Improved polar-code-based efficient post-processing algorithm for quantum key distribution

Abstract

Combined with one-time pad encryption scheme, quantum key distribution guarantees the unconditional security of communication in theory. However, error correction and privacy amplification in the post-processing phase of quantum key distribution result in high time delay, which limits the final secret key generation rate and the practicability of quantum key distribution systems. To alleviate this limitation, this paper proposes an efficient post-processing algorithm based on polar codes for quantum key distribution. In this algorithm, by analyzing the channel capacity of the main channel and the wiretap channel respectively under the Wyner’s wiretap channel model, we design a codeword structure of polar codes, so that the error correction and privacy amplification could be completed synchronously in a single step. Through combining error correction and privacy amplification into one single step, this efficient post-processing algorithm reduces complexity of the system and lower the post-processing delay. Besides, the reliable and secure communicaiton conditions for this algorithm has been given in this paper. Simulation results show that this post-processing algorithm satisfies the reliable and secure communication conditions well.

Introduction

Combined with one-time pad encryption scheme, quantum key distribution (QKD) can guarantee the unconditional security of communication system in theory^1–9. Unlike the traditional encryption schemes such as RSA and Elliptical Curves whose security is based on the complexity of certain mathematical problems and hence will be influenced by the computing power of computing devices, QKD’s security is based on physics law and the degree of the perfection of practical devices, which will not be influenced by computing power. Hence, in the post-quantum era during which most of the traditional encryption schemes are challenged with the formidable computing power of quantum computation, researchers have attached great attention to QKD. However, most practical QKD systems take photons as secret key carriers^10–13, which makes these systems susceptible to device defect and results in bit error and information leakage^14,15. Therefore, it’s necessary to perform error correction (also known as secret-key reconciliation) and privacy amplification in the post-processing phase to correct the error bit and eliminate the information leakage. Unfortunately, these two steps increase system overhead and introduce high time delay, which has become a bottleneck of realizing high-speed QKD and limits the further practicability of QKD systems^16,17. The earliest error correction algorithm for QKD post-processing is BBBSS algorithm¹⁸ which iteratively applies dichotomic parity check. Based on BBBSS algorithm, Brassard and Salvail proposed the Cascade algorithm¹⁹ which improves the error correction efficiency of BBBSS. However, both of these two algorithms need repetitive exchange of the checking information between Alice (information sender) and Bob (information receiver) in the public channel, which leads to low error correction efficiency and high time delay in the post-processing phase. To reduce this repetitive information exchange in the public channel, Winnow algorithm²⁰, in which the checking information only needs transmitting for once, was proposed in 2003. However, within the security threshold of qubit error rate (QBER), Winnow still has low error correction efficiency. In 2004, Pearson proposed to apply LDPC codes in QKD post processing²¹. This idea has been followed by researchers for many years^22–26. Though LDPC codes do improve the efficiency of error correction, its parity-check matrix relies on QBER and hence the error correction performance is quite sensitive to QBER. To overcome this shortcoming, Elkouss, Martinez-Mateo and Martin²³ proposed auto-adaptive LDPC for QKD system, but the iterative decoding of LDPC still results in high decoding overhead. In 2014, Joduget and Kunz-Jacques²⁷ first applied polar codes, whose code rate has been proved to achieve Shannon limit, to QKD, and discussed the feasibility. Later research²⁸ shows under short code length, the efficiency of polar codes is higher than LDPC codes’. In the past several years, the application of polar codes in QKD system has drawn the attention of researchers^29–36.

In the aspect of privacy amplification, at present, a universal class of hash functions³⁷ was widely used in information compression to guarantee the security of secret key. However, due to its high computation complexity, this scheme has high time delay. To lower the time delay, researchers applies Toeplitz hashing, which becomes the most widely used privacy amplification method in recent years^25,38–40. By combining Toeplitz hashing with fast Fourier transform, researchers has reduced the computation complexity of Toeplitz hashing to $O(n\log n)$.

To provide a new idea to reduce the complexity and lower the time delay of the post-processing phase in QKD systems, a polar-code-based efficient QKD post-processing algorithm is proposed in this paper. Using Wyner’s wiretap channel model, we design a codeword structure of polar codes which satisfies the reliability and security for QKD post-processing. This idea has been applied to different communication systems in recent years^41,42. By doing this, the error correction and privacy amplification which are the most time-consuming steps in the QKD post-processing could be completed synchronously in a single encoding and decoding process. Therefore, the complexity and time delay of post-processing can be reduced, and the final key generation rate can be improved. This will help with breaking through the bottleneck of realizing high-speed QKD system and promote practicability of QKD.

