were proposed. In a CVQKD system, the information is encoded on continuous variables by a Gaussian modulation, such as in the position or momentum quadratures of coherent states. In comparison to DVQKD, the modulation and decoding of continuous variables does not require specialized devices and can be implemented efficiently by standard technologies that are available and in widespread use. The CVQKD systems also provide higher secret key rates and higher communication distances. The CVQKD protocols can be further classified into one-way and two-way systems. In a one-way CVQKD system, Alice, the sender transmits her continuous variables to the receiver, Bob, over a quantum channel [9,10,11]. In a two-way system, Bob starts the communication, Alice adds her internal secret to the received message, and this is then sent back to Bob (e.g., one mode of the coupled beam that is outputted from a beamsplitter is transmitted back to Bob). The two-way CVQKD systems were introduced for practical reasons to exceed the limitations of one-way CVQKD, such as low key rates and short communication distances [1,2,3,4,5,6,7,8]. The two-way CVQKD protocols exploit the benefits of multiple channel uses and allow for the leak of only lower valuable information to the eavesdropper. On the other hand, the achievable distances of one-way CVQKD can be extended by efficient channel-estimation methods [36], which is important since the one-way protocol currently is still the focus of the research, owing to the easy experimental implementation.

The CVQKD schemes use continuous-variable Gaussian modulation, which provably provides optimal key rates against collective attacks at finite-size block lengths [1,2,3,4,5,6,7,8,9,10,11] and also maximizes the mutual information between Alice and Bob. The security of CVQKD has also been proven against collective attacks in the asymptotic regime with infinite block sizes, and against arbitrary attacks in the finite-size regime [9,13,38,39,40]. One of the most critical points in regard to CVQKD is the post-processing [1,2,3,4,5,6,7,8,9,10,11,47]. The post-processing is aimed to correct the errors of the quantum channel that are cumulated in the raw data. The raw data is a correlated binary bitstring at Alice’s and Bob’s side, as generated by the random quadrature measurements at the parties. Each quadrature measurement results in a unit in the raw data. The raw data itself is not a secret key; it consists only of the results of the random quadrature measurements. The secret key is a uniformly distributed long binary string that will be combined with the raw data elements, and will be added to the picture only in the stage of logical layer manipulations. The logical layer-based post-processing phase uses purely classical tools: precisely a classical-authenticated communication channel and classical error-correction algorithms. This phase basically does the same in the logical layer as the tomography does in the physical layer, and it consists of two main phases: the reconciliation procedure with several error-correction steps, and privacy amplification.

The aim of reconciliation is to extract as much valuable information from the correlated raw data as possible and to generate an error-free key between Alice and Bob. The privacy amplification operates on the shared, error-corrected common secret to extract the final key between the parties, and the aim of this phase is to reduce to zero the possible knowledge of an eavesdropper from the elements of the key. The implementation of tomography in the physical layer is a complex problem, and it is intractable in a practical scenario. But, well-characterized solutions can be proposed in the logical layer for the same purpose of giving an analogous, and also more valuable, answer to the reconciliation of correlated Gaussian variables than the physical-layer tomography ever could. The theoretical background that makes the logical layer-based reconciliation possible also allow us to view the noisy physical quantum channel as a binary Gaussian channel in the logical layer [9,10,11]. This has the immediate consequence that very efficient binary error-correction tools can be integrated from the world of traditional communication theory into CVQKD—which would not be available for the physical-layer tomography to extract binary information from the correlated Gaussian variables.

The raw data shared over the quantum channel is noisy, and this must be corrected to distill the final secret key. Since a large amount of raw data bits have to be shared between the parties, the complexity of the post-processing phase is a critical point in CVQKD protocols, and it has to be in order to be as low as possible. The existing logical layer-based solutions require high-complexity calculations in the high-dimensional spherical space for the reconciliation of Gaussian variables [9,10,11]. Since a complex reconciliation is so undesirable, the aim is to find a more efficient solution in the logical layer. A slice method is a different reconciliation approach, which is also used in the current reconciliation steps of CVQKD for short distances, and can be implemented without spherical operations [41]. Basically, the error correction in the reconciliation phase consists of two phases: First, the binary-channel codes (such as LDPC—Low Density Parity Check, turbo codes, polar codes, etc. [22,23,24,25,26,27,28,29,30,31,32,33,34,35]) that are used for the transmission of the classical bits in the reconciliation phase are corrected. Second, the real Gaussian noise on the received raw-data vector must be corrected, which noise arises from the effect of the quantum channel (i.e., from Eve’s optimal Gaussian attack, which is considered in CVQKD protocols [1,2,3,4,5,6,7,8,9,10,11]). In this work, we focus on the second phase of reconciliation, which has a crucial role in CVQKD, since this phase makes it possible to correct the errors that are incurred on the quantum channel and to share an error-free key between Alice and Bob. Since the raw data is formulated by continuous real numbers resulted from quadrature measurements at the parties, the reconciliation problem is analogous to the well-known subject of binary-channel coding that operates on binary-channel codes. It also follows that the complicated and difficult to implement physical-layer tomography can be replaced in the logical level by binary error-correction schemes that are easier to implement. According to a critical security requirement of QKD, in the reconciliation phase, only uniform distribution can be transmitted over the classical channel, otherwise the information theoretic security of the protocol cannot be proven [1,2,3,4,5,6,7,8,9,10,11,12,13]. The raw data itself follows Gaussian random distribution because these arise from a Gaussian random source; however, by applying some trivial operations on the raw data units, the desired uniform distribution can be reached, and the reconciliation can be performed with unconditional security, as we will show in detail in Section 3.

A relevant difference of DV and CV protocols is that the physical quantum channel that connects the parties is characterized in a different way. For DVQKD the appropriate channel model is the Binary Symmetric Channel (BSC), which allows the use of the well-known channel-coding and error-correction tools in the post-processing phase. It also follows that for DVQKD there is a clear connection between the characteristics of the quantum channel and the world of traditional communication theory. On the other hand, for a CVQKD system the situation is more complicated, because the proper description of a Gaussian quantum channel requires several physical parameters (transmittance, variance, shot noise, excess noise, etc.) which allows no to draw a clear connection. To solve the situation for one-way CVQKD, the multidimensional reconciliation schemes [9,10,11,12] have been introduced, which made possible the conversion of the physical AWGN (Additive White Gaussian Noise) quantum channel to a logical binary AWGN (BAWGN) channel, where the Gaussian random noise arises directly from the quantum-level transmission. Precisely, it works only for low dimensions and the resulted logical channel approximates only a binary Gaussian channel. As the accuracy of the physical-logical channel conversion gets closer to perfect, the resulting logical channel gets closer to a binary Gaussian channel. At low SNRs (Signal-to-Noise Ratio) the capacities of the Gaussian quantum channel and the binary Gaussian channel coincidence, and this is particularly convenient because for low SNRs, the problem of channel conversion can be reduced to the approximation of a binary Gaussian channel. From this follows, that the efficiency of the channel conversion procedure can be described by the relevant parameters of the resulting logical binary channel (such as its variance and capacity). This conversion efficiency has tremendous importance because it also determines the efficiency of the reconciliation process, i.e., the performance of the protocol. In the multidimensional reconciliation the conversion procedure required the use of the spherical space and its sophisticated operations [9,10,11], which is a complex process. The difficult computational steps of post-processing just cause further slowing down in the very sensitive key rates that are so difficult to establish. These requirements of the reconciliation phase are strongly undesired in a practical CVQKD scenario, so a simpler reconciliation would be desirable—for both one- and two-way systems. The problem of efficient post-processing is more crucial for two-way CVQKD, due to its more complex physical architecture.

To exploit the real potential of two-way CVQKD systems, efficient post-processing is needed. It is still missing, which makes it not possible to attain the true performance of two-way CVQKD. This is the main reason why the theoretical maximum of key rates and ranges cannot be exceeded in the current practical scenarios; however, the protocol in its ‘hardware level’ is built to be strong, and would be capable of more performance than is currently available. To boost up the performance of the two-way CVQKD protocols over the current limits, we introduce an efficient reconciliation method that makes it possible to increase the key rates and to extend the currently available distance ranges. The mathematical apparatus that stands behind the multidimensional reconciliation puts a strict upper bound on the available dimensions, and limits its maximum [9,10,11,42]. The reason is that in higher dimensions the required spherical division operations do not exist. In our scheme, we also eliminate this serious drawback and extend the reconciliation of Gaussian variables to arbitrary high dimensions. The proposed approach also makes possible to get a closer and more precise approximation of the binary Gaussian channel, in comparison to the multidimensional case.

Since the post-processing phase uses the binary form of the continuous variables, in fact, we do not have to decode the Gaussian variables in the multidimensional space. As a corollary, arbitrary high-precision approximation of the logical binary Gaussian channel can be made in the non-spherical space by using considerable dimensions. We exploit it in this work to construct a scalar reconciliation that breaks with the traditions of the previously introduced approaches [9,10,11,42,46], and uses only the space of scalar variables. The proposed scalar reconciliation is also able to transform the physical Gaussian quantum channel into a logical binary Gaussian channel in two-way CVQKD, and the same benefits can be exploited as in the case of multidimensional reconciliation. However since our scheme is not limited to eight dimensions, an arbitrary precision can be reached in the approximation of the logical binary Gaussian channel. As follows, the accuracy of the conversion between the physical Gaussian quantum channel and the logical Gaussian channel can be improved beyond the current limits. Another issue in the current approaches is the requirement of spherical calculations. To make the existing post-processing approaches more efficient, we have to eliminate the multidimensional operations. The reconciliation of Gaussian variables would be much easier, if we found a solution that would make it possible to extract the final key from the noisy data by simple calculations in the level of scalar space. It immediately follows that this would significantly increase the efficiency of the reconciliation process, and would lead to a negligible complexity and computational power in the error-correction procedure.

In this paper, we define low-dimensional (scalar) reconciliation for CVQKD. It brings significantly higher noise-resistance and information-transmission capability, extended transmission distances, and improved key rates.

The proposed method does the reconciliation of Gaussian variables without the need of any physical-layer tomography or multidimensional operations. We demonstrate the results for two-way CVQKD. The scheme is backward compatible it also can be applied to one-way CVQKD.

The novel contribution of our paper is as follows:

• The reconciliation process of correlated Gaussian variables is a complex problem that requires either tomography in the physical layer that is intractable in a practical scenario, or high-cost calculations in the multidimensional spherical space with strict dimensional limitations.
• To avoid these issues, we propose an efficient logical layer-based reconciliation method for CVQKD to extract binary information from correlated Gaussian variables.
• We demonstrate that by operating on the raw-data level, the noise of the quantum channel can be corrected in the low-dimensional scalar space and the reconciliation can be extended to arbitrary dimensions.
• We prove that the error probability of scalar reconciliation is zero in any practical CVQKD scenario, and provides unconditional security.
• The results allow to significantly improve the currently available key rates and transmission distances of CVQKD.

This paper is organized as follows. In Section 2, preliminary findings are summarized. In Section 3, we introduce the reconciliation scheme. Section 4 provides the theorems and proofs. In Section 5, numerical evidence is proposed. Finally, in Section 6, we conclude the paper. Supplementary Materials are also included, notations are summarized in Table S1.

2. System Model

In comparison to one-way CVQKD protocols, in two-way CVQKD the two uses of the quantum channel lead to superadditive private classical capacity (more precisely, the superadditivity of security threshold leads to a subadditive eavesdropper [1,2,3,4,5,6,7,8,14]), which makes it possible to decrease the amount of valuable information leaked to Eve. The subadditive eavesdropper is a consequence of the multiple uses of the quantum channel. The superadditivity of the security threshold can also be expressed in terms of tolerable excess noise and the channel transmission [1]. In the two-way scenario, Eve perturbs the quantum channel ${\mathcal{N}}_1$, which causes a noise in the transmission that will have an effect on the success of her second attack. From the two attacks, comparatively lower valuable information will be available to Eve so that she would not have made an attack on ${\mathcal{N}}_1$. The reason for this is that the amount of valuable information transmitted over ${\mathcal{N}}_2$ is already decreased by the attack of ${\mathcal{N}}_1$. More attacks add more noise into the transmission, which also decreases the amount of mutual information between Alice and Bob. With the increased number of channel uses we allow Eve to get as much less valuable information as possible. If Alice encodes her information into the noisy state that is received from ${\mathcal{N}}_1$, and then sends it back to Bob over ${\mathcal{N}}_2$, then the parties can achieve the desired phenomenon of superadditivity [1,2,3,4]. The amount of valuable information leaked to Eve is also decreased by the multiple uses of the quantum channel. The errors caused by more channel uses can be corrected in the reconciliation phase by traditional error-correction tools. In fact, by utilizing multiple channel uses, we ‘set a trap’ for Eve, since again and again she will attack the quantum channel. Eve will also simultaneously decrease the amount of eavesdropped information by her actions. The idea works well, because in the post-processing phase the parties can correct the errors caused by Eve, thus, finally, it can be concluded that it was a correct decision to increase the number of channel uses. Of course, if we had perfect amplifiers and ideal devices, then, in theory, it would be possible to completely eliminate Eve from the picture in the asymptotic scenario to make unnecessary the privacy amplification by allowing an infinite amount of channel uses to maximally exploit the superadditivity property (more precisely, the superadditivity of the security-threshold parameter hence the strong subadditivity of Eve). However, in practice it is trivially not possible to circulate over and over the same beam an infinite amount of times, due to the losses and imperfections of the physical devices.

Let us review the data components of the protocol that are needed for the appropriate description of the scalar reconciliation for the two-way CVQKD protocol. Our description will be as detailed as desired for further analysis, and will not take into account the particular description of any components of an experimental protocol. The raw data is generated by the use of noisy Gaussian channels ${\mathcal{N}}_1$ and ${\mathcal{N}}_2$, and by the parties’ internal secrets. The aim of the quantum-level transmission is to generate two nearly identical classical bitstrings between the parties. All of the quantum-level interactions are closed at this point, and the post-processing phase, which uses the raw data of the parties and a classical authenticated channel, is brought to life. The post-processing phase consists of the processes of reconciliation and privacy amplification. The valuable key will be generated in the reconciliation phase by using the raw data and a random secret. It consists of error-correction phases as well. The privacy amplification is geared toward performing security checks on the elements of the generated key, and it is not part of our description. We will assume reverse reconciliation (RR), which is desirable since the mutual information between Bob and Eve is provably lower than between Alice and Eve [1,2,3,4,5,6,7,9,10,11,12,13,14]. If Bob starts to run the reconciliation phase using his already noisy raw data, then only lower valuable information can be leaked to Eve during the procedure in comparison to if Alice would have started to run the reconciliation, from her ideal raw data (from the perspective of the raw data-level reconciliation, the noise that arises from the first channel use has no relevance, as will be clarified later, and Alice’s raw data can be viewed as ideal).

