Rate-Adaptive Information Reconciliation for CV-QKD Systems at Low Signal-to-Noise Ratios

Abstract

In continuous-variable quantum key distribution (CV-QKD) systems, information reconciliation (IR) is a crucial step that significantly affects the secret key rate (SKR). The fixed-rate error-correcting codes used in IR are highly sensitive to changes in the signal-to-noise ratio (SNR) and cannot maintain a high reconciliation efficiency in practical CV-QKD systems. To address this issue, we first propose a rate-adaptive IR protocol, namely Threshold-based IR (TIR), which changes the code rate of low-density parity-check (LDPC) codes by selectively revealing bits with lower reliability and adjusting their log-likelihood ratios (LLRs). Then, we propose a rate-adaptive IR protocol, namely Sorting-based IR (SIR), which not only adjusts the code rate according to variations in SNR, but also enables the CV-QKD systems to achieve high reconciliation efficiency over a wide range of SNRs. Furthermore, we perform an analysis of the protocols in terms of code rate, reconciliation efficiency, and complexity. The simulation results demonstrate that the proposed protocols outperform other rate-adaptive IR protocols, achieving a reconciliation efficiency higher than 98.5% in the SNR range below −20 dB and maintaining a certain SKR in long-distance transmission.

1. Introduction

Quantum key distribution (QKD) [1,2,3] is among the most practical implementations of quantum-information technologies, enabling two spatially separated parties, Alice and Bob, to share random keys in an untrusted environment and theoretically guaranteeing unconditional security [4]. Currently, QKD technology falls into two mainstream types: discrete-variable QKD (DV-QKD) [1,2] and continuous-variable QKD (CV-QKD) [5]. In DV-QKD systems, key information is used to encode the polarization or phase of a single-photon state; in contrast, in CV-QKD systems, the encoding process targets the amplitude and phase quadrature states [6]. CV-QKD systems have attracted considerable research interest due to their compatibility with conventional telecommunication infrastructure [7]. Recent studies have mainly focused on enhancing secure transmission distances and optimizing the secret key rate (SKR) in CV-QKD systems [8,9].

Quantum transmission and post-processing make up a typical CV-QKD system [8]. Bob uses a homodyne or heterodyne detector to test quantum states at random during the quantum transmission [10]. Base sifting [11], parameter estimation [12], information reconciliation (IR) [13,14], and privacy amplification [15] are the four primary processes of post-processing, which is used to obtain secret keys from both parties. Among these, IR is considered the primary technical bottleneck, limiting the transmission distance and the SKR of the system. Ongoing research aims to improve reconciliation efficiency and reduce the frame error rate (FER), thereby improving the SKR [16]. Currently, slice reconciliation [17] and multidimensional reconciliation [18] are currently widely utilized reconciliation techniques.

Considering finite-size effects [12], high-performance error-correcting codes with long block lengths are typically employed in IR to achieve a high reconciliation efficiency. Specifically, multi-edge-type low-density parity-check (MET-LDPC) codes [19,20], as a generalization of LDPC codes [20], have demonstrated near-Shannon-limit performance, which can achieve a high reconciliation efficiency at low signal-to-noise ratios (SNRs). However, fixed-rate LDPC codes cannot maintain a high reconciliation efficiency under fluctuating SNR conditions in practical CV-QKD systems [6,21,22]. Raptor codes [23] and spinal codes [24] with the rateless property can achieve a high reconciliation efficiency over a wider range of SNRs, but require a higher decoding complexity compared to LDPC codes. The rate-adaptive LDPC codes in [16] maintain over 96% reconciliation efficiency by modifying a fixed-size parity-check matrix, though this fixed size is a limitation. The multiple decoding attempt (MDA) protocol was proposed [25], which reveals bits randomly after decoding failure to adjust log-likelihood ratios (LLRs), thereby changing the code rate. However, we follow the definition of bit reliability as proposed in [26], and it has been experimentally demonstrated that bits with lower reliability are significantly more likely to be erroneous, and thus are key contributors to decoding failure.

In this paper, we propose that selectively revealing bits with lower reliability and adjusting their LLRs can change the code rate of LDPC codes. To achieve this, we first introduce a rate-adaptive IR protocol named Threshold-based IR (TIR), where bits with lower reliability below a threshold $\theta$ are disclosed. Then, we propose a Sorting-based IR (SIR) protocol, through which bits are sorted by reliability, and the least reliable bits are selectively disclosed. The SIR protocol not only adjusts the code rate according to variations in SNRs, but also achieves high reconciliation efficiency across a wide range of SNRs.

