Practical device-independent quantum cryptography via entropy accumulation

Abstract

Device-independent cryptography goes beyond conventional quantum cryptography by providing security that holds independently of the quality of the underlying physical devices. Device-independent protocols are based on the quantum phenomena of non-locality and the violation of Bell inequalities. This high level of security could so far only be established under conditions which are not achievable experimentally. Here we present a property of entropy, termed “entropy accumulation”, which asserts that the total amount of entropy of a large system is the sum of its parts. We use this property to prove the security of cryptographic protocols, including device-independent quantum key distribution, while achieving essentially optimal parameters. Recent experimental progress, which enabled loophole-free Bell tests, suggests that the achieved parameters are technologically accessible. Our work hence provides the theoretical groundwork for experimental demonstrations of device-independent cryptography.

The security of DIQKD is difficult to prove, as one needs to take into account every possible attack strategy. Here, the authors develop a method to determine the entropy of a system as the sum of the entropies of its parts. Applied to DIQKD, this implies that it suffices to consider i.i.d. attacks.

Introduction

Device-independent (DI) quantum cryptographic protocols achieve an unprecedented level of security—with guarantees that hold (almost) irrespective of the quality, or trustworthiness, of the physical devices used to implement them¹. The most challenging cryptographic task in which DI security has been considered is quantum key distribution (QKD); we will use this task as an example throughout the manuscript. In DIQKD, the goal of the honest parties, called Alice and Bob, is to create a shared key, unknown to everybody else but them. To execute the protocol, they hold a device consisting of two parts: each part belongs to one of the parties and is kept in their laboratories. Ideally, the device performs measurements on some entangled quantum states it contains.

In real life, the manufacturer of the device, called Eve, can have limited technological abilities (and hence cannot guarantee that the device’s actions are exact and non-faulty) or even be malicious. The device itself is far too complex for Alice and Bob to open and assess whether it works as Eve alleges. Alice and Bob must therefore treat the device as a black box with which they can only interact according to the protocol. The protocol must allow them to test the possibly faulty or malicious device and decide whether using it to create their keys poses any security risk. The protocol guarantees that by interacting with the device according to the specified steps, the honest parties will either abort, if they detect a fault, or produce identical and secret keys (with high probability).

Adopting the DI approach is not only crucial for the paranoid cryptographers; even the most skilled experimentalist will recognise that a fully characterised, stable at all times, large-scale quantum device that implements a QKD protocol is extremely hard to build. Indeed, implementations of QKD protocols have been attacked by exploiting imperfections of the devices^2–5. Instead of trying to come up with a “patch” each time an imperfection in the device is detected, DI protocols allow us to break the cycle of attacks and countermeasures.

The most important (in fact necessary) ingredient, which forms the basis of all DI protocols, is a “test for quantumness” based on the violation of a Bell inequality^6–9. A Bell inequality^10,11 can be thought of as a game played by the honest parties using the device they share (Fig. 1). Different devices lead to different winning probabilities when playing the game. The game has a special “feature”—there exists a quantum device which achieves a winning probability ω_q greater than all classical, local, devices. Hence, if the honest parties observe that their device wins the game with probability ω_q they conclude that it must be non-local¹¹. A recent sequence of breakthrough experiments have verified the quantum advantage in such “Bell games” in a loophole-free way^12–14 (in particular, this means that the experiments were executed without making assumptions that could otherwise be exploited by Eve to compromise the security of a cryptographic protocol).

Fig. 1.

The Clauser–Horne–Shimony–Holt game³⁴. Alice and Bob input bits, separately, into their parts of the shared device. Each part of the device supplies an output. The game is won if a ⊕ b = x ⋅ y. The optimal winning probability in this game for a classical device is 75%. A quantum device can get up to approximately 86% by measuring the maximally entangled state $∣{\mathrm{\Phi }}^{+}⟩$ = $\left(∣00⟩+∣11⟩\right)\mathrm{∕}\sqrt{2}$ with the following measurements: Alice’s measurements x = 0 and x = 1 correspond to the Pauli operators σ_z and σ_x, respectively, and Bob’s measurements y = 0 and y = 1 to $\left({\sigma }_z+{\sigma }_x\right)\mathrm{∕}\sqrt{2}$ and $\left({\sigma }_z-{\sigma }_x\right)\mathrm{∕}\sqrt{2}$, respectively

DI security relies on the following deep but well-established facts. High winning probability in a Bell game not only implies that the measured system is non-local, but more importantly that the kind of non-local correlations it exhibits cannot be shared: the higher the winning probability, the less information any eavesdropper can have about the devices’ outcomes. The tradeoff between winning probability and secret randomness, or entropy, can be made quantitative^15,16.

The amount of entropy, or secrecy, generated in a single round of the protocol can therefore be calculated from the winning probability in a single game. The major challenge, however, consists in establishing that entropy accumulates additively throughout the multiple rounds of the protocol and use it to bound the total secret randomness produced by the device.

A commonly used assumption^17–21 to simplify this task is that the device held by the honest parties makes the same measurements on identical and independent quantum states in every round i ∈ {1, …, n} of the protocol. This implies that the device is initialised in some (unknown) state of the form σ^⊗n, i.e., an independent and identically distributed (i.i.d.) state, and that the measurements have a similar structure. In that case, the total entropy created during the protocol can be easily related to the sum of the entropies generated in each round separately (as further explained below).

Unfortunately, although quite convenient for the analysis, the i.i.d. assumption cannot be justified a priori. When considering device-dependent protocols, such as the BB84 protocol²², de Finetti theorems^23,24 can often be applied to reduce the task of proving the security in the most general case to that of proving security with the i.i.d. assumption. This approach was unsuccessful in the DI scenario, where known de Finetti theorems^23–26 do not apply. Hence, one cannot simply reduce a general security statement to the one proven under the i.i.d. assumption.

Without this assumption, however, very little is known about the structure of the untrusted device and hence also about its output. As a consequence, previous DIQKD security proofs had to address directly the most general case^27–29. This led to security statements which are of limited relevance for practical experimental implementations; they are applicable only in an unrealistic regime of parameters, e.g., small amount of tolerable noise and large number of signals.

The work presented here resolves this situation. First, we provide a general information-theoretic tool that quantifies the amount of entropy accumulated during sequential processes which do not necessarily behave identically and independently in each step. We call this result the “Entropy Accumulation Theorem” (EAT). We then show how it can be applied to essentially reduce the problem of proving DI security in the most general case to that of the i.i.d. case. This allows us to establish simple and modular security proofs for DIQKD that yield tight key rates. Our quantitative results imply that the first proofs of principle experiments implementing a DIQKD protocol are within reach with today’s state-of-the-art technology. Aside from its application to security proofs, the EAT can be used in other scenarios in quantum information such as the analysis of quantum random access codes.

Results

In the following, we start by explaining the main steps in a security proof of DIQKD under the i.i.d. assumption using well-established techniques. We then present the EAT and show how it can be used to extend the proof and achieve full security (i.e., without assuming an i.i.d. behaviour of the device).

Security under the independent and identically distributed device assumption

The central task when proving the security of cryptographic protocols consists in bounding the information that an adversary, called Eve, may obtain about certain values generated by the protocol, which are supposed to be secret. For QKD, the appropriate measure of knowledge, or rather uncertainty, is given by the smooth conditional min-entropy³⁰ $H_{\min }^{\epsilon }\left(K∣E\right)$, where K is the raw data obtained by the honest parties, E the quantum system held by Eve, and ε a parameter describing the security of the protocol. The quantity $H_{\min }^{\epsilon }\left(K∣E\right)$ determines the maximal length of the secret key that can be created by the protocol. Hence, proving the security amounts to establishing a lower bound on $H_{\min }^{\epsilon }\left(K∣E\right)$. Evaluating $H_{\min }^{\epsilon }\left(K∣E\right)$ can be a daunting task, as the adversary’s system E is out of our control; in particular, it can have arbitrary dimension and share quantum correlations with the users’ devices.

Most protocols consist of a basic building block, or “round”, which is repeated a large number, n, of times; in each round i, the classical data K_i is generated. The structure of a DIQKD protocol is shown in Box 1. The i.i.d. assumption means that the raw key $K_1^n=K_1,\dots ,K_n$ can be treated as a sequence of i.i.d. random variables K_i. That is, all the K_i are identical and independent of one another. The eavesdropper has side information E_i about each K_i. In this case, the total conditional min-entropy $H_{\min }^{\epsilon }\left(K_1^n∣E_1^n\right)$ can be directly related to the single-round conditional von Neumann entropy $H\left(K_i∣E_i\right)$ using the quantum asymptotic equipartition property³¹ (AEP), which asserts that

$$H_{\min }^{\epsilon }\left(K_1^n∣E_1^n\right)\ge nH\left(K_i∣E_i\right)-c_{\epsilon }\sqrt{n},$$ 1

where c_ε depends only on ε (see the Methods section).

To get a bound on $H_{\min }^{\epsilon }\left(K_1^n∣E_1^n\right)$, we therefore need to analyse the secrecy, $H\left(K_i∣E_i\right)$, resulting from a single round of the protocol. Depending on the considered scenario, a lower bound on $H\left(K_i∣E_i\right)$ can be found using different techniques. For discrete- and continuous-variable QKD, for example, one can use the entropic uncertainty relations^32,33. When dealing with DIQKD, a quantum advantage in a Bell game implies a lower-bound on $H\left(K_i∣E_i\right)$ as discussed above.

The Clauser–Horne–Shimony–Holt (CHSH) game³⁴ (presented in Fig. 1) forms the basis for most DIQKD protocols. For this game, a tight bound on the secrecy as a function of the winning probability in the game was derived¹⁹. The bound implies that for any quantum state that wins the CHSH game with probability ω, the entropy evaluated on the state of the system after the game has been played is at least

$$H\left(K_i∣E_i\right)\ge 1-h\left(\frac{1}{2}+\frac{1}{2}\sqrt{16\omega \left(\omega -1\right)+3}\right),$$ 2

where h(⋅) is the binary entropy function. This relation is shown in Fig. 2.