The run of the protocol is sketched as follows. Let us denote Alice’s binary raw data by $X$, and Bob’s binary raw data by $X^{\prime }$, where $\left|X\right|=\left|X^{\prime }\right|=N$ units. Alice’s raw data is generated by a random quadrature measurement of $M_1$. Alice’s selects two random variables x and p each drawn from a Gaussian distribution, which encodes her position and momentum quadratures and obtains a phase space vector $S_{Alice}=|x_A+i{p}_A\rangle$. Bob also draws a phase space vector $S_{Bob}=|x_B+i{p}_B\rangle$. The noisy ${S^{\prime }}_{Bob}$ is received by Alice in the first phase via channel ${\mathcal{N}}_1$ in the beam $B_{out}$. Alice’s raw data is defined as follows:

$$X\equiv M_1\left(B_{out}+S_{Alice}\right)={\mathcal{N}}_1\left(S_{Bob}\right)+S_{Alice}.$$

(1)

The outgoing beam $A_{out}$ will contain the other mode of the coupled beam. Bob’s raw data is generated by the $M_2$ random quadrature measurement applied on the beam $A_{out}$, as:

$$X^{\prime }\equiv M_2\left(A_{out}\right)={B^{\prime }}_{out}+{S^{\prime }}_{Alice}={\mathcal{N}}_2\left({\mathcal{N}}_1\left(S_{Bob}\right)\right)+{\mathcal{N}}_2\left(S_{Alice}\right),$$

(2)

where $A_{out}$ contains the noisy version of the second mode of the beam. A detailed description will be given in Section 2.1.

A simplified view of a PM (Prepare-and-Measure: entanglement-free) two-way CVQKD protocol with homodyne measurements $M_1$, $M_2$ at the parties and with RR is shown in Figure 1. Alice and Bob are connected by a noisy quantum channel and a classical authenticated channel. The quantum communication is started by Bob. Alice receives Bob’s quantum message and then couples it with her quantum message using a BS (Beam Splitter) to create a correlated signal. The first mode of the beam is measured by Alice, using a random quadrature measurement; the second mode is sent back to Bob, who will also apply a random quadrature measurement on the received beam. After the measurements have been performed, the parties inform each other about the used position and momentum quadratures over the classical channel, and discard the irrelevant data. The resulted raw data is a collection of correlated Gaussian variables. Since these binary strings follow Gaussian random distribution, they cannot be transmitted directly over the classical channel. In reverse reconciliation, Bob has to make the probability distribution of his raw data to uniform. He can do this by applying an appropriate function $C(\cdot )$ (will be clarified in Section 3) on his j-th raw data block, as denoted by ${X^{\prime }}_j$. Bob then generates a random key $U_j$ (the full key vector $K$ is granulated into several $U_j$-s), and multiplies it with his raw data $C\left({X^{\prime }}_j\right)$. Alice receives $C\left({X^{\prime }}_j\right)U_j$, and using her $C\left(X_j\right)$, she computes the noisy ${U^{\prime }}_j$. Next, the errors of the secret key that arise from the noise of the quantum channel will be corrected. This phase is modeled by the scalar reconciliation box at Alice’s side. The aim of the scalar reconciliation is to share an error-free key $K$ between Alice and Bob. From Alice, it requires the correction of the noise on ${U^{\prime }}_j$ to get back Bob’s $U_j$, using only scalar operations without the need of the multidimensional spherical space.

2.1. Physical Coding

In the following description we give a considerable view of the coding of two-way CVQKD, focusing on the contributions of information theory. Let us denote the quadratures of the i-th signal $S_{Alice,i}$ in the phase space ${\mathcal{S}}_A$ by $x_{A,i},p_{A,i}$, and the quadratures of Bob’s signal $S_{Bob,i}$ in the phase space ${\mathcal{S}}_B$ by $x_{B,i},p_{B,i}$, where $x_{A,i},p_{A,i}\in \mathbb{N}\left(0,{\sigma }_{\omega }^2\right)$ and $x_{B,i},p_{B,i}\in \mathbb{N}\left(0,{\sigma }_{\omega }^2\right)$ are drawn from a Gaussian random distribution with mean $\mu =0$, and variance ${\sigma }_{\omega }^2$, where ${\sigma }_{\omega }^2$ is the modulation variance [1,2,3,4,5,6,7,8,9,10].

The coherent states $S_{Alice,i}=|x_{A,i}+i{p}_{A,i}\rangle \in {\mathcal{S}}_A$ and $S_{Bob,i}=|x_{B,i}+i{p}_{B,i}\rangle \in {\mathcal{S}}_B$ are encoded by Gaussian modulation with dedicated centers $\left(x_{A,i},p_{A,i}\right)\in {\mathcal{S}}_A$ and $\left(x_{B,i},p_{B,i}\right)\in {\mathcal{S}}_B$, respectively (Note: Each $S_i$ define a zero-mean, circular symmetric complex Gaussian random variable $\mathcal{C}\mathbb{N}\left(0,{\sigma }_{S_i}^2\right)$ with variance ${\sigma }_{S_i}^2=\mathbb{E}\left[{\left|S_i\right|}^2\right]$ in the phase space $\mathcal{S}$, with i.i.d. real and imaginary components $x_i,p_i\in \mathbb{N}\left(0,{\sigma }_{\omega }^2\right)$, thus ${\sigma }_{S_i}^2=2{\sigma }_{\omega }^2$. The squared magnitude ${\left|S_i\right|}^2$ is exponentially distributed with density $f\left({\left|S_i\right|}^2\right)=1/{\sigma }_{S_i}^2\exp \left(-{\left|S_i\right|}^2/{\sigma }_{S_i}^2\right),{\left|S_i\right|}^2\ge 0$. The two beams are correlated at Alice’s BS, which results in a combined signal in the combined phase space ${\mathcal{S}}_{A\times B}$. The modulation noise $\partial \in \mathcal{C}\mathbb{N}\left(0,{\sigma }_{\partial }^2\right)$, is precisely centered around $\left(x_{A,i}+x_{B,i},p_{A,i}+p_{B,i}\right)\in {\mathcal{S}}_{A\times B}$ and $\left(x_{A,i}-x_{B,i},p_{A,i}-p_{B,i}\right)\in {\mathcal{S}}_{A\times B}$ in ${\mathcal{S}}_{A\times B}$. After the two beams $S_{Alice,i}$ and ${S^{\prime }}_{Bob,i}$ are correlated at a BS at Alice’s side, where ${S^{\prime }}_{Bob,i}$ is the noisy version of $S_{Bob,i}$, Alice applies a random quadrature measurement $M_1$ on the first mode of the beam, while the second mode is transmitted back to Bob over quantum channel ${\mathcal{N}}_2$. Alice’s state in the combined phase space ${\mathcal{S}}_{A\times B}$ is as follows:

$$|{\phi }_i\rangle =|x_{A,i}+{x^{\prime }}_{B,i}+i\left(p_{A,i}+{p^{\prime }}_{B,i}\right)\rangle \in \mathcal{C}\mathbb{N}\left(0,{\sigma }_{{\phi }_i}^2\right)\in {\mathcal{S}}_{A\times B},$$

(3)

with Gaussian random quadrature components $\mathbb{N}\left(0,2{\sigma }_{\omega }^2+{\sigma }_{{\mathcal{N}}_1}^2\right)$, where $2{\sigma }_{\omega }^2$ is the cumulated modulation variance, ${\sigma }_{{\mathcal{N}}_1}^2$ is the variance of ${\mathcal{N}}_1$, ${x^{\prime }}_{B,i}$, ${p^{\prime }}_{B,i}$ are Bob’s noisy quadratures modified by ${\mathcal{N}}_1$, while ${\sigma }_{{\phi }_i}^2=\mathbb{E}\left[{\left|{\phi }_i\right|}^2\right]$. Assuming a homodyne measurement $M_1$, Alice gets an $X_i$ unit of her raw data, which is a binary string. If she measured in the position quadrature basis she obtains:

$$X_i=x_{A,i}+{x^{\prime }}_{B,i},$$

(4)

or, if she used the momentum quadrature basis she gets

$$X_i=p_{A,i}+{p^{\prime }}_{B,i}.$$

(5)

The second mode of the combined signal in ${\mathcal{S}}_{A\times B}$ is transmitted directly back to Bob over the noisy channel ${\mathcal{N}}_2$, given as:

$$|{\varphi }_i\rangle =|x_{A,i}-{x^{\prime }}_{B,i}+i\left(p_{A,i}-{p^{\prime }}_{B,i}\right)\rangle \in \mathcal{C}\mathbb{N}\left(0,{\sigma }_{{\varphi }_i}^2\right)\in {\mathcal{S}}_{A\times B},$$

(6)

with $\mathbb{N}\left(0,2{\sigma }_{\omega }^2+{\sigma }_{{\mathcal{N}}_1}^2\right)$ Gaussian random quadratures, and ${\sigma }_{{\varphi }_i}^2=\mathbb{E}\left[{\left|{\varphi }_i\right|}^2\right]$. The Gaussian noise of the quantum channel ${\mathcal{N}}_2$ defines a noise vector ${\Delta }_i\in \mathcal{C}\mathbb{N}\left(0,{\sigma }_{{\Delta }_i}^2\right)\in {\mathcal{S}}_{A\times B}$, with noise components ${\Delta }_{x_i}\in \mathbb{N}\left(0,{\sigma }_{{\mathcal{N}}_2}^2\right)$, ${\Delta }_{p_i}\in \mathcal{C}\mathbb{N}\left(0,{\sigma }_{{\mathcal{N}}_2}^2\right)$, which results in the noisy state $|{\xi }_i\rangle \in {\mathcal{S}}_{A\times B}$ as follows:

$$|{\xi }_i\rangle =|{\varphi }_i\rangle +{\Delta }_i=|{x^{\prime }}_{A,i}-{x^{″}}_{B,i}+i\left({p^{\prime }}_{A,i}-{p^{″}}_{B,i}\right)\rangle \in \mathcal{C}\mathbb{N}\left(0,{\sigma }_{{\xi }_i}^2\right)\in {\mathcal{S}}_{A\times B},$$

(7)

with $\mathbb{N}\left(0,2{\sigma }_{\omega }^2+{\sigma }_{{\mathcal{N}}_1}^2+{\sigma }_{{\mathcal{N}}_2}^2\right)$ distributed Gaussian random quadratures, and ${\sigma }_{{\xi }_i}^2=\mathbb{E}\left[{\left|{\xi }_i\right|}^2\right]$, where ${x^{\prime }}_{A,i}$, ${p^{\prime }}_{A,i}$ are Alice’s noisy quadratures modified by ${\mathcal{N}}_2$, while ${x^{″}}_{B,i}$, ${p^{″}}_{B,i}$ are Bob’s noisy quadratures modified by ${\mathcal{N}}_2$.

In the next phase, Bob applies a random quadrature measurement $M_2$ (assumed to be homodyne) and gets block $Y_i$. If he used a position quadrature basis, he gets

$${Y^{\prime }}_i={x^{\prime }}_{A,i}-{x^{″}}_{B,i},$$

(8)

and for the momentum quadrature basis he obtains:

$${Y^{\prime }}_i={p^{\prime }}_{A,i}-{p^{″}}_{B,i}.$$

(9)

Bob, calibrating his resulted block $Y_i{}^{\prime }$ by $2{x^{″}}_{B,i}$ or $2{p^{″}}_{B,i}$ (depending on the used quadrature measurement), gets back the noisy version ${X^{\prime }}_i$ of Alice’s raw data unit $X_i$ as:

$$X_i{}^{\prime }={Y^{\prime }}_i+2{x^{″}}_{B,i}={x^{\prime }}_{A,i}-{x^{″}}_{B,i}+2{x^{″}}_{B,i}={x^{\prime }}_{A,i}+{x^{″}}_{B,i}$$

(10)

and

$$X_i{}^{\prime }={Y^{\prime }}_i+2{p^{″}}_{B,i}={p^{\prime }}_{A,i}-{p^{″}}_{B,i}+2{p^{″}}_{B,i}={p^{\prime }}_{A,i}+{p^{″}}_{B,i}.$$

(11)

which is referred as Bob’s raw data unit. The nature of the of error of the quantum channel will be characterized in detail in Section 4, however, at this point, we can surmise that the noise of the quantum channel is analogous to the addition of a non-standard Gaussian random noise vector ${\Delta }_i$ to Alice’s raw data block $X_i$.

Alice’s and Bob’s modes in the combined phase space ${\mathcal{S}}_{A\times B}$ right after being outputted from the BS are $|{\phi }_i\rangle$ and $|{\varphi }_i\rangle$, as shown in Figure 2. Alice obtains the first mode of the beam, $|{\phi }_i\rangle$, the second mode $|{\varphi }_i\rangle$ is sent back to Bob. The noise that exists in ${\mathcal{S}}_{A\times B}$ arises from the modulation noise $\partial \in \mathcal{C}\mathbb{N}\left(0,{\sigma }_{\partial }^2\right)$ (already included in the quadrature distributions) and the two channel uses, ${\mathcal{N}}_1$ and ${\mathcal{N}}_2$. The measurements performed on $|{\phi }_i\rangle$ and $|{\xi }_i\rangle$ result in raw data units $X_i\in \mathbb{N}\left(0,{\sigma }_X^2\right)$ and $X_i{}^{\prime }\in \mathbb{N}\left(0,{\sigma }_{X^{\prime }}^2\right)$. The noise of the first channel changes the Gaussian random distribution of the quadratures from $\mathbb{N}\left(0,2{\sigma }_{\omega }^2\right)$ to $\mathbb{N}\left(0,2{\sigma }_{\omega }^2+{\sigma }_{{\mathcal{N}}_1}^2\right)$ in the combined phase space ${\mathcal{S}}_{A\times B}$, with mean $\mu =0$, and results $X$ raw data level variance ${\sigma }_X^2=\left(2{\sigma }_{\omega }^2+{\sigma }_{{\mathcal{N}}_1}^2\right)$, and where noise variance ${\sigma }_{{\mathcal{N}}_1}^2$ arises from the first channel use. The quadratures of the second mode of the coupled beam are also characterized by the same variance, i.e., $|{\varphi }_i\rangle \in \mathcal{C}\mathbb{N}\left(0,{\sigma }_{{\varphi }_i}^2\right)$. The noise of ${\mathcal{N}}_2$ transforms $|{\varphi }_i\rangle \in {\mathcal{S}}_{A\times B}$ into $|{\xi }_i\rangle \in {\mathcal{S}}_{A\times B}$ and further modifies the distribution, so finally Bob’s received quadratures will follow a Gaussian distribution $\mathbb{N}\left(0,2{\sigma }_{\omega }^2+{\sigma }_{{\mathcal{N}}_1}^2+{\sigma }_{{\mathcal{N}}_2}^2\right)$. The $X^{\prime }$ raw data level variance is evaluated as ${\sigma }_{X^{\prime }}^2=\left(2{\sigma }_{\omega }^2+{\sigma }_{{\mathcal{N}}_1}^2+{\sigma }_{{\mathcal{N}}_2}^2\right)$, which, in fact, arises from the cumulated Gaussian random noise of ${\mathcal{N}}_1$ and ${\mathcal{N}}_2$.

One can recognize that on the raw data level, only the difference of the variance of Alice’s and Bob’s raw data ${\sigma }_X^2$ and ${\sigma }_{X^{\prime }}^2$ has relevance and ${\sigma }_{{\mathcal{N}}_1}^2$ vanishes from the picture. This difference is, indeed, ${\sigma }_{{\mathcal{N}}_2}^2$. In the level of raw data manipulations Alice’s $X_i$ will serve as a reference unit to correct Bob’s noisy unit, ${X^{\prime }}_i$. In other words, the first channel use will have no relevance in the raw data-level calculations, hence the noise of ${\mathcal{N}}_1$ can be excluded from the error-correction process. Precisely, the use of ${\mathcal{N}}_1$ has only one consequence: it increases the initial variance $2{\sigma }_{\omega }^2$ by ${\sigma }_{{\mathcal{N}}_1}^2$, which finally results in $\mathbb{N}\left(0,{\sigma }_X^2\right)$ on the level of raw data blocks. In particular, only ${\mathcal{N}}_2$ will have significance, and, in fact, only the noise of the second channel use has to be corrected in the reconciliation phase. (Note: Throughout the manuscript, the noise will be modeled on the quadrature-level via a real vector).