The rest of the paper is structured as follows: In Section 2, we review the fundamentals of IR in brief. In Section 3, we introduce the proposed protocols in detail. In Section 4, we perform an analysis of the proposed protocols. The simulation results of our scheme are shown and analyzed in Section 5. Finally, we conclude this paper in Section 6.

2. Preliminaries

IR serves as a crucial procedure in CV-QKD systems, which aims to accomplish error correction while minimizing leakage the information of secret keys, thereby enabling the two communicating parties to acquire symmetric secret keys. IR can be categorized into two main types: direct reconciliation and reverse reconciliation [11]. Reverse reconciliation provides longer transmission distances and maintains a specific SKR during long-distance fiber optic communication at low SNRs, in contrast to direct reconciliation [27].

Multidimensional reverse reconciliation is a popular reconciliation technique for CV-QKD systems due to its superior reconciliation efficiency at low SNRs and low capacity loss. A schematic diagram of CV-QKD systems is presented in Figure 1. The general method of information reconciliation was proposed in [18] and improved in [6,16,28,29]. After going through the data sifting and parameter estimation steps, Alice and Bob obtain correlated quantum sequences $\mathbf{x}$ and $\mathbf{y}$; in this context, $\mathbf{y}=\mathbf{x}+\mathbf{z}$, with $\mathbf{z}$ standing for the quantum channel noise. Alice and Bob then split the sequences $\mathbf{x}$ and $\mathbf{y}$ into d-dimensional vectors, and proceed to normalize these vectors respectively.

Using a quantum random number generator (QRNG), Bob creates a secret key consisting of a random binary sequence $\mathbf{u}$. The encoder employs an error-correcting code to encode $\mathbf{u}$ into $\widehat{\mathbf{c}}$, and outputs side information that avoids revealing the secret key. To compute the mapping function $\mathbf{M}(\widehat{\mathbf{y}},\widehat{\mathbf{c}})$ that acts as part of the side information, we utilize the encoded sequence $\widehat{\mathbf{c}}$ and the normalized sequence $\widehat{\mathbf{y}}$. $\mathbf{M}(\widehat{\mathbf{y}},\widehat{\mathbf{c}})$ is an orthogonal transformation, defined as $\mathbf{M}(\widehat{\mathbf{y}},\widehat{\mathbf{c}})={\sum }_{i=1}^d{\alpha }_i(\widehat{\mathbf{y}},\widehat{\mathbf{c}}){\mathbf{A}}_i$, where ${\alpha }_i(\widehat{\mathbf{y}},\widehat{\mathbf{c}})=({\mathbf{A}}_i\widehat{\mathbf{y}}\mid \widehat{\mathbf{c}})$; the specific form of matrix ${\mathbf{A}}_i$ is available in [18]. Bob then uses a classical channel to send Alice this side information. After receiving $\mathbf{M}(\widehat{\mathbf{y}},\widehat{\mathbf{c}})$, Alice uses it together with the normalized sequence $\widehat{\mathbf{x}}$ to obtain $\mathbf{e}$ via data mapping. Subsequently, the LDPC code and sum-product algorithm are adopted to recover $\mathbf{e}$ into the sequence $\widehat{\mathbf{u}}$. Once the decoding process succeeds, Alice and Bob will share a symmetrical secret key.

The SKR of a CV-QKD system with one-way multidimensional reverse reconciliation, considering finite-size effects into account, is provided by  [10]

$$K_{\mathrm{finite}}={\displaystyle \frac{n}{N}}(1-P_e)\left[\beta I(A:B)-S_{{ϵ}_{\mathrm{PE}}}(B:E)-\mathrm{\Delta }\left(n\right)\right],$$

