The Road to Near-Capacity CV-QKD Reconciliation: An FEC-Agnostic Design

New near-capacity continuous-variable quantum key distribution (CV-QKD) reconciliation schemes are proposed, where both the authenticated classical channel (ClC) and the quantum channel (QuC) for QKD are protected by separate forward error correction (FEC) coding schemes. More explicitly, all of the syndrome-based QKD reconciliation schemes found in literature rely on syndrome-based codes, such as low-density parity-check (LDPC) codes. Hence at the current state-of-the-art the channel codes that cannot use syndrome decoding such as the family of convolutional codes (CCs) and polar codes cannot be directly applied. Moreover, the ClC used for syndrome transmission in these schemes is generally assumed to be idealistically error-free, where the realistic additive white Gaussian noise (AWGN) and Rayleigh fading of the ClC have not been taken into account. To circumvent this limitation, a new codeword-based - rather than syndrome-based - QKD reconciliation scheme is proposed, where Alice sends an FECprotected codeword to Bob through a ClC, while Bob sends a separate FEC protected codeword to Alice through a QuC. Upon decoding the codeword received from the other side, the final key is obtained by applying a simple modulo-2 operation to the local codeword and the decoded remote codeword. As a result, first of all, the proposed codeword-based QKD reconciliation system ensures protection of both the QuC and of the ClC. Secondly, the proposed system has a similar complexity at both sides, where both Alice and Bob have an FEC encoder and an FEC decoder. Thirdly, the proposed system makes QKD reconciliation compatible with a wide range of FEC schemes, including polar codes, CCs and irregular convolutional codes (IRCCs), where a near-capacity performance can be achieved for both the QuC and for the ClC. Our simulation results demonstrate that thanks to the proposed regime, the performance improvements of the QuC and of the ClC benefit each other, hence leading to an improved secret key rate (SKR) that inches closer to both the Pirandola-Laurenza-Ottaviani-Banchi (PLOB) bound and to the maximum achievable rate bound.

ABSTRACT New near-capacity continuous-variable quantum key distribution (CV-QKD) reconciliation schemes are proposed, where both the authenticated classical channel (ClC) and the quantum channel (QuC) for QKD are protected by separate forward error correction (FEC) coding schemes.More explicitly, all of the syndrome-based QKD reconciliation schemes found in literature rely on syndrome-based codes, such as low-density parity-check (LDPC) codes.Hence at the current state-of-the-art the channel codes that cannot use syndrome decoding such as the family of convolutional codes (CCs) and polar codes cannot be directly applied.Moreover, the ClC used for syndrome transmission in these schemes is generally assumed to be idealistically error-free, where the realistic additive white Gaussian noise (AWGN) and Rayleigh fading of the ClC have not been taken into account.To circumvent this limitation, a new codeword-based -rather than syndrome-based -QKD reconciliation scheme is proposed, where Alice sends an FEC-protected codeword to Bob through a ClC, while Bob sends a separate FEC protected codeword to Alice through a QuC.Upon decoding the codeword received from the other side, the final key is obtained by applying a simple modulo-2 operation to the local codeword and the decoded remote codeword.As a result, first of all, the proposed codeword-based QKD reconciliation system ensures protection of both the QuC and of the ClC.Secondly, the proposed system has a similar complexity at both sides, where both Alice and Bob have an FEC encoder and an FEC decoder.Thirdly, the proposed system makes QKD reconciliation compatible with a wide range of FEC schemes, including polar codes, CCs and irregular convolutional codes (IRCCs), where a near-capacity performance can be achieved for both the QuC and for the ClC.Our simulation results demonstrate that thanks to the proposed regime, the performance improvements of the QuC and of the ClC benefit each other, hence leading to an improved secret key rate (SKR) that inches closer to both the Pirandola-Laurenza-Ottaviani-Banchi (PLOB) bound and to the maximum achieveable rate bound.
INDEX TERMS Continuous variable quantum key distribution (CV-QKD), multidimensional reconciliation, low-density parity check (LDPC) codes, irregular convolutional codes (IRCC), secret key rate (SKR), nearcapacity codes.Given the increasing penetration of commercial fifth generation (5G) services, since 2020 researchers have embarked on the exploration of future wireless systems such as beyond 5G (B5G) and sixth generation (6G) communication.In this context, quantum science has the promise of supporting a range of appealing application scenarios [1]- [4].More explicitly, on one hand, quantum computing provides revolutionary acceleration in the information processing speed, which is envisioned to substantially improve the computing efficiency in B5G applications and to facilitate powerful new solutions for optimizing next-generation (NG) systems [5].However, the commercialization of quantum computing may also impose a threat to the conventional cryptosystems [6]- [14].These classical cryptography algorithms can provide computational security, which is practically unbreakable within a relatively short period of time when using state-of-the-art computational sources.However, conventional cryptography may be endangered by the progress in advanced quantum computing techniques.More explicitly, Shor's powerful algorithm that is capable of efficiently factorizing large prime numbers and of solving elliptic curve problems can impose a serious threat on the classic asymmetric cryptography [15].Similarly, Grover's search algorithm will also make sym-

