## 2 System Model
The privacy amplification is geared toward performing security checks on the elements of the generated key, and it is not part of our description. We will assume reverse reconciliation (RR), which is desirable since the mutual information between [PERSON] and [PERSON] is provably lower than between [PERSON] and [PERSON] [1; 2; 3; 4; 5; 6; 7; 8; 9; 10; 11; 12; 13; 14]. If [PERSON] starts to run the reconciliation phase using his already noisy raw data, then only lower valuable information can be leaked to [PERSON] during the procedure in comparison to if [PERSON] would have started to run the reconciliation, from her ideal raw data (from the perspective of the raw data-level reconciliation, the noise that arises from the first channel use has no relevance, as will be clarified later, and [PERSON]'s raw data can be viewed as ideal). The run of the protocol is sketched as follows. Let us denote [PERSON]'s binary raw data by \(X\), and [PERSON]'s binary raw data by \(X^{\prime}\), where \(|X|=|X^{\prime}|=N\) units. [PERSON]'s raw data is generated by a random quadrature measurement of \(M_{1}\). [PERSON]'s selects two random variables \(x\) and \(p\) each drawnfrom a Gaussian distribution, which encodes her position and momentum quadratures and obtains a phase space vector \(S_{[PERSON]}=|x_{A}+ip_{A}\rangle\). [PERSON] also draws a phase space vector \(S_{[PERSON]}=|x_{B}+ip_{B}\rangle\). The noisy \(S^{\prime}_{[PERSON]}\) is received by [PERSON] in the first phase via channel \(\mathcal{N}_{1}\) in the beam \(B_{out}\). [PERSON]'s raw data is defined as follows:  
\[X\equiv M_{1}(B_{out}+S_{[PERSON]})=\mathcal{N}_{1}(S_{[PERSON]})+S_{[PERSON]}. \tag{1}\]  
The outgoing beam \(A_{out}\) will contain the other mode of the coupled beam. [PERSON]'s raw data is generated by the \(M_{2}\) random quadrature measurement applied on the beam \(A_{out}\), as:  
\[X^{\prime}\equiv M_{2}(A_{out})=B^{\prime}_{out}+{S^{\prime}}_{[PERSON]}=\mathcal{ N}_{2}(\mathcal{N}_{1}(S_{[PERSON]}))+\mathcal{N}_{2}(S_{[PERSON]}), \tag{2}\]  
where \(A_{out}\) contains the noisy version of the second mode of the beam. A detailed description will be given in Section 2.1. A simplified view of a PM (Prepare-and-Measure: entanglement-free) two-way CVQKD protocol with homodyne measurements \(M_{1}\), \(M_{2}\) at the parties and with RR is shown in Figure 1. [PERSON] and [PERSON] are connected by a noisy quantum channel and a classical authenticated channel. The quantum communication is started by [PERSON]. [PERSON] receives [PERSON]'s quantum message and then couples it with her quantum message using a BS (Beam Splitter) to create a correlated signal. The first mode of the beam is measured by [PERSON], using a random quadrature measurement; the second mode is sent back to [PERSON], who will also apply a random quadrature measurement on the received beam. After the measurements have been performed, the parties inform each other about the used position and momentum quadratures over the classical channel, and discard the irrelevant data. The resulted raw data is a collection of correlated Gaussian variables. Since these binary strings follow Gaussian random distribution, they cannot be transmitted directly over the classical channel. In reverse reconciliation, [PERSON] has to make the probability distribution of his raw data to uniform. He can do this by applying an appropriate function \(C(\cdot)\) (will be clarified in Section 3) on his \(j\)-th raw data block, as denoted by \(\mathbf{X}^{\prime}_{j}\). [PERSON] then generates a random key \(\mathbf{U}_{j}\) (the full key vector \(\mathbf{K}\) is granulated into several \(\mathbf{U}_{j}\)-s), and multiplies it with his raw data \(C(\mathbf{X}^{\prime}_{j})\). [PERSON] receives \(C(\mathbf{X}^{\prime}_{j})\mathbf{U}_{j}\), and using her \(C(\mathbf{X}_{j})\), she computes the noisy \(\mathbf{U}^{\prime}_{j}\). Next, the errors of the secret key that arise from the noise of the quantum channel will be corrected. This phase is modeled by the scalar reconciliation box at [PERSON]'s side.