(1)

where N is the total amount of data that Alice and Bob exchanged, n is the amount of data that was used to extract the keys, and the remaining portion is used for parameter estimation. $P_e$ is the reconciliation FER, which is defined as the ratio of discarded secret keys to total secret keys. The reconciliation efficiency is measured by

$$\beta ={\displaystyle \frac{R}{C\left(s\right)}},$$

(2)

where R denotes the error-correcting code rate and $C\left(s\right)={\displaystyle \frac{1}{2}}{log}_2(1+s)$ represents the channel capacity when the SNR is set to s. $I(A:B)$ represents Alice and Bob’s classical mutual information. The maximum Holevo information that Eve can receive from Bob’s data is $S_{{ϵ}_{\mathrm{PE}}}(B:E)$, where ${ϵ}_{\mathrm{PE}}$ is the parameter estimate failure probability [29]. The finite-size offset factor is represented by $\mathrm{\Delta }\left(n\right)$. According to Equation (1), an imperfect reconciliation scheme leads to a reduction in the SKR and imposes limitations on the applicable range of the protocol.

3. The Proposed Protocols

In this section, we introduce two rate-adaptive IR protocols for CV-QKD systems, both of which are designed based on the principle of revealing bits with lower reliability. The schematic diagram of the protocols is shown in Figure 2.

3.1. Threshold-Based IR (TIR)

3.1.1. Threshold Selection

The TIR protocol involves setting a threshold $\theta$ for the reliability of the bits during the iterative decoding process. Here, define $L_i$ as the LLR of the i-th bit and define the reliability of the i-th bit as the absolute value of $L_i$, denoted as $|L_i|$. The determination of the threshold $\theta$ is precisely based on the reliability value $|L_i|$ difference between erroneous bits and correct bits. To clarify how this difference supports the selection of $\theta$, we verify this through a practical scenario: take a rate 0.02 LDPC code with SNR = −15.1 dB and analyze one hundred failed codewords. Histograms of reliability values $L_i$ for correct bits and erroneous bits after decoding failure are drawn in Figure 3a and Figure 3b, respectively. It is shown that the reliability value $|L_i|$ of erroneous bits is obviously smaller than that of most correct bits, which can be used to distinguish them efficiently. Hence, for a failed codeword, one can set a suitable threshold $\theta$. If the reliability value $\left|L_i\right|<\theta$, the corresponding bits are classified into the set of suspicious bits, which have a high probability of being erroneous bits and are selected to be revealed.

3.1.2. TIR Protocol

In this paper, we adopt multidimensional reverse reconciliation. Alice and Bob both have correlated Gaussian sequences, $\mathbf{x}$ and $\mathbf{y}$, which satisfy $\mathbf{x}\sim N{\left(0,{\sigma }_{\mathbf{x}}^2\right)}^d$ on Euclidean space ${\mathbb{R}}^d$ and $\mathbf{y}=\mathbf{x}+\mathbf{z}$, where $\mathbf{z}\sim N{\left(0,{\sigma }_{\mathbf{z}}^2\right)}^d$ and d indicates the multidimensional IR dimension. Subsequently, they normalize $\mathbf{x}$ and $\mathbf{y}$ into $\widehat{\mathbf{x}}$ and $\widehat{\mathbf{y}}$, where $\widehat{\mathbf{x}}=\mathbf{x}/\left|\right|\mathbf{x}\left|\right|$ and $\widehat{\mathbf{y}}=\mathbf{y}/\left|\right|\mathbf{y}\left|\right|$. Here $\left|\right|·\left|\right|$ denotes a norm of a vector. The uniform distribution of the sequences $\widehat{\mathbf{x}}$ and $\widehat{\mathbf{y}}$ is satisfied by their distribution on the surface of the unit sphere $S^{d-1}$, which centers on zero.

Using the QRNG, Bob generates a binary sequence $\mathbf{u}$. He then employs LDPC encoding to produce the codeword $\mathbf{c}$. However, in order to adapt $\mathbf{c}$ for multidimensional reconciliation, $\mathbf{c}$ must be converted into a binary spherical sequence $\widehat{\mathbf{c}}$ by

$$\widehat{c}=\left(\widehat{c_1},\widehat{c_2},\dots ,\widehat{c_d}\right)\to \left({\displaystyle \frac{{(-1)}^{c_1}}{\sqrt{d}}},{\displaystyle \frac{{(-1)}^{c_2}}{\sqrt{d}}},\dots ,{\displaystyle \frac{{(-1)}^{c_d}}{\sqrt{d}}}\right).$$

(3)