List of Abbreviations
BB84 the first DV-QKD protocol with prepare-and-measure implementation [27].
FIGURE 1: State-of-the-art QKD protocols metric cryptography insecure [16], [17].Hence, a quantumsafe cryptosystem is needed to tackle this threat.Against this backdrop, quantum key distribution (QKD) as one of the promising technologies can play an important role in providing sufficiently secure and reliable data transmission for next-generation communication systems [18]- [25].More explicitly, a QKD scheme instructs both the transmitter Alice and the receiver Bob to encrypt their confidential messages with the reconciled keys generated at both sides.This socalled one-time pad (OTP) system has been proven by Shannon to be information-theoretically secure [26].Furthermore, the QKD-based cryptosystem possesses the capability of eavesdropping detection based on the no-cloning theorem and Heisenberg's uncertainty principle.
The earliest QKD protocol can be traced back to 1984, which is the Bennett-Brassard-1984 (BB84) protocol [27].Since then, a variety of QKD protocols have been proposed, which can be divided into two types, i.e. discrete variable QKD (DV-QKD) and continuous variable QKD (CV-QKD).The state-of-the-art of DV-QKD and CV-QKD schemes is summarized at a glance in Fig. 1.More specifically, the landmark BB84 protocol [27] has spawned the family of DV-QKD exemplified by the Ekert-91 (E91) [28], Bennett-Brassard-Mermin-1992 (BBM92) [30], Bennett-92 (B92) [29], six-state [31], decoy-state [33], Scarani-Acién-Ribordy-Gisin-2004 (SARG04) [34], Twinfield (TF) [37], and phase-matching (PM) [38] protocols.Furthermore, the first CV-QKD protocol was the Gaussian modulation assisted Grosshans-Grangier-2002 (GG02) protocol [32], which was followed by the discrete modulation based CV-QKD Leverrier-Grangier-2009 (LG09) [35] protocol.A comprehensive overview of QKD protocols can be found in [39]- [43].Table 1 offers a comparison between the two types of QKD.First of all, for light sources, typically the single photon or the attenuated laser source is utilized in DV-QKD, whilst the coherent state or squeezed state solution is used for CV-QKD.Secondly, the DV-QKD modulates or maps information onto the discrete degrees of freedom of a single photon, such as its polarization or phase.By contrast, the CV-QKD information is modulated or mapped onto the quadrature components of electromagnetic fields [19].Finally, single-photon detection is required for DV-QKD, which is expensive to implement and yet has a low key rate.By contrast, for CV-QKD either homodyne or heterodyne detection is utilized, which has convenient compatibility with the operational network infrastructure [19], [44].
Recently, some authors have studied the feasibility of CV-QKD for NG wireless communication systems operating at microwave and terahertz (THz) frequencies [45]- [48].More explicitly, multiple-input multiple-output (MIMO) and orthogonal frequency division multiplexing (OFDM) air interface techniques have been utilized for increasing the limited secure transmission distance caused by the high path loss of the THz band [49]- [56].Furthermore, some recent achievements in THz hardware implementations such as detectors, power-efficient sources and antennas [57]- [60], can facilitate the practical implementation of CV-QKD in NG communication systems.Therefore, this paper mainly focuses on the study of CV-QKD.
As an important step of classical post-processing in QKD, reconciliation plays an pivotal role in ensuring that both the transmitter and the receiver rely on the same bit stream and use it as the reconciled key.More explicitly, the reconcilia-tion process is based on error correction used for mitigating the deleterious effects of noise and interference imposed by Eve [61].For instance, a simple Hamming code was utilized in the reconciliation step to correct the bit errors in the raw key string shared by the satellite and the ground station for the experimental satellite-to-ground QKD system used in the Micius experiment [62].Inspired by this development, some more advanced forward error correction (FEC) codes have also been investigated, such as low-density paritycheck (LDPC) codes [13], [63]- [68], polar codes [55], [69]- [71], rateless codes [72], [73], and their diverse variants.As a further advance, instead of using a fixed FEC code rate, adaptive-rate reconciliation schemes were proposed in [74]- [76], where the secret key rate (SKR) and the secure transmission distance were optimized for different signal-tonoise ratios (SNRs).Moreover, a Raptor-like LDPC code was harnessed for QKD in [75], where the rate-compatible nature of the raptor code was exploited for reducing the cost of constructing new matrices for low-rate LDPC codes harnessed at low SNRs.In contrast to the conventional CV-QKD reconciliation, where a so-called single decoding attempt based algorithm was used, a multiple decoding attempt based method was adopted in [68] to improve the SKR performance.Furthermore, a large block length based LDPC coded scheme was analyzed in [77], where a nearcapacity performance was achieved for transmission over the quantum channel (QuC).
A list of LDPC coded QKD reconciliation schemes is seen at a glance in Table II.In a nutshell, there are two main types of reconciliation methods, namely the multidimensional [78], [79] and the slice-based reconciliation method [80], [81].The former achieves better performance in the low-SNR region, which is suitable for longe-range CV-QKD transmission, while the latter in the high-SNR domain, which is suitable for short-distance CV-QKD systems 1 .The soft-decision LDPC decoding adopted for QKD in [13], [83] outperforms the hard-decision decoding algorithm of [81], but at the cost of a higher complexity.However, a major issue is that all the existing studies assume that the classical channel (ClC) used for syndrome transmission is error-free.In practice, the ClC is contaminated both by fading and noise, hence error correction is required for both the QuC and the classical tion efficiency than slice based reconciliation due to the fact that there is no quantization process, which can cause performance degradation, and also that the capacity of the virtual established channel gets closer to the capacity of additive white Gaussian noise (AWGN) channel at a low SNR [82].However, its throughput is limited to 1 bit, hence making it more suitable for long-range CV-QKD transmission system.By contrast, the slice based reconciliation, especially the multilevel coding and multistage decoding aided slice based reconciliation, has the capability of extracting more than 1 bit of information per channel use (bpcu), especially for higher SNRs.This is achieved at the cost of poor quantization performance in the low SNR region, making it more suitable for a short range CV-QKD transmission system.
syndrome-feedback channel.Consequently, for the multidimensional reconciliation scheme, the receiver has to perform two separate FEC decoding actions, namely one for the QuC and one for the ClC2 .This creates an imbalance in terms of the reconciliation complexity, heavily burdening one side.Furthermore, the classic syndrome-based QKD reconciliation system is limited to syndrome-based codes such as LDPC codes, while the family of convolutional codes (CCs) that are often included in communication standards [84], [85] have not been used in the open literature.Against this background, the novel contributions of this work are as follows: • Firstly, the block error rate (BLER) performance is analyzed in the context of syndrome-based reconciliation systems, where the ClC is initially assumed to be errorfree, and both the bit-flipping (BF) and belief propagation (BP) based decoding algorithms are harnessed.More explicitly, we revise Gallager's sum-product algorithm (SPA) for LDPC codes using BP, where both the codeword transmitted through the QuC and the side information conveying the syndrome through the authenticated ClC can be accepted as the input of the modified SPA.Our performance results confirm that the revised BP decoder substantially outperforms the conventional BF decoder in terms of the secret key rate (SKR) of the QKD system.• Secondly, for the first time in the literature, the effect of a realistic imperfect ClC is characterized for syndrome transmission from Bob to Alice, where reverse reconciliation (RR) is considered and the effects of both fading as well as of noise are taken into account.We demonstrate that the QKD system requires error correction for both the quantum and ClC.Consequently, the receiver has to perform FEC decoding of the potentially corrupted encoded syndrome for transmission over the ClC, and FEC decoding of the corrupted reference key sent from Bob over the ClC, making the decoding complexity unbalanced that burdens the receiver side.This calls for clean-slate considerations for a new QKD system design.• Thirdly, a new bit-difference based CV-QKD reconciliation scheme is proposed, where Bob transmits the key through the QuC to Alice, and Alice carries out decoding with the aid of the bit-difference side information sent by Bob through the ClC to Alice.
The bit-difference side information is constituted by the vector of bit differences between the key and a legitimate LDPC codeword.This regime allows us to use any arbitrary FEC codes.Our performance results confirm that for a specific FEC this new system has the same performance as the conventional syndrome-based CV-QKD [61], but again, it is compatible with any FEC schemes, including polar codes, CCs and irregular convolutional codes (IRCCs).• Since the bit-difference vector based CV-QKD system still requires Alice to perform FEC decoding for both the QuC and ClC, a new codeword-based QKD reconciliation system is proposed.In this system, Alice sends a FEC-protected classical key (CK) to Bob through the ClC, while Bob sends a separate FEC protected quantum key (QK) to Alice through the QuC 3 .Upon a FEC decoding performed at both sides, the final key to be used for the message encryption is the modulo-2 sum of the CK and QK 4 .As a result, for the first time in the open literature, our proposed codeword-based CV-QKD system achieves the following novelties.Firstly, the proposed scheme ensures protection of both the QuC and the ClC by FECs.Secondly, the system conceived has a symmetric complexity, where both Alice and Bob have an FEC encoder and an FEC decoder.Thirdly, the proposed QKD reconciliation scheme is compatible with a wide range of FEC schemes, including polar codes, CCs and IRCCs, where a near-capacity performance can be achieved for both the QuC and for the ClC.
• Our performance results demonstrate that with the aid of IRCCs, near-capacity performance can be achieved for both the quantum and the ClC, which leads to an improved SKR that inches closer to both the Pirandola-Laurenza-Ottaviani-Banchi (PLOB) bound [86] and the maximum achieveable rate bound [87].Therefore, the proposed codeword-based QKD reconciliation system facilitates flexible FEC deployment and it is capable of increasing the secure transmission distance.
The rest of this paper is structured as follows.Section II describes one of the classic CV-QKD protocols [13], [61], relying on a commonly utilized reconciliation scheme.Furthermore, some LDPC basics are introduced together with the modified BP 5 decoding algorithm used in the rec- 3 Note that in our proposed codeword-based reconciliation system the QK is defined as the specific part of the key that is transmitted through the QuC, while the CK is defined as the remaining part of the key that is transmitted through the ClC.This is different from the terminology of key used in Systems A-C, where the key is only transmitted through the QuC with the aid of some side information. 4We note that in the conventional syndrome-based QKD [61], even if Eve infers the syndrome from the ClC, she still cannot extract the QK from the QuC.Similarly, in the proposed system, even if Eve obtains the CK that is suitable for any FEC codes, she still cannot acquire the QK from the QuC.The QKD's Heisenberg's uncertainty principle remains valid for the quantum transmission.As a benefit, the SKR will be improved by using our powerful IRCC FEC schemes for both the ClC and the QuC despite considering realistic imperfect channels. 5The modified BP decoding algorithm is different from the original BP decoding algorithm, because the check node update BP contains a sign flipping term that depends on the syndrome information.The revised Gallager SPA is summarized in Algorithm 1.  onciliation schemes.Following this, different system designs are proposed and compared in Section III.The corresponding security analysis in terms of SKR is conducted in Section IV.Then, Section V presents the BLER and BER performance of different systems, where the performance of the proposed FEC aided CV-QKD is analyzed.Finally, Section VI provides our main conclusions and future research ideas.The structure of this paper is shown in Fig. 2. Notations: In this paper, bold uppercase and lowercase represent matrices and vector, respectively; ∥•∥ denotes the Frobenius norm, and (•) T denotes the transpose operation.
A list of abbreviations and a list of variables are offered in the beginning of our paper.

II. Modelling of the CV-QKD protocol
In this section, a general CV-QKD scheme 6 is modelled, which contains both the quantum transmission and classical post-processing.Following this, the important postprocessing step of multidimensional reconciliation is detailed.Finally, the modified BP decoding is conceived for the reconciliation scheme.

