Multi-Matrix Post-Processing for Quantum Key Distribution

TL;DR

This paper introduces a multi-matrix post-processing scheme for quantum key distribution that enhances error correction efficiency and error rate estimation, leading to higher secure key rates without compromising security.

Contribution

It proposes a multi-low-density parity-check codes based reconciliation scheme with multi-syndrome error estimation, improving efficiency over traditional methods.

Findings

More accurate error rate estimation compared to single-syndrome methods

Significant increase in reconciliation efficiency

Maintains security while improving key rate

Abstract

Post-processing is a significant step in quantum key distribution(QKD), which is used for correcting the quantum-channel noise errors and distilling identical corrected keys between two distant legitimate parties. Efficient error reconciliation protocol, which can lead to an increase in the secure key generation rate, is one of the main performance indicators of QKD setups. In this paper, we propose a multi-low-density parity-check codes based reconciliation scheme, which can provide remarkable perspectives for highly efficient information reconciliation. With testing our approach through data simulation, we show that the proposed scheme combining multi-syndrome-based error rate estimation allows a more accurate estimation about the error rate as compared with random sampling and single-syndrome estimation techniques before the error correction, as well as a significant increase in the efficiency of the procedure without compromising security and sacrificing reconciliation efficiency.

Tables

Table 1. Table 1: Soft-decision Values of 𝐯 𝟐 subscript 𝐯 2 \mathbf{v_{2}} and 𝐯 𝟒 subscript 𝐯 4 \mathbf{v_{4}}

Iteration number	Soft-decision value of $v_2$	Soft-decision value of $v_4$	Result
1	-0.753772	0.753772	fail
2	0.753772	-0.753772	fail
3	-0.728434	0.728434	fail
4	-0.728434	0.728434	fail
5	-0.704088	0.704088	fail
$\cdots$	$\cdots$	$\cdots$	$\cdots$
96	0.166115	-0.166115	fail
97	-0.160981	0.160981	fail
98	0.160981	-0.160981	fail
99	-0.156007	0.156007	fail
100	0.156007	-0.156007	fail

Table 2. Table 2: Soft-decision Values of 𝐯 𝟐 subscript 𝐯 2 \mathbf{v_{2}} and 𝐯 𝟒 subscript 𝐯 4 \mathbf{v_{4}} in 3-matrix reconciliation

Iteration number	Soft-decision value of $v_2$ in $H_1$	Soft-decision value of $v_2$ in $H_2$	Soft-decision value of $v_2$ in $H_3$	Soft-decision value of $v_2$	Soft-decision value of $v_4$ in $H_1$	Soft-decision value of $v_4$ in $H_2$	Soft-decision value of $v_4$ in $H_3$	Soft-decision value of $v_4$	Result
1	-0.753772	-0.753772	-0.753772	-5.0339	0.753772	-2.01882	-1.38629	0.121249	fail
2	0.753772	-3.46963	-2.56496	-8.0534	-0.753772	-2.77259	-3.52636	-4.28013	success

Equations

$$\{\begin{array}{ll}{P}_i^0=1-e,P_i^1=e& y_i=0\\ P_i^0=e,P_i^1=1-e& y_i=1\end{array},$$

$$L_{P_i}=\log \frac{P_i^0}{P_i^1},$$

$$L_{v_i\to c_j}=L_{P_i},$$

$$\begin{array}{r}{L}_{c_j\to v_i}=\mathrm{sign}(z_j)\cdot 2{\tanh }^{-1}(\prod _{v_{i^{{}^{\prime }}}\in N(c_j)\backslash i}\tanh (\frac{1}{2}{L}_{v_{i^{{}^{\prime }}}\to c_j})),\end{array}$$

$$\mathrm{sign}(z_j)=\{\begin{array}{ll}+1& z_j=0\\ -1& z_j=1\end{array}.$$

$$L_{v_i\to c_j}=L_{P_i}+\sum _{c_{j^{{}^{\prime }}}\in N(v_i)\backslash j}{L}_{c_{j^{{}^{\prime }}}\to v_i},$$

$$L_{v_i}=L_{P_i}+\sum _{c_j\in N(v_i)}{L}_{c_j\to v_i},$$

$$y_i=\{\begin{array}{ll}1& L_{v_i}>0\\ 0& L_{v_i}<0\end{array}.$$

$$△z^k=z^{A|k}\oplus z^{B|k},k\in \{1,\cdots ,u\},$$

$$e=\arg \underset{e^{{}^{\prime }}\in [0,threshold]}{\max }{M}_{e^{{}^{\prime }}|△Z},$$

$$M_{e^{{}^{\prime }}|△Z}=\prod _{k=1}^u\prod _{j=1}^m[1-△z_j^k+(2△z_j^k-1)p(e^{{}^{\prime }},d_{c_j}^k)],$$

$$\begin{array}{rl}p(e^{{}^{\prime }},d_{c_j}^k)& =Pr(△z_j^k=1)\\ & =\sum _{\begin{array}{c}i=1\\ i\mathrm{mod}2=1\end{array}}^{d_{c_j}^k}\left(\genfrac{}{}{0ex}{}{d_{c_j}^k}{i}\right)e^{{}^{\prime }i}(1-e^{{}^{\prime }}{)}^{d_{c_j}^k-i},\end{array}$$

$$\begin{array}{rl}(z^k{)}^T=[z_1^k,\dots ,z_n^k]=H_k\cdot x,\text{leavevmode}& k\in \{1,\dots ,u\},\\ & z_i^k\in \{0,1\},\end{array}$$