In 2019, we proposed polar codes-based one-step post-processing for quantum key distribution in our previous work⁴³. However, there are three main drawbacks in our previous work. First, the security condition (see Eq. (5) in⁴³) is inaccurate and ambiguous. Thus we modify the security condition in this paper (see Eq. (5) in this paper). Second, the protocol in⁴³ is incomplete which may result in decoding failure and insecurity (see the steps 1 to 10 and Fig. 3 in⁴³). In this paper, we modify the protocol (see the steps 1 to 10 and Fig. 4 in this paper), which makes it more reliable and secure. The last but the most important point is that our previous work lacks experimental verification, since we only calculated the coding rate, and analyzed the reliability and security in theory. In this paper, we verify the reliability and security of the protocol through a large number of simulation experiments (see the whole section—“Simulation results”).

The rest of this paper is organized as follows. In second section, we introduce the basic theory about Wyner’s wiretap channel model, the secrecy capacity of discrete variable QKD (DVQKD) systems and polar codes. Then in third section, polar-code-based efficient QKD post-processing algorithm is introduced, after which we illustrate the reliability and security for the polar-code-based efficient QKD post-processing algorithm. The fourth section gives the simulation experiment result on code rate, decoding reliability and com1munication security. In last section, we summarize our work.

Basic theory

Wyner’s wiretap channel model

The goal of secret communication is to realize reliable and secure information transmission between two authentic communication sides even under eavesdropping. The channel under eavesdropping can be depicted by Wyner’s wiretap channel model⁴⁴ which is shown in Fig. 1. Authentic information sender Alice encodes the original information U of length k to code X of length n and sends code X to authentic information receiver Bob through the main channel W, after which Bob gets information Y. In the meantime, eavesdropper Eve eavesdrops through the wiretap channel $W^{\ast }$ and gets information Z. After decoding, Bob gets the estimation ${\widehat{U}}^{\prime }$ of original information U and Eve gets the estimation ${\widehat{U}}^{\prime \prime }$.

Figure 1.

Wiretap channel model.

In the Wyner’s wiretap channel model, when the wiretap channel $W^{\ast }$ is degenerative with respect to the main channel W (that is to say, the channel capacity of the wiretap channel $C(W^{\ast })$ is smaller than the channel capacity of the main channel C(W)), with the code length tending to infinite, one can design a secure coding scheme which satisfies the communication reliability and security. Furthermore, the largest code rate is equal to the secrecy capacity $C_{\sec }$ which is defined by $C_{\sec }\equiv C(W)-C(W^{\ast })$. In other words, for all $ϵ>0$, there exist coding schemes of rate $R\ge C_{\sec }-ϵ$ that asymptotically achieve both the reliability and the security objectives⁴⁵. Here, the reliability is measured by the decoding bit error rate (BER) of Bob, and the security is measured by the mutual information of ${\widehat{U}}^{\prime \prime }$ and U. Reliable communication means that

$$\begin{array}{c}\hfill \underset{n\to \infty }{lim}Pr({\widehat{U}}_i^{\prime }\ne U_i)=0,\end{array}$$ 1

where the subscript i means the ith bit in ${\widehat{U}}^{\prime }$ and U. Secure communication means that

$$\begin{array}{c}\hfill \underset{n\to \infty }{lim}I({\widehat{U}}_i^{\prime \prime };U_i)=0,\end{array}$$ 2

where $I({\widehat{U}}_i^{\prime \prime };U_i)$ is the mutual information between Alice and Eve, ${\widehat{U}}_i^{\prime \prime }$ is the ith bit in ${\widehat{U}}^{\prime \prime }$. Combining Eq. (2) with the relation between mutual information $I({\widehat{U}}_i^{\prime \prime };U_i)$ and conditional entropy $H(U_i|{\widehat{U}}_i^{\prime \prime })$ depicted by Eq. (3), and the definition of conditional entropy depicted by Eq. (4),