Fig. 2.

Secrecy for the Clauser–Horne–Shimony–Holt game vs. winning probability. The amount of secret randomness is quantified by the conditional von Neumann entropy $H\left(A∣E\right)$. As soon as the winning probability is above the classical threshold of 75% some secret randomness is produced. The analytical bound¹⁹ is stated as Eq. (2)

To compute the bound on $H\left(K_i∣E_i\right)$, Alice and Bob need to collect the statistics they observe while running the protocol and estimate the winning probability ω appearing in Eq. (2); assuming the i.i.d. structure this is easily done using Hoeffding’s inequality.

The conclusion of this section is the following. The i.i.d. assumption plays a crucial role in the above line of proof: it allows us to reduce the problem of calculating the total secrecy of the raw key created by the device to that of bounding the secrecy produced in one round. Instead of dealing with large-scale quantum systems, we are only required to understand the physics of small systems associated with just one round (as in Eq. (2)). The AEP appearing as Eq. (1) does the rest.

Box 1 Device-independent quantum key distribution protocol (simplified example)

  Given: A device for Alice and Bob that can play the chosen Bell game repeatedly

1. For every round i ∈ [n] do Steps 2–4:

2.  Alice and Bob choose X_i,Y_i at random.

3.  They input X_i,Y_i to the device and record the outputs A_i, B_i.

4.  Alice sets K_i = A_i

5. Parameter estimation: Alice and Bob estimate the average winning probability in the game from the observed data. If it is below the expected winning probability, ω_T, they abort.

6. Classical post processing: Alice and Bob apply an error correction protocol and a privacy amplification protocol (both classical) on their raw keys K and B.

Extending to full security

Assuming the device behaves in an i.i.d. way goes completely against the DI setting by imposing a severe and even unrealistic restrictions on the implementation of the device. In particular, the assumption implies that the device does not include any, classical or quantum, internal memory (i.e., its actions in one round cannot depend on the previous rounds) and cannot display time-dependent behaviour.

Our main contribution can be phrased as follows.

Theorem (Security of DIQKD, informal): Security of DIQKD in the most general case follows from security under the i.i.d. assumption. Moreover, the dependence of the key rate on the number of exchanged signals, n, is the same as the one in the i.i.d. case, up to terms that scale like $1\mathrm{∕}\sqrt{n}$. The key rates are plotted below.

We now explain the above theorem and how it is derived in more detail. A general device is described by an (unknown) tripartite state ${\rho }_{Q_{\mathrm{A}}{Q}_{\mathrm{B}}E}$, where the bipartite quantum state ${\rho }_{Q_{\mathrm{A}}{Q}_{\mathrm{B}}}$ is shared between Alice and Bob and ρ_E belongs to Eve, together with the measurements applied to ${\rho }_{Q_{\mathrm{A}}{Q}_{\mathrm{B}}}$ when the device is used. No additional structure is assumed (see Fig. 3).

Fig. 3.

An independent and identically distributed device vs. a general one. An independent and identically distributed (i.i.d.) device (left) is initialised in some (unknown) i.i.d. state σ^⊗n; each “small device” is described by one copy of the same bipartite state σ and all copies are measured in the same way. A general device (right) is described by a bipartite quantum state ρ; in contrast to the i.i.d. case, any further division into subsystems is unknown. During the protocol, the state is measured through a sequential process: Alice and Bob use the device in the first round of the protocol and only then proceed to the second round, and so on

As mentioned above, the standard DIQKD protocol proceeds in rounds (recall Box 1): Alice and Bob use their components in the first round of the protocol and only then proceed to the second round, etc. We leverage this structure to bound the amount of entropy produced during a complete execution of the protocol.

To do so, we prove a generalisation of the AEP given in Eq. (1) to a scenario in which, instead of the raw key $K_1^n=K_1,\dots ,K_n$ being produced by an i.i.d. process, its parts K_i are produced one after the other. In this case, each K_i may depend not only on i-th round of the protocol but also on everything that happened in previous rounds (but not on the subsequent ones). We explain our tool, the EAT, in the following.

The entropy accumulation theorem (EAT)

We describe here a simplified and informal version of the EAT, sufficient to understand how it can be used to prove the security of DI protocols; for the most general statements see the Methods section.

We consider processes which can be described by a sequence of n maps ${\mathcal{M}}_1,\dots ,{\mathcal{M}}_n$, called “EAT channels”, as shown in Fig. 4. Each ${\mathcal{M}}_i$ outputs two systems, O_i, which describes the information that should be kept secret, and S_i, describing some side information leaked by the map, together with a “memory” system R_i, which is passed on as an input to the next map ${\mathcal{M}}_{i+1}$. The systems $S_1^n$ describe the side information created during the process. A further quantum system, denoted by E, represents additional side information correlated to the initial state in the beginning of the considered process. The systems $O_1^n$ are then the ones in which entropy is accumulated conditioned on the side information $S_1^n$ and E.

Fig. 4.

Sequential processes. Each map in the sequence ${\mathcal{M}}_i$ outputs O_i, which describes the information that should be kept secret, and S_i, describing some side information leaked by the map, together with a “memory” system R_i, which gets passed on to the next map ${\mathcal{M}}_{i+1}$. In each step, an additional classical value C_i is calculated from O_i and S_i

To bound the entropy of $O_1^n$, we take into account global statistical properties. These are inferred by tests carried out by the protocol on a small sample of the generated outputs. To incorporate such statistical information, we consider for each round an additional classical value C_i computed from O_i and S_i. Additionally, in each step of the process, the previous outcomes $O_1^{i-1}$ are independent of future information S_i given all the past side information $S_1^{i-1}E$. By choosing O_i and S_i properly, this condition can be satisfied by sequential protocols such as DIQKD.

The EAT relates the total amount of entropy to the entropy accumulated in one step of the process. The latter is quantified by the minimal, or worst-case, von Neumann entropy produced by the maps ${\mathcal{M}}_i$ when acting on an input state that reproduces the correct statistics on C_i, i.e., states that satisfy ${\mathcal{M}}_i{\left(\sigma \right)}_{C_i}=\mathrm{f}req\left(c_1^n\right)$ where $\mathrm{f}req\left(c_1^n\right)$ is the empirical statistics, or frequency distribution, on $\mathcal{C}$ defined by $\mathrm{f}req\left(c_1^n\right)\left(c\right)=\frac{∣\left\{i\in \left\{1,\dots ,n\right\}:c_i=c\right\}∣}{n}$.

To state the explicit result, we define a “min-tradeoff function”, f_min, from the set of probability distributions over $\mathcal{C}$ to the real numbers; f_min should be chosen as a convex differentiable function which is bounded above by the worst-case entropy just described:

$$f_{\min }\left(\mathrm{f}req\left(c_1^n\right)\right)\le H\left(O_i∣S_{i}E\right).$$ 3

An event Ω is defined by a subset of ${\mathcal{C}}^n$ and we write $p_{\Omega }={\sum }_{c_1^n\in \Omega }\left({\rho }_{O_1^n{S}_1^{n}E,C_1^n=c_1^n}\right)$ for the probability of the event Ω and

$${\rho }_{\mid \Omega }=\frac{1}{p_{\Omega }}\sum _{c_1^n\in \Omega }∣c_1^n⟩⟨c_1^n∣\otimes {\rho }_{O_1^n{S}_1^{n}E,C_1^n=c_1^n}$$ 4

for the state conditioned on Ω. We further define a set $\widehat{\Omega }$ over the set of frequencies such that for all $c_1^n$, $\mathrm{f}req\left(c_1^n\right)\in \widehat{\Omega }$ if and only if $c_1^n\in \Omega$.

Theorem (EAT, informal): For any EAT channels, an event Ω such that $\widehat{\Omega }$ is a convex set, and a convex min-tradeoff function for which $f_{\min }\left(\mathrm{f}req\left(c_1^n\right)\right)\ge t$ for any $\mathrm{f}req\left(c_1^n\right)\in \widehat{\Omega }$,

$$H_{\min }^{\epsilon }\left(O_1^n∣S_1^{n}E\right)>nt-v\sqrt{n},$$ 5

where the conditional smooth min-entropy is evaluated on ρ_|Ω and v depends on the values ${∥\nabla f_{\min }∥}_{\infty },\epsilon ,p_{\Omega }$, and the maximal dimension of the systems O_i.

Equation (5) asserts that, to first order in n, the total conditional smooth min-entropy is at least n times the value of the min-tradeoff function, evaluated on the empirical statistics observed during the protocol (and hence linear in the number of rounds). In the special case where the EAT channels are independent and identical, the EAT is reduced to the quantum AEP; Eq. (5) is thus a generalisation of Eq. (1).

DIQKD security via the EAT

To gain intuition on how the EAT can be applied to DIQKD, note the following. Define the maps ${\mathcal{M}}_i$ to describe the joint behaviour of the honest parties and their respective uncharacterised device while playing a single round of a Bell game such as the CHSH game. Let Ω be the event of the protocol not aborting or a closely related event, e.g., the event that the fraction of CHSH games won is above some threshold ω_T. The state for which the smooth min-entropy is evaluated is ρ_|Ω, i.e., the state at the end of the protocol conditioned on not aborting. This implies, in particular, a bound on $H_{\min }^{\epsilon }\left(K_1^n∣E\right)$.

Furthermore, the condition on the min-tradeoff function stated in Eq. (3) corresponds to the requirement that the distribution of C_i equals $c_1^n$, which ensures that the entropy in Eq. (3) is evaluated on states that can be used to win the CHSH game with probability ω_T. Thus, in order to devise an appropriate min-tradeoff function, we can use the relation appearing in Eq. (2); the exact details are given in the Methods section. This results in a tight bound on the amount of entropy created in each step of the protocol. In this sense, we reduce the problem of proving the security of the whole protocol to that of a single round.