$$L_{v_i}=L_{P_i}+\sum _{k=1}^u\sum _{c_j\in N_k(v_i)}{L}_{c_j\to v_i}^k,$$

$$f=\frac{m}{nh(e)}>1,$$

$$h(e)=-e{\log }_{2}e-(1-e){\log }_2(1-e).$$

$$f=\frac{\alpha m}{nh(e)}>1,(\alpha \ge 1),$$

$$\mathrm{BER}=\frac{\mathrm{number}\mathrm{of}\mathrm{error}\mathrm{bits}}{1000\ast \mathrm{length}\mathrm{of}\mathrm{code}},$$

$$I(x;z)\le m.$$

$$I(x;z)=H(z)-H(z|x).$$

$$H(z|x)=0.$$

$$\begin{array}{rl}I(x;z)& =H(z)\le -\sum _1^{2^m}(\frac{1}{2^m}\log \frac{1}{2^m})\\ & =\log 2^m=m.\end{array}$$

$$P(X=x)=\frac{1}{2^n},$$

$$H(x|z)\ge t.$$

$$H(x)=-\sum _1^{2^n}(\frac{1}{2^n}\log \frac{1}{2^n})=\log 2^n=n.$$

$$\begin{array}{rl}H(x|z)& =H(x)-H(z)\\ & =H(x)-I(x;z)\ge n-m=t.\end{array}$$

$$H_{m\times n}=(H_{m\times t}^{{}^{\prime }},E_m),$$

$$\begin{array}{rl}z& =(H_{m\times t}^{{}^{\prime }},E_m)\cdot x\\ & =H_{m\times t}^{{}^{\prime }}\cdot \left[\begin{array}{c}{x}_1\\ x_2\\ ⋮\\ x_t\end{array}\right]\oplus \left[\begin{array}{c}{x}_{t+1}\\ x_{t+2}\\ ⋮\\ x_n\end{array}\right]=\left[\begin{array}{c}{z}_1\\ z_2\\ ⋮\\ z_m\end{array}\right].\end{array}$$

$$H_{m\times n}=A\cdot (H_{m\times t}^{{}^{\prime }},E_m)\cdot B,$$

$$\begin{array}{rl}{z}^{{}^{\prime }}& =(H_{m\times t}^{{}^{\prime }},E_m)\cdot x^{{}^{\prime }}\\ & =H_{m\times t}^{{}^{\prime }}\cdot \left[\begin{array}{c}{x}_1^{{}^{\prime }}\\ x_2^{{}^{\prime }}\\ ⋮\\ x_t^{{}^{\prime }}\end{array}\right]\oplus \left[\begin{array}{c}{x}_{t+1}^{{}^{\prime }}\\ x_{t+2}^{{}^{\prime }}\\ ⋮\\ x_n^{{}^{\prime }}\end{array}\right]=\left[\begin{array}{c}{z}_1^{{}^{\prime }}\\ z_2^{{}^{\prime }}\\ ⋮\\ z_m^{{}^{\prime }}\end{array}\right].\end{array}$$

Full text

I Introduction

Quantum Key Distribution (QKD) is a class of protocols where the two separated users, Alice and Bob, can share identical secret keys which are secure from the eavesdropper (Eve) Gisin et al. (2002). Since it provides unconditional security guaranteed by laws of quantum mechanics Scarani et al. (2009), QKD has attracted wide attention and many advanced works have been published over recent years Lo et al. (2005, 2012); Liao et al. (2017); Wang (2005). Generally, a QKD protocol can be divided into quantum and classical parts. In the former part, Alice generates and transmits a set of raw key through the quantum channel. Due to Eve’s attacksBennet and Brassard (1984), channel noise, and device imperfection Gerhardt et al. (2010); Weier et al. (2011); Jain et al. (2011), the keys are weakly correlated and partially secure, and Eve may obtain some information about the keys. The classical part, also known as post-processing, is used to correct the errors, and to remove information leakage.

Post-processing consists of base sifting Bennet and Brassard (1984), error estimation Wang (2005); Treeviriyanupab et al. (2014); Kiktenko et al. (2018), key reconciliation Luby et al. (1998) and privacy amplification Bennett et al. (1988, 1995). During base sifting, the bits measured with correct measurement bases in the raw key are kept and constitute the sifted key. Subsequently, Bob uses a key reconciliation algorithm to correct the errors in the sifted key based on the estimated error rate. Finally, Alice and Bob implement privacy amplification to remove information leakage and obtain the final key, which is secure from Eve.

In error estimation, the accuracy of the estimated quantum bit error rate(QBER) effects the operational efficiency of post-processing. If the actual QBER for a given block is larger than the estimate, Bob might end up with a wrong final key. A common method to obtain the QBER for legitimate users is to exchange and compare random sampled sifted key, which can lower the key generation rate due to disclosed bits. Recently, Kiktenko $etal$ Kiktenko et al. (2018) proposed a distinct approach based on the use of syndromes of low-density parity-check (LDPC) codes to obtain the QBER for each block of the sifted key, allowing more accurate estimation. The suggested algorithm is also suitable for irregular LDPC codes.

