Device-independent quantum key distribution secure against collective attacks
Identifieur interne : 001A83 ( Istex/Corpus ); précédent : 001A82; suivant : 001A84Device-independent quantum key distribution secure against collective attacks
Auteurs : Stefano Pironio ; Antonio Acn ; Nicolas Brunner ; Nicolas Gisin ; Serge Massar ; Valerio ScaraniSource :
- New Journal of Physics [ 1367-2630 ] ; 2009.
Abstract
Device-independent quantum key distribution (DIQKD) represents a relaxation of the security assumptions made in usual quantum key distribution (QKD). As in usual QKD, the security of DIQKD follows from the laws of quantum physics, but contrary to usual QKD, it does not rely on any assumptions about the internal working of the quantum devices used in the protocol. In this paper, we present in detail the security proof for a DIQKD protocol introduced in Acn et al(2008Phys. Rev. Lett.98230501). This proof exploits the full structure of quantum theory (as opposed to other proofs that exploit only the no-signaling principle), but only holds against collective attacks, where the eavesdropper is assumed to act on the quantum systems of the honest parties independently and identically in each round of the protocol (although she can act coherently on her systems at any time). The security of any DIQKD protocol necessarily relies on the violation of a Bell inequality. We discuss the issue of loopholes in Bell experiments in this context.
Url:
DOI: 10.1088/1367-2630/11/4/045021
Links to Exploration step
ISTEX:3826DC738D18141428C804738D7E7ADBA9F46FC7Le document en format XML
<record><TEI wicri:istexFullTextTei="biblStruct"><teiHeader><fileDesc><titleStmt><title xml:lang="en">Device-independent quantum key distribution secure against collective attacks</title><author><name sortKey="Pironio, Stefano" sort="Pironio, Stefano" uniqKey="Pironio S" first="Stefano" last="Pironio">Stefano Pironio</name><affiliation><mods:affiliation>Group of Applied Physics, University of Geneva, 1211 Geneva 4, Switzerland</mods:affiliation></affiliation><affiliation><mods:affiliation>Author to whom any correspondence should be addressed.</mods:affiliation></affiliation><affiliation><mods:affiliation>E-mail: stefano.pironio@unige.ch</mods:affiliation></affiliation></author><author><name sortKey="Acn, Antonio" sort="Acn, Antonio" uniqKey="Acn A" first="Antonio" last="Acn">Antonio Acn</name><affiliation><mods:affiliation>ICFO-Institut de Ciencies Fotoniques, 08860 Castelldefels, Spain</mods:affiliation></affiliation><affiliation><mods:affiliation>ICREA-InstituciCatalana de Recerca i Estudis Avanats, Pg. Lluis Companys 23, 08010 Barcelona, Spain</mods:affiliation></affiliation></author><author><name sortKey="Brunner, Nicolas" sort="Brunner, Nicolas" uniqKey="Brunner N" first="Nicolas" last="Brunner">Nicolas Brunner</name><affiliation><mods:affiliation>H H Wills Physics Laboratory, University of Bristol, Tyndall Avenue, Bristol, BS8 1TL, UK</mods:affiliation></affiliation></author><author><name sortKey="Gisin, Nicolas" sort="Gisin, Nicolas" uniqKey="Gisin N" first="Nicolas" last="Gisin">Nicolas Gisin</name><affiliation><mods:affiliation>Group of Applied Physics, University of Geneva, 1211 Geneva 4, Switzerland</mods:affiliation></affiliation></author><author><name sortKey="Massar, Serge" sort="Massar, Serge" uniqKey="Massar S" first="Serge" last="Massar">Serge Massar</name><affiliation><mods:affiliation>Laboratoire d'Information Quantique, Universit Libre de Bruxelles, CP 225, Boulevard du Triomphe, B-1050 Bruxelles, Belgium</mods:affiliation></affiliation></author><author><name sortKey="Scarani, Valerio" sort="Scarani, Valerio" uniqKey="Scarani V" first="Valerio" last="Scarani">Valerio Scarani</name><affiliation><mods:affiliation>Centre for Quantum Technologies and Department of Physics, National University of Singapore, Singapore</mods:affiliation></affiliation></author></titleStmt><publicationStmt><idno type="wicri:source">ISTEX</idno><idno type="RBID">ISTEX:3826DC738D18141428C804738D7E7ADBA9F46FC7</idno><date when="2009" year="2009">2009</date><idno type="doi">10.1088/1367-2630/11/4/045021</idno><idno type="url">https://api.istex.fr/document/3826DC738D18141428C804738D7E7ADBA9F46FC7/fulltext/pdf</idno><idno type="wicri:Area/Istex/Corpus">001A83</idno></publicationStmt><sourceDesc><biblStruct><analytic><title level="a" type="main" xml:lang="en">Device-independent quantum key distribution secure against collective attacks</title><author><name sortKey="Pironio, Stefano" sort="Pironio, Stefano" uniqKey="Pironio S" first="Stefano" last="Pironio">Stefano Pironio</name><affiliation><mods:affiliation>Group of Applied Physics, University of Geneva, 1211 Geneva 4, Switzerland</mods:affiliation></affiliation><affiliation><mods:affiliation>Author to whom any correspondence should be addressed.</mods:affiliation></affiliation><affiliation><mods:affiliation>E-mail: stefano.pironio@unige.ch</mods:affiliation></affiliation></author><author><name sortKey="Acn, Antonio" sort="Acn, Antonio" uniqKey="Acn A" first="Antonio" last="Acn">Antonio Acn</name><affiliation><mods:affiliation>ICFO-Institut de Ciencies Fotoniques, 08860 Castelldefels, Spain</mods:affiliation></affiliation><affiliation><mods:affiliation>ICREA-InstituciCatalana de Recerca i Estudis Avanats, Pg. Lluis Companys 23, 08010 Barcelona, Spain</mods:affiliation></affiliation></author><author><name sortKey="Brunner, Nicolas" sort="Brunner, Nicolas" uniqKey="Brunner N" first="Nicolas" last="Brunner">Nicolas Brunner</name><affiliation><mods:affiliation>H H Wills Physics Laboratory, University of Bristol, Tyndall Avenue, Bristol, BS8 1TL, UK</mods:affiliation></affiliation></author><author><name sortKey="Gisin, Nicolas" sort="Gisin, Nicolas" uniqKey="Gisin N" first="Nicolas" last="Gisin">Nicolas Gisin</name><affiliation><mods:affiliation>Group of Applied Physics, University of Geneva, 1211 Geneva 4, Switzerland</mods:affiliation></affiliation></author><author><name sortKey="Massar, Serge" sort="Massar, Serge" uniqKey="Massar S" first="Serge" last="Massar">Serge Massar</name><affiliation><mods:affiliation>Laboratoire d'Information Quantique, Universit Libre de Bruxelles, CP 225, Boulevard du Triomphe, B-1050 Bruxelles, Belgium</mods:affiliation></affiliation></author><author><name sortKey="Scarani, Valerio" sort="Scarani, Valerio" uniqKey="Scarani V" first="Valerio" last="Scarani">Valerio Scarani</name><affiliation><mods:affiliation>Centre for Quantum Technologies and Department of Physics, National University of Singapore, Singapore</mods:affiliation></affiliation></author></analytic><monogr></monogr><series><title level="j">New Journal of Physics</title><title level="j" type="abbrev">New J. Phys.</title><idno type="ISSN">1367-2630</idno><idno type="eISSN">1367-2630</idno><imprint><publisher>IOP Publishing</publisher><date type="published" when="2009">2009</date><biblScope unit="volume">11</biblScope><biblScope unit="issue">4</biblScope><biblScope unit="page" from="1">1</biblScope><biblScope unit="page" to="25">25</biblScope></imprint><idno type="ISSN">1367-2630</idno></series><idno type="istex">3826DC738D18141428C804738D7E7ADBA9F46FC7</idno><idno type="DOI">10.1088/1367-2630/11/4/045021</idno><idno type="articleID">308932</idno><idno type="articleNumber">045021</idno></biblStruct></sourceDesc><seriesStmt><idno type="ISSN">1367-2630</idno></seriesStmt></fileDesc><profileDesc><textClass></textClass><langUsage><language ident="en">en</language></langUsage></profileDesc></teiHeader><front><div type="abstract">Device-independent quantum key distribution (DIQKD) represents a relaxation of the security assumptions made in usual quantum key distribution (QKD). As in usual QKD, the security of DIQKD follows from the laws of quantum physics, but contrary to usual QKD, it does not rely on any assumptions about the internal working of the quantum devices used in the protocol. In this paper, we present in detail the security proof for a DIQKD protocol introduced in Acn et al(2008Phys. Rev. Lett.98230501). This proof exploits the full structure of quantum theory (as opposed to other proofs that exploit only the no-signaling principle), but only holds against collective attacks, where the eavesdropper is assumed to act on the quantum systems of the honest parties independently and identically in each round of the protocol (although she can act coherently on her systems at any time). The security of any DIQKD protocol necessarily relies on the violation of a Bell inequality. We discuss the issue of loopholes in Bell experiments in this context.</div></front></TEI><istex><corpusName>iop</corpusName><author><json:item><name>Stefano Pironio</name><affiliations><json:string>Group of Applied Physics, University of Geneva, 1211 Geneva 4, Switzerland</json:string><json:string>Author to whom any correspondence should be addressed.</json:string><json:string>E-mail: stefano.pironio@unige.ch</json:string></affiliations></json:item><json:item><name>Antonio Acn</name><affiliations><json:string>ICFO-Institut de Ciencies Fotoniques, 08860 Castelldefels, Spain</json:string><json:string>ICREA-InstituciCatalana de Recerca i Estudis Avanats, Pg. Lluis Companys 23, 08010 Barcelona, Spain</json:string></affiliations></json:item><json:item><name>Nicolas Brunner</name><affiliations><json:string>H H Wills Physics Laboratory, University of Bristol, Tyndall Avenue, Bristol, BS8 1TL, UK</json:string></affiliations></json:item><json:item><name>Nicolas Gisin</name><affiliations><json:string>Group of Applied Physics, University of Geneva, 1211 Geneva 4, Switzerland</json:string></affiliations></json:item><json:item><name>Serge Massar</name><affiliations><json:string>Laboratoire d'Information Quantique, Universit Libre de Bruxelles, CP 225, Boulevard du Triomphe, B-1050 Bruxelles, Belgium</json:string></affiliations></json:item><json:item><name>Valerio Scarani</name><affiliations><json:string>Centre for Quantum Technologies and Department of Physics, National University of Singapore, Singapore</json:string></affiliations></json:item></author><language><json:string>eng</json:string></language><originalGenre><json:string>paper</json:string></originalGenre><abstract>Device-independent quantum key distribution (DIQKD) represents a relaxation of the security assumptions made in usual quantum key distribution (QKD). As in usual QKD, the security of DIQKD follows from the laws of quantum physics, but contrary to usual QKD, it does not rely on any assumptions about the internal working of the quantum devices used in the protocol. In this paper, we present in detail the security proof for a DIQKD protocol introduced in Acn et al(2008Phys. Rev. Lett.98230501). This proof exploits the full structure of quantum theory (as opposed to other proofs that exploit only the no-signaling principle), but only holds against collective attacks, where the eavesdropper is assumed to act on the quantum systems of the honest parties independently and identically in each round of the protocol (although she can act coherently on her systems at any time). The security of any DIQKD protocol necessarily relies on the violation of a Bell inequality. We discuss the issue of loopholes in Bell experiments in this context.