Using the EAT we get a bound on $H_{\min }^{\epsilon }\left(K_1^n∣E\right)$ which, to first order in n, coincides with the one derived under the i.i.d. assumption and is thus optimal. The final key rate $r=\ell \mathrm{∕}n$ (where $\ell$ is the length of a key) produced in a DIQKD protocol depends on this amount of entropy and the amount of information leaked during standard classical post-processing steps. We plot the results for specific choices of parameters in Fig. 5.

Fig. 5.

Key rate in a DIQKD protocol. The plots show the key rate r as a function of a the quantum bit error rate Q and b the number of signals n. The completeness error, i.e., the probability that the protocol aborts when using an honest implementation of the device, e.g., due to statistical fluctuations, was chosen to be ${\epsilon }_{\mathrm{QKD}}^c=10^{-2}$. The soundness error, which quantifies the maximum tolerated deviation of the actual protocol from a hypothetical one where a perfectly random and completely secret key is produced for Alice and Bob, is taken to be ${\epsilon }_{\mathrm{QKD}}^s=10^{-5}$. Both of these values are considered to be realistic and relevant for actual applications. The rates are calculated using Eq. (35) which is derived in the Methods section

To calculate the key rate, one must have some honest implementation of the protocol in mind; this is given by what the experimentalists think (or guess) is happening in their experiment when an adversary is not present. It does not, in any way, restrict the actions of the adversary or the types of imperfections in the device. We consider the following honest implementation, but the analysis can be adapted to any other implementation of interest.

In the realisation of the device, in each round, Alice and Bob share the two-qubit Werner state ${\rho }_{Q_{\mathrm{A}}{Q}_{\mathrm{B}}}=\left(1-\nu \right)∣{\mathrm{\Phi }}^{+}⟩⟨{\mathrm{\Phi }}^{+}∣+\nu \mathbb{I}\mathrm{∕}4$ resulting from a depolarisation noise acting on the maximally entangled state $∣{\mathrm{\Phi }}^{+}⟩$. In every round, the measurements for X_i, Y_i ∈ {0, 1} are as described in Fig. 1 and for Y_i = 2 Bob’s measurement is σ_z. The winning probability in the CHSH game (restricted to X_i, Y_i ∈ {0, 1}) using these measurements on ${\rho }_{Q_{\mathrm{A}}{Q}_{\mathrm{B}}}$ is ${\omega }_{\exp }=\left[2+\sqrt{2}\left(1-\nu \right)\right]\mathrm{∕}4$. The quantum bit error rate $Q=\mathrm{Pr}\left[A_i\ne B_i∣\left(X_i,Y_i\right)=\left(0,2\right)\right]$ for the above state and measurements is given by Q = ν/2.

The key rate r is plotted in Fig. 5. For n = 10¹⁵, the curve essentially coincides with the rate achieved in the asymptotic i.i.d. case¹⁹. Since the latter was shown to be optimal¹⁹, it provides an upper bound on the key rate and the amount of tolerable noise. Hence, for large enough n our rates become optimal and the protocol can tolerate up to the maximal error rate Q = 7.1%. For comparison, the previously established explicit rates²⁸ are well below the lowest curve presented in Fig. 5, even when the number of signals goes to infinity, with a maximal noise tolerance of 1.6%. Moreover, our key rates are comparable to those achieved in device-dependent QKD protocols³⁵.

Discussion

The information theoretic tool, the EAT, reveals a novel property of entropy: the operationally relevant total uncertainty about an n-partite system created in a sequential process corresponds to the sum of the entropies of its parts, even without an independence assumption.

Using the EAT, we show that practical and realistic protocols can be used to achieve the unprecedented level of DI security. The next major challenge in experimental implementations is a field demonstration of a DIQKD protocol. This would provide the strongest cryptographic experiment ever realised. The work presented here provides the theoretical groundwork for such experiments. Our quantitative results imply that the first proofs of principle experiments, with small distances and small rates, are within reach with today’s state-of-the-art technology, which recently enabled the violation of Bell inequalities in a loophole-free way.

Methods

We state here the main theorems of our work and sketch the proofs. Using the explicit expressions given below, one can reproduce the key rates presented in Fig. 5.

The formal statement and proof idea of the EAT

In this section, we are interested in the general question of whether entropy accumulates, in the sense that the operationally relevant total uncertainty about an n-partite system $O_1^n$ corresponds to the sum of the entropies of its parts O_i. The AEP, given in Eq. (1), implies that this is indeed the case to first order in n—under the assumption that the parts O_i are identical and independent of each other. Our result shows that entropy accumulation occurs for more general processes, i.e., without an independence assumption, provided one quantifies the uncertainty about the individual systems O_i by the von Neumann entropy of a suitably chosen state.

The type of processes that we consider are those that can be described by a sequence of channels, as illustrated in Fig. 4. Such channels are called EAT channels and are formally defined as follows.

Definition 1 (EAT channels): EAT channels ${\mathcal{M}}_i:R_{i-1}\to R_i{O}_i{S}_i{C}_i$, for i ∈ [n], are CPTP (completely positive trace preserving) maps such that for all i ∈ [n]:

1. C_i are finite-dimensional classical systems (random variables). O_i, S_i, and R_i are quantum registers. The dimension of O_i is $d_{O_i}.$

2. For any input state ${\sigma }_{R_{i-1}R\prime }$, where R′ is a register isomorphic to R_i−1, the output state ${\sigma }_{R_i{O}_i{S}_i{C}_{i}R\prime }=\left({\mathcal{M}}_i\otimes {\mathbb{I}}_{R\prime }\right)\left({\sigma }_{R_{i-1}R\prime }\right)$ has the property that the classical value C_i can be measured from the system ${\sigma }_{O_i{S}_i}$ without changing the state.

3. For any initial state ${\rho }_{R_{0}E}^0$, the final state ${\rho }_{O_1^n{S}_1^n{C}_1^{n}E}=\left(\left({\mathrm{Tr}}_{R_n}\circ {\mathcal{M}}_n\circ \dots \circ {\mathcal{M}}_1\right)\otimes {\mathbb{I}}_E\right){\rho }_{R_{0}E}^0$ fulfils the Markov chain condition $O_1^{i-1}\leftrightarrow S_1^{i-1}E\leftrightarrow S_i$ for each i ∈ [n].

In the above definition, $O_1^{i-1}\leftrightarrow S_1^{i-1}E\leftrightarrow S_i$ if and only if their conditional mutual information is 0, $I\left(O_1^{i-1}:S_i∣S_1^{i-1}E\right)=0$.

Next, one should find an adequate way to quantify the amount of entropy which is accumulated in a single step of the process, i.e., in an application of just one channel. To do so, let p be a probability distribution over $\mathcal{C}$, where $\mathcal{C}$ denotes the common alphabet of $C_1,\dots ,C_n$, and R′ be a system isomorphic to R_i−1. We define the set of states

$$\begin{array}{ccc}{\mathrm{\Sigma }}_i\left(p\right)\hfill & =\hfill & \left\{{\sigma }_{O_i{S}_i{C}_i{R}_{i}R\prime }=\left({\mathcal{M}}_i\otimes {\mathbb{I}}_{R\prime }\right)\left({\tau }_{R_{i-1}R\prime }\right):\right.\hfill \\ \hfill & \hfill & \left.\tau \in \mathrm{D}\left(R_{i-1}\otimes R\prime \right)\mathrm{and}{\sigma }_{C_i}=p\right\},\hfill \end{array}$$ 6

where ${\sigma }_{C_i}$ denotes the probability distribution over $\mathcal{C}$ with the probabilities given by $⟨c∣{\sigma }_{C_i}∣c⟩$.

The tradeoff functions for the EAT channels are defined below.

Definition 2 (Tradeoff functions): A real function is called a min- or max-tradeoff function for ${\mathcal{M}}_i$ if it satisfies

$$f_{\min }\left(p\right)\le \underset{\sigma \in {\mathrm{\Sigma }}_i\left(p\right)}{\inf }H{\left(O_i∣S_{i}R\prime \right)}_{\sigma }$$ 7

or

$$f_{\max }\left(p\right)\ge \underset{\sigma \in {\mathrm{\Sigma }}_i\left(p\right)}{\sup }H{\left(O_i∣S_{i}R\prime \right)}_{\sigma },$$ 8

respectively, and if it is convex or concave, respectively. If the set Σ_i(p) is empty, then the infimum and supremum are by definition equal to ∞ and −∞, respectively, so that the conditions are trivial.

To get some intuition as to why the above definition is the “correct” one, consider the following classical example. Each EAT channel outputs a single bit O_i without any side information S_i about it; the system E is empty as well. Every bit can depend on the ones produced previously. We would like to extract randomness out of the sequence $O_1^n$; for this we should find a lower bound on $H_{\min }^{\epsilon }\left(O_1^n\right)$.

We ask the following question—given the randomness of O₁ which is already accounted for, how much randomness does O₂ contribute? One possible guess is the conditional von Neumann entropy $H\left(O_2∣O_1\right)={\mathbb{E}}_{o_1,o_2}{\left[-\log \mathrm{Pr}\left(o_2∣o_1\right)\right]}_{}^{}$. If, however, O₁ is uniform while O₂ is fixed when O₁ = 0 and uniform otherwise, then $H\left(O_2∣O_1\right)$ is too optimistic; the amount of extractable randomness is quantified by the smooth min-entropy, which depends on the most probable value of O₁O₂, and not by an average quantity as the von Neumann entropy.

Another possible guess is a worst-case version of the min-entropy $H_{\min }^{\mathrm{w}.c.}={\min }_{o_1,o_2}\left[-\log \mathrm{Pr}\left(o_2∣o_1\right)\right]$. This, however, is too pessimistic; when the O_i’s are independent of each other, the extractable amount of randomness behaves like the von Neumann entropy in first order, and not like the min-entropy.