After acquiring $\widehat{\mathbf{y}}$ and $\widehat{\mathbf{c}}$, Bob uses $\widehat{\mathbf{y}}$ and $\widehat{\mathbf{c}}$ to compute $\mathbf{M}(\widehat{\mathbf{y}},\widehat{\mathbf{c}})$, also known as the mapping function. This mapping function satisfies the following condition: $\mathbf{M}(\widehat{\mathbf{y}},\widehat{\mathbf{c}})·\widehat{\mathbf{y}}=\widehat{\mathbf{c}}$. Bob transmits $\mathbf{M}(\widehat{\mathbf{y}},\widehat{\mathbf{c}})$ to Alice through the classical channel. Then, Alice transforms $\widehat{\mathbf{x}}$ into $\mathbf{e}$ using the mapping function $\mathbf{e}=\mathbf{M}(\widehat{\mathbf{y}},\widehat{\mathbf{c}})·\widehat{\mathbf{x}}$.

Alice uses the parity-check matrices of the LDPC code and sum-product algorithm to recover sequence $\mathbf{e}$ into sequence $\widehat{\mathbf{u}}$. During the iterative decoding process, while calculating the LLR, Alice sets a threshold $\theta$ for $\left|L_i\right|$. She identifies the set of indices $\mathcal{I}=\{i\mid |L_i|<\theta \}$ and sends $\mathcal{I}$ to Bob.

Bob determines the values of the bits in $\mathcal{I}$ and returns the values to Alice. If Bob confirms that the i-th bit is 1, Alice sets $L_i$ to a large negative value, thereby forcing the bit to be interpreted as 1 in subsequent iterations. Conversely, if Bob confirms that the i-th bit is 0, Alice sets $L_i$ to a large positive value, thereby forcing the bit to be interpreted as 0 in subsequent iterations. Alice continues the iterative decoding with the modified LLRs. If the decoding process is successful, Alice and Bob will possess symmetric secret keys, which are retained for final secret keys; if decoding fails, the secret keys are discarded outright to ensure the absolute security of the final secret keys.

Finally, privacy amplification decreases the information leakage that occurs through the preceding quantum and raw key generation processes. The final secret keys can thus be established by Alice and Bob using a robust randomness extraction protocol.

3.2. Sorting-Based IR (SIR)

The SIR protocol for revealing bits with lower reliability involves sorting the $\left|L_i\right|$ during the iterative decoding process and selecting a certain number of bits with lower reliability for disclosure. This protocol effectively enables adaptive reconciliation. Before IR, Alice and Bob calculate the optimal code rate $R_{\mathrm{SIR}}$ based on the time-varying SNR of the quantum channel. Then, they select a high-performance original LDPC code whose code rate is close to $R_{\mathrm{SIR}}$. Typically, the original LDPC code rate is defined as

$$R_0={\displaystyle \frac{n-m}{n}}.$$

(4)

Here, m and n correspond to the number of rows and columns of the LDPC parity-check matrix $\mathbf{H}$, respectively. Subsequently, to achieve the target reconciliation efficiency, it is necessary to reveal $l_{\mathrm{SIR}}$ bits with lower reliability so that the original code rate equals the optimal code rate. This relationship is formulated as

$$R_{\mathrm{SIR}}={\displaystyle \frac{(n-l_{\mathrm{SIR}})-m}{n-l_{\mathrm{SIR}}}}={\displaystyle \frac{n-m-l_{\mathrm{SIR}}}{n-l_{\mathrm{SIR}}}}.$$

(5)

In the SIR protocol, the main differences from the TIR protocol are as follows: Alice uses LDPC decoding to recover sequence $\mathbf{e}$ into sequence $\widehat{\mathbf{u}}$. During the iterative decoding process, while calculating the LLR, Alice takes the $\left|L_i\right|$ and sorts them in ascending order. Then, Alice identifies the indices $i_1,i_2,\dots ,i_{l_{\mathrm{SIR}}}$ corresponding to the $l_{\mathrm{SIR}}$ smallest values, such that $|L_1| \le |L_2| \le \dots \le |L_{l_{\mathrm{SIR}}}|$. She constructs the index set $\mathcal{I}=\{i_1,i_2,\dots ,i_{l_{\mathrm{SIR}}}\}$ and sends $\mathcal{I}$ to Bob.

4. Analysis of the TIR and SIR Protocols

In this section, we perform an analysis of the TIR and SIR protocols, focusing on their code rate, reconciliation efficiency, and complexity.