</abstract><qualityIndicators><score>7.504</score><pdfVersion>1.4</pdfVersion><pdfPageSize>595.276 x 841.89 pts (A4)</pdfPageSize><refBibsNative>true</refBibsNative><keywordCount>0</keywordCount><abstractCharCount>1043</abstractCharCount><pdfWordCount>12347</pdfWordCount><pdfCharCount>60235</pdfCharCount><pdfPageCount>25</pdfPageCount><abstractWordCount>167</abstractWordCount></qualityIndicators><title>Device-independent quantum key distribution secure against collective attacks</title><genre><json:string>research-article</json:string></genre><host><volume>11</volume><publisherId><json:string>nj</json:string></publisherId><pages><total>25</total><last>25</last><first>1</first></pages><issn><json:string>1367-2630</json:string></issn><issue>4</issue><genre><json:string>journal</json:string></genre><language><json:string>unknown</json:string></language><eissn><json:string>1367-2630</json:string></eissn><title>New Journal of Physics</title></host><publicationDate>2009</publicationDate><copyrightDate>2009</copyrightDate><doi><json:string>10.1088/1367-2630/11/4/045021</json:string></doi><id>3826DC738D18141428C804738D7E7ADBA9F46FC7</id><score>0.2073244</score><fulltext><json:item><original>true</original><mimetype>application/pdf</mimetype><extension>pdf</extension><uri>https://api.istex.fr/document/3826DC738D18141428C804738D7E7ADBA9F46FC7/fulltext/pdf</uri></json:item><json:item><original>false</original><mimetype>application/zip</mimetype><extension>zip</extension><uri>https://api.istex.fr/document/3826DC738D18141428C804738D7E7ADBA9F46FC7/fulltext/zip</uri></json:item><istex:fulltextTEI uri="https://api.istex.fr/document/3826DC738D18141428C804738D7E7ADBA9F46FC7/fulltext/tei"><teiHeader><fileDesc><titleStmt><title level="a" type="main" xml:lang="en">Device-independent quantum key distribution secure against collective attacks</title></titleStmt><publicationStmt><authority>ISTEX</authority><publisher>IOP Publishing</publisher><availability><p>IOP Publishing and Deutsche Physikalische Gesellschaft</p></availability><date>2009</date></publicationStmt><sourceDesc><biblStruct type="inbook"><analytic><title level="a" type="main" xml:lang="en">Device-independent quantum key distribution secure against collective attacks</title><author xml:id="author-1"><persName><forename type="first">Stefano</forename><surname>Pironio</surname></persName><email>stefano.pironio@unige.ch</email><affiliation>Group of Applied Physics, University of Geneva, 1211 Geneva 4, Switzerland</affiliation><affiliation>Author to whom any correspondence should be addressed.</affiliation></author><author xml:id="author-2"><persName><forename type="first">Antonio</forename><surname>Acn</surname></persName><affiliation>ICFO-Institut de Ciencies Fotoniques, 08860 Castelldefels, Spain</affiliation><affiliation>ICREA-InstituciCatalana de Recerca i Estudis Avanats, Pg. Lluis Companys 23, 08010 Barcelona, Spain</affiliation></author><author xml:id="author-3"><persName><forename type="first">Nicolas</forename><surname>Brunner</surname></persName><affiliation>H H Wills Physics Laboratory, University of Bristol, Tyndall Avenue, Bristol, BS8 1TL, UK</affiliation></author><author xml:id="author-4"><persName><forename type="first">Nicolas</forename><surname>Gisin</surname></persName><affiliation>Group of Applied Physics, University of Geneva, 1211 Geneva 4, Switzerland</affiliation></author><author xml:id="author-5"><persName><forename type="first">Serge</forename><surname>Massar</surname></persName><affiliation>Laboratoire d'Information Quantique, Universit Libre de Bruxelles, CP 225, Boulevard du Triomphe, B-1050 Bruxelles, Belgium</affiliation></author><author xml:id="author-6"><persName><forename type="first">Valerio</forename><surname>Scarani</surname></persName><affiliation>Centre for Quantum Technologies and Department of Physics, National University of Singapore, Singapore</affiliation></author></analytic><monogr><title level="j">New Journal of Physics</title><title level="j" type="abbrev">New J. Phys.</title><idno type="pISSN">1367-2630</idno><idno type="eISSN">1367-2630</idno><imprint><publisher>IOP Publishing</publisher><date type="published" when="2009"></date><biblScope unit="volume">11</biblScope><biblScope unit="issue">4</biblScope><biblScope unit="page" from="1">1</biblScope><biblScope unit="page" to="25">25</biblScope></imprint></monogr><idno type="istex">3826DC738D18141428C804738D7E7ADBA9F46FC7</idno><idno type="DOI">10.1088/1367-2630/11/4/045021</idno><idno type="articleID">308932</idno><idno type="articleNumber">045021</idno></biblStruct></sourceDesc></fileDesc><profileDesc><creation><date>2009</date></creation><langUsage><language ident="en">en</language></langUsage><abstract><p>Device-independent quantum key distribution (DIQKD) represents a relaxation of the security assumptions made in usual quantum key distribution (QKD). As in usual QKD, the security of DIQKD follows from the laws of quantum physics, but contrary to usual QKD, it does not rely on any assumptions about the internal working of the quantum devices used in the protocol. In this paper, we present in detail the security proof for a DIQKD protocol introduced in Acn et al(2008Phys. Rev. Lett.98230501). This proof exploits the full structure of quantum theory (as opposed to other proofs that exploit only the no-signaling principle), but only holds against collective attacks, where the eavesdropper is assumed to act on the quantum systems of the honest parties independently and identically in each round of the protocol (although she can act coherently on her systems at any time). The security of any DIQKD protocol necessarily relies on the violation of a Bell inequality. We discuss the issue of loopholes in Bell experiments in this context.</p></abstract></profileDesc><revisionDesc><change when="2009">Published</change></revisionDesc></teiHeader></istex:fulltextTEI><json:item><original>false</original><mimetype>text/plain</mimetype><extension>txt</extension><uri>https://api.istex.fr/document/3826DC738D18141428C804738D7E7ADBA9F46FC7/fulltext/txt</uri></json:item></fulltext><metadata><istex:metadataXml wicri:clean="corpus iop not found" wicri:toSee="no header"><istex:xmlDeclaration>version="1.0" encoding="ISO-8859-1"</istex:xmlDeclaration><istex:docType SYSTEM="http://ej.iop.org/dtd/iopv1_5_2.dtd" name="istex:docType"></istex:docType><istex:document><article artid="nj308932"><article-metadata><jnl-data jnlid="nj"><jnl-fullname>New Journal of Physics</jnl-fullname><jnl-abbreviation>New J. Phys.</jnl-abbreviation><jnl-shortname>NJP</jnl-shortname><jnl-issn>1367-2630</jnl-issn><jnl-coden>NJOPFM</jnl-coden><jnl-imprint>IOP Publishing</jnl-imprint><jnl-web-address>stacks.iop.org/NJP</jnl-web-address></jnl-data><volume-data><year-publication>2009</year-publication><volume-number>11</volume-number></volume-data><issue-data><issue-number>4</issue-number><coverdate>April 2009</coverdate></issue-data><article-data><article-type type="paper" sort="regular"></article-type><type-number type="paper" numbering="article" artnum="045021">045021</type-number><article-number>308932</article-number><first-page>1</first-page><last-page>25</last-page><length>25</length><pii></pii><doi>10.1088/1367-2630/11/4/045021</doi><copyright>IOP Publishing and Deutsche Physikalische Gesellschaft</copyright><ccc>1367-2630/09/045021+25$30.00</ccc><printed></printed></article-data></article-metadata><header><title-group><title>Device-independent quantum key distribution secure against collective attacks</title><short-title>Device-independent quantum key distribution secure against collective attacks</short-title><ej-title>Device-independent quantum key distribution secure against collective attacks</ej-title></title-group><author-group><author address="nj308932ad1" alt-address="nj308932aad7" email="nj308932ea1"><first-names>Stefano</first-names><second-name>Pironio</second-name></author><author address="nj308932ad2" second-address="nj308932ad3"><first-names>Antonio</first-names><second-name>Acín</second-name></author><author address="nj308932ad4"><first-names>Nicolas</first-names><second-name>Brunner</second-name></author><author address="nj308932ad1"><first-names>Nicolas</first-names><second-name>Gisin</second-name></author><author address="nj308932ad5"><first-names>Serge</first-names><second-name>Massar</second-name></author><author address="nj308932ad6"><first-names>Valerio</first-names><second-name>Scarani</second-name></author><short-author-list>Stefano Pironio <italic>et al</italic></short-author-list></author-group><address-group><address id="nj308932ad1" showid="yes">Group of Applied Physics, <orgname>University of Geneva</orgname>, 1211 Geneva 4, <country>Switzerland</country></address><address id="nj308932ad2" showid="yes"><orgname>ICFO-Institut de Ciencies Fotoniques</orgname>, 08860 Castelldefels, <country>Spain</country></address><address id="nj308932ad3" showid="yes"><orgname>ICREA-Institució Catalana de Recerca i Estudis Avançats</orgname>, Pg. Lluis Companys 23, 08010 Barcelona, <country>Spain</country></address><address id="nj308932ad4" showid="yes">H H Wills Physics Laboratory, <orgname>University of Bristol</orgname>, Tyndall Avenue, Bristol, BS8 1TL, <country>UK</country></address><address id="nj308932ad5" showid="yes">Laboratoire d'Information Quantique, <orgname>Université Libre de Bruxelles</orgname>, CP 225, Boulevard du Triomphe, B-1050 Bruxelles, <country>Belgium</country></address><address id="nj308932ad6" showid="yes">Centre for Quantum Technologies and Department of Physics, <orgname>National University of Singapore</orgname>, <country>Singapore</country></address><address id="nj308932aad7" alt="yes" showid="yes">Author to whom any correspondence should be addressed.</address><e-address id="nj308932ea1"><email mailto="stefano.pironio@unige.ch">stefano.pironio@unige.ch</email></e-address></address-group><history received="10 February 2009" online="30 April 2009"></history><abstract-group><abstract><heading>Abstract</heading><p indent="no">Device-independent quantum key distribution (DIQKD) represents a relaxation of the security assumptions made in usual quantum key distribution (QKD). As in usual QKD, the security of DIQKD follows from the laws of quantum physics, but contrary to usual QKD, it does not rely on any assumptions about the internal working of the quantum devices used in the protocol. In this paper, we present in detail the security proof for a DIQKD protocol introduced in Acín <italic>et al</italic> (2008 <italic>Phys. Rev. Lett.</italic> <bold>98</bold> 230501). This proof exploits the full structure of quantum theory (as opposed to other proofs that exploit only the no-signaling principle), but only holds against collective attacks, where the eavesdropper is assumed to act on the quantum systems of the honest parties independently and identically in each round of the protocol (although she can act coherently on her systems at any time). The security of any DIQKD protocol necessarily relies on the violation of a Bell inequality. We discuss the issue of loopholes in Bell experiments in this context.