Information reconciliation Clause Samples

Information reconciliation. The transmitter and the le- gitimate receiver exchange messages over the public in which i denotes the index of the channel use. When n is sufficiently large, the power constraint is equivalent to a trace constraint on the input covariance matrix KX = E XnT (XnT )† . In addition, the transmitter and the receiver are allowed to communicate over a two way, public, noiseless and authenticated channel to distill a secret-key from the symbols transmitted over the noisy channel. We refer the reader to [3] for a precise description of a key-distillation strategy. Suffice to say that it consists of transmissions over the noisy channel as well as exchanges channel to agree on a common bit sequence.

Information reconciliation. In Round 0, ▇▇▇▇▇ sends to Bob, n and ht(x), where ht is the hash function introduced above. Next, ▇▇▇▇▇ computes p′ = ERRV(x, w) for a random w ∈ {0, 1}d. ▇▇▇▇▇ sends to Bob the string p′ (or rather a prefix of it), one bit per round, till Bob announces that he does not need more bits. Suppose we are at round k, after ▇▇▇▇▇ has sent the k-th bit of p′. Thus, by now Bob has received pk, the k-th bit long prefix of p′. He calculates, as we explain next, a set of candidate strings, which he thinks might be x. A string x′ is a candidate at round k if 1. x′ ∈ B = {u ∈ {0, 1}n | CS(n−k)(u | y, n, k + c) ≤ k + c}, and

Information reconciliation. This section describes information reconciliation, i.e., it shows how Al- ice and Bob can obtain a common string over which ▇▇▇ has large min- entropy. For this we assume that ▇▇▇▇▇ and ▇▇▇ have instances of random variables which are distributed according to a distribution PXYZ which satisfies H(X Z) > H(X Y) (i.e., we ignore the preprocessing in this sec- tion).

Information reconciliation. Finally, ▇▇▇▇▇ and ▇▇▇ need to ensure that they obtain a same key and correct the mismatch bits, which are very few in TDS. TDS uses an in-

Information reconciliation. ▇▇▇▇▇ and ▇▇▇ exchange messages over the public channel, in order to agree on a common sequence of bits, extracted from the observations Xn or Y n.

Information reconciliation. ▇▇▇▇▇, who obtained the bit string x0 of length n from the trusted third party first chooses a very large number of uniform random n-bit strings x1, . . . , xt and sends them to Bob, whereas she hides x0 in a random po- sition in the strings (in other words, she sends a random permutation of x0, . . . , xt to Bob). We do not care about the amount of communication needed in this simple protocol. A randomly chosen string matches Bob’s information with probability 2—n(1—p), while it matches ▇▇▇’s information with probability 2—n(1—q). Thus, if q > p and n is large enough, we can choose t appropriately between 2n(1—q) and 2n(1—p), such that with high probability only the string x0 matches Bob’s information, while many strings will match ▇▇▇’s information. In other words, ▇▇▇▇▇ and ▇▇▇ agree on a common string, while ▇▇▇ still has large min-entropy about x0. This method to do information reconciliation requires a large amount of communication. A different method often used in the literature is that Al- ice sends Bob the output of a randomly chosen two-universal hash func- tion applied on her input (including the information which two-universal hash function was chosen). The idea here is that the possible preimages of a two-universal hash function have similar properties as our randomly chosen strings. However, in this case it is not clear how Bob can recover the input of ▇▇▇▇▇ computationally efficiently. For this reason we will use error correcting codes in our construction, as explained in Section 3.3.