A. CV-QKD protocol
The basic QKD protocol is shown in Fig. 3(a), which has a quantum processing part and a classical post-processing part.
As for the quantum processing part, Alice prepares Gaussianmodulated coherent states for transmission to Bob.After receiving the signal, Bob makes a measurement relying either  on homodyne or on heterodyne detection.This is followed by the classical post-processing part.Explicitly, the signal y of Fig. 3(a) is a sifted and potentially channel-infested version of x, which suffers from the hostile action of the QuC.Observe in the figure that the post-processing part contains four steps, namely the sifting, parameter estimation, reconciliation, and privacy amplification.

1) Quantum transmission part
Firstly, Alice generates a pair of independent Gaussian distributed random variables, denoted as q A , p A ∼ N (0, V s ), where V s is the variance of the initial Gaussian signal.
Then she uses the random variables q A , p A to generate a coherent state |α⟩ associated with α = q A + jp A for transmission.As for Eve, we consider an optimal eavesdropping attack, namely the so-called Gaussian collective attack that can be implemented by the Gaussian entangling cloner attack, where Eve has full control over the channel [89].Generally, Eve prepares the ancilla modes, which are two-mode squeezed states also known as Einstein-Podolsky-Rosen (EPR) states, with variance W .The modes of the EPR states can be described by the operators Ê and Ê′′ , where Eve keeps one of the modes such as Ê′′ and injects the other mode Ê into the channel.After the interaction with Alice's state Eve gets the output result Ê′ .Eve then collectively detects both modes of Ê′ and Ê′′ , gathered from each run of the protocol, in a final coherent measurement.Based on this, the output mode at Bob's side can be expressed as where √ T represents the transmission coefficient of the link between Alice and Bob, âA and âE respectively represent the transmitted mode of Alice associated with the coherent state |α⟩ and the injected Gaussian mode of Eve, and √ 1 − T âE can be considered as a noise term.
For each of the received modes, Bob applies homodyne measurement to one of the randomly chosen quadratures, i.e. the Q or the P quadrature.After the measurement, the input-output relationship between Alice and Bob is given by and the input-output relationship of Eve's ancilla mode is where XB is the received quadrature component, which is measured at Bob, XA is the quadrature component transmitted by Alice, XE is the excess noise quadrature component introduced by Eve, and XE ′ is the ancilla quadrature component stored in Eve's quantum memory.Note that the variable X corresponds to one of the two quadrature components {q, p}, so that we have X ∈ {q, p}, which is held for XA , XB , XE and XE ′ .The variance of Alice's transmitted mode is V A = V s +V 0 , where V s is the variance of the initial Gaussian signal and V 0 is the variance of the vacuum state, and V E = W is the variance of the excess noise injected by Eve.The variance of the vacuum state can be expressed as where and T e is the environmental temperature in Kelvin.
2) Classical post-processing part • Sifting: In the sifting step of Fig. 3(a), both Alice and Bob retain the data associated with those specific states, whose preparation and measurement basis happen to be the same, given that both their bases are randomly chosen.More explicitly, in the BB84 DV-QKD example, Bob randomly chooses one of two legitimate polarization bases to measure his data received from Alice.Then they both publicly communicate with each other to agree about the particular bit-indices, where the measurement basis of Bob is the same as the preparation basis of Alice.
• Parameters estimation: In this step of Fig. 3(a), Alice and Bob will reveal and compare a random subset of the data, which allows them to estimate some parameters, such as the transmissivity (pathloss coefficient), excess noise, and the SNR of the channel.Then the mutual information (MI) between them is calculated to judge whether this channel is secure enough for supporting their communication.If the MI between Alice and Bob is higher than Eve's information concerning the key, the channel is deemed to be secure enough for supporting secret keys transmission, otherwise, the transmission aborts and a new random process is initiated.• Reconciliation: The reconciliation step of Fig. 3(a) relies on error correction.There are two styles of reconciliation, namely direct reconciliation (DR) and RR.As for DR, Bob corrects his data according to Alice's data, while Alice's data remains unmodified.By contrast, in RR, Alice corrects her data according to Bob's data and Bob's data remains unmodified.Usually, RR is preferred since it can provide longer secure transmission distance than that of DR.More explicitly, in DR, the channel's transmission coefficient must be above 0.5 to provide a non-zero SKR, while there is no such limitation in the RR case [48], [90].• Privacy amplification: Finally, the last step of Fig. 3(a) is privacy amplification harnessed for reducing Eve's probability of successfully guessing (a part of) the keys, since Eve has a certain amount of information concerning the key.A hashing function may be used for privacy amplification.For example, a universal hashing function can be used to complete the privacy amplification via turning the reconciled key stream into a shorter-length final key stream.As for the amount by which the reconciled key is shortened, this depends on how much information Eve has gained about the key.

B. Typical reconciliation scheme in CV-QKD
Again, a multidimensional reconciliation method is considered, since it exhibits better performance in the lower SNR region, which may translate into a longer secure transmission distance [78].The multidimensional reverse reconciliation process is shown in Fig. 3(b).After the disclosure of the raw data to be used for parameter estimation, as seen in Fig. 3(a), the rest of their raw data x := X′ A and y := X′ B is constituted by a pair of correlated Gaussian distributed sequences, where x ∼ N 0, σ 2 x , and y = x + n, n ∼ N 0, σ 2 n .Then both Alice and Bob choose D for representing the number of dimensions in the multidimensional reconciliation, which defines how the sequence of transmit data is partitioned into shorter segments.It was shown in [78] that the mapping function used in the multidimensional reconciliation process only exists in R, R 2 , R 4 , R 8 dimensions, which corresponds to D = 1, 2, 4, 8, due to its algebraic structure as proven by Theorem 2 in [78].Moreover, it was demonstrated in [13], [67], [72], [78] that an eight-dimensional reconciliation scheme (D = 8) outperformed the schemes associated with D = 1, 2, 4 in terms of the BLER performance attained.Therefore, usually the eight-dimensional (D = 8) reconciliation scheme is adopted for practical CV-QKD systems [13], [72], [78].The main steps of multidimensional RR can be described as follows.
1) Firstly, the rest of the raw data of Alice and Bob, can be viewed as a pair of sequences, denoted as x and y.The length of the two sequences is set to the FEC codeword length N .Then they are partitioned into I = N/8 number of shorter segments, denoted as x = [x 1 ; x 2 ; ...; x I ] and y = [y 1 ; y 2 ; ...; y I ], where x i , y i , i = 1, 2, ..., I, are 8 × 1 column vectors.2) Both Alice and Bob will normalize each 8-element segment of x and y in order to get a uniformly distributed 8-element vector, which is reminiscent of producing equi-probable 2 8 -ary symbols.To elaborate on the resultant eight-dimensional reconciliation scheme, the normalized data in the form of the vectors x ′ i and y ′ i can be obtained by x ′ i = xi ∥xi∥ and y ′ i = yi ∥yi∥ , where we have 2 and Hence, both the normalized vectors x ′ i and y ′ i are uniformly distributed on the surface of the 8-dimensional unit-radius sphere.Therefore, spherical codes [78], where all codewords lie on a sphere centered on 0 can play the same role for CV-QKD as binary codes for DV-QKD.
3) Bob randomly generates a binary stream b using a quantum random number generator (QRNG) 7 , whose length is the same as the FEC codeword length N .Then, the random bit sequence b will be interleaved into b ′ and the resultant sequence b ′ is partitioned into where b ′ i is an 8-element binary column vector.Then each segment b ′ i , i = 1, 2, ..., I, will be mapped to the 8-dimensional unit-radius sphere √ 8 . 4) Bob calculates the mapping function for each segment based on the vectors u i and y ′ i .This mapping function is used to map y ′ i to u i so as to find the relationship between the normalized Gaussian vector y ′ i and the modulated stream u i , which is represented by a phase rotation between y ′ i and u i in the case of D = 2, as can seen in Fig. 4.More details about how the mapping function works for our scheme can be seen in our following discourse.On the other hand, Bob also has to calculate the side information represented by the syndrome s used for assisting the decoding process.This side-information decoding is slightly different for different reconciliation schemes.To elaborate further, initially we assume that LDPC codes are adopted in the reconciliation scheme considered in this paper.How-  denotes the spherical codes of b ′ , which is the interleaved bit stream of b; u is the sequence before decoding and b is the decoding result that is equal to b when the decoding is successful; s denotes the additional side information, which is normally the syndrome calculated based on Bob's bit stream.Note that the dimensionality D is set 8. ever, it is not necessary to encode b using LDPC codes, where the side information s could be the syndrome calculated from b.But again, the side information is not necessarily constituted by the syndromes in other application scenarios.For example, frozen bits are used as side information in polar code-based reconciliation schemes [55], [76].Then Bob publicly transmits both the mapping function M i (y ′ i , u i ) and the syndrome s to Alice through the classical communication channel.The details of the mapping function calculation can be found in [78] and are also shown in Appendix A. 5) Alice then applies the same mapping function to her normalized segment x ′ i in order to map the Gaussian variables to which is actually the noisy version of u i .Hence, the difference between the variable u i and its noisy version u i can reflect the quality of the QuC.Hence it may be exploited for eavesdropping detection.6) After the mapping operation harnessed for each segment at Alice's side, she then concatenates all the segments into a sequence u = [ u 1 ; u 2 ; ...; u I ] having the length of N .Furthermore, the sequence u is turned into u ′ after deinterleaving.She finally carries out the decoding of u ′ with the aid of the syndrome s calculated by Bob and obtains the secret key b.
In summary, the core idea of multidimensional reconciliation is to convert the noise in the QuC to the ClC via using the specific mapping functions M i (y ′ i , u i ).As a consequence, the noisy version u of b is obtained, hence the family of commonly used FEC schemes can be applied to CV-QKD.More specifically, Fig. 4 demonstrates this conversion process from three different dimensionalities 8 , that are D=1, 2, 3, respectively.In Fig. 4a, the noisy version u of u = +1 can be obtained based on the proportion of y to x in a 1-dimensional case.Note that the values of x and y are not normalized in the 1-dimensional case.As for the 2-dimensional case of Fig. 4b, the normalized vectors y ′ and x ′ are on the unit-circle, and we have . Firstly, Bob calculates the mapping function between y ′ and x ′ , corresponding to α, which physically represents the phase rotation operation.After Alice receives the mapping function, she uses it to get the noisy version u of u by rotating x ′ with the same angle α.Similarly, for the 3dimensional case seen in Fig. 4c, the mapping function can be calculated based on y ′ and u on the surface of the unitradius sphere.Then the noisy version of u, namely u can be obtained by applying the same mapping function to x ′ .As for how strong the noise is, it depends on the quality of the QuC, which is modelled by a virtual equivalent binary-input AWGN (BI-AWGN) ClC characterized in Fig. 5.This is reminiscent of classical modulation and transmission through the AWGN channel [78].After that, FEC decoding can be applied and finally the reconciled key is generated.
To elaborate a little further, the 2-dimensional reconciliation of a segment is exemplified to illustrate this process.Firstly, after Alice and Bob finish their quantum-domain transmission and detection, sifting and parameter estimation, as well as normalization, they have two sequences, which are where Note that the pair of orthogonal matrices used in this 2-dimensional scheme are which is the coordinate of the vector u 1 under the orthonormal basis Based on this, the sequence u 1 at Alice's side after data mapping becomes , which is a noisy version of u 1 .Furthermore, the noise in u 1 is capable of reflecting the noise level of the quantum transmission between Alice and Bob.Therefore, in our ensuing discourse, the QuC is modelled by an equivalent BI-AWGN ClC.

