Cite this Article
Lu Zhao, Shi Jian-Hong, Li Feng-Guang. Spherical reconciliation for a continuous-variable quantum key distribution. Chinese Physics B, 2017, 26(4): 040304  
Permissions
Spherical reconciliation for a continuous-variable quantum key distribution
Lu Zhao1, Shi Jian-Hong1, 2, †, Li Feng-Guang1
Zhengzhou Information Science and Technology Institute, Zhengzhou 450004, China
Science and Technology on Information Assurance Laboratory, Beijing 100072, China

 

† Corresponding author. E-mail: shijianhong2011@163.com

Project supported by the National Natural Science Foundation of China (Grant Nos. U1304613 and 11204379).

Abstract

Information reconciliation is a significant step for a continuous-variable quantum key distribution (CV-QKD) system. We propose a reconciliation method that allows two authorized parties to extract a consistent and secure binary key in a CV-QKD protocol, which is based on Gaussian-modulated coherent states and homodyne detection. This method named spherical reconciliation is based on spherical quantization and non-binary low-density parity-check (LDPC) codes. With the suitable signal-to-noise ratio (SNR) and code rate of non-binary LDPC codes, spherical reconciliation algorithm has a high efficiency and can extend the transmission distance of CV-QKD.

PACS: 03.67.Dd;03.67.Hk;84.40.Ua
Keyword:continuous-variable quantum key distribution;quantization;spherical reconciliation
1. Introduction

Quantum key distribution (QKD)[1,2] allows two authorized parties (Alice and Bob) to obtain raw keys after quantum signal generation, transmission and detection Since BB84 protocol[1] was proposed in 1984, quantum key distribution (QKD) has been greatly developed[3–11] and can be used in data encryption.[12–14] Because of imperfection of experimental equipment, disturbance of external environment and eavesdropping from attacker Eve, some errors appear in raw keys and part of raw keys are revealed to Eve. To avoid these disadvantages, classical post-processing,[15–17] such as authentication information reconciliation and privacy amplification, must be used to generate errorless secure key.

According to the difference in transmitted quantum state, QKD protocols are divided into discrete-variable (DV) QKD protocol and CV-QKD protocol. In DV- QKD protocol,[1] the transmitted information is encoded with discrete variables[18] and the raw keys are binary bit strings. So the information reconciliation for DV-QKD protocol is an error correction step principally. In CV-QKD protocol,[2,19] the transmitted information is encoded with continuous variables and the raw keys are values of continuous variables. In this paper, we focus on information reconciliation of CV-QKD[20] by using Gaussian-modulated coherent states and homodyne detection.

CV-QKD is expected to achieve higher secret key rates than DV-QKD due to the possibility of encoding more than 1 bit per pulse, while the difficult point of CV-QKD lies in information reconciliation. Up to now, there have been mainly two information reconciliation methods for CV-QKD: slice reconciliation[21,22] and multidimensional reconciliation.[23] Slice reconciliation method consists of slice quantization step and error correction step. This method encodes a Gaussian variable (symbol) into several bits and is applied to the SNR range 0.5–15.[11] Multidimensional reconciliation method consists of transformation and error correction. This method encodes a symbol into only one bit and is used for SNRs below 0.5. Because slice reconciliation can quantify a continuous variable into several bits, the complexity of slice reconciliation is higher than that of multidimensional reconciliation. The reverse reconciliation,[24] which was proposed in 2003, can reach longer transmission distance (with more than 3-dB losses) than the direct reconciliation.[19] The efficiency and complexity of information reconciliation method are significant for the performance of CV-QKD system.

