Layered Schemes for Large-Alphabet Secret Key Distribution

Transcription

1 Layered Schemes for Large-Alphabet Secret Key Distributio Hogchao Zhou Research Laboratory of Electroics Massachusetts Istitute of Techology Cambridge, MA 39 Ligog Wag Research Laboratory of Electroics Massachusetts Istitute of Techology Cambridge, MA 39 Gregory Worell Research Laboratory of Electroics Massachusetts Istitute of Techology Cambridge, MA 39 Abstract We discuss the desig of practical codes for largealphabet secret key distributio, motivated by the applicatio of high-dimesioal quatum key distributio. We itroduce ad study a simple scheme called layered scheme, which ca be treated as a variat of coded modulatio.the idea of layered schemes is to first split the observed large-alphabet symbols ito bit layers, ad to the ecode all the bit layers either idepedetly or joitly usig biary codes. The chaels that we are iterested i are more geeral tha the AWGN chaels or Rayleigh fadig chaels studied i coded modulatio. We preset ad compare differet implemetatios of layered schemes, i.e., based o idepedet parallel ecodig or joit ecodig, ad we ivestigate differet approaches i how to map large-alphabet symbols ito bit layers. Both theoretical aalyses ad simulatio results show that layered schemes have good performaces o q-ary chaels such as uiform-error chaels ad limited-magitude-error chaels. I. INTRODUCTION We cosider the problem of secret key distributio (SKD), which aims at establishig a secret key betwee two termials based o their correlated observatios [], [6]. Specifically, we try to desig efficiet codes for SKD whe the iitial observatios of the two parties are memoryless sequeces, with each symbol i the sequeces beig draw from a relatively large alphabet. Demads for such codes come from, e.g., practical high-dimesioal quatum key distributio (QKD) [] [], [7], []. To meet these demads, we itroduce a type of efficiet codig schemes which we call layered schemes. A. The Problem Cosider a sceario where two termials, Alice ad Bob, iitially observe sequeces X X ad Y Y, respectively. We assume that the eavesdropper, Eve, has o iitial kowledge about X or Y. The goal of SKD is to extract a secret key S {, } s betwee Alice ad Bob based o these observatios. The secret key S should be almost uiformly distributed o {, } s, ad should be almost completely ukow to Eve, i the sese of [], [6]. We assume that the sequeces X ad Y are both memoryless, with each pair (X, Y ) draw from the same joit distributio P XY. Without loss of geerality, let X = {,,..., q }. Fixig P X, We ca treat Y Y as the output after trasmittig X over a chael characterized by the trasitio law P C (Y X). As a example of the above settig, thik of the optical SKD problem discussed i [], []. A source geerates radom etagled-photo pairs which travel to Alice ad Bob separately, where some photos may be lost i trasmissio. Alice ad Bob record the detectio times of the photos, with precisio up to time-slots of a certai legth. They divide all the time-slots ito frames where each frame cotais q slots. Due to techical costraits, q is typically o the order of to. Through public discussio Alice ad Bob ca locate all the frames i which they each observed exactly oe photo. They ca use their relative detectio positios i these frames (i.e., X ad Y ) to distill the secret key. There ca be two types of errors i this example. First, due to trasmissio loss, Alice s ad Bob s detectios may come from differet photo pairs, which result i their detectio positios beig idepedet. Secod, due to detectio jitters, whe they detect photos from the same source pair, their detectio positios ca differ by oe or two slots. The chael from X to Y is the the result of combiig these two types of effects. Because of the high loss-rate ad low detectio-efficiecy i today s optical systems, the error probability of X Y ca be rather high, e.g, 5%, raisig challeges i code desig. A typical SKD protocol cosists of two steps. I the first step, ofte called iformatio recociliatio i cryptography, Alice ad Bob commuicate over a public chael (which is authetic but public to Eve). Based o the messages trasmitted ad o X ad Y, respectively, Alice geerates a sequece W {, } w ad Bob geerates a sequece W {, } w. I this step they try to make W = W with high probability, but Eve ca have some iformatio about W. I the secod step, privacy amplificatio [5] is applied to the sequece W ad W to extract the secret key S ad S. If W = W, the S = S. Furthermore, privacy amplificatio ca esure that Eve has virtually o iformatio about S. Sice there exist stadard techiques for privacy amplificatio, i this paper we focus o the first, iformatio-recociliatio step. We try to miimize the amout of iformatio that is leaked to Eve while esurig W = W with high probability. We defie the key rate of this step as r = P (W = W ) H(W W = W ) t, ()