C. LDPC code
LDPC codes constitute a class of linear block codes defined by a sparse parity-check matrix (PCM) H of size (N −K)× N, K ≤ N , where N is the number of columns in H and FIGURE 4: The representation of the noise conversion process for D = 1, 2 and 3 based on [78].

Virtual equaivalent channel
Noise mapping FIGURE 5: The relationship between the QuC and the virtual equivalent channel.
it is also known as the block length, while Otherwise, there is no connection between them.The notion of degree distribution is used for characterizing the check and variable node degrees [92].For example, as shown in Fig. 6, for the first VN, there are two edge connections seen in bold lines with the first and second CN.In a similar fashion, the second VN is connected with the first and third CN.The corresponding PCM H is formulated as which is a LDPC decoding is popularly performed using the BP algorithm [93], which is an iterative message-passing algorithm commonly used for inference based on graphical models such as factor graphs [94].In the context of LDPC codes, the decoding procedure attempts to find a valid codeword by iteratively exchanging the probabilistic information represented by the log-likelihood ratio (LLR) between the CN and VN along the edges of the Tanner graph until the parity-check condition is satisfied or the maximum affordable number of iterations is reached.More explicitly, we modify the classic Gallager SPA [93] for QKD systems, as seen in Algorithm 1, where both the codeword transmitted through the QuC and the side information constituted by the syndrome transmitted through the authenticated ClC are the inputs of the modified SPA.
In for the appropriate channel model.Then, for all i, j for which h i,j = 1, set L l v→c = L 0 v→c .2: CN update: Compute outgoing CN messages L c→v for each CN using and then transmit to the VN.3: VN update: Compute outgoing VN messages L v→c for each VN using and then transmit to the CN.4: LLR total: Stopping criterion: Hard decision and early termination check: If ĈH T = s B or the number of affordable iterations reaches the maximum limit, stop; else, go to step 2.
at the output of the channel before the first message-passing iteration.Then, Step 2 to Step 5 illustrate the process of finding the most likely codeword by iterative soft information exchange between CN and VN, until the syndrome defined by ĈH T becomes zero, or the maximum affordable number of decoding iterations is reached.To elaborate further, in Step 2, L t c→v is the message arriving from CN to VN in iteration t, and C v \c denotes all the CNs connected to VN v, except for CN c.In Step 3, L t v→c is the message coming from VN to CN in iteration t, and V c \v is the set of VNs connected to CN c, except for VN v.
In contrast to the conventional SPA decoding algorithm, both the contaminated codeword received from the QuC and the side information received from the ClC are entered into the modified SPA of Algorithm 1. Normally, the side information refers to the syndrome calculated by Bob in the context of LDPC codes.Hence, the SPA decoding algorithm has to be modified.Specifically, we have to change the CN update operation, which is Step 2 in Algorithm 1, based on the syndrome s B from Bob received by Alice.The modified CN update operation can be formulated as [13] L where s B (c) ∈ {0, 1} represents the parity value at index c.It is plausible that if the syndrome is s B (c) = 0, the CN update operation remains the same as that of the conventional SPA.Otherwise, for s B (c) = 1, the CN update operation would flip the sign of the outgoing messages.

D. The relationship between FEC codes and segment vectors ui after mapping
Once an equivalent ClC has been setup for the QuC, an FEC scheme is needed to proceed.Therefore, in this section, we aim for clarifying how to connect the segment vectors u i after mapping with FEC codes.
In Fig. 7, we consider 2-dimensional reconciliation and a [10,5] LDPC code.The PCM of Eq. ( 5), is used for illustrating the relationship between the FEC codes and segmented vectors u i .In Fig. 7, the dashed box at the left represents the relationship between the pair of Gaussian sequences, namely y and x.Since we consider a [10,5] LDPC code and a 2dimensional reconciliation scheme (D = 2), each of the pair of Gaussian sequences of length N = 10, is divided into I = N/D = 5 segments, yielding x = [x 1 ; x 2 ; x 3 ; x 4 ; x 5 ] and y = [y 1 ; y 2 ; y 3 ; y 4 ; y 5 ], each of which contains 2 Gaussian elements, i.e. x i = [x 1 i , x 2 i ] for i = 1, 2, ..., 5 and y i = [y 1 i , y 2 i ] for i = 1, 2, ..., 5. Furthermore, it is assumed that within each segment the channel's fading coefficients remain constant.For example, we have On the other hand, the bit stream b generated by Bob's QRNG seen in Fig. 3 In light of this, the affect of the channel's fading coefficient h = [h 1 ; h 2 ; h 3 ; h 4 ; h 5 ] and noise n = [n 1 ; n 2 ; n 3 ; n 4 ; n 5 ] in the QuC are used for representing the relationship between the modulated sequences u = [u 1 ; u 2 ; u 3 ; u 4 ; u 5 ] based on b ′ and u = [ u 1 ; u 2 ; u 3 ; u 4 ; u 5 ].Note that it is assumed that the fading coefficients are known at both sides, and the noise variances of n = [n 1 ; n 2 ; n 3 ; n 4 ; n 5 ] and are the same even thought the exact value of noise n ′ is not the same as n in the QuC.After deinterleaving, a reordered sequence of u is derived, which represents the corrupted sequences of b.Therefore, the sequence u ′ of length 10 will be fed into the [10,5] LDPC decoder.