In the reconciliation phase, our task is to share an error-free secret key between the parties. This requires the raw data-level error-correction of the noise that arises from the quantum-level transmission. First, we review the background of the multidimensional reconciliation, and then we introduce our solution.

2.2. Uniform Distribution in the Spherical Space

In this section we review the background of the multidimensional approaches, and the properties of Gaussian random vectors in the spherical space. The multidimensional reconciliation processes for CVQKD were not implementable without the use of spherical codes and a high-dimensional spherical space.

First, let us clarify how a d-dimensional Gaussian random vector is formulated in the framework of a two-way CVQKD protocol. The outcoming beam from Alice (and Bob) can be regarded as a collection of Gaussian random variables. A standard Gaussian random variable $g\in \mathbb{N}\left(0,1\right)\in ℝ$ is a real variable selected from a Gaussian distribution. A standard Gaussian variable $g\in \mathbb{N}\left(0,1\right)$ has probability density function [15,18]:

$$f\left(g\right)=\frac{1}{\sqrt{2\pi }}{e}^{\frac{-g^2}{2}}.$$

(12)

A non-standard Gaussian random variable $g^{*}\in \mathbb{N}\left(\mu ,{\sigma }^2\right)\in ℝ$ with nonzero mean $\mu \ne 0$, and variance ${\sigma }^2$, can be expressed from $g\in \mathbb{N}\left(0,1\right)$ as $g^{*}=g\sigma +\mu$. A non-standard Gaussian random variable $g^{*}$ has probability density function:

$$f\left(g^{*}\right)=\frac{1}{\sqrt{2\pi {\sigma }^2}}{e}^{\frac{-{\left(g^{*}-\mu \right)}^2}{2{\sigma }^2}}.$$

(13)

In Alice’s raw data, a d-dimensional Gaussian vector

$$X_j={\left(X_{j,0},\dots ,X_{j,d-1}\right)}^T\in \mathbb{N}{\left(0,{\sigma }_X^2\right)}_d\in {ℝ}^d$$

(14)

is a collection of d independent Gaussian random variables $X_{j,0},\dots ,X_{j,d-1}$, where each $X_{j,i}$ is a real variable $ℝ$ drawn from a Gaussian random distribution $\mathbb{N}\left(0,{\sigma }_X^2\right)$. Alice’s Gaussian vector is referred by $X_j\in \mathbb{N}{\left(0,{\sigma }_X^2\right)}_d\in {ℝ}^d$, and its noisy version at Bob’s side is denoted by ${X^{\prime }}_j\in \mathbb{N}{\left(0,{\sigma }_{X^{\prime }}^2\right)}_d\in {ℝ}^d$. The values of Bob’s units are affected by the Gaussian noise that arises from the quantum channel.

First, let us evaluate why the normalized vector structure has importance in the multidimensional scenario. The normalized d-dimensional Gaussian vectors change the probability distribution from Gaussian random to uniform on the d-dimensional unit sphere, ${\Gamma }^{d-1}$. It has a relevance, since only uniform distribution is allowed in the reconciliation phase. The result clearly follows from the Rayleigh law [18], the application of Stirling’s formula [19], Gersho’s conjecture [22], and Sakrison’s result [23], which are connected to the contributions of spherical coding [24].

We formulate d-length blocks ${X^{\prime }}_j={\left({X^{\prime }}_{j,0},\dots ,{X^{\prime }}_{j,d-1}\right)}^T\in \mathbb{N}{\left(0,{\sigma }_{X^{\prime }}^2\right)}_d\in {ℝ}^d$, where ${X^{\prime }}_{j,i}\in \mathbb{N}\left(0,{\sigma }_{X^{\prime }}^2\right)\in ℝ$, for $i\in \left[d\right]$. The d-length Gaussian random vector ${X^{\prime }}_j$ has norm $\Vert {X^{\prime }}_j\Vert$, mean

$$\mathbb{E}\left[\Vert {X^{\prime }}_j\Vert \right]={\sigma }_{X^{\prime }}^{}\sqrt{d-\frac{1}{2}}$$

(15)

and variance

$$\mathrm{var}\left[\Vert {X^{\prime }}_j\Vert \right]\le \frac{{\sigma }_{X^{\prime }}^2}{2}.$$

(16)

We step further from this point. Since the variance of ${X^{\prime }}_j$ is not unit, the covariance matrix $ℭ\left({X^{\prime }}_j\right)$ is not equal to identity, but the random units ${X^{\prime }}_{j,i}$ are uncorrelated, so $ℭ\left({X^{\prime }}_j\right)$ is diagonal.

The normalized vector ${X^{\prime }}_j{}_j/\sqrt{d{\sigma }_{X^{\prime }}^2}$ with norm $\Vert {X^{\prime }}_j/\sqrt{d{\sigma }_{X^{\prime }}^2}\Vert$, can be identified on the unit sphere ${\Gamma }^{d-1}$ [18,24], with radius $r=\Vert {X^{\prime }}_j/\sqrt{d{\sigma }_{X^{\prime }}^2}\Vert$. The mean of $\Vert {X^{\prime }}_j\Vert /\sqrt{d{\sigma }_{X^{\prime }}^2}$ is

$$\mathbb{E}\left[\Vert {X^{\prime }}_j\Vert /\sqrt{d{\sigma }_{X^{\prime }}^2}\right]={\sigma }_{X^{\prime }}^{}\sqrt{d-\frac{1}{2}}/\sqrt{d{\sigma }_{X^{\prime }}^2}.$$

(17)

The vector ${X^{\prime }}_j/\sqrt{d{\sigma }_{X^{\prime }}^2}$ on the unit sphere ${\Gamma }^{d-1}$ is identified as

$${X^{\prime }}_j/\sqrt{d{\sigma }_{X^{\prime }}^2}=r\frac{{X^{\prime }}_j}{\Vert {X^{\prime }}_j\Vert }=\frac{\Vert {X^{\prime }}_j/\sqrt{d{\sigma }_{X^{\prime }}^2}\Vert {X^{\prime }}_j}{\Vert {X^{\prime }}_j\Vert }.$$

(18)

Precisely, the normalized quantity $\Vert {X^{\prime }}_j\Vert /\sqrt{d{\sigma }_{X^{\prime }}^2}$ has variance $\mathrm{var}\left[\Vert {X^{\prime }}_j\Vert /\sqrt{d{\sigma }_{X^{\prime }}^2}\right]\le \frac{{\sigma }_{X^{\prime }}^2}{2}/d{\sigma }_{X^{\prime }}^2$.

From the spherical symmetry, it follows that if $d\to \infty$, the normalized random vector ${X^{\prime }}_j/\sqrt{d{\sigma }_{X^{\prime }}^2}$ will be equipped with uniform distribution on ${\Gamma }^{d-1}$. The background of this phenomenon is as follows.

First, for $d\to \infty$, the mean $\mathbb{E}[\cdot ]$ of the normalized quantity $\Vert {X^{\prime }}_j\Vert /\sqrt{d{\sigma }_{X^{\prime }}^2}$ will tend to one, i.e.,

$$\underset{d\to \infty }{\lim }\mathbb{E}\left[\frac{\Vert {X^{\prime }}_j\Vert }{\sqrt{d{\sigma }_{X^{\prime }}^2}}\right]=\underset{d\to \infty }{\lim }\frac{{\sigma }_{X^{\prime }}^{}\sqrt{d-\frac{1}{2}}}{\sqrt{d{\sigma }_{X^{\prime }}^2}}=1.$$

(19)

Second, the variance $\mathrm{var}[\cdot ]$ of $\Vert {X^{\prime }}_j\Vert /\sqrt{d{\sigma }_{X^{\prime }}^2}$ will tend to zero,

$$\underset{d\to \infty }{\lim }\mathrm{var}\left[\frac{\Vert {X^{\prime }}_j\Vert }{\sqrt{d{\sigma }_{X^{\prime }}^2}}\right]=\underset{d\to \infty }{\lim }\frac{\frac{1}{2}{\sigma }_{X^{\prime }}^2}{d{\sigma }_{X^{\prime }}^2}=0.$$

(20)

These imply that for $d\to \infty$, the normalized Gaussian random vector ${X^{\prime }}_j/\sqrt{d{\sigma }_{X^{\prime }}^2}$ becomes uniformly distributed on the unit sphere ${\Gamma }^{d-1}$. Third, as the dimension increases the distribution of the norm of ${X^{\prime }}_j/\sqrt{d{\sigma }_{X^{\prime }}^2}$ (i.e., the radius on ${\Gamma }^{d-1}$) will approximate the Dirac distribution $\mathcal{D}\left(d\right)$ [9,10,11,18], and it will also converge to one, $r=\underset{d\to \infty }{\lim }\Vert {X^{\prime }}_j/\sqrt{d{\sigma }_{X^{\prime }}^2}\Vert =1$. The unit norms of ${X^{\prime }}_j/\sqrt{d{\sigma }_{X^{\prime }}^2}$ play exactly the role of unit fading-coefficients for a logical binary Gaussian channel, since during the transmissions of the messages generated from ${X^{\prime }}_j/\sqrt{d{\sigma }_{X^{\prime }}^2}$ the unit norms $r=\Vert {X^{\prime }}_j/\sqrt{d{\sigma }_{X^{\prime }}^2}\Vert =1$ are also transmitted [11,21].

To be more exact, the unit norms are only approximated and the distribution of the unit norms also depends on d, and as $d\to \infty$, it precisely can be described by the Dirac distribution

$${\mathcal{D}}_d\left(x\right)=\left(1/a\sqrt{\pi }\right)e^{-{\left(x-r\right)}^2/a^2},$$

(21)

where $a=1/\sqrt{d}$ and

$$r=\underset{d\to \infty }{\lim }\frac{\Vert {X^{\prime }}_j\Vert }{\sqrt{d{\sigma }_{X^{\prime }}^2}}=1.$$

(22)

From ${\mathcal{D}}_d\left(x\right)$ it immediately follows, that the unit norms of the normalized random Gaussian vectors gets closer to 1, as d goes to infinity [18]. As follows from these, for low values of $d$ the uniform distribution of ${X^{\prime }}_j/\sqrt{d{\sigma }_{X^{\prime }}^2}$ cannot be achieved.

In comparison to the multidimensional reconciliation, where the required mathematical operations (the spherical division operator at Alice’s side) exist only in $d=1,$ 2, 4, or 8 dimensions [9,10,11,18], the scalar reconciliation process are also existent for arbitrary high dimensions, which makes possible to give a more closer approximation, however it will not refer to the Dirac distribution. Analyzing the situation if the noisy raw data follows Gaussian random distribution with ${\sigma }_{X^{\prime }}^2>1$, the speed of convergence of the mean $\mathbb{E}\left[{X^{\prime }}_j/\sqrt{d{\sigma }_{X^{\prime }}^2}\right]$ and variance $\mathrm{var}\left[{X^{\prime }}_j/\sqrt{d{\sigma }_{X^{\prime }}^2}\right]$ will be lower for any d, in comparison if ${\sigma }_{X^{\prime }}^2=1$ would have hold.

For ${\sigma }_{X^{\prime }}^2=1$, the situation for various dimensions of ${X^{\prime }}_j$ is summarized in Figure 3.

As we have mentioned, the multidimensional approaches are limited in the dimension, specifically, $d=8$ in [9,10,11]. In this case, the Gaussian random vectors form the so-called octonions [20]. In the level of Gaussian random raw data, an octonion ${\mathrm{O}}_j\in {ℝ}^8$ is built up from eight units $X_{j,0\dots j,7}\in \mathbb{N}\left(0,{\sigma }_X^2\right)$, as:

$${\mathrm{O}}_j=X_{j,0}\mathrm{Re}+X_{j,1}{\mathrm{Im}}_1+\dots +X_{j,7}{\mathrm{Im}}_7,$$

(23)

where $\mathrm{Re}\in ℝ$ stands for the real part, while ${\mathrm{Im}}_i\in ℂ$, for$i=1,i\le 7$ identifies the i-th imaginary units, respectively. Bob’s noisy ${{\mathrm{O}}^{\prime }}_j$ is ${{\mathrm{O}}^{\prime }}_j={X^{\prime }}_{j,0}\mathrm{Re}+{X^{\prime }}_{j,1}{\mathrm{Im}}_1+\dots +{X^{\prime }}_{j,7}{\mathrm{Im}}_7,$ where ${X^{\prime }}_{j,0\dots 7}\in \mathbb{N}\left(0,{\sigma }_{X^{\prime }}^2\right)$. In the multidimensional case the uniformity of the d-dimensional Gaussian random raw data vectors $X_j\in {ℝ}^d$, $d\le 8$, can be achieved only in the multidimensional spherical space, over the unit sphere ${\Gamma }^{d-1}$. The process requires complex operations and transformations [9,10,11] that are so undesirable in a practical CVQKD scenario. In comparison to these approaches, our proposed scalar reconciliation uses only simple scalar operations on the raw data, which makes it possible to eliminate the spherical calculations from the reconciliation phase.

3. Low-Dimensional Reconciliation

We start our description from the point at which the quantum states are completely transmitted through the quantum channel from Alice to Bob. At this point, all of the interactions with the quantum channel are closed, and the post-processing phase is being started. First, Alice and Bob exclude from the raw data those measurements that have been performed in different quadratures that result in the N-unit length raw data vectors. Then, formulate $N/d$ number of d-dimensional vectors $X_j\in {ℝ}^d$, ${X^{\prime }}_j\in {ℝ}^d$. These quantities are introduced as follows.

3.1. Notations

Let $X\in {ℝ}^N$ and $X^{\prime }\in {ℝ}^N$ the N-unit length raw data of Alice and Bob. The d-dimensional vectors $X_j\in {ℝ}^d$ and ${X^{\prime }}_j\in {ℝ}^d$, for$j=0,j\le \left(N/d\right)-1$, of Alice and Bob are defined as:

$$X_j={\left(X_{j,0},\dots ,X_{j,d-1}\right)}^T\in \mathbb{N}{\left(0,{\sigma }_X^2\right)}_d$$

(24)

and

$${X^{\prime }}_j={\left({X^{\prime }}_{j,0},\dots ,{X^{\prime }}_{j,d-1}\right)}^T\in \mathbb{N}{\left(0,{\sigma }_{X^{\prime }}^2\right)}_d,$$

(25)

where

$$X_{j,i}\in \mathbb{N}\left(0,{\sigma }_X^2\right)\in ℝ$$

(26)

and

$${X^{\prime }}_{j,i}\in \mathbb{N}\left(0,{\sigma }_{X^{\prime }}^2\right)\in ℝ$$

(27)

refer to the i-th unit of the j-th vector, respectively. Alice and Bob have to share a common secret by using their correlated raw data. For this purpose, they establish a proper code-alphabet $\mathcal{A}=\left\{a,b\right\}$, where $a\in ℝ$ and $b\in ℝ$ are two public variables (i.e., Eve also has access to it). In the reverse reconciliation, these will be selected uniformly at random in the form of several $U_j\in \left\{a,b\right\}$-s at Bob’s side, with $\mathrm{Pr}\left(a\right)=\mathrm{Pr}\left(b\right)=0.5$.

