Reconciliation Efficiency Impact on Discrete Modulated CV-QKD Systems Key Rates

Continuous variable quantum key distribution (CV-QKD) allows the distribution of symmetric keys in a secure manner. CV-QKD systems can extract keys at its maximum rate when using Gaussian modulation (GM). Nonetheless, GM demands high-capacity random number sources and tends to be very hard to approach in practice. To circumvent these disadvantages, higher-order probabilistic-shaped discrete modulation (DM) can be used. State-of-the-art works compute the key rates of DM-CV-QKD systems considering a fixed value for the reconciliation efficiency and do not take into account the frame error rate (FER) of the system, thus over or under estimating the key rates. In this work, we study the security bounds of CV-QKD systems considering probabilistic shaped DM formats with 256-symbols in the finite-size regime. This accounting for the true value of the reconciliation efficiency, and the FER of the information reconciliation step. Both conventional and hexagonal 256-quadrature amplitude modulation (QAM) constellations yield higher key rates than 256-amplitude and phase shift keying (APSK) constellations, with 256-QAM constellations being indistinguishable in performance with GM for high transmission distances. Minimum signal-to-noise ratio (SNR) values were fixed from a FER analysis through a CV-QKD simulation allowing for key extraction considering different FER levels. Lower FER values are associated with higher SNRs in the system and thus lower achievable transmission distances. Nonetheless, the FER maximizing the extraction key rate is not null. Our results show that the extraction key rate is maximized by SNR adjustment which should have in account both the reconciliation efficiency and the FER.


I. INTRODUCTION
Q UANTUM key distribution (QKD) can be used to distribute symmetric keys over optical links avoiding any computational assumption [1]. In the continuous variables (CVs) realm this can be provided by using weak coherent fields and off-the-shelf coherent detection [2], [3], [4], [5]. The use of discrete modulation (DM) alongside CV-QKD protocols is an attractive solution due to the possibility of using standard modulation formats, such as M-symbol (M-) quadrature amplitude modulation (QAM) and M-amplitude and phase shift keying (APSK) constellations. Such DM formats can approximate the theoretically optimal performance of Gaussian modulation (GM) [6], [7]. Nonetheless, to the best of our knowledge, the impact of the information reconciliation step, fundamental to retrieving symmetric keys from any QKD implementation, on the performance of higher-order DM-CV-QKD remains an open issue in the literature. CV-QKD systems were initially proposed using GM to model the quantum signal [4], [8]. GM is theoretically optimal in terms of secret key rate [9]. Nonetheless, the security proofs assume ideal GM, which is very difficult to achieve in practice due to the finite extinction ratio of the electro-optic modulators [10]. Moreover, ideal GM requires high amounts of randomness, which demands the use of extreme high-speed true random number generators [10]. On the other hand, DM-CV-QKD avoids these disadvantages, while keeping not straightforward. Thus, a performance comparison between DM formats in CV-QKD is also an open issue. Moreover, the experimental demonstrations of higher-order DM formats for secret keys extraction were obtained offline without the implementation of all post-processing steps [14], [15], [16], [17]. As such, the obtained key rates do not account for the frame error rate (FER) in the system. Furthermore, state-of-the-art works in DM-CV-QKD such as [6], [7], [14], [15], [16], [17] assume a fixed value for the reconciliation efficiency parameter, leading to an under or over estimation of the key rates achieved by the system. This undervaluing the effect of the information reconciliation method and of the signal-to-noise ratio (SNR) of the system on the reconciliation efficiency parameter.
We assess the performance of probabilistic shaped 256symbols DM-CV-QKD systems. Considering the true value of the reconciliation efficiency, the performance of 256-QAM constellations closely approximates the optimum performance of GM. On the other hand, 256-APSK constellations are further apart from GM's performance. We found that maximizing the reconciliation efficiency leads to higher FER values, thus deteriorating the extraction key rate. Moreover, minimizing the FER does not maximize the final extraction key rate. To maximize the final extraction key rate of the DM-CV-QKD system, the SNR must be adjusted to allow a high reconciliation efficiency and a low FER. For 10 km, SNR values around 0.23 were found to lead to maximum key extraction rates.
