Low-Dimensional Reconciliation for Continuous-Variable Quantum Key Distribution

We propose an eﬃcient logical layer-based reconciliation method for continuous-variable quantum key distribution (CVQKD) to extract binary information from correlated Gaussian variables. We demonstrate that by operating on the raw-data level, the noise of the quantum channel can be corrected in the low-dimensional (scalar) space and the reconciliation can be extended to arbitrary dimensions. The CVQKD systems allow an unconditionally secret communication over standard telecommunication networks. To exploit the real potential of CVQKD a robust reconciliation technique is needed. It is currently unavailable, which makes it impossible to reach the real performance of the CVQKD protocols. The reconciliation is a post-processing step separated from the transmission of quantum states, which is aimed to derive the secret key from the raw data. The reconciliation process of correlated Gaussian variables is a complex problem that requires either tomography in the physical layer that is intractable in a practical scenario, or high-cost calculations in the multidimensional spherical space with strict dimensional limitations. To avoid these issues we deﬁne the low-dimensional reconciliation. We prove that the error probability of one-dimensional reconciliation is zero in any practical CVQKD scenario, and provides unconditional security. The results allow to signiﬁcantly improve the currently available key rates and transmission distances of CVQKD.


Introduction
The QKD (Quantum Key Distribution) systems represent one of the most important practical applications of quantum information theory [1][2][3][4][5][6][7][8][9][10][11], [49][50][51][52][53].The QKD schemes allow to establish an unconditionally secret communication between distant parties by exploiting the fundamental attributes of quantum mechanics [10][11][12][13][14], [34][35][36][37][38][39][40][41][42], [46][47][48][49][50][51][52][53].The QKD protocols can be classified into three main classes [1][2][3][4][5][6][7][8][9][10][11], [49][50][51][52][53]: DVQKD (Discrete-Variable), CVQKD (Continuous-Variable) and DPR-QKD (Differential Phase Reference) systems.The firstly introduced QKD protocols were based on discrete variables, such as photon polarization.Since the polarization of single photons cannot be encoded and decoded efficiently because of the technological limitations of current physical devices, the CVQKD systems were proposed.In a CVQKD system, the information is encoded on continuous variables by a Gaussian modulation, such as in the position or momentum quadratures of coherent states.In comparison to DVQKD, the modulation and decoding of continuous variables does not require specialized devices and can be implemented efficiently by standard technologies that are available and in widespread use.The CVQKD systems also provide higher secret key rates and higher communication distances.The CVQKD protocols can be further classified into one-way and two-way systems.In a one-way CVQKD system, Alice, the sender transmits her continuous variables to the receiver, Bob, over a quantum channel [9][10][11].In a two-way system, Bob starts the communication, Alice adds her internal secret to the received message, and this is then sent back to Bob (e.g., one mode of the coupled beam that is outputted from a beamsplitter is transmitted back to Bob).The two-way CVQKD systems were introduced for practical reasons to exceed the limitations of one-way CVQKD, such as low key rates and short communication distances [1][2][3][4][5][6][7][8][9][10][11][12][13].The two-way CVQKD protocols exploit the benefits of multiple channel uses and allow the leak of only lower valuable information to the eavesdropper.On the other hand, the achievable distances of one-way CVQKD can be extended by efficient channel-estimation methods [36], which is important since the one-way protocol currently is still the focus of the research owing to the easy experimental implementation.
The CVQKD schemes use continuous-variable Gaussian modulation which provably provides optimal key rates against collective attacks at finite-size block lengths [1][2][3][4][5][6][7][8][9][10][11] and also maximizes the mutual information between Alice and Bob.The security of CVQKD has also been proven against collective attacks in the asymptotic regime with infinite block sizes, and against arbitrary attacks in the finite-size regime [9,13], [39][40].One of the most critical points in regard to CVQKD is the post-processing [1][2][3][4][5][6][7][8][9][10][11], [47].The post-processing is aimed to correct the errors of the quantum channel that are cumulated in the raw data.The raw data is a correlated binary bitstring at Alice's and Bob's side, generated by the random quadrature measurements at the parties.Each quadrature measurement results in a unit in the raw data.The raw data itself is not a secret key; it consists only of the results of the random quadrature measurements.The secret key is a uniformly distributed long binary string that will be combined with the raw data elements, and will be added to the picture only in the stage of logical layer manipulations.The logical layer-based post-processing phase uses purely classical tools: precisely a classical-authenticated communication channel and classical error-correction algorithms.This method basically does the same in the logical layer as the tomography does in the physical layer, and it consists of two main phases: the reconciliation procedure with several error-correction steps, and privacy amplification.Without loss of generality, the aim of reconciliation is to extract as much valuable information from the correlated raw data as possible and to generate an error-free key between Alice and Bob.The privacy amplification operates on the shared, error-corrected common secret to extract the final key between the parties, and the aim of this phase is to reduce to zero the possible knowledge of an eavesdropper from the elements of the key.The implementation of tomography in the physical layer is a complex problem, and it is intractable in a practical scenario.But, well-characterized solutions can be proposed in the logical layer for the same purpose of giving an analogous, and also more valuable answer to the reconciliation of correlated Gaussian variables than the physical-layer tomography ever could.The theoretical background that makes the logical layer-based reconciliation possible also allow us to view the noisy physical quantum channel as a binary Gaussian channel in the logical layer [1][2][3][4][5][6][7][8][9][10][11][12][13].This has the immediate consequence that very efficient binary error-correction tools can be integrated from the world of traditional communication theory into CVQKD-which would not be available for the physical-layer tomography to extract binary information from the correlated Gaussian variables.
The raw data shared over the quantum channel is noisy, and this must be corrected to distill the final secret key.Since a large amount of raw data bits have to be shared between the parties, the complexity of the post-processing phase is a critical point in CVQKD protocols, and it has to be in order to be as low as possible.The existing logical layer-based solutions require high-complexity calculations in the high-dimensional spherical space for the reconciliation of Gaussian variables [9][10][11].Since a complex reconciliation is so undesirable, the aim is to find a more efficient solution in the logical layer.A slice method is a different reconciliation approach, which is also used in the current reconciliation steps of CVQKD for short distances, and can be implemented without spherical operations [41].Basically, the error correction in the reconciliation phase consists of two phases: First, the binary-channel codes (such as LDPC -Low Density Parity Check, turbo codes, polar codes, etc. [22][23][24][25][26][27][28][29][30][31][32][33][34][35]) that are used for the transmission of the classical bits in the reconciliation phase are corrected.Second, the real Gaussian noise on the received raw-data vector must be corrected, which noise arises from the effect of the quantum channel (i.e., from Eve's optimal Gaussian attack, which is considered in CVQKD protocols [1][2][3][4][5][6][7][8][9][10][11]).In this work we focus on the second phase of reconciliation, which has crucial role in CVQKD, since this phase makes it possible to correct the errors incurred on the quantum channel and to share an error-free key between Alice and Bob.Since the raw data is formulated by continuous real numbers resulted from quadrature measurements at the parties, the reconciliation problem is analogous to the well-known subject of binary-channel coding that operates on binary-channel codes.It also follows that the complicated and difficult to implement physical-layer tomography can be replaced in the logical level by binary error-correction schemes that are easier to implement.According to a critical security requirement of QKD, in the reconciliation phase only uniform distribution can be transmitted over the classical channel, otherwise the information theoretic security of the protocol cannot be proven [1][2][3][4][5][6][7][8][9][10][11][12][13].The raw data itself follows Gaussian random distribution because these arise from a Gaussian random source; however, by applying some trivial operations on the raw data units, the desired uniform distribution can be reached, and the reconciliation can be performed with unconditional security, as we will show in detail in Section 3.
A relevant difference of DV and CV protocols is that the physical quantum channel that connects the parties is characterized in a different way.For DVQKD the appropriate channel model is the Binary Symmetric Channel (BSC), which allows the use of the well-known channel-coding and error-correction tools in the post-processing phase.It also follows that for DVQKD there is a clear connection between the characteristics of the quantum channel and the world of traditional communication theory.On the other hand, for a CVQKD system the situation is more complicated, because the proper description of a Gaussian quantum channel requires several physical parameters (transmittance, variance, shot noise, excess noise, etc.) which allows no to draw a clear connection.To solve the situation for one-way CVQKD, the multidimensional reconciliation schemes [9][10][11][12] have been introduced, which made possible the conversion of the physical AWGN (Additive White Gaussian Noise) quantum channel to a logical binary AWGN (BAWGN) channel, where the Gaussian random noise arises directly from the quantum-level transmission.Precisely, it works only for low dimensions and the resulted logical channel approximates only a binary Gaussian channel.As the accuracy of the physical-logical channel conversion gets closer to perfect the resulting logical channel gets closer to a binary Gaussian channel.At low SNRs (Signal-to-Noise Ratio) the capacities of the Gaussian quantum channel and the binary Gaussian channel coincidence, and this is partic-ularly convenient because for low SNRs the problem of channel conversion can be reduced to the approximation of a binary Gaussian channel.From this follows, that the efficiency of the channel conversion procedure can be described by the relevant parameters of the resulting logical binary channel (such as its variance and capacity).This conversion efficiency has tremendous importance because it also determines the efficiency of the reconciliation process, i.e., the performance of the protocol.In the multidimensional reconciliation the conversion procedure required the use of the spherical space and its sophisticated operations [9][10][11], which is a complex process.The difficult computational steps of post-processing just cause further slowing down in the very sensitive key rates that are so difficult to establish.These requirements of the reconciliation phase are strongly undesired in a practical CVQKD scenario, so a simpler reconciliation would be desirable-for both one-and two-way systems.The problem of efficient post-processing is more crucial for two-way CVQKD, due to its more complex physical architecture.
To exploit the real potential of two-way CVQKD systems, efficient post-processing is needed.It is still missing, which makes it not possible to attain the true performance of two-way CVQKD.This is the main reason why the theoretical maximum of key rates and ranges cannot be exceeded in the current practical scenarios; however, the protocol in its 'hardware level' is built to be strong, and would be capable of more performance than is currently available.To boost up the performance of the two-way CVQKD protocols over the current limits, we introduce an efficient reconciliation method that makes it possible to increase the key rates and to extend the currently available distance ranges.The mathematical apparatus that stands behind the multidimensional reconciliation puts a strict upper bound on the available dimensions, and limits its maximum [9][10][11], [42].The reason is that in higher dimensions the required spherical division operations do not exist.In our scheme, we also eliminate this serious drawback and extend the reconciliation of Gaussian variables to arbitrary high dimensions.The proposed approach also makes possible to get a closer and more precise approximation of the binary Gaussian channel, in comparison to the multidimensional case.
Since the post-processing phase uses the binary form of the continuous variables, in fact, we do not have to decode the Gaussian variables in the multidimensional space.As a corollary, arbitrary high-precision approximation of the logical binary Gaussian channel can be made in the non-spherical space by using considerable dimensions.We exploit it in this work to construct a scalar reconciliation that breaks with the traditions of the previously introduced approaches [9][10][11], [42,46], and uses only the space of scalar variables.The proposed scalar reconciliation is also able to transform the physical Gaussian quantum channel into a logical binary Gaussian channel in two-way CVQKD, and the same benefits can be exploited as in the case of multidimensional reconciliation.However since our scheme is not limited to eight dimensions, an arbitrary precision can be reached in the approximation of the logical binary Gaussian channel.As follows, the accuracy of the conversion between the physical Gaussian quantum channel and the logical Gaussian channel can be improved beyond the current limits.Another issue in the current approaches is the requirement of spherical calculations.To make the existing post-processing approaches more efficient, we have to eliminate the multidimensional operations.The reconciliation of Gaussian variables would be much easier, if we found a solution that would make it possible to extract the final key from the noisy data by simple calculations in the level of scalar space.It immediately follows that this would significantly increase the efficiency of the reconciliation process, and would lead to a negligible complexity and computational power in the error-correction procedure.
In this paper we define low-dimensional (scalar) reconciliation for CVQKD.It brings significantly higher noise-resistance and information-transmission capability, extended transmission dis-tances, and improved key rates.The proposed method does the reconciliation of Gaussian variables without the need of any physical-layer tomography or multidimensional operations.We demonstrate the results for two-way CVQKD.The scheme is backward compatible it also can be applied to one-way CVQKD.
The novel contribution of our paper is as follows: • The reconciliation process of correlated Gaussian variables is a complex problem that requires either tomography in the physical layer that is intractable in a practical scenario, or high-cost calculations in the multidimensional spherical space with strict dimensional limitations.
• To avoid these issues, we propose an efficient logical layer-based reconciliation method for CVQKD to extract binary information from correlated Gaussian variables.
• We demonstrate that by operating on the raw-data level, the noise of the quantum channel can be corrected in the low-dimensional scalar space and the reconciliation can be extended to arbitrary dimensions.
• We prove that the error probability of scalar reconciliation is zero in any practical CVQKD scenario, and provides unconditional security.
• The results allow to significantly improve the currently available key rates and transmission distances of CVQKD.
This paper is organized as follows.In Section 2, preliminary findings are summarized.In Section 3, we introduce the reconciliation scheme.Section 4 provides the theorems and proofs.In Section 5, a numerical evidence is proposed.Finally, in Section 6, we conclude the paper.Supplemental information is included in the Appendix.