In parallel, key reconciliation is the most crucial step of post-processing, which is responsible for correcting the errors in Bob’s sifted key, in such a way that it ensures consistency between Alice’s and Bob’s sifted keys. Belief Propagation (BP) Luby et al. (1998) is the most widely used key reconciliation algorithm, and has attracted intensive study Kou et al. (2001); Zhang and Fossorier (2002); Hocevar (2004); Sharon et al. (2004); Zhang and Fossorier (2004); Chang et al. (2008); Park et al. (2008); Wu et al. (2010); Aslam et al. (2017). There are three criteria for judging a key reconciliation algorithm, namely, convergence speed, bit error rate (BER) and success rate. However, it is hard to meet the three criteria at the same time, which often appears if the syndrome decoding, based on an iterative BP algorithm, fails to converge within the predefined number of iterations (e.g., it could be caused by an inappropriate choice of the LDPC parity-matrices relative to the actual errors in raw keys). This makes key reconciliation the bottleneck of QKD and severely affects the key generation rate for industrial QKD systems.

In this paper, we extend the blind information reconciliation Kiktenko et al. (2017) to multiple LDPC codes and estimate the QBER more accurately by virtue of multiple syndromes without disclosing redundant bits. Experimental results show that a significant increase in the efficiency of the procedure, i.e. faster convergence speed with higher success rate. To prevent extra information leakage in our post-processing scheme, we also give a multiple LDPC codes construction method. Security analysis shows that our key reconciliation scheme does not reveal extra information.

The rest of the paper is organized as follows: in Section II, a briefly review of error estimation and key reconciliation is given, followed by a detail description of the process and advantages of our scheme. Section III provides the novel multi-matrix post-processing approach for error estimation and correction. In Section IV a set of data simulation are carried out to fully evaluate these advantages. The proposed construction method of multiple matrices and the security analysis of the proposed scheme are given in the appendix.

II Preliminaries

In this section, we will first review error estimation and reconciliation. Other parts of post-processing can be referred to Bennet and Brassard (1984); Bennett et al. (1988, 1995).

II.1 Error Estimation

We assume that Alice and Bob possess random sifted keys of equal length, and Bob needs to estimate the error rate $e$ of the sifted keys before executing key reconciliation, since $e$ is an important input parameter of reconciliation algorithms. The estimation accuracy of $e$ directly effects the operational efficiency of post-processing. If $e$ is overestimated, Alice will place superfluous information on her syndrome, i.e., more leakage needed to be removed during privacy amplification, leading to relatively low key generation rate. On the contrary, if $e$ is underestimated, less information is provided, so Bob spends more time to correct errors during key reconciliation or even end up with wrong final key.

Error estimation can be executed in the several ways. The most well-known method is the random sampling Wang (2005). But its drawback is that if Alice and Bob want to estimate more accurate error rate, they inevitably sacrifice key bits. To solve this problem, P.Treeviriyanupab et al. proposed a new method Treeviriyanupab et al. (2014). In this protocol, Alice and Bob use their syndromes $z^{A}=[z_{1}^{A},\cdots,z_{m}^{A}]$ and $z^{B}=[z_{1}^{B},\cdots,z_{m}^{B}]\ (z_{j}^{A},z_{j}^{B}\in\{0,1\},j\in\{0,\cdots,m\})$ as input to calculate the maximum likelihood estimation of error rate. Syndromes are generated from a kind of data structure, LDPC code Gallager (1962), which can be presented by a $m\times n$ matrix or a Tanner Graph (TG) Tanner (1981). In Fig. 1 (a), an example of binary LDPC matrix $H_{m\times n}$ is given. The variable nodes $v_{i}\leavevmode\nobreak\ (i\in\{1,\cdots,n\})$ (blue circles ) and check nodes $c_{j}\leavevmode\nobreak\ (j\in\{1,\cdots,m\})$ (yellow squares) represent bits of key and parity-check equations, respectively Gallager (1962). TG corresponding to this matrix is shown in Fig. 1 (b). An edge connecting a variable node and a check node indicates that the variable node participates in the parity-check equation. In a LDPC code, the degree of a variable node (or check node) is the number of check nodes (or variable nodes) connected to it.

The syndromes, $z^{A}$ (or $z^{B}$), are simply obtained by multiplying a LDPC matrix and Alice’s (or Bob’s) sifted key. But the method Treeviriyanupab et al. (2014) is applicable only to regular LDPC code, in which all of the variable nodes have the same degrees and so does all check nodes. So Kiktenko et al. extend the scope of application Kiktenko et al. (2018) (hereinafter referred to as the single-syndrome error estimation), which is also suitable for irregular LDPC code.

II.2 Key Reconciliation

BP Luby et al. (1998), also known as the Sum Product (SP) algorithm, can be used for error-correction. Due to its relatively high decoding efficiency and low executing complexity, BP has been widely adopted in QKD to correct the key errors caused by Eve’s attacks, channel noise, etc.

In QKD, if Bob uses BP to correct his sifted key $y^{T}=[y_{1},\ldots,y_{n}]$, he first needs to initializes $P^{b}_{i}\leavevmode\nobreak\ (b\in\{0,1\})$, $v_{i}$ and variable-to-check (V2C) information $L_{v_{i}\to c_{j}}$ as follows,

[TABLE]

[TABLE]

[TABLE]

where $P^{b}_{i}\leavevmode\nobreak\ (b\in\{0,1\})$ is the prior probability of the candidate value $b$ of $v_{i}$, $e$ is the result of error estimation, $L_{P_{i}}$ represents the log likelihood ratio of $P_{i}^{b}$.