III. System descriptions and comparisons
In this section, our new codeword-based reconciliation system will be proposed, following the critical appraisal of the state-of-the-art.More explicitly, four reconciliation systems will be presented in this section.In a nutshell, 1) System A represents the conventional LDPC-coded reconciliation scheme relying on the idealistic simplifying assumption that the ClC used for syndrome transmission is error-free.
2) System B takes into account the fading and noise effects of the ClC, where a separate LDPC code is required for both the QuC and the ClC.Note that System B is a practical version of System A. 3) System C is proposed to demonstrate that the bitdifference vector-based side information can play the same role as the syndrome of Systems A and B. Hence System C has the same performance as System A and System B. 4) System D represents the proposed codeword-based reconciliation scheme suitable for any arbitrary FEC code.Hence the family of powerful IRCCs can also be applied to achieve a near-capacity performance for both the QuC and ClC.
Note that the following reconciliation systems mainly focus on the details of the reconciliation step within the QKD protocol.More specifically, the BI-AWGN equivalent QuC of Fig. 5 is used here for the description of the reconciliation post-processing step.

A. System A: the ideal syndrome-based LDPC-coded scheme
System A: The first reconciliation system shown in Figure 8 is the BF/BP decoding algorithm based LDPC-coded CV-QKD reconciliation scheme, where the ClC used for syndrome transmission is assumed to be error-free.The algorithmic steps are described as follows.
(a) Bob randomly generates a bit stream C using a QRNG, and we view this as the initial raw key b at his side.Note that, the QRNG generates classical random numbers.The length of this is determined by the codeword length of the predefined PCM H.The PCM is known at both sides.Note that, the bit stream b at Bob's side does not have to be a legitimate codeword, because the final objective is to obtain a reconciled key.More specifically, in the reverse reconciliation scheme, the bit stream generated at Bob's side is the reference key, and Alice has to acquire this as the final key.Let us consider the single-error correcting authenticated ClC of block (6), which is assumed to be perfectly noiseless and error-free.(d) Alice takes the bit stream b inferred at the output of the QuC, which may or may not be a legitimate codeword, and forwards it as namely C = [1111011] to the decoder.Decoding is carried out by the corresponding FEC decoder with the aid of the syndrome bits she received through the ClC (6) and gets the decoded result of Ĉ = [1111010] at the output of block (7).
Based on this, Alice gets the decoded codeword as the final reconciled key, which is b = [1111010] shown in block (8).Observe that this is the same as Bob's bit stream b, provided that there are no decoding errors.This is the case, if the QuC inflicts no more than a single error, since the [7,4,1] code can only correct a single error.It is important to mention here that if the classical syndrome-transmission channel inflicts errors, this would results in catastrophic corruption of the QuCs' output.This issue will be addressed by System B.

B. System B: the practical syndrome-based LDPC-coded scheme
System B: Following the above rudimentary BCH-coded example to introduce how System A works, let us now detail a prctical LDPC code based scheme.System B of Fig. 9 represents the BP decoding algorithm based CV-QKD reconciliation scheme.In contrast to System A, System B no longer assumes that the ClC is error-free.Hence both the classical and the QuC require error correction.Let us consider a [1024,512] LDPC code as our example to introduce System B. More explicitly, the operational steps of System B are (a) Bob randomly generates a 1024-bit stream using the QRNG of Fig. 9, and views this as the initial key b at his side.Note that, the QRNG generates classical random numbers.Again, the length of this is determined by the codeword length of the predefined LDPC PCM H, which is known to both sides.(b) Bob transmits this bit stream b through the equivalent QuC to Alice, who receives the bit stream as b.(c) Meanwhile, Bob calculates the syndrome based on the QRNG output -namely b -as the side information s and transmits it to Alice through the authenticated ClC protected by the LDPC encoder in block (6) of Fig. 9.Note that, the rectangular frame shown in Fig. 9 that encompasses blocks ( 6)-( 8), constitutes a separate FEC-aided data protection for the ClC, which relies on the LDPC 1 code.The dimensionality of the PCM of such LDPC codes in our example is 512 × 1024, and hence the syndrome s = H•b calculated from Bob has the length of 512 bits.After the FEC scheme applied to the syndrome protection, which is protected by another [1024, 512] LDPC code, the encoded syndrome has the length of 1024 bits.Then, after being decoded at Alice's side by the LDPC 1 decoder (8), the syndrome s having 512 bits is recovered.In the literature [13], [63]- [67], [75], [77], [78], [81], [83], [88], the ClC is assumed to be noiseless and error-free, but a realistic ClC tends to inflict both fading and noise.Hence the ClC's LDPC 1 scheme of Fig. 9 may not be able to eliminate all errors imposed on the syndrome.Therefore, the performance of practical FEC schemes in the classical syndrome-transmission channel is taken into account in System B. (d) Then Alice carries out BP decoding of the information received over the QuC with the aid of the syndrome bits to get b, as seen in block (9).
Note that, the syndrome-based scheme is limited to FEC codes that rely on syndromes, whereas other codes such as polar codes and CCs cannot be applied.Therefore, the bitdifference vector-based scheme (System C) is proposed to tackle this issue, which is described as follows.

C. System C: the proposed bit-difference vector-based LDPC-coded scheme
System C of Figure 10, is our proposed scheme, where the final key generated by the QRNG is transmitted through the QuC and the syndromes of System B are replaced by the bit-difference vector.For convenience, both the QuC and the ClC may adopt the same kind of FEC codes, albeit they may have different length.The corresponding steps are described as follows.
(a) The functions of block ( 1) to (4) in Fig. 10  [1111010] at the output of block (13), which is ideally the same as b at Bob's side.
Observe in Fig. 9 (System B) and Fig. 10 (System C) that there are two LDPC decoders at Alice's side.By contrast, there is merely a single LDPC encoder and a low-complexity syndrome calculation scheme at Bob's side in System B, while two LDPC encoders are required at Bob's side in System C. Since Alice has to perform computationally demanding LDPC decoding twice in order to infer the final key, this is not a balanced-complexity system 9 .In light of these considerations, the new codeword-based reconciliation System D was proposed for arriving at a solution having a balanced-complexity, where Alice and Bob have a similar complexity, as required in device-to-device (D2D) systems for example [97], [98], which is described as follows.

D. System D: the proposed practically generic scheme
System D of Figure 11, is our proposed scheme that utilizes a pair of FEC codes to protect both the QuC and the classical authenticated channel.For convenience, both the QuC and the ClC may adopt the same kind of FEC codes.The corresponding steps are described as follows.QuC, which is modelled again by the equivalent ClC of Fig. 5. On the other hand, Alice transmits her legitimate codeword c through the ClC, which may inflict errors.Note that, the 2 LDPC codes in Fig. 11 do not have to be exactly the same code, whose PCMs are the same.However, for convenience, in our study, it is assumed that both QuC and ClC may adopt the same kind of FEC codes, which have exactly the same PCM.
The codewords transmission over both the QuC and the ClC is independent.More specifically, the codeword c is transmitted the same as that in conventional wireless communication, whilst the codeword b is transmitted with the aid of the equivalent QuC of Fig. 5, where the relationship between the Gaussian signals transmitted over the QuC and the random bit stream generated by QRNG is leveraged as can be seen in Fig. 3 9 Even though System C is not a balanced-complexity system, there are practical scenarios, where having a balanced complexity is not imperative, such as in ground station to unmanned aerial vehicle (UVA) quantum communication [95], [96], etc. 10 As for handling decoding failures, it is assumed to be identical to that in the conventional LDPC-based reconciliation scheme of [66], which is based on the classic cyclic redundancy check.Specifically, the system opts for discarding the sifted keys, if decoding failure occurs.Yet, a slight difference is that our codeword-based reconciliation needs two separate steps to check whether decoding is successful or not.We can only proceed to the next step when both parts are correct.a benefit of this design, first of all, the proposed codewordbased -rather than syndrome-based -QKD reconciliation scheme protects both the QuC and ClC.Secondly, the system has a similar complexity for both Alice and Bob, each of whom has a FEC encoder and a FEC decoder.Thirdly, System D makes QKD reconciliation compatible with a wide range of FEC, including polar codes and the family of CCs.We will demonstrate in Section V that this design allows us to achieve a near-capacity performance for both the QuC and for the ClC.