2 where t is the umber of bits (correlated with W) commuicated betwee Alice ad Bob. This defiitio of the key rate is i the oasymptotic regime, ad is hece slightly differet from the existig defiitio i, e.g., [6], which focuses o the limit where teds to ifiity ad where the probability W = W teds to oe. I this limit, it ca be show usig results of [] that r teds to I(X; Y ). For fiite, we show i Appedix A that it always holds that r I(X; Y )+. We heceforth call I(X; Y ) the maximal key rate betwee X ad Y. B. Slepia-Wolf Codig A simple oe-way iformatio-recociliatio scheme directly applies a Slepia-Wolf [8] code. I this scheme, Alice seds a message R {, } t that is a determiistic fuctio of X to Bob; Bob the tries to recover the sequece X based o R ad Y. They use X as the commo sequece W. I [8], Slepia ad Wolf showed that the shortest legth of the biary message R that ca guaratee Bob s successful decodig of X is asymptotically equal to H(X Y). I practice, Slepia-Wolf codes are ofte costructed from liear chael codes. Specifically, let C be a liear code with a parity-check matrix H. I a correspodig Slepia-Wolf code, the message R set from Alice to Bob is the fully compressed versio of the sydrome of X, amely, of HX. It is easy to show that, if the code C ca correct the error Y X, the Bob ca retrieve X from Y ad R successfully. To implemet the above scheme requires efficiet liear q- ary codes, which are hard to fid or costruct for moderately large q. Oe cadidate is a Reed-Solomo code, but its blocklegth is limited by q ad it is iefficiet whe error probability is high. Aother cadidate is a large-alphabet LDPC code, which is more efficiet tha Reed-Solomo codes. However, traditioal belief-propagatio decodig is ot scalable to large alphabet size q for practical use [8], while verificatio-based decodig for LDPC codes, as of today, oly works for extremely large q [5]. C. Layered Schemes The mai idea of layered schemes for large-alphabet SKD is to covert the problem ito biary problems by mappig each symbol X X = {,,..., q } ito k = log q bits. Doig this, Alice splits the sequece X ito k bit layers. She the applies Slepia-Wolf codig to the k bit layers, either idepedetly or joitly, ad seds the ecoded bits to Bob. Layered schemes ca be see as the reverse of coded modulatio (see Fig. ), which was proposed to achieve both power ad badwidth efficiecies i commuicatio. I coded modulatio, the trasmitter first ecodes the message ito a biary codeword usig a error-correctio code, ad the maps the codeword to a sequece X with alphabet size X = k. Well-kow coded modulatio schemes iclude multilevel codig (MLC) [], [9] ad bit-iterleaved coded modulatio (BICM) [9]. These schemes have bee extesively studied for Gaussia chaels or Rayleigh fadig chaels, ad they ca be coverted to Slepia-Wolf codes for sources with biary message X Fig.. biary ECC mappig u coded modulatio layered scheme mappig v biary SW code Layered scheme ad coded modulatio. correspodig joit distributios. However, existig work o coded modulatio has ot cosidered geeral q-ary chaels or the specific optical settig discussed i Sectio I-A, ad the alphabet size q was costraied to be a power of (ot ecessary i layered schemes). Oe drawback of layered schemes (or of coded modulatio) is the high latecy. However, i cotrast to commuicatio, latecy is less importat i SKD. I SKD, Alice ad Bob usually geerate a secret-bit stream i a block-by-block way. These secret bits are stored for further use followig the well-kow oe-time-pad scheme [7]. Thaks to this cashig mechaism, eve if there is a loss or delay i some block i the key-distributio process, it will ot itroduce ay delay i the real-time data commuicatio uless the cashe is empty. Hece, while i commuicatio the decodig error rate of each block should be made extremely small to avoid retrasmissio (which will itroduce delay), i SKD we are more iterested i the statistical performace of differet blocks, i.e., the key rate that we defied i (). I some cases (Sectios III-C ad IV-C) our layered schemes ivolve iteractive commuicatio, i.e., they ivolve commuicatio from Bob to Alice. This ca simplify ad improve the performaces of the schemes. Iteractive commuicatio is ofte allowed ad widely used i SKD problems. But the kid of iteractive commuicatio we propose caot be used for chael codes, eve i the presece of feedback. The rest of this paper is orgaized as follows. Sectio II presets layered schemes ad their implemetatios based o idepedet ecodig ad joit ecodig. Sectio III compares two differet ecodig approaches of layered schemes. Sectio IV studies properties of layered schemes for certai classes of P C (Y X) ad ivestigates the role of iteractive commuicatio. Sectio V shows simulatio results ad demostrates that performaces of layered schemes ca be ear optimal. II. LAYERED SCHEMES As depicted i Fig., a layered scheme has two steps. I the first step, a ijective mappig u: X {, } k with k = log X is applied to map each symbol X i X to k bits (X, X,..., X k ). The sequece X is hece split ito k bit layers, heceforth deoted by X, X,..., X k, where X i with i k cotais the ith bit of u(x) for every X i X. I the secod step, Alice geerates a message R by applyig a biary Slepia-Wolf code to [X, X,..., X k ] ad seds R X R