We therefore choose an intermediate quantity—${\min }_{o_1}{\mathbb{E}}_{o_2}\left[-\log \mathrm{Pr}\left(o_2∣o_1\right)\right]={\min }_{o_1}H\left(O_2∣O_1=o_1\right)$. That is, this quantity is the von Neumann entropy of O₂, evaluated for the worst-case state in the beginning of the second step of the process. The min-tradeoff function defined above is the quantum analogue version of this.

Informally, the min-tradeoff function can be understood as the amount of entropy available from a single round, conditioned on the outputs of the previous rounds. Since we condition on the previous rounds, one can think of the randomness of the current round as independent from past events. Intuitively, this suggests that, by appropriately generalising the proof of the AEP, one can argue that the entropy that is contributed by this independent randomness in each round accumulates.

The formal statement of the EAT is as follows.

Theorem 3 (EAT, formal): Let ${\mathcal{M}}_i:R_{i-1}\to R_i{O}_i{S}_i{C}_i$ for i ∈ [n] be EAT channels, ρ be the final state, Ω an event defined over ${\mathcal{C}}^n$, p_Ω the probability of Ω in ρ, and ρ_|Ω the final state conditioned on Ω. Let ε_s ∈ (0, 1).

For f_min, a min-tradeoff function for $\left\{{\mathcal{M}}_i\right\}$, $\widehat{\Omega }=\left\{\mathrm{f}req\left(c_1^n\right)∣c_1^n\in \Omega \right\}$ convex, and any $t\in \mathbb{R}$ such that $f_{\min }\left(\mathrm{f}req\left(c_1^n\right)\right)\ge t$ for any $c_1^n\in {\mathcal{C}}^n$ for which $\mathrm{Pr}{\left[c_1^n\right]}_{{\mathrm{\rho }}_{\mid \Omega }}>0$,

$$H_{\min }^{\epsilon }{\left(O_1^n∣S_1^{n}E\right)}_{{\mathrm{\rho }}_{\mid \Omega }}>nt-v\sqrt{n},$$ 9

where

$$v=2\left(\log \left(1+2d_{O_i}\right)+⌈{∥\nabla f_{\min }∥}_{\infty }⌉\right)\sqrt{1-2\log \left({\epsilon }_{\mathrm{s}}\cdot p_{\Omega }\right)}.$$ 10

Similarly, for f_max a max-tradeoff function and $t\in \mathbb{R}$ such that $f_{\max }\left(\mathrm{f}req\left(c_1^n\right)\right)\le t$ for any $\mathbf{c}\in {\mathcal{C}}^n$ for which $\mathrm{Pr}{\left[\mathbf{c}\right]}_{{\mathrm{\rho }}_{\mid \Omega }}>0$,

$$H_{\max }^{\epsilon }{\left(O_1^n∣S_1^{n}E\right)}_{{\mathrm{\rho }}_{\mathrm{\mid \Omega }}}<nt-v\sqrt{n}.$$ 11

The two most important properties of the above statement are that the first-order term is linear in n and that t is the von Neumann entropy of a suitable state (as explained above). This implies that the EAT is tight to first order in n.

We remark that the Markov chain conditions are important, in the sense that dropping them completely would render the statement invalid.

We now give a rough proof sketch of the $H_{\min }^{\epsilon }$ case; the bound for $H_{\max }^{\epsilon }$ follows from an almost identical argument. The proof has a similar structure to that of the quantum AEP³¹, which we can retrieve as a special case. The proof relies heavily on the “sandwiched” Rényi entropies^36,37, which is a family of entropies that we will denote here by H_α, where α is a real parameter ranging from $\frac{1}{2}$ to ∞, and which corresponds to the max-entropy at $\alpha =\frac{1}{2}$, to the von Neumann entropy when α = 1, and to the min-entropy when α = ∞.

The basic idea is to first lower bound the $H_{\min }^{\epsilon }$ term by H_α using the following general bound^31,38–40:

$$H_{\min }^{\epsilon }\left(A∣B\right)>H_{\alpha }\left(A∣B\right)-\frac{1}{\alpha -1}O\left(\log \left(1\mathrm{∕}\epsilon \right)\right).$$ 12

Then, we lower bound the H_α term by the von Neumann entropy using the following^31,39:

$$H_{\alpha }\left(A∣B\right)>H\left(A∣B\right)-\left(\alpha -1\right)O\left({\left(\log d_A\right)}^2\right).$$ 13

Now, we could simply chain these two inequalities and apply them to $H_{\min }^{\epsilon }\left(O_1^n∣S_1^{n}E\right)$. However, this would result in a very poor bound due to the $O\left({\left(\log d_A\right)}^2\right)$ term in Eq. (13), which in our case would be O(n²). To get the bound we want, we need to reduce this term to O(n); choosing $\alpha \approx 1+\frac{1}{\sqrt{n}}$ would then produce a bound with the right scaling.

The trick we use to achieve this is to decompose $H_{\alpha }\left(O_1^n∣S_1^{n}E\right)$ into n terms of constant size before applying Eq. (13). In the quantum AEP³¹, this step is immediate since the state is i.i.d. Here, we must use more sophisticated techniques. Specifically, we use the following chain rule for the sandwiched Rényi entropy to decompose $H_{\alpha }\left(O_1^n∣S_1^{n}E\right)$ into n terms:

Theorem 4: Let ${\rho }_{R{A}_1{B}_1}^0$ be a density operator on R ⊗ A₁ ⊗ B₁ and $\mathcal{M}={\mathcal{M}}_{A_2{B}_2\leftarrow R}$ be a CPTP map. Assuming that ${\rho }_{A_1{B}_1{A}_2{B}_2}=\mathcal{M}\left({\rho }_{R{A}_1{B}_1}^0\right)$ satisfies the Markov condition A₁↔B₁↔B₂,we have

$$H_{\alpha }{\left(A_1∣B_1\right)}_{\rho }+\underset{\omega }{\inf }{H}_{\alpha }{\left(A_2∣B_2{A}_1{B}_1\right)}_{\mathcal{M}\left(\omega \right)}\le H_{\alpha }{\left(A_1{A}_2∣B_1{B}_2\right)}_{\rho },$$ 14

where the infimum ranges over density operators ${\omega }_{R{A}_1{B}_1}$ on R ⊗ A₁ ⊗ B₁. Moreover, if ${\rho }_{R{A}_1{B}_1}^0$ is pure, then we can optimise over pure states ${\omega }_{R{A}_1{B}_1}$.

Implementing this proof strategy then yields the following chain of inequalities:

$$\begin{array}{cc}\hfill & H_{\min }^{\epsilon }{\left(O_1^n∣S_1^{n}E\right)}_{\rho }\hfill \\ \hfill & >H_{\alpha }{\left(O_1^n∣S_1^{n}E\right)}_{\rho }-\frac{1}{\alpha -1}O\left(\log \left(1\mathrm{∕}\epsilon \right)\right)\hfill \\ \hfill & \ge \sum _i\underset{{\omega }_{R\prime R_i}}{\inf }{H}_{\alpha }{\left(O_i∣S_{i}R\prime \right)}_{{\mathcal{M}}_i\left(\omega \right)}-\frac{1}{\alpha -1}O\left(\log \left(1\mathrm{∕}\epsilon \right)\right)\hfill \\ \hfill & >\sum _i\underset{\omega }{\inf }H{\left(O_i∣S_{i}R\prime \right)}_{{\mathcal{M}}_i\left(\omega \right)}-\frac{1}{\alpha -1}O\left(\log \left(1\mathrm{∕}\epsilon \right)\right)\hfill \\ \hfill & -n\left(\alpha -1\right)O\left({\left(\log d_{O_i}\right)}^2\right)\hfill \\ \hfill & \ge \sum _i\underset{\omega }{\inf }H{\left(O_i∣S_{i}R\prime \right)}_{{\mathcal{M}}_i\left(\omega \right)}-O\left(\sqrt{n}\right).\hfill \end{array}$$ 15

However, this does not yet take into account the sampling over the C_i subsystems. To do this, we tweak the EAT channels ${\mathcal{M}}_i$ to output two extra systems D_i and ${\overline{D}}_i$ which contain an amount of entropy that depends on the value of C_i observed. To define this, let g be an affine lower bound on f_min, let $\left[g_{\min },g_{\max }\right]$ be the smallest interval that contains the range of g, and set $ḡ:=\frac{1}{2}\left(g_{\min }+g_{\max }\right)$. Then, we define ${\mathcal{D}}_i:C_i\to C_i{D}_i{\overline{D}}_i$ as

$${\mathcal{D}}_i\left(X\right)=\sum _c⟨c∣X∣c⟩\cdot ∣c⟩{⟨c∣}_{C_i}\otimes \tau {\left(c\right)}_{D_i{\overline{D}}_i},$$ 16

where τ(c) is a mixture between a maximally entangled state and a fully mixed state such that the marginal on ${\overline{D}}_i$ is uniform, and such that $H_{\alpha }{\left(D_i∣{\overline{D}}_i\right)}_{\tau \left(c\right)}=ḡ-g\left({\delta }_c\right)$ (here δ_c stands for the distribution with all the weight on element c). To ensure that this is possible, we need to choose $d_{D_i}$ large enough, and it turns out that setting $d_{D_i}=⌈2^{\parallel \nabla g{\parallel }_{\infty }}⌉$ suffices. We can then define a new sequence of EAT channels by ${\overline{\mathcal{M}}}_i={\mathcal{D}}_i\circ {\mathcal{M}}_i$.

Armed with this, we apply the above argument to our new EAT channels. On the one hand, a more sophisticated version of Eq. (12) yields:

$$\begin{array}{ccc}{H}_{\min }^{\epsilon }{\left(O_1^n∣S_1^{n}E\right)}_{{\rho }_{\mid \Omega }}\hfill & \ge \hfill & H_{\alpha }{\left(O_1^n{D}_1^n∣S_1^{n}E{\overline{D}}_1^n\right)}_{\rho }\hfill \\ \hfill & -\hfill & nḡ+nt-O\left(\sqrt{n}\right)\log \left(\frac{1}{p_{\Omega }}\right)\hfill \end{array}$$ 17

On the other hand, the argument from Eq. (15) can be used here to give

$$H_{\alpha }{\left(O_1^n{D}_1^n∣S_1^{n}E{\overline{D}}_1^n\right)}_{\rho }>nḡ-O\left(\sqrt{n}\right)\left(\log {\left(d_{O_i}{d}_{D_i}\right)}^2\right).$$ 18

Combining these two bounds then yields the theorem.

