# An Efficient Advantage Distillation Scheme for Bidirectional Secret-Key Agreement
## 3 Bidirectional Secret-Key Agreement
### Proposed Advantage Distillation scheme
#### 3.1.3 SKA from [PERSON] to [PERSON]  
**(B1. 1)** Before [PERSON] sends the raw key \(M^{1}_{ba}\) to [PERSON], he has to make  
\[T_{2}=V_{1}. \tag{17}\]  
Then, we can calculate  
\[U_{2}=T_{2}\oplus M^{1}_{ba} \tag{18}\]  
and send \(U_{2}\) to [PERSON] through the main channel when [PERSON] wiretaps it via the eavesdropper's channel. **(B1. 2)** In this step, when [PERSON] transmits the sequence \(U_{2}\) to [PERSON], the noise of the two channels are \(E^{1}_{ba}\) and \(E^{1}_{be}\), respectively. Both [PERSON] and [PERSON] receive a noisy version of \(U_{2}\) as \(V_{2}\) and \(W_{2}\):  
\[V_{2}=U_{2}\oplus E^{1}_{ba}=M^{1}_{ba}\oplus U_{1}\oplus E^{1} _{ab}\oplus E^{1}_{ba}, \tag{19}\] \[W_{2}=U_{2}\oplus E^{1}_{be}=M^{1}_{ba}\oplus U_{1}\oplus E^{1} _{ab}\oplus E^{1}_{be}. \tag{20}\]  
**(B1. 3)** [PERSON] has the knowledge of \(U_{1}\) and [PERSON] has the knowledge of \(W_{2}\), therefore [PERSON] can obtain the intended raw key by\[\bar{M}^{1}_{ba}=V_{2}\oplus U_{1}=M^{1}_{ba}\oplus E^{1}_{ab}\oplus E^{1}_{ba} \tag{21}\]  
and [PERSON] can obtain the intended sequence by  
\[Z^{1}_{be}=W_{2}\oplus W_{1}=M^{1}_{ba}\oplus E^{1}_{ab}\oplus E^{1}_{ae}\oplus E ^{1}_{be}. \tag{22}\]  
Step A1 and Step B1 correspond to the first round of our proposed bidirectional AD scheme for SKA, which is shown in Figure 4. Note that Steps A1.1-A1.3 provide raw keys \(M^{1}_{ab}\) and \(\bar{M}^{1}_{ab}\); we can do the reconciliation to correct errors between \(M^{1}_{ab}\) and \(\bar{M}^{1}_{ab}\) and do the privacy amplification to get the secret keys shared between [PERSON] and [PERSON]. Similarly, Steps B1.1-B1.3 provide raw keys \(M^{1}_{ba}\) and \(\bar{M}^{1}_{ba}\), based on which we can also do the reconciliation and privacy amplification steps and obtain secret keys between [PERSON] and [PERSON]. Let us define \(L^{i}_{M}\) as the number of the raw keys, \(L_{Q}\) as the number of the random sequence \(Q\). Then, the transmission rate \(\eta^{i}_{bi}\) of the proposed bidirectional AD over \(i\) round is  
\[\eta^{i}_{bi}=\frac{L^{i}_{M}}{L^{i}_{M}+L_{Q}}. \tag{23}\]  
For example, for \(i=1,2\), \(\eta^{1}_{bi}\) and \(\eta^{2}_{bi}\) equals to \(\frac{2}{3}\) and \(\frac{4}{5}\), respectively. However, for a large number of rounds, such as \(l=100\), \(\eta^{100}_{bi}\) almost equals to \(1\). Now, let us analyze the error probability of the main and eavesdropper's channels in the following theorem. Theorem 4.1: _Let the error probability of \(E^{i}_{ba}\) and \(E^{i}_{ab}\) be denoted as \(\Pr(e^{i}_{ba_{k}}=1)=\Pr(e^{i}_{ab_{k}}=1)=\alpha\) and the error probability of \(E^{i}_{be}\) and \(E^{i}_{ae}\) be denoted as \(\Pr(e^{i}_{be_{k}}=1)=\Pr(e^{i}_{ae_{k}}=1)=\beta\). After a round of the bidirectional TWC, the bit error probability of the main channel is \(2\alpha(1-\alpha)\), and the bit error probability of the eavesdropper's channel is \(\alpha(1-\beta)^{2}+2(1-\alpha)(1-\beta)\beta+\alpha\beta^{2}\)._  
Figure 4: First round of bidirectional secret-key agreement. **Proof. ** Since [PERSON] receives \(\bar{M}^{1}_{ab}=M^{1}_{ab}\oplus E^{0}_{ba}\oplus E^{1}_{ab}\) and the raw key is \(M^{1}_{ab}\), the bit error probability of raw key \(M^{1}_{ab}\) is  
\[ \begin{split}\Pr(\bar{m}^{1}_{ab_{k}}\
eq m^{1}_{ab_{k}})& =\Pr(\epsilon^{0}_{b_{k}}=1)\Pr(\epsilon^{1}_{ab_{k}}=0)+\Pr( \epsilon_{b_{k}}=0)\Pr(\epsilon^{1}_{ab_{k}}=1)\\ &=\alpha(1-\alpha)+(1-\alpha)\alpha\\ &=2\alpha(1-\alpha).\end{split}  \tag{24}\]  
Since [PERSON] only has \(Z^{1}_{ae}=M^{1}_{ab}\oplus E^{0}_{ba}\oplus E^{0}_{be}\oplus E^{1}_{ae}\), her bit error probability is  
\[