A secret d-dimensional key vector $U_j$ is drawn from a uniform distribution $\mathcal{U}$ and built up from d units, $U_{j,i}\in ℝ$, as:

$$U_j\in {ℝ}^d:{\left(U_{j,0},\dots ,U_{j,d-1}\right)}^T,\mathrm{for}j=0,j\le \left(N/d\right)-1.$$

(28)

The d units $U_{j,i}\in \mathcal{U}$ of $U_j$ are uniform random variables, and define $U_j\in ℝ$ as follows:

$$U_j={\displaystyle {\sum }_{i=0}^{d-1}{U}_{j,i}}\in \mathcal{U}.$$

(29)

The noisy version of (29), ${U^{\prime }}_j$, is defined as

$${U^{\prime }}_j={\displaystyle {\sum }_{i=0}^{d-1}{U^{\prime }}_{j,i}}.$$

(30)

From (29) follows, that (28) can be rewritten as $U_j\in \left\{A,B\right\}\in {ℝ}^d$, with vectors $A,B$ as:

$$A:{\left(a_{j,0},\dots ,a_{j,d-1}\right)}^T,\left\{{\displaystyle {\sum }_{i=0}^{d-1}{a}_{j,i}}=a\right\},B:{\left(b_{j,0},\dots ,b_{j,d-1}\right)}^T,\left\{{\displaystyle {\sum }_{i=0}^{d-1}{b}_{j,i}}=b\right\}.$$

(31)

As follows, Bob granulates the selected a or b into d number of uniformly random variables $U_{j,i}$, so that the sum of the units will be equal to the selected value.

The full key $K$ is built up as:

$$K\in {ℝ}^{N/d}:{\left(U_0,\dots ,U_{\left(N/d\right)-1}\right)}^T.$$

(32)

Alice and Bob first agree on d. Bob then sends the d blocks of

$$C\left({X^{\prime }}_j\right)U_j={\left(C\left({X^{\prime }}_{j,0}\right)U_{j,0},\dots ,C\left({X^{\prime }}_{j,d-1}\right)U_{j,d-1}\right)}^T\in {ℝ}^d,$$

(33)

for $j=0,j\le \left(N/d\right)-1$, over a classical channel. The scalar quantities $C\left(X_j\right)$, $C\left({X^{\prime }}_j\right)$, and $C\left({X^{\prime }}_j\right)U_j$ are evaluated as

$$C\left(X_j\right)={\displaystyle {\sum }_{i=0}^{d-1}C\left(X_{j,i}\right)}\in ℝ,C\left({X^{\prime }}_j\right)={\displaystyle {\sum }_{i=0}^{d-1}C\left({X^{\prime }}_{j,i}\right)}\in ℝ,$$

(34)

and

$$C\left({X^{\prime }}_j\right)U_j={\displaystyle {\sum }_{i=0}^{d-1}C\left({X^{\prime }}_{j,i}\right)U_{j,i}}\in ℝ,$$

(35)

respectively.

Alice receives the d noisy ${U^{\prime }}_{j,i}$ units, and by the addition of the d units, and via the application of $C\left(X_j\right)$ she computes ${U^{\prime }}_j$ as

$$\begin{array}{ll}{U^{\prime }}_j& ={\displaystyle {\sum }_{i=0}^{d-1}{U^{\prime }}_{j,i}}=C\left({X^{\prime }}_j\right)U_j\frac{1}{C\left(X_j\right)}\\ & =\left({\displaystyle {\sum }_{i=0}^{d-1}C\left({X^{\prime }}_{j,i}\right)/{\displaystyle {\sum }_{i=0}^{d-1}C\left(X_{j,i}\right)}}\right){\displaystyle {\sum }_{i=0}^{d-1}{U}_{j,i}}.\end{array}$$

(36)

Thus, Alice has to make an error-correction to remove the noise from ${U^{\prime }}_j$ to get achieve $U_j$.

3.2. Achieving the Uniform Distribution

In comparison to the multidimensional reconciliation, the scalar reconciliation uses a fundamentally different solution to achieve the uniform distribution of the raw data. While the former is based on sophisticated multidimensional spherical operations, our solution requires only the use of a simple function in the scalar space. In our scheme, the uniform distribution of the correlated raw data units is achieved by the Gaussian Cumulative Distribution Function (CDF) [26,43,44,45]. Another important difference is that the approximation of the logical binary Gaussian channel can be achieved by arbitrary dimension with arbitrary accuracy, which is justified by the Central Limit Theorem (CLT) [26,43,44,45].

3.2.1. Gaussian Cumulative Distribution Function

On Alice’s and Bob’s side, the Gaussian CDF function can be used to reach the uniform distribution of the correlated raw data. Since we assumed reverse reconciliation, let us to start the description from Bob’s perspective. Let Bob’s raw data unit ${X^{\prime }}_{j,i}$ with Gaussian random distribution $\mathbb{N}\left(0,{\sigma }_{X^{\prime }}^2\right)$. The Gaussian CDF-transformation $C(\cdot ):ℝ\to ℝ$ for a unit ${X^{\prime }}_{j,i}$ is as follows:

$$C\left({X^{\prime }}_{j,i}\right)=\frac{1}{2}\left(1+erf\left(\frac{{X^{\prime }}_{j,i}}{\sqrt{2{\sigma }_{X^{\prime }}^2}}\right)\right),\mathrm{for}i\in \left[d\right],$$

(37)

where

$$erf\left(\frac{{X^{\prime }}_{j,i}}{\sqrt{2{\sigma }_{X^{\prime }}^2}}\right)=\frac{2}{\sqrt{\pi }}{\displaystyle {\int }_0^{{X^{\prime }}_{j,i}/\sqrt{2{\sigma }_{X^{\prime }}^2}}{e}^{-t^2}dt}$$

(38)

is the Gauss error function, and $C\left({X^{\prime }}_{j,i}\right)\in ℝ$ is a real variable from the range of $\left[0,1\right]$, with $\mathcal{U}$ uniform distribution (for a plausible example Section 5). The quantity $C\left({X^{\prime }}_{j,i}\right)$ will be referred as the CDF-transformed unit.

Alice also applies the CDF transformation, and takes into account her raw data variance ${\sigma }_X^2$ for the units of $X_{j,i}$ to get $C\left(X_{j,i}\right)$:

$$C\left(X_{j,i}\right)=\frac{1}{2}\left(1+erf\left(\frac{X_{j,i}}{\sqrt{2{\sigma }_X^2}}\right)\right),\mathrm{for}i\in \left[d\right],$$

(39)

and the result of (37) and (39) is the correlated uniform raw data $C\left(X_{j,i}\right)\approx C\left({X^{\prime }}_{j,i}\right)$. In the reconciliation process, only Alice can correct ${U^{\prime }}_j$ into $U_j$, because nobody knows the CDF-transformed raw data units $C\left(X_{j,i}\right)$, except Alice.

For a given $X_j\in {ℝ}^d$, the CDF function $C(\cdot ):ℝ\to ℝ$ reads as

$$C\left(X_j\right)=C\left(X_{j,0}\right),\dots ,C\left(X_{j,d-1}\right)=\frac{1}{2}\left(1+erf\left(\frac{X_{j,i}}{\sqrt{2{\sigma }^2}}\right)\right)\in ℝ,\mathrm{for}i\in \left[d\right],$$

(40)

Applying the results for Bob’s raw data the CDF-transformed vector is:

$$C\left({X^{\prime }}_j\right)=C\left({X^{\prime }}_{j,0}\right),\dots ,C\left({X^{\prime }}_{j,d-1}\right)=\frac{1}{2}\left(1+erf\left(\frac{{X^{\prime }}_{j,i}}{\sqrt{2{\sigma }^2}}\right)\right)\in ℝ,\mathrm{for}i\in \left[d\right].$$

(41)

The CDF-transformed $C\left(X_j\right)$, $C\left({X^{\prime }}_j\right)$ raw data vectors each consist of d real $ℝ$ variables as:

$$C\left(X_j\right)={\left(C\left(X_{j,0}\right),\dots ,C\left(X_{j,d-1}\right)\right)}^T,C\left({X^{\prime }}_j\right)={\left(C\left({X^{\prime }}_{j,0}\right),\dots ,C\left({X^{\prime }}_{j,d-1}\right)\right)}^T.$$

(42)

3.2.2. Central Limit Theorem

In the multidimensional case, the precision of the approximation of the logical binary Gaussian channel (i.e., the quality of the physical-logical channel conversion) was quantified by the Dirac distribution [9,10,11]. Since in the scalar reconciliation the spherical space is eliminated, a different solution was needed to analyze the accuracy of the conversion between the physical-logical Gaussian channels. Our answer for the problem is the Central Limit Theorem [26,43,44,45] and a mathematical result from the 19th century—the so-called Lyapunov-condition [26,45]. The accuracy of the physical-logical conversion of scalar reconciliation can be maximized, and it can be made in arbitrary high dimensions, as it is being stated in Lemma 1.

Lemma 1.

The noise variance of the converted logical binary Gaussian channel asymptotically coincidences with the noise variance of the physical quantum channel, which allows to reach the theoretical maximum of the capacity of the converted logical binary channel.

Proof. 

Let $X_{j,i}\in ℝ$ and ${X^{\prime }}_{j,i}\in ℝ$ the j-th units of Alice’s and Bob’s raw data, respectively. For a d-dimensional vector $U_j={\left({U^{\prime }}_{j,0},\dots ,{U^{\prime }}_{j,d-1}\right)}^T$, the sum of the independent noise $\left\{{\delta }_{j,0},\dots ,{\delta }_{j,d-1}\right\}$ units on the secret noisy key units ${U^{\prime }}_{j,i}=U_{j,i}+{\delta }_{j,i}$ will approximate a zero-mean Gaussian random variable with mean $\mathbb{E}\left[{\delta }_{j,i}\right]={\mu }_{{\delta }_{j,i}}=0$, noise variance $\mathrm{var}\left[{\delta }_{j,i}\right]={\sigma }_{{\delta }_{j,i}}^2$ (see Section 3.1 and Section 3.3 for a detailed derivation) as follows:

$$\begin{array}{c}CLT:\frac{1}{\sqrt{{\displaystyle {\sum }_{i=0}^{d-1}{\sigma }_{{\delta }_{j,i}}^2}}}{\delta }_j=\frac{1}{\sqrt{{\displaystyle {\sum }_{i=0}^{d-1}{\sigma }_{{\delta }_{j,i}}^2}}}\left({\displaystyle {\sum }_{i=0}^{d-1}{\delta }_{j,i}}\right)\to \mathbb{N}{\left(0,1\right)}_d\\ {\delta }_j=\left({\displaystyle {\sum }_{i=0}^{d-1}{\delta }_{j,i}}\right)\to \mathbb{N}\left(0,{\displaystyle {\sum }_{i=0}^{d-1}{\sigma }_{{\delta }_{j,i}}^2}\right)=\mathbb{N}{\left(0,{\sigma }_{{\delta }_{j,i}}^2\right)}_d.\end{array}$$

(43)

To show that (43) holds for the d-dimensional noise parameter ${\delta }_j$, we exploit the Lyapunov-condition [26]. Applying the standard mathematical description of the Lyapunov condition [45], let $\mathfrak{L}>0$, then

$$\underset{d\to \infty }{\lim }\frac{1}{{\left(\sqrt{{\displaystyle {\sum }_{i=0}^{d-1}{\sigma }_{{\delta }_{j,i}}^2}}\right)}^{2+\mathfrak{L}}}{\displaystyle {\sum }_{i=0}^{d-1}\mathbb{E}\left[{\left|{\delta }_{j,i}\right|}^{2+\mathfrak{L}}\right]}=0$$

(44)

is satisfied for any $d\to \infty$, by theory. As follows, the noise on $U_j\in {ℝ}^d$ will converge to

$${\delta }_j=\left({\displaystyle {\sum }_{i=0}^{d-1}{\delta }_{j,i}}\right)\in \mathbb{N}{\left(0,{\sigma }_{{\delta }_j}^2\right)}_d,$$

(45)

and the resulting logical channel will be equivalent to a logical binary Gaussian channel with noise variance ${\sigma }_{{\delta }_j}^2$. By the same argumentation, the variance of the resulting logical binary Gaussian channel will converge to the variance of the physical Gaussian quantum channel ${\sigma }_{{\mathcal{N}}_2}^2$ for $N\to \infty$.

Let again $\mathfrak{L}>0$, and d is an appropriate dimension for which (44) is satisfied, and let the expected variance of ${\delta }_j$ is $\mathrm{var}\left[{\delta }_j\right]={\sigma }_{{\mathcal{N}}_2}^2$. Then

$$\underset{N\to \infty }{\lim }\frac{1}{{\left(\sqrt{{\displaystyle {\sum }_{j=0}^{\left(N/d\right)-1}{\sigma }_{{\mathcal{N}}_2}^2}}\right)}^{2+\mathfrak{L}}}{\displaystyle {\sum }_{j=0}^{\left(N/d\right)-1}\mathbb{E}\left[{\left|{\delta }_j\right|}^{2+\mathfrak{L}}\right]}=0,$$

(46)

is satisfied by theory, from which

$$\begin{array}{c}CLT:\frac{1}{\sqrt{{\displaystyle {\sum }_{j=0}^{\left(N/d\right)-1}{\sigma }_{{\mathcal{N}}_2}^2}}}\left({\displaystyle {\sum }_{j=0}^{\left(N/d\right)-1}{\delta }_j}\right)\to \mathbb{N}{\left(0,1\right)}_{N/d}\\ \left({\displaystyle {\sum }_{j=0}^{\left(N/d\right)-1}{\delta }_j}\right)\to \mathbb{N}\left(0,{\displaystyle {\sum }_{j=0}^{\left(N/d\right)-1}{\sigma }_{{\mathcal{N}}_2}^2}\right)=\mathbb{N}{\left(0,{\sigma }_{{\mathcal{N}}_2}^2\right)}_{N/d},\end{array}$$

(47)

follows, which proves the statement. Hence, one can readily recognize that

$$\underset{N\to \infty }{\lim }\mathrm{var}\left[{\delta }_{0\dots \left(N/d\right)-1}\right]={\left({\sigma }_{{\mathcal{N}}_2}^2\right)}_{N/d}.$$

(48)

To conclude the situation, in (43) and (47) the variances of ${\delta }_j$ and ${\displaystyle {\sum }_{j=0}^{\left(N/d\right)-1}{\delta }_j}$, indeed, are not scaled up by d and $N/d$, which makes possible to convert the physical Gaussian quantum channel to a logical binary Gaussian channel with noise variance $d{\sigma }_{{\delta }_j}^2\approx {\sigma }_{{\mathcal{N}}_2}^2$ for arbitrary d.

These results allow for one to obtain the lowest noise variance, and hence, the highest SNR of the logical channel that is possible by theory. At the resulting SNR, the capacity of the logical binary Gaussian channel also picks up its maximum. From this, one can immediately conclude, that, in fact, it is a favorable result because the logical channel is indeed a binary Gaussian channel that is equipped with the same capacity at low SNRs (which is the situation in an experimental long-distance scenario) than the physical Gaussian quantum channel. In our solution, the lower bound ${\sigma }_{{\delta }_j}^2={\sigma }_{{\mathcal{N}}_2}^2$ is precisely reached and is justified by the Lyapunov-condition, which means that our conversion provides the best approximation that is possible. ☐

3.2.3. Application

In comparison to the multidimensional approaches, here, one can recognize that these results make no necessary the use of the multidimensional spherical space. The key idea is as follows: do the reconciliation in the scalar space to reduce the problem from ${\Gamma }^{d-1}$ of ${ℝ}^d$ into $ℝ$. The main drawback of the multidimensional reconciliation approaches is the use of spherical space ${\Gamma }^{d-1}$ of ${ℝ}^n$ to achieve the uniform distribution. As we have found in a CVQKD scenario it is not a required condition, and completely can be eliminated. The uniformly distributed elements of ${ℝ}^d$ have to be transmitted over the classical authenticated channel, but it per se, does not imply that the reconciliation has to be executed in the spherical space. The spherical correction of the errors of the raw data is a completely undesirable and unwanted event in a practical CVQKD, because it would just cause a further decrease in the very fragile, sensitive, and so strenuously established secret key rates. The use of ${\Gamma }^{d-1}$ of ${ℝ}^d$ served only one purpose in the multidimensional reconciliation: to guarantee the security requirements of the QKD post-processing phase. From this, it immediately can be concluded that the use of spherical space is, in fact, unnecessary, and a mathematically equivalent and more efficient solution exists in the scalar space of $ℝ$.