4.1. Code Rate

In CV-QKD, we need rate-adaptive and high-efficiency codes since errors must be efficiently corrected at low SNRs to increase the SKR and the secure transmission distance. The TIR protocol identifies bits with lower reliability using the threshold $\theta$: bits with reliability $|L_i| <\theta$ are selected for revelation. Thus, the code rate is calculated as

$$R_{\mathrm{TIR}}={\displaystyle \frac{(n-l_{\mathrm{TIR}})-m}{n-l_{\mathrm{TIR}}}}={\displaystyle \frac{n-m-l_{\mathrm{TIR}}}{n-l_{\mathrm{TIR}}}},$$

(6)

where $l_{\mathrm{TIR}}$ denotes the number of revealed bits and depends on both the threshold $\theta$ and the channel SNR. This results in a passive rate adjustment: $l_{\mathrm{TIR}}$ varies with SNRs, since more bits have $|L_i| <\theta$ at low SNRs, which increases $l_{\mathrm{TIR}}$ and lowers $R_{\mathrm{TIR}}$. However, in the SIR protocol, rate-adaptive adjustment of the code rate is achieved by adjusting the number of disclosed bits with lower reliability according to variations in SNRs. Specifically, it first sorts the bits in descending order of their reliability $|L_i|$ and then calculates the optimal code rate $R_{\mathrm{SIR}}$, which is given by $R_{\mathrm{SIR}}=\beta ·C\left(s\right)$ using Equation (2). Finally, to ensure that the original code rate $R_0$ is equal to $R_{\mathrm{SIR}}$, we reveal $l_{\mathrm{SIR}}$ bits with lower reliability. According to Equation (5), the $l_{\mathrm{SIR}}$ is calculated as

$$l_{\mathrm{SIR}}={\displaystyle \frac{(n-m)-R_{\mathrm{SIR}}·n}{1-R_{\mathrm{SIR}}}}.$$

(7)

Algorithm 1 demonstrates the code rate calculation process of the SIR protocol. In summary, both the TIR and SIR protocols proposed in this paper can achieve adaptive adjustment of the code rate.

Algorithm 1 The code rate calculation process of the SIR protocol.

Step 1 Obtain the channel capacity C(s) based on the practical SNR.

Step 2 Determine the target reconciliation efficiency $\beta$.

Step 3 Sort the bits in descending order of reliability $|L_i|$.

Step 4 Obtain the optimal code rate $R_{SIR}$ using Equation (2).

Step 5 Determine the $l_{SIR}$ to disclose $R_0\to R_{SIR}$ using Equation (7).

4.2. Reconciliation Efficiency

A higher reconciliation efficiency is required at low SNRs in order to meet the criterion that the SKR is greater than zero. From Equation (2), we know that the code rate is the major factor affecting reconciliation efficiency. Thus, in the TIR protocol, the reconciliation efficiency is defined by Equations (2) and (6) as

$${\beta }_{\mathrm{TIR}}={\displaystyle \frac{R_{\mathrm{TIR}}}{C\left(s\right)}}={\displaystyle \frac{n-m-l_{\mathrm{TIR}}}{(n-l_{\mathrm{TIR}})·C\left(s\right)}}.$$

(8)

Additionally, it can also be derived from Equation (2) that under various SNRs, fixed-rate error-correcting codes are unable to sustain high reconciliation efficiency. However, the SIR protocol adjusts the code rate according to variations in SNRs to achieve high reconciliation efficiency across a wide range of SNRs. To be specific, we first set a target reconciliation efficiency, denoted as ${\beta }_{\mathrm{target}}$. Then, we determine the optimal code rate $R_{\mathrm{SIR}}$ under a given SNR based on Equation (2). Finally, we calculate the number of bits with lower reliability to be disclosed using Equation (7), such that the original code rate $R_0$ is adjusted to the optimal code rate $R_{\mathrm{SIR}}$, thereby achieving a high reconciliation efficiency.