$$\begin{array}{c}\hfill I({\widehat{U}}_i^{\prime \prime };U_i)\equiv H(U_i)-H(U_i|{\widehat{U}}_i^{\prime \prime })=1-H(U_i|{\widehat{U}}_i^{\prime \prime }),\end{array}$$ 3

$$\begin{array}{c}\hfill H(U_i|{\widehat{U}}_i^{\prime \prime })\equiv -\sum _{a\in U_i}\sum _{b\in {\widehat{U}}_i^{\prime \prime }}p(a,b)\log p(a|b),\end{array}$$ 4

we can rewrite eqaution (2) to

$$\begin{array}{c}\hfill \underset{n\to \infty }{lim}Pr({\widehat{U}}_i^{\prime \prime }\ne U_i)=\underset{n\to \infty }{lim}Pr({\widehat{U}}_i^{\prime \prime }=U_i)=0.5.\end{array}$$ 5

Equation (1) is the reliable communication condition and Eq. (5) is the secure communication condition. They imply that a reliable and secure coding scheme demands that, with code length tending to infinite, Bob asymptotically achieves 0 and the decoding BER of Eve asymptotically achieves 0.5.

Channel capacity of DVQKD post-processing systems under Wyner’s wiretap channel model

In QKD systems, after qubit transmission and sifting, Alice obtains sifted key $K{A}_{\mathrm{sifted}}$ and Bob obtains sifted key $K{B}_{\mathrm{sifted}}$. Due to the defect of devices, channel noise and possible eavesdropping in the practical QKD system, in general, $K{A}_{\mathrm{sifted}}\ne K{B}_{\mathrm{sifted}}$. Namely, there are error bits. Denote the bit error rate in practical QKD system by p.

DVQKD is the maturest and the most widely used QKD system. For those DVQKD systems which apply BB84 protocol, their qubit transmission channel can be regarded as binary symmetric channel (BSC). Under this assumption, the mutual information between Alice and Bob is

$$\begin{array}{c}\hfill I_{\mathrm{AB}}=1-h_2(p),\end{array}$$ 6

where $h_2(·)$ is binary entropy function²². Considering the maximum safety of communication, we can regard all the noise in practical systems results from eavesdropping. Hence, all information Eve can obtain is at most

$$\begin{array}{c}\hfill I_{\mathrm{AE}}=h_2(p).\end{array}$$ 7

If we adopt Wyner’s wiretap channel model to depict QKD system, the channel capacity of main channel W is

$$\begin{array}{c}\hfill C(W)=I_{\mathit{AB}}=1-h_2(p),\end{array}$$ 8

the channel capacity of the wiretap channel is

$$\begin{array}{c}\hfill C(W^{\ast })=I_{\mathrm{AE}}=h_2(p),\end{array}$$ 9

and the secrecy capacity is

$$\begin{array}{c}\hfill C_{\sec }=C(W)-C(W^{\ast })=1-2h_2(p).\end{array}$$ 10

The secrecy capacity is equal to the secure final key generation rate $k_{\mathrm{th}}$².

Practical DVQKD systems require that $k_{\mathrm{th}}=1-2h_2(p)\ge 0$. This means that the value range of QBER p is [0, 0.11] and $C(W)\ge C(W^{\ast })$. Hence, according to the Wyner’s wiretap channel model theory, within this range of p, channel $W^{\ast }$ between Alice and Eve is degenerative to channel W between Alice and Bob, and we can design a coding scheme which achieves the secrecy capacity. The rest of this paper is based on this prerequisite.

Polar codes

Polar codes are the only coding scheme which has been proved in theory that their code rate can achieve Shannon limit⁴⁶. Besides, the encoding and decoding complexity of polar codes is relatively small compared with LDPC codes⁴⁶. Through recursively polarizing N independent identically distributed (i.i.d.) channels whose capacity are all C, one can get N coordinate subchannels whose capacity polarizes - with the growth of code length N, the capacity of $N·C$ coordinate subchannels asymptotically tends to 1, while the capacity of the other $N·(1-C)$ coordinate subchannels asymptotically tends to 0. That is to say, the former $N·C$ coordinate subchannels are optimized and the latter $N·(1-C)$ coordinate subchannels are degraded. The optimized channels will be used to transmit information bits and the degraded ones will be used to transmit frozen bits. Hence, the code rate asymptotically achieves the channel capacity which equals to $N·C$.