In this paper, we propose a new information reconciliation method named spherical reconciliation, which is based on spherical quantization and non-binary LDPC codes. In spherical reconciliation, firstly Alice or Bob’s symbols are transformed into the points on the unit sphere completely. Then the points on the unit sphere are quantified into discrete variables with quantization function. Later part bits of discrete variables are discarded to reduce the bit error rate. Finally non-binary LDPC codes[25] are used to encode and decode remaining discrete variables and symbols, and Alice and Bob obtain consistent and secure binary keys.[26] Compared with slice reconciliation, the spherical reconciliation encodes more than 1 bit per pulse, in addition, spherical quantization can reduce leaked information. The performance of information reconciliation is influenced by quantization method, error correction method and corresponding signal-to-noise ratio (SNR) ranges. Reverse reconciliation is used in the following discussion. The simulation result indicates that spherical reconciliation can achieve a high efficiency nearly 97%, and obviously extend the transmission distance of CV-QKD systems to 80 km with a group of suitable parameters.

The rest of the paper is organized as follows. In Section 2, the spherical quantization theory is presented. In Section 3, the details of spherical reconciliation are described. In Section 4, the performances of two-dimensional spherical (2DS) reconciliation are analyzed.

2. Information theory and spherical quantization

The first step of spherical reconciliation is to perform the spherical quantization. Spherical quantization is based on the unit sphere of , and all the symbols belong to reconciliation range and are quantified reasonably. Gaussian variables are mapped to uniform variables on the unit sphere, then the uniform variables are quantified into discrete variables. Quantization method determines the suitable SNR range of reconciliation method, and quantization efficiency influences the reconciliation efficiency.

2.1. Information theory of Gaussian variables

After the quantum process of CV-QKD, Alice owns a symbol , Bob obtains a corresponding symbol and the noise random variable obeys Gaussian distribution with . According to the characteristics of Gaussian channel, the SNR is defined as . The relationships among X, Y, and N is determined by , .

The mutual information between Alice and Bob is defined as

where is the differential entropy with , Z is a continuous random variable with probability density function , is the differential conditional entropy of symbol Y for a given symbol X, and and are the differential entropies of symbols Y and N respectively. Hence the mutual information between Alice and Bob is also denoted as

2.2. Spherical quantization method

Quantization is a process in which the symbols are mapped into binary bits. In spherical quantization, Bob’s symbols should be mapped into the points on the unit sphere . Alice builds n-dimensional vector with her symbols Xi sequentially, with the same method Bob builds n-dimensional vector . Hence the normalized vector obeys uniform distribution on with .

Assuming that Bob quantifies the normalized vector to r bits, so there should be 2r quantization ranges. Bob divides the unit sphere into 2r ranges equally, and the probability of normalized vector falling in each quantization range is

Each quantization range corresponds to one binary bit string. The normalized vector will be quantified into this binary bit string if belongs to the corresponding quantization range. The quantization function Q is defined as

Here, . is the binary bit string of corresponding quantization range Ik. The quantization efficiency is denoted as

Based on the elements of information theory, the mutual information between and is

The entropy of is with . The differential conditional entropy is defined as
and the probability is conditioned on the fact that Alice measures and obtains

Spherical quantization is different from symbol quantization of Slice reconciliation. An imperfection of slice quantization is that a few symbols are out of the quantization intervals and assigned to the corresponding adjacent intervals. This way changes quantization efficiency and reconciliation efficiency necessarily. While in spherical quantization, all the symbols are mapped into the points on the unit sphere, which satisfies all the symbols in the corresponding quantization ranges.

When the number of dimension is 2 or 3, the unit spheres can be divided equally through angle division or gridding division. A necessary problem is that it is difficult to divide the unit sphere equally when the dimension n is larger than 3. Hence Bob should do this job in advance. In Section 4 spherical reconciliation will be simulated when the dimension is 2.

3. Details of spherical reconciliation

Spherical reconciliation contains spherical quantization, bits sifting and error correction. We have introduced the spherical quantization method in Section 2. Non-binary LDPC codes are used to correct errors constantly with high decoding efficiency.[27,28] After quantifying the symbols, bits sifting step and error correction step will be allowed to proceed.