E. Systems comparison
In summary, the comparisons between System A (ideal syndrome-based CV-QKD), System B (practical syndromebased CV-QKD), System C (practical bit-difference vector based CV-QKD) and System D (codeword-based CV-QKD) are summarized in Table 3.More specifically, all four systems use the same equivalent QuC, but in System A we assume that the ClC is error-free, while in Systems B, C and D we consider realistic noise and fading in the ClC.Secondly, as for the side information, syndromes are transmitted from Bob to Alice through the ClC in both System A and System B. By contrast, instead of using the syndrome, System C transmits te bit-difference vector from Bob to Alice through the ClC, making the system compatible with any FEC.Furthermore, System D transmits the CK from Alice to Bob through the ClC, making the FEC decoding complexity balanced between both sides.Lastly, only LDPC codes can be applied to both System A and System B, while any kinds of FEC codes can be applied to System C and D. We opted for powerful IRCCs to achieve near-capacity performance.

IV. Secret key rate analysis
Note that the security level of the proposed System C and D is the same as that of System A and B, since the difference between them only lies in the side information.More specifically, we can only proceed with the reconciliation steps of Fig. 3, when the QK is securely received through the  QuC, which obeys the Heisenberg's uncertainty principle.Therefore, even if Even steals the side information from the ClC, the final key still cannot be recovered.This is true for Systems A-D.Nonetheless, there are three distinct advantages for the proposed System D. Firstly, it is compatible with any FEC code, rather than being limited to LDPC codes.Secondly, it has a balanced complexity for Alice and Bob, which is particularly favourable in wireless device-to-device scenarios.Lastly, it exhibits near-capacity performance, where the SKR is close to the PLOB.This is achieved by using IRCCs for protecting both the QuC and ClC, making the SNRs required for error-free quantum and classical transmissions near-optimal.The SKR is defined as [67] where γ denotes the proportion of the key extractions in the total number of data exchanged by Alice and Bob, while P B represents the BLER in the reconciliation step.Furthermore, I AB is the classical MI between Alice and Bob based on their shared correlated data, and χ BE represents the Holevo information [61] that Eve can extract from the information of Bob.Finally, △ (N privacy ) represents the finite-size offset factor with the finite-size N privacy 11 .It was proven in [99] that when N privacy > 10 4 , this factor can be simplified as where ϵ represents the security parameter 12 for the protocol.As for β ∈ [0, 1], it represents the reconciliation efficiency, which is defined as [61], [75] 11 Note that the finite-size offset can be viewed as a penalty term imposed by the imperfect parameter estimation step as shown in Fig. 3 when using finite length data.The value of N privacy set in our analysis is 10 12 , which is a value chosen in most of the literature. 12This security parameter corresponds to the failure probability of the whole protocol, implying that the protocol is assured to perform as requested except for a probability of at most ϵ.The value of ϵ is chosen to be 10 −10 in our following analysis, which is widely used in the literature.
where R represents the transmission rate, and C is referred to as the one-dimensional Shannon capacity [93], [100], which is given by the MI as follows [67]: where V A = V s + 1 and V s is Alice's modulation variance 13 , while ξ total is the total amount of noise between Alice and Bob, which can be expressed as where ξ hom = 1+v el η − 1 is the homodyne detector's noise, and v el stands for the electric noise, while η represents the detection efficiency.Furthermore, ξ line = 1 T − 1 + ξ ch represents the channel noise from the sender Alice, where T represents the path loss and ξ ch is the excess noise [90] (i.e.imperfect modulation noise, Raman noise, phaserecovery noise, etc.).Assuming a single-mode fiber having an attenuation of α = 0.2 dB/km, the distance-dependent path loss of such a channel is T = 10 −αL/10 , where L denotes the distance between the two parties.
The Holevo information between Bob and Eve can be calculated as follows [61] χ EB = S (ρ E ) − S ρ E|B = S(ρ AB ) − S ρ A|B , (12) where S(•) is the von Neumann entropy defined in [61].The von Neumann entropy of a Gaussian state ρ containing M modes can be written in terms of its symplectic eigenvalues [101] where (14) To elaborate on Eq. ( 14), generally these symplectic eigenvalues can be calculated based on the covariance matrix (CM) V of the Gaussian state using the formula [48] where Ω defines the symplectic form given by (16) Here is the direct sum indicating the construction of a block-diagonal matrix Ω having the same dimensionality as V by placing M blocks of ω diagonally.Eq. ( 15) indicates that first we have to find the eigenvalue of the matrix iΩV and then take the absolute values.However, in some circumstances, we can simplify the calculation of 13 The modulation variance here represents the variance of Gaussian signals used in the modulator of CV-QKD.the eigenvalues.To elaborate further, firstly we consider a generic two-mode CM in the form of Based on [61], the symplectic eigenvalues υ 1 and υ 2 of V can be written in the form of [48] υ where det V represents the determinant of the matrix V and we have In light of this, the CM related to the information between Alice and Bob, -namely the mode of ρ AB after transmission through the QuC -can be expressed as where we have which are the two Pauli matrices.Therefore, the symplectic eigenvalues of ρ AB required are given by where we have: As for the symplectic eigenvalue of ρ A|B , it can be shown that: Hence, the Holevo information can be formulated as where υ 1 , υ 2 and υ 3 are symplectic eigenvalues.Upon substituting Eq. ( 10) and Eq. ( 25) into Eq.( 7), the corresponding SKR can be obtained.In summary, SKR versus distance L performance metric, used in our following analysis are as follows.
• Once the BLER versus SNR performance is obtained, a fixed BLER corresponds to a fixed SNR. • The noise term ξ total in Eq. ( 10) is a function of L.
Hence, the value of V A is adjusted for each L to satisfy the fixed SNR based on Eq. ( 10).• Once V A is adjusted for each L, χ BE can be obtained, since it is a function of V A .• Finally, the target SKR versus distance is derived.

V. Performance analysis
In this section, our BLER performance comparisons will be presented for different reconciliation schemes.Moreover, the SKR versus distance performance indicator will be analyzed.The common simulation parameters 14 , which are used in our LDPC based reconciliation scheme are summarized in Table 4.

A. Performance comparison between BF and BP decoding in System A
Firstly, the performance comparison between the BF and BP decoding in System A is presented by Fig. 12, where the classical authenticated channel is assumed to be error-free.Observe from Fig. 12 that as expected, BP decoding outperforms BF decoding.Since the BLER performance is a key performance factor in the SKR of Eq. ( 7), the BP decoding algorithm will be adopted in the rest of performance analysis.

B. Performance comparison among System B, System C and System D
Let us now compare System B of Fig. 9 and System C of Fig. 10 as well as System D of Fig. 11, given that the authenticated channel is no longer error-free.Instead, an AWGN channel and an uncorrelated Rayleigh fading channel as well as perfect channel estimation are assumed for the classical side-information in Fig. 13 and Fig. 14, respectively.Fig. 13 demonstrates that the performance of the uncoded System B is severely degraded, when the ClC is contaminated by AWGN and hence it is no longer error-free, which confirms that error correction is required for both the ClC and QuC.By contrast, it can be seen in Fig. 13 that when System B, System C and System D employed FEC to protect their ClC, they no longer suffer from performance loss compared to the scenario of the idealistic assumption of having an error-free ClC.The ClC of SN R C = 3dB is sufficient for supporting System B, System C and System D for approaching the performance of the error-free ClC, which 14 Note that the code length and code rate used in both the QuC and ClC are the same.It can be seen in Fig. 14 that System B operating without error protection for the ClC performs worst, requiring excessive SNR.By contrast, Fig. 14 shows that when FEC is applied to the ClC, at say SN R C = 5, 6dB, System B, System C and System D approach the idealistic scenario of an error-free ClC.By contrast, an error floor is encountered by both System B , System C and System D at SN R C = 4dB, which is too low to mitigate the errors imposed by the Rayleigh faded ClC.
Based on the BLER performances shown above, the corresponding SKR versus distance comparison is portrayed in Fig. 15.The parameters are as follows: the modulation variance is adjusted to get a certain target SNR, which is related to the BLER threshold of 0.1 utilized for comparison; the excess noise is ξ ch = 0.002; the efficiency of the homodyne detector is η = 0.98; the attenuation of a singlemode optical fibre is α = 0.2dB/km, and the electric noise is v el = 0.01.More explicitly, Fig. 15 demonstrates that the maximum secure distance of System A using BF decoding is limited at around 1km, while that of System A using BP decoding is about 30 km.A similar performance as that of System A using BP decoding is attained for System B for a protected ClC at SN R C = 3dB, which is a sufficiently high SN R C .System C and System D also achieve a similar SKR performance, as evidenced by Fig. 15.Note that the SKR versus distance performance of System B without protecting