One can recognize two improvements in our proposed scheme in comparison to the existing approaches. First, the uniform distribution will be reached by a simple operation, the Gaussian-CDF function applied separately on each unit of the raw data. Second, the approximation of the Gaussian channel will be justified by the CLT, using arbitrary dimensional vectors. As follows, the physical-logical channel conversion can be established with arbitrary high precision, since the $d\le 8$ limitation has also been eliminated from the picture. To conclude, the spherical space can be replaced by the CDF transformation on the raw data units, and the Dirac distribution can be replaced by the CLT. It is clear now that the existing reconciliation methods require a revision since its application just leads to further slow-down in a practical CVQKD scenario. By these reasons, we drop away the spherical space, and instead of it, use the CDF-transformed units. These improvements allow for very efficient decoding and error-correction, however, this step does not modify any fine property of the code: in other words, it keeps the desired uniform distribution and guarantees the arbitrary high-precision in the approximation of the logical binary Gaussian channel. Finally, we have to emphasize again that the whole reconciliation procedure is implemented through the logical layer only, without any need of physical-layer tomography.

3.3. Run of Scalar Reconciliation

The run of scalar reconciliation (assuming reverse reconciliation) is sketched as follows. Bob divides his N-unit length raw data $X^{\prime }$ into $n=N/d$ number of d-dimensional vectors ${X^{\prime }}_j={\left({X^{\prime }}_{j,0},\dots ,{X^{\prime }}_{j,d-1}\right)}^T\in {ℝ}^d$, where $d$ is the length of the vectors measured in units ${X^{\prime }}_{j,i}$ in the raw data.

Then, for each ${X^{\prime }}_j$, applies CDF transformation on the units ${X^{\prime }}_{j,i}\in ℝ$ of ${X^{\prime }}_j$, $fori=0,i\le d-1$, $forj=0,j\le \left(N/d\right)-1$. Bob generates $U_j={\left(U_{j,0}\dots U_{j,d-1}\right)}^T\in {ℝ}^d,$ $U_{j,i}\in ℝ$, computes $C\left({X^{\prime }}_j\right)U_j={\left(C\left({X^{\prime }}_{j,0}\right)U_{j,0},\dots ,C\left({X^{\prime }}_{j,d-1}\right)U_{j,d-1}\right)}^T$, and sends it to Alice over the classical authenticated channel.

Alice also divides her N-unit length raw data $X$, into $n=N/d$ number of d-dimensional vectors $X_j={\left(X_{j,0},\dots ,X_{j,d-1}\right)}^T\in {ℝ}^d$, computes the CDF-transformed $C\left(X_j\right)={\left(C\left(X_{j,0}\right),\dots ,C\left(X_{j,d-1}\right)\right)}^T\in {ℝ}^d$ and using (29), (34), and (35) computes as

$$\begin{array}{ll}{U^{\prime }}_j& =C\left({X^{\prime }}_j\right)U_j\frac{1}{C\left(X_j\right)}\\ & ={\displaystyle {\sum }_{i=0}^{d-1}{X^{\prime }}_{j,i}{U}_{j,i}}{\displaystyle {\sum }_{i=0}^{d-1}{U^{\prime }}_{j,i}}\\ & =\frac{{\displaystyle {\sum }_{i=0}^{d-1}C\left({X^{\prime }}_{j,i}\right)U_{j,i}}}{{\displaystyle {\sum }_{i=0}^{d-1}C\left(X_{j,i}\right)}}.\end{array}$$

(49)

Next, she corrects the Gaussian noise on ${U^{\prime }}_j$ to get $U_j$. From these she rebuilds the error-free full key

$$K\in {ℝ}^{N/d}:{\left(U_0,\dots ,U_{\left(N/d\right)-1}\right)}^T.$$

(50)

3.4. Security

The scalar reconciliation provides unconditional security. It will be demonstrated for reverse reconciliation. The security of scalar reconciliation is guaranteed by the fact that the transmitted $C\left({X^{\prime }}_j\right)U_j$ messages follow uniform distribution, and the multiplied $U_j$ and ${X^{\prime }}_j$ vectors are also uniform and independent.

The following conditional probability holds for each $U_j$, $U_j=U_{0\dots 1}$ (see also (29),(34) and (35)):

$$\mathrm{Pr}\left(U_j=U_{0\dots 1}|C\left({X^{\prime }}_j\right)U_j\right)=\frac{1}{2}.$$

(51)

Since $C\left({X^{\prime }}_j\right)U_j$ are uniformly distributed, and also independent [11], it follows that:

$$\mathrm{Pr}\left(C\left({X^{\prime }}_{j,i}\right)=C\left({X^{\prime }}_{j,0}\right)\dots C\left({X^{\prime }}_{j,N-1}\right)\right)=\frac{1}{N}$$

(52)

and

$$\mathrm{Pr}\left(U_j=U_{0\dots 1}\right)=\frac{1}{2}.$$

(53)

Since the overall number of d-dimensional $U_j\in {ℝ}^d$ vectors is $N/d$, the probability that Eve obtains the full key $K$ is

$${\mathrm{Pr}}_{Eve}\left(K={\left(U_0,\dots ,U_{\left(N/d\right)-1}\right)}^T\right)=\frac{1}{2^{N/d}}.$$

(54)

3.5. Noise on the Data

This section reveals the mathematical description of the noise vector of the Gaussian quantum channel ${\mathcal{N}}_2$ and its impacts on Bob’s raw data and Alice’s received secret key. We also can exploit that in the evaluation of the noise vector, only the second channel use ${\mathcal{N}}_2$ has to be taken in to consideration in the error correction.

The d-dimensional noise vector ${\Delta }_j\in \mathbb{N}{\left(0,{\sigma }_{{\mathcal{N}}_2}^2\right)}_d\in {ℝ}^d$ of the Gaussian channel ${\mathcal{N}}_2$ on the j-th ${X^{\prime }}_j$ is a Gaussian random vector defined as:

$${\Delta }_j={X^{\prime }}_j-X_j=\left\{{\Delta }_{j,0},\dots ,{\Delta }_{j,d-1}\right\}\in \mathbb{N}{\left(0,{\sigma }_{{\mathcal{N}}_2}^2\right)}_d\in {ℝ}^d,$$

(55)

where ${\Delta }_{j,i}\in \mathbb{N}\left(0,{\sigma }_{{\mathcal{N}}_2}^2\right)\in ℝ$ identifies the Gaussian noise on the i-th unit $X_i$ of ${X^{\prime }}_j$ as:

$${\Delta }_{j,i}={X^{\prime }}_{j,i}-X_{j,i}\in \mathbb{N}\left(0,{\sigma }_{{\mathcal{N}}_2}^2\right)\in ℝ.$$

(56)

The noise vector ${\Delta }_j$ is added to Alice’s $X_j$, hence Bob’s noisy ${X^{\prime }}_j$ is:

$${X^{\prime }}_j=X_j+{\Delta }_j\in {ℝ}^d.$$

(57)

In terms of raw-data vector units, the Gaussian noise vector ${\Delta }_{j,i}$ is described as follows:

$${X^{\prime }}_{j,i}=X_{j,i}+{\Delta }_{j,i}\in ℝ,$$

(58)

and (57) can be rewritten as:

$$\begin{array}{ll}{X^{\prime }}_j& =\left\{{X^{\prime }}_{j,0},\dots ,{X^{\prime }}_{j,d-1}\right\}\\ & =\left\{X_{j,0}+{\Delta }_{j,0},\dots ,X_{j,d-1}+{\Delta }_{j,d-1}\right\}.\end{array}$$

(59)

In the scalar reconciliation, the error-correction is performed on the level of unit sums ${U^{\prime }}_j={\displaystyle {\sum }_{i=0}^{d-1}{U^{\prime }}_{j,i}}$ in $ℝ$ as follows. Alice receives the d-dimensional $C\left({X^{\prime }}_j\right)U_j$ from Bob, from which she obtains $C\left({X^{\prime }}_j\right)U_j$ (see (35)) and divides it by her $C\left(X_j\right)$ (see (34)). The effect of Gaussian noise [9] results in a distorted secret ${U^{\prime }}_j\in ℝ$ as:

$${U^{\prime }}_j={\displaystyle {\sum }_{i=0}^{d-1}{U^{\prime }}_{j,i}}=\frac{{\displaystyle {\sum }_{i=0}^{d-1}C\left({X^{\prime }}_{j,i}\right)U_{j,i}}}{{\displaystyle {\sum }_{i=0}^{d-1}C\left(X_{j,i}\right)}}={\displaystyle {\sum }_{i=0}^{d-1}{U}_{j,i}}+{\displaystyle {\sum }_{i=0}^{d-1}{\delta }_{j,i}}=U_j+{\delta }_j\in ℝ,$$

(60)

where ${\delta }_{j,i}$ is the noise on $U_{j,i}$ (for a plausible example, see Section 5):

$${\delta }_{j,i}=\frac{U_{j,i}}{C\left(X_{j,i}\right)}C\left({\Delta }_{j,i}\right)\in \mathbb{N}\left(0,{\sigma }_{{\delta }_{j,i}}^2\right),$$

(61)

where ${\sigma }_{{\delta }_{j,i}}^2$ is the variance of the distribution of ${\delta }_{j,i}$, while $C\left({\Delta }_{j,i}\right)$ is the noise of the CDF-transformed raw data units:

$$C\left({\Delta }_{j,i}\right)=C\left({X^{\prime }}_{j,i}\right)-C\left(X_{j,i}\right)\in ℝ,$$

(62)

where $C\left({\Delta }_{j,i}\right)\in \mathbb{N}\left(0,{\sigma }_{C\left({\Delta }_{j,i}\right)}^2\right)$, and $C\left({\Delta }_j\right)=C\left({X^{\prime }}_j\right)-C\left(X_j\right)\in {ℝ}^d$, with a distribution of $\mathbb{N}{\left(0,{\sigma }_{C\left({\Delta }_j\right)}^2\right)}_d$. The error-corrected $U_j$ can be expressed from the noisy ${U^{\prime }}_{j,i}$, as follows:

$$U_j={\displaystyle {\sum }_{i=0}^{d-1}{U^{\prime }}_{j,i}}-{\displaystyle {\sum }_{i=0}^{d-1}{\varsigma }_{j,i}}=U_j-{\varsigma }_j\in ℝ,$$

(63)

where ${\varsigma }_{j,i}\in \mathbb{N}\left(0,{\sigma }_{{\varsigma }_{j,i}}^2\right)$ characterizes the same amount of noise as (61), i.e., and ${\varsigma }_{j,i}={\delta }_{j,i}$, however it is evaluated from the noisy raw-data units ${U^{\prime }}_{j,i},$ $C\left({X^{\prime }}_{j,i}\right)$ as:

$${\varsigma }_{j,i}=\frac{{U^{\prime }}_{j,i}}{C\left({X^{\prime }}_{j,i}\right)}C\left({\Delta }_{j,i}\right)\in ℝ,$$

(64)

with ${\varsigma }_{j,i}\in \mathbb{N}\left(0,{\sigma }_{{\varsigma }_{j,i}}^2\right)$. The d-dimensional vector ${U^{\prime }}_j\in {ℝ}^d$ can be expressed as:

$${U^{\prime }}_j=U_j+{\overrightarrow{\delta }}_j\in {ℝ}^d,$$

(65)

where the noise vector ${\overrightarrow{\delta }}_j=\left\{{\delta }_{j,0},\dots ,{\delta }_{j,d-1}\right\}\in {ℝ}^d$ is as follows:

$${\overrightarrow{\delta }}_j=\frac{U_j}{C\left(X_j\right)}C\left({\Delta }_j\right)\in \mathbb{N}{\left(0,{\sigma }_{{\delta }_j}^2\right)}_d=\mathbb{N}\left(0,{\sigma }_{{\delta }_{j,0},\dots ,{\delta }_{j,d-1}}^2\right).$$

(66)

According to the CLT, the sum of independent noise on units ${U^{\prime }}_{j,i}$ in ${U^{\prime }}_j\in {ℝ}^d$ is evaluated by a Gaussian random variable as:

$${\delta }_j={\displaystyle {\sum }_{i=0}^{d-1}{\delta }_{j,i}=\frac{{\displaystyle {\sum }_{i=0}^{d-1}C\left({\Delta }_{j,i}\right)U_{j,i}}}{{\displaystyle {\sum }_{i=0}^{d-1}C\left(X_{j,i}\right)}}}\in \mathbb{N}\left(0,{\sigma }_{{\delta }_j}^2={\displaystyle {\sum }_{i=0}^{d-1}{\sigma }_{{\delta }_{j,i}}^2}\right).$$

(67)

The d-dimensional vector $U_j\in {ℝ}^d$ can be expressed as

$$U_j={U^{\prime }}_j-{\overrightarrow{\varsigma }}_j\in {ℝ}^d,$$

(68)

and the noise vector ${\overrightarrow{\varsigma }}_j=\left\{{\varsigma }_{j,0},\dots ,{\varsigma }_{j,d-1}\right\}\in {ℝ}^d$ is as follows:

$${\overrightarrow{\varsigma }}_j=\frac{{U^{\prime }}_j}{C\left(X_j\right)+C\left({\Delta }_j\right)}C\left({\Delta }_j\right)\in \mathbb{N}{\left(0,{\sigma }_{{\overrightarrow{\varsigma }}_j}^2\right)}_d.$$

(69)

The sum of independent noise on units ${U^{\prime }}_{j,i}$ of ${U^{\prime }}_j\in {ℝ}^d$ can also be identified as:

$${\varsigma }_j={\displaystyle {\sum }_{i=0}^{d-1}{\varsigma }_{j,i}}=\frac{{\displaystyle {\sum }_{i=0}^{d-1}C\left({\Delta }_{j,i}\right){U^{\prime }}_{j,i}}}{{\displaystyle {\sum }_{i=0}^{d-1}C\left({X^{\prime }}_{j,i}\right)}}=\mathbb{N}\left(0,{\sigma }_{{\varsigma }_j}^2={\displaystyle {\sum }_{i=0}^{d-1}{\sigma }_{{\varsigma }_{j,i}}^2}\right).$$

(70)

From the physical properties of a Gaussian quantum channel [1,2,3,4,5,6,7,8,9,10,11], we know exactly what happens during the transmission of the coherent combined signal from Alice to Bob. The noise on ${X^{\prime }}_{j,i}$ has a non-standard Gaussian random distribution ${\Delta }_{j,i}\in \mathbb{N}\left(0,{\sigma }_{{\mathcal{N}}_2}^2\right)$.

