# An Efficient Advantage Distillation Scheme for Bidirectional Secret-Key Agreement
## 1 Introduction  
The one-time pad was developed by [PERSON] [1], by which a group of users can communicate messages among themselves securely if they share a common secret key beforehand. However, the key rate should be at least the message rate [2], and so the problem of secure communication effectively turns into the problem of secret-key agreement (SKA). In the SKA problem, legitimate users [PERSON] and [PERSON] aim at agreeing on a sequence of bits (key) that must be kept secret from the passive eavesdropper [PERSON]. As shown in Figure 1, the classical SKA scheme includes three phases: (a) advantage distillation (AD), (b) reconciliation, and (c) privacy amplification [3]. AD aims to provide the legitimate agents an advantage over the eavesdropper. Information reconciliation aims at generating an identical random sequence at both [PERSON] and [PERSON]. Privacy amplification is the step that extracts a secret key from the identical random sequence agreed upon by the legitimate agents [4]. Bounds for the secret-key capacity have been derived for a large variety of communication channels [5; 6; 7; 8; 9]. Unfortunately, most do not provide direct insight into the design of practical secret-key capacity-achieving schemes. SKA based on noisy channels was presented in [5; 10] using an additionalinsecure but authenticated public channel in which a third party can eavesdrop the communication but cannot forge it. This approach was recently extended in [11] to the model where the players share correlated Gaussian sources. In [12], opportunistic transmission was proposed for SKA over the quasi-static fading channel by sending signals only when the channel condition for the two legitimate players is better than the one for an adversary. The use of the reciprocity of wireless channels has been studied in [13; 14; 15] to study the key agreement. In [16], the SKA with public discussion was studied based on Gaussian and fading channels. It is well known that [PERSON] [17] introduced the wiretap channel, in which a sequence \(M\) is transmitted from [PERSON] to [PERSON] over the main channel, while [PERSON] is wiretapping over the eavesdropper's channel. [PERSON] proved that [PERSON] could send \(M\) to [PERSON] in almost perfect secrecy if the main channel between [PERSON] and [PERSON] is better than [PERSON]'s eavesdropper channel. Nevertheless, the assumption that the main channel is better (lower error rate) than the eavesdropper's channel is generally impractical. This problem can be solved by using a two-way communication (TWC) as the main channel [18]. By using TWC, the message received by [PERSON] over the eavesdropper's channel is noisier than the message received by [PERSON]. Therefore, the TWC scheme can be used as an AD scheme. Obviously, if we combine this AD scheme with any reconciliation and privacy amplification steps, the result can be used as secret keys between [PERSON] and [PERSON] [19]. However, the SKA of [18] is unidirectional from [PERSON] to [PERSON], and therefore the transmission rate of this SKA is slow. In this paper, emphasis is placed on the AD over the binary symmetric channel (BSC) and additive white Gaussian noise (AWGN) channel. We present a novel approach in building the two-way wiretap channel (TWWC) for bidirectional SKA. Different from all previous works, we will modify the original TWC scheme to be a bidirectional AD scheme to increase the transmission rate of the SKA and study the proposed AD over BSC and AWGN channel. We calculate the secret-key capacity of the proposed AD scheme to measure how many secret key bits can be shared between [PERSON] and [PERSON]. The advantages of the proposed bidirectional AD scheme are as follows. * The proposed AD scheme provides an advantage of [PERSON] and [PERSON] over [PERSON] when the channel between [PERSON] and [PERSON] is not less noisy than [PERSON]'s eavesdropper channel. * The unidirectional SKA--whose transmission rate is 0.5--can be realized by using the original TWWC as the AD scheme.