4.3. Complexity

We conduct an analysis of the time complexity and space complexity for the TIR and SIR protocols. The time complexity $\mathcal{O}\left(f\right(\alpha \left)\right)$ and space complexity $\mathcal{O}\left(g\right(\alpha \left)\right)$ are defined as the asymptotic time cost and storage cost of an algorithm, respectively, both of which are associated with the algorithm’s scale, and specifically described using the $\mathcal{O}$-notation [30]. In this context, $f\left(\alpha \right)$ and $g\left(\alpha \right)$ are functions that characterize the growth rates of running time of the algorithm and storage demand, with both dependent on the input size $\alpha$. According to the notations above, the time complexity of the TIR protocol is $\mathcal{O}\left(n\right)$, since it only requires comparator operations to determine if satisfies $|L_i| <\theta$. The computational cost thus grows linearly with the block length n, and the dominant factor is the number of decoding iterations. In comparison, the SIR protocol requires an additional sorting of the reliability. A direct sorting implementation has complexity $\mathcal{O}(nlogn)$, which increases with the block length more rapidly than the TIR protocol. In terms of space complexity, both protocols scale linearly with the block length. For the TIR protocol, the memory requirement is minimal, involving only the storage of indices of revealed bits. The SIR protocol requires additional buffers to store sorted indices and to compute the number of disclosed bits, which leads to slightly higher memory usage but still of linear order. In addition, we analyzed the complexity of other rate-adaptive reconciliation protocols, including the Raptor and MDA protocols. Raptor codes consist of an outer pre-code and an inner Luby transform (LT) code. Therefore, the two-stage architecture also presents challenges. For the Raptor protocol, the complexity of precoding increases dramatically with block length, making it unsuitable for practical applications at low SNRs [8]. Furthermore, LT code decoding requires dynamic symbol generation and confidence propagation, resulting in a complexity of $\mathcal{O}(nlogn)$, exceeding that of LDPC-based protocols. The MDA protocol, while sharing the $\mathcal{O}\left(n\right)$ complexity of the TIR protocol for random bit revelation, may require multiple decoding attempts, which multiplies the base complexity. Overall, both the TIR and SIR protocols maintain a linear order of computational and storage complexity, providing positive implications for the practical implementation of CV-QKD systems.

5. Simulation Results

In this section, we study the performance of the proposed TIR and SIR protocols, focusing on reconciliation efficiency, FER, and the SKR. We employ MET-LDPC codes in our simulations. For MET-LDPC codes, different types of edges have independent degree distribution functions. Here, the degree refers to the number of edges connected to variable nodes or check nodes. The detailed degree distribution we use in this paper is shown in

Table 1. The degree distribution of MET-LDPC codes.

Code Rate	Degree Distribution
0.1	$\nu (r,x)=0.0775r_1{x}_1^{20}{x}_2^{20}+0.0475r_1{x}_1^3{x}_2^{22}+0.875r_1{x}^3$
	$\mu \left(x\right)=0.0025x_1^{11}+0.0225x_1^{12}+0.03x_2^2{x}_3+0.845x_2^3{x}_3$
0.05	$\nu (r,x)=0.04r_1{x}_1^{21}{x}_2^{34}+0.03r_1{x}_1^3{x}_2^{34}+0.93r_1{x}^3$
	$\mu \left(x\right)=0.01x_1^8+0.01x_1^9+0.41x_2^2{x}_3+0.52x_2^3{x}_3$
0.02	$\nu (r,x)=0.0225r_1{x}_1^2{x}_2^{57}+0.0175r_1{x}_1^3{x}_2^{57}+0.96r_1{x}_3$
	$\mu \left(x\right)=0.010625x_1^3+0.009375x_1^7+0.6x_2^2{x}_3+0.36x_2^3{x}_3$

, where $\nu (r,x)$ denotes the generating polynomial for the variable node types and $\mu \left(x\right)$ denotes the generating polynomial for the check node types. For more information about the degree distribution of MET-LDPC codes, refer to [9]. The dimension d of multidimensional reconciliation is set to 8 in the simulation that follows.

Figure 4 illustrates the FER performance comparison between the TIR protocol with threshold-based bit revelation and a baseline strategy that randomly reveals the same number of bits, where the 0.02 MET-LDPC code, as presented in Table 1, is used in the comparison. As observed, the method of setting the threshold $\theta$ to reveal bits consistently outperforms random revelation in the SNR range from −15.4 to −14.9 dB. This demonstrates that selectively revealing bits with $\left|L_i\right|<\theta$ significantly enhances decoding performance and reduces the FER at low SNRs.