We have to analyze in detail the properties of the noise vector. The noise vector ${\Delta }_j\in \mathbb{N}{\left(0,{\sigma }_{{\mathcal{N}}_2}^2\right)}_d\in {ℝ}^d$ of ${\mathcal{N}}_2$ that generates the noisy ${X^{\prime }}_j$ from $X_j$ is characterized, as follows. First we decompose the noise vector ${\Delta }_j$ into its components:

$${\Delta }_j=A_j{\mathsf{\Lambda }}_j,$$

(71)

where matrix $A_j$ represents a linear transformation in ${ℝ}^d$, while ${\mathsf{\Lambda }}_j$ is a the standard Gaussian noise vector ${\mathsf{\Lambda }}_j\in \mathbb{N}{\left(0,1\right)}_d\in {ℝ}^d$. The probability density function of ${\mathsf{\Lambda }}_j$ is:

$$f\left({\mathsf{\Lambda }}_j\right)=\frac{1}{{\left(\sqrt{2\pi }\right)}^d}{e}^{-\frac{{\Vert {\mathsf{\Lambda }}_j\Vert }^2}{2}},$$

(72)

where $\Vert {\mathsf{\Lambda }}_j\Vert =\sqrt{{\mathsf{\Lambda }}_{j,0}^2+\dots +{\mathsf{\Lambda }}_{j,d-1}^2}$ is magnitude, in other words, the Euclidean distance from the origin to ${\mathsf{\Lambda }}_j\in {ℝ}^d$. This type of noise exhibits different behavior than the real Gaussian noise of a quantum channel, and it is characterized by the same magnitude $\Vert {\mathsf{\Lambda }}_j\Vert$ in every direction. This property is connected to the standard Gaussian random noise, and it cannot be applied in a realistic CVQKD scenario, because it does not properly describe the noise characteristic of the quantum channel. The probability density function of ${\Delta }_j\in {ℝ}^d$ is:

$$f\left({\Delta }_j\right)=\frac{1}{{\left(\sqrt{2\pi }\right)}^d\sqrt{\det A_j{A}_j^T}}{e}^{-\frac{1}{2}{\Delta }_j^T{\left(A_j{A}_j^T\right)}^{-1}{\Delta }_j},$$

(73)

where $A_j{A}_j^T$ stands for the $ℭ\left({\Delta }_j\right)$ covariance matrix of ${\Delta }_j$, and it analogous of ${\sigma }_{{\mathcal{N}}_2}^2$, i.e., in a more precise form $ℭ\left({\Delta }_j\right)=\mathbb{E}\left({\Delta }_j{\Delta }_j^T\right)=A_j{A}_j^T$. The noise on the units ${X^{\prime }}_{j,i}$ of ${X^{\prime }}_j$ at Bob’s side arises from the quantum-level transmission of the combined phase space states $|{\varphi }_{j,i}\rangle \in {\mathcal{S}}_{A\times B}$, and vectors ${\mathsf{\Lambda }}_j\in \mathbb{N}{\left(0,1\right)}_d$ and ${\Delta }_j\in \mathbb{N}{\left(0,{\sigma }_{{\mathcal{N}}_2}^2\right)}_d$ is built up by d components, ${\mathsf{\Lambda }}_{j,i}\in \mathbb{N}\left(0,1\right)\in ℝ$ and ${\Delta }_{j,i}\in \mathbb{N}\left(0,{\sigma }_{{\mathcal{N}}_2}^2\right)\in ℝ$. The error ${\Delta }_{j,i}$ on the i-th unit ${X^{\prime }}_{j,i}$ is as follows:

$${\Delta }_{j,i}=A_{j,i}{\mathsf{\Lambda }}_{j,i},\mathrm{for}i=0,i\le d-1,$$

(74)

where $A_{j,i}$ is a linear transformation that scales ${\mathsf{\Lambda }}_{j,i}$. The probability density function of ${\mathsf{\Lambda }}_{j,i}$ is:

$$f\left({\mathsf{\Lambda }}_{j,i}\right)=\frac{1}{\sqrt{2\pi }}{e}^{-\frac{{\Vert {\mathsf{\Lambda }}_{j,i}\Vert }^2}{2}},$$

(75)

where $\Vert {\mathsf{\Lambda }}_{j,i}\Vert =\sqrt{{\mathsf{\Lambda }}_{j,i}^2}$ is the magnitude of ${\mathsf{\Lambda }}_{j,i}$. The probability density function of ${\Delta }_{j,i}$ is:

$$f\left({\Delta }_{j,i}\right)=\frac{1}{\sqrt{2\pi }\sqrt{\det A_{j,i}{A}_{j,i}^T}}{e}^{-\frac{1}{2}{\Delta }_{j,i}^T{\left(A_{j,i}{A}_{j,i}^T\right)}^{-1}{\Delta }_{j,i}},$$

(76)

where $A_{j,i}{A}_{j,i}^T=\mathbb{E}\left({\Delta }_{j,i}{\Delta }_{j,i}^T\right)=ℭ\left({\Delta }_{j,i}\right).$

From ${\mathsf{\Lambda }}_{j,i}$ and ${\Delta }_{j,i}$, the correction of Bob’s noisy secret $U_j$ can be approached by the units $\left\{{U^{\prime }}_{j,0},\dots ,{U^{\prime }}_{j,d-1}\right\}$, because the noise of ${\mathcal{N}}_2$ is survived in the raw data level and lives also on ${U^{\prime }}_{j,i}$, but in a modified form, see (61).

Let us denote by $|{\varphi }_{j,i}\rangle$, the phase-space representation of Alice’s noise-free raw data unit $X_{j,i}$ given by (6), and by $|{\xi }_{j,i}\rangle$ the noisy raw data unit ${X^{\prime }}_{j,i}$ of Bob, from (7). (State $|{\varphi }_{j,i}\rangle$ is the second mode of the combined beam, while $|{\xi }_{j,i}\rangle$ is its noisy version).

The effect of the real Gaussian noise of the quantum channel is shown in Figure 4. The noise vector ${\Delta }_j\in \mathbb{N}{\left(0,{\sigma }_{{\mathcal{N}}_2}^2\right)}_d\in {\mathcal{S}}_{A\times B}$ of the quantum channel is a non-standard Gaussian random vector, which distorts the density. The circles of ${\mathsf{\Lambda }}_{j,i}\in \mathbb{N}\left(0,1\right)$ are scaled by $A_{j,i}$, resulting in ellipses. The magnitude $\Vert {\Delta }_{j,i}\Vert$ of ${\Delta }_{j,i}$ is not preserved in all directions, which leads to a different density. The x and p quadratures of $|{\varphi }_{j,i}\rangle \in {\mathcal{S}}_{A\times B}$ are modified by ${\Delta }_x$ and ${\Delta }_p$ in $|{\xi }_{j,i}\rangle \in {\mathcal{S}}_{A\times B}$.

4. Theorems and Proofs

First, we show that Alice’s noisy secret can be corrected in the $v$ vector space of ${ℝ}^d$ by using an error-correction rule based on the apparatus provided by the maximum-likelihood decision [15,16,17,18,19,24,25], which renders unnecessary the use of the spherical space of ${\Gamma }^{d-1}$.

Proposition 1 (Vector reconciliation of correlated Gaussian variables).

The Gaussian noise ${\delta }_j$ on the received vector ${U^{\prime }}_j\in {ℝ}^d:\left\{{U^{\prime }}_{j,0},\dots ,{U^{\prime }}_{j,d-1}\right\}$ can be corrected in the vector space $v$ of ${ℝ}^d$.

Proof. 

First, Bob selects the d-dimensional vector $U_j\in \left\{U_{j,0},\dots ,U_{j,d-1}\right\}\in {ℝ}^d$ where ${\displaystyle {\sum }_{i=0}^{d-1}{U}_{j,i}}=a$ or ${\displaystyle {\sum }_{i=0}^{d-1}{U}_{j,i}}=b$, $U_{j,i}\in \mathcal{U}$ and sends $C\left({X^{\prime }}_j\right)U_j$ over the classical channel. Alice uses her CDF-transformed raw data $C\left(X_j\right)=\left\{C\left(X_{j,0}\right),\dots ,C\left(X_{j,d-1}\right)\right\}$ to obtain ${U^{\prime }}_j\in {ℝ}^d$. Since Alice knows $a$, $b$ and d, she can draw two vectors $A={\left(A_0,\dots ,A_{d-1}\right)}^T\in {ℝ}^d,$ with norm $\Vert A\Vert =\sqrt{{\displaystyle {\sum }_{i=0}^{d-1}{\left(A_i\right)}^2}}$, where $\left\{{\displaystyle {\sum }_{i=0}^{d-1}{A}_i}=a\right\}$, $A_i\in \mathcal{U}$ and $B={\left(B_0,\dots ,B_{d-1}\right)}^T\in {ℝ}^d,$ with $\Vert B\Vert =\sqrt{{\displaystyle {\sum }_{i=0}^{d-1}{\left(B_i\right)}^2}}$, where $\left\{{\displaystyle {\sum }_{i=0}^{d-1}{B}_i}=b\right\}$, $B_i\in \mathcal{U}$. She then corrects the noise on ${U^{\prime }}_j$ by the following error-correction rule [15,16,17,18,19]:

$$U_j=A:\Vert {U^{\prime }}_j-A\Vert <\Vert {U^{\prime }}_j-B\Vert ,$$

(77)

$$U_j=B:\Vert {U^{\prime }}_j-A\Vert >\Vert {U^{\prime }}_j-B\Vert ,$$

(78)

where the quantity $\Vert {U^{\prime }}_j-U_j\Vert$, $U_j\in \left\{A,B\right\}$ is evaluated as

$$\begin{array}{ll}\Vert {U^{\prime }}_j-U_j\Vert & =\sqrt{{\displaystyle {\sum }_{i=0}^{d-1}{\left({U^{\prime }}_{j,i}-U_{j,i}\right)}^2}}=\sqrt{{\displaystyle {\sum }_{i=0}^{d-1}{\left(\frac{U_{j,i}}{C\left(X_{j,i}\right)}C\left({\Delta }_{i,j}\right)\right)}^2}}\\ & =\sqrt{{\displaystyle {\sum }_{i=0}^{d-1}{\left({\delta }_{j,i}\right)}^2}}=\Vert {\overrightarrow{\delta }}_j\Vert ,\end{array}$$

(79)

which precisely coincidences with the norm of the Gaussian noise in (67). However, since Alice does not know Bob’s $U_{j,i}$, in (79) an additional noise, ${\mathsf{\Upsilon }}_j$, also brings up, i.e., $\Vert {U^{\prime }}_j-U_j\Vert =\Vert {\delta }_j+{\mathsf{\Upsilon }}_j\Vert$. The noise vector ${\overrightarrow{\mathsf{\Upsilon }}}_j$ with expected variance ${\sigma }_{{\overrightarrow{\mathsf{\Upsilon }}}_j}^2$ is independent from the real noise on ${U^{\prime }}_{j,i}$. This problem will be resolved in Theorem 1 and will be shown that this quantity completely vanishes from the picture.

Alice receives the d-dimensional vectors ${U^{\prime }}_j\in \left\{{U^{\prime }}_{j,0},\dots ,{U^{\prime }}_{j,d-1}\right\}\in {ℝ}^d$, and corrects ${U^{\prime }}_j$ into $U_j$ and then from the components she rebuilds the full key $K={\left(U_0,\dots ,U_{\left(N/d\right)-1}\right)}^T\in {ℝ}^{N/d}$. The error-vector ${\overrightarrow{\delta }}_j\in {ℝ}^d$ on a given noisy ${U^{\prime }}_j$ is

$$\begin{array}{ll}{\overrightarrow{\delta }}_j& ={\delta }_{j,i}={\left(\frac{U_j}{C\left(X_j\right)}\right)}^{T}C\left({\Delta }_j\right)\in \mathbb{N}{\left(0,{\sigma }_{{\overrightarrow{\delta }}_j}^2=ℭ\left({\left(\frac{U_j}{C\left(X_j\right)}\right)}^{T}C\left({\Delta }_j\right)\right)\right)}_d\\ & =\mathbb{N}\left(0,{\sigma }_{{\delta }_{j,i}}^2=ℭ\left({\left(\frac{U_{j,i}}{C\left(X_{j,i}\right)}\right)}^{T}C\left({\Delta }_{j,i}\right)\right)\right)\in {ℝ}^d,0\le i\le d-1,\end{array}$$

(80)

The covariance matrix of (80) is expressed as:

$$ℭ\left({\left(\frac{U_j}{C\left(X_j\right)}\right)}^{T}C\left({\Delta }_j\right)\right)=\mathbb{E}\left({\left(\frac{U_j}{C\left(X_j\right)}\right)}^{T}C\left({\Delta }_j\right){\left({\left(\frac{U_j}{C\left(X_j\right)}\right)}^{T}C\left({\Delta }_j\right)\right)}^T\right)={\left({\sigma }_{{\overrightarrow{\delta }}_j}^2\right)}_d$$

(81)

along with

$${\delta }_{j,i}={\left(\frac{U_{j,i}}{C\left(X_{j,i}\right)}\right)}^{T}C\left({\Delta }_{j,i}\right)\in \mathbb{N}\left(0,{\sigma }_{{\delta }_{j,i}}^2=ℭ\left({\left(\frac{U_{j,i}}{C\left(X_{j,i}\right)}\right)}^{T}C\left({\Delta }_{j,i}\right)\right)\right)\in ℝ,$$

(82)

and (82) is characterized by covariance matrix

$$ℭ\left(\frac{U_{j,i}}{C\left(X_{j,i}\right)}C\left({\Delta }_{j,i}\right)\right)=\mathbb{E}\left(\frac{U_{j,i}}{C\left(X_{j,i}\right)}C\left({\Delta }_{j,i}\right){\left(\frac{U_{j,i}}{C\left(X_{j,i}\right)}C\left({\Delta }_{j,i}\right)\right)}^T\right)={\sigma }_{{\delta }_{j,i}}^2.$$

(83)

The error-corrected $U_j$ can be expressed as:

$$U_j={U^{\prime }}_j-{\overrightarrow{\varsigma }}_j\in {ℝ}^d,$$

(84)

where

$$\begin{array}{ll}{\overrightarrow{\varsigma }}_j& ={\left(\frac{{U^{\prime }}_j}{C\left(X_j\right)+C\left({\Delta }_j\right)}\right)}^{T}C\left({\Delta }_j\right)\in \mathbb{N}{\left(0,{\sigma }_{{\overrightarrow{\varsigma }}_j}^2=ℭ\left({\left(\frac{{U^{\prime }}_j}{C\left(X_j\right)+C\left({\Delta }_j\right)}\right)}^{T}C\left({\Delta }_j\right)\right)\right)}_d\\ & =\mathbb{N}\left(0,{\sigma }_{{\varsigma }_j}^2=ℭ\left(\frac{{U^{\prime }}_{j,i}}{C\left(X_{j,i}\right)+C\left({\Delta }_{j,i}\right)}C\left({\Delta }_{j,i}\right)\right)\right)\in {ℝ}^d,0\le i\le d-1.\end{array}$$

(85)

The covariance matrix of (85) is as follows:

$$ℭ\left({\left(\frac{{U^{\prime }}_j}{C\left(X_j\right)+C\left({\Delta }_j\right)}\right)}^{T}C\left({\Delta }_j\right)\right)=\mathbb{E}\left({\left(\frac{{U^{\prime }}_j}{C\left(X_j\right)+C\left({\Delta }_j\right)}\right)}^{T}C\left({\Delta }_j\right){\left({\left(\frac{{U^{\prime }}_j}{C\left(X_j\right)+C\left({\Delta }_j\right)}\right)}^{T}C\left({\Delta }_j\right)\right)}^T\right)={\left({\sigma }_{{\overrightarrow{\varsigma }}_j}^2\right)}_d$$