This article is organized as follows. In Section II we introduce the model considered to compute the secret key rate, accounting for the true value of the reconciliation efficiency. Section III briefly describes the DM formats and distributions considered for probabilistic shaping, alongside the DM-CV-QKD implemented simulation. In Section IV we present results considering the true value of the reconciliation efficiency. Finally, we study the extraction key rate of DM-CV-QKD systems considering the FER of the system. In Section V a brief conclusion is presented and directions for future work are discussed.

II. SECRET KEY RATE MODEL
The secret key rate of a CV-QKD system, K, can be computed from the difference between the mutual information between Bob and Alice, I BA , and the Holevo bound between Bob and Eve, χ BE . Since m states from the total number of transmitted states, N , are used to estimate the channel transmission, T , and excess noise, ξ, in the CV-QKD system, only n = N − m states are used to extract the final binary key. As such, in the finite-size effect regime, the secret key rate of a CV-QKD system is given by [18] where the impact of the finite-size blocks to obtain the secret key rate is considered by the Δ(n) parameter and by the use of the worst case estimators for the channel transmission, T and excess noise, ξ [18]. The Δ(n) parameter is related with the security of privacy amplification in the finite-size regime, being given by where¯ is a smoothing parameter, and PA is the failure probability of the privacy amplification procedure [18]. The limited number of exchanged states degrades Alice's and Bob's knowledge on the channel transmission, T , and excess noise, ξ [19]. As such, the analysis of the finite-size effects must also have into account the effect due to the parameter estimation step. This is provided by considering the lower bound of the channel transmission and the upper bound on the excess noise with a probability of at least 1 − PE [18]. Moreover, the CV-QKD system can, at most, extract the amount of bits allowed by the information reconciliation process. Therefore, the mutual information between Bob and Alice, I BA , must be multiplied by the reconciliation efficiency parameter, β. The reconciliation efficiency can be defined as β = 2R I BA , where R is the rate of bits that can be extracted from the information reconciliation step.
For GM, the mutual information between Bob and Alice can be computed as in [20], [21], while for DM we use [22]. On the other hand, for collective Gaussian attacks, the Holevo bound between Bob and Eve, χ BE , can be computed as described by [23], through a proper definition of the Z * parameter, required to compute χ BE . For DM, the Z * parameter can be computed following [6], through the knowledge of the density matrix τ that describes the average state sent by Alice, τ = k p k |α k α k |, where p k is the probability of Alice sending the state |α k . Thus, the Z * parameter can be computed numerically using where Tr(X) is the trace of X, W = k p k ( α k |â † τâτ |α k − | α k |â τ |α k | 2 ), andâ τ = τ 1/2â τ −1/2 . For GM, the Z * parameter is well known, being Z * = T (V 2 A + 2V A ) [6], [23], where V A is the modulation variance.

III. DM-CV-QKD SYSTEM
In this work we will study the regular and irregular 256-APSK, conventional 256-QAM and hexagonal regular and irregular 256-QAM (see Fig. 1). The regular 256-APSK contains 32 states per ring. The probabilistic shaping will consider the binomial and the Boltzmann-Maxwell distributions functions. For the M-APSK constellations, the ring's probability, P p , is given by P p = 2 for the binomial distribution, where n k is the number of ways to choose k elements from a set of n elements, and by P p = exp(−ν( p Q ) 2 )/ p P p for the Boltzmann-Maxwell distribution, with p = 1, 2, . . ., Q, where Q is the number of rings in the constellation, and ν a parameter that needs to be optimized. The probability associated to each state of the constellation is P p,k = P p /M p , with k = 1, . . ., M p and M p being the number of points in ring p. For the conventional M-QAM format, the binomial distribution is defined by choosing the probability of each state to be P k,l = 1 M being the number of levels in each quadrature. For the hexagonal M-QAM formats, the binomial distribution is defined by constructing a hexagonal grid, using two square grids with different centers. The probability of the points nonexistent in the hexagonal constellation are then discarded, and the probabilities of the remaining points are scaled such that the total probability is unitary. For all M-QAM constellations, the Boltzmann-Maxwell distribution is applied by considering P k,l = exp(−ν(k 2 + l 2 ))/ k,l P k,l . At the physical layer of the DM-CV-QKD system, Alice prepares her sequence of states from the chosen DM format (Fig. 1). Alice then sends her states to Bob by the quantum channel, who measures the states. After the state's preparation, transmission and measurement, Alice and Bob apply post-processing techniques to distill a common secret key. The post-processing techniques are composed of parameter estimation, information reconciliation and privacy amplification.