Secondly, as shown in Fig. 2 (a), he generates and propagates check-to-variable (C2V) information $L_{c_{j}\to v_{i}}$ by

[TABLE]

where $z$ denotes the Alice’s syndrome Mackay (1999), which is the product of $H_{m\times n}$ and Alice’s sifted key, $\mathrm{tanh()}$ is the hyperbolic tangent function, $\mathrm{tanh}^{-1}()$ is the inverse function of $\mathrm{tanh}()$, $v_{i^{{}^{\prime}}}\in{N(c_{j})\backslash i}$ represents the set of adjacent variable nodes of check nodes $c_{j}$ except $v_{i}$, $\mathrm{sign}()$ is a sign function defined as follows:

[TABLE]

Thirdly, as plotted in Fig. 2 (b), Bob updates and propagates V2C information by substituting the generated C2V information into the following equation.

[TABLE]

where, $c_{j^{{}^{\prime}}}\in{N(v_{i})\backslash j}$ represents the set of adjacent check nodes of $v_{i}$ except $c_{j}$. All of $L_{c_{j}\to v_{i}}$ and $L_{v_{i}\to c_{j}}$ contain information of posterior probabilities of $v_{i}$.

Finally, he calculates the soft-decision value of every variable node $v_{i}$ as follows,

[TABLE]

then performs the decoding decision on every variable node according to the following equation,

[TABLE]

Bob iterates the last three steps until the decoding is successful (i.e., the equation $z=H_{m\times n}\cdot y$ is satisfied) or the number of iterations reaches the pre-set upper limit.

In each iteration, BP can use different scheduling strategies, which can be divided into three categories Casado et al. (2007): Flooding, Shuffled, and Layer. Flooding first goes through all the check nodes and generates C2V information, then traverses all the variable nodes and updates V2C information. Shuffled uses variable nodes as the traversal sequence, sequentially updates C2V and V2C information between variable nodes and their adjacent check nodes. Layer, on the contrary, uses check nodes as the traversal sequence, sequentially updates C2V and V2C information between check nodes and their adjacent variable nodes. In practical applications, BP, Shuffled Belief Propagation (SBP) Zhang and Fossorier (2002), and Layer Belief Propagation (LBP) Hocevar (2004); Sharon et al. (2004) are the typical representatives of the above three scheduling strategies. For convenience, the algorithms based on single matrix are hereinafter referred to as the single-matrix reconciliation.

III Multi-matrix Post-processing

In this section, we propose a post-processing scheme where users estimate error rate with multiple syndromes and correct errors with multiple matrices (hereinafter referred to as the multi-matrix post-processing). In the multi-matrix post-processing, base sifting and privacy amplification are the same as the original post-processing (hereinafter referred to as the single-matrix post-processing). Here we introduce only error estimation and key reconciliation in the frame of multiple syndromes.

III.1 Multi-syndrome Error Estimation

Each bit of a syndrome represents the relationship of the parity-check equation and the key. By comparing Alice’s syndrome and his own syndrome, Bob can extract some information about error rate. If he uses multiple matrices, he can obtain multiple syndromes, which can be used to estimate the error rate more accurately.

Above all, Bob obtains $u$ syndromes from Alice and performs XOR as follows,

[TABLE]

where $\oplus$ is the XOR operation, $z^{A|k}$ and $z^{B|k}$ is the $k^{th}$ syndromes of Alice and Bob respectively. Then Bob calculates the maximum likelihood estimation of $e$ by,

[TABLE]

where $e^{{}^{\prime}}$ is a possible value that $e$ may take, $\triangle Z=[\triangle z^{1},\triangle z^{2},\cdots,\triangle z^{u}]$. In equation (10), $M_{e^{{}^{\prime}}|\triangle Z}$ can be obtained via,

[TABLE]

[TABLE]

where $M_{e^{{}^{\prime}}|\triangle Z}$ is the likelihood function of $e^{{}^{\prime}}$, $p(e^{{}^{\prime}},d_{c_{j}}^{k})$ is the priori probability of that $z_{j}^{A|k}$ and $z_{j}^{B|k}$ are different, $\triangle z_{j}^{k}$ is the $j^{th}$ bit of $\triangle z^{k}$, $z_{j}^{A|k}$ is the $j^{th}$ bit of $z^{A|k}$, $z_{j}^{B|k}$ is the $j^{th}$ bit of $z^{B|k}$, $d_{c_{j}}^{k}$ is the degree of check node $c_{j}$ of $k^{th}$ matrix. As shown in equation (10), $e$ evaluates to $e^{{}^{\prime}}$ that maximizes $M_{e^{{}^{\prime}}|\triangle Z}$. The “threshold” Richardson and Urbanke (2001); Richardson et al. (2001) is the upper limit of error rate that can be acceptable. If $e$ exceeds the “threshold”, the sifted key will be abandoned.

Our method (hereinafter referred to as the multi-syndrome error estimation) is based on the single-syndrome error estimation, but can bring out higher accuracy of estimation. Meanwhile, compared with the random sampling, our method doesn’t need to discard any key bit.

III.2 Multi-matrix Key Reconciliation

Although, theoretical analysis and simulation results show that the single-matrix reconciliation can correct the errors to some extent Sharon et al. (2007), the performances of convergence speed and BER are still limited Casado et al. (2007, 2010), and the success rate is decreased when LDPC code is not cycle-free Tanner (1981); Yazdani et al. (2004). To overcome these problems, we propose a new reconciliation strategy that uses two or more matrices to correct errors in parallel. Let us take multi-matrix BP (MBP) as an example to show the detailed process and advantages of our strategy.