(86)

and

$${\varsigma }_{j,i}=\frac{{U^{\prime }}_{j,i}}{C\left(X_{j,i}\right)+C\left({\Delta }_{j,i}\right)}C\left({\Delta }_{j,i}\right)\in \mathbb{N}\left(0,{\sigma }_{{\varsigma }_{j,i}}^2=ℭ\left(\frac{{U^{\prime }}_{j,i}}{C\left(X_{j,i}\right)+C\left({\Delta }_{j,i}\right)}C\left({\Delta }_{j,i}\right)\right)\right),$$

(87)

along with

$$ℭ\left(\frac{{U^{\prime }}_{j,i}}{C\left(X_{j,i}\right)+C\left({\Delta }_{j,i}\right)}C\left({\Delta }_{j,i}\right)\right)=\mathbb{E}\left(\frac{{U^{\prime }}_{j,i}}{C\left(X_{j,i}\right)+C\left({\Delta }_{j,i}\right)}C\left({\Delta }_{j,i}\right){\left(\frac{{U^{\prime }}_{j,i}}{C\left(X_{j,i}\right)+C\left({\Delta }_{j,i}\right)}C\left({\Delta }_{j,i}\right)\right)}^T\right)={\sigma }_{{\varsigma }_{j,i}}^2.$$

(88)

From (82) and (87) the quantities $U_{j,i}$ and ${U^{\prime }}_{j,i}$ are evaluated as follows:

$$U_{j,i}={U^{\prime }}_{j,i}-\frac{{U^{\prime }}_{j,i}}{C\left({X^{\prime }}_{j,i}\right)}C\left({\Delta }_{j,i}\right)={U^{\prime }}_{j,i}-{\varsigma }_{j,i}\in ℝ,$$

(89)

and

$${U^{\prime }}_{j,i}=\frac{C\left({X^{\prime }}_{j,i}\right)}{C\left(X_{j,i}\right)}{U}_{j,i}=U_{j,i}+{\delta }_{j,i}\in ℝ.$$

(90)

Let us denote by $\nu$ the standard deviation of ${\overrightarrow{\delta }}_j+{\overrightarrow{\mathsf{\Upsilon }}}_j={\delta }_{j,i}+{\mathsf{\Upsilon }}_{j,i},0\le i\le d-1,$ which is evaluated from (86) and ${\sigma }_{{\overrightarrow{\mathsf{\Upsilon }}}_j}^2$ as

$$\nu =\sqrt{{\left({\sigma }_{{\overrightarrow{\delta }}_j}^2+{\sigma }_{{\overrightarrow{\mathsf{\Upsilon }}}_j}^2\right)}_d}.$$

(91)

The maximum-likelihood-based correction rules can be given in the form of:

$$U_j=A:\frac{1}{{\left(\pi 2{\nu }^2\right)}^{d/2}}{e}^{-\frac{{\Vert {U^{\prime }}_j-A\Vert }^2}{2{\nu }^2}}\ge \frac{1}{{\left(\pi 2{\nu }^2\right)}^{d/2}}{e}^{-\frac{{\Vert {U^{\prime }}_j-B\Vert }^2}{2{\nu }^2}},$$

(92)

and:

$$U_j=B:\frac{1}{{\left(\pi 2{\nu }^2\right)}^{d/2}}{e}^{-\frac{{\Vert {U^{\prime }}_j-A\Vert }^2}{2{\nu }^2}}\le \frac{1}{{\left(\pi 2{\nu }^2\right)}^{d/2}}{e}^{-\frac{{\Vert {U^{\prime }}_j-B\Vert }^2}{2{\nu }^2}}.$$

(93)

The error probability for the case of decoding vector $U_j=A$, is

$${\mathrm{Pr}}_e\left({\Vert {\overrightarrow{\delta }}_j+{\overrightarrow{\mathsf{\Upsilon }}}_j\Vert }^2>{\Vert \left(A+{\overrightarrow{\delta }}_j+{\overrightarrow{\mathsf{\Upsilon }}}_j\right)-B\Vert }^2\right)={\mathrm{Pr}}_e\left({\left(A-B\right)}^T\left({\overrightarrow{\delta }}_j+{\overrightarrow{\mathsf{\Upsilon }}}_j\right)<-\frac{{\Vert A-B\Vert }^2}{2}\right).$$

(94)

For the case of correction of $U_j=B$, the error probabilities are evaluated as

$${\mathrm{Pr}}_e\left({\Vert {\overrightarrow{\delta }}_j+{\overrightarrow{\mathsf{\Upsilon }}}_j\Vert }^2>{\Vert \left(B+{\overrightarrow{\delta }}_j+{\overrightarrow{\mathsf{\Upsilon }}}_j\right)-A\Vert }^2\right)={\mathrm{Pr}}_e\left({\left(B-A\right)}^T\left({\overrightarrow{\delta }}_j+{\overrightarrow{\mathsf{\Upsilon }}}_j\right)<-\frac{{\Vert B-A\Vert }^2}{2}\right).$$

(95)

The decision regions can be separated into two hyperplanes ${\mathscr{H}}_1$ and ${\mathscr{H}}_2$ along $B-A$, which separate $U_j=A$ and $U_j=B$. In other words, the correction-condition of a given noisy ${U^{\prime }}_j$ is reduced to the following decision problem:

$$U_j=\{\begin{array}{c}A,if{U^{\prime }}_j\in {\mathscr{H}}_1,\\ B,if{U^{\prime }}_j\in {\mathscr{H}}_2.\end{array}$$

(96)

As follows, by applying the procedure Alice can retrieve $U_j\in \left\{A,B\right\}$ from the noisy $U_j$ in the vector space $v$ of ${ℝ}^d$. From the error-corrected $U_j$ components, Alice finally rebuilds the full key vector $K={\left(U_0,\dots ,U_{\left(N/d\right)-1}\right)}^T\in {ℝ}^{N/d}$, which concludes the proof. ☐

Proposition 1 demonstrated that there is no need for the use of ${\Gamma }^{d-1}$ of ${ℝ}^d$ in the error correction, however the corrected noise is not precisely a Gaussian. Theorem 1 reveals that the reconciliation process, in fact, does not require vector operations in ${ℝ}^d$, and the noise is a real Gaussian noise in the scalar space $ℝ$.

Theorem 1 (Scalar reconciliation of correlated Gaussian variables).

The Gaussian noise ${\delta }_j$ on the received scalar ${U^{\prime }}_j={\displaystyle {\sum }_{i=0}^{d-1}{U^{\prime }}_{j,i}}$ can be corrected in $ℝ$.

Proof. 

We exploit that the noise on ${U^{\prime }}_{j,i}$-s is ${\delta }_{j,i}=\frac{U_{j,i}}{C\left(X_{j,i}\right)}C\left({\Delta }_{j,i}\right)\in \mathbb{N}\left(0,{\sigma }_{{\delta }_{j,i}}^2\right)$, while on the sum of the noise of the d units is a zero-mean Gaussian random variable ${\displaystyle {\sum }_{i=0}^{d-1}{\delta }_{j,i}}\in \mathbb{N}\left(0,{\sigma }_{{\delta }_j}^2\right)$, that is justified by the CLT and the Lyapunov-condition. Alice will correct the units in the following form:

$${U^{\prime }}_j={\displaystyle {\sum }_{i=0}^{d-1}{U^{\prime }}_{j,i}}=\frac{{\displaystyle {\sum }_{i=0}^{d-1}C\left({X^{\prime }}_{j,i}\right)U_{j,i}}}{{\displaystyle {\sum }_{i=0}^{d-1}C\left(X_{j,i}\right)}}=U_j+{\delta }_j\in ℝ.$$

(97)

First, expresses the secret vector $U_j\in {ℝ}^d$ as follows:

$$U_j=x\left(A-B\right)+\frac{1}{2}\left(A+B\right),$$

(98)

where $x\in \left\{-0.5,0.5\right\}\in ℝ$ is a scalar. From this, Alice can also rewrite the noisy ${U^{\prime }}_j$ as:

$${U^{\prime }}_j=x\left(A-B\right)+\frac{1}{2}\left(A+B\right)+{\overrightarrow{\delta }}_j.$$

(99)

From (99), follows that:

$$\begin{array}{ll}{U^{\prime }}_j& ={\sum }_{i=0}^{d-1}\left(x\right(A_i-B_i)+\frac{1}{2}(A_i+B_i)+{\delta }_{j,i})\\ & ={\sum }_{i=0}^{d-1}\left(x\right(A_i-B_i)+\frac{1}{2}(A_i+B_i\left)\right)+{\delta }_j\\ & ={\sum }_{i=0}^{d-1}{U^{\prime }}_{j,i}\\ & =U_j+\frac{U_j}{C\left(X_i\right)}C\left({\Delta }_j\right),\end{array}$$

(100)

where $C\left(X_j\right)={\displaystyle {\sum }_{i=0}^{d-1}C\left(X_{j,i}\right)},$ $C\left({\Delta }_j\right)={\displaystyle {\sum }_{i=0}^{d-1}C\left({\Delta }_{j,i}\right)}$, $U_j={\displaystyle {\sum }_{i=0}^{d-1}{U}_{j,i}}$ and ${\delta }_j={\displaystyle {\sum }_{i=0}^{d-1}{\delta }_{j,i}}$. In fact, Alice does not have to use all elements from (100), because she can apply a simpler process. For this purpose, she draws a new vector, $d$:

$$d=\frac{A-B}{\Vert A-B\Vert },$$

(101)

where $\Vert A-B\Vert =\sqrt{{\displaystyle {\sum }_{i=0}^{d-1}{\left(A_i-B_i\right)}^2}}$ is the effective distance of $A$ and $B$. A useful property of vector $d$ drawn in (101), that any independent noise [15] (i.e., independent from the noise on ${U^{\prime }}_j$) could live only in the orthogonal directions to $d$, i.e., $\left(n_1,\dots ,n_l\right)\perp d$. It immediately follows, that the $n_1,\dots ,n_l$ orthogonal directions will have no further importance for Alice in the decoding [15,16,17,18,19]. Since $x$ is a scalar and in (99) the term $\frac{1}{2}\left(A+B\right)$ is a constant, Alice introduces vector $\chi \in v$ as follows:

$$\chi \equiv {U^{\prime }}_j-\frac{1}{2}\left(A+B\right)=x\left(A-B\right)+{\overrightarrow{\delta }}_j.$$

(102)

She also draws an orthogonal matrix $M$, which contains $d$ and the orthogonal directions $n_1,\dots ,n_l$, with unit norm as:

$$M=\left(\begin{array}{c}d\\ n_1\\ n_2\\ ⋮\\ n_l\end{array}\right).$$

(103)

By multiplying $M$ with $\chi$ leads to:

$$M\chi =\left(\begin{array}{c}x\Vert A-B\Vert \\ 0\\ 0\\ ⋮\\ 0\end{array}\right)+M{\overrightarrow{\delta }}_j.$$

(104)

From (104), it clearly follows that only $x\Vert A-B\Vert$ and the first component of $M{\overrightarrow{\delta }}_j$ have relevance in the error-correction process, because all of the other components are orthogonal to $d$ [15]. Since the evolution of $d$ is a trivial process on Alice’s side, the received ${U^{\prime }}_j$ can be projected by $\mathcal{P}$ onto the direction of $d$, since all of the valuable information, including the real noise, is carried only by this direction. The projection $\mathcal{P}$ on ${U^{\prime }}_j$ is made by $d^T\chi$, which then results in:

$$\begin{array}{ll}\mathcal{P}\left({U^{\prime }}_j\right)& =d^T\chi \\ & ={\left(\frac{A-B}{\Vert A-B\Vert }\right)}^T(x\left(A-B\right)+{\overrightarrow{\delta }}_j)\\ & =d^T\left({U^{\prime }}_j-\frac{1}{2}\left(A+B\right)\right).\end{array}$$

(105)

The projected vector $\mathcal{P}\left({U^{\prime }}_j\right)$ is analogous to the scalar representation $U_j={\displaystyle {\sum }_{i=0}^{d-1}{U}_{j,i}}$ in $ℝ$, and makes it possible to correct the noise in the scalar space $ℝ$. The received ${U^{\prime }}_j=U_j+{\delta }_j$ has mean ${\mu }_a=a$ or ${\mu }_b=b$, and the decision boundary is $\frac{{\mu }_a+{\mu }_b}{2}$, which defines a separator in $ℝ$. According to the previously obtained calculations, (104) can be rewritten as follows:

$$M\chi =\left(\begin{array}{c}x\sqrt{{\displaystyle {\sum }_{i=0}^{d-1}{\left(A_i-B_i\right)}^2}}\\ 0\\ 0\\ ⋮\\ 0\end{array}\right)+{\delta }_j.$$

(106)

As follows, only the first component of $M{\overrightarrow{\delta }}_j$ has relevance in the error-correction, which in particular coincidences with the scalar quantity ${\delta }_j={\displaystyle {\sum }_{i=0}^{d-1}{\delta }_{j,i}}=\frac{{\displaystyle {\sum }_{i=0}^{d-1}C\left({\Delta }_{j,i}\right)U_{j,i}}}{{\displaystyle {\sum }_{i=0}^{d-1}C\left(X_{j,i}\right)}}$ shown in (79). Putting the pieces together, $\mathcal{P}\left({U^{\prime }}_j\right)$ is evaluated as:

$$\mathcal{P}\left({U^{\prime }}_j\right)=x\sqrt{{\displaystyle {\sum }_{i=0}^{d-1}{\left(A_i-B_i\right)}^2}}+{\displaystyle {\sum }_{i=0}^{d-1}{\delta }_{j,i}}$$

(107)

which contains all of the sufficient information for the error correction in $ℝ$, which completes the proof. ☐

In Theorem 2, the error probability of scalar reconciliation is proposed in an exact form.

Theorem 2.

The error probability $\mathrm{Pr}\left(error\right)=Q\left(\frac{\left|a-b\right|}{2}\frac{1}{\eta }\right)$ of scalar reconciliation depends only on $\left|a-b\right|$, where $Q\left(\frac{\left|a-b\right|}{2}\frac{1}{\eta }\right)=\mathrm{Pr}\left(\frac{\left|a-b\right|}{2}\frac{1}{\eta }<g\right)$ is the Q-function (tail function), g is a standard Gaussian random variable $g\in \mathbb{N}\left(0,1\right)$ , and $\eta =\sqrt{{\sigma }_{{\delta }_j}^2}=\sqrt{{\displaystyle {\sum }_{i=0}^{d-1}{\sigma }_{{\delta }_{j,i}}^2}}$ is the standard deviation of the Gaussian noise ${\delta }_j$ . The $\mathrm{Pr}\left(error\right)$ exponentially converges to zero for any $\left|a-b\right|>2\eta$.

Proof. 