3.1. Bits sifting

Bob’s symbols were quantified into a binary bit string in the spherical quantization step. Because of the structure characteristics of quantization function, part bits of lk are strongly correlated with Alice’s measured values , and the remaining bits of lk are weakly correlated with Alice’s measured values . Hence the bits in binary bit string lk consist of strongly correlated bits and weakly correlated bits.[29] The weakly correlated bits distribute at the end of bit string with high probability. Hence the bit string lk can be divided into two parts, i.e., the strongly correlated bit string and the weakly correlated bit string with .

The bit string contains weakly correlated bits so that it will be send to Alice entirely.[21] The remaining bit string is used to correct error and generate secure keys. The parameter q influences the reconciliation efficiency immediately. If parameter q is too large, part of serviceable bits will be disclosed. If parameter q is too small, some extra errors will appear in . The value of parameter q is determined by actual conditions, such as the length of lk. In bits sifting step q bit information is discarded.

3.2. Error correction with non-binary LDPC codes

The purpose of error correction is that Alice and Bob share the same keys with high probability. They process the error correction via non-binary LDPC codes over Galois fields with , which are based on belief propagation (BP) decoding algorithm. Code rate of non-binary LDPC codes, is a parameter to influence decoding efficiency and reconciliation efficiency. The wasting information in error correction step is .

At first, Bob generates a parity-check matrix with a suitable size. Then Bob computes the syndrome and sends it to Alice via a noiseless channel. Later, Alice decodes her symbols by the sum-product algorithm,[29] which is based on BP decoding algorithm. The computational complexity is when a symbol is decoded. Finally, Alice obtains the bit string with high probability , where is the probability that the error correction fails to decode and it is determined by the frame error rate of LDPC codes.

The total efficiency of bits sifting and error correction is given by

3.3. Reconciliation efficiency

Details of spherical reconciliation are finished, and the structure is shown in Fig. 1. The reconciliation efficiency can be defined as

From formulas (5), (9), and (10), the efficiency of spherical reconciliation is given by

Fig. 1. Structure of spherical reconciliation.

From formula (11), SNR and code rate of non-binary LDPC codes are two important parameters, which can determine the reconciliation efficiency. By adjusting the SNR and code rate of non-binary LDPC codes, the optimal reconciliation efficiency can be obtained. Alice and Bob need transmit information twice in spherical reconciliation. One is that Bob sends weakly correlated bit string to Alice ( is not used to generate keys), and the other is that Bob sends to Alice to be decoded.

4. Simulation analysis

We analyze the spherical reconciliation with a CV-QKD protocol based on Gaussian-modulated coherent states,[20] homodyne detection and reverse reconciliation. We simulate the performance of 2DS reconciliation now.

Alice and Bob build their respective two-dimensional vectors and . Bob normalizes and obtains . According to different conditions, Bob quantifies the normalized value into a bit string lk with r bit length, and discards a bit string with q bits length. Considering the SNR of the transmission, Bob chooses a suitable non-binary LDPC codes and sends to Alice to be decoded. Efficiency of spherical reconciliation is influenced by the performance of non-binary LDPC codes, especially code rate and corresponding frame error rate. Success rate of spherical reconciliation is determined by the frame error rate of LDPC codes. According to the performance of non-binary LDPC codes,[29] figure 2 shows the efficiency of 2DS reconciliation method. In the remaining part of simulation Bob chooses non-binary LDPC codes over for frame length with code rate .

Fig. 2. (color online) Efficiencies of 2DS reconciliation method with different code rates of non-binary LDPC codes and length of quantified bit strings. The non-binary LDPC codes are over for frame length .

When the normalized value is quantified into 5 bits, the number of quantization intervals is 32. As figure 3 shows, Bob divides the two-dimensional sphere into 32 ranges, i.e., . According to quantization function (4), Bob can compute the corresponding quantified value lk. Its quantization efficiency can be calculated by formulas (5)–(8), and figure 4 shows the efficiency of 2DS quantization and efficiency of slice quantization with optimal intervals.[22] For 2DS quantization, is quantified into 5 bits, which is similar to the case that a symbol is quantified into 2.5 bits. Compared with slice quantization, the efficiency of 2DS quantization is higher when slice quantization quantifies a symbol into 4 bits.