</p></abstract></abstract-group></header><body refstyle="numeric"><sec-level1 id="nj308932s1" label="1"><heading>Introduction</heading><p indent="no">Device-independent quantum key distribution (DIQKD) protocols aim at generating a secret key between two parties in a provably secure way without making assumptions about the internal working of the quantum devices used in the protocol. In DIQKD, the quantum apparatuses are seen as black boxes that produce classical outputs, possibly depending on the value of some classical inputs (see figure <figref linkend="nj308932fig1">1</figref>). These apparatuses are thought to implement a quantum process, but no hypotheses in terms of Hilbert space, operators or states are made on the actual quantum process that generates the outputs given the inputs.</p><figure id="nj308932fig1" parts="single" width="column" position="float" pageposition="top" printstyle="normal" orientation="port"><graphic position="indented"><graphic-file version="print" format="EPS" width="21.9pc" printcolour="no" filename="images/nj308932fig1.eps"></graphic-file><graphic-file version="ej" format="JPEG" printcolour="no" filename="images/nj308932fig1.jpg"></graphic-file></graphic><caption type="figure" id="nj308932fc1" label="Figure 1"><p indent="no">Schematic representation of the DIQKD scenario. Alice and Bob see their quantum devices as black boxes producing classical outputs, <inline-eqn><math-text><italic>a</italic></math-text></inline-eqn> and <inline-eqn><math-text><italic>b</italic></math-text></inline-eqn>, as a function of classical inputs <inline-eqn><math-text><italic>X</italic></math-text></inline-eqn> and <inline-eqn><math-text><italic>Y</italic></math-text></inline-eqn>. From the observed statistics, and without making any assumption on the internal working of the devices, they should be able to conclude whether they can establish a secret key secure against a quantum eavesdropper.</p></caption></figure><p>DIQKD can be better understood by contrasting it with usual quantum key distribution (QKD). In its entanglement-based version [<cite linkend="nj308932bib1">1</cite>], traditional QKD involves two parties, Alice and Bob, who receive entangled particles emitted from a common source and who measure each of them in some chosen bases. The measurement outcomes are kept secret and form the raw key. As the source of particles is situated between Alice's and Bob's secure locations, it is not trusted by the parties, but is assumed to be under the control of an eavesdropper Eve. The eavesdropper could for instance have replaced the original source by one that produces states that give her useful information about Alice's and Bob's measurement outcomes. However, by performing measurements in well-chosen bases on a random subset of their particles and by comparing their results, Alice and Bob can estimate the quantum states that they receive from the eavesdropper and decide whether a secret key can be extracted from them.</p><p>In a device-independent analysis of this scenario, Alice and Bob would not only distrust the source of particles, but they would also distrust their measuring apparatuses. The measurement directions may for instance drift with time due to imperfections in the apparatuses, or the entire apparatuses may be untrusted because they have been fabricated by a malicious party. Alice and Bob have therefore no guarantee that the actual measurement bases correspond to the expected ones. In fact they cannot even make assumptions about the dimension of the Hilbert space in which they are defined. In DIQKD, Alice and Bob have thus to bound Eve's information by looking for the worst combination of states and measurements (in Hilbert spaces of arbitrary dimension) that are compatible with the observed classical input–output relations. In contrast, in usual QKD, Alice and Bob have a perfect knowledge of the measurements that are carried out and of the Hilbert space dimension of the quantum state they measure, and they exploit this information to bound the eavesdropper's information when they look for the worst possible states compatible with their observed data.</p><sec-level2 id="nj308932s1.1" label="1.1"><heading>Why DIQKD?</heading><p indent="no">DIQKD represents a relaxation of the security assumptions made in usual QKD. In this sense, it fits in the continuity of a series of works that aim to design cryptographic protocols secure against more and more powerful eavesdroppers.</p><p>From a fundamental point of view, DIQKD shows that the security of a cryptographic scheme is possible based on a minimal set of fundamental assumptions. It only requires that:</p><itemized-list id="list1" type="bullet" style="hanging"><list-item id="list1-i1"><p>Alice's and Bob's physical locations are secure, i.e. no unwanted information can leak to the outside;</p></list-item><list-item id="list1-i2"><p>they have a trusted random number generator, possibly quantum, producing a classical random output;</p></list-item><list-item id="list1-i3"><p>they have trusted classical devices (e.g. memories and computing devices) to store and process the classical data generated by their quantum apparatuses;</p></list-item><list-item id="list1-i4"><p>they share an authenticated, but otherwise public, classical channel (this hypothesis can be ensured if Alice and Bob start off with a small shared secret key);</p></list-item><list-item id="list1-i5"><p>quantum physics is correct.</p></list-item></itemized-list><p indent="no">Other than these prerequisites, shared by all QKD protocols, no others are necessary. In addition to these essential requirements, usual QKD protocols assume that Alice and Bob have some knowledge of their quantum devices.</p><p>From a practical point of view, DIQKD resolves some of the drawbacks of usual QKD. Usual security proofs of QKD make several assumptions about the quantum systems, such as their Hilbert space dimension. These assumptions are often critical: as we show below, the security of the BB84 protocol, for instance, is entirely compromised if Alice and Bob share four-dimensional systems instead of sharing qubits as usually assumed. The problem is that real-life implementation of QKD protocols may differ from the ideal design. For instance, the quantum apparatuses may be noisy or there may be uncontrolled side channels. A possible, but challenging, way of addressing these problems would be to characterize very precisely the quantum devices and try to adapt the security proof to the actual implementation of the protocol. The concept of device-independent QKD, on the other hand, applies through its remarkable generality in a simple way to these situations, as it allows us to ignore all implementation details.</p><p>DIQKD also makes it easier to test the components of a QKD protocol. Since its security relies on the observed classical data generated by the devices, errors or deterioration with time of the internal working of the quantum devices, which could be exploited by an eavesdropper, are easily monitored and accounted for in the key rate.</p><p>A third practical motivation for DIQKD is that it covers the adverse scenario where the quantum devices are not trusted. For instance, someone who had access to the quantum apparatuses at some time might have hacked or modified their mechanism. But if the devices still produce proper classical input–output relations, which is all that is required, this is irrelevant to the security of the scheme. To some extent, DIQKD overturns the adage that the security of a cryptographic system is only as good as its physical security. Of course an eavesdropper who had access to the quantum devices might have modified their working so that they directly send her information about the measurement settings and outcomes. But this goes against the basic requirement that Alice's and Bob's locations should be completely secure against Eve's scrutiny—a necessary requirement for cryptography to have any meaning. It is modulo this assumption that the eavesdropper is free to tamper with their devices.</p></sec-level2><sec-level2 id="nj308932s1.2" label="1.2"><heading>Usual QKD protocols are not secure in the device-independent scenario</heading><p indent="no">A consequence of adopting a more general security model is that traditional QKD protocols may no longer be secure, as illustrated by the following example.</p><p>Consider the entanglement-based version of BB84 [<cite linkend="nj308932bib2">2</cite>]. Alice has a measuring device that takes a classical input <inline-eqn><math-text><italic>X</italic>∈{0, 1}</math-text></inline-eqn> (her choice of measurement setting) and that produces an output <inline-eqn><math-text><italic>a</italic>∈{0, 1}</math-text></inline-eqn> (the measurement outcome). Similarly, Bob's device accepts inputs <inline-eqn><math-text><italic>Y</italic>∈{0, 1}</math-text></inline-eqn> and produces outputs <inline-eqn><math-text><italic>b</italic>∈{0, 1}</math-text></inline-eqn>. Both measuring devices act on a two-dimensional subspace of the incoming particles (e.g. the polarization of a photon). The setting ‘0’ is associated with the measurement of <inline-eqn><math-text>σ<sub><italic>x</italic></sub></math-text></inline-eqn>, while the setting ‘1’ corresponds to <inline-eqn><math-text>σ<sub><italic>z</italic></sub></math-text></inline-eqn>. Suppose that in an ideal, noise-free situation they observe the following correlations:
<display-eqn id="nj308932eqn1" textype="equation" notation="LaTeX" eqnnum="1" lines="multiline"></display-eqn>where <inline-eqn><math-text><italic>P</italic>(<italic>ab</italic>|<italic>XY</italic>)</math-text></inline-eqn> is the probability of observing the pair of outcomes <inline-eqn><math-text><italic>a</italic>, <italic>b</italic></math-text></inline-eqn> given that they have made measurements <inline-eqn><math-text><italic>X</italic>, <italic>Y</italic></math-text></inline-eqn>. That is, if Alice and Bob perform measurements in the same bases, they always get perfectly correlated outcomes; while if they measure in different bases, they get completely uncorrelated random outcomes. In terms of the measurement operators <inline-eqn><math-text>σ<sub><italic>x</italic></sub></math-text></inline-eqn> and <inline-eqn><math-text>σ<sub><italic>z</italic></sub></math-text></inline-eqn> and the two-qubit state <inline-eqn></inline-eqn> that characterizes their incoming particles, the above correlations can be rewritten as
<display-eqn id="nj308932eqn2" textype="equation" notation="LaTeX" eqnnum="2" lines="multiline"></display-eqn>The only state compatible with this set of equations is the maximally entangled state <inline-eqn></inline-eqn>. Alice and Bob therefore rightly conclude that they can safely extract a secret key from their measurement data.</p><p>In the device-independent scenario, however, Alice and Bob can no longer assume that the measurement settings ‘0’ and ‘1’ correspond to the operators <inline-eqn><math-text>σ<sub><italic>x</italic></sub></math-text></inline-eqn> and <inline-eqn><math-text>σ<sub><italic>z</italic></sub></math-text></inline-eqn>, nor that they act on the two-qubit space <inline-eqn></inline-eqn>. It is then not difficult to find separable (hence insecure) states that reproduce the measurement data (<eqnref linkend="nj308932eqn1">1</eqnref>) for an appropriate choice of measurements [<cite linkend="nj308932bib3">3</cite>, <cite linkend="nj308932bib4">4</cite>]. An example is given by the <inline-eqn></inline-eqn> state