Let $U_j={\displaystyle {\sum }_{i=0}^{d-1}{U}_{j,i}}$ from (100), $C\left(X_j\right)={\displaystyle {\sum }_{i=0}^{d-1}C\left(X_{j,i}\right)}$ and $C\left({\Delta }_j\right)={\displaystyle {\sum }_{i=0}^{d-1}C\left({\Delta }_{j,i}\right)}$. Exploiting the result of Theorem 1, in the scalar reconciliation process Alice decides on the scalar quantity ${U^{\prime }}_j=a$, if:

$$\mathrm{Pr}\left(U_j=a|{U^{\prime }}_j\right)\ge \mathrm{Pr}\left(U_j=b|{U^{\prime }}_j\right).$$

(108)

Similarly, she decides on ${U^{\prime }}_j=b$, if:

$$\mathrm{Pr}\left(U_j=b|{U^{\prime }}_j\right)\ge \mathrm{Pr}\left(U_j=a|{U^{\prime }}_j\right).$$

(109)

Conditioned on $a$ or $b$, the received ${U^{\prime }}_j$ has mean ${\mu }_a=a$ or ${\mu }_b=b$, with $\mathbb{N}\left({\mu }_a,{\eta }^2\right)$ and $\mathbb{N}\left({\mu }_b,{\eta }^2\right)$. Applying the maximum-likelihood-based correction rule [15,16,17,18,19], Alice calculates with the following inequalities:

$$\frac{1}{\sqrt{2\pi {\eta }^2}}{e}^{\left(-\frac{{\left({U^{\prime }}_j-a\right)}^2}{2{\eta }^2}\right)}\ge \frac{1}{\sqrt{2\pi {\eta }^2}}{e}^{\left(-\frac{{\left({U^{\prime }}_j-b\right)}^2}{2{\eta }^2}\right)}$$

(110)

and:

$$\frac{1}{\sqrt{2\pi {\eta }^2}}{e}^{\left(-\frac{{\left({U^{\prime }}_j-b\right)}^2}{2{\eta }^2}\right)}\ge \frac{1}{\sqrt{2\pi {\eta }^2}}{e}^{\left(-\frac{{\left({U^{\prime }}_j-a\right)}^2}{2{\eta }^2}\right)},$$

(111)

which then leads to (for a comparison see (77) and (78)):

$$\left|{U^{\prime }}_j-a\right|<\left|{U^{\prime }}_j-b\right|$$

(112)

and:

$$\left|{U^{\prime }}_j-a\right|>\left|{U^{\prime }}_j-b\right|.$$

(113)

The received ${U^{\prime }}_j$ has mean ${\mu }_a=a$ or ${\mu }_b=b$, hence one obtains the following conditional probability for an error event, conditioned on Bob has sent $U_j=a$:

$$\mathrm{Pr}\left({U^{\prime }}_j=\frac{U_j}{C\left(X_j\right)}C\left({\Delta }_j\right)<\frac{{\mu }_a+{\mu }_b}{2}|U_j=a\right)=\mathrm{Pr}\left(\left({U^{\prime }}_j-U_j\right)>\frac{\left|{\mu }_a-{\mu }_b\right|}{2}\right),$$

(114)

where $\frac{\left|{\mu }_a-{\mu }_b\right|}{2}$ assigns a decision boundary. The tail function $Q\left(\frac{\left|a-b\right|}{2}\frac{1}{\eta }\right)=\mathrm{Pr}\left(\frac{\left|a-b\right|}{2}\frac{1}{\eta }<g\right)$, where $g\in \mathbb{N}\left(0,1\right)$, has exponential decay for any $\left|a-b\right|>2\eta$, hence:

$$\frac{1}{\sqrt{2\pi }\left(\frac{\left|a-b\right|}{2}\frac{1}{\eta }\right)}\left(1-\frac{1}{{\left(\frac{\left|a-b\right|}{2}\frac{1}{\eta }\right)}^2}\right)e^{-\frac{{\left(\frac{\left|a-b\right|}{2}\frac{1}{\eta }\right)}^2}{2}}<Q\left(\frac{\left|a-b\right|}{2}\frac{1}{\eta }\right)<e^{-\frac{{\left(\frac{\left|a-b\right|}{2}\frac{1}{\eta }\right)}^2}{2}},$$

(115)

which clearly demonstrates that the error probability of scalar reconciliation exponentially converges to zero. As one can readily obtain from (115), for arbitrary large differences between a and b, $Q\left(\frac{\left|a-b\right|}{2}\frac{1}{\eta }\right)\to 0$ [15,16,17]. Then, by applying the maximum-likelihood decision theory and the Bayes’ rule [15,16,17,18,19], for a given $U_j$, one obtains error probability via the tail function:

$$\begin{array}{ll}\mathrm{Pr}\left({U^{\prime }}_j<\frac{{\mu }_a+{\mu }_b}{2}|U_j=a\right)& =Q\left(\frac{\left|a-b\right|}{2}\frac{1}{\eta }\right)\\ & =\mathrm{Pr}\left(\frac{\left|a-b\right|}{2}\frac{1}{\eta }<g\right)\\ & =\mathrm{Pr}\left(error\right),\end{array}$$

(116)

where $g\in \mathbb{N}\left(0,1\right)$ is a standard Gaussian random variable such that $Q\left(x\right)=\mathrm{Pr}\left(x<g\right)$, which clearly demonstrates that $\mathrm{Pr}\left(error\right)$ depends only on the distance $\left|a-b\right|$ of a and b.

The exponential decay of $\mathrm{Pr}\left(error\right)$ is depicted in Figure 5.

The condition $\left|a-b\right|>2\eta$ can be trivially satisfied by the parties in any practical CVQKD scenario; the proposed results complete the proof.  ☐

5. Numerical Evidence and Noise Model

5.1. Reconciliation Characteristics

In this section, we analyze the performance of the proposed reconciliation for Gaussian modulation, in terms of secret key rates (bits/pulse) and distances. The excess noise $\mathfrak{N}$ of the Gaussian quantum channel is expressed as

$$\mathfrak{N}=\left({\sigma }_{{\omega }_E}^2-1\right)\left(1-T\right)T^{-1},$$

(117)

where $T$ is the transmission, and ${\sigma }_{{\omega }_E}^2$ is Eve’s modulation variance [1]. Assuming reconciliation efficiency $0\le \beta \le 1$, the key rate can be rewritten as

$$R=\beta I\left(A:B\right)-\chi \left(B:E\right),$$

(118)

where $I\left(A:B\right)$ is the mutual information between Alice and Bob, while $\chi \left(B:E\right)$ is the Holevo information between Bob and Eve, respectively, with relation

$$\chi \left(B:E\right)<\chi \left(A:E\right),$$

(119)

where $\chi \left(A:E\right)$ is the Holevo information between Alice and Eve at a direct reconciliation [1,2,3,4,5,6,7,8,9,10,11,12,13]. At a given SNR, the mutual information of Alice and Bob is [1,2,3,4,5,6,7,8]

$$\chi \left(A:B\right)\ge 1/2{\log }_2\left(1+\mathrm{SNR}\right),$$

(120)

where

$$\mathrm{SNR}={\sigma }_{\varphi }^2/{\sigma }_{{\mathcal{N}}_2}^2,$$

(121)

where ${\sigma }_{\varphi }^2$ is the transmit signal’s variance, ${\sigma }_{{\mathcal{N}}_2}^2$ is the variance of ${\mathcal{N}}_2$, which has parameters that can be calculated from T and $\mathfrak{N}$. In Figure 6a the $d{\sigma }_{{\delta }_j}^2$ quantities of the converted logical binary Gaussian channel for various dimensions are shown. As depicted by the red line, the Lyapunov-condition can be exploited to get variance

$$\underset{N/d\to \infty }{\lim }d\mathrm{var}\left[{\delta }_{0\dots N/d}\right]=\mathrm{var}\left[{\delta }_{0\dots N/d}\right]\approx {\left({\sigma }_{{\mathcal{N}}_2}^2\right)}_d$$

(122)

for arbitrary d to maximize the SNR value,

$$\mathrm{SNR}={\sigma }_X^2/{\sigma }_{{\delta }_j}^2$$

(123)

of the converted logical channel. As depicted in Figure 6b, for $d\to \infty$, the efficiency converges to one, $\beta \to 1$, because the noise perfectly converges to a zero-mean Gaussian random variable.

The numerical analysis uses a two-way CVQKD protocol, with homodyne measurements. The parameters are as follows. Excess noise $\mathfrak{N}=0.015$, $T=0.8$, variance ${\sigma }_X^2=1.06$, channel correlation $n_C=0.5$, which parameter describes the correlation of the Gaussian attacks of Eve in the range of $0\le n_C\le 1$ [7,8]. (Note: If $n_C=0$, there is no correlation between her attacks of ${\mathcal{N}}_1$ and ${\mathcal{N}}_2$ [7,8]).

In Figure 7 the SNR of the logical binary Gaussian are depicted for various dimensions.

The performance of scalar reconciliation is summarized in Figure 8. The performance of the simulated protocol without scalar reconciliation with reconciliation efficiency $\beta =0.9$, is depicted by the blue curve [7,8]. At $d=16$, improved the reconciliation efficiency to $\beta =0.97$, which resulted in significantly higher transmission distances and secret key rates.

The scalar reconciliation applied on the two-way CVQKD protocol resulted in approximately 160 km of achievable transmission distance (for the computations of the secret key rate, and the detection parameters, see the derivations of [1,7,8]). The results indicate that the range of the current two-way CVQKD without our post-processing technique can be significantly extended, and the maximal 80.5 km range of the current one-way CVQKD systems [12] can be doubled, and almost tripled compared with existing two-way CVQKD systems [7,8]. The reason behind the phenomenon is the possibility of the conversion of the Gaussian quantum channel to a logical binary Gaussian channel, similar to the multidimensional reconciliation approaches developed for one-way CVQKD.

The favorable properties of the multidimensional solutions are preserved here, however the proposed scalar reconciliation does not require any multidimensional spherical calculations [9,10,11] and can be extended to arbitrary high dimensions thanks to the fact that it completely eliminates the spherical operations. From the use of higher dimensions, a more precise approximation of the logical binary Gaussian channel has also become available which resulted in significantly higher reconciliation efficiency in comparison to current two-way CVQKD reconciliation methods.

The proposed scalar reconciliation is available at low SNRs, and the transmission ranges of experimental long-distance CVQKD can significantly be improved because at low SNRs the capacity of the logical binary Gaussian channel coincidences with the capacity of the Gaussian quantum channel, and the logical channel resulted from the conversion can approximate it with arbitrary-high precision.

5.2. Noise Analysis

5.2.1. Noise on the Raw Data

The following example demonstrates the change of behavior of the probability distribution of raw data units and the CDF-transformed units, and serves only demonstration purposes.

For an illustrative example, let $N=1000$ units, the amount of sample raw data units $X_{j,i}$, ${X^{\prime }}_{j,i}$ (the units are resulted from random quadrature measurements) taken from Alice’s and Bob’s raw data, respectively. The Gaussian random units $X_{j,i}$ are characterized with zero mean and variance ${\sigma }_X^2=100$.

In Figure 9a, the distribution of the $X_{j,i}$ Gaussian random raw data units is shown. Figure 9b depicts the result of the $C(\cdot )$ Gaussian CDF function applied on $X_{j,i}$. The Gaussian random behavior is eliminated and is changed into uniform.

The distribution of the Gaussian noise vector ${\Delta }_{j,i}\in \mathbb{N}\left(0,{\sigma }_{{\mathcal{N}}_2}^2\right)$ of the quantum channel ${\mathcal{N}}_2$, at ${\sigma }_{{\mathcal{N}}_2}^2=4$ is shown in Figure 10.

At Bob’s side, the received noisy units ${X^{\prime }}_{j,i}$ and the CDF-transformed $C\left({X^{\prime }}_{j,i}\right)$ units have a modified distribution with variance ${\sigma }_{X^{\prime }}^2={\sigma }_X^2+{\sigma }_{{\mathcal{N}}_2}^2=104$, as depicted in Figure 11. The Gaussian noise on the units is added by ${\Delta }_{j,i}\in \mathbb{N}\left(0,{\sigma }_{{\mathcal{N}}_2}^2\right)$.

This example showed that the uniform distribution of the Gaussian random raw data could be achieved by trivial operations, without any multidimensional calculations or coding.

5.2.2. Noise on the Random Secret

This example demonstrates that the noise ${\delta }_j=\frac{{\displaystyle {\sum }_{i=0}^{d-1}C\left({\Delta }_{j,i}\right)U_{j,i}}}{{\displaystyle {\sum }_{i=0}^{d-1}C\left(X_{j,i}\right)}}$ on the secret ${U^{\prime }}_j={\displaystyle {\sum }_{i=0}^{d-1}{U^{\prime }}_{j,i}}$ is inherited from the Gaussian quantum channel and by applying the Central Limit Theorem (CLT), the noise of the logical binary channel can be approximated by a Gaussian random variable ${\delta }_j={\displaystyle {\sum }_{i=0}^{d-1}{\delta }_{j,i}}\in \mathbb{N}\left(0,{\sigma }_{{\delta }_j}^2\right)$.

Let $N=1000$ units, the amount of sample raw data units $X_{j,i}$, ${X^{\prime }}_{j,i}$. The quantity $C\left({\Delta }_j\right)=C\left({X^{\prime }}_j\right)-C\left(X_j\right)$ measures the difference of $C\left({X^{\prime }}_j\right)$ and $C\left(X_j\right)$, i.e., the noise of Bob’s CDF-transformed data. Let $X_j\in \mathbb{N}\left(0,{\sigma }_X^2=100\right)$ and ${X^{\prime }}_j\in \mathbb{N}\left(0,{\sigma }_{X^{\prime }}^2=104\right)$. The example uses an $d=16$ dimensional approximation.

The distribution of the error $C\left({\Delta }_{j,i}\right)$ of the CDF-transformed raw data units $C\left({X^{\prime }}_{j,i}\right)$, $C\left(X_{j,i}\right)$ are depicted in Figure 12.

In Figure 13a the ratio $C\left({X^{\prime }}_{j,i}\right)/C\left(X_{j,i}\right)$ of the CDF-transformed units is shown in Figure 13a. In the ideal (noise-free) case the ratio equals to 1. In Figure 13b the distribution of the quantity $C\left({\Delta }_{j,i}\right)/C\left(X_{j,i}\right)$ is shown.

In Figure 14a the distribution of noise ${\delta }_{j,i}$ on units ${U^{\prime }}_{j,i}$ is shown, assuming that Bob selects $U_{j,i}\in \left\{-400/16,400/16\right\}$.

In Figure 14b the distribution of ${\delta }_j$ on ${U^{\prime }}_j$, using $U_j={\displaystyle {\sum }_{i=0}^{d-1}{U}_{j,i}}\in \left\{-400,400\right\}$ is depicted. The distribution of ${\delta }_j$ is given by the formula of $\mathbb{N}\left(0,{\sigma }_{{\delta }_j}^2\right)$, and the approximation of the binary Gaussian logical channel is justified by the CLT and the Lyapunov-condition.

The results make it possible to achieve a high-precision conversion of the physical Gaussian quantum channel into a logical binary Gaussian channel. Precisely, only an approximation is possible by the logical layer manipulations, which gets closer to perfect as $d\to \infty$. At $d=16$ the approximation is almost perfect, and the noise on ${U^{\prime }}_j={\displaystyle {\sum }_{i=0}^{d-1}{U^{\prime }}_{j,i}}$ is a real Gaussian noise $\mathbb{N}\left(0,{\sigma }_{{\delta }_j}^2\right)$.

6. Conclusions

The CVQKD protocols are based on Gaussian modulation, and powerful post-processing is needed to maximize the extractable valuable information from the correlated raw data. The physical layer solutions for the reconciliation of Gaussian variables require tomography that is intractable in a practical CVQKD scenario. The reconciliation is also possible in the level of the logical layer by a classical authenticated communication channel, and by traditional algorithmical tools. The multidimensional approaches were developed for this purpose, however the use of complex multidimensional calculations is also not desirable in a practical scenario. The proposed scalar reconciliation eliminates the use of multidimensional spherical space along with the dimensional boundaries. The scalar reconciliation process neither requires any physical-layer tomography, and only standard operations and calculations needed in the level of raw data. The method provides an easy implementation to maximize the extractable valuable binary information from the correlated raw data to significantly boost up the key rates and to improve the distance ranges of CVQKD.