3 X mappig X k R k SW ecoder E k X R SW ecoder E R the ext bit layer is.5. Hece the ext bit ca be treated as erased []. For the ith layer, it is coveiet to thik about the equivalet chael which takes iput X i ad outputs Y, X i. The trasitio law of this chael ca be easily obtaied as R k (a) Ecoder SW decoder D k X k P (Y = y, X i = x i X i = x i ) x A(x = P,x,...,x i) C(y x)p (X = x) x A(x P (X = x), i) R Y R R Fig.. SW decoder D SW decoder D (b) Decoder Idepedetly-Ecoded Layered Scheme. to Bob. After receivig R, Bob tries to recover every layer X, X,..., X k, ad hece also the origial sequece X, based o Y ad R. The sequece X is used as the commo sequece shared betwee Alice ad Bob (i.e., the sequece deoted W i the Itroductio), upo which privacy-amplificatio will be applied. I the secod step above, we cosider two differet approaches for Alice to apply a Slepia-Wolf code to [X, X,..., X k ]. The first approach is to apply a (possibly differet) Slepai-Wolf code to each bit layer idepedetly. Doig this will produce k output bit-strigs, the cocateatio of which is the message R. This approach is similar i spirit to MLC i chael codig. The secod approach is to apply a sigle biary Slepia-Wolf code to the whole vector [X, X,..., X k ], geeratig the message R directly. This approach is similar to BCIM i chael codig. We call the first approach a idepedetly-ecoded scheme, ad the secod approach a joitly-ecoded scheme. A. Idepedetly-Ecoded Scheme The diagram of the idepedetly-ecoded layered scheme is sketched i Fig.. I this scheme, Alice ecodes each bit layer X i with i k idepedetly based o biary Slepia-Wolf codig. As a result, she gets k messages deoted by R, R,..., R k, whose cocateatio R is set to Bob. Bob decodes each bit layer X i with i k based o the received message R i, his observatio Y, ad the decodig results of previous layers, i.e., Xi = [ X, X,..., X i ]. This is the multistage decodig for Slepia-Wolf codes. The idea behid this scheme is that the errors i differet bit layers (for the same symbol) are correlated. For istace, cosider the model where X is uiformly distributed o {,,..., q } with q = k for some iteger k, ad where P C (Y X) is a uiform-error chael (i.e., give Y X, Y takes value i the remaiig k symbols with equal probabilities). If a certai symbol erred i oe bit layer, the (irrespective of the mappig u) the probability that it errs i X X where A(x, x,..., x i ) deotes the set of all x X such that the jth bit of u(x) is x j with j i; similarly, A(x i ) deotes the set of all x X such that the ith bit of u(x) is x i. Theorem. Provided that a asymptotically optimal Slepia- Wolf code for each bit layer ca be foud, the maximum achievable asymptotic rate (i.e., the maximum rate i the limit where blocklegth teds to ifiity ad where the probability that W = W is required to ted to oe) of idepedetlyecoded layered schemes is r idepedet = I(X; Y ). Proof: Let t i be the legth of the message R i. From our defiitio () we have r =P (X = ˆX) H(X X = ˆX) k t i. Assume that the first i bit layers are successfully decoded. If the Slepia-Wolf code is asymptotically optimal for the equivalet chael i, the [8] lim t i H(X i Y, X i ) = ad, for ay positive ɛ, for large eough, P (X i X i ) < ɛ. Usig the chai rule for coditioal etropies we obtai t i lim = lim H(X i Y, X i ) H(X Y) = lim =H(X Y ), where the last step follows from our assumptio that the sequeces X ad Y are memoryless. We also have H(X) H(X (X k = ˆX k )) + P (X k = ˆX k )H(X X k = ˆX k ) + ɛk + H(X X k = ˆX k ) + ɛk +, so H(X X k = ˆX k ) H(X) ɛk. Hece, as, we have r ( ɛk) H(X) ɛk k t i =( ɛk)h(x) ɛk H(X Y ) =I(X; Y ) ɛk(h(x) + ).

4 X mappig X k X (a) Ecoder SW ecoder E R SW decoder D X Y Fig. 3. (b) Decoder Joitly-Ecoded Layered Scheme. Settig ɛ arbitrarily small proves the theorem. Theorem shows that the idepedetly-ecoded scheme is theoretically optimal, irrespective of the chose mappig u. B. Joitly-Ecoded Scheme I the joitly-ecoded layered scheme, as sketched i Fig. 3, Alice treats [X, X,..., X k ] as a whole biary sequece ad applies a sigle Slepia-Wolf code to this sequece. As a result, she gets the message R, which she seds to Bob. To decode [X, X,..., X k ] based o the received message R ad the observatio Y, Bob igores the depedece betwee the bits i [X, X,..., X k ]. For istace, for the Maximum Likelihood Decoder, Bob computes the likelihood of X i oly based o Y ad the idex i. For the ith layer, we ca thik of the equivalet chael which takes iput X i ad outputs Y. The trasitio law of this equivalet chael is x A(x P (Y = y X i = x i ) = P i) C(y x)p (X = x) x A(x P (X = x). i) Assume that the biary Slepia-Wolf code (as well as the decoder for each layer) is optimal, the the message legth t satisfies lim This implies the followig: t k H(X i Y) =. Theorem. Provided that a asymptotically optimal biary Slepia-Wolf code ca be foud, the maximum asymptotic rate of the joitly-ecoded layered scheme is r joit = H(X) H(X i Y ). Note that there is geerally a gap betwee rjoit ad ridepedet = I(X; Y ). This gap depeds o the distributio P XY ad o the mappig u: X {, } k. R C. Slepia-Wolf Codes based o LDPC codes We ext demostrate how to costruct a Slepia-Wolf code from a biary LDPC code. For a biary-iput chael with iput X ad output Y, we assume that C is a LDPC code with parity-check matrix H such that for all X C, X ca be successfully decoded from Y with probability close to oe. The ecodig of the Slepia-Wolf code based o C is very simple: the message R set from X to Y is the compressed versio of HX. Note that if we defie