System Model
In comparison to one-way CVQKD protocols, in two-way CVQKD the two uses of the quantum channel lead to superadditive private classical capacity (more precisely, the superadditivity of security threshold leads to a subadditive eavesdropper [1][2][3][4][5][6][7][8], [14]), which makes it possible to decrease the amount of valuable information leaked to Eve.The subadditive eavesdropper is a consequence of the multiple uses of the quantum channel.The superadditivity of the security threshold can also be expressed in terms of tolerable excess noise and the channel transmission [1].In the two-way scenario, Eve perturbs the quantum channel N 1 , which causes a noise in the transmission that will have an effect on the success of her second attack.From the two attacks, comparatively lower valuable information will be available to Eve so that she would not have made an attack on N 1 .The reason for this is that the amount of valuable information transmitted over N 2 is already decreased by the attack of N 1 .More attacks add more noise into the transmission, which also decreases the amount of mutual information between Alice and Bob.With the increased number of channel uses we allow Eve to get as much less valuable information as possible.If Alice encodes her information into the noisy state that is received from N 1 , and then sends it back to Bob over N 2 , then the parties can achieve the desired phenomenon of superadditivity [1][2][3][4].The amount of valuable information leaked to Eve is also decreased by the multiple uses of the quantum channel.The errors caused by more channel uses can be corrected in the reconciliation phase by traditional error-correction tools.
In fact, by utilizing multiple channel uses, we 'set a trap' for Eve, since again and again she will attack the quantum channel.Eve will also simultaneously decrease the amount of eavesdropped information by her actions.The idea works well, because in the post-processing phase the parties can correct the errors caused by Eve, thus, finally, it can be concluded that it was a correct decision to increase the number of channel uses.Of course, if we had perfect amplifiers and ideal devices, then, in theory, it would be possible to completely eliminate Eve from the picture in the asymptotic scenario to make unnecessary the privacy amplification by allowing an infinite amount of channel uses to maximally exploit the superadditivity property (more precisely, the superadditivity of the security-threshold parameter hence the strong subadditivity of Eve).However, in practice it is trivially not possible to circulate over and over the same beam an infinite amount of times, due to the losses and imperfections of the physical devices.
Let us review the data components of the protocol that are needed for the appropriate description of the scalar reconciliation for the two-way CVQKD protocol.Our description will be as detailed as desired for further analysis, and will not take into account the particular description of any components of an experimental protocol.The raw data is generated by the use of noisy Gaussian channels N 1 and N 2 , and by the parties' internal secrets.The aim of the quantumlevel transmission is to generate two nearly identical classical bitstrings between the parties.All quantum-level interactions are closed at this point, and the post-processing phase, which uses the raw data of the parties and a classical authenticated channel, is brought to life.The post-processing phase consists of the processes of reconciliation and privacy amplification.The valuable key will be generated in the reconciliation phase by using the raw data and a random secret.It consists of error-correction phases as well.The privacy amplification is geared toward performing security checks on the elements of the generated key, and it is not part of our description.We will assume reverse reconciliation (RR), which is desirable since the mutual information between Bob and Eve is provably lower than between Alice and Eve [1][2][3][4][5][6], [9][10][11][12][13][14], [50].It is because if Bob starts to run the reconciliation phase using his already noisy raw data, then only lower valuable information can be leaked to Eve during the procedure in comparison to if Alice would have started to run the reconciliation, from her ideal raw data (from the perspective of the raw data-level reconciliation, the noise that arises from the first channel use has no relevance, as will be clarified later, and Alice's raw data can be viewed as ideal).
The run of the protocol is sketched as follows.Let us denote Alice's binary raw data by X, and Bob's binary raw data by X , where |X| = |X | =N units.Alice's raw data is generated by a random quadrature measurement of M 1 .Alice's selects two random variables x and p each drawn from a Gaussian distribution, that encodes her position and momentum quadratures and obtains a phase space vector S Alice = | x A +ip A . Bob also draws a phase space vector S Bob = | x B +ip B .The noisy S Bob is received by Alice in the first phase via channel N 1 in the beam B out .Alice's raw data is defined as follows: The outgoing beam A out will contain the other mode of the coupled beam.Bob's raw data is generated by the M 2 random quadrature measurement applied on the beam A out , as: where A out contains the noisy version of the second mode of the beam.A detailed description will be given in Section 2.1.
A simplified view of a PM (Prepare-and-Measure: entanglement-free) two-way CVQKD protocol with homodyne measurements M 1 , M 2 at the parties and with RR is shown in Fig. 1.Alice and Bob are connected by a noisy quantum channel and a classical authenticated channel.The quantum communication is started by Bob.Alice receives Bob's quantum message and then couples it with her quantum message using a BS (Beam Splitter) to create a correlated signal.The first mode of the beam is measured by Alice, using a random quadrature measurement; the second mode is sent back to Bob, who will also apply a random quadrature measurement on the received beam.After the measurements have been performed, the parties inform each other about the used position and momentum quadratures over the classical channel, and discard the irrelevant data.The resulted raw data is a collection of correlated Gaussian variables.Since these binary strings follow Gaussian random distribution, they cannot be transmitted directly over the classical channel.In reverse reconciliation, Bob has to make the probability distribution of his raw data to uniform.He can do this by applying an appropriate function C (•) (will be clarified in Section 3) on his j -th raw data block, denoted by X j .Bob then generates a random key U j (the full key vector K is granulated into several U j -s), and multiplies it with his raw data C X j .Alice receives C X j U j , and using her C (X j ), she computes the noisy U j .Next, the errors of the secret key that arise from the noise of the quantum channel will be corrected.This phase is modeled by the scalar reconciliation box at Alice's side.The aim of the scalar reconciliation is to share an error-free key K between Alice and Bob.From Alice, it requires the correction of the noise on U j to get back Bob's U j , using only scalar operations without the need of the multidimensional spherical space.