C. Performance comparison among different FEC codes in System D
In this section, comparisons have been made among three different types of FEC codes, which are LDPC codes, CC and IRCC, respectively.The number of LDPC decoding iteration is 50 and that of IRCC decoding is 30.The code length and code rate of the CC code are 1024 and 0.5, respectively.The authenticated ClC is assumed to be a AWGN channel.
Fig. 16 and Fig. 17 characterize the performance of our codeword-based reconciliation scheme using a 1/2-rate CC of constraint-length 7 under AWGN and Rayleigh channels, respectively.The same trend can be observed in Fig. 16   The code length and code rate of the CC code are 1024 and 0.5, respectively.The authenticated ClC is assumed to be a Rayleigh fading channel.
Fig. 17, where a higher SN R C of the ClC leads to reduced error floor.We note that as expected, compared to the AWGN scenario of Fig. 16, the Rayleigh scenario of Fig. 17   Let us now consider the most sophisticated FEC scheme of this study, namely the IRCC used, which was discussed in great detail in [102], [103] and shown in Fig. 18, where P out and P in represents the number of irregular coding com- ponents used.In Fig. 18a, the extrinsic information transfer (EXIT) chart matching process detailed in [104] is briefly illustrated, and the process of IRCC encoding and decoding is shown in Fig. 18b.The EXIT charts [87], [105], [106] and the iterative decoding trajectory of IRCC and Unity Rate Code (URC) coded BPSK modulation communicating over classical AWGN channel are portrayed in Fig. 19.More explicitly, the dotted EXIT curves seen in Fig. 19 correspond to 17 component CCs having coding rates ranging from 0.1 to 0.9 with a step size of 0.05.The IRCC design assigns different-length segments to different-rate component codes, so that a narrow tunnel is formed between the inner URC-BPSK coding component's EXIT curve and that of the outer IRCC decoder, as seen in Fig. 19.It was shown in [104] that the open tunnel area is proportional to the distance from capacity.More explicitly, as this area tends to zero, the scheme tends to approach the capacity.Hence, the presence of the narrow but open decoding tunnel of Fig. 19 indicates decoding convergence at a low SNR that approaches the capacity limit.The IRCC fractions of the component codes are found to be [0.01206030 0 0 0 0 0.605992 0.0780007 0 0 0 0.0672488 0.177274 0 0 0 0.0594503] for the 17 subcodes used in Fig. 19.To elaborate briefly, for a 1000-bit IRCC the cod-rate of 0.05 is used for 0.0120603•1000≈12 bits.Then the code-rates of 0.1, 0.15, 0.2, 0.25 and 0.3 have 0 weight, so they are unused.The code-rate of 0.35 has a weight of 0.605992, hence it is used for 0.605992•1000≈606 bits and this process is applied to the remaining code-rates as well.
The BLER of the codeword based reconciliation scheme (System D) of a variety of FEC codes is shown in Fig. 20.The corresponding (BLER, β) pair can be obtained as TABLE 5: Reconciliation efficiency of different FEC codes calculated from Eq. ( 9) at the BLER threshold that equals to 0.1, together with the corresponding SNRs.The code length and code rate of them are the same for all of them, which are N = 10 where we have Ψ i, ī = −∥s i −s ī+n∥ 2 +∥n∥ 2 N0 , s i represents the BPSK symbols, while n is the noise, whose distribution obeys n ∼ CN (0, N 0 ).The corresponding SNR can be obtained by solving C DCM C (SN R) = 0.5, since we consider BPSK and R = 0.5, FEC codes.The same capacity line is also drawn in Fig. 22    at the BLER threshold of 0.1.The other parameters are as follows: the modulation variance is adjusted to get a target SNR, the excess noise is ξ ch = 0.002, the efficiency of the homodyne detector is η = 0.98, the attenuation of a singlemode optical fibre is α = 0.2dB/km, and the electric noise is v el = 0.01.The corresponding PLOB [86] bound and the maximum achievable rate bound are shown as well.
On the other hand, based on the reconciliation efficiencies seen in Table 5 and inferred from Fig. 20 as well as Fig. 22, the reconciliation efficiencies are similar for the Rayleigh-faded and for the AWGN ClC.This is because the reconciliation efficiencies are mainly determined by the QuC quality characterized by the equivalent channel SNR, provided that the ClC quality is high enough for ensuring that the errors from the classical transmission do not unduly erode the overall system performance, as demonstrated in Fig. 22. Intuitively, a higher SN R C is required in Rayleigh faded ClCs compared to the SN R C in an AWGN based ClC to achieve nearly the same system performance.Therefore, given that the βs are nearly the same, the SKR of a Rayleigh faded ClC is similar to that in Fig. 21.

VI. Conclusions
The codeword based reconciliation concept was proposed as a general reconciliation scheme that can be applied in conjunction with diverse FEC codes.This is a significant improvement because the popular syndrome-based LDPCcoded reconciliation scheme can only be applied for FEC codes that possess syndromes.Furthermore, in contrast to the general assumption that the classical authenticated channel is error-free and noiseless, a realistic ClC has been considered, which may contain errors.We investigated the performance of our QKD systems when the classical authenticated channel is modelled as an AWGN channel or a Rayleigh channel.We demonstrated that when the ClC quality is sufficiently high, the QKD system will have a relatively low BLER.An error floor is exhibited by the system, when the ClC has errors due to employing a weak channel code or when the ClC quality is too low.More specifically, we have investigated LDPC codes, CC and IRCCs assisted CV-QKD schemes.It was demonstrated that the IRCC associated system performs the best among them, followed by the LDPC codes, whilst the CC code performs the worst.In light of this, the SKR versus distance performance of different FEC codes using optical fibre as the QuC has been compared.It was demonstrated that near-capacity FEC codes such as IRCC can provide higher reconciliation efficiency, hence they can offer a longer secure transmission distance.

Appendix Mapping function of multidimensional reconciliation
Mapping function calculation: Bob calculates the mapping function M i (y ′ i , u i ) for each 8-element vector, which meets M i (y ′ i , u i ) y ′ i = u i , using the following formula: where  [78].Note that the 8 orthogonal matrices used in our scheme are listed in Eq. (28).
of the CV-QKD protocol III.System descriptions and comparisons IV.Secret key rate analysis V. Performance analysis VI.Conclusion A. CV-QKD protocol B. Typical reconciliation scheme in CV-QKD C. LDPC code A. System A: the ideal syndrome-based LDPC-coded scheme C. System C: the proposed bit-difference vector-based LDPC-coded scheme D. System D: the propose practically generic scheme E. System comparison D. The relationship between FEC codes and segment vectors after mapping

FIGURE 2 :
FIGURE 2: Structure of this paper.

FIGURE 3 : 8 , 8 ,
FIGURE 3: (a) Schematic diagram of a QKD protocol.Note that a binary variable is utilized in DV-QKD systems, whilst a Gaussian variable is utilized in CV-QKD systems.Moreover, as for the quantum transmission shown here, it contains the process of converting the binary/Gaussian variable to quantum states and that of converting the quantum states to binary/Gaussian variable, which is the quantum measurement.(b) Schematic of the multidimensional RR scheme in QKD, where x and y are two correlated Gaussian sequences, while x ′ and y ′ represent their normalized counterparts; M(y ′ , u) represents the mapping function sent from Bob to Alice; b denotes the initial sequence generated by QRNG; u = (−1) b ′ (1) √ 8 , (−1) b ′ (2) √ 8 , . . ., (−1) b ′ (8) √ 8

x ′ 1 = 1 , u 1
[0.8865, −0.4626] T , y ′ 1 = [0.9748,−0.229] T .Let us assume that the random bit stream after interleaving at Bob's side is b ′ 1 = [0, 0] T along with the corresponding u 1 = [0.7071,0.7071] T .Then the resultant mapping matrix can be calculated as M 1 (y ′ [10,5]-regular LDPC code having the code length of N = 10 and code rate of R = 0.5, the row weight is d c = 4 and the column weight is d v = 2.The notation of [N, K]regular LDPC code used from now on to represent regular LDPC codes having a code length of N , and information length of K.