Denote the original N i.i.d. channels by W. As shown in Fig. 2, through channel combining in a recursive way, we get the combining channel $W_N$ of all N i.i.d. channels. Then through channel splitting, we can obtain N coordinate subchannels $W_N^{(i)}$⁴⁶. The superscript (i) means the $i\mathrm{th}$ subchannel. In the rest of this paper, $1\le i\le N$.

Figure 2.

Channel polarization. $R_N$ is the bit-reversal operation. When $N=1$, $W_1$ is the original channel W.

Under finite code length N, we need to evaluate the channel quality of each coordinate subchannel. According to the channel quality, we rank all coordinate subchannels in descending order. Then, the first K of them are chosen to transmit information bits according to concrete error correction requirement. In this way, the construction of polar codes is fulfilled. It’s noticeable that the determination of K will impact the reliability and the code rate of the code structure we design - if K is too high, the decoding reliability will be unacceptable; if it is too low, the channel-capacity-reachable characteristic of polar code cannot be fully used and hence the code rate will be unsatisfactory. K can be determined by setting target frame error rate (TFER, it is a predefined value which Alice and Bob try to make the practical frame error rate of their communication lower than through error correction), which is used in our algorithm in “Simulation results”.

At present, there are several ways to realize the construction of polar codes^46–49. In this paper, we adopt Tal’s method⁴⁷ to construct polar codes, in which the probability of error $P_{\mathrm{e}}(W_N^{(i)})$ under maximum-likelihood decision is used to measure the quality of each coordinate subchannel $W_N^{(i)}$. Through a asymptotic method called channel degradation⁴⁷, we calculate the upper bound of each $P_{\mathrm{e}}(W_N^{(i)})$ which will be used to construct polar codes.

Polar-code-based efficient post-processing algorithm

Error correction and privacy amplification are two crucial steps in QKD post-processing. The goal of error correction is to eliminate the difference between Alice’s sifted key $K{A}_{\mathrm{sifted}}$ and Bob’s sifted key $K{B}_{\mathrm{sifted}}$ through information exchange between Alice and Bob, so that they can obtain the information which is equal to the capacity $C(W^{\ast })$ of the main channel. The goal of privacy amplification is to compress the exchanged information between Alice and Bob to remove the information Eve can obtain, which is equal to the capacity $C(W^{\ast })$ of wiretap channel.

Aiming at these two functions of the two crucial steps, we propose an efficient post-processing algorithm which can fulfill error correction and privacy amplification at the same time. This algorithm is called polar-code-based efficient post-processing (PCEP) algorithm. The concrete steps of PCEP are as follows. Denote the TFER by $FE{R}_{\mathrm{target}}$, the target privacy amplification index (TPAI, it is a predefined value which Alice and Bob try to make the practical privacy amplification index lower than. Privacy amplification index is the leaked information rate, which is equal to the amount of leaked information leaked in a single code block divided by the code block length) by $PA{I}_{\mathrm{target}}$.

Steps of PCEP algorithm

Step 1: Parameter estimation

Alice and Bob compare the bases they use in the qubit transmission phase and get their own sifted key $K{A}_{\mathrm{sifted}}$ and $K{B}_{\mathrm{sifted}}$. Then they choose some bits from their own sifted key to estimate the bit error rate $p_{\mathrm{m}}$ (to distinguish the indexes of main channel and wiretap channel, we write an “m” in the subscript to represent that this index belongs to “main channel” or a “w” to represent that this index belongs to “wiretap channel”) in the main channel as in other common post-processing algorithm . If $p_{\mathrm{m}}$ exceeds the security threshold, they abort this key distribution, or else they enter into next step.

Step 2: Polarization of the main channel

Alice and Bob polarize the main channel W by Arikan’s method⁴⁶ and obtain N coordinate subchannels $W_N^{(i)}$.

Step 3: Channel quality evaluation in the main channel

Denote the code length that Alice and Bob use by N, Alice and Bob take $p_{\mathrm{m}}$ as the channel quality index of the main channel, according to which they adopt Tal’s polar code construction algorithm⁴⁷ to calculate the upper bound $U{P}_{\mathrm{e},\mathrm{m}}(W_N^{(i)})$ (not necessarily the supremum) of the decoding error rate $P_{\mathrm{e},\mathrm{m}}(W_N^{(i)})$ under maximum-likelihood decision of each coordinate subchannel $W_N^{(i)}$. $U{P}_{\mathrm{e},\mathrm{m}}(W_N^{(i)})$ are used to evaluate the channel quality of each coordinate subchannel, the lower the better.