Coding Scheme
In the following description we give a considerable view of the coding of two-way CVQKD, focusing on the contributions of information theory.Let us denote the quadratures of the i -th signal S Alice,i in the phase space S A by x A,i , p A,i , and the quadratures of Bob's signal S Bob,i in the phase space S B by x B,i , p B,i , where x A,i , p A,i ∈N 0, σ 2 ω and x B,i , p B,i ∈N 0, σ 2 ω are drawn from a Gaussian random distribution with mean µ= 0, and variance σ 2 ω , where σ 2 ω is the modulation variance [1][2][3][4][5][6][7][8][9][10].The coherent states S Alice,i = | x A,i +ip A,i ∈S A and S Bob,i = | x B,i +ip B,i ∈S B are encoded by Gaussian modulation with dedicated centers (x A,i , p A,i ) ∈S A and (x B,i , p B,i ) ∈S B , respectively (Note: Each S i define a zero-mean, circular symmetric complex Gaussian random variable CN 0, σ 2 in the phase space S, with i.i.d.real and imaginary components The two beams are correlated at Alice's BS, which results in a combined signal in the combined phase space S A×B .The modulation noise After the two beams S Alice,i and S Bob,i are correlated at a BS at Alice's side, where S Bob,i is the noisy version of S Bob,i , Alice applies a random quadrature measurement M 1 on the first mode of the beam, while the second mode is transmitted back to Bob over quantum channel N 2 .Alice's state in the combined phase space S A×B is as follows: with Gaussian random quadrature components N 0, 2σ  while Assuming a homodyne measurement M 1 , Alice gets an X i unit of her raw data, which is a binary string.If she measured in the position quadrature basis she obtains: or, if she used the momentum quadrature basis she gets The second mode of the combined signal in S A×B is transmitted directly back to Bob over the noisy channel N 2 , given as: with N 0, 2σ with N 0, 2σ In the next phase, Bob applies a random quadrature measurement M 2 (assumed to be homodyne) and gets block Y i .If he used a position quadrature basis, he gets and for the momentum quadrature basis he obtains: Bob, calibrating his resulted block Y i by 2x B,i or 2p B,i (depending on the used quadrature measurement), gets back the noisy version X i of Alice's raw data unit X i as: and which is referred as Bob's raw data unit.The nature of the of error of the quantum channel will be characterized in detail in Section 4, however at this point we can surmise that the noise of the quantum channel is analogous to the addition of a non-standard Gaussian random noise vector ∆ i to Alice's raw data block X i .Alice's and Bob's modes in the combined phase space S A×B right after being outputted from the BS are | ϕ i and | φ i , as shown in Fig. 2. Alice obtains the first mode of the beam, | ϕ i , the second mode | φ i is sent back to Bob.The noise that exists in S A×B arises from the modulation noise ∂∈CN 0, σ 2 ∂ (already included in the quadrature distributions) and the two channel uses, N 1 and N 2 .The measurements performed on | ϕ i and | ξ i result in raw data units X i ∈N 0, σ 2 X and X i ∈N 0, σ 2 X .The noise of the first channel changes the Gaussian random distribution of the quadratures from N 0, 2σ 2 ω to N 0, 2σ 2 ω +σ 2 N 1 in the combined phase space S A×B , with mean µ= 0, and results X raw data level variance σ 2 X = 2σ 2 ω +σ 2 N 1 , and where noise variance σ 2 arises from the first channel use.The quadratures of the second mode of the coupled beam is also characterized by the same variance, i.e., | φ i ∈CN 0, σ 2 φ i .The noise of N 2 transforms | φ i ∈S A×B into | ξ i ∈S A×B and further modifies the distribution.Finally, Bob's received quadratures will follow a Gaussian distribution N 0, 2σ , which fact arises from the cumulated Gaussian random noise of N 1 and N 2 .
On the raw data level, only the difference of the variance of Alice's and Bob's raw data σ 2 X and σ 2 X has relevance and σ 2 N 1 vanishes from the picture.This difference is, indeed, σ 2 N 2 .In the level of raw data manipulations Alice's X i will serve as a reference unit to correct Bob's noisy unit, X i .In other words, the first channel use will have no relevance in the raw data-level calculations, hence the noise of N 1 can be excluded from the error-correction process.Precisely, the use of N 1 has only one consequence: it increases the initial variance 2σ 2 ω by σ 2 N 1 , which finally results in N 0, σ 2 X on the level of raw data blocks.In particular, only N 2 will have significance, and, in fact, only the noise of the second channel use has to be corrected in the reconciliation phase.(Note: Throughout the manuscript, the noise will be modeled on the quadrature-level via a real vector).
In the reconciliation phase, our task is to share an error-free secret key between the parties.This requires the raw data-level error-correction of the noise that arises from the quantum-level transmission.First we review the background of the multidimensional reconciliation and then we introduce our solution.