<display-eqn id="nj308932eqn3" textype="equation" notation="LaTeX" eqnnum="3"></display-eqn>where the vectors <inline-eqn><math-text>|0⟩</math-text></inline-eqn> and <inline-eqn><math-text>|1⟩</math-text></inline-eqn> define the <inline-eqn><math-text><italic>z</italic></math-text></inline-eqn> basis, and by the measurements <inline-eqn><math-text>σ<sub><italic>z</italic></sub>⊗<italic>I</italic></math-text></inline-eqn> for the setting ‘0’ and <inline-eqn><math-text><italic>I</italic>⊗σ<sub><italic>z</italic></sub></math-text></inline-eqn> for the setting ‘1’. Clearly this combination of state and measurements reproduces the correlations (<eqnref linkend="nj308932eqn1">1</eqnref>): Alice and Bob find completely correlated outcomes when they use the same measurement settings, and completely uncorrelated ones otherwise. In contrast to the previous situation, however, Eve can now have a perfect copy of the local states of Alice and Bob, for instance if they share the tripartite state
<display-eqn id="nj308932eqn4" textype="equation" notation="LaTeX" eqnnum="4"></display-eqn>This example illustrates the fact that in the usual security analysis of BB84, it is crucial to assume that Alice's and Bob's measurements act on a two-dimensional space, a condition difficult to check experimentally. If we relax this assumption, the security is no longer guaranteed.</p></sec-level2><sec-level2 id="nj308932s1.3" label="1.3"><heading>How can DIQKD possibly be secure?</heading><p indent="no">A better understanding of why usual QKD protocols are not secure in the device-independent scenario may help us identify the physical principles on which to base the security of a device-independent scheme. A first observation is that the correlations (<eqnref linkend="nj308932eqn1">1</eqnref>) produced in BB84 are classical: we do not need to invoke quantum physics at all to reproduce them. They can simply be generated by a set of classical random data shared by Alice's and Bob's systems—in essence, this is what the separable state (<eqnref linkend="nj308932eqn2">2</eqnref>) achieves. Formally, they can be written in the form
<display-eqn id="nj308932eqn5" textype="equation" notation="LaTeX" eqnnum="5"></display-eqn>where <inline-eqn><math-text>λ</math-text></inline-eqn> is a classical variable with probability distribution <inline-eqn><math-text><italic>P</italic>(λ)</math-text></inline-eqn> shared by Alice's and Bob's devices and <inline-eqn><math-text><italic>D</italic>(<italic>a</italic>|<italic>X</italic>, λ)</math-text></inline-eqn> is a function that completely specifies Alice's outputs once the input <inline-eqn><math-text><italic>X</italic></math-text></inline-eqn> and <inline-eqn><math-text>λ</math-text></inline-eqn> are given (and similarly for <inline-eqn><math-text><italic>D</italic>(<italic>b</italic>|<italic>Y</italic>, λ)</math-text></inline-eqn>). An eavesdropper might of course have a copy of <inline-eqn><math-text>λ</math-text></inline-eqn>, which would give her full information about Alice's and Bob's outputs once the inputs are announced.</p><p>This trivial strategy is not available to the eavesdropper, however, if the outputs of Alice's and Bob's apparatuses are correlated in a non-local way, in the sense that they violate a Bell inequality [<cite linkend="nj308932bib5">5</cite>]. Indeed, non-local correlations are defined precisely as those that cannot be written in the form (<eqnref linkend="nj308932eqn5">5</eqnref>). The violation of a Bell inequality is thus a necessary requirement for the security of a QKD protocol in the device-independent scenario. This condition is clearly not satisfied by BB84.</p><p>More than a necessary condition for security, non-locality is the physical principle on which all device-independent security proofs are based. This follows from the fact that non-local correlations require for their generation entangled states, whose measurement statistics cannot be known completely to an eavesdropper. To put it another way, Bell inequalities are the only entanglement witnesses that are device independent, in the sense that they do not depend on the physical details underlying Alice's and Bob's apparatuses.</p></sec-level2><sec-level2 id="nj308932s1.4" label="1.4"><heading>Earlier works and relation to QKD against no-signaling eavesdroppers</heading><p indent="no">The intuition that the security of a QKD scheme could be based on the violation of a Bell inequality was at the origin of Ekert's 1991 celebrated proposal [<cite linkend="nj308932bib6">6</cite>]. The crucial role that non-local correlations play in a device-independent scenario was also implicitly recognized by Mayers and Yao [<cite linkend="nj308932bib7">7</cite>]. Quantitative progress, however, has been possible only recently thanks to the pioneering work of Barrett <italic>et al</italic> [<cite linkend="nj308932bib8">8</cite>]. Barrett <italic>et al</italic> proved the security of the QKD scheme against general attacks by a supra-quantum eavesdropper that is limited by the no-signaling principle only (rather than the full quantum formalism). This is possible because once the no-signaling condition is assumed, non-local correlations satisfy a monogamy condition analogous to that of entanglement in quantum theory [<cite linkend="nj308932bib9">9</cite>]. Since quantum theory satisfies the no-signaling condition, security against a no-signaling eavesdropper implies security in the device-independent scenario.</p><p>Barrett <italic>et al</italic>'s result is a proof of principle as their protocol requires Alice and Bob to have a noise-free quantum channel and generates a single shared secret bit (but makes a large number of uses of the channel). A slight modification of their protocol based on the results of [<cite linkend="nj308932bib10">10</cite>] enables the generation of a secret key of <inline-eqn><math-text><upright>log</upright><sub>2</sub><italic>d</italic></math-text></inline-eqn> bit if Alice and Bob have a channel that distributes <inline-eqn><math-text><italic>d</italic></math-text></inline-eqn>-dimensional systems. Barrett <italic>et al</italic>'s work was extended to noisy situations and non-vanishing key rates in [<cite linkend="nj308932bib4">4</cite>, <cite linkend="nj308932bib11">11</cite>, <cite linkend="nj308932bib12">12</cite>], although these works only considered security against individual attacks, where the eavesdropper is restricted to act independently on each of Alice's and Bob's systems. Masanes <italic>et al</italic> [<cite linkend="nj308932bib13">13</cite>] introduced a security proof valid against arbitrary attacks by an eavesdropper that is not able to store non-classical information. This result was improved by Masanes [<cite linkend="nj308932bib14">14</cite>], who proved security in the universally composable sense, the strongest notion of security. Although the last two results take into account eavesdropping strategies that act collectively on systems corresponding to different uses of the devices, they require the no-signaling condition to hold not only between the devices on Alice's and Bob's side, but also between all individual uses of the quantum device of one party. This condition can be enforced, although not in a practical manner, by having the parties use, in parallel, <inline-eqn><math-text><italic>N</italic></math-text></inline-eqn> devices that are space-like separated from each other, rather than using sequentially a single device <inline-eqn><math-text><italic>N</italic></math-text></inline-eqn> times.</p><p>There are fundamental motivations to study the security of QKD protocols against no-signaling eavesdroppers; this improves for instance our understanding of the relationship between information theory and physical theories. From a practical point of view, it is also interesting to develop cryptographic schemes that rely on physical principles independent of quantum theory and thus that could be guaranteed to be secure even if quantum theory were to fail.</p><p>However, given that for the moment we have no good reasons (apart from possibly theoretical ones) to doubt the validity of quantum theory, nor evidence that a hypothetical breakdown of quantum theory would signify the immediate end of QKD<fnref linkend="nj308932fn8"><sup>8</sup></fnref>, it is advantageous to exploit the full quantum formalism in the device-independent context. First of all, as the entire quantum formalism is more constraining than the no-signaling principle alone, we expect to derive higher key rates and better noise resistance in the quantum case (for instance, the proof of general security given in [<cite linkend="nj308932bib14">14</cite>] has a key rate and a noise resistance that is not practical when applied to quantum correlations). A second advantage is that, from a technical point of view, we can exploit, in proving security, the full theoretical framework of quantum theory—as opposed to a single principle. We may, in particular, use existing results such as de Finetti theorems, efficient privacy amplification schemes against quantum adversaries, etc (but might also have to derive new technical results that may find applications in other contexts).</p></sec-level2><sec-level2 id="nj308932s1.5" label="1.5"><heading>Content and structure of the paper</heading><p indent="no">Here we prove the security of a modified version of the Ekert protocol [<cite linkend="nj308932bib6">6</cite>], proposed in [<cite linkend="nj308932bib11">11</cite>]. Our proof, already introduced in [<cite linkend="nj308932bib15">15</cite>], exploits the full quantum formalism, but is restricted to collective attacks, where Eve is assumed to act independently and identically at each use of the devices, although she can act coherently at any time on her own systems. In the usual security model, security against collective attacks implies security against the most general type of attacks [<cite linkend="nj308932bib16">16</cite>]. It is an open question whether this is also true in the device-independent scenario. In the protocol that we analyze, Alice and Bob bound Eve's information by estimating the violation of the Clauser–Horne–Shimony–Holt (CHSH) inequality [<cite linkend="nj308932bib17">17</cite>]. Our main result is a tight bound on the Holevo information between Alice and Eve as a function of the amount of violation of the CHSH inequality. The protocol that we use, our security assumptions and our main result are presented in section <secref linkend="nj308932s2">2</secref>. In particular, we present in section <secref linkend="nj308932s2.4">2.4</secref> all the details of our security proof, which was only sketched in [<cite linkend="nj308932bib15">15</cite>].</p><p>It is crucial for the security of DIQKD that Alice's and Bob's outcomes genuinely violate a Bell inequality. All experimental tests of non-locality that have been made so far, however, are subject to at least one of several loopholes and therefore admit in principle a local description. We discuss in section <secref linkend="nj308932s3">3</secref> the issue of loopholes in Bell experiments from the perspective of DIQKD.</p><p>Finally, we conclude with a discussion of our results and some open questions in section <secref linkend="nj308932s4">4</secref>.