In the parameter estimation step, the lower bound of the channel transmission and the upper bound of the excess noise, with a probability of at least 1 − PE , are estimated from Alice's and Bob's shared states [18]. Here, PE was chosen to be 10 −10 . From this, the secret key rate can be easily estimated using (1), by substituting T and ξ by their lower and upper bound estimates. If the estimate of the secret key rate is positive, the method follows to information reconciliation. If not, the method is aborted.
Information reconciliation was applied by considering multidimensional reconciliation of dimension 8 as described in [24], [25], alongside the sum-product algorithm [24], [26]. Here we consider the multi-edge type (MET) low-density parity check  [27] (LDPC) codes of code rates 0.01, 0.02, 0.05, and 0.1 specified in Table I [27], [28]. MET-LDPC codes can be seen as a generalization of irregular LDPC codes [28], with performance close to the Shannon's limit in the low SNR regime [13], [28]. All MET-LDPC matrices used in this work were generated considering the Progressive-Edge Growth method [29]. At the end of the information reconciliation step we can compute the FER value of the system. The FER is given by the ratio between the number of uncorrected groups and the total number of groups after the information reconciliation step. After information reconciliation, Alice and Bob own a weakly secret binary sequence W . Since Eve may contain some information on W , Alice and Bob perform privacy amplification. This  TABLE II  CHARACTERISTICS OF THE MET-LDPC CODES CORRESPONDING TO THE  MULTIVARIATE POLYNOMIAL PAIRS PRESENTED IN TABLE I is provided through the application of the Toeplitz extractor, using a uniformly random and non-secret seed s [30], [31]. The Toeplitz matrix, M , is applied to the weakly secret information vector W , returning a vector Z with almost uniform secret randomness, by doing W · M = Z [32]. Moreover, we apply fast-Fourier transforms to the Toeplitz extractor following the method described in [13]. The size of the extracted key Z is given by |W |(βI BA − χ BE − Δ(n)) , where · denotes the floor function and |W | is W 's length. With this, at the end of privacy amplification one is able to compute the extraction key rate, K extraction , given by The extraction key rate gives the rate at which the DM-CV-QKD system extracts key bits per symbol transmitted in the quantum channel, and should not be confused with the secret key rate. The secret key rate does not account for the information reconciliation step, while the extraction key rate does. Usually, the secret key rate is considered to study the performance of DM-CV-QKD systems, which is equivalent to assuming that the FER in the system is null. Nonetheless, the extraction key rate given by (4) is a better figure of merit of the performance of CV-QKD systems.

IV. RESULTS
The reconciliation efficiency, β, is the ratio of twice the code rate of the MET-LDPC code used for information reconciliation to the mutual information, i.e., β = 2R I BA . As such, smaller SNRs in the system require smaller code rates for key extraction. Remark that each MET-LDPC code has a minimum SNR for which key extraction is possible. The minimum value of the SNR, SNR min , can be computed from the threshold, obtained by [27], [28] through density evolution, by doing SNR min = 1/(threshold 2 ). The maximum reconciliation efficiencies are computed from the minimum value of the SNR assuming GM, since [27], [28] obtained the threshold parameter considering a Gaussian modulated CV-QKD system. Table II presents these characteristics for the MET-LDPC codes considered in this work.
For non-unity reconciliation efficiency, β, there is a trade-off between the mean number of photons per symbol and the key rate value. Such trade-off was analyzed for Gaussian modulation in [21], [33]. Despite such analysis, in the case of discrete modulation being out of our focus, we optimize the mean number of photons per symbol such that the secret key rate is maximized. This for each transmission distance, and considering the reconciliation efficiency value associated with the MET-LDPC code rate that was used.