Uniform Distribution in the Spherical Space
In this section we review the background of the multidimensional approaches, and the properties of Gaussian random vectors in the spherical space.The multidimensional reconciliation processes for CVQKD were not implementable without the use of spherical codes and a high-dimensional spherical space.
First, let us clarify how a d -dimensional Gaussian random vector is formulated in the framework of a two-way CVQKD protocol.The outcoming beam from Alice (and Bob) can be regarded as a collection of Gaussian random variables.A standard Gaussian random variable g∈N (0, 1) ∈R is a real variable selected from a Gaussian distribution.A standard Gaussian variable g∈N (0, 1) has probability density function [15,18]: A non-standard Gaussian random variable g * ∈N µ, σ 2 ∈R with nonzero mean µ =0, and variance σ 2 , can be expressed from g∈N (0, 1) as g * =gσ+µ.A non-standard Gaussian random variable g * has probability density function: In Alice's raw data, a d -dimensional Gaussian vector is a collection of d independent Gaussian random variables X j,0 , . . .,X j,d−1 , where each X j,i is a real variable R drawn from a Gaussian random distribution N 0, σ 2 X .Alice's Gaussian vector is referred by X j ∈N 0, σ 2 X d ∈R d , and its noisy version at Bob's side is denoted by The values of Bob's units are affected by the Gaussian noise that arises from the quantum channel.
First, let us evaluate why the normalized vector structure has importance in the multidimensional scenario.The reason: the normalized d -dimensional Gaussian vectors change the probability distribution from Gaussian random to uniform on the d -dimensional unit sphere, Γ d−1 .It has a relevance, since only uniform distribution is allowed in the reconciliation phase.The result clearly follows from the Rayleigh law [18], the application of Stirling's formula [19], Gersho's conjecture [22], and Sakrison's result [23], which are connected to the contributions of spherical coding [24].
We formulate d-length blocks X j = X j,0 , . . .,X j,d−1 and variance We step further from this point.Since the variance of X j is not unit, the covariance matrix C X j is not equal to identity, but the random units X j,i are uncorrelated, thus C X j is diagonal.
The normalized vector X j / dσ 2 X with norm X j / dσ 2 X , can be identified on the unit sphere Γ d−1 [18,24], with radius r= X j / dσ 2 X .The mean of X j / dσ 2 X is The vector X j / dσ 2 X on the unit sphere Γ d−1 is identified as Precisely, the normalized quantity X j / dσ 2 X has variance var From the spherical symmetry, it follows that if d→∞, the normalized random vector X j / dσ 2 X will be equipped with uniform distribution on Γ d−1 .The background of this phenomenon is as follows.
First, for d→∞, the mean E [•] of the normalized quantity X j / dσ 2 X will tend to one, i.e., lim Second, the variance var [•] of X j / dσ 2 X will tend to zero, lim These implies that for d→∞, the normalized Gaussian random vector X j / dσ 2 X becomes uniformly distributed on the unit sphere Γ d−1 .Third, as the dimension increases the distribution of the norm of X j / dσ 2 X (i.e., the radius on Γ d−1 ) will approximate the Dirac distribution D (d) [9][10][11], [18], and it will also converge to one, r= lim d→∞ X j / dσ 2 X = 1.The unit norms of X j / dσ 2 X play exactly the role of unit fading-coefficients for a logical binary Gaussian channel, since during the transmissions of the messages generated from X j / dσ 2 X the unit norms r= X j / dσ 2 X = 1 are also transmitted [11,21].
To be more exact, the unit norms are only approximated and the distribution of the unit norms also depends on d, and as d→∞, it precisely can be described by the Dirac distribution where a=1/ √ d and From D d (x) it immediately follows, that the unit norms of the normalized random Gaussian vectors gets closer to 1, as d goes to infinity [18].As follows from these, for low values of d the uniform distribution of X j / dσ 2 X cannot be achieved.In comparison to the multidimensional reconciliation where the required mathematical operations (the spherical division operator at Alice's side) exist only in d= 1, 2, 4 or 8 dimensions [9][10][11], [18], the scalar reconciliation process are also existent for arbitrary high dimensions, which makes possible to give a more closer approximation, however it will not refer to the Dirac distribution.Analyzing the situation if the noisy raw data follows Gaussian random distribution with σ 2 X > 1, the speed of convergence of the mean E X j / dσ 2 X and variance var X j / dσ 2 X will be lower for any d, in comparison if σ 2 X = 1 would have hold.For σ 2 X = 1, the situation for various dimensions of X j is summarized in Fig. 3.
Figure 3: The mean E [•], variance var [•] of the normalized quantity X j / dσ 2 X and the norm X j / dσ 2 X of the normalized Gaussian random vector X j / dσ 2 X .Vector X j is formulated from d number of X j,i elements of Bob's noisy raw data X .The approximation of the logical binary Gaussian gets more precise as the norm approaches to one, which requires the use of higher dimensions.
As we have mentioned, the multidimensional approaches are limited in the dimension, specifically, d= 8 in [9][10][11].In this case, the Gaussian random vectors form the so-called octonions [20].In the level of Gaussian random raw data, an octonion O j ∈R 8 is built up from eight units X j,0...j,7 ∈N 0, σ 2 X , as: where Re∈R stands for the real part, while Im i ∈C, f or i= 1,i≤7 indentifies the i -th imaginary units, respectively.Bob's noisy O j is O j =X j,0 Re+X j,1 Im 1 + • • • +X j,7 Im 7 , where X j,0...7 ∈N 0, σ 2 X .In the multidimensional case the uniformity of the d -dimensional Gaussian random raw data vectors X j ∈R d , d≤8, can be achieved only in the multidimensional spherical space, over the unit sphere Γ d−1 .The process requires complex operations and transformations [9][10][11] that are undesirable in a practical CVQKD scenario.In comparison to these approaches, our proposed scalar reconciliation uses only simple scalar operations on the raw data, which makes it possible to eliminate the spherical calculations from the reconciliation phase.