Fig. 3. (color online) When , the unit circle is divided into 32 ranges by the points, and the 32 ranges correspond to quantization intervals. The normalized random vector has a uniform distribution on the unit circle.
Fig. 4. (color online) Efficiencies of 2DS quantization and slice quantization with optimal intervals.

For the infinite-size condition, the secret key rate proven secure against individual attack is given by[23]

where β is the reconciliation efficiency, denotes the Shannon mutual information between Alice and Bob, is the mutual information between Bob and Eve, is the probability that error correction fails to be decoded.

As figure 5 shows, when and , 2DS reconciliation is optimal for an SNR of about 2, this new reconciliation method can extend the transmission distance of CV-QKD protocols to over 60 km when the SNR is 1.92. Figure 6 shows that the suitable SNR range varies with the length of quantified bit string lk. For different lengths of quantified bit strings , , and the suitable SNRs, reconciliation efficiency can reach . Especially, the transmission distance of CV-QKD protocols is over 70 km when .

Fig. 5. (color online) Performances of 2DS reconciliation with different SNRs when , and experimental parameters:[31] /km, , , and .
Fig. 6. (color online) Performances of 2DS reconciliation with different SNRs when , , and . The reconciliation efficiencies in three cases are all . The experimental parameters are as follows:[31] /km, , , and .

To compare spherical reconciliation with slice reconciliation in the same SNR case, we assume that the SNR is 3.25 and Bob quantifies a symbol into 4 bits, for slice reconciliation Bob should discard 2 bits, the efficiency is .[30] In order to embody fairness, for 2DS reconciliation Bob quantifies into 8 bits and discards 4 bits, which is equivalent to Bob’s quantifying a symbol into 4 bits and discards 2 bits. As figure 7 shows, under the same conditions the performance of 2DS reconciliation is superior.

Fig. 7. (color online) Performances of 2DS reconciliation with , , and experimental parameters:[30] /km, , , and .

For the finite-size condition, the secret key rate proven secure against collective attack is given by[32]

where is the Shannon mutual information between Alice and Bob, is the Holevo bound on the information between Bob and Eve, and is related to the security of the privacy amplification.[33] The involved parameters are the repetition rate of CV-QKD system K, the number of the total signal pulses N1, the number of the signals pulses for key generation N2, and the reconciliation efficiency β.

Figure 8 shows the comparison of the performance between 2DS reconciliation method and slice reconciliation method[11] in the finite-size case with the corresponding SNR values being 3.25 and 19; the 2DS reconciliation method can extend the transmission distance to over 55 km when the SNR is 3.25 in the same CV-QKD system. As figure 9 shows, the performance of the spherical reconciliation is still better than that of multidimensional reconciliation when the size is finite. The distance of this CV-QKD system can be extend to 80 km when the modulation variance .

Fig. 8. (color online) Performances of 2DS reconciliation with , , and the experimental parameters:[11] /km, , , and .
Fig. 9. (color online) Performances of 2DS reconciliation when , , and experimental parameters:[32] /km, , , , MHz, , and .
5. Conclusions

Information reconciliation is an indispensable part for CV-QKD system. In this paper we propose a new information reconciliation method named spherical reconciliation. Because of using no post-selection,[34,35] the spherical reconciliation can be proven secure against general attacks. Spherical quantization method is a high-efficiency quantization method. The performance of spherical reconciliation is restricted by the compatibility and performance of non-binary LDPC codes. We analyze the performance of 2DS reconciliation method, which has high efficiency and can extend the transmission distance of infinite-size and finite-size CV-QKD protocols. It is valuable to discuss spherical reconciliation in the case of high dimensions.