</p></sec-level2></sec-level1><sec-level1 id="nj308932s2" label="2"><heading>Results</heading><sec-level2 id="nj308932s2.1" label="2.1"><heading>The protocol</heading><p indent="no">The protocol that we study is a modification of the Ekert 1991 protocol [<cite linkend="nj308932bib6">6</cite>] proposed in [<cite linkend="nj308932bib11">11</cite>]. Alice and Bob share a quantum channel consisting of a source that emits pairs of particles in an entangled state <inline-eqn><math-text>ρ<sub><upright>AB</upright></sub></math-text></inline-eqn>. Alice can choose to apply to her particle one out of three possible measurements <inline-eqn><math-text><italic>A</italic><sub>0</sub></math-text></inline-eqn>, <inline-eqn><math-text><italic>A</italic><sub>1</sub></math-text></inline-eqn> and <inline-eqn><math-text><italic>A</italic><sub>2</sub></math-text></inline-eqn>, and Bob one out of two measurements <inline-eqn><math-text><italic>B</italic><sub>1</sub></math-text></inline-eqn> and <inline-eqn><math-text><italic>B</italic><sub>2</sub></math-text></inline-eqn>. All measurements have binary outcomes labeled by <inline-eqn><math-text><italic>a</italic><sub><italic>i</italic></sub>, <italic>b</italic><sub><italic>j</italic></sub>∈{+1, −1}</math-text></inline-eqn>.</p><p>The raw key is extracted from the pair <inline-eqn><math-text>{<italic>A</italic><sub>0</sub>, <italic>B</italic><sub>1</sub>}</math-text></inline-eqn>. The quantum bit error rate (QBER) is defined as <inline-eqn></inline-eqn>. This parameter estimates the amount of correlations between Alice's and Bob's symbols and thus quantifies the amount of classical communication needed for error correction. The measurements <inline-eqn><math-text><italic>A</italic><sub>1</sub></math-text></inline-eqn>, <inline-eqn><math-text><italic>A</italic><sub>2</sub></math-text></inline-eqn>, <inline-eqn><math-text><italic>B</italic><sub>1</sub></math-text></inline-eqn> and <inline-eqn><math-text><italic>B</italic><sub>2</sub></math-text></inline-eqn> are used on a subset of the particles to estimate the CHSH polynomial
<display-eqn id="nj308932eqn6" textype="equation" notation="LaTeX" eqnnum="6"></display-eqn>where the correlator <inline-eqn><math-text>⟨<italic>a</italic><sub><italic>i</italic></sub><italic>b</italic><sub><italic>j</italic></sub>⟩</math-text></inline-eqn> is defined as <inline-eqn></inline-eqn>. The CHSH polynomial is used by Alice and Bob to bound Eve's information and thus governs the privacy amplification process. We note that there is no <italic>a priori</italic> relation between the value of <inline-eqn><math-text><italic>S</italic></math-text></inline-eqn> and the value of <inline-eqn><math-text><italic>Q</italic></math-text></inline-eqn>: these are two parameters that are available to estimate Eve's information.</p><p>Without loss of generality, we suppose that the marginals are random for each measurement, i.e. <inline-eqn><math-text>⟨<italic>a</italic><sub><italic>i</italic></sub>⟩=⟨<italic>b</italic><sub><italic>j</italic></sub>⟩=0</math-text></inline-eqn> for all <inline-eqn><math-text><italic>i</italic></math-text></inline-eqn> and <inline-eqn><math-text><italic>j</italic></math-text></inline-eqn>. Were this not the case, Alice and Bob could achieve it <italic>a posteriori</italic> through public one-way communication by agreeing on flipping randomly a chosen half of their bits. This operation would not change the value of <inline-eqn><math-text><italic>Q</italic></math-text></inline-eqn> and <inline-eqn><math-text><italic>S</italic></math-text></inline-eqn> and would be known to Eve.</p><p>A particular implementation of our protocol with qubits is given for instance by the noisy two-qubit state <inline-eqn><math-text>ρ<sub><upright>AB</upright></sub>=<italic>p</italic>|&PHgr;<sup>+</sup>⟩⟨&PHgr;<sup>+</sup>|+(1−<italic>p</italic>)<italic>I</italic>/4</math-text></inline-eqn> and by the qubit measurements <inline-eqn><math-text><italic>A</italic><sub>0</sub>=<italic>B</italic><sub>1</sub>=σ<sub><italic>z</italic></sub></math-text></inline-eqn>, <inline-eqn><math-text><italic>B</italic><sub>2</sub>=σ<sub><italic>x</italic></sub></math-text></inline-eqn>, <inline-eqn></inline-eqn> and <inline-eqn></inline-eqn>, which maximize the CHSH polynomial for the state <inline-eqn><math-text>ρ<sub><upright>AB</upright></sub></math-text></inline-eqn>. The state <inline-eqn><math-text>ρ<sub><upright>AB</upright></sub></math-text></inline-eqn> corresponds to a two-qubit Werner state and arises, for instance, from the state <inline-eqn></inline-eqn>) after going through a depolarizing channel or through a phase-covariant cloner. The resulting correlations satisfy <inline-eqn></inline-eqn> and <inline-eqn><math-text><italic>Q</italic>=1/2−<italic>p</italic>/2</math-text></inline-eqn>, i.e. <inline-eqn></inline-eqn>. Although these correlations can be generated in the way that we just described, it is important to stress that Alice and Bob do not need to assume that they perform the above measurements, nor that their quantum systems are of dimension 2, when they bound Eve's information.</p><p>In the case of classically correlated data (corresponding to <inline-eqn></inline-eqn> for the above correlations), the maximum of the CHSH polynomial (<eqnref linkend="nj308932eqn6">6</eqnref>) is 2, which defines the well-known CHSH Bell inequality <inline-eqn><math-text><italic>S</italic>⩽2</math-text></inline-eqn>. Secure DIQKD is not possible if the observed value of <inline-eqn><math-text><italic>S</italic></math-text></inline-eqn> is below this classical limit, since in this case there exists a trivial attack for Eve that gives her complete information, as discussed in section <secref linkend="nj308932s1.3">1.3</secref>. On the other hand, at the point of maximal quantum violation <inline-eqn></inline-eqn> (corresponding to <inline-eqn><math-text><italic>p</italic>=1</math-text></inline-eqn> for the above correlations), Eve's information is zero. This follows from the work of Tsirelson [<cite linkend="nj308932bib18">18</cite>], who showed that any quantum realization of this violation is equivalent to the case where Alice and Bob measure a two-qubit maximally entangled state. The main ingredient in the security proof of our DIQKD protocol is a lower bound on Eve's information as a function of the CHSH value. This bound allows us to interpolate between the two extreme cases of zero and maximal quantum violation and yields provable security for sufficiently large violations.</p></sec-level2><sec-level2 id="nj308932s2.2" label="2.2"><heading>Eavesdropping strategies</heading><sec-level3 id="nj308932s2.2.1" label="2.2.1"><heading>Most general attacks</heading><p indent="no">In the device-independent scenario, Eve is assumed not only to control the source (as in usual entanglement-based QKD), but also to have fabricated Alice's and Bob's measuring devices. The only data available to Alice and Bob to bound Eve's knowledge is the observed relation between the inputs and outputs, without any assumption on the type of quantum measurements and systems used for their generation.</p><p>In complete generality, we may describe this situation as follows. Alice, Bob and Eve share a state <inline-eqn><math-text>|&PSgr;⟩<sub><upright>ABE</upright></sub></math-text></inline-eqn> in <inline-eqn><math-text><italic>H</italic><sub><upright>A</upright></sub><sup>⊗<italic>n</italic></sup>⊗<italic>H</italic><sub><upright>B</upright></sub><sup>⊗<italic>n</italic></sup>⊗<italic>H</italic><sub><upright>E</upright></sub></math-text></inline-eqn>, where <inline-eqn><math-text><italic>n</italic></math-text></inline-eqn> is the number of bits of the raw key. The dimension <inline-eqn><math-text><italic>d</italic></math-text></inline-eqn> of Alice's and Bob's Hilbert spaces <inline-eqn></inline-eqn> is unknown to them and fixed by Eve. The measurement <inline-eqn><math-text><italic>M</italic><sub><italic>k</italic></sub></math-text></inline-eqn> yielding the <inline-eqn><math-text><italic>k</italic><upright>th</upright></math-text></inline-eqn> outcome of Alice is defined on the <inline-eqn><math-text><italic>k</italic><upright>th</upright></math-text></inline-eqn> subspace of Alice and chosen by Eve. This measurement may depend on the input <inline-eqn><math-text><italic>A</italic><sub><italic>j</italic><sub><italic>k</italic></sub></sub></math-text></inline-eqn> chosen by Alice at step <inline-eqn><math-text><italic>k</italic></math-text></inline-eqn> and on the value <inline-eqn><math-text><italic>c</italic><sub><italic>k</italic></sub></math-text></inline-eqn> of a classical register stored in the device, that is, <inline-eqn><math-text><italic>M</italic><sub><italic>k</italic></sub>=<italic>M</italic><sub><italic>k</italic></sub>(<italic>A</italic><sub><italic>j</italic><sub><italic>k</italic></sub></sub>, <italic>c</italic><sub><italic>k</italic></sub>)</math-text></inline-eqn>. The classical memory <inline-eqn><math-text><italic>c</italic><sub><italic>k</italic></sub></math-text></inline-eqn> can in particular store information on all previous inputs and outputs. Note that the quantum device may also have a quantum memory, but this quantum memory at step <inline-eqn><math-text><italic>k</italic></math-text></inline-eqn> of the protocol can be seen as part of Alice's state defined in <inline-eqn><math-text><italic>H</italic><sub><upright>A</upright></sub><sup><italic>k</italic></sup></math-text></inline-eqn>. The value of this quantum memory can be passed internally from step <inline-eqn><math-text><italic>k</italic></math-text></inline-eqn> of the protocol to step <inline-eqn><math-text><italic>k</italic>+1</math-text></inline-eqn> by teleporting it from <inline-eqn><math-text><italic>H</italic><sub><upright>A</upright></sub><sup><italic>k</italic></sup></math-text></inline-eqn> to <inline-eqn><math-text><italic>H</italic><sub><upright>A</upright></sub><sup><italic>k</italic>+1</sup></math-text></inline-eqn> using the classical memory <inline-eqn><math-text><italic>c</italic><sub><italic>k</italic></sub></math-text></inline-eqn>. The situation is similar for Bob.</p></sec-level3><sec-level3 id="nj308932s2.2.2" label="2.2.2"><heading>Collective attacks.</heading><p indent="no">In this paper, we focus on collective attacks where Eve applies the same attack to each system of Alice and Bob. Specifically, we assume that the total state shared by the three parties has the product form <inline-eqn><math-text>|&PSgr;<sub><upright>ABE</upright></sub>⟩=|ψ<sub><upright>ABE</upright></sub>⟩<sup>⊗<italic>n</italic></sup></math-text></inline-eqn> and that the measurements are a function of the current input only; for example, for Alice <inline-eqn><math-text><italic>M</italic><sub><italic>k</italic></sub>=<italic>M</italic>(<italic>A</italic><sub><italic>j</italic><sub><italic>k</italic></sub></sub>)</math-text></inline-eqn>. We thus assume that the devices are memoryless and behave identically and independently at each step of the protocol. From now on, we simply write the measurement <inline-eqn><math-text><italic>M</italic>(<italic>A</italic><sub><italic>j</italic></sub>)</math-text></inline-eqn> as <inline-eqn><math-text><italic>A</italic><sub><italic>j</italic></sub></math-text></inline-eqn>.</p><p>For collective attacks, the asymptotic secret key rate <inline-eqn><math-text><italic>r</italic></math-text></inline-eqn> in the limit of a key of infinite size under one-way classical postprocessing from Bob to Alice is lower-bounded by the Devetak–Winter rate [<cite linkend="nj308932bib19">19</cite>],