a coset code C R as C R = {X {, } : HX = R}, the X is a codeword i C R. Decodig Y ad R joitly to recover X is ow equivalet to decodig the coset code C R. Oe such decoder based o belief-propagatio is described i [], [3]. Specifically, we label the bits i R to the check odes, the the belief passed from a check ode c to a variable ode v is m cv = ( ) Rc tah v N(c)/v tah ( mv ) c, () where m vc is the message passed from a variable ode v to a check ode c, N(c) is the set of variable odes that coect to check ode c, ad R c is the bit labeled o the check ode c. Compared to the belief-propagatio decoder for the origial LDPC code, it oly chages the sigs of the beliefs from the check odes with R c =. D. Chael Adapters Slepia-Wolf codes based o LDPC codes have earoptimal performaces for biary-iput symmetric chaels with equiprobable iput distributio. Here, a biary-iput chael C : {, } Y is said to be symmetric if ad oly if there exists a bijective fuctio σ : Y Y such that σ (y) = y for all y Y ad P C (y x = ) = P C (σ(y) x = ) for all y Y. Ufortuately, the equivalet chaels yielded by layered schemes are ot always symmetric. I [], a tool called chael adapter was itroduced to force the symmetry of the biary-iput chaels for commuicatio. The same idea ca be used for Slepia-Wolf codig. Let X {, } be the biary sequece observed by Alice ad Y Y be the sequece observed by Bob. Alice draws a radom sequece Z uiformly from {, }, computes X = X Z, ad seds Z to Bob. We thus obtai a ew chael whose iput is X {, } ad whose output is (Y, Z) Y {, }. It is easy to see that P (X = ) = P (X = ). This ew chael is symmetric, because P C ((Y, Z) X = ) = P C (σ(y, Z) X = ) with σ(y, Z) = (Y, Z ) ad σ (Y, Z) = (Y, Z). If we costruct a Slepia-Wolf code based o LDPC codes for the sequeces X ad (Y, Z), the it has ear-optimal performace due to the symmetry of the ew chael. Hece

5 the legth of the message R set by Alice is close to H(X Y, Z). After successfully decodig X, Bob ca further retrieve X = X Z. Observig that H(X Y, Z) = H(X Z Y, Z) = H(X Y, Z) = H(X Y ), we coclude that: A Slepia-Wolf code for a arbitrary biary-iput chael that is based o chael adapters is asymptotically optimal if the uderlyig Slepia-Wolf code is asymptotically optimal for biary-iput symmetric chaels with equiprobable iput distributio. III. COMPARISON OF LAYERED SCHEMES I this sectio we itroduce differet mappigs u ad compare the two classes of layered schemes. A. Mappigs Let w : {,,..., k } {, } k be a bijective mappig. We cosider u which is w with the iput costraied o the first X values. The simplest mappig is the biary represetatio, i.e., the uique fuctio w bi : {,,..., k } {, } k such that w bi (x) = [x, x,..., x k ] with x = k x i i. Gray mappig, where two successive values i {,,..., k } differ i oly oe bit [6], is widely used i BICM [9]. We deote it as w Gray. Both the biary represetatio ad the Gray mappig are easy to costruct but geerally suboptimal i terms of rjoit. It is ofte computatioally difficult to fid the best mappig w by brute-force searchig. Oe idea is to first radomly geerate a bijective fuctio w, ad the to optimize w based o a heuristic approach. Specifically, we switch the outputs of w for two distict iput values a, b {,,..., k } if this operatio leads to a better mappig. We do this util o such two distict iput values ca be foud. We use w search to deote the mappig costructed i this way. As we shall see, this heuristic approach ca ofte lead to reasoably good mappigs. B. Maximal Key Rates We ext compare ridepedet ad rjoit, which are give i Theorems ad, respectively, where the latter depeds o the chose mappig u. A importat class of q-ary chael is uiform-error chaels. Such a chael s trasitio law P C (y x) with x, y {,,..., q } is give by { δ if y = x P C (y x) = δ q otherwise, where δ is the symbol error rate. I high-dimesioal QKD, this type of errors is usually caused by the dark curret, photo trasmissio ad detectio losses [3]. Aother iterestig class of chaels is local-error chaels. Local errors have also bee observed i QKD systems, ad are ofte caused by jitters of electroics [3]. A simple local-error chael is oe with trasitio law P C (y x) = δ if y x = ±, δ if x = y, otherwise (3) () maximal key rate maximal key rate Fig Idepedetly Ecoded Joitly Ecoded, w search Joitly Ecoded, w Gray Joitly Ecoded, w bi w search, w Gray, w bi alphabet size q (a) Uiform-Error Chael Idepedetly Ecoded Joitly Ecoded, w search Joitly Ecoded, w Gray Joitly Ecoded, w bi alphabet size q (b) Local-Error Chael Maximal key rates of the layered schemes for differet chaels. for all x, y {,,..., q }. Here, = q i the field of {,,,..., q }. Fig. compares the maximal rates of the two classes of (i.e., idepedetly-ecoded ad joitly-ecoded) layered schemes, with differet us, for the two chael models specified by (3) ad (), where we set the symbol error rate δ =.5 ad let X be uiformly distributed. It shows that the idepedetlyecoded scheme is much more efficiet tha the joitlyecoded scheme for chaels with a big fractio of uiform errors. We also observe that the Gray mappig w Gray is much better tha the biary represetatio w bi for the joitlyecoded scheme for local-error chaels. C. Error Propagatio I practice, our idepedetly-ecoded schemes ca suffer from error propagatio: a decodig error i a bit layer will result i decodig errors i the followig bit layers. To see this effect, let t i deote the legth of the message set from Alice to Bob for the ith bit layer, ad let e i deote the decodig error