Reference
[1] Bennett C H Brassard G 1984 Proceedings of the IEEE International Conference on Computers, Systems and Signal Processing December 10–12, 1984 New York, USA 175
[2] Ralph T C 1999 Phys. Rev. 61 103031
[3] Lo H K Curty M Tamaki K 2014 Nat. Photon. 8 595
[4] Gu Y B Bao W S Wang Y Zhou C 2016 Chin. Phys. Lett. 33 040301
[5] Li J Chen Y H Pan Z S Sun F Q Li N Li L L 2016 Acta Phys. Sin. 65 030302 in Chinese
[6] Yin Z Q An X B Han Z F 2015 Acta Phys. Sin. 64 140303 in Chinese
[7] Chen H An X B Wu J Yin Z Q Wang S Chen W Han Z F 2016 Chin. Phys. 25 020305
[8] Li Y Bao W S Li H W Zhou C Wang Y 2016 Chin. Phys. 25 010305
[9] Wang L Zhao S M Gong L Y Cheng W W 2015 Chin. Phys. 24 120307
[10] Li Y Bao W S Li H W Zhou C Wang Y 2015 Chin. Phys. 24 110307
[11] Jouguet P Elkouss D Kunz-jacques S 2014 Phys. Rev. 90 042329
[12] Xia Z H Wang X H Sun X M Wang Q 2015 IEEE Transactions on Parallel and Distributed Systems 27 340
[13] Fu Z J Sun X M Liu Q Zhou L Shu J G 2015 IEICE Transactions on Communications 98 190
[14] Fu Z J Wu X L Guan C W Sun X M Ren K 2016 IEEE Transactions on Information Forensics and Security 11 2706
[15] Elkouss D Martinez-Mateo J Martin V 2011 Quantum Inform. Comput. 11 226
[16] Du P Y Bai Z L Wang X Y Li Y M 2013 Acta Sin. Quantum Opt. 19 129
[17] Li Y Liao S K Liang F T Shen Q Liang H Peng C Z 2016 Chin. Phys. Lett. 33 30303
[18] Buttler W T Torgerson J R Lamoreaux S K 2002 Phys. Lett. 299 38
[19] Grosshans F Grangier P 2002 Phys. Rev. Lett. 88 057902
[20] Grosshans F Van A G Wenger J Brouri R Cerf N J Grangier P 2003 Nature 421 238
[21] Van Assche G Cardinal J Cerf N J 2004 IEEE Transactions on Information Theory 50 394
[22] Bai Z L Wang X Y Yang S S Li Y M 2016 Sci. China-Phys., Mech. & Astron. 59 614201
[23] Leverrier A Alléaume R Boutros J Zémor G Grangier P 2008 Phys. Rev. 77 042325
[24] Grosshans F Grangier P 2002 Physics 3 4
[25] Davey M C Mackay D 1998 IEEE Commun. Lett. 2 70
[26] Ankan E Ul Hassan N Lentmaier M Montorsi G 2015 Journal of Communications and Networks 17 328
[27] Voicila A Declercq D Verdier F Fossorier M Urard P 2010 IEEE Trans. Commun. 58 1365
[28] Sayir J 2014 Non-binary “LDPC decoding using truncated messages in the Walsh-Hadamard domain”. International Symposium on Information Theory and ITS Applications IEEE 16 20
[29] Pacher C Martinez-Mateo J Duhme J Gehring T Furrer F 2016 arXiv: 1602.09140v1 [quant-ph]
[30] Lodewyck J Bloch M García-Patrón R Fossier S Karpov E Diamanti E Debuisschert T Cerf N J Tualle-Brouri R McLaughlin W Grangier P 2007 Phys. Rev. 76 042305
[31] Jouguet P Kunz-Jacques S Leverrier A 2011 Phys. Rev. 84 062317
[32] Wang C Huang D Huang P Lin D K Peng J Y Zeng G H 2015 Sci. Rep. 5 14607
[33] Leverrier A Grosshans F Grangier P 2010 Phys. Rev. 81 062343
[34] Silberhorn C Ralph T C Lütkenhaus N Leuche G 2002 Phys. Rev. Lett. 89 167901
[35] Navascués M Grosshans F Acín A 2006 Phys. Rev. Lett. 97 190502