In this section, we present results for the secret key rate given by (1) and for the extraction key rate given by (4), considering numerical simulations of the DM-CV-QKD system using MET-LDPC codes for information reconciliation with different code rates. Moreover, we compare the results of the secret key rate given by (1) from the simulations with the theoretical ones. All these results consider the real value of the reconciliation efficiency parameter. We have considered the maximum values of reconciliation efficiency and the minimum values of SNR presented in Table II. The theoretical results are computed from the theoretical expressions, considering the lower bound of the channel transmission and the upper bound of the excess noise. For the results of the numerical simulations, the lower bound of the channel transmission and the upper bound of the excess noise are estimated from the comparison of Alice's and Bob's states. Fig. 2 shows the secret key rate along transmission distance for different code rates for conventional 256-QAM using optimized mean number of photons per symbol. The code rate may be chosen in order to maximize the secret key rate. From the theoretical results of the secret key rate of Fig. 2 we can see that, for the various constellations under study, the MET-LDPC code with R = 0.05 performs better for longer transmission distances. In opposition, the MET-LDPC code with R = 0.1 allows higher secret key rates for shorter transmission distances. Remark that the secret key rate for R = 0.1 decreases faster than for R = 0.05. As such, for higher transmission distances, choosing a smaller code rate for the MET-LDPC code is beneficial. Nonetheless, further decreasing the code rate may not result in the extension of the maximum achievable transmission distance, as observed for R = 0.02. In fact, the decrease of the secret key rate due to the decrease of the code rate may be such that the secret key rate is null for all range of transmission distances, such as occurs for R = 0.01. As such, the MET-LDPC codes of code rates 0.02 and 0.01 do not maximize the secret key rate for any transmission distance. A proper choice of the code rate of the information reconciliation method is fundamental.
For both theoretical and numerical results, we have optimized the mean number of photons per symbol in order to maximize the secret key rate. The optimum mean number of photons per symbol is represented in Fig. 3(a) for the code rates R of 0.1, 0.05, 0.02, and 0.01 as a function of the transmission distance. The mean number of photons per symbol that maximizes the secret key rate given by (1) is statistically the same for all constellations considered. Fig. 3(a) presents a different evolution with the transmission distance than the one observed for the same figure of merit when fixing the reconciliation efficiency (see for instance Fig. 10 of [7]). Maximizing the secret key rate given by (1), when the true value of the reconciliation efficiency is considered, leads to an increase on the optimum mean number of photons per symbol with the transmission distance and with the code rate. For transmission distances above 25 km, the optimum mean number of photons per symbol is higher than 1 photon per symbol, allowing an easier practical implementation of the DM-CV-QKD system.
The optimization of the mean number of photons per symbol ( Fig. 3(a)) is such that the SNR is approximately constant and kept close to the minimum value of SNR corresponding to the maximum value of the reconciliation efficiency (Table II). For the MET-LDPC code of code rate 0.1, this occurs for SNR values close to 0.15 allowing a reconciliation efficiency of 96.26% (Table II) for all range of transmission distance.
In Fig. 3(b) we present both theoretical results and numerical results from simulations of the secret key rate given by (1) as a function of the transmission distance considering the true value of the reconciliation efficiency and the finite-size effects for a total of N = 10 8 exchanged states. The numerical results were obtained in the parameter estimation step of simulations of the DM-CV-QKD system performed for transmission distances of 40, 48, 51 and 55 km. The secret key rate was maximized considering the mean number of photons per symbol and the code rate R of the MET-LDPC codes. Remark that such optimization in the simulation of the DM-CV-QKD, as in an experimental implementation, must assume channel's transmission and excess noise values. Nonetheless, the channel's transmission can be monitored in a practical implementation while the effect of the excess noise on the optimum value of the mean number of photons per symbol is small. For the various simulations we also present the extraction key rate given by (4) considering the FER in the system after information reconciliation.