Step 4: Optimized coordinate subchannels selection in the main channel

Alice and Bob sort all coordinate subchannels $W_N^{(i)}$ according to $U{P}_{\mathrm{e},\mathrm{m}}(W_N^{(i)})$ in ascending order, and chooses the first $K_{\mathrm{m}}$ coordinate subchannels which satisfy Eq. (11) to compose the optimized channel set $G_N(W,FE{R}_{\mathrm{target}})$. The rest of coordinate subchannels compose the degraded channel set $B_N(W,FE{R}_{\mathrm{target}})$.

$$\begin{array}{c}\hfill \sum _{i}U{P}_{\mathrm{e},\mathrm{m}}(W_N^{(i)})\le FE{R}_{\mathrm{target}}.\end{array}$$ 11

That is to say, Alice and Bob divide all coordinate subchannels in the main channel to two sets:

$$\begin{array}{c}\hfill G_N(W,FE{R}_{\mathrm{target}})\equiv \{i|1\le i\le N\}\cap \{i|\sum _{i}U{P}_{\mathrm{e},\mathrm{m}}(W_N^{(i)})\le FE{R}_{\mathrm{target}}\},\end{array}$$ 12

$$\begin{array}{c}\hfill B_N(W,FE{R}_{\mathrm{target}})\equiv \{i|1\le i\le N\}\backslash G_N(W,FE{R}_{\mathrm{target}}).\end{array}$$ 13

From Eqs. (12) and (13), we can see that $G_N$ and $B_N$ are functions of W and $FE{R}_{\mathrm{target}}$. This is why we write $G_N$ as $G_N(W,FE{R}_{\mathrm{target}})$ and $B_N$ as $B_N(W,FE{R}_{\mathrm{target}})$. For convenience, $G_N$ and $B_N$ will be used in the rest of this paper.

Step 5: Polarization of the wiretap channel

Alice and Bob polarize the wiretap channel $W^{\ast }$ by Arikan’s method⁴⁶ and obtain N coordinate subchannels $W_N^{(i)}$.

Step 6: Channel quality evaluation in the wiretap channel

Alice and Bob calculate the bit error rate $p_{\mathrm{w}}$ of wiretap channel according to $I_{\mathrm{AE}}=1-h_2(p_{\mathrm{w}})=h_2(p_{\mathrm{m}})$ as mentioned in “Polar-code-based efficient post-processing algorithm”. Then they take $p_{\mathrm{w}}$ as the channel quality index of the wiretap channel, according to which they adopt Tal’s polar codes construction algorithm⁴⁷ to calculate the upper bound $U{P}_{\mathrm{e},\mathrm{w}}(W_N^{\ast (i)})$ (not necessarily the supremum) of the probability of error $P_{\mathrm{e},\mathrm{w}}(W_N^{\ast (i)})$ under maximum-likelihood decision of each coordinate subchannel $W_N^{\ast (i)}$ in wiretap channel. Using Eq. (14), Alice and Bob calculate the channel capacity of $C_{\mathrm{w}}(W_N^{\ast (i)})$ each coordinate subchannel.

$$\begin{array}{c}\hfill C_{\mathrm{w}}(W_N^{\ast (i)})=1-h_2(P_{\mathrm{e},\mathrm{w}}(W_N^{\ast (i)})).\end{array}$$ 14

The channel capacity $C_{\mathrm{w}}(W_N^{\ast (i)})$ is used to evaluate the channel quality of each coordinate subchannel, the higher the better.

Step 7: Optimized coordinate subchannels selection in the wiretap channel

Alice and Bob sort all coordinate subchannels $W_N^{\ast (i)}$ according to $C_{\mathrm{w}}(W_N^{\ast (i)})$ in ascending order and chooses the first $K_{\mathrm{w}}$ ones which satisfy Eq. (15) to compose degraded channel set $B_N^{\ast }(W^{\ast },PA{I}_{\mathrm{target}})$ with respect to Eve. The rest of coordinate subchannels compose optimized channel set $G_N^{\ast }(W^{\ast },PA{I}_{\mathrm{target}})$ with respect to Eve.

