Reconciliation is the technique needed to ensure that Claude's and Dominique's key elements are equal. Starting from outcomes of the random variables X and Y, they wish to agree on an equal string Ψ.

In this chapter, I will first give some general properties and then overview and introduce several classes of reconciliation techniques.

Problem description

The goal of the legitimate parties is to distill a secret key, i.e., to end up with a shared binary string that is unknown to Eve. We assume as a convention that Claude's outcomes of X will determine the shared key K. The common string Ψ before privacy amplification can thus be expressed as a function Ψ(X).

Reconciliation consists in exchanging messages over the public classical authenticated channel, collectively denoted M, so that Dominique can recover Ψ from M and the outcomes of Y. If we denote as x1…l a vector of l independent outcomes of X, the string can be compressed to obtain about lH(Ψ(X)) common uniform bits.

As explained in Chapter 6, the impact of reconciliation on privacy amplification is a decrease of |M| bits in the key length, where |M| is the number of bits exchanged during reconciliation.

Our goal is thus to maximize lH(Ψ(X))-|M|, or if Ψ is given, to minimize the number |M| of disclosed bits.

Characteristics of reconciliation protocols

Before dealing with the details of reconciliation, let us here review some of its characteristics.

First, reconciliation can be either one-way or interactive. The first case is obviously only possible with one-way secret-key distillation, as information is sent only from Claude to Dominique.