6 probability of the ith bit layer whe the first i bit layers are successfully decoded. The key rate of the idepedetlyecoded scheme ca the be writte as ( k ) H(X) k r idepedet = ( e i ) t i. Usig iteractive commuicatio betwee Alice ad Bob, which is ofte allowed i iformatio recociliatio, ca help to largely elimiate error-propagatio effects. To this ed, after decodig the ith layer, Bob checks whether decodig was successful or ot. He ca do this either by observig the decodig process, i.e., whether the beliefs of all the variables coverge to certaity, or by Alice s addig extra redudat bits for error detectio. If there is a decodig error, the Bob asks Alice to trasmit the whole sequece X i directly. As a result, the key rate of the idepedetly-ecoded scheme is improved to r idepedet = [( e i ) H(X i X i ) t i H(X i X i ] ) H(X i ) + e i. D. Usig Suboptimal Biary Slepia-Wolf Codes Realistic Slepia-Wolf codes caot achieve the theoretical limit. We ext discuss how suboptimality of biary Slepia- Wolf codes affects the performace of the layered schemes. To simplify the discussio, we make a simple assumptio (which may ot be realistic): give a arbitrary biary-iput chael, the biary Slepia-Wolf code for X {, } ad Y Y requires αh(x Y) bits where α > for successful decodig. If the message legth is shorter tha αh(x Y), the X caot be recovered; otherwise, X ca be recovered surely. Based o this assumptio, we get the key rate of the joitlyecoded scheme: r joit = H(X) α H(X i Y ) H(X) αh(x Y ). We also get the key rate of the idepedetly-decoded scheme: r idepedet = H(X) mi(h(x i ), αh(x i X i, Y )) = H(X) αh(x Y ) + (αh(x i X i, Y ) H(X i )) +, where x + max{x, }. We see that r joit r idepedet, i.e., eve whe we use biary Slepia-Wolf codes that are suboptimal (but with the same performace for the two schemes), the idepedetlyecoded scheme is always better tha the joitly-ecoded scheme, irrespective of the mappig u. E. Discussios: Idepedet Ecodig vs. Joit Ecodig From the above aalyses, we have the followig simple observatios, which we shall further verify by simulatio i Sectio V. () If the magitude of errors is large, it is proe to apply the idepedetly-ecoded layered scheme rather tha the joitlyecoded layered scheme, for much higher maximal key rate. () Error propagatio amog differet bit layers is a problem for the idepedetly-ecoded scheme. However, this effect ca be elimiated by iteractive commuicatio betwee Alice ad Bob. (3) I high-speed SKD applicatios, hardware implemetatio of the uderlyig biary Slepia-Wolf decoders is required. Limited by hardware, the iput legth of the Slepia- Wolf code caot be too large. If we assume that the biary Slepia-Wolf codes used for the two layered schemes have the same iput legth ad approximately the same performace, the the overall performace of the joitlyecoded scheme should ot be better tha the idepedetlyecoded scheme. However, i this case, the block legth of the joitly-ecoded scheme is actually k times shorter tha that of the idepedetly-ecoded scheme. I other words, the idepedetly-ecoded scheme itroduces more latecy which, as we argued i the Itroductio, is less importat i SKD tha i commuicatios. () We will demostrate that i the idepedetly-ecoded scheme, iteractive commuicatio betwee Alice ad Bob ca further improve the practical performace of the scheme. I particular, Bob may sed some useful iformatio to Alice after decodig each bit layer, ad based o this iformatio Alice ca better ecode the ext layer. (5) As we have discussed may advatages of the idepedetly-ecoded scheme, it has a obvious disadvatage: it requires k biary Slepia-Wolf decoders, while the joitly-ecoded scheme requires oly oe decoder, which is less complex o hardware. IV. CHANNEL PROPERTIES I this sectio, we study some properties of certai chaels that are useful i layered schemes. A. Reflectio-Symmetric Chaels A chael C : X Y with X = {,,,.., q } for some eve q is said to be reflectio-symmetric if there exists a bijective fuctio σ : Y Y with σ = I such that P C (y x) = P C (σ(y) q x) for all x X, y Y. Examples of reflectio-symmetric chaels iclude the uiform-error chaels (3) ad the localerror chaels (). We show that if a q-ary chael is reflectio-symmetric with equiprobable iput distributio, the all the biary equivalet chaels yielded by the layered schemes are also symmetric (without chael adapters). Here, we cosider mappigs u: X {, } k satisfyig u(x) = u(q x) (5)