$$\begin{array}{c}\hfill \sum _i{C}_{\mathrm{w}}(W_N^{\ast (i)})\le PA{I}_{\mathrm{target}}.\end{array}$$ 15

That is to say, Alice and Bob divide all coordinate subchannels in the wiretap channel to two sets:

$$\begin{array}{c}\hfill B_N^{\ast }(W^{\ast },PA{I}_{\mathrm{target}})\equiv \left\{i|1\le i\le N\}\cap \{i|,\sum _i,C_{\mathrm{w}},(W_N^{\ast (i)}),\le ,P,A,I_{\mathrm{target}}\right\},\end{array}$$ 16

$$\begin{array}{c}\hfill G_N^{\ast }(W^{\ast },PA{I}_{\mathrm{target}})\equiv \{i|1\le i\le N\}\backslash B_N^{\ast }(W^{\ast },PA{I}_{\mathrm{target}}).\end{array}$$ 17

From Eqs. (16) and (17), we can see that $B_N^{\ast }$ and $G_N^{\ast }$ are functions of $W^{\ast }$ and $PA{I}_{\mathrm{target}}$. This is why we write $G_N^{\ast }$ as $G_N^{\ast }(W^{\ast },PA{I}_{\mathrm{target}})$ and $B_N^{\ast }$ as $B_N^{\ast }(W^{\ast },PA{I}_{\mathrm{target}})$. For convenience, $G_N^{\ast }$ and $B_N^{\ast }$ will be used in the rest of this paper.

Step 8: Determination of code structure

After the above steps, Alice and Bob obtain four sets of coordinate subchannels. The first set $G_N$ is the optimized coordinate subchannels to Bob, the second set $B_N$ is the degraded ones to Bob, the third set $G_N^{\ast }$ is the optimized ones to Eve, and the last set $B_N^{\ast }$ is the degraded ones to Eve. As shown in Fig. 3, the subchannels which belong to $B_N$ must belong to $B_N^{\ast }$, and the ones which belong to $G_N^{\ast }$ must belong to $G_N$. This is because that the wiretap channel is degenerative with respect to the main channel. Therefore, those subchannels which are degraded to Bob must be degraded to Eve, and those which are optimized to Eve must be optimized to Bob. Hence, $G_N$ and $B_N^{\ast }$ have intersection.

Figure 3.

Code construction. The two columns which are colored by gradient represent the coordinate subchannels of the main channel and the wiretap channel. The deeper the color is, the worse the channel quality is.

Based on the above analysis of the four sets $G_N$, $B_N$, $G_N^{\ast }$, and $B_N^{\ast }$, Alice and Bob can redivide all subchannels into three sets without intersection as follows.

$$\begin{array}{c}\hfill R\equiv G_N^{\ast },\end{array}$$ 18

$$\begin{array}{c}\hfill A\equiv B_N^{\ast }\cap G_N,\end{array}$$ 19

$$\begin{array}{c}\hfill B\equiv B_N.\end{array}$$ 20

Alice and Bob choose the subchannels in A to transmit the information bits (in this situation, they are the bits of secret key), the subchannels in R to transmit random bits, and the subchannels in B to transmit frozen bits. By this redivision, the code structure is determined. Notice that, actually, all the code construction work, including steps 4 to steps 8, can be done by Alice alone. Once Alice finish this work, she will transmit the code structure to Bob. Hence, Fig. 4 has not shown that Bob joins in the code construction work.

Figure 4.

Polar-code-based efficient post-processing algorithm.

Step 9: Code transmission

Alice randomly generates the bits which belong to R, sets all bits which belong to B to zero, and puts $K{A}_{\mathrm{sifted}}$ into the bits which belong to A. Then she connects them according to the order of corresponding coordinate subchannels to form the original code. After encoding the original code by systematic polar coding algorithm⁵⁰, Alice gets code $C{W}_{\mathrm{enc}}$. As shown in Fig. 4, $C{W}_{\mathrm{enc}}$ is composed of $C{W}_{\mathrm{enc}}^{\mathrm{chk}1}$, $C{W}_{\mathrm{enc}}^{\mathrm{final}}$(under systematic polar coding, $C{W}_{\mathrm{enc}}^{\mathrm{final}}=K{A}_{\mathrm{sifted}}$) and $C{W}_{\mathrm{enc}}^{\mathrm{chk}2}$, which are the systematic polar encoding results of the bits belong to R, A, and B, respectively. Alice only sends the check bits $C{W}_{\mathrm{enc}}^{\mathrm{chk}1}$ and $C{W}_{\mathrm{enc}}^{\mathrm{chk}2}$ to Bob through classical public channel.