<display-eqn id="nj308932eqn7" textype="equation" notation="LaTeX" eqnnum="7"></display-eqn>which is the difference between the mutual information between Alice and Bob,
<display-eqn id="nj308932eqn8" textype="equation" notation="LaTeX" eqnnum="8"></display-eqn>and the Holevo quantity between Eve and Bob
<display-eqn id="nj308932eqn9" textype="equation" notation="LaTeX" eqnnum="9"></display-eqn>Here <inline-eqn><math-text><italic>H</italic></math-text></inline-eqn> and <inline-eqn><math-text><italic>S</italic></math-text></inline-eqn> denote the standard Shannon and von Neumann entropies, <inline-eqn><math-text>ρ<sub><upright>E</upright></sub>=<upright>Tr</upright><sub><upright>AB</upright></sub>|ψ<sub><upright>ABE</upright></sub>⟩⟨ψ<sub><upright>ABE</upright></sub>|</math-text></inline-eqn> denotes Eve's quantum state after tracing out Alice's and Bob's particles, and <inline-eqn><math-text>ρ<sub><upright>E</upright>|<italic>b</italic><sub>1</sub></sub></math-text></inline-eqn> is Eve's quantum state when Bob has obtained the result <inline-eqn><math-text><italic>b</italic><sub>1</sub></math-text></inline-eqn> for the measurement <inline-eqn><math-text><italic>B</italic><sub>1</sub></math-text></inline-eqn>. The optimal collective attack corresponds to the case where the tripartite state <inline-eqn><math-text>|ψ<sub><upright>ABE</upright></sub>⟩</math-text></inline-eqn> is the purification of the bipartite state <inline-eqn><math-text>ρ<sub><upright>AB</upright></sub></math-text></inline-eqn> shared by Alice and Bob.</p><p>Since we have assumed uniform marginals, the mutual information between Alice and Bob is given here by
<display-eqn id="nj308932eqn10" textype="equation" notation="LaTeX" eqnnum="10"></display-eqn>where <inline-eqn><math-text><italic>h</italic></math-text></inline-eqn> is the binary entropy.</p><p>Note that the rate is given by (<eqnref linkend="nj308932eqn7">7</eqnref>) and not by <inline-eqn><math-text><italic>I</italic>(<italic>A</italic><sub>0</sub>:<italic>B</italic><sub>1</sub>)−χ(<italic>A</italic><sub>0</sub>: <italic>E</italic>)</math-text></inline-eqn> because <inline-eqn><math-text>χ(<italic>A</italic><sub>0</sub>:<italic>E</italic>)⩾χ(<italic>B</italic><sub>1</sub>:<italic>E</italic>)</math-text></inline-eqn> holds for our protocol [<cite linkend="nj308932bib11">11</cite>]; it is therefore advantageous for Alice and Bob to do the classical postprocessing with public communication from Bob to Alice.</p></sec-level3></sec-level2><sec-level2 id="nj308932s2.3" label="2.3"><heading>Security of our protocol against collective attacks</heading><p indent="no">To find Eve's optimal collective attack, we have to find the largest value of <inline-eqn><math-text>χ(<italic>B</italic><sub>1</sub>:<italic>E</italic>)</math-text></inline-eqn> compatible with the observed parameters <inline-eqn><math-text><italic>Q</italic></math-text></inline-eqn> and <inline-eqn><math-text><italic>S</italic></math-text></inline-eqn> without assuming anything about the physical systems and the measurements that are performed. Our main result is the following.</p><proclaim id="nj308932pro1" type="theorem" format="num" style="italic"><heading>Theorem 1.</heading><p indent="no">Let <inline-eqn><math-text>|ψ<sub><upright>ABE</upright></sub>⟩</math-text></inline-eqn> be a quantum state and <inline-eqn><math-text>{<italic>A</italic><sub>1</sub>, <italic>A</italic><sub>2</sub>, <italic>B</italic><sub>1</sub>, <italic>B</italic><sub>2</sub>}</math-text></inline-eqn> a set of measurements yielding a violation <inline-eqn><math-text><italic>S</italic></math-text></inline-eqn> of the CHSH inequality. Then after Alice and Bob have symmetrized their marginals,
<display-eqn id="nj308932eqn11" textype="equation" notation="LaTeX" eqnnum="11"></display-eqn></p></proclaim><p>The proof of this theorem will be given in section <secref linkend="nj308932s2.4">2.4</secref>. From this result, it immediately follows that the key rate for given observed values of <inline-eqn><math-text><italic>Q</italic></math-text></inline-eqn> and <inline-eqn><math-text><italic>S</italic></math-text></inline-eqn> is
<display-eqn id="nj308932eqn12" textype="equation" notation="LaTeX" eqnnum="12"></display-eqn>As an illustration, we have plotted in figure <figref linkend="nj308932fig2">2</figref> the key rate for the correlations introduced in section <secref linkend="nj308932s2.1">2.1</secref> that satisfy <inline-eqn></inline-eqn> and which arise from the state <inline-eqn><math-text>|&PHgr;<sup>+</sup>⟩</math-text></inline-eqn> after going through a depolarizing channel. We stress that although we have specified a particular state and particular qubit measurements that produce these correlations, we do not assume anything about the implementation of the correlations when computing the key rate. For the sake of comparison, we have also plotted the key rate under the usual assumptions of QKD for the same set of correlations. In this case, Alice and Bob have perfect control of their apparatuses, which we have assumed in order to faithfully perform the qubit measurements given in section <secref linkend="nj308932s2.1">2.1</secref>. The protocol is then equivalent to Ekert's, which in turn is equivalent to the entanglement-based version of BB84, and one finds
<display-eqn id="nj308932eqn13" textype="equation" notation="LaTeX" eqnnum="13"></display-eqn>as proved in section <secref linkend="nj308932s2.5">2.5</secref>. If <inline-eqn></inline-eqn>, this expression yields the well-known critical QBER of <inline-eqn><math-text>11%</math-text></inline-eqn> [<cite linkend="nj308932bib20">20</cite>], compared to <inline-eqn><math-text>7.1%</math-text></inline-eqn> in the device-independent scenario (figure <figref linkend="nj308932fig2">2</figref>).</p><figure id="nj308932fig2" parts="single" width="column" position="float" pageposition="top" printstyle="normal" orientation="port"><graphic position="indented"><graphic-file version="print" format="EPS" width="21.9pc" printcolour="no" filename="images/nj308932fig2.eps"></graphic-file><graphic-file version="ej" format="JPEG" printcolour="yes" filename="images/nj308932fig2.jpg"></graphic-file></graphic><caption type="figure" id="nj308932fc2" label="Figure 2"><p indent="no">Extractable secret-key rate against collective attacks in the usual scenario (<inline-eqn><math-text>χ(<italic>B</italic><sub>1</sub>:<italic>E</italic>)</math-text></inline-eqn> given by equation (<eqnref linkend="nj308932eqn13">13</eqnref>)) and in the device-independent scenario (<inline-eqn><math-text>χ(<italic>B</italic><sub>1</sub>:<italic>E</italic>)</math-text></inline-eqn> given by equation (<eqnref linkend="nj308932eqn11">11</eqnref>)), for correlations satisfying
<inline-eqn></inline-eqn>. The key rate is plotted as a function of <inline-eqn><math-text><italic>Q</italic></math-text></inline-eqn>. Remember that the key rate for the BB84 protocol in the device-independent scenario is zero.</p></caption></figure><p>To illustrate further the difference between the device-independent scenario and the usual scenario, we now give an explicit attack that saturates our bound; this example also clarifies why the bound (<eqnref linkend="nj308932eqn11">11</eqnref>) is independent of <inline-eqn><math-text><italic>Q</italic></math-text></inline-eqn>. To produce correlations characterized by given values of <inline-eqn><math-text><italic>Q</italic></math-text></inline-eqn> and <inline-eqn><math-text><italic>S</italic></math-text></inline-eqn>, Eve sends to Alice and Bob the two-qubit Bell-diagonal state
<display-eqn id="nj308932eqn14" textype="equation" notation="LaTeX" eqnnum="14"></display-eqn>where <inline-eqn><math-text><italic>P</italic><sub>&PHgr;<sup>±</sup></sub></math-text></inline-eqn> are the projectors on the Bell states <inline-eqn></inline-eqn> and where <inline-eqn></inline-eqn>. She defines the measurements to be <inline-eqn><math-text><italic>B</italic><sub>1</sub>=σ<sub><italic>z</italic></sub></math-text></inline-eqn>, <inline-eqn><math-text><italic>B</italic><sub>2</sub>=σ<sub><italic>x</italic></sub></math-text></inline-eqn> and <inline-eqn></inline-eqn>. Any value of <inline-eqn><math-text><italic>Q</italic></math-text></inline-eqn> can be obtained by choosing <inline-eqn><math-text><italic>A</italic><sub>0</sub></math-text></inline-eqn> to be <inline-eqn><math-text>σ<sub><italic>z</italic></sub></math-text></inline-eqn> with probability <inline-eqn><math-text>1−2<italic>Q</italic></math-text></inline-eqn> and to be a randomly chosen bit with probability <inline-eqn><math-text>2<italic>Q</italic></math-text></inline-eqn>. One can check that the Holevo information <inline-eqn><math-text>χ(<italic>B</italic><sub>1</sub>:<italic>E</italic>)</math-text></inline-eqn> for the state (<eqnref linkend="nj308932eqn14">14</eqnref>) and the measurement <inline-eqn><math-text><italic>B</italic><sub>1</sub>=σ<sub><italic>z</italic></sub></math-text></inline-eqn> are equal to the right-hand side of (<eqnref linkend="nj308932eqn11">11</eqnref>), i.e. this attack saturates our bound. This attack is impossible within the usual assumptions because here not only the state <inline-eqn><math-text>ρ<sub><upright>AB</upright></sub></math-text></inline-eqn>, but also the measurements taking place in Alice's apparatus depend explicitly on the observed values of <inline-eqn><math-text><italic>S</italic></math-text></inline-eqn> and <inline-eqn><math-text><italic>Q</italic></math-text></inline-eqn>. The state (<eqnref linkend="nj308932eqn14">14</eqnref>) has a nice interpretation: it is the two-qubit state that gives the highest violation <inline-eqn><math-text><italic>S</italic></math-text></inline-eqn> of the CHSH inequality for a given value of the entanglement, measured by the concurrence <inline-eqn><math-text><italic>C</italic></math-text></inline-eqn> [<cite linkend="nj308932bib21">21</cite>]. Therefore, for the optimal attack, Eve uses the quantum state achieving the observed Bell violation with the minimal amount of entanglement between Alice and Bob. Since entanglement is a monogamous resource, this allows her to maximize her correlations with the honest parties.</p></sec-level2><sec-level2 id="nj308932s2.4" label="2.4"><heading>Proof of the upper bound on the Holevo quantity</heading><p indent="no">The proof of the bound (<eqnref linkend="nj308932eqn11">11</eqnref>) was only sketched in [<cite linkend="nj308932bib15">15</cite>]. We present here all the details of that proof. For clarity, we divide the proof into four steps.</p><sec-level3 id="nj308932s2.4.1" label="2.4.1"><heading>Step 1: reduction to calculations on two qubits</heading><proclaim id="nj308932pro2" type="lemma" format="num" style="italic"><heading>Lemma 1.</heading><p indent="no"> It is not restrictive to suppose that Eve sends to Alice and Bob a mixture <inline-eqn></inline-eqn> of two-qubit states, together with a classical ancilla (known to her) that carries the value <inline-eqn><math-text>λ</math-text></inline-eqn> and determines which measurements <inline-eqn><math-text><italic>A</italic><sub><italic>i</italic></sub><sup>λ</sup></math-text></inline-eqn> and <inline-eqn><math-text><italic>B</italic><sub><italic>j</italic></sub><sup>λ</sup></math-text></inline-eqn> are to be used on <inline-eqn><math-text>ρ<sub>λ</sub></math-text></inline-eqn>.