Low-Dimensional Reconciliation
We start our description from the point at which the quantum states are completely transmitted through the quantum channel from Alice to Bob.At this point all interactions with the quantum channel are closed, and the post-processing phase is being started.First, Alice and Bob exclude from the raw data those measurements that have been performed in different quadratures that results in the N-unit length raw data vectors.Then formulate N/d number of d -dimensional vectors X j ∈R d , X j ∈R d .These quantities are introduced as follows.

Notations
Let X∈R N and X ∈R N the N -unit length raw data of Alice and Bob.The d -dimensional vectors X j ∈R d and X j ∈R d , f or j=0, j≤ (N/d) −1, of Alice and Bob are defined as: and where and refer to the i -th unit of the j -th vector, respectively.Alice and Bob have to share a common secret by using their correlated raw data.For this purpose, they establish a proper code-alphabet A= {a, b}, where a∈R and b∈R are two public variables (i.e., Eve also has access to it).In the reverse reconciliation these will be selected uniformly at random in the form of several U j ∈ {a, b}-s at Bob's side, with Pr (a) = Pr (b) = 0.5.A secret d -dimensional key vector U j is drawn from a uniform distribution U and built up from d units, U j,i ∈R, as: The d units U j,i ∈U of U j are uniform random variables, and define U j ∈R as follows: The noisy version of (29), U j , is defined as From ( 29) follows, that (28) can be rewritten as U j ∈ {A, B} ∈R d , with vectors A, B as: As follows, Bob granulates the selected a or b into d number of uniformly random variables U j,i , so that the sum of the units will be equal to the selected value.
The full key K is built up as: Alice and Bob first agree on d. Bob then sends the d blocks of f or j= 0, j≤ (N/d) −1, over a classical channel.The scalar quantities C (X j ), C X j , and C X j U j are evaluated as and respectively.
Alice receives the d noisy U j,i units, and by the addition of the d units, and via the application of C (X j ) she computes U j as Thus, Alice has to make an error-correction to remove the noise from U j to get achieve U j .

Achieving the Uniform Distribution
In comparison to the multidimensional reconciliation, the scalar reconciliation uses a fundamentally different solution to achieve the uniform distribution of the raw data.While the former is based on sophisticated multidimensional spherical operations, our solution requires only the use of a simple function in the scalar space.In our scheme, the uniform distribution of the correlated raw data units is achieved by the Gaussian Cumulative Distribution Function (CDF) [26], [43][44][45].Another important difference is that the approximation of the logical binary Gaussian channel can be achieved by arbitrary dimension with arbitrary accuracy, which is justified by the Central Limit Theorem (CLT) [26], [43][44][45].

Gaussian Cumulative Distribution Function
On Alice's and Bob's side, the Gaussian CDF function can be used to reach the uniform distribution of the correlated raw data.Since we assumed reverse reconciliation let us to start the description from Bob's perspective.Let Bob's raw data unit X j,i with Gaussian random distribution N 0, σ 2 X .The Gaussian CDF-transformation C (•) :R→R for a unit X j,i is as follows: where is the Gauss error function, and C X j,i ∈R is a real variable from the range of [0, 1], with U uniform distribution (for a plausible example Section 5).The quantity C X j,i will be referred as the CDF-transformed unit.Alice also applies the CDF transformation, and takes into account her raw data variance σ 2

X
for the units of X j,i to get C (X j,i ): and the result of ( 37) and ( 39) is the correlated uniform raw data C (X j,i ) ≈C X j,i .In the reconciliation process, only Alice can correct U j into U j , because nobody knows the CDF-transformed raw data units C (X j,i ), except Alice.For a given X j ∈R d , the CDF function C (•) :R→R reads as Applying the results for Bob's raw data the CDF-transformed vector is: The CDF-transformed C (X j ), C X j raw data vectors each consist of d real R variables as: C (X j ) =(C (X j,0 ) , . . .,C (X j,d−1 )) T , C X j = C X j,0 , . . .,C X j,d−1 T . (42)

Central Limit Theorem
In the multidimensional case, the precision of the approximation of the logical binary Gaussian channel (i.e., the quality of the physical-logical channel conversion) was quantified by the Dirac distribution [9][10][11].Since in the scalar reconciliation the spherical space is eliminated, a different solution was needed to analyze the accuracy of the conversion between the physical-logical Gaussian channels.Our answer for the problem is the Central Limit Theorem [26], [43][44][45] and a mathematical result from the 19th century -the so-called Lyapunov-condition [26,45].The accuracy of the physical-logical conversion of scalar reconciliation can be maximized and it can be made in arbitrary high dimensions as it is being stated in Lemma 1.

Lemma 1
The noise variance of the converted logical binary Gaussian channel asymptotically coincidences with the noise variance of the physical quantum channel, which allows to reach the theoretical maximum of the capacity of the converted logical binary channel.
Proof.Let X j,i ∈R and X j,i ∈R the j -th units of Alice's and Bob's raw data, respectively.For a d -dimensional vector U j = U j,0 , . . .,U j,d−1 T , the sum of the independent noise {δ j,0 , . . .,δ j,d−1 } units on the secret noisy key units U j,i =U j,i +δ j,i will approximate a zero-mean Gaussian random variable with mean E [δ j,i ] =µ δ j,i = 0, noise variance var [δ j,i ] =σ 2 δ j,i (see Section 3.1 and Section 3.3 for a detailed derivation) as follows: CLT: To show that (43) holds for the d -dimensional noise parameter δ j , we exploit the Lyapunovcondition [26].Applying the standard mathematical description of the Lyapunov condition [45], let L> 0, then is satisfied for any d→∞, by theory.As follows, the noise on U j ∈R d will converge to and the resulting logical channel will be equivalent to a logical binary Gaussian channel with noise variance σ 2 δ j .By the same argumentation, the variance of the resulting logical binary Gaussian channel will converge to the variance of the physical Gaussian quantum channel σ 2 N 2 for N →∞.Let again L> 0, and d is an appropriate dimension for which (44) is satisfied, and let the expected variance of δ j is var [δ j ] =σ 2 N 2 .Then lim is satisfied by theory, from which CLT: follows, which proves the statement.Hence one can readily recognize that lim To conclude the situation, in ( 43) and ( 47) the variances of δ j and (N/d)−1 j=0 δ j , indeed, are not scaled up by d and N/d, which makes possible to convert the physical Gaussian quantum channel to a logical binary Gaussian channel with noise variance dσ 2 δ j ≈σ 2 N 2 for arbitrary d.
These results allow for one to obtain the lowest noise variance and hence, the highest SNR of the logical channel that is possible by theory.At the resulting SNR, the capacity of the logical binary Gaussian channel also picks up its maximum.From this one can immediately conclude, that, in fact, it is a favorable result because the logical channel is indeed a binary Gaussian channel which is equipped with the same capacity at low SNRs (which is the situation in an experimental long-distance scenario) than the physical Gaussian quantum channel.In our solution, the lower bound σ 2 δ j =σ 2 N 2 is precisely reached and is justified by the Lyapunov-condition, which means that our conversion provides the best approximation that is possible.