Step 10: Error correction

Bob puts his sifted key $K{B}_{\mathrm{sifted}}$ into the bits which belong to A, puts $C{W}_{\mathrm{enc}}^{\mathrm{chk}1}$ into the bits which belong to R, and puts $C{W}_{\mathrm{enc}}^{\mathrm{chk}2}$ into the bits which belong to B. Then he decodes this bit string to get ${\widehat{\mathit{CW}}}_{\mathrm{enc}}^{\mathrm{final}}$. At last, Alice and Bob take $C{W}_{\mathrm{enc}}^{\mathrm{final}}$ and ${\widehat{\mathit{CW}}}_{\mathrm{enc}}^{\mathrm{final}}$ as their final key respectively. The reliable communication condition Eq. (21) asks that

$$\begin{array}{c}\hfill \underset{n\to \infty }{lim}Pr({\widehat{\mathit{CW}}}_{\mathrm{enc}}^{\mathrm{final}}\ne C{W}_{\mathrm{enc}}^{\mathrm{final}})=0.\end{array}$$ 21

Reliability and security for PCEP algorithm

In PCEP algorithm, Bob gets $C{W}_{\mathrm{enc}}^{\mathrm{chk}1}$, $C{W}_{\mathrm{enc}}^{\mathrm{chk}2}$ and $K{B}_{\mathrm{sifted}}$ which is obtained through the quantum channel with bit error rate $p_{\mathrm{m}}$. Assume Eve has full access to the classical channel, and all that she can get is $C{W}_{\mathrm{enc}}^{\mathrm{chk}1}$, $C{W}_{\mathrm{enc}}^{\mathrm{chk}2}$ and $K{B}_{\mathrm{sifted}}$ which is obtained by eavesdropping the quantum channel with bit error rate $p_{\mathrm{w}}$. According to Eq. (7), we obtain

$$\begin{array}{c}\hfill 1-h_2(p_{\mathrm{w}})=h_2(p_m).\end{array}$$ 22

When wiretap channel $W^{\ast }$ is degenerative to main channel W, $p_{\mathrm{m}}<p_{\mathrm{w}}$. The key $K{A}_{\mathrm{sifted}}$ has been encoded into $C{W}_{\mathrm{enc}}^{\mathrm{final}}$, and under systematic polar coding, $C{W}_{\mathrm{enc}}^{\mathrm{final}}=K{A}_{\mathrm{sifted}}$. To obtain the key, Bob decodes $C{W}_{\mathrm{enc}}^{\mathrm{chk}1}$, $C{W}_{\mathrm{enc}}^{\mathrm{chk}2}$ and $K{B}_{\mathrm{sifted}}$ to get ${\widehat{\mathit{CW}}}_{\mathrm{enc}}^{\mathrm{final}}$, Eve decodes $C{W}_{\mathrm{enc}}^{\mathrm{chk}1}$, $C{W}_{\mathrm{enc}}^{\mathrm{chk}2}$ and $K{E}_{\mathrm{sifted}}$ to get ${\widehat{\mathit{CW}}}_{\mathrm{enc}}^{\prime \mathrm{f}inal}$. Because the coordinate subchannels in set A is optimized to Bob but degraded to Eve, the code structure which is determined in step 8 is optimized to Bob but degraded to Eve. Hence, with the growth of code length N, the decoding error rate of Bob tends to 0 while the decoding error rate of Eve tends to 0.5 (namely, the information in the wiretap channel has been compressed to zero). That is to say, ${lim}_{n\to \infty }Pr({\widehat{\mathit{CW}}}_{\mathrm{enc}}^{\mathrm{final}}\ne C{W}_{\mathrm{enc}}^{\mathrm{final}})=0$ and ${lim}_{n\to \infty }Pr({\widehat{\mathit{CW}}}_{\mathrm{enc}}^{\mathrm{final}}=C{W}_{\mathrm{enc}}^{\prime \mathrm{f}inal})=0$, which satisfies the reliable communication condition (Eq. 1) and secure communication condition (Eq. 5).