We remark that some of the concepts used in this work generalise techniques proposed in the recent security proofs for DI cryptography²⁹.

Entropy accumulation protocol

To analyse the key rates of the DIQKD protocol, we first find a lower bound on the amount of entropy accumulated during the run of the protocol, when the honest parties use their device to play the Bell games repeatedly. To this end, we consider the “entropy accumulation protocol” shown in Box 2. This protocol can be seen as the main building block of many DI cryptographic protocols.

The entropy accumulation protocol creates m blocks of bits, each of maximal length $s_{max}$. Each block ends (with high probability) with a test round; this is a round in which Alice and Bob play the CHSH game with their device so that they can verify that the device acts as expected. The probability of each round to be a test round is γ. The rest of the rounds are generation rounds, in which Bob chooses a special input for his component of the device. In the end of the protocol, Alice and Bob check whether they had sufficiently many test rounds in which they won the CHSH game. If not, they abort.

We note that the protocol is complete, in the sense that there exists an honest implementation of it (possibly noisy) which does not abort with high probability. Denoting the completeness error, i.e., the probability that the protocol aborts for an honest implementation of the devices D, by ${\epsilon }_{EA}^c$, one can easily show using Hoeffding’s inequality that for an honest i.i.d. implementation ${\epsilon }_{EA}^c\le \exp \left(-2n{\delta }_{\mathrm{est}}^2\right)$.

Next, we show that the protocol is also sound. That is, for any device D, if the probability that the protocol does not abort is not too small, then the total amount of smooth min-entropy is sufficiently high.

The EAT can be used to bound the total amount of smooth min-entropy, $H_{\min }^{{\epsilon }_{\mathrm{s}}}{\left(A_1^n{B}_1^n∣X_1^n{Y}_1^n{T}_1^{n}E\right)}_{{\rho }_{\mid \Omega }}$, created when running the entropy accumulation protocol, given that it did not abort. Here n denotes the expected number of rounds of the protocol and ε_s is one of the security parameters (to be fixed later).

Below we use the following notation. For each block j ∈ [m], ${\overrightarrow{A}}_j$ denotes the string that includes Alice’s outputs in block j (note that the length of this string is unknown, but it is at most $s_{max}$). ${\overrightarrow{B}}_j,{\overrightarrow{X}}_j$, and ${\overrightarrow{Y}}_j$ are defined analogously. To use the EAT, we make the following choices of random variables:

$$O_i\to {\overrightarrow{A}}_j{\overrightarrow{B}}_j$$ 19

$$S_i\to {\overrightarrow{X}}_j{\overrightarrow{Y}}_j{\overrightarrow{T}}_j$$ 20

$$C_i\to {\tilde{C}}_j$$ 21

$$E\to E.$$ 22

The event Ω is the event of not aborting the protocol, as given in Step 11 in Box 2:

$$\Omega =\left\{{\tilde{C}}_1^m\mid \sum _{j\mid {\tilde{C}}_j=1}1<\left[{\omega }_{\exp }\left(1-{\left(1-\gamma \right)}^{s_{\max }}\right)-{\delta }_{\mathrm{est}}\right]\cdot m\right\}.$$ 23

The EAT channels are chosen to be

$${\mathcal{M}}_j:R_{j-1}\to R_j{\overrightarrow{A}}_j{\overrightarrow{B}}_j{\overrightarrow{X}}_j{\overrightarrow{Y}}_j{\tilde{C}}_j,$$ 24

where ${\mathcal{M}}_j$ describes Steps 2–10 of block j in the entropy accumulation protocol (Box 2). These channels include both the actions made by Alice and Bob as well as the operations made by the device D in these steps. Note that the Device’s operations can always be described within the formalism of quantum mechanics, although we do not assume we know them. The registers R_j−1 and R_j hold the quantum state of the device in the beginning and the end of the j’th step of the protocol, respectively.

Lemma 5: The channels ${\mathcal{M}}_j$ described above are EAT channels.

Proof. For the channels to be EAT channels, they need to fulfil the conditions given in Definition 1. We show that this is indeed the case. First, ${\tilde{C}}_j$ are classical registers with ${\tilde{C}}_j\in \left\{0,1,\perp \right\}$ and $d_{{\overrightarrow{A}}_j}\times d_{{\overrightarrow{B}}_j}\le 6^{s_{\max }}$. Second, ${\tilde{C}}_j$ is determined by the classical registers ${\overrightarrow{A}}_j,{\overrightarrow{B}}_j,{\overrightarrow{X}}_j,{\overrightarrow{Y}}_j,{\overrightarrow{T}}_j$ as shown in Box 2. Therefore, ${\tilde{C}}_j$ can be calculated without modifying the marginal on those registers. The third condition is also fulfilled since the inputs are chosen independently in each round and hence ${\overrightarrow{A}}_{1\dots j-1}{\overrightarrow{B}}_{1\dots j-1}\leftrightarrow {\overrightarrow{X}}_{1\dots j-1}{\overrightarrow{Y}}_{1\dots j-1}{\overrightarrow{T}}_{1\dots j-1}E\leftrightarrow {\overrightarrow{X}}_j{\overrightarrow{Y}}_j{\overrightarrow{T}}_j$ trivially holds.

To continue one should devise a min-tradeoff function. Let $\tilde{p}$ be the probability distribution describing ${\tilde{C}}_j$. We remark that due to the structure of our EAT channels, it is sufficient to consider ${\tilde{p}}_{}^{}$ for which $\tilde{p}\left(1\right)+\tilde{p}\left(0\right)=1-{\left(1-\gamma \right)}^{s_{\max }}$ (otherwise the set Σ defined in Eq. (6) is an empty set).

The following lemma gives a lower bound on the von Neumann entropy of the outputs in a single block.

Lemma 6: Let $\overline{s}=\frac{1-{\left(1-\gamma \right)}^{s_{\max }}}{\gamma }$ be the expected length of a block and h the binary entropy function. Then,

$$H\left({\overrightarrow{A}}_j{\overrightarrow{B}}_j\mid {\overrightarrow{X}}_j{\overrightarrow{Y}}_j{\overrightarrow{T}}_{j}R\prime \right)\ge \overline{s}\left[1-h\left(\frac{1}{2}+\frac{1}{2}\sqrt{16{\omega }^{*}\left({\omega }^{*}-1\right)+3}\right)\right],$$ 25

where the entropy is evaluated on a state that wins the CHSH game, in the test round, with probability

$${\omega }^{*}=\frac{\tilde{p}\left(1\right)}{1-{\left(1-\gamma \right)}^{s_{\max }}}.$$ 26

Proof sketch. The amount of entropy accumulated in a single round in a block is given in Eq. (2) in the main text. To get the amount of entropy accumulated in a block, one can use the chain rule for the von Neumann entropy. The result is then

$$\begin{array}{c}H\left({\overrightarrow{A}}_j{\overrightarrow{B}}_j\mid {\overrightarrow{X}}_j{\overrightarrow{Y}}_j{\overrightarrow{T}}_{j}R\prime \right)\hfill \\ \begin{array}{ccc}\hfill & \ge \hfill & \sum _{i\in \left[s_{\max }\right]}{\left(1-\gamma \right)}^{\left(i-1\right)}\left[1-h\left(\frac{1}{2}+\frac{1}{2}\sqrt{16{\omega }_i\left({\omega }_i-1\right)+3}\right)\right],\hfill \end{array}\hfill \end{array}$$ 27

where the pre-factors (1 − γ)⁽ⁱ⁻¹⁾ are attributed to the fact that the entropy in each round is non-zero only if the round is part of the block, i.e., if a test round was not performed before the i’th round in the block, and ω_i denotes the winning probability in the i’th round (given that a test was not performed before).

The value of each ω_i is not fixed completely given ω^*. However, by the operation of the EAT channels the following relation holds:

$${\omega }^{*}\left(1-{\left(1-\gamma \right)}^{s_{\max }}\right)=\sum _{i\in \left[s_{\max }\right]}\gamma {\left(1-\gamma \right)}^{\left(i-1\right)}{\omega }_i.$$ 28

To conclude the proof, we thus need to minimise $H\left({\overrightarrow{A}}_j{\overrightarrow{B}}_j\mid {\overrightarrow{X}}_j{\overrightarrow{Y}}_j{\overrightarrow{T}}_{j}R\prime \right)$ under the above constraint. Using standard techniques, e.g., Lagrange multipliers, one can see that the minimal value of this entropy is achieved for ω_i = ω^* for all i and the lemma follows.