Algorithm 1 , 1
Step 1 prepares the LLR input values at each VN.All VN-to-CN messages arriving from VN v to CN c are initialized to the received LLR, denoted as L 0 v→c Algorithm The Modified Sum-Product Algorithm of Gallager 1: Initialization: Initialize LLR at each VN, v = 1, 2, ..., n

FIGURE 8 :
FIGURE 8: System Athe ideal LDPC-coded syndrome-based reconciliation scheme in the CV-QKD system relying on the BF/BP decoding algorithm.Note that, the dashed arrow represents the bit stream sent from Bob to Alice through the equivalent QuCs as illustrated in Section II-B.

FIGURE 9 :
FIGURE 9: System Bthe practical LDPC-coded syndrome-based reconciliation scheme in the CV-QKD system with BP decoding algorithm.Compared to System A, System B no longer assumes that the ClC is error-free, where both ClC and QuC require data protection by error correction.
are the same as described in System A. Here, again a simple[7,4,1] BCH code is used as our rudimentary example.Specifically, the bit stream b = [1111010] may be obtained from the QRNG, which generates a bit stream C=[1111010], and it is transmitted from Bob to Alice through the QuC, resulting the corrupted bit stream b = [1111011] at Alice's side.This has a single error in the last position.(b) In contrast to the way of calculating the syndrome in Systems A and B, a legitimate codeword c = [0001111] is required for deriving the bit-difference vector ∆b = [1110101] based on blocks (5) to (7) in Fig. 10, where k B = [0001] represents the corresponding random information bits used to obtain c. (c) Based on the received and protected bit-difference vector ∆b = [1110101] at the output of block (10) in Fig. 10, Alice flips the bits of b in those specific positions, where a logical 1 occurs in ∆b at the output of block (3) in Fig. 10 to arrive at c = [0001110] at the output of (11) before decoding.(d) Alice then decodes the bit stream c = [0001110] to arrive at ĉ = [0001111] after (12) to get the key b = (a) Both Bob and Alice generate a legitimate codeword based on a pair of predefined PCMs H 1 and H 2 , which are b and c.Consider again a simple [7,4,1] BCH code as our rudimentary example, where the pair of legitimate codewords are b = [0000000] and c = [0001111], respectively, as indicated in Fig. 11.The corresponding uncoded information bits are for example k B = [0000] and k A = [0001], respectively.(b) Bob transmits his legitimate codeword b through the (b).(c) Both Alice and Bob carry out LDPC BP decoding to get b = [0000000] and ĉ = [0001111], respectively 10 .(d) Furthermore, Modulo-2 operation is carried out at both sides to obtain the final key for both Alice and Bob, which are b ⊕ c and b ⊕ ĉ, respectively.

FIGURE 10 : 1 : 2 :
FIGURE 10: System Cthe LDPC-coded bit-difference vector-based reconciliation scheme designed for CV-QKD systems and using the BP decoding algorithm.

FIGURE 11 :
FIGURE 11: System Dthe proposed practically generic reconciliation scheme designed for CV-QKD systems.

FIGURE 12 :
FIGURE 12:  Performance comparison between System A of Fig.8and System B of Fig.9.The code length and code rate of the LDPC code are 1024 and 0.5, respectively.BF decoding is used in System A and BP decoding is utilized in System B. The classical authenticated channel is assumed to be error-free.

BLER=0. 1 ,
FIGURE 15: The secret key rate analysis versus distance.The values of different reconciliation efficiency are calculated based on the corresponding SNR at the threshold of BLER equals to 0.1.

FIGURE 16 :
FIGURE 16: Performance comparison in System D with CC.The code length and code rate of the CC code are 1024 and 0.5, respectively.The authenticated ClC is assumed to be a AWGN channel.
Fig.16 and Fig.17characterize the performance of our codeword-based reconciliation scheme using a 1/2-rate CC of constraint-length 7 under AWGN and Rayleigh channels, respectively.The same trend can be observed in Fig.16 and

NFIGURE 17 :
FIGURE 17: Performance comparison in System D with CC.The code length and code rate of the CC code are 1024 and 0.5, respectively.The authenticated ClC is assumed to be a Rayleigh fading channel.

5 FIGURE 20 :
FIGURE 20: Performance comparison of different FEC codes in System D of Fig. 11.The code length and code rate of different codes are 10 4 and 0.5, respectively.The authenticated ClC is an AWGN channel.

FIGURE 21 :
FIGURE 21: The secret key rate versus distance.The values of different reconciliation efficiencies are shown in Table5at the BLER threshold of 0.1.The other parameters are as follows: the modulation variance is adjusted to get a target SNR, the excess noise is ξ ch = 0.002, the efficiency of the homodyne detector is η = 0.98, the attenuation of a singlemode optical fibre is α = 0.2dB/km, and the electric noise is v el = 0.01.The corresponding PLOB[86] bound and the maximum achievable rate bound are shown as well.

5 FIGURE 22 :
FIGURE 22: Performance comparison of different FEC codes in System D of Fig. 11.The code length and code rate of different codes are 10 4 and 0.5, respectively.The authenticated ClC is a Rayleigh channel.

TABLE 1 :
Comparisons between two types of QKD

TABLE 2 :
Novel contributions of this work in comparison to the state-of-the-art schemes.
[91] K) is the rank of H. Hence, the code rate is R = K/N .A [N, K]regular LDPC code is defined as the null space of a sparse PCM, where each row of H contains exactly d c ones, which is also called the degree d c of check nodes (CNs) .Each column of H contains exactly d v ones, which is also called the degree d v of variable nodes (VNs) .Both the degrees of CNs and VNs are small compared to the number of rows in H.An LDPC code is classified as being irregular if the row The Tanner graph for the code given in Eq.(5).weightdc and column weight d v are not constant.It is often helpful to use the so-called Tanner graph to represent the PCM H[91].In the Tanner graph representation, there are two types of nodes, which are the VNs (or code-bit nodes) and CNs (or constraint nodes), respectively.If an element of H i,j is equal to one, then CN i denoted as c i is connected by an edge to VN j denoted as v j in the Tanner graph.

TABLE 3 :
Comparisons between four different systems.
FIGURE 13: Performance comparison among System B, System C and System D. The code length and code rate of the LDPC code are 1024 and 0.5, respectively.BP decoding algorithm is used in System B, System C and System D, as well as System A. The authenticated ClC is assumed to be an AWGN channel and the corresponding SN R C is 3 dB.
the ClC is not shown here, because it is extremely low at such low reconciliation efficiency.
requires a higher SN R C for achieving a low BLER.

Table 5 .
[107]= 0.5.The authenticated ClCs are AWGN and uncorrelated Rayleigh channel.In light of the BLER performance comparison among different FEC codes, the corresponding SKR versus distance performances of different FEC code based reconciliation schemes can be obtained with the aid of the reconciliation efficiencies as shown in Fig.21.For the same BLER, for example BLER=0.1,given the same block length of 10 4 bits, the reconciliation performances associated with IRCC, LDPC and CC exhibit different reconciliation efficiencies, which are 86.41%,81.04% and 52.40%, respectively.Therefore, the SKR performance of the IRCC scheme is the best.More explicitly, the maximum secure distance associated with the IRCC code (the diamond solid line) is longer than that of LDPC (the square solid line) and of the CC (the square dash line) code.Furthermore, the SKR at each specific secure distance associated with IRCC code is higher than that of the LDPC or CC codes.To elaborate further, the maximum secure distance of the IRCC code with BLER=0.1, β = 86.41% is around 35km, whereas the corresponding maximum secure distance of the LDPC (BLER=0.1, β = 81.04%)andCC(BLER=0.1,β=52.40%)codesarearound28kmand8km,respectively.The same conclusion can be drawn for the comparison between LDPC and CC codes at BLER=0.01.Moreover, Fig.21demonstrates that the SKR performance of a longer block length of N = 10 5 is superior to that of N = 10 4 , since a longer block length can offer near-capacity performance, hence leading to a longer secure transmission distance of around 37km.Note that the vertical line shown in Fig.20represents the minimum SNR required to achieve near-errorfree transmission.It is obtained based on[87],[106],[107] 2 i , ..., α 8 d 8 , d = 1, 2, ..., 8 is the orthogonal matrix of size 8 × 8 provided in the Appendix of A