Suppose Alice and Bob have prepared and shared $u$ LDPC codes $H_{1},\ldots,H_{u}$. After obtaining the sifted key $x^{T}=[x_{1},\ldots,x_{n}]\leavevmode\nobreak\ (x_{i}\in\{0,1\})$, Alice calculates $u$ syndromes according to the following equation:

[TABLE]

and sends them to Bob over the classical channel. Because of Eve’s attacks, channel noise, or device imperfection, Bob inevitably obtain different sifted keys with Alice, denoted as $y^{T}=[y_{1},\ldots,y_{n}],\leavevmode\nobreak\ (y_{i}\in\{1,0\})$.

In our strategy, Bob first initializes the prior probabilities $P^{b}_{i}\leavevmode\nobreak\ (b\in\{0,1\})$, log likelihood ratios $L^{k}_{P_{i}}$ and V2C information $L^{k}_{v_{i}\to c_{j}}$ for all matrices according to equations (1), (2) and (3), respectively.

Secondly, Bob generates and propagates C2V information $L^{k}_{c_{j}\to v_{i}}$ according to equation (4).

Thirdly, by substituting C2V information into equation (6), Bob updates and propagates V2C information.

Finally, he goes through all variable nodes to obtain their soft-decision values by

[TABLE]

and makes decoding decisions according to equation (8). Because once Bob’s key is corrected, i.e. $y$ is equal to $x$, all his syndromes satisfy $z_{k}=H_{k}\cdot y$. Thus he randomly selects a matrix $H_{k}$, and judges whether $z_{k}$ is equal to $H_{k}\cdot y$. If so, Bob terminates the algorithm and stores $y$. Otherwise, he starts another iteration. The reconciliation is considered as a failure when the number of iterations exceeds the upper limit.

There is an important figure called the reconciliation efficiency $f$ Kiktenko et al. (2017). It shows the ratio of practical information leakage to theoretical floor for successful reconciliation. It serves to imply the efficiency and security of a reconciliation strategy and help privacy amplification to remove information leakage. For the single-matrix reconciliation, the reconciliation efficiency $f$ is represented as

[TABLE]

where m and n are the numbers of check nodes and variable nodes of the LDPC code, e is the result of error estimation, h is the Shannon binary entropy:

[TABLE]

For the multi-matrix reconciliation, however, $f$ is given by

[TABLE]

where $\alpha$ is a constant which is relative to $u$ and the structures of $u$ matrices. Fortunately, if the construction method of multiple matrices (see Appendix B) is used, it can be proved that the practical information leakage is equal to $m$ (see Appendix A), i.e., $\alpha$ is equal to $1$, without sacrificing the reconciliation efficiency compared with single-matrix post-processing.

Obviously, our strategies is portable, it can be easily applied to SBP, LBP (see Appendix C), and other algorithms to achieve the following improvements:

Faster Convergence Speed   In our strategy, when Bob generates C2V and updates V2C information, all matrices operate in parallel. And as shown in equation (14), Bob obtains the soft-decision value of each variable node $v_{i}$ by gathering all the C2V information sent to $v_{i}$ in every matrix. The amount of C2V information gathered within one iteration in the multi-matrix reconciliation is equal to information gathered in numerous iterations in the single-matrix reconciliation. 2. 2.

Higher Success Rate   Once C2V and V2C information of a matrix are trapped in a cycle, the other matrices without this cycle can help the trapped matrix jump out the cycle, leading to higher success rate. 3. 3.

Lower BER   The value of each key bit is determined according to the information provided by multiple matrices. The accuracy of error-correction is effectively improved, resulting in lower BER.

IV Experimental Evaluation

To fully evaluate the above advantages of multi-matrix post-processing, in this session we first give some detailed comparisons among three methods of error estimation. Then for the other three parts, the experiments about the three criteria of key reconciliation algorithms are carried out. All simulation data used in our experiments are generated by real random number generator IDQ EasyQuantis 2.1. For comparison, we also set the upper limit of iterations to $100$, which is similar to existing implementations Zhang and Pfister (2012); Djordjevic et al. (2012), and the code rate and code length of LDPC codes are set to $0.8$ and $10000$, respectively.

IV.1 Error Estimation

We have described the three methods of error estimation hereinbefore, including the random sampling, the single-syndrome error estimation and the multi-syndrome error estimation. To compare these three methods, we generate 2000 sets of keys at error rates of $0.0068$, $0.0166$, and $0.0267$, respectively. The sampling rate of random sampling is set to 0.5. For any set of key, we use these methods to get three error rates. As shown in Fig. 3, it is clear that our method (black lines) is more accurate and stable than the random sampling (magenta lines) and the single-syndrome error estimation (red lines).

IV.2 Convergence Speed

For key reconciliation, since the faster the convergence speed is, the smaller the average number of iterations becomes, we evaluate the convergence speed of different algorithms by calculating their average numbers of iterations under different error rates. We first prepare a matrix for the single-matrix algorithms, then add four more matrices for the multi-matrix algorithms (see the next section for the detailed method of generating LDPC codes). At a certain error rate, we generate 100 sets of keys, perform each algorithm on the keys, and calculate the average number of iterations. The results are shown in Fig. 4. Clearly, under different error rates, the average numbers of iterations of the multi-matrix algorithms are significantly decreased compared with their single-matrix versions. MBP cuts down 43.15$\sim$46.06% of average iteration number of BP, while MLBP is 38.16$\sim$40.21% and MSBP is 47.87$\sim$53.38%.