The bound given in the above lemma can now be used to define the min-tradeoff function $f_{\min }\left(\tilde{p}\right)$. As the derivative of the function plays a role in the final bound, we must make sure it is not too large at any point. This can be enforced by “cutting” the function at a chosen point ${\tilde{p}}_t$ and “gluing” it to a linear function starting at that point, as shown in Fig. 6. ${\tilde{p}}_t$ can be chosen depending on the other parameters such that the total amount of smooth min-entropy is maximal. Following this idea, the resulting min-tradeoff function is given by

$$g\left(\tilde{p}\right)=\left\{\begin{array}{cc}\overline{s}\left[1-h\left(\frac{1}{2}+\frac{1}{2}\sqrt{16\frac{\tilde{p}\left(1\right)}{1-{\left(1-\gamma \right)}^{s_{\max }}}\left(\frac{\tilde{p}\left(1\right)}{1-{\left(1-\gamma \right)}^{s_{\max }}}-1\right)+3}\right)\right]\hfill & \frac{\tilde{p}\left(1\right)}{1-{\left(1-\gamma \right)}^{s_{\max }}}\in \left[0,\frac{2+\sqrt{2}}{4}\right]\hfill \\ \overline{s}\hfill & \frac{\tilde{p}\left(1\right)}{1-{\left(1-\gamma \right)}^{s_{\max }}}\in \left[\frac{2+\sqrt{2}}{4},1\right],\hfill \end{array}\right.$$ 29

$$f_{\min }\left(\tilde{p},{\tilde{p}}_t\right)=\left\{\begin{array}{cc}g\left(\tilde{p}\right)\hfill & \tilde{p}\left(1\right)\le {\tilde{p}}_t\left(1\right)\hfill \\ {\frac{\mathrm{d}}{\mathrm{d}\tilde{p}\left(1\right)}g\left(\tilde{p}\right)∣}_{{\tilde{p}}_t}\cdot \tilde{p}\left(1\right)+\left({g\left({\tilde{p}}_t\right)-\frac{\mathrm{d}}{\mathrm{d}\tilde{p}\left(1\right)}g\left(\tilde{p}\right)∣}_{{\tilde{p}}_t}\cdot {\tilde{p}}_t\left(1\right)\right)\hfill & \tilde{p}\left(1\right)>{\tilde{p}}_t\left(1\right).\hfill \end{array}\right.$$ 30

Let ε_EA be the desired error probability of the entropy accumulation protocol. We can then use Theorem 3 to say that either the probability of the protocol aborting is greater than 1 − ε_EA or the following bound on the total smooth min-entropy holds:

$$\begin{array}{ccc}{H}_{\min }^{{\epsilon }_{\mathrm{s}}}{\left(A_1^n{B}_1^n\mid X_1^n{Y}_1^n{T}_1^{n}E\right)}_{{\rho }_{\mid \mathrm{\Omega }}}\hfill & >\hfill & m\cdot {\eta }_{\mathrm{opt}}\left({\epsilon }_{\mathrm{s}},{\epsilon }_{\mathrm{EA}}\right)\hfill \\ \hfill & =\hfill & \frac{n}{\overline{s}}\cdot {\eta }_{\mathrm{opt}}\left({\epsilon }_{\mathrm{s}},{\epsilon }_{\mathrm{EA}}\right),\hfill \end{array}$$ 31

where

$$\begin{array}{ccc}\eta \left(\tilde{p},{\tilde{p}}_t,{\epsilon }_{\mathrm{s}},{\epsilon }_{\mathrm{e}}\right)\hfill & =\hfill & f_{\min }\left(\tilde{p},{\tilde{p}}_t\right)-\frac{1}{\sqrt{m}}2\left(\log \left(1+2\cdot 6^{s_{\max }}\right)\right.\hfill \\ \hfill & \hfill & \left.+{∥\frac{\mathrm{d}}{\mathrm{d}\tilde{p}\left(1\right)}g\left(\tilde{p}\right)∥}_{\infty }\right)\sqrt{1-2\log \left({\epsilon }_{\mathrm{s}}\cdot {\epsilon }_{\mathrm{e}}\right)},\hfill \\ {\eta }_{\mathrm{opt}}\left({\epsilon }_{\mathrm{s}},{\epsilon }_{\mathrm{e}}\right)\hfill & =\hfill & \underset{\frac{3}{4}<{\tilde{p}}_t\left(1\right)<\frac{2+\sqrt{2}}{4}}{\max }\eta \left({\omega }_{\exp }\left(1-{\left(1-\gamma \right)}^{s_{\max }}\right)-{\delta }_{\mathrm{est}},{\tilde{p}}_t,{\epsilon }_{\mathrm{s}},{\epsilon }_{\mathrm{e}}\right).\hfill \end{array}$$ 32

Fig. 6.

The construction of the min-tradeoff function f_min. The plot shows the values of the min-tradeoff function on a slice $\tilde{p}\left(0\right)+\tilde{p}\left(1\right)=1-{\left(1-\gamma \right)}^{s_{\max }}$

To illustrate the behaviour of the entropy rate η_opt, we plot it as a function of the expected Bell violation ω_exp in Fig. 7 for γ = 1 and s_max = 1. For comparison, we also plot in Fig. 7 the asymptotic rate (n → ∞) under the assumption that the state of the device is an (unknown) i.i.d. state. In this case, the quantum AEP appearing in Eq. (1) implies that the optimal rate is the von Neumann entropy accumulated in one round of the protocol (as given in Eq. (2)). This rate, appearing as the dashed line in Fig. 7, is an upper bound on the entropy that can be accumulated. One can see that as the number of rounds in the protocol increases, our rate η_opt approaches this optimal rate.

Fig. 7.

Entropy rate for entropy accumulation protocol. η_opt(ω_exp) for γ = 1, s_max = 1 and several choices of δ_est, n, ε_EA, and ε_s. We optimise the rates over all parameters which are not explicitly stated in the figure. The dashed line shows the optimal asymptotic (n → ∞) rate under the assumption that the devices are such that Alice, Bob, and Eve share an (unknown) i.i.d. state and n → ∞

For the calculations of the DIQKD rates later on, we choose $s_{\max }=⌈\frac{1}{\gamma }⌉$. For this choice, the first-order term of η_opt is linear in n and a short calculation reveals that the second-order term scales, roughly, as $\sqrt{n∕\gamma }$.

Our DIQKD protocol, shown in Box 3, is based on the entropy accumulation protocol described above. In the first part of the protocol Alice and Bob use their devices to produce the raw data, similarly to what is done in the entropy accumulation protocol. The main difference is that Bob’s outputs always contains his measurement outcomes (instead of being set to $\perp$ in the generation rounds); to make the distinction explicit, we denote Bob’s outputs in the DIQKD protocol with a tilde, ${\tilde{B}}_1^n$.

We now describe the three post-processing steps, error correction, parameter estimation, and privacy amplification, in more detail.

Box 2 Entropy accumulation protocol (based on the CHSH game)

Given:

 D—device that can play the CHSH game repeatedly

 $m\in {\mathbb{N}}_{+}$—number of blocks

 $s_{\mathrm{m}ax}\in {\mathbb{N}}_{+}$—maximal length of a block

 γ ∈ (0, 1]—probability of a test round

 ω_exp—expected winning probability in the honest implementation

 δ_est ∈ (0, 1)—width of the statistical confidence interval

1. For every block j ∈ [m] do Steps 2–10:

2.  Set i = 0 and ${\tilde{C}}_j=\perp$.

3.  If $i\le s_{\mathrm{m}ax}$:

4.   Set i = i + 1.

5.   Alice and Bob choose T_i ∈ {0, 1} at random such that $\mathrm{P}r\left(T_i=1\right)=\gamma$.

6.   If T_i = 1 Alice and Bob choose inputs X_i ∈ {0,1} and Y_i ∈ {0,1}.

7.   If T_i = 0 they choose inputs X_i ∈ {0, 1} and Y_i = 2.

8.   Alice and Bob use D with X_i,Y_i and record their outputs as A_i, B_i.

9.   If T_i = 0 Bob updates B_i to B_i = ⊥.

10.   If T_i = 1 they set ${\tilde{C}}_j=w\left(A_i,B_i,X_i,Y_i\right)$ and $i=s_{\mathrm{m}ax}+1$.

11. Alice and Bob abort if ${\sum }_{j\in \left[m\right]}{\tilde{C}}_j<\left[{\omega }_{\mathrm{e}xp}\left(1-{\left(1-\gamma \right)}^{s_{\mathrm{m}ax}}\right)-{\delta }_{\mathrm{e}st}\right]\cdot m$.

Box 3 DIQKD protocol (based on the CHSH game)

Given:

 D—device that can play the CHSH game repeatedly

 $m\in {\mathbb{N}}_{+}$—number of blocks

 $s_{\mathrm{m}ax}\in {\mathbb{N}}_{+}$—maximal length of a block

 γ ∈ (0, 1]—probability of a test round

 ω_exp—expected winning probability in the honest implementation

 δ_est ∈ (0, 1)—width of the statistical confidence interval

 EC—error correction protocol which leaks leak_EC bits and has error probability ε_EC

 PA—privacy amplification protocol with error probability ε_PA

1. For every block j ∈ [m] do Steps 2–8:

2.  Set i = 0 and ${\tilde{C}}_j=\perp$.

3.  If i ≤ s_max:

4.   Set i = i + 1.

5.   Alice and Bob choose T_i ∈ {0, 1} at random such that Pr(T_i = 1) = γ.

6.   If T_i = 1 Alice and Bob choose inputs X_i ∈ {0,1} and Y_i ∈ {0,1}.

7.   If T_i = 0 they choose inputs X_i ∈ {0, 1} and Y_i = 2.

8.   Alice and Bob use D with X_i, Y_i and record their outputs as A_i, ${\tilde{B}}_i$.

9. Error correction: Alice and Bob apply the error correction protocol EC on the outputs $A_1^n$ and ${\tilde{B}}_1^n$, communicating O in the process. If EC aborts they abort the protocol. Otherwise, they obtain raw keys denoted by K_A and K_B.

10. Parameter estimation: Using ${\tilde{B}}_1^n$ and K_B, Bob sets ${\tilde{C}}_j=w\left(A_i,B_i,X_i,Y_i\right)$ for the blocks with a test round at round i and ${\tilde{C}}_j=\perp$ otherwise. He aborts if ${\sum }_{j\in \left[m\right]}{\tilde{C}}_j<\left[{\omega }_{\mathrm{e}xp}\left(1-{\left(1-\gamma \right)}^{s_{\mathrm{m}ax}}\right)-{\delta }_{\mathrm{e}st}\right]\cdot m$.

11. Privacy amplification: Alice and Bob apply the privacy amplification protocol PA on K_A and K_B to create their final keys ${\tilde{K}}_{\mathrm{A}}$ and ${\tilde{K}}_{\mathrm{B}}$ of length $\ell$ as defined in Eq. (9).