From the results in Fig. 3(b) we can see that, regular 256-APSK performs better than irregular 256-APSK in terms of the secret key rate given by (1), but both are still far from the performance of GM (Fig. 3(b)). All three 256-QAM modulation formats are almost overlapped in terms of secret key rate with GM, thus approximately achieving optimal performance ( Fig. 3(b)). Despite the difference between the different 256-QAM constellations being minimal, concerning the theoretical results, the hexagonal irregular one is the modulation format achieving the highest performance, being followed by the hexagonal regular and then by the conventional one. Remark that this may not be the case for the numerical results, since the secret and extraction key rates are estimated from the simulation, which may result in deviations from simulation to simulation. As an example, in the particular simulations here presented, for 55 km, conventional 256-QAM extracted more data than hexagonal irregular 256-QAM. Similarly, irregular 256-APSK achieved higher extraction key rate than the regular counterpart for 48 km, for the same code rate R. Optimizing the mean number of photons to adjust the SNR to the code rate, allowing β close to 1, was beneficial to maximize the secret key rate but, due to the FER associated to the system's SNR, it was not optimal for the extraction key rate. Fig. 4 presents the FER as a function of the SNR considering a MET-LDPC code of code rate 0.1. A 40 km distance was considered and the SNR was allowed to vary due to the variation of the mean number of photons per symbol. The FER is unitary for SNR values tending to zero and null for higher values of SNR. For the MET-LDPC code with R = 0.1, the FER is unitary, thus not allowing key extraction, for SNR values smaller than 0.17. The minimal SNR for which error correction is possible is expected to decrease with the decrease of the code rate.
With this, the SNR of the system that maximizes the secret key rate when using the MET-LDPC code of code rate 0.1 is below the value allowing error correction (Fig. 4), resulting in an unitary FER value, thus not allowing key extraction. As such, for the simulations conducted for 40 km, a null extraction key rate given by (4) was obtained, despite the relatively high secret key rate value given by (1) (Fig. 3(b)). When considering the MET-LDPC code with R = 0.05, key extraction was possible since the FER was not unitary for the minimum SNR corresponding to the maximum value of the reconciliation efficiency. Even so, in this case the FER was close to unitary, thus resulting in a high reduction of the amount of extracted bits in the system given by (4), in relation to the secret key rate given by (1) (Fig. 3(b)). No simulations were conducted for transmission distances below 40 km, since the system was expected to extract no key for the code rates here considered, as long as minimum SNRs are used.
The study of the FER as a function of the SNR for the various MET-LDPC codes allowed the definition of minimum values of SNR for different FER levels, as done in Fig. 4 for the code rate 0.1. In Fig. 5(a) we present results for the secret key rate given by (1) and of the extraction key rate given by (4) for different transmission distances considering different FER levels, by fixing different minimum values of SNR. Fig. 5(a) also contains theoretical results for the secret key rate in the system. This considering regular and irregular 256-APSK with a binomial distribution, and conventional and hexagonal regular and irregular 256-QAM with Boltzmann-Maxwell distribution, concerning the true value of the reconciliation efficiency, and accounting for the finite-size effects.
To decrease the expected FER level in the system, the SNR must increase. This results in a decrease of the maximum achievable transmission distance considering the secret key rate given by 1 (Fig. 5(a)). From the simulations conducted for several transmission distances and the various 256-states constellations, we observe the decrease of the FER with the increase of the minimum SNR values fixed in the simulation of the system. The obtained FER values deviate from the expected values ( Fig. 5(a)). Remark that far less exchanged states were used to model the FER as a function of the SNR than for the simulations of the DM-CV-QKD system. To model the FER as a function of the SNR only N = 10 6 states were considered due to time constraints, while for the simulations of the system a total of N = 10 8 of exchanged states was considered to achieve positive secret key rates while accounting for finite-size effects. Nonetheless, for the same transmission distance the differences in the FER between constellations are minimal.
By increasing the SNR in the system, the FER decreases, and the extraction key rate given by (4) approximates the value of the estimated secret key rate given by (1) (Fig. 5). Remark that, since a smaller range of transmission distance is considered through the increase of the SNR, the secret key rate is maximized only using the MET-LDPC code of code rate 0.1. It is also of interest to notice that, increasing the minimum SNRs of the system, irregular 256-APSK achieves higher performances than regular 256-APSK. Moreover, the increase of the SNR in the system also results in a decrease of the reconciliation efficiency. From the FER level of 0.95 to the level of 0.1, resulting in a mean FER of 0.842 and 0.036, respectively, for 10 km, the reconciliation efficiency decreases from 0.75 to 0.59. For the minimum value of SNR, the reconciliation efficiency was expected to be close to 0.96. Nonetheless, such decrease of the reconciliation efficiency is compensated with the decrease of the FER in the system, which results in higher extraction key rates.