Figure 5 shows the FER performance of the SIR protocol compared with the MDA protocol [25] under varying bit revelation ratios at SNR = −15.23 dB. In the proposed SIR protocol, bits are sorted according to $\left|L_i\right|$, and the least reliable ones are selectively revealed. In contrast, the MDA protocol randomly reveals bits for LLR adjustment after decoding failure. As shown in the Figure 5, the proposed SIR protocol consistently achieves a lower FER across all tested revelation ratios. Specifically, when the bit revelation ratio exceeds 6%, the FER of the SIR protocol drops below 0.01, while the MDA protocol still maintains a relatively high FER of around 0.08. This clearly demonstrates that the proposed protocol, which reveals bits with lower reliability, outperforms the MDA protocol [25] with random bit disclosure.

To further study the performance of our proposed SIR protocol at low SNRs, we compare the FER with the Raptor protocol in reference [6], as shown in Figure 6. The target reconciliation efficiency is set to 96% in the SNR range of −18 and −13 dB, and 95% of −12 to −10 dB. As shown in

Table 2. The detailed results of the SIR protocol.

${\mathit{R}}_0$	SNR (dB)	${\mathit{l}}_{\mathbf{SIR}}$	${\mathit{R}}_{\mathbf{SIR}}$
0.02	−18	9210	0.01089
	−17	6408	0.01368
	−16	2869	0.01718
0.05	−15	29,069	0.02156
	−14	23,605	0.02703
	−13	16,700	0.03387
	−12	8421	0.04193
0.1	−11	1005	0.05238
	−10	742	0.06531

, we evaluate the number of revealed bits $l_{\mathrm{SIR}}$ to convert the original code rate $R_0=$ 0.02, 0.05, 0.1 into the optimal code rate $R_{\mathrm{SIR}}$ under various SNR conditions, in order to maintain the target reconciliation efficiency. Although Figure 6 shows the FER is relatively high, this is a reasonable trade-off to achieve high reconciliation efficiency at low SNRs. Therefore, the simulation results demonstrate that all points (FER < 1) have the desired reconciliation efficiency. In the SNR range between −18 and −10 dB, the SIR protocol has a smaller FER, indicating a greater SKR.

Figure 7 presents the finite-size SKR results of the SIR protocol for a CV-QKD system with one-way reverse reconciliation. In practice, the modulation variance $V_A$ is applied to approximate the theoretical ideal value by adjusting it in real time based on various channel characteristics. Nevertheless, it is not feasible to obtain simulation results covering the full SNR range from −20 to −10 dB. Thus, we simulate the reconciliation efficiency at low SNRs and present the simulation in Figure 7. Specifically, Figure 7 shows the finite-size SKR results for a block length of $N={10}^{12}$ at SNRs of −20, −18, −16, −14, −12, and −10 dB, respectively, while also providing the corresponding asymptotic theoretical SKR. The SKR of our adaptive SIR protocol is calculated using Equation (1), and other parameters remain consistent with those in reference [6]. Given that some bits are used for parameter estimation, we designate half of the bits for parameter estimation and the other half for symmetric secret key extraction ($n=N/2$) in IR. The simulation results indicate that when the FER of reconciliation is 0.99, the SIR protocol can achieve a reconciliation efficiency of 98.5%, with a theoretical transmission distance exceeding 165 km.

6. Conclusions

In this paper, we proposed two rate-adaptive IR protocols for CV-QKD systems, which dynamically adjusted the code rate and improved reconciliation efficiency at low SNRs. The TIR protocol disclosed bits with $\left|L_i\right|<\theta$, while the SIR protocol revealed a fixed number of the least reliable bits, allowing dynamic adjustment of the code rate to the time-varying nature of the quantum channel of CV-QKD systems. The analysis demonstrated the overall effectiveness of the proposed TIR and SIR protocols in terms of key metrics including code rate, reconciliation efficiency, and complexity. The simulation results showed that selectively revealing bits with lower reliability outperformed randomly revealing bits. Moreover, the SIR protocol reduced the FER and improved reconciliation efficiency, achieving high reconciliation efficiency over a wide range of SNRs and even attaining over 98.5% efficiency when the SNR dropped below −20 dB. Furthermore, the relationship between the finite-size SKR and transmission distance confirmed the superiority of our scheme. Our work may contribute to the development of practical applications for CV-QKD systems.