Error correction

Alice and Bob use an error correction protocol EC to obtain identical raw keys K_A and K_B from their bits $A_1^n$, ${\tilde{B}}_1^n$. In our analysis, we use a protocol, based on universal hashing, which minimises the amount of leakage to the adversary^41,42. To implement this protocol, Alice chooses a hash function and sends the chosen function and the hashed value of her bits to Bob. We denote this classical communication by O. Bob uses O, together with his prior knowledge ${\tilde{B}}_1^n{X}_1^n{Y}_1^n{T}_1^n$, to compute a guess ${Â}_1^n$ for Alice’s bits $A_1^n$. If EC fails to produce a good guess, Alice and Bob abort; in an honest implementation, this happens with probability at most ${\epsilon }_{\mathrm{EC}}^c$. If Alice and Bob do not abort, then they hold raw keys $K_{\mathrm{A}}=A_1^n$ and $K_{\mathrm{B}}={Â}_1^n$ and K_A = K_B with probability at least 1 − ε_EC.

Due to the communication from Alice to Bob, leak_EC bits of information are leaked to the adversary. The following guarantee holds for the described protocol⁴²:

$${\mathrm{leak}}_{\mathrm{EC}}\le H_0^{\epsilon {\prime }_{\mathrm{EC}}}\left(A_1^n\mid {\tilde{B}}_1^n{X}_1^n{Y}_1^n{T}_1^n\right)+\log \left(\frac{1}{{\epsilon }_{\mathrm{EC}}}\right),$$ 33

for ${\epsilon }_{\mathrm{EC}}^c=\epsilon {\prime }_{\mathrm{EC}}+{\epsilon }_{\mathrm{EC}}$ and where $H_0^{\epsilon {\prime }_{\mathrm{EC}}}\left(A_1^n\mid {\tilde{B}}_1^n{X}_1^n{Y}_1^n{T}_1^n\right)$ is evaluated on the state in an honest implementation of the protocol. If a larger fraction of errors occur when running the actual DIQKD protocol (for instance due to adversarial interference) the error correction might not succeed, as Bob will not have a sufficient amount of information to obtain a good guess of Alice’s bits. If so, this will be detected with probability at least 1 − ε_EC and the protocol will abort. In an honest implementation of the device, Alice and Bob’s outputs in the generation rounds should be highly correlated in order to minimise the leakage of information.

Parameter estimation

After the error correction step, Bob has all of the relevant information to perform parameter estimation from his data alone, without any further communication with Alice. Using ${\tilde{B}}_1^n$ and K_B, Bob sets ${\tilde{C}}_j=w_{\mathrm{CHSH}}\left({Â}_i,{\tilde{B}}_i,X_i,Y_i\right)=w_{\mathrm{CHSH}}\left(K_{\mathrm{B}i},{\tilde{B}}_i,X_i,Y_i\right)$ for the blocks with a test round (which was done at round i of the block) and ${\tilde{C}}_j=\perp$ otherwise. He aborts if the fraction of successful test rounds is too low, that is, if ${\sum }_{j\in \left[m\right]}{\tilde{C}}_j<\left[{\omega }_{\exp }\left(1-{\left(1-\gamma \right)}^{s_{\max }}\right)-{\delta }_{\mathrm{est}}\right]\cdot m$.

As Bob does the estimation using his guess of Alice’s bits, the probability of aborting in this step in an honest implementation, ${\epsilon }_{\mathrm{PE}}^c$, is bounded by ${\epsilon }_{\mathrm{EA}}^c+{\epsilon }_{\mathrm{EC}}$.

Privacy amplification

Finally, Alice and Bob use a (quantum-proof) privacy amplification protocol PA (which takes some random seed S as input) to create their final keys ${\tilde{K}}_{\mathrm{A}}$ and ${\tilde{K}}_{\mathrm{B}}$ of length $\ell$, which are close to ideal keys, i.e., uniformly random and independent of the adversary’s knowledge.

For simplicity, we use universal hashing⁴³ as the privacy amplification protocol in the analysis below. Any other quantum-proof strong extractor, e.g., Trevisan’s extractor⁴⁴, can be used for this task and the analysis can be easily adapted.

The secrecy of the final key depends only on the privacy amplification protocol used and the value of $H_{\min }^{{\epsilon }_{\mathrm{s}}}\left(A_1^n\mid X_1^n{Y}_1^n{T}_1^{n}OE\right)$, evaluated on the state at the end of the protocol, conditioned on not aborting. For universal hashing, for every ε_PA,ε_s∈(0, 1), a secure key of maximal length

$$\ell =H_{\min }^{{\epsilon }_{\mathrm{s}}}\left(A_1^n\mid X_1^n{Y}_1^n{T}_1^{n}OE\right)-2\log \frac{1}{{\epsilon }_{\mathrm{PA}}}$$ 34

is produced with probability at least 1 − ε_PA − ε_s.

Correctness, secrecy, and overall security of a DIQKD protocol are defined as follows⁴⁵:

Definition 7 (Correctness): A DIQKD protocol is said to be ε_corr-correct, when implemented using a device D, if Alice and Bob’s keys, ${\tilde{K}}_{\mathrm{A}}$ and ${\tilde{K}}_{\mathrm{B}}$ respectively, are identical with probability at least 1 − ε_corr. That is, $\mathrm{Pr}\left({\tilde{K}}_{\mathrm{A}}\ne {\tilde{K}}_{\mathrm{B}}\right)\le {\epsilon }_{\mathrm{corr}}$.

Definition 8 (Secrecy): A DIQKD protocol is said to be ε_sec-secret, when implemented using a device D, if for a key of length l, $\left(1-\mathrm{Pr}\left[\mathrm{abort}\right]\right){∥{\rho }_{{\tilde{K}}_{\mathrm{A}}E}-{\rho }_{U_l}\otimes {\rho }_E∥}_1\le {\epsilon }_{\sec }$, where E is a quantum register that may initially be correlated with D.

ε_sec in the above definition can be understood as the probability that some non-trivial information leaks to the adversary⁴⁵. If a protocol is ε_corr-correct and ε_sec-secret (for a given D), then it is ${\epsilon }_{\mathrm{QKD}}^s$-correct-and-secret for any ${\epsilon }_{\mathrm{QKD}}^s\ge {\epsilon }_{\mathrm{corr}}+{\epsilon }_{\sec }$.

Definition 9 (Security): A DIQKD protocol is said to be $\left({\epsilon }_{\mathrm{QKD}}^s,{\epsilon }_{\mathrm{QKD}}^c,l\right)$-secure if:

1. (Soundness) For any implementation of the device D it is ${\epsilon }_{\mathrm{QKD}}^s$-correct-and-secret.

2. (Completeness) There exists an honest implementation of the device D such that the protocol does not abort with probability greater than $1-{\epsilon }_{\mathrm{QKD}}^c$.

Below we show that the following theorem holds.

Theorem 10: The DIQKD protocol described above is $\left({\epsilon }_{\mathrm{QKD}}^s,{\epsilon }_{\mathrm{QKD}}^c,\ell \right)$-secure, with ${\epsilon }_{\mathrm{QKD}}^s\le {\epsilon }_{\mathrm{EC}}+{\epsilon }_{\mathrm{PA}}+{\epsilon }_{\mathrm{s}}+{\epsilon }_{\mathrm{EA}}$, ${\epsilon }_{\mathrm{QKD}}^c\le {\epsilon }_{EC}^c+{\epsilon }_{\mathrm{EA}}^c+{\epsilon }_{\mathrm{EC}}$, and

$$\begin{array}{ccc}\ell \hfill & =\hfill & \frac{n}{\overline{s}}\cdot {\eta }_{\mathrm{opt}}\left({\epsilon }_{\mathrm{s}}∕4,{\epsilon }_{\mathrm{EA}}+{\epsilon }_{\mathrm{EC}}\right)\hfill \\ \hfill & \hfill & -{\mathrm{leak}}_{\mathrm{EC}}-3\log \left(1-\sqrt{1-{\left({\epsilon }_{\mathrm{s}}∕4\right)}^2}\right)-\gamma \left(n+t\right)\hfill \\ \hfill & \hfill & -\sqrt{n+t}2\log 7\sqrt{1-2\log \left(\left({\epsilon }_{\mathrm{s}}∕4-\sqrt{{\epsilon }_{\mathrm{t}}}\right)\cdot \left({\epsilon }_{\mathrm{EA}}+{\epsilon }_{\mathrm{EC}}\right)\right)}\hfill \\ \hfill & \hfill & -2\log \left({\epsilon }_{\mathrm{PA}}^{-1}\right),\hfill \end{array}$$ 35

where $t=\sqrt{-m{\left(1-\gamma \right)}^2\log {\epsilon }_{\mathrm{t}}\mathrm{∕}2{\gamma }^2}$ for any ε_t ∈ (0, 1).

We now explain the steps taken to prove Theorem 10. The completeness part follows trivially from the completeness of the “subprotocols”.

To establish soundness, first note that by definition, as long as the protocol does not abort it produces a key of length $\ell$. Therefore, it remains to verify correctness, which depends on the error correction step, and security, which is based on the privacy amplification step. To prove security we start with Lemma 11, in which we assume that the error correction step is successful. We then use it to prove soundness in Lemma 12.

Let $\tilde{\Omega }$ denote the event of the DIQKD protocol not aborting and the EC protocol being successful, and let ${\tilde{\rho }}_{A_1^n{\tilde{B}}_1^n{X}_1^n{Y}_1^n{T}_1^n{O}_1^{n}E\mid \tilde{\Omega }}$ be the state at the end of the protocol, conditioned on this event.

Success of the privacy amplification step relies on the min-entropy $H_{\min }^{{\epsilon }_{\mathrm{s}}}{\left(A_1^n\mid X_1^n{Y}_1^n{T}_1^{n}OE\right)}_{{\tilde{\rho }}_{\mid \tilde{\Omega }}}$ being sufficiently large. The following lemma connects this quantity to $H_{\min }^{\frac{{\epsilon }_{\mathrm{s}}}{4}}{\left(A_1^n{B}_1^n\mid X_1^n{Y}_1^n{T}_1^{n}E\right)}_{{\rho }_{\mid \Omega }}$, on which a lower bound is provided in Eq. (31) above.