Application
In comparison to the multidimensional approaches, here, one can recognize that these results make no necessary the use of the multidimensional spherical space.The key idea is as follows: do the reconciliation in the scalar space to reduce the problem from Γ d−1 of R d into R.The main drawback of the multidimensional reconciliation approaches is the use of spherical space Γ d−1 of R n to achieve the uniform distribution.As we have found in a CVQKD scenario it is not a required condition, and completely can be eliminated.The uniformly distributed elements of R d have to be transmitted over the classical authenticated channel, but it per se, does not imply that the reconciliation has to be executed in the spherical space.The spherical correction of the errors of the raw data is a completely undesirable and unwanted event in a practical CVQKD, because it would just cause a further decrease in the very fragile, sensitive, and so strenuously established secret key rates.The use of Γ d−1 of R d served only one purpose in the multidimensional reconciliation: to guarantee the security requirements of the QKD post-processing phase.From this it immediately can be concluded that the use of spherical space is, in fact, unnecessary, and a mathematically equivalent and more efficient solution exists in the scalar space of R.
One can recognize two improvements in our proposed scheme in comparison to the existing approaches.First, the uniform distribution will be reached by a simple operation, the Gaussian-CDF function applied separately on each unit of the raw data.Second, the approximation of the Gaussian channel will be justified by the CLT, using arbitrary dimensional vectors.As follows, the physical-logical channel conversion can be established with arbitrary high precision, since the d≤8 limitation has also been eliminated from the picture.To conclude, the spherical space can be replaced by the CDF transformation on the raw data units, and the Dirac distribution can be replaced by the CLT.It is clear now that the existing reconciliation methods require a revision since its application just leads to further slow-down in a practical CVQKD scenario.By these reasons, we drop away the spherical space, and instead of it, use the CDF-transformed units.These improvements allow very efficient decoding and error-correction, however, this step does not modify any property of the code: in other words, it keeps the desired uniform distribution and guarantees the arbitrary high-precision in the approximation of the logical binary Gaussian channel.Finally, we have to emphasize again that the whole reconciliation procedure is implemented through the logical layer only, without any need of physical-layer tomography.

Run of Scalar Reconciliation
The run of scalar reconciliation (assuming reverse reconciliation) is sketched as follows.Bob divides his N -unit length raw data X into n=N/d number of d -dimensional vectors X j = X j,0 , . . .,X j,d−1 T ∈R d , where d is the length of the vectors measured in units X j,i in the raw data.
Then for each X j , applies CDF transformation C on the units X j,i ∈R of X j , f or i= 0, i≤d−1, f or j= 0, j≤ (N/d) −1.Bob generates , and sends it to Alice over the classical authenticated channel.
Alice also divides her N -unit length raw data X, into n=N/d number of d -dimensional vectors X j =(X j,0 , . . .,X j,d−1 ) T ∈R d , computes the CDF-transformed C (X j ) =(C (X j,0 ) , . . .,C (X j,d−1 )) T ∈R d and using ( 29), ( 34) and ( 35) computes as Next, she corrects the Gaussian noise on U j to get U j .From these she rebuilds the error-free full key

Security
The scalar reconciliation provides unconditional security.It will be demonstrated for reverse reconciliation.The security of scalar reconciliation is guaranteed by the fact that the transmitted C X j U j messages follow uniform distribution, and the multiplied U j and X j vectors are also uniform and independent.
The following conditional probability holds for each U j , U j =U 0...1 (see also (29), (34) and ( 35)): Since C X j U j are uniformly distributed, and also independent [11], it follows that: and Since the overall number of d -dimensional U j ∈R d vectors is N/d, the probability that Eve obtains the full key K is (54)

Noise on the Data
This section reveals the mathematical description of the noise vector of the Gaussian quantum channel N 2 and its impacts on Bob's raw data and Alice's received secret key.We also can exploit that in the evaluation of the noise vector only the second channel use N 2 has to be taken in to consideration in the error correction.The d -dimensional noise vector ∆ j ∈ N 0, σ 2 N 2 d ∈ R d of the Gaussian channel N 2 on the j -th X j is a Gaussian random vector defined as: where ∆ j,i ∈N 0, σ 2 N 2 ∈R identifies the Gaussian noise on the i -th unit X i of X j as: The noise vector ∆ j is added to Alice's X j , hence Bob's noisy X j is: In terms of raw-data vector units, the Gaussian noise vector ∆ j,i is described as follows: and ( 57) can be rewritten as: In the scalar reconciliation, the error-correction is performed on the level of unit sums U j = d−1 i=0 U j,i in R as follows.Alice receives the d -dimensional C X j U j from Bob, from which she obtains C X j U j (see (35)) and divides it by her C (X j ) (see (34)).The effect of Gaussian noise [9] results in a distorted secret U j ∈R as: where δ j,i is the noise on U j,i (for a plausible example, see Section 5): where σ 2 δ j,i is the variance of the distribution of δ j,i , while C (∆ j,i ) is the noise of the CDFtransformed raw data units: where bution.The error-corrected U j can be expressed from the noisy U j,i as follows: where ς j,i ∈N 0, σ 2 ς j,i characterizes the same amount of noise as (61), i.e., and ς j,i =δ j,i , however it is evaluated from the noisy raw-data units U j,i , C X j,i as: with ς j,i ∈N 0, σ 2 ς j,i .The d -dimensional vector U j ∈R d can be expressed as: where the noise vector − → δ j = {δ j,0 , . . .,δ j,d−1 } ∈R d is as follows: According to the CLT, the sum of independent noise on units U j,i in U j ∈R d is evaluated by a Gaussian random variable as: The d -dimensional vector U j ∈R d can be expressed as and the noise vector − → ς j = {ς j,0 , . . .,ς j,d−1 } ∈R d is as follows: The sum of independent noise on units U j,i of U j ∈R d can also be identified as: From the physical properties of a Gaussian quantum channel [1][2][3][4][5][6][7][8][9][10][11], we know exactly what happens during the transmission of the coherent combined signal from Alice to Bob.The noise on X j,i has a non-standard Gaussian random distribution ∆ j,i ∈N 0, σ 2 N 2 .We have to analyze in detail the properties of the noise vector.The vector ∆ j ∈N 0, σ 2 N 2 d ∈R d of N 2 that generates the noisy X j from X j is characterized as follows.First we decompose the noise vector ∆ j into its components: where matrix A j represents a linear transformation in R d , while Λ j is a the standard Gaussian noise vector Λ j ∈N (0, 1) d ∈R d .The probability density function of Λ j is: where Λ j = Λ 2 j,0 + • • • +Λ 2 j,d−1 is magnitude, in other words, the Euclidean distance from the origin to Λ j ∈R d .This type of noise exhibits different behavior than the real Gaussian noise of a quantum channel, and it is characterized by the same magnitude Λ j in every direction.This property is connected to the standard Gaussian random noise, and it cannot be applied in a realistic CVQKD scenario, because it does not properly describe the noise characteristic of the quantum channel.The probability density function of ∆ j ∈R d is: where A j A T j stands for the C (∆ j ) covariance matrix of ∆ j , and it analogous of σ 2 N 2 , i.e., in a more precise form C (∆ j ) =E ∆ j ∆ T j =A j A T j .The noise on the units X j,i of X j at Bob's side arises from the quantum-level transmission of the combined phase space states | φ j,i ∈S A×B , and vectors Λ j ∈N (0, 1) d and ∆ j ∈N 0, σ 2 N 2 d is built up by d components, Λ j,i ∈N (0, 1) ∈R and ∆ j,i ∈N 0, σ 2 N 2 ∈R.The error ∆ j,i on the i -th unit X j,i is as follows: where A j,i is a linear transformation that scales Λ j,i .The probability density function of Λ j,i is: where Λ j,i = Λ 2 j,i is the magnitude of Λ j,i .The probability density function of ∆ j,i is: where A j,i A T j,i =E ∆ j,i ∆ T j,i = C (∆ j,i ).From Λ j,i and ∆ j,i , the correction of Bob's noisy secret U j can be approached by the units U j,0 , . . .,U j,d−1 , because the noise of N 2 is survived in the raw data level and lives also on U j,i , but in a modified form, see (61).
Let us denote by | φ j,i the phase-space representation of Alice's noise-free raw data unit X j,i given by ( 6), and by | ξ j,i the noisy raw data unit X j,i of Bob, from (7). (State | φ j,i is the second mode of the combined beam, while | ξ j,i is its noisy version).
The effect of the real Gaussian noise of the quantum channel is shown in Fig. 4. The noise vector ∆ j ∈N 0, σ 2 N 2 d ∈S A×B of the quantum channel is a non-standard Gaussian random vector, which distorts the density.The circles of Λ j,i ∈N (0, 1) are scaled by A j,i resulting in ellipses.The magnitude ∆ j,i of ∆ j,i is not preserved in all directions, which leads to different density.The x and p quadratures of | φ j,i ∈S A×B are modified by ∆ x and ∆ p in | ξ j,i ∈S A×B .
Figure 4: The real Gaussian noise of the quantum channel 2 causes a rotation and rescaled vector in the combined phase space S A×B (x : position quadrature, p: momentum quadrature).The magnitude ∆ j,i of the noise vector ∆ j,i ∈N 0, σ 2 N 2 is not preserved, since the noise characteristic describes an ellipse in the combined phase space.