Despite the decrease of the FER value, for higher minimum SNR values allowed in the system, resulting in an approximation of the extraction key rate given by (4) to the secret key rate given by (1), the secret key rate of the system also decreases. As such, a point is reached for which the increase of the SNR is no longer attractive (See the results of the simulation undertaken for 10 km of Fig. 5). By increasing the SNR of the system from 0.20 to 0.21 for the MET-LDPC code of code rate 0.1, associated to the FER levels of 0.95 and 0.8, respectively (Fig. 5), one observes an increase of the extraction key rate given by (4) despite the decrease on the secret key rate given by (1). For the hexagonal irregular 256-QAM, this increase is of 0.004 bits per symbol. By increasing once again the minimum SNR from 0.21 to 0.23, associated to the FER levels of 0.8 and 0.5, respectively (Fig. 5), an increase is again observed. For the hexagonal irregular 256-QAM, the extraction key rate increases from 0.009 to 0.016 bits per symbol due to the increase of the system's SNR. However, further increasing the SNR value to 0.26 to reach the FER level of 0.1 (Fig. 5), smaller extraction key rates are obtained. In this case, for the hexagonal irregular 256-QAM, the extraction key rate decreases to 0.008 bits per symbol. Perfect error correction, i.e., a null FER, is not advantageous to maximize the extraction key rate given by (4) due to the effect of the true value of the reconciliation efficiency on the secret key rate. To maximize the extraction key rate of a CV-QKD system, one must not restrict the analysis to the maximization of the secret key rate according to the mean number of photons per symbol for a specific transmission distance. One must also consider the expected FER value and the effect of the reconciliation efficiency on the secret key rate to properly acknowledge the extraction key rate given by (4). As future work, higher code rates should be considered, since this may allow for even higher key rates for small transmission distances. Such is specially interesting for metropolitan communication lines. Moreover, other information reconciliation methods could be studied and compared with multidimensional reconciliation when considering DM-CV-QKD, in particular methods combining different codes rates or with varying code rates.

V. CONCLUSION
We studied the secret key rate of various 256-symbols DM formats with different probabilistic shaping, considering the true value of the reconciliation efficiency. The highest achievable transmission distances were obtained for M-QAM constellations considering the Boltzmann-Maxwell distribution and for M-APSK considering the binomial distribution. M-QAM constellations, namely conventional and regular and irregular hexagonal M-QAM, achieve higher performance than M-APSK constellations, namely regular and irregular M-APSK. The 256-QAM constellations are almost indistinguishable from the performance of GM. When considering the true value of the reconciliation efficiency, different MET-LDPC code rates maximize the secret key rate for different transmission distance ranges. The code rate maximizing the secret key rate and the reconciliation efficiency decreases with the transmission distance. Nonetheless, this is associated to small values of SNR, resulting in higher FER values, not allowing for key extraction. Thus, higher SNR values must be considered, even if resulting in the decrease of the reconciliation efficiency. The higher the SNR, the smaller the FERs, and the closer the extraction key rate, at the end of the privacy amplification step, is to the secret key rate estimated in the parameter estimation step. Nonetheless, the minimization or even nullification of the FER does not maximize the extraction key rate. The maximization of the extraction key rate is achieved using high reconciliation efficiency, but also low FER, which requires a compromise on the SNR value. More possibilities of code rates for the MET-LDPC codes can be considered depending on the target distance, which may be less vulnerable to high FER values. As future work, we intend to study not only higher code rates in multidimensional reconciliation, but also different information reconciliation methods, alongside DM-CV-QKD systems. The use of adaptable reconciliation methods might also be of interest to achieve higher transmission distances. Remark that different reconciliation methods require different parameters to be optimized for the maximization of the extraction key rate. Besides that, eavesdropper attacks in addiction to the collective ones presented in this work should also be considered.