We can further increase the convergence speed of the multi-matrix algorithms by adjusting two factors. One is the number of matrices used in reconciliation. We generate 100 sets of keys with error rate 0.0246, run the multi-matrix algorithms with different number of matrices to correct these keys. The relationship between the average number of iterations and the number of matrices is plotted in Fig. 5. Clearly, the average number of iterations and the number of matrices are inversely proportional.

Another factor is the number of waves. The variable nodes with larger degrees can get more information, thus can be corrected earlier and can provide useful information to help other variable nodes. This process spreads from large-degree to small-degree variable nodes, behaving like a wave, so it is called the wave effect Luby et al. (2001). For a multi-matrix algorithm, the multiple waves can be formed simultaneously to correct errors. We refer this phenomenon as the multi-wave effect, which obviously leads to faster convergence speed. However, if the waves are close to each other, they spread as one wave. This greatly discounts the performance of the multi-wave effect. On the contrary, if the large-degree variable nodes are dispersed in different matrices, the multiple waves spread and correct errors at the same time, resulting in faster convergence speed. We construct $5$ matrices with close waves to compare with $5$ matrices with separated ones, and plot the results in Fig. 6. Clearly, the algorithms using matrices with separated waves outperform the others.

Therefore, our strategy can significantly improve the convergence speed compared with the single-matrix reconciliation, and the speed can be further improved if Bob uses more or designs better matrices.

IV.3 Success Rate

The success rate of reconciliation may be negatively impacted by the cycles. For example, suppose Alice’s sifted key is $x^{T}=[1,0,1,0,1]$, Bob’s sifted key is $y^{T}=[1,0,0,0,1]$, the error rate $e$ is 0.2, LDPC code has $5$ variable nodes labeled as $\{v_{1},\dots,v_{5}\}$ and $4$ check nodes denoted as $\{c_{1},\dots,c_{4}\}$. As shown in Fig. 7 (a), in LDPC code there is a 4-member cycle which is represented by a blue circle and red edges, respectively. If Bob uses BP algorithm to correct the key, the reconciliation is failed in each iteration. It is because that there is always a difference between the signs of soft-decision values of $v_{2}$ and $v_{4}$. Therefore, they cannot be decoded as $1$ at the same time. The 4-member cycle makes new information always be excluded and old information always loop in the cycle. Thus, as recorded in Tab. 1, no matter how large the upper limit of iterations is, the single-matrix reconciliation always fails.

However, as shown in Fig. 7 (b), if Bob adds two matrices to correct the key, since there are no cycle between $v_{2}$ and $v_{4}$ in the new matrices, the data of the new matrices help $v_{2}$ and $v_{4}$ break out of the 4-member cycle, resulting in a successful reconciliation. As shown in Tab. 2, MBP correct the error within two iterations.

We carry out a test to fully represent the performance of reducing the impact of cycles. In this test, we generate 1000 sets of keys with error rate 0.0275, perform the 6 reconciliation algorithms on the generated keys, and calculate the success rate. As shown in Fig. 8, the average success rate of the multi-matrix algorithms is 96.33%, nearly double that, 48.83%, of the single-matrix algorithms.

IV.4 Bit Error Rate

Compared with the single-matrix reconciliation, the multi-matrix algorithms decode the key according to information provided by multiple matrices. The decoding results are more accurate and reliable. We generate 100 sets of keys with error rate 0.0267, perform BP and MBP on the generated keys to calculate the number of corrected bits $N_{c}$ and the number of misjudged bits $N_{m}$ in each iteration, and plot the valid number of corrected bits $N_{c}-N_{m}$ in Fig. 9. We can see that MBP can correct more errors in each iteration, and most of the errors are corrected at the beginnings of the iterations. It achieves faster convergence speed and lower BER compared with BP.

To further evaluate the BER performances of the multi-matrix algorithms, five QBER values ranging from 0.0202 to 0.0256 are selected. At each error rate, we generate 1000 sets of keys, perform 5-matrix algorithms and their single-matrix versions on these generated keys. After 5 iterations, we calculate BERs of different algorithms according to the following equation,

[TABLE]

and draw the results in Fig. 10. It is obvious that all three multi-matrix algorithms achieve lower BERs under different error rates compared with their single-matrix versions. For example, the BER of SBP is 0.0030832 when the error rate is 0.0202, while MSBP is 0.0000045, between which there is a difference of 3-order magnitude.

V Conclusion

In this paper, a highly efficient error reconciliation protocol for QKD is proposed, whose core is using likelihood of multiple syndromes obtained from multiple LDPC codes for QBER estimation and correction. Security analysis and multi-matrix construction method are provided. Evaluation results show that the proposed approach allows improving the accuracy of QBER estimation in contract to previous works. Additionally, the scheme can greatly increase the convergence speed, success rate, and significantly improve the BER performance during key reconciliation without compromising the reconciliation efficiency and significant expenditure of authentication and time resources. Our findings can lower the complexity for post-processing procedure, thus will promote the commercialization of QKD.

VI Acknowledgements

This research is financially supported by the Major Program of National Natural Science Foundation of China (No. 11690030, 11690032, 11804153), the National Key Research and Development Program of China (No. 2017YFA0303700), the National Natural Science Foundation of China (No. 61771236), and the Excellence Research Program of Nanjing University. The authors are grateful to Wen-yuan Wang for valuable contribution.