Theorems and Proofs
First we show that Alice's noisy secret can be corrected in the v vector space of R d by using an error-correction rule based on the apparatus provided by the maximum-likelihood decision [15][16][17][18][19], [24,25], which renders unnecessary the use of the spherical space of Γ d−1 .
Proposition 1 (Vector reconciliation of correlated Gaussian variables).The Gaussian noise δ j on the received vector U j ∈R d : U j,0 , . . .,U j,d−1 can be corrected in the vector space v of R d .
Proof.First, Bob selects the d -dimensional vector U j ∈ {U j,0 , . . .,U j,d−1 } ∈R d where d−1 i=0 U j,i =a or d−1 i=0 U j,i =b, U j,i ∈U and sends C X j U j over the classical channel.Alice uses her CDFtransformed raw data C (X j ) = {C (X j,0 ) , . . .,C (X j,d−1 )} to obtain U j ∈R d .Since Alice knows a, b and d, she can draw two vectors A=(A 0 , . . ., She then corrects the noise on U j by the following error-correction rule [15][16][17][18][19]: where the quantity U j −U j , U j ∈ {A, B} is evaluated as which precisely coincidences with the norm of the Gaussian noise in (67).However, since Alice does not know Bob's U j,i , in (79) an additional noise, Υ j , also brings up, i.e., U j −U j = δ j +Υ j .The noise vector − → Υ j with expected variance σ 2 − → Υ j is independent from the real noise on U j,i .This problem will be resolved in Theorem 1 and will be shown that this quantity completely vanishes from the picture.
Alice receives the d -dimensional vectors U j ∈ U j,0 , . . .,U j,d−1 ∈R d , and corrects U j into U j and then from the components she rebuilds the full key K= U 0 , . . .,U (N/d)−1 T ∈R N/d .The errorvector − → δ j ∈R d on a given noisy U j is The covariance matrix of (80) is expressed as: and ( 82) is characterized by covariance matrix The error-corrected U j can be expressed as: where (85) The covariance matrix of (85) is as follows: along with From ( 82) and (87) the quantities U j,i and U j,i are evaluated as follows: and Let us denote by ν the standard deviation of − → δ j + − → Υ j =δ j,i +Υ j,i , 0≤i≤d−1, which is evaluated from (86) and σ 2 The maximum-likelihood-based correction rules can be given in the form of: and: The error probability for the case of decoding vector U j =A, is For the case of correction of U j =B, the error probabilities are evaluated as The decision regions can be separated into two hyperplanes H 1 and H 2 along B−A, which separate U j =A and U j =B.In other words, the correction-condition of a given noisy U j is reduced to the following decision problem: where is the effective distance of A and B. A useful property of vector d drawn in (101), that any independent noise [15] (i.e., independent from the noise on U j ) could live only in the orthogonal directions to d, i.e., (n 1 , . . .,n l ) ⊥d.It immediately follows, that the n 1 , . . .,n l orthogonal directions will have no further importance for Alice in the decoding [15][16][17][18][19]. Since x is a scalar and in (99) the term 1 2 (A+B) is a constant, Alice introduces vector χ∈v as follows: She also draws an orthogonal matrix M, which contains d and the orthogonal directions n 1 , . . .,n l with unit norm as: By multiplying M with χ leads to: From (104), it clearly follows that only x A−B and the first component of M − → δ j have relevance in the error-correction process, because all of the other components are orthogonal to d [15].Since the evolution of d is a trivial process on Alice's side, the received U j can be projected by P onto the direction of d, since all valuable information including the real noise is carried only by this direction.The projection P on U j is made by d T χ, which then results in: The projected vector P U j is analogous to the scalar representation U j = d−1 i=0 U j,i in R, and makes it possible to correct the noise in the scalar space R. The received U j =U j +δ j has mean µ a =a or µ b =b, and the decision boundary is µa+µ b 2 , which defines a separator in R. According to the previously obtained calculations, (104) can be rewritten as follows: As follows, only the first component of M − → δ j has relevance in the error-correction, which in particular coincidences with the scalar quantity δ shown in (79).Putting the pieces together, P U j is evaluated as: which contains all sufficient information for the error correction in R; the proof is concluded here.
In Theorem 2 the error probability of scalar reconciliation is proposed in an exact form.
). Exploiting the result of Theorem 1, in the scalar reconciliation process Alice decides on the scalar quantity U j =a, if: Similarly, she decides on U j =b, if: Conditioned on a or b, the received U j has mean µ a =a or µ b =b, with N µ a , η 2 and N µ b , η 2 .Applying the maximum-likelihood-based correction rule [15][16][17][18][19], Alice calculates with the following inequalities: and: which then leads to (for a comparison see ( 77) and ( 78)): and: The received U j has mean µ a =a or µ b =b, hence one obtains the following conditional probability for an error event, conditioned on Bob has sent U j =a: η < g , where g ∈ N (0, 1), has exponential decay for any |a − b| > 2η, hence: which clearly demonstrates that the error probability of scalar reconciliation exponentially converges to zero.As one can readily obtain from (115), for arbitrary large differences between a and b, η →0 [15][16][17].Then, by applying the maximum-likelihood decision theory and the Bayes' rule [15][16][17][18][19], for a given U j one obtains error probability via the tail function: where g∈N (0, 1) is a standard Gaussian random variable such that Q (x) = Pr (x<g),which clearly demonstrates that Pr (error) depends only on the distance |a−b| of a and b.
The exponential decay of Pr (error) is depicted in Fig. 5.The condition |a−b| > 2η can be trivially satisfied by the parties in any practical CVQKD scenario; the proof is concluded here.