7 for all x X, where a [,,..., ] a. For istace, whe q = k, biary represetatio satisfies (5). Theorem 3. For a reflectio-symmetric chael with equiprobable iput distributio, if the mappig u satisfies (5), the the layered scheme based o u yield biary-iput symmetric chaels with equiprobable iput distributio for all layers. Proof: Let us cosider the equivalet chael i of the idepedetly-ecoded scheme. The chael s iput is X i ad its output is (X i, Y ). It is easy to see that the iput has equiprobable distributio, i.e., P (X i = ) = P (X i = ). We ca see that this chael is also symmetric. To this ed, observe P ((X i, Y ) X i = ) = P (Y x)p (x) = x A(X i,x i=) q x A(X i,x ) = P (X i, σ(y ) X i = ). P (σ(y ) q x)p (q x) Hece we obtai a bijective fuctio σ with σ (X i, Y ) = (X i, σ(y )) ad σ = I. So the equivalet chaels of the idepedetly-ecoded scheme are ideed symmetric. The proof for joitly-ecoded layered schemes are similar ad are omitted. B. Limited-Magitude-Error Chaels Give a chael C : X Y with Y = X = {,,,..., q }, we defie its error magitude as the miimal iteger m such that m = m + + m with P C (y x) =, y x < m or y x > m +. (6) For some chaels with limited-magitude errors, it is ot ecessary to split the sequece X ito k = log q bit layers. Istead, we ca geerate a ew sequece X such that X = X mod m +. The we apply a layered scheme to X ad Y. I this case, the umber of bit layers ca be reduced to log (m + ), ad the ecodig/decodig is simplified. The followig theorem shows that this simplificatio does ot degrade performace. Theorem. I the above approach, X ca be uiquely determied by X ad Y, ad H(X Y) = H(X Y). Proof: Let Z = Y X mod m +. If Z =, the X = Y. If < Z m +, the X = Y Z. If m + + Z m, the X = Y + Z m. So X ca be uiquely determied by X ad Y, ad H(X Y) = H(X, Y Y) = H(X Y). C. Cyclic-Symmetric Chaels A chael C : X Y with Y = X = {,,,.., q } is said to be cyclic-symmetric if for all x, y {,,..., q }, we have P C (y x) = P C (y x ). Here, we defie the operatio i the field of {,,..., q }, e.g., = q. Both the uiform-error chaels (3) ad local-error chaels () are cyclic-symmetric chaels. Theorem 5. For a cyclic-symmetric chael with q = k ad equiprobable iput distributio, let u be the biary represetatio i the lowest-bit-first order. If C = mi({i: X i Y i } {k + }), the I(X; C) =. Proof: We show that P (X = x, C = i) is idepedet of x as follows: P (X = x, C = i) = P C (y x)p (x) y : (y x)= i mod i = P C (y x ) k y : (y x)= i mod i = P C (e ) k. e X : e= i mod i The claim follows. The above theorem implies that for a cyclic-symmetric chael with q = k, if we apply a layered scheme with the biary-represetatio mappig, the Bob ca sed C to Alice without disclosig ay iformatio about X. We ca also write C as [C, C,..., C k ] with C i = (X i Y i ). So, istead of trasmittig C, Bob ca trasmit C, C,..., C k to Alice. We ca implemet this process i the idepedetlyecoded scheme, i.e, after decodig the ith bit layer, Bob seds C i to Alice. The followig example demostrates how such iteractive commuicatio ca be used to improve the practical performace of the idepedetly-ecoded scheme. Example 6. For a uiform-error chael specified by (3) with q = k, we have P (X i X i, Y, C i = ) =. It implies that if C i =, the Bob kows othig about X i util receivig the message R i. I this case, if Alice kows C i =, there is o eed for her to ecode X i ito the message R i. A simple approach is that Alice directly seds X i to Bob without ecodig it; she oly eeds to ecode those bits with C i =. I each bit layer, the bits to ecode is a radom variable upper-bouded by the block legth, which is ot coveiet for hardware decodig. Our idea of solvig this problem is to ecode bits from the same bit layer but differet blocks joitly. I the above example, assume that q = 3 ad that the biary Slepai-Wolf codig is ot perfect: it requires to trasmit

8 .H(X Y) bits to recover X. The, without applyig the iteractive-commuicatio mechaism, the maximal symbol error rate that allows o-zero key rate is δ =.6. By applyig the iteractive-commuicatio mechaism described i the example, the maximal symbol error rate that allows o-zero key rate is.883. V. SIMULATION I this sectio, we evaluate the performace of the layered schemes for large-alphabet secret key distributio by simulatio. We first itroduce the setup ad some practical implemetatio issues. The we provide some simulatio results for differet types of chaels. A. Setup I the simulatio, we set q = 3 with k = 5 ad let X be uiformly distributed o {,,..., 3}. The blocklegth for the idepedetly-ecoded scheme is = ad the the block legth for the joitly-ecoded scheme is 8 (for the same legth of the uderlyig biary Slepia-Wolf codes). We assume that each biary Slepia-Wolf code associates with extra d = parity-check bits so that the decodig error ca be detected by Bob with high probability. We use simple regular LDPC codes for the biary Slepia- Wolf codig. Specifically, give the block legth ad message legth r, the parity-check matrix H is radomly costructed such that each colum has exactly 3 oes. (Note that by usig irregular LDPC codes based o desity evolutio, we ca get better performaces of the layered schemes.) I the idepedetly-ecoded scheme, we use the biaryrepresetatio with the lowest-bit-first order as the mappig u, ad we let t i be the message legth of the biary Slepia- Wolf code for the ith bit layer. The the rate of the scheme (elimiatig the error-propagatio effect based o iteractive commuicatio) is r idepedet = 5 ( e i (t i )) max( t i d, ) with =, where e i (t i ) is the decodig error probability for the ith bit layer ad it is a fixed fuctio of t i with give chael ad Slepia-wolf code. I the joitly-ecoded scheme, we use the Gray mappig as the mappig u, ad we let t be the message