Appendix A Appendix A

Security Analysis

The security of single-matrix reconciliation is guaranteed by the following theorems.

Theorem 1: Let $x$ and $z$ be Alice’s sifted key and syndrome, respectively. $H_{m\times n}$ is the matrix used in reconciliation. Once Eve gets $z$, she can extract at most $m$ bits of information about $x$, i.e.,

[TABLE]

Proof of Theorem: The amount of information that Eve can obtain from $z$ about $x$ is

[TABLE]

Assuming that Eve knows $H_{m\times n}$, she would obtain $z$ if she knows $x$, i.e.,

[TABLE]

When a random variables are in the equal probability distribution, the discrete entropy can reach the maximum value, so

[TABLE]

Theorem 2: If the random variable $X$ of Alice’s sifted key $x$ obeys uniform distribution, i.e.,

[TABLE]

then there are at least $t$ bits of information about $x$ unknown to Eve, even though she has obtained $z$, i.e.,

[TABLE]

where $t=n-m$.

Proof of Theorem: The random variable $X$ of Alice’s sifted key obeys uniform distribution, so

[TABLE]

From equations (19), (20), and (21), we derive

[TABLE]

According to Theorem 1 and Theorem 2, Eve can get at most $m$ bits information. Thus, if the $m$ bits is discarded during privacy amplification, the security of the key can be guaranteed.

Generally, Alice and Bob can use the following method to abandon the $m$ bits information leakage. If the matrix $H_{m\times n}$ has the following structure,

[TABLE]

where $H_{m\times t}^{{}^{\prime}}$ is a matrix which has $m$ rows and $t$ columns, $E_{m}$ is an m-order identity matrix, then $H_{m\times n}$ is called a system code. In other words, $m$ vectors of $E_{m}$ are linearly independent in $H_{m\times n}$. Under this circumstance, Alice can calculate and send the syndrome by

[TABLE]

From Theorem 1, we know that Eve can obtain at most $m$ bits of information about $x$. Assume these $m$ bits of information is $m$ bits of $x$. And for Eve, it is in her best interests if the $m$ bits of $x$ are $[x_{t+1},\cdots,x_{n}]^{T}$. Then Eve has to solve a underdetermined system of equation, which has no unique solution. Moreover, after Alice and Bob discard the $m$ bits key $[x_{t+1},\cdots,x_{n}]^{T}$, Eve cannot even form the system of equation and get any information about $[x_{1},\cdots,x_{t}]^{T}$, even if she knows $H_{m\times t}^{{}^{\prime}}$ and $z$.

If the matrix $H_{m\times n}$ is a non-system code, a system code can be formed by a series of elementary row transformations and column exchanges based on

[TABLE]

where A is a m-order invertible square matrix representing a whole train of primary row transformation. B is a n-order square matrix representing a series of column exchanges. Denote ${z^{{}^{\prime}}}^{T}={(A^{-1}\cdot z)}^{T}=[z_{1}^{{}^{\prime}},\cdots,z_{m}^{{}^{\prime}}]$ and ${x^{{}^{\prime}}}^{T}={(B\cdot x)}^{T}=[x_{1}^{{}^{\prime}},\cdots,x_{n}^{{}^{\prime}}]$, then

[TABLE]

Similarly, after Alice and Bob abandon the $m$ bits key $[x_{t+1}^{{}^{\prime}},\cdots,x_{n}^{{}^{\prime}}]^{T}$, even if Eve knows $H_{m\times t}^{{}^{\prime}}$ and $z^{{}^{\prime}}$, she will not be able to get any information about $[x_{1}^{{}^{\prime}},\cdots,x_{t}^{{}^{\prime}}]^{T}$.

From the above analysis, we can see that if we first select $m$ linearly independent columns in $H_{m\times n}$, then discard the corresponding bits of these columns, the $m$ bits information leakage can be removed, thus ensuring the security of the key. Therefore, we design a multiple matrices construction method as shown in the Appendix B. And all matrices used in the simulation are prepared according to the the method.

Through the above method, we can construct a series of matrices $(H_{1},\cdots,H_{u})$ of the same size. Let $H_{i}$ and $H_{j}$ denote any two matrices from $(H_{1},\cdots,H_{u})$. They can be represented as follows:

[TABLE]

[TABLE]

Their syndromes $z^{{}^{\prime}i}$ and $z^{{}^{\prime}j}$ can be represented as:

[TABLE]

[TABLE]