Reconciliation Characteristics
In this section, we analyze the performance of the proposed reconciliation for Gaussian modulation, in terms of secret key rates (bits/pulse) and distances.The excess noise N of the Gaussian quantum channel is expressed as where T is the transmission, and σ 2 ω E is Eve's modulation variance [1].Assuming reconciliation efficiency 0≤β≤1, the key rate can be rewritten as where I (A:B) is the mutual information between Alice and Bob, while χ (B:E) is the Holevo information between Bob and Eve, respectively, with relation where χ (A:E) is the Holevo information between Alice and Eve at a direct reconciliation [1][2][3][4][5][6][7][8][9][10][11][12][13].
At a given SNR, the mutual information of Alice and Bob is [1-8] where σ 2 φ is the transmit signal's variance, σ 2 N 2 is the variance of N 2 , which has parameters that can be calculated from T and N.
In Fig. 6(a) the dσ 2 δ j quantities of the converted logical binary Gaussian channel for various dimensions are shown.As depicted by the red line, the Lyapunov-condition can be exploited to get variance lim of the converted logical channel.As depicted in Fig. 6(b), for d→∞, the efficiency converges to one, β→1, because the noise perfectly converges to a zero-mean Gaussian random variable.
The numerical analysis uses a PM-RR two-way CVQKD protocol, with homodyne measurements.The parameters are as follows.Excess noise N= 0.015, T = 0.8, variance σ 2 X = 1.06, channel correlation n C = 0.5, which parameter describes the correlation of the Gaussian attacks of Eve in the range of 0≤n C ≤1 [7,8].(Note: If n C = 0, there is no correlation between her attacks of N 1 and N 2 ).
In Fig. 7 the SNR of the logical binary Gaussian are depicted for various dimensions.The performance of scalar reconciliation is summarized in Fig. 8.The performance of the simulated protocol without scalar reconciliation with reconciliation efficiency β= 0.9, is depicted by the blue curve [7,8].At d= 16, improved the reconciliation efficiency to β= 0.97, which resulted in significantly higher transmission distances and secret key rates.
The scalar reconciliation applied on the two-way CVQKD protocol resulted in approximately 160 km of achievable transmission distance (for the computations of the secret key rate, and the detection parameters see the derivations of [1], and [7,8]).The results indicate that the range of the current two-way CVQKD without our post-processing technique can be significantly extended, and the maximal 80.5 km range of the current one-way CVQKD systems [12] can be doubled, and almost tripled compared with existing two-way CVQKD systems [7,8].The reason behind the phenomenon is the possibility of the conversion of the Gaussian quantum channel to a logical binary Gaussian channel, similar to the multidimensional reconciliation approaches developed for one-way CVQKD.
The favorable properties of the multidimensional solutions are preserved here, however the proposed scalar reconciliation does not require any multidimensional spherical calculations [9][10][11] and can be extended to arbitrary high dimensions thanks to the fact that it completely eliminates the spherical operations.From the use of higher dimensions a more precise approximation of the logical binary Gaussian channel has also become available which resulted in significantly higher reconciliation efficiency in comparison to current two-way CVQKD reconciliation methods.
The proposed scalar reconciliation is available at low SNRs, and the transmission ranges of experimental long-distance CVQKD can significantly be improved because at low SNRs the capacity of the logical binary Gaussian channel coincidences with the capacity of the Gaussian quantum channel, and the logical channel resulted from the conversion can approximate it with arbitraryhigh precision.=C X j −C (X j ) measures the difference of C X j and C (X j ), i.e., the noise of Bob's CDFtransformed data.Let X j ∈N 0, σ 2 X = 100 and X j ∈N 0, σ 2 X = 104 .The example uses an d= 16 dimensional approximation.
The distribution of the error C (∆ j,i ) of the CDF-transformed raw data units C X j,i , C (X j,i ) are depicted in Fig. 12.The distribution of the error C (∆ j,i ) =C X j,i −C (X j,i ) on the CDF-transformed raw data units.
The ratio C X j,i /C (X j,i ) of the CDF-transformed units is shown in Fig. 13(a).In the ideal (noise-free) case the ratio equals to 1.In Fig. 13(b) the distribution of the quantity C (∆ j,i )/C (X j,i ) is shown.
In Fig. 14(a) the distribution of noise δ j,i on units U j,i is shown, assuming that Bob selects U j,i ∈ {−400/16, 400/16}.
In Fig. 14(b) the distribution of δ j on U j , using U j = d−1 i=0 U j,i ∈ {−400, 400} is depicted.The distribution of δ j is given by the formula of N 0, σ 2 δ j , and the approximation of the binary Gaussian logical channel is justified by the CLT and the Lyapunov-condition.
The results make it possible to achieve a high-precision conversion of the physical Gaussian quantum channel into a logical binary Gaussian channel.Precisely, only an approximation is possible by the logical layer manipulations, which gets closer to perfect as d→∞.At d= 16 the approximation is almost perfect, and the noise on U j = d−1 i=0 U j,i is a real Gaussian noise N 0, σ 2 δ j .
in a practical CVQKD scenario.The reconciliation is also possible in the level of the logical layer by a classical authenticated communication channel and by traditional algorithmical tools.The multidimensional approaches were developed for this purpose, however the use of complex multidimensional calculations is also not desirable in a practical scenario.The proposed scalar reconciliation eliminates the use of multidimensional spherical space along with the dimensional boundaries.The scalar reconciliation process neither requires any physical-layer tomography, and only standard operations and calculations needed in the level of raw data.The method provides an easy implementation to maximize the extractable valuable binary information from the correlated raw data to significantly boost up the key rates and to improve the distance ranges of CVQKD.

Figure 1 :
Figure 1: Simplified model of a PM-RR two-way CVQKD protocol with the scalar reconciliation.The modulated Gaussian variables are sent through a Gaussian quantum channel (AWGN) depicted by N 1 and N 2 (same physical link).The classical channel is depicted by the dashed line.Bob sends S Bob to Alice over N 1 .Alice adds to it her secret S Alice by a BS, and applies measurement M 1 , which defines her raw data X=M 1 (N 1 (S Bob ) +S Alice ).The other mode is sent back to Bob over N 2 , who applies M 2 , which results in his X =M 2 (N 2 (N 1 (S Bob ) +S Alice )).

Figure 5 :
Figure 5: The error probability of the scalar reconciliation process.It converges exponentially to zero as |a−b| > 2η.

Figure 6 :
Figure 6: (a): The SNR of the resulting logical binary channel is maximized by the Lyapunovcondition (red line).It makes possible to convert the physical Gaussian quantum channel to a logical channel with the same noise variance for arbitrary d.For the blue line the Lyapunov-condition is not satisfied.(b):The capacity of the logical channel for various dimensions.At low SNRs the capacity of the physical Gaussian quantum channel (dashed line) coincidences with the capacity of the binary Gaussian channel (red).For d= 16, the capacity of the logical channel is very close to the capacity of a binary Gaussian channel, and at low SNRs it perfectly coincidences with the capacity of the Gaussian quantum channel.The reconciliation efficiency at d= 16 is β= 0.97.The curves for lower d -s do not exist because the resulting logical channels are not Gaussian, since the Lyapunov-condition is not satisfied in the low-regimes.

Figure 7 :
Figure 7: The SNRs of the logical channel at variance σ 2 X = 1.06.As the dimension increases the variance of the logical channel reaches the variance of the physical quantum channel.At d= 16 the variances perfectly coincidence.

4 Figure 12 :
Figure 12:  The distribution of the error C (∆ j,i ) =C X j,i −C (X j,i ) on the CDF-transformed raw data units.