legth of the biary Slepia-Wolf code. The the rate of the scheme is r joit = ( e(t)) max( t d, ) /k with =, where e(r) is the decodig error probability. B. Message Legth Accordig to the expressios of the key rates, the message legth t i (or t) for each biary Slepia-Wolf code ca be optimized idepedetly. For istace, the optimal legth t i for the equivalet chael i i the idepedetly-ecoded scheme is t i = arg max t i ( e i (t i )) max( t i d, ). Key Rate Theoretical Limit Joitly Ecoded Limit Idepedetly Ecoded, Iteractive Idepedetly Ecoded Joitly Ecoded Reed Solomo Symbol Error Rate δ Fig. 5. Key rates of the layered schemes based o regular LDPC codes for uiform-error chaels whe q = 3 ad =. The block legth of the Reed-Solomo code is. Such a way of selectig t i is very useful whe symbol error rate is high. For istace, assume that it requires t i > to make e i (t i )., ad it requires t i =.9 to make e i (t i ) =.5. Obviously, the secod t i results i a higher key rate. I the simulatio, we igore this edge effect of t i (i.e., whe symbol error rate is high, the optimal message legth should be used). We use a simple empirical approach to determie t, t,..., t k ad t. Specifically, we let t i = α i H(X Y) with α i > whe X ad Y are the iput sequece ad output sequece of the equivalet chael i, respectively. At the begiig, we let α i =. We apply the biary Slepia- Wolf codig to may samples of X ad Y. If X caot be successfully decoded, the we update α i = α i + α c with a small costat α c, e.g... By ruig this procedure for eough samples, e.g., samples, we obtai a reasoably good message legth t i, based o which a biary Slepia-Wolf code is costructed as the basic compoet for the layered schemes. C. Uiform-Error Chaels Fig. 5 shows the performaces of the layered schemes for the uiform-error chaels defied by (3). Due to the imperfectess of the regular LDPC codes that we used, there is a gap betwee the actual key rates of the layered schemes ad their maximal key rates. We compare the layered schemes with Slepia-Wolf codes based o Reed-Solomo codes. We cosider a Reed-Solomo code over F (q) with block legth = q m. For such a code, i order to correct at most t symbol errors, it requires r = mt redudat symbols. Give a symbol error rate δ, we ca select the best t to maximize the key rate. I this case, the maximal

9 Key Rate Key Rate Theoretical Limit Joitly Ecoded Limit Idepedetly Ecoded Joitly Ecoded.5.5 Theoretical Limit Joitly Ecoded Limit Idepedetly Ecoded Joitly Ecoded Symbol Error Rate δ Symbol Error Rate δ Fig. 6. Key rates of the layered schemes based o regular LDPC codes for local-error chaels whe q = 3 ad =. Fig. 7. Key rates of the layered schemes based o regular LDPC codes for hybrid-error chaels whe q = 3 ad =. key rate is r RS = max t,m P ( E t)[k(q m tm) d] q m, where P ( E t) is the probability that the umber of erroeous symbols is at most t. I this simulatio, we have k = 5 ad we set m =. From Fig. 5, we see that there is a sigificat performace gai i the layered schemes over Reed-Solomo codes, especially whe the symbol error rate is ot small. We also see that the idepedetly-ecoded scheme is much more efficiet tha the joitly-ecoded scheme for correctig uiform errors. This possibly comes from the gap betwee the maximal key rates of the two schemes. Furthermore, iteractive commuicatio improves the performace of the idepedetly-ecoded scheme. Our ituitio is that, as the symbol error rate icreases, the improvemet becomes stroger because there are more bits that ca be treated as erased i the scheme. D. Local-Error Chaels Fig. 6 shows the performaces of the layered schemes for local-error chaels described by (). There is a smaller gap betwee the performaces of the joitly-ecoded scheme ad of the idepedetly-ecoded scheme compared to o uiform-error chaels. Oe observatio is that, as the symbol error rate icreases, the gap betwee their maximal key rates icreases. Aother observatio is that the gap of the actual key rate ad the maximal key rate of the joitly-ecoded scheme is larger tha that of the idepedetly schemes. We ca explai the secod observatio as follows. The key rate of the idepedetly-ecoded scheme ca be roughly writte as k α(h(x i X i, Y )) (7) for a cocave fuctio α( ). It meas that, i practice, if H(X i Y ) is small, the biary Slepia-Wolf code eeds a large overhead. I the ideal case, α(x) = x. Similarly, the key rate of the joitly-ecoded scheme ca be roughly writte as ( ( k )) k α H(X i Y ). (8) k The differece betwee (7) ad (8) comes from two terms, α(h(x i Y )) α(h(x i X i, Y )) itroduced by the gap of the maximal key rates, ad ( k ) kα H(X i Y ) α(h(x i Y )) k itroduced by the cocavity of the fuctio α( ). This is a advatage of the idepedet-ecoded scheme over the joitlyecoded scheme i practical use. E. Hybrid-Error Chaels I the high-dimesioal QKD systems described i [3], [], a large umber of uiform errors ad local errors due to differet mechaisms are observed. We call such a chael a hybrid-error chael. Fig. 7 simulates a hybrid-error chael C : {,,..., q } {,,..., q } described by P C (y x) = δ if y x = ±, δ if x = y, δ (q 3) otherwise. We see that, eve if all the symbols have errors, the idepedetly-ecoded scheme is still able to geerate secret bits.