More precisely, ${z^{{}^{\prime}i}}^{T}={(A_{i}^{-1}\cdot z^{i})}^{T}=[z_{1}^{{}^{\prime}i},\cdots,z_{m}^{{}^{\prime}i}]$, ${x^{{}^{\prime}i}}^{T}={(B_{i}\cdot x)}^{T}=[x_{1}^{{}^{\prime}i},\cdots,x_{n}^{{}^{\prime}i}]$, ${z^{{}^{\prime}j}}^{T}={(A_{j}^{-1}\cdot z^{j})}^{T}=[z_{1}^{{}^{\prime}j},\cdots,z_{m}^{{}^{\prime}j}]$, and ${x^{{}^{\prime}j}}^{T}={(B_{j}\cdot x)}^{T}=[x_{1}^{{}^{\prime}j},\cdots,x_{n}^{{}^{\prime}j}]$. From the above matrices construction method, we can see that $[x_{t+1}^{{}^{\prime}i},\cdots,x_{n}^{{}^{\prime}i}]$ and $[x_{t+1}^{{}^{\prime}j},\cdots,x_{n}^{{}^{\prime}j}]$ are not equal, but their corresponding variable nodes sets are the same. Similarly, assume Eve knows $[x_{t+1}^{{}^{\prime}i},\cdots,x_{n}^{{}^{\prime}i}]$ and $[x_{t+1}^{{}^{\prime}j},\cdots,x_{n}^{{}^{\prime}j}]$, then she has to solve the system of equation. Because $H_{i}$ and $H_{j}$ are construct with the method in the Appendix B, the two sets of underdetermined systems of equation in equations (33) and (34) are the same. In other word, it is impossible to form a determined or overdetermined system of equation. After Alice and Bob discard those $m$ bits, even if Eve knows $H_{i}$, $H_{j}$, $z^{i}$, and $z^{j}$, she cannot obtain any information about $[x_{1}^{{}^{\prime}i},\cdots,x_{t}^{{}^{\prime}i}]$ and $[x_{1}^{{}^{\prime}j},\cdots,x_{t}^{{}^{\prime}j}]$. In fact, any two matrices constructed by this method will not reveal extra information during reconciliation. Accordingly, in the case of reconciliation with more than two matrices, because the discarded $m$ bits information is corresponding to the same $m$ linearly independent columns, multiple syndromes transmitted through the classical channel do not reveal extra information, i.e.

[TABLE]

then we get

[TABLE]

where $Z=\{z^{1},z^{2},\cdots,z^{u}\}$. Therefore, if Alice and Bob use our method to construct matrices, they can guarantee the security of the key, i.e., guarantee the security of the multi-matrix post-processing.

Appendix B Appendix B

Multiple Matrices Construction Method

The first LDPC matrix called $H_{1}$ is constructed; 2. 2.

By a series of elementary row transformation and column exchanges, $H_{1}$ is transformed into a system code, such that $m$ linearly independent columns can be determined. These columns correspond to variable nodes $[v_{(1)},\cdots,v_{(m)}]$ in $H_{1}$. Let the remaining variable nodes be $[v_{[1]},\cdots,v_{[t]}]$; 3. 3.

The rest $u-1$ parity check matrices $(H_{2},\cdots,H_{u})$ can be constructed based on $H_{1}$: First, rearrange the columns of the variable nodes $[v_{(1)},\cdots,v_{(m)}]$ in $H_{1}$. Then rearrange the columns of the variable nodes $[v_{[1]},\cdots,v_{[t]}]$ in $H_{1}$. It’s clear that the set of the positions of linearly independent columns, in this way, is identical to each other for all of the $u$ matrices.

Appendix C Appendix C

Pseudocode of MBP, MSBP and MLBP

MBP algorithm

1:$Initialize\ L_{v_{i}\to c_{j}}^{k}=L_{P_{i}}^{k}$

2:for $every\ parity\textrm{-}check\ matrix\ H_{k}$ do

3:     for $j=1$ to $m$ do

4:         for $every\ v_{i}^{k}\in neighborhood\ of\ c_{j}^{k}$ do

5:              $Generate\ and\ propagate\ L_{c_{j}\to v_{i}}^{k}$

6:         end for

7:     end for

8:     for $i=1$ to $n$ do

9:         for $every\ c_{j}^{k}\in neighborhood\ of\ v_{i}^{k}$ do

10:              $Generate\ and\ propagate\ L_{v_{i}\to c_{j}}^{k}$

11:         end for

12:     end for

13:end for

14:$Make\ decoding\ decisions$

15:if $stopping\ rule\ is\ not\ satisfied$ then

16:     $Go\ back\ to\ line\ 2$

17:end if

MSBP algorithm

1:$Initialize\ L_{v_{i}\to c_{j}}^{k}=L_{P_{i}}^{k}$

2:for $every\ parity\textrm{-}check\ matrix\ H_{k}$ do

3:     for $i=1$ to $n$ do

4:         for $every\ c_{j}^{k}\in neighborhood\ of\ v_{i}^{k}$ do

5:              $Generate\ and\ propagate\ L_{c_{j}\to v_{i}}^{k}$

6:         end for

7:         for $every\ c_{j}^{k}\in neighborhood\ of\ v_{i}^{k}$ do

8:              $Generate\ and\ propagate\ L_{v_{i}\to c_{j}}^{k}$

9:         end for

10:     end for

11:end for

12:$Make\ decoding\ decisions$

13:if $stopping\ rule\ is\ not\ satisfied$ then

14:     $Go\ back\ to\ line\ 2$

15:end if

MLBP algorithm

1:$Initialize\ L_{v_{i}\to c_{j}}^{k}=L_{P_{i}}^{k}$

2:for $every\ parity\textrm{-}check\ matrix\ H_{k}$ do

3:     for $j=1$ to $m$ do

4:         for $every\ v_{i}^{k}\in neighborhood\ of\ c_{j}^{k}$ do

5:              $Generate\ and\ propagate\ L_{c_{j}\to v_{i}}^{k}$

6:              for $every\ c_{l}^{k}\in neighborhoodof\ v_{i}^{k}\ except\ c_{j}^{k}$ do

7:                  $Generate\ and\ propagate\ L_{v_{i}\to c_{l}}^{k}$

8:              end for

9:         end for

10:     end for

11:end for

12:$Make\ decoding\ decisions$

13:if $stopping\ rule\ is\ not\ satisfied$ then

14:     $Go\ back\ to\ line\ 2$

15:end if