# On the Security of Offloading Post-Processing
## 3 Outsourcing Information Reconciliation
### On Outsourcing Reverse Reconciliation  
For continuous-variable QKD (CV-QKD), we have different requirements than for discrete-variable QKD which not only impact the modulation schemes but also the information reconciliation. On the Qbit level, CV-QKD uses homodyne detection, which allows for soft or hard decoding. For simplicity, we will look only at discrete modulated CV-QKD, particularly binary modulation. Therefore, in the following, we treat the CV-QKD system as a hard-input-hard-output channel which operates on classical bit strings. The idea of reverse reconciliation was introduced by [PERSON] [27] for classical communication and later applied to CV-QKD to overcome the 3 dB loss limit [28]. In essence, reverse reconciliation is based on one-way error correction in a reverse configuration, with [PERSON] sending the syndrome \(\mathbf{s}_{B}\) to [PERSON] and [PERSON] correcting her bits. The underlying model is based on two channels: one connecting [PERSON] and [PERSON] and the other connecting [PERSON] and [PERSON]. Interestingly, if reverse reconciliation is applied in this scenario, a key can still be distilled even if the channel from [PERSON] to [PERSON] is superior to the one from [PERSON] to [PERSON]. The secret capacity of the channel for reverse reconciliation in [27] was derived as \(\mathsf{C}_{s}=H_{b}(e+d-2 ed)-H_{b}(e)\) when [PERSON] and [PERSON] had access to a broadcast channel for public discussion. The bit error probabilities are \(e\) and \(d\) for the channels from [PERSON] to [PERSON] and [PERSON] to [PERSON], respectively, and \(e+d-2 ed\) for the conceptual channel from [PERSON] to [PERSON]. \(H_{b}\) is the binary entropy function. In the classical model of [27], Shannon entropy is used in the analysis. For the case of CV-QKD, the mutual information between [PERSON] and [PERSON] has to be replaced by the Holevo information, and finite key effects have to be considered [29]. However, both refinements do not affect our treatment based on generic BSC channels. For the secret channel capacity argument to be valid, [PERSON]'s key has to be kept private, thus preventing [PERSON] from correcting the error bits in her key. With this additional requirement, outsourcing information reconciliation directly, as performed in REM-IR, is not possible. If both \(\mathbf{s}_{e}\) and \(\mathbf{s}_{B}\) are leaked, then \(\mathbf{s}_{A}=\mathbf{s}_{e}+\mathbf{s}_{B}\) can easily be computed, and the advantage over the conceptual channel is lost because [PERSON] can correct all errors in the string with [PERSON] and remove the uncertainty \(H(\mathbf{K}_{E}|\mathbf{K}_{B})\). More formally, the following result shows that _fully offloading_ error corrections (i.e., letting a third party perform the entire error correction and simply return \(\mathbf{e}\)) to an untrusted party cannot be achieved for both classical reverse reconciliation and in the quantum setting:  
**Theorem 2** (Impossibility of external syndrome decoding for classical RR). : _For reverse reconciliation in the classical (non-quantum) setting, full offloading syndrome decoding is not possible with a positive key rate._  
Proof. : [PERSON] is connected to [PERSON] and [PERSON] over binary symmetric channels (BSCs) with error rates \(e\) and \(d\), respectively. She sends out the very same signal \(\mathbf{k}_{A}\), which is received as \(\mathbf{k}_{B}\) and \(\mathbf{k}_{E}\). In the case of RR, we further have that [PERSON] sends the signal \(\mathbf{k}_{A}\) but corrects her key for the error received by [PERSON] (i.e., \(\mathbf{k}_{B}\) is the final key \(\mathbf{k}\)). For binary random input encoding, it holds that \(H(K_{A})=H(K_{B})=1\), and the mutual information \(I_{AB}\coloneqq I(K_{A};K_{B})=1-H_{b}(e)\) is defined by the error probability on the channel. \(K_{A}\), \(K_{B}\) and \(K_{E}\) are the binary correlated random variables at [PERSON], [PERSON] and [PERSON], respectively.