# On the Security of Offloading Post-Processing
## 3 Outsourcing Information Reconciliation
### Protocol for Offloading Direct Reconciliation  
In the context of QKD, if [PERSON], who sends the qubits, also sends the syndrome to [PERSON], and [PERSON] corrects erroneous bits to obtain the sifted key of [PERSON] as an agreed key, then the protocol is called _direct reconciliation_ (DR). In DV-QKD, which is considered symmetric [25], the roles of [PERSON] and [PERSON] can also be interchanged during IR, resulting in so-called _reverse reconciliation_ (RR). However, the same is not true for CV-QKD, where the direction of the IR protocol does matter for higher transmission rates, as will be discussed later. We present a simple scheme for remote (outsourced) information reconciliation called REM-IR (remote IR), which allows the computationally intense step of syndrome decoding to be outsourced to an untrusted party in a secure way. The idea is to give the error syndrome (i.e., \(\mathbf{s}_{\mathbf{e}}=\mathbf{s}_{B}-\mathbf{s}_{A}=\mathbf{k}_{B}\mathbf{H }^{\top}-\mathbf{k}_{A}\mathbf{H}^{\top}\)) to an external party, which returns the error vector \(\mathbf{e}\) with a minimal weight satisfying \(\mathbf{s}_{\mathbf{e}}=\mathbf{e}\mathbf{H}^{\top}\). We want to emphasize that searching for \(\mathbf{e}\mathbf{H}^{\top}=\mathbf{s}_{\mathbf{e}}\) can be carried out with the very same algorithms and techniques typically used locally by [PERSON] (e.g., efficient variants as in [21] or [26]). The problem is that finding \(\mathbf{e}\) with a minimum Hamming weight is fully equivalent to the problem of finding a \(\hat{\mathbf{k}}_{B}\) with a minimum Hamming distance to \(\mathbf{k}_{B}\) which fulfills \(\hat{\mathbf{k}}_{B}\mathbf{H}=\mathbf{s}_{B}\), which is due to the linearity of the code. As an example, if LDPC codes are used which are characterized by a sparse \(\mathbf{H}\), then all types of decoders can be used in the very same way to find \(\mathbf{e}\) close to the zero code word as in finding \(\hat{\mathbf{k}}_{B}\) close to \(\mathbf{k}_{B}\). The only difference in the two ways error decoding is applied is that in the latter, \(\hat{\mathbf{k}}_{B}\) is directly computed, and in the first case, it is computed by \(\hat{\mathbf{k}}_{B}=\mathbf{k}_{B}+\mathbf{e}\). Informally, the protocol is secure because the information leaked by publishing \(\mathbf{s}_{\mathbf{e}}\) and \(\mathbf{e}\) in addition to \(\mathbf{s}_{A}\), and thus also \(\mathbf{s}_{B}=\mathbf{s}_{A}-\mathbf{e}\), does not increase the information of [PERSON] regarding the agreed key string \(\mathbf{k}_{A}\). The intuition behind this is that just learning a bit flip vector of a largely unknown key does not increase the information about the key. Put differently, the information leaked about the final key \(\mathbf{k}_{A}\) by additionally learning \(\mathbf{e}\) is zero because \(\mathbf{e}\) is independent of \(\mathbf{k}_{A}\) and removed from \(\mathbf{k}_{B}\) in the IR step anyway. The described protocol is also equivalent to interactive error decoding, as introduced in CASCADE [19], which also leaks parity information and error bit locations during the public discussion. A detailed description of the protocol is shown in Figure 1, and the security of the protocols is proven in the following:  
**Theorem 1** (Security of REM-IR). : _REN-IR is a secure scheme for offloading direct reconciliation for DV-QKD and does not leak any additional information about the agreed key by public discussion compared with a local IR (i.e., the mutual information between [PERSON]'s key and the agreed key is the same as with local IR)._  
Proof. : Let \(\mathbf{K}_{A},\mathbf{K}_{B}\) be \(n\) bit random variables representing correlated sifted keys for [PERSON] and [PERSON], which are used as input to information reconciliation. \(\mathbf{S}_{A}\) is a random variable representing the syndrome computed by [PERSON], and \(\mathbf{E}\) is a random variable for the error introduced on \(n\) channel usages.