Information reconciliation Sample Clauses

Information reconciliation. Xxxxx, who obtained the bit string x0 of length n from the trusted third party first chooses a very large number of uniform random n-bit strings x1, . . . , xt and sends them to Bob, whereas she hides x0 in a random po- sition in the strings (in other words, she sends a random permutation of x0, . . . , xt to Bob). We do not care about the amount of communication needed in this simple protocol. A randomly chosen string matches Bob’s information with probability 2—n(1—p), while it matches Xxx’s information with probability 2—n(1—q). Thus, if q > p and n is large enough, we can choose t appropriately between 2n(1—q) and 2n(1—p), such that with high probability only the string x0 matches Bob’s information, while many strings will match Xxx’s information. In other words, Xxxxx and Xxx agree on a common string, while Xxx still has large min-entropy about x0. This method to do information reconciliation requires a large amount of communication. A different method often used in the literature is that Al- ice sends Bob the output of a randomly chosen two-universal hash func- tion applied on her input (including the information which two-universal hash function was chosen). The idea here is that the possible preimages of a two-universal hash function have similar properties as our randomly chosen strings. However, in this case it is not clear how Bob can recover the input of Xxxxx computationally efficiently. For this reason we will use error correcting codes in our construction, as explained in Section 3.3.

Information reconciliation. This section describes information reconciliation, i.e., it shows how Al- ice and Bob can obtain a common string over which Xxx has large min- entropy. For this we assume that Xxxxx and Xxx have instances of random variables which are distributed according to a distribution PXYZ which satisfies H(X Z) > H(X Y) (i.e., we ignore the preprocessing in this sec- tion).

Information reconciliation. Finally, Xxxxx and Xxx need to ensure that they obtain a same key and correct the mismatch bits, which are very few in TDS. TDS uses an in-

Information reconciliation. Finally, Xxxxx and Xxx need to ensure that they obtain a same key and correct the mismatch bits, which are very few in TDS. TDS uses an in- formation reconciliation method, as presented in prior work [3, 28]. Note that the protocol has a threshold T such only Correlation coefficient 0.5 0.03 0.03 -11 5 10 15 20 25 30 0.02 Probability 0.01 01 40 80 120 Probability 0.01 0 Δσ^0 Δσ^1 20 40 60 80 150 180 210 Ba Bb Bc 240 CSI subcarrier index Singular value The difference of singular value σˆ2 Δσˆ2 a device with error bits fewer than T can start information reconciliation with Xxxxx.

Information reconciliation. The transmitter and the le- gitimate receiver exchange messages over the public in which i denotes the index of the channel use. When n is sufficiently large, the power constraint is equivalent to a trace constraint on the input covariance matrix KX = E XnT (XnT )† . In addition, the transmitter and the receiver are allowed to communicate over a two way, public, noiseless and authenticated channel to distill a secret-key from the symbols transmitted over the noisy channel. We refer the reader to [3] for a precise description of a key-distillation strategy. Suffice to say that it consists of transmissions over the noisy channel as well as exchanges channel to agree on a common bit sequence.

Information reconciliation. Xxxxx and Xxx exchange messages over the public channel, in order to agree on a common sequence of bits, extracted from the observations Xn or Y n.

Information reconciliation. In Round 0, Xxxxx sends to Bob, n and ht(x), where ht is the hash function introduced above. Next, Xxxxx computes p′ = ERRV(x, w) for a random w ∈ {0, 1}d. Xxxxx sends to Bob the string p′ (or rather a prefix of it), one bit per round, till Bob announces that he does not need more bits. Suppose we are at round k, after Xxxxx has sent the k-th bit of p′. Thus, by now Bob has received pk, the k-th bit long prefix of p′. He calculates, as we explain next, a set of candidate strings, which he thinks might be x. A string x′ is a candidate at round k if 1. x′ ∈ B = {u ∈ {0, 1}n | CS(n−k)(u | y, n, k + c) ≤ k + c}, and