</p></proclaim><p indent="no">The proof of this first statement relies critically on the simplicity of the CHSH inequality (two binary settings on each side). We present the argument for Alice, and the same holds for Bob. First, since any generalized measurement (or positive operator-valued measure) can be viewed as a von Neumann measurement in a larger Hilbert space [<cite linkend="nj308932bib22">22</cite>], we may assume that the two measurements <inline-eqn><math-text><italic>A</italic><sub>1</sub></math-text></inline-eqn> and <inline-eqn><math-text><italic>A</italic><sub>2</sub></math-text></inline-eqn> of Alice are von Neumann measurements, if necessary by including ancillas in the state <inline-eqn><math-text>ρ<sub><upright>AB</upright></sub></math-text></inline-eqn> shared by Alice and Bob. Thus <inline-eqn><math-text><italic>A</italic><sub>1</sub></math-text></inline-eqn> and <inline-eqn><math-text><italic>A</italic><sub>2</sub></math-text></inline-eqn> are Hermitian operators on <inline-eqn></inline-eqn> with eigenvalues <inline-eqn><math-text>±1</math-text></inline-eqn>. We can then use the following lemma.</p><proclaim id="nj308932pro3" type="lemma" format="num" num="3" style="italic"><heading>Lemma 2.</heading><p indent="no"> Let <inline-eqn><math-text><italic>A</italic><sub>1</sub></math-text></inline-eqn> and <inline-eqn><math-text><italic>A</italic><sub>2</sub></math-text></inline-eqn> be Hermitian operators with eigenvalues equal to <inline-eqn><math-text>±1</math-text></inline-eqn> acting on a Hilbert space <inline-eqn><math-text><italic>H</italic></math-text></inline-eqn> of finite or countable infinite dimension. Then we can decompose the Hilbert space <inline-eqn><math-text><italic>H</italic></math-text></inline-eqn> as a direct sum
<display-eqn id="nj308932eqn15" textype="equation" notation="LaTeX" eqnnum="15"></display-eqn>such that <inline-eqn><math-text><upright>dim</upright>(<italic>H</italic><sub>α</sub><sup>2</sup>)⩽2</math-text></inline-eqn> for all <inline-eqn><math-text>α</math-text></inline-eqn>, and such that both <inline-eqn><math-text><italic>A</italic><sub>1</sub></math-text></inline-eqn> and <inline-eqn><math-text><italic>A</italic><sub>2</sub></math-text></inline-eqn> act within <inline-eqn><math-text><italic>H</italic><sub>α</sub><sup>2</sup></math-text></inline-eqn>, that is, if <inline-eqn><math-text>|ψ⟩∈<italic>H</italic><sub>α</sub><sup>2</sup></math-text></inline-eqn>, then <inline-eqn><math-text><italic>A</italic><sub>1</sub>|ψ⟩∈<italic>H</italic><sub>α</sub><sup>2</sup></math-text></inline-eqn> and <inline-eqn><math-text><italic>A</italic><sub>2</sub>|ψ⟩∈<italic>H</italic><sub>α</sub><sup>2</sup></math-text></inline-eqn>.</p></proclaim><proclaim id="nj308932pro4" type="proof" format="unnum" style="upright"><heading>Proof.</heading><p indent="no"> Previous proofs of this result have been obtained independently by Tsirelson [<cite linkend="nj308932bib23">23</cite>] and Masanes [<cite linkend="nj308932bib24">24</cite>]. Here, we provide an alternative and possibly simpler proof.</p><p>Note that since the eigenvectors of <inline-eqn><math-text><italic>A</italic><sub>1</sub></math-text></inline-eqn> and <inline-eqn><math-text><italic>A</italic><sub>2</sub></math-text></inline-eqn> are <inline-eqn><math-text>±1</math-text></inline-eqn>, these operators square to the identity: <inline-eqn></inline-eqn>. Therefore <inline-eqn><math-text><italic>A</italic><sub>2</sub><italic>A</italic><sub>1</sub></math-text></inline-eqn> is a unitary operator. Let <inline-eqn><math-text>|α⟩</math-text></inline-eqn> be an eigenvector of <inline-eqn><math-text><italic>A</italic><sub>2</sub><italic>A</italic><sub>1</sub></math-text></inline-eqn>:
<display-eqn id="nj308932eqn16" textype="equation" notation="LaTeX" eqnnum="16"></display-eqn>Then <inline-eqn></inline-eqn> is also an eigenvector of <inline-eqn><math-text><italic>A</italic><sub>2</sub><italic>A</italic><sub>1</sub></math-text></inline-eqn> with eigenvalue <inline-eqn></inline-eqn>, since <inline-eqn></inline-eqn>. As <inline-eqn><math-text><italic>A</italic><sub>2</sub><italic>A</italic><sub>1</sub></math-text></inline-eqn> is unitary, its eigenvectors span the entire Hilbert space <inline-eqn><math-text><italic>H</italic></math-text></inline-eqn>. It follows that <inline-eqn><math-text><italic>H</italic></math-text></inline-eqn> can be decomposed as the direct sum <inline-eqn></inline-eqn>, where <inline-eqn></inline-eqn> is (at most) two-dimensional.</p><p>It remains to be shown that <inline-eqn><math-text><italic>A</italic><sub>1</sub></math-text></inline-eqn> and <inline-eqn><math-text><italic>A</italic><sub>2</sub></math-text></inline-eqn> act within <inline-eqn><math-text><italic>H</italic><sub>α</sub><sup>2</sup></math-text></inline-eqn>. By definition <inline-eqn></inline-eqn> and <inline-eqn></inline-eqn>. On the other hand, <inline-eqn></inline-eqn> and <inline-eqn></inline-eqn>. Note that in the case where <inline-eqn><math-text>ω=±1</math-text></inline-eqn>, <inline-eqn><math-text><italic>A</italic><sub>1</sub>=±<italic>A</italic><sub>2</sub></math-text></inline-eqn> on <inline-eqn><math-text><italic>H</italic><sub>α</sub><sup>2</sup></math-text></inline-eqn>, that is, <inline-eqn><math-text><italic>A</italic><sub>1</sub></math-text></inline-eqn> and <inline-eqn><math-text><italic>A</italic><sub>2</sub></math-text></inline-eqn> are identical operators up to a phase.</p></proclaim><proclaim id="nj308932pro5" type="proof" format="unnum" style="upright"><heading>Proof of lemma <textref linkend="nj308932pro2">1</textref>.</heading><p indent="no">We can rephrase lemma <textref linkend="nj308932pro3">2</textref> as saying that <inline-eqn></inline-eqn> where the <inline-eqn><math-text><italic>P</italic><sub>α</sub>'<upright>s</upright></math-text></inline-eqn> are orthogonal projectors of rank 1 or 2. From Alice's standpoint, the measurement of <inline-eqn><math-text><italic>A</italic><sub><italic>i</italic></sub></math-text></inline-eqn> thus amounts to projecting in one of the (at most) two-dimensional subspaces defined by the projectors <inline-eqn><math-text><italic>P</italic><sub>α</sub></math-text></inline-eqn>, followed by a measurement of the reduced observable <inline-eqn></inline-eqn>. Clearly, it cannot be worse for Eve to perform the projection herself before sending the state to Alice and learn the value of <inline-eqn><math-text>α</math-text></inline-eqn>. The same holds for Bob. We conclude that without loss of generality, in each run of the experiment, Alice and Bob receive a two-qubit state. The deviation from usual proofs of security of QKD lies in the fact that the measurements to be applied can depend explicitly on the state sent by Eve.</p></proclaim></sec-level3><sec-level3 id="nj308932s2.4.2" label="2.4.2"><heading>Step 2: reduction to Bell-diagonal states of two qubits</heading><p indent="no">Let <inline-eqn></inline-eqn> and <inline-eqn></inline-eqn> be the four Bell states.</p><proclaim id="nj308932pro6" type="lemma" format="num" num="6" style="italic"><heading>Lemma 3.</heading><p indent="no"> In the basis of Bell states ordered as <inline-eqn><math-text>{|&PHgr;<sup>+</sup>⟩, |&PSgr;<sup>−</sup>⟩, |&PHgr;<sup>−</sup>⟩, |&PSgr;<sup>+</sup>⟩}</math-text></inline-eqn>, each state <inline-eqn><math-text>ρ<sub>λ</sub></math-text></inline-eqn> can be taken to be a Bell-diagonal state of the form
<display-eqn id="nj308932eqn17" textype="equation" notation="LaTeX" eqnnum="17" lines="multiline"></display-eqn>with eigenvalues satisfying
<display-eqn id="nj308932eqn18" textype="equation" notation="LaTeX" eqnnum="18" lines="multiline"></display-eqn>Furthermore, the measurements <inline-eqn><math-text><italic>A</italic><sub><italic>i</italic></sub><sup>λ</sup></math-text></inline-eqn> and <inline-eqn><math-text><italic>B</italic><sub><italic>j</italic></sub><sup>λ</sup></math-text></inline-eqn> can be taken to be measurements in the <inline-eqn><math-text>(<italic>x</italic>, <italic>z</italic>)</math-text></inline-eqn> plane.</p></proclaim><proclaim id="nj308932pro7" type="proof" format="unnum" style="upright"><heading>Proof.</heading><p indent="no"> For fixed <inline-eqn><math-text>λ</math-text></inline-eqn> (we now omit the index <inline-eqn><math-text>λ</math-text></inline-eqn>), we can label the axis of the Bloch sphere on Alice's side in such a way that <inline-eqn></inline-eqn> define the <inline-eqn><math-text>(<italic>x</italic>, <italic>z</italic>)</math-text></inline-eqn> plane, and similarly on Bob's side.</p><p>Eve is <italic>a priori</italic> distributing any two-qubit state <inline-eqn><math-text>ρ</math-text></inline-eqn> of which she holds a purification. Now, recall that we have supposed, without loss of generality, that all the marginals are uniformly random. Knowing that Alice and Bob are going to symmetrize their marginals, Eve does not lose anything in providing them a state with the suitable symmetry. The reason is as follows. First note that since the (classical) randomization protocol that ensures <inline-eqn><math-text>⟨<italic>a</italic><sub><italic>i</italic></sub>⟩=⟨<italic>b</italic><sub><italic>j</italic></sub>⟩=0</math-text></inline-eqn> is done by Alice and Bob through public communication, we can as well assume that it is Eve who does it, i.e. she flips the value of each outcome bit with probability one half. But because the measurements of Alice and Bob are in the <inline-eqn><math-text>(<italic>x</italic>, <italic>z</italic>)</math-text></inline-eqn> plane, we can equivalently, i.e. without changing Eve's information, view the classical flipping of the outcomes as the quantum operation <inline-eqn></inline-eqn> on the state <inline-eqn><math-text>ρ</math-text></inline-eqn>. We conclude that it is not restrictive to assume that Eve is in fact sending the mixture
<display-eqn id="nj308932eqn19" textype="equation" notation="LaTeX" eqnnum="19"></display-eqn>i.e. that she is sending a state invariant under <inline-eqn></inline-eqn>.</p><p>Now, <inline-eqn><math-text>|&PHgr;<sup>+</sup>⟩</math-text></inline-eqn> and <inline-eqn><math-text>|&PSgr;<sup>−</sup>⟩</math-text></inline-eqn> are eigenstates of <inline-eqn></inline-eqn> for the eigenvalue <inline-eqn><math-text>−1</math-text></inline-eqn>, whereas <inline-eqn><math-text>|&PHgr;<sup>−</sup>⟩</math-text></inline-eqn> and <inline-eqn><math-text>|&PSgr;<sup>+</sup>⟩</math-text></inline-eqn> are eigenstates of <inline-eqn></inline-eqn> for the eigenvalue <inline-eqn><math-text>+1</math-text></inline-eqn>. Consequently, <inline-eqn></inline-eqn> is obtained from <inline-eqn><math-text>ρ</math-text></inline-eqn> by erasing all the coherences between states with different eigenvalues. Explicitly, in the basis of Bell states, ordered as <inline-eqn><math-text>{|&PHgr;<sup>+</sup>⟩, |&PSgr;<sup>−</sup>⟩, |&PHgr;<sup>−</sup>⟩, |&PSgr;<sup>+</sup>⟩}</math-text></inline-eqn>, we have
<display-eqn id="nj308932eqn20" textype="equation" notation="LaTeX" eqnnum="20" lines="multiline"></display-eqn>where all the nonzero elements coincide with those of the original <inline-eqn><math-text>ρ</math-text></inline-eqn>.</p><p>We now use some additional freedom that is left in the labeling: we can select any two orthogonal axes in the <inline-eqn><math-text>(<italic>x</italic>, <italic>z</italic>)</math-text></inline-eqn> plane to be labeled <inline-eqn><math-text><italic>x</italic></math-text></inline-eqn> and <inline-eqn><math-text><italic>z</italic></math-text></inline-eqn>, and we can also choose their orientation. We make use of this freedom to bring <inline-eqn></inline-eqn> to the form