Lemma 11: For any device D, let $\tilde{\rho }$ be the state generated in the protocol right before the privacy amplification step. Let ${\tilde{\rho }}_{\mid \tilde{\Omega }}$ be the state conditioned on not aborting the protocol and success of the EC protocol. Then, for any ε_EA, ε_EC, ε_s, ε_t ∈ (0, 1), either the protocol aborts with probability greater than 1 − ε_EA − ε_EC or

$$\begin{array}{ccc}{H}_{\min }^{{\epsilon }_{\mathrm{s}}}{\left(A_1^n\mid X_1^n{Y}_1^n{T}_1^{n}OE\right)}_{{\tilde{\rho }}_{\mid \tilde{\Omega }}}\hfill & \ge \hfill & \frac{n}{\overline{s}}\cdot {\eta }_{\mathrm{opt}}\left({\epsilon }_{\mathrm{s}}∕4,{\epsilon }_{\mathrm{EA}}+{\epsilon }_{\mathrm{EC}}\right)\hfill \\ \hfill & \hfill & -{\mathrm{leak}}_{\mathrm{EC}}-3\log \left(1-\sqrt{1-{\left({\epsilon }_{\mathrm{s}}∕4\right)}^2}\right)\hfill \\ \hfill & \hfill & -\gamma \left(n+t\right)\hfill \\ \hfill & \hfill & -\sqrt{n+t}2\log 7\sqrt{1-2\log \left(\left({\epsilon }_{\mathrm{s}}∕4-\sqrt{{\epsilon }_{\mathrm{t}}}\right)\cdot \left({\epsilon }_{\mathrm{EA}}+{\epsilon }_{\mathrm{EC}}\right)\right)}.\hfill \end{array}$$ 36

Proof sketch. Before deriving a bound on the entropy of interest, we remark that the t is chosen such that the probability that the actual number of rounds in the protocol, N, is larger than the expected number of rounds n plus t is ε_t. The above value for t can be derived by noticing that the sizes of the blocks are i.i.d. random variables which take values in [1, 1/γ].

The key idea of the proof is to consider the following events:

1. Ω: the event of not aborting in the entropy accumulation protocol. This happens when the Bell violation, calculated using Alice and Bob’s outputs (and inputs), is sufficiently high.

2. $\widehat{\Omega }$: Suppose Alice and Bob run the entropy accumulation protocol, and then execute the EC protocol. The event $\widehat{\Omega }$ is defined by Ω and $K_{\mathrm{B}}=A_1^n$.

3. $\tilde{\Omega }$: the event of not aborting the DIQKD protocol and $K_{\mathrm{B}}=A_1^n$.

The state ${\rho }_{\mid \widehat{\Omega }}$ then denotes the state at the end of the entropy accumulation protocol conditioned on $\widehat{\Omega }$.

Using a sequence of chain rules for smooth entropies⁴⁶ and the fact that ${\tilde{\rho }}_{A_1^n{X}_1^n{Y}_1^n{T}_1^{n}E\mid \tilde{\Omega }}={\rho }_{A_1^n{X}_1^n{Y}_1^n{T}_1^{n}E\mid \widehat{\Omega }}$ (${\tilde{B}}_1^n$ and $B_1^n$ were traced out from $\tilde{\rho }$ and ρ, respectively), one can conclude

$$\begin{array}{ccc}{H}_{min}^{{\epsilon }_{\mathrm{s}}}{\left(A_1^n\mid X_1^n{Y}_1^n{T}_1^{n}OE\right)}_{{\tilde{\rho }}_{\mid \tilde{\Omega }}}\hfill & \ge \hfill & H_{min}^{\frac{{\epsilon }_{\mathrm{s}}}{4}}{\left(A_1^n{B}_1^n\mid X_1^n{Y}_1^n{T}_1^{n}E\right)}_{{\rho }_{\mid \widehat{\Omega }}}\hfill \\ \hfill & \hfill & -H_{max}^{\frac{{\epsilon }_{\mathrm{s}}}{4}}{\left(B_1^n\mid T_1^{n}E\right)}_{{\rho }_{\mid \widehat{\Omega }}}-{\mathrm{leak}}_{\mathrm{EC}}\hfill \\ \hfill & \hfill & -3\log \left(1-\sqrt{1-{\left({\epsilon }_{\mathrm{s}}∕4\right)}^2}\right).\hfill \end{array}$$ 37

$H_{\max }^{\frac{{\epsilon }_{\mathrm{s}}}{4}}{\left(B_1^n\mid T_1^{n}E\right)}_{{\rho }_{\mid \widehat{\Omega }}}$ can be bounded from above. The intuition is that $B_i\ne \perp$ only when T_i = 0, which happens with probability γ. The exact bound can be calculated using the EAT and is given by

$$\begin{array}{ccc}{H}_{\max }^{\frac{{\epsilon }_{\mathrm{s}}}{4}}{\left(B_1^n\mid T_1^{n}E\right)}_{{\rho }_{\mid \widehat{\mathrm{\Omega }}}}\hfill & <\hfill & \gamma \left(n+t\right)\hfill \\ \hfill & \hfill & +\sqrt{n+t}2\log 7\sqrt{1-2\log \left(\left({\epsilon }_{\mathrm{s}}∕4-\sqrt{{\epsilon }_{\mathrm{t}}}\right)\cdot \left({\epsilon }_{\mathrm{EA}}+{\epsilon }_{\mathrm{EC}}\right)\right)}.\hfill \end{array}$$ 38

The above steps together with Eq. (31) conclude the proof.

Using Lemma 11, one can prove that our DIQKD protocol is sound.

Lemma 12: For any device D let $\tilde{\rho }$ be the state generated by the DIQKD protocol. Then either the protocol aborts with probability greater than 1 − ε_EA − ε_EC or it is (ε_EC + ε_PA + ε_s)-correct-and-secret while producing keys of length $\ell$, as defined in Eq. (35).

Proof sketch. Assume the DIQKD protocol did not abort. We consider two cases. First, assume that the EC protocol was not successful (but did not abort). Then Alice and Bob’s final keys might not be identical. This happens with probability at most ε_EC. Otherwise, assume the EC protocol was successful, i.e., $K_{\mathrm{B}}=A_1^n$. In that case, Alice and Bob’s keys must be identical also after the final privacy amplification step.

The secrecy depends only on the privacy amplification step, and for universal hashing a secure key is produced as long as Eq. (34) holds. Hence, a uniform and independent key of length $\ell$ as in Eq. (35) is produced by the privacy amplification step unless the smooth min-entropy is not high enough or the privacy amplification protocol was not successful, which happens with probability at most ε_PA + ε_s.

According to Lemma 11, either the protocol aborts with probability greater than 1 − ε_EA − ε_EC or the entropy is sufficiently high to create the secret key.

The expected key rates appearing in Fig. 5 in the main text are given by $r=\ell \mathrm{∕}n$. The key rate depends on the amount of leakage of information due to the error correction step, which in turn depends on the honest implementation of the protocol as mentioned above. To have an explicit bound, we consider the honest implementation described in the main text. Using Eq. (33) and the AEP, one can show that the amount of leakage in the error correction step is then given by

$$\begin{array}{ccc}{\mathrm{leak}}_{\mathrm{EC}}\hfill & \le \hfill & \left(n+t\right)\cdot \left[\left(1-\gamma \right)h\left(Q\right)+\gamma h\left({\omega }_{\exp }\right)\right]\hfill \\ \hfill & \hfill & +\sqrt{n+t}4\log \left(2\sqrt{2}+1\right)\sqrt{2\log \left(8∕{\left(\epsilon {\prime }_{\mathrm{EC}}-2\sqrt{{\epsilon }_{\mathrm{t}}}\right)}^2\right)}\hfill \\ \hfill & \hfill & +\log \left(8∕{\left(\epsilon {\prime }_{\mathrm{EC}}\right)}^2+2∕\left(2-\epsilon {\prime }_{\mathrm{EC}}\right)\right)+\log \left(\frac{1}{{\epsilon }_{\mathrm{EC}}}\right).\hfill \end{array}$$ 39

To get the optimal key rates, one should fix the parameters of interest (e.g., ${\epsilon }_{\mathrm{QKD}}^s$, ${\epsilon }_{\mathrm{QKD}}^c$, and n) and optimise over all other parameters.

DI randomness expansion

The entropy accumulation protocol can be used to perform DI randomness expansion as well. In a DI randomness expansion protocol, the honest parties start with a short seed of perfect randomness and use it to create a longer random secret string. For the purposes of randomness expansion, we may assume that the parties are co-located, therefore, the main difference from the DIQKD scheme is that there is no need for error correction (and hence there is no leakage of information due to public communication).

In order to minimise the amount of randomness required to execute the protocol, we adapt the main entropy accumulation protocol by deterministically choosing inputs in the generation rounds X_i,Y_i∈{0,1}. In particular, there is no use for the input 2 to Bob’s device, and no randomness is required for the generation rounds. Aside from the last step of privacy amplification, the remainder of the protocol is essentially the same as the entropy accumulation protocol.

The plotted entropy rates in Fig. 7 are therefore also the ones relevant for a DI randomness expansion.

Since we are concerned here not only with generating randomness but also with expanding the amount of randomness initially available to the users of the protocol, we should also evaluate the total number of random bits that are needed to execute the protocol. Random bits are required to select which rounds are generation rounds, i.e., the random variable $T_1^n$, to select inputs to the devices in the testing rounds, i.e., those for which T_i = 0, and to select the seed for the quantum proof extractor used for privacy amplification. All of these can be accounted for using standard techniques and so we omit the detailed explanation and formulas.

Data availability

No data sets were generated or analysed during the current study.

Author contributions

R.A.F., F.D., O.F., R.R., and T.V. contributed equally to this work.

Competing interests

The authors declare that they have no competing financial interests.