Simulation results

To prove the feasibility of PCEP algorithm, we conduct a series of simulation experiment on code rate, reliability and security. It should be noticed that the range of $p_{\mathrm{m}}$ has been limited to [0, 0.11] because as mentioned in “Polar-code-based efficient post-processing algorithm”, only in this range is $W^{\ast }$ degenerative to W. In all simulation experiment, we set $FE{R}_{\mathrm{target}}$ to 0.1 and $PA{I}_{\mathrm{target}}$ to ${10}^{-7}$.

Code rate

As shown in Fig. 5, under different code length N, we calculate the code rate. It is observed that with the increase of QBER $p_{\mathrm{m}}$ of the main channel, the code rate tends to zero. Moreover, except a single point (where $N=2^{20}$, $p_{\mathrm{m}}=0.03$), under the same QBER $p_{\mathrm{m}}$, the longer the code length is, the higher the code rate is. This is in accord with the asymptotic property of polar codes.

Figure 5.

Code rate. The ideal polar code rate is the ideal code rate of polar code itself without considering wiretap channel. The ideal secure code rate is the ideal code rate of PCEP algorithm under wiretap channel model.

Figure 6 shows the ratio of the practical code rate and the theoretical secure code rate. It can be observed that with the increase of QBER $p_{\mathrm{m}}$, the ratio decreases to zero. The theoretical secure code rate can be regarded as a measurement of the error correcting capability of polar codes, while the practical code rate can be regarded as a measurement of the specific requirement for error correcting capability in certain setting. Therefore, the ratio can be used to measure the extent to which the requirement can be met - the lower the ratio is, the higher the extent is, and hence the better the error correcting performance is. Hence, the lower the ratio is, the higher the decoding reliability should be, which is consistent with the simulation result in “Reliability”.

Figure 6.

The ratio of the practical code rate and the theoretical secure code rate.

Security: the decoding FER and BER of Eve

According to Eq. (5), the security of PCEP algorithm can be measured by the decoding FER and BER of Eve, which is shown in Figs. 7 and 8. It can be observed that when QBER $p_{\mathrm{m}}$ is small, the decoding FER and BER of Eve well satisfies the security condition Eq. (5) ($FER=1$, $BER\sim 0.5$), while there is a threshold of QBER beyond which the decoding FER and BER of Eve dramatically decrease to zero. Moreover, the longer the code length, the higher the threshold, which coheres with the asymptotic property of polar codes.

Figure 7.

The decoding FER of Eve. The number of simulation tests is $1\times {10}^5$.

Figure 8.

The decoding BER of Eve. The number of simulation tests is $1\times {10}^5$.

Reliability

According to Eq. (1), the reliability of PCEP algorithm can be measured by the decoding FER and BER of Bob, which is shown in Figs. 9 and 10. It is observed that the practical decoding FER and BER are satisfying under all code lengths shown in Figs. 9 and 10. Besides, as shown in Fig. 9, the maximum FER in the simulation is around $1^{-4}$ when $N=2^{10}$ and $p=0.01$. Notice that the TFER has been set to 0.1, hence this target is well achieved.

Figure 9.

The decoding FER of Bob.

Figure 10.

The decoding BER of Bob.

Moreover, under different code lengths, the decoding FER and BER of Bob decrease to zero rapidly with the increase of QBER $p_{\mathrm{m}}$. The reason for this counterintuitive phenomenon has been explained in the last paragraph in “Code rate”.

Conclusion

In this paper, an efficient QKD post-processing algorithm PCEP which is based on polar codes is proposed. In PCEP algorithm, by analyzing the channel capacity of the main channel and the wiretap channel respectively under the Wyner’s wiretap channel model, we design a codeword structure of polar codes, so that the error correction and privacy amplification could be completed synchronously in a single encoding and decoding process. That is to say, PCEP algorithm realizes combining these two post-processing steps into one step. Through this, PCEP algorithm can reduce the complexity and lower the post-processing delay of QKD systems. This provides a new way to develop high-speed QKD systems. To clarify the reliability and security of PCEP algorithm, the reliability and security conditions have deen deduced from the perspective of information theory. Simulation results show that PCEP algorithm well satisfies the reliable and secure communication conditions.

Author contributions

J.F., Z.Y., J.L., Z.L., Y.W., W.L., Z.L.J and X.W. conceived the work, carried out experiments, analysed the results and wrote the manuscript.

Competing interests

The authors declare no competing interests.