10 Key Rate Theoretical Limit Joitly Ecoded Limit Idepedetly Ecoded Joitly Ecoded We the obtai r =P (W = W ) H(W W = W ) t P (W = W ) I(X; Y W = W ) I(X; Y (W=W )) I(X; Y ) +. This completes the proof Symbol Error Rate δ Fig. 8. Key rates of the layered schemes based o regular LDPC codes for discrete-gaussia-error chaels whe q = 3 ad =. F. Discrete-Gaussia-Error Chaels Fig. 8 shows the performaces of the layered schemes for a discrete chael with Gaussia oise, ad we call it a discrete- Gaussia-error chael, defied by y x P C (y x) = δ e σ c x x= e σ for all x, y {,,..., q }, x y. Here c = is a ormalizatio factor ad δ is the symbol error rate. I this simulatio, we choose σ = 3. APPENDIX A UPPER BOUND ON THE KEY RATE Theorem 7. Let r be the key rate defied i (), the, for ay >, r I(X; Y ) +. Proof: Let T {, } t be the set of bits that are commuicated betwee Alice ad Bob ad are correlated with W. Note that W ca be uiquely determied by X ad T, ad that W ca be uiquely determied by Y ad T. First, we derive a upper boud o H(W W = W ) t as follows: H(W W = W ) t H(W W = W, T) = H(XW W = W, T) H(X W, W = W, T) H(X W = W, T) H(X Y, W, W = W, T) = H(X W = W, T) H(X Y, W = W, T) = I(X; Y W = W, T) Followig the proof of Theorem i [6], specifically Eq. (3) therei, we have I(X; Y W = W, T) I(X; Y W = W ). REFERENCES [] R. Ahlswede ad I. Csiszár, Commo radomess i iformatio theory ad cryptography Part I: Secret sharig, IEEE Tras. If. Theory, vol. 39, pp. 3, Jul [] I. Ali-Kha ad J. C. Howell, Experimetal demostratio of high twophoto time-eergy etaglemet, Phys. Rev. A, vol. 73, 38(R) (6). [3] I. Ali-Kha, C. J. Broadbet, ad J. C. Howell, Large-alphabet quatum key distributio usig eergy-time etagled bipartite states, Phys. Rev. Lett. vol. 98, 653 (7). [] J. T. Barreiro, N. K. Lagford, N. A. Peters, ad P. G. Kwiat, Geeratio of hyperetagled photo pairs, Phys. Rev. Lett. vol. 95, 65 (5). [5] C. H. Beett, G. Brassard, C. Crepeau, ad U. M. Maurer, Geeralized privacy amplificatio, IEEE Tras. If. Theory, vol., o. 6, pp , 995. [6] J. R. Biter, G. Ehrlich ad E. M. Reigold, Efficiet geeratio of the biary reflected gray code ad its applicatios, Commuicatios of the ACM, vol. 9, pp. 57 5, 976. [7] N. J. Cerf, M. Boureace, A. Karlsso, ad N. Gisi, Security of quatum key distributio usig d-level systems, Phys. Rev. Lett., vol. 88, 79 (). [8] M. C. Davey ad D. MacKay, Low desity parity check codes over GF(q), IEEE Commu. Lett., vol., pp , 998. [9] G. Caire, G. Taricco, ad E. Biglieri, Bit-iterleaved coded modulatio, IEEE Tras. Iform. Theory, vol., pp , 998. [] M. N. O Sulliva-Hale, I. Ali-Kha, R. W. Boyd, ad J. C. Howell, Pixel etaglemet: experimetal realizatio of optically etagled d=3 ad d=6 qudits, Phys. Rev. Lett., vo. 9, 5 (5). [] J. Hou, P. H. Siegel, L. B. Milstei ad H. D. Pfister, Capacityapproachig badwidth-efficiet coded modulatio schemes based o low-desity parity-check codes, IEEE Tras. Iform. Theory, vol. 9, pp. 55, 3. [] H. Imai ad S. Hirakawa, A ew multilevel codig method usig error correctig codes, IEEE Tras. Iform. Theory, vol. 3, pp , 977. [3] A. Kav cić, X. Ma, ad M. Mitzeamcher, Biary itersymbol iterferece chaels: Gallager codes, desity evolutio, ad code performace bouds, IEEE Tras. Iform. Theory, vol. 9, pp , 3. [] Y. Kochma ad G.W. Worell, O high-efficiecy optical commuicatio ad key distributio i Proc. Iformatio Theory ad Applicatio Workshop, February. [5] M. G. Luby ad M. Mitzemacher, Verificatio-based decodig for packet-based low-desity parity-check codes, IEEE Tras. Iform. Theory, vol. 5, o., pp. 7, 5. [6] U. M. Maurer, Secret key agreemet by public discussio from commo iformatio, IEEE Tras. Ifo. Theory, vol. 39, pp , 993. [7] C. E. Shao, Commuicatio theory of secrecy systems, Bell Syst. Tech. J. vol. 8, pp , 99. [8] D. Slepia ad J. K. Wolf, Noiseless codig of correlated iformatio sources, IEEE Tras. Ifo. Theory, vol. 9, pp. 7 8, 973. [9] U. Wachsma, R. F. H. Fischer, ad J. B. Huber, Multilevel codes: Theoretical cocepts ad practical desig rules, IEEE Tras. Iform. Theory, vol. 5, pp , 999. [] C. Weidma, Codig for the q-ary symmetric chael with moderate q, i Proc. IEEE It. Symp. Iformatio Theory (ISIT), pp , July 8.