<display-eqn id="nj308932eqn21" textype="equation" notation="LaTeX" eqnnum="21" lines="multiline"></display-eqn>with <inline-eqn><math-text><italic>r</italic><sub>1</sub></math-text></inline-eqn> and <inline-eqn><math-text><italic>r</italic><sub>2</sub></math-text></inline-eqn> being real and with the diagonal elements arranged as
<display-eqn id="nj308932eqn22" textype="equation" notation="LaTeX" eqnnum="22"></display-eqn>Indeed, let <inline-eqn></inline-eqn>, by applying <inline-eqn></inline-eqn> with
<display-eqn id="nj308932eqn23" textype="equation" notation="LaTeX" eqnnum="23"></display-eqn>the off-diagonal elements become purely imaginary. In order to further arrange the diagonal elements according to (<eqnref linkend="nj308932eqn22">22</eqnref>), one can make the following extra rotations:</p><itemized-list id="list2" type="bullet" style="hanging"><list-item id="list2-i6"><p>in order to relabel <inline-eqn></inline-eqn> without changing the others, one sets <inline-eqn><math-text>α−β=π</math-text></inline-eqn> and <inline-eqn><math-text>α+β=0</math-text></inline-eqn>, i.e. <inline-eqn></inline-eqn>;</p></list-item><list-item id="list2-i7"><p>in order to relabel <inline-eqn></inline-eqn> without changing the others, one sets <inline-eqn><math-text>α−β=0</math-text></inline-eqn> and <inline-eqn><math-text>α+β=π</math-text></inline-eqn>, i.e. <inline-eqn></inline-eqn>;</p></list-item><list-item id="list2-i8"><p>in order to relabel both, one takes the sum of the previous ones, i.e. <inline-eqn><math-text>α=π</math-text></inline-eqn> and <inline-eqn><math-text>β=0</math-text></inline-eqn>.</p></list-item></itemized-list><p indent="no">In this way one fixes <inline-eqn><math-text>λ<sub>&PHgr;<sup>+</sup></sub>⩾λ<sub>&PSgr;<sup>−</sup></sub></math-text></inline-eqn> and <inline-eqn><math-text>λ<sub>&PHgr;<sup>−</sup></sub>⩾λ<sub>&PSgr;<sup>+</sup></sub></math-text></inline-eqn>, i.e. the order of the diagonal elements in each sector.</p><p>Finally, we repeat an argument similar to the one given above: since <inline-eqn></inline-eqn> and its conjugate <inline-eqn></inline-eqn> produce the same statistics for Alice's and Bob's measurements and provide Eve with the same information, we can suppose without loss of generality that Alice and Bob rather receive the Bell-diagonal mixture
<display-eqn id="nj308932eqn24" textype="equation" notation="LaTeX" eqnnum="24" lines="multiline"></display-eqn>with the eigenvalues satisfying (<eqnref linkend="nj308932eqn22">22</eqnref>).</p></proclaim></sec-level3><sec-level3 id="nj308932s2.4.3" label="2.4.3"><heading>Step 3: Explicit calculation of the bound</heading><proclaim id="nj308932pro8" type="lemma" format="num" num="8" style="italic"><heading>Lemma 4.</heading><p indent="no">For a Bell-diagonal state <inline-eqn><math-text>ρ<sub>λ</sub></math-text></inline-eqn> (<eqnref linkend="nj308932eqn17">17</eqnref>) with eigenvalues <inline-eqn><math-text>λ</math-text></inline-eqn> ordered as in equation (<eqnref linkend="nj308932eqn18">18</eqnref>) and for measurements in the <inline-eqn><math-text>(<italic>x</italic>, <italic>z</italic>)</math-text></inline-eqn> plane,
<display-eqn id="nj308932eqn25" textype="equation" notation="LaTeX" eqnnum="25"></display-eqn>where <inline-eqn><math-text><italic>S</italic><sub>λ</sub></math-text></inline-eqn> is the largest violation of the CHSH inequality by the state <inline-eqn><math-text>ρ<sub>λ</sub></math-text></inline-eqn>.</p></proclaim><p indent="no">In order to prove lemma <textref linkend="nj308932pro8">4</textref> we have to bound <inline-eqn></inline-eqn>. For the Bell-diagonal state (<eqnref linkend="nj308932eqn17">17</eqnref>) one has
<display-eqn id="nj308932eqn26" textype="equation" notation="LaTeX" eqnnum="26"></display-eqn>where <inline-eqn><math-text><italic>H</italic></math-text></inline-eqn> is Shannon entropy and where we have adopted the notation <inline-eqn></inline-eqn>. We divide the proof of lemma <textref linkend="nj308932pro8">4</textref> into three parts. In the first part, we prove that, for any given Bell-diagonal state, Eve's best choice for Bob's measurement is <inline-eqn><math-text><italic>B</italic><sub>1</sub>=σ<sub><italic>z</italic></sub></math-text></inline-eqn>, which allows us to express (<eqnref linkend="nj308932eqn26">26</eqnref>) solely in terms of the eigenvalues <inline-eqn></inline-eqn>. In the second part, we obtain an inequality between entropies. In the third part, we compute the maximal violation of the CHSH inequality for states of the form (<eqnref linkend="nj308932eqn17">17</eqnref>).</p><sec-level4 id="nj308932s2.4.3.1" label="2.4.3.1"><heading>Step 3, part 1: upper bound for a given Bell-diagonal state</heading><proclaim id="nj308932pro9" type="lemma" format="num" num="9" style="italic"><heading>Lemma 5.</heading><p indent="no"> For a Bell-diagonal state <inline-eqn><math-text>ρ<sub>λ</sub></math-text></inline-eqn> with eigenvalues <inline-eqn><math-text>λ</math-text></inline-eqn> ordered as in (<eqnref linkend="nj308932eqn18">18</eqnref>) and for measurements in the <inline-eqn><math-text>(<italic>x</italic>, <italic>z</italic>)</math-text></inline-eqn> plane,
<display-eqn id="nj308932eqn27" textype="equation" notation="LaTeX" eqnnum="27"></display-eqn></p></proclaim><proclaim id="nj308932pro10" type="proof" format="unnum" style="upright"><heading>Proof.</heading><p indent="no"> Let us compute <inline-eqn><math-text><italic>S</italic>(ρ<sub><italic>E</italic>|<italic>b</italic><sub>1</sub></sub>)</math-text></inline-eqn>. First, one gives Eve the purification of <inline-eqn><math-text>ρ<sub>λ</sub></math-text></inline-eqn>:
<display-eqn id="nj308932eqn28" textype="equation" notation="LaTeX" eqnnum="28"></display-eqn>with <inline-eqn><math-text>⟨<italic>e</italic><sub><italic>i</italic></sub>|<italic>e</italic><sub><italic>j</italic></sub>⟩=δ<sub><italic>ij</italic></sub></math-text></inline-eqn>. By tracing Alice out, one obtains <inline-eqn><math-text>ρ<sub><upright>BE</upright></sub></math-text></inline-eqn>.</p><p>Now, Bob measures in the (<inline-eqn><math-text><italic>x</italic>, <italic>z</italic></math-text></inline-eqn>) plane. His measurement <inline-eqn><math-text><italic>B</italic><sub>1</sub></math-text></inline-eqn> can be written as
<display-eqn id="nj308932eqn29" textype="equation" notation="LaTeX" eqnnum="29"></display-eqn>After the measurement, the system is projected in one of the eigenstates of <inline-eqn><math-text><italic>B</italic><sub>1</sub></math-text></inline-eqn> which can be written as <inline-eqn></inline-eqn> when <inline-eqn><math-text>ϕ∈[0, π]</math-text></inline-eqn>. The case <inline-eqn><math-text>ϕ∈[π, 2π]</math-text></inline-eqn> corresponds to a flip of the outcome <inline-eqn><math-text><italic>b</italic><sub>1</sub></math-text></inline-eqn>, but as the result that follows is independent of the value of <inline-eqn><math-text><italic>b</italic><sub>1</sub></math-text></inline-eqn>, it is sufficient to consider <inline-eqn><math-text>ϕ∈[0, π]</math-text></inline-eqn>. The reduced density matrix of Eve conditioned on the value of <inline-eqn><math-text><italic>b</italic><sub>1</sub></math-text></inline-eqn> is given by
<display-eqn id="nj308932eqn30" textype="equation" notation="LaTeX" eqnnum="30"></display-eqn>where we have defined the two non-normalized states
<display-eqn id="nj308932eqn31" textype="equation" notation="LaTeX" eqnnum="31"></display-eqn>The calculation of the eigenvalues of a rank two matrix is a standard procedure. The result is that the eigenvalues of <inline-eqn><math-text>ρ<sub><upright>E</upright>|<italic>b</italic><sub>1</sub></sub></math-text></inline-eqn> are independent of <inline-eqn><math-text><italic>b</italic><sub>1</sub></math-text></inline-eqn> and are given by
<display-eqn id="nj308932eqn32" textype="equation" notation="LaTeX" eqnnum="32" lines="multiline"></display-eqn>Therefore we have obtained <inline-eqn><math-text><italic>S</italic>(ρ<sub><upright>E</upright>|<italic>b</italic><sub>1</sub>=1</sub>) =<italic>S</italic>(ρ<sub><upright>E</upright>|<italic>b</italic><sub>1</sub>=−1</sub>) =<italic>h</italic>(&Lgr;<sub>+</sub>)</math-text></inline-eqn>, that is,
<display-eqn id="nj308932eqn33" textype="equation" notation="LaTeX" eqnnum="33"></display-eqn>Now, for any set of <inline-eqn><math-text>λ</math-text></inline-eqn>'s, Eve's information is the largest for the choice of <inline-eqn><math-text>ϕ</math-text></inline-eqn> that minimizes <inline-eqn><math-text><italic>h</italic>(&Lgr;<sub>+</sub>)</math-text></inline-eqn>, which is the one for which the difference <inline-eqn><math-text>&Lgr;<sub>+</sub>−&Lgr;<sub>−</sub></math-text></inline-eqn> is the largest. Because of (<eqnref linkend="nj308932eqn22">22</eqnref>), the product <inline-eqn><math-text>(λ<sub>&PHgr;<sup>+</sup></sub>−λ<sub>&PSgr;<sup>−</sup></sub>)(λ<sub>&PHgr;<sup>−</sup></sub>−λ<sub>&PSgr;<sup>+</sup></sub>)</math-text></inline-eqn> is non-negative and the maximum is obtained for <inline-eqn><math-text>ϕ=0</math-text></inline-eqn>, i.e. <inline-eqn><math-text><italic>B</italic><sub>1</sub>=σ<sub><italic>z</italic></sub></math-text></inline-eqn>. This gives the upper bound that we wanted:
<display-eqn id="nj308932eqn34" textype="equation" notation="LaTeX" eqnnum="34"></display-eqn></p></proclaim></sec-level4><sec-level4 id="nj308932s2.4.3.2" label="2.4.3.2"><heading>Step 3, part 2: entropic inequality</heading><proclaim id="nj308932pro11" type="lemma" format="num" style="italic"><heading>Lemma 6.</heading><p indent="no"> Let <inline-eqn></inline-eqn> be probabilities, i.e. <inline-eqn><math-text>λ<sub>&PHgr;<sup>+</sup></sub>, λ<sub>&PHgr;<sup>−</sup></sub>, λ<sub>&PSgr;<sup>+</sup></sub>, λ<sub>&PSgr;<sup>−</sup></sub>⩾0</math-text></inline-eqn> and <inline-eqn><math-text>λ<sub>&PHgr;<sup>+</sup></sub>+λ<sub>&PHgr;<sup>−</sup></sub>+λ<sub>&PSgr;<sup>+</sup></sub>+λ<sub>&PSgr;<sup>−</sup></sub>=1</math-text></inline-eqn>. Let <inline-eqn><math-text><italic>R</italic><sup>2</sup>=(λ<sub>&PHgr;<sup>+</sup></sub>−λ<sub>&PSgr;<sup>−</sup></sub>)<sup>2</sup>+(λ<sub>&PHgr;<sup>−</sup></sub>−λ<sub>&PSgr;<sup>+</sup></sub>)<sup>2</sup></math-text></inline-eqn>. Then
<display-eqn id="nj308932eqn35" textype="equation" notation="LaTeX" eqnnum="35"></display-eqn><display-eqn id="nj308932eqn36" textype="equation" notation="LaTeX" eqnnum="36"></display-eqn>with equality in equation (<eqnref linkend="nj308932eqn35">35</eqnref>) if and only if <inline-eqn><math-text>λ<sub>&PHgr;<sup>±</sup></sub>=0</math-text></inline-eqn> or <inline-eqn><math-text>λ<sub>&PSgr;<sup>±</sup></sub>=0</math-text></inline-eqn>.</p></proclaim><proclaim id="nj308932pro12" type="proof" format="unnum" style="upright"><heading>Proof.</heading><p indent="no">We can parameterize the <inline-eqn><math-text>λ</math-text></inline-eqn>'s as
<display-eqn id="nj308932eqn37" textype="equation" notation="LaTeX" eqnnum="37" lines="multiline"></display-eqn>The conditions <inline-eqn><math-text>λ<sub>&PHgr;<sup>+</sup></sub>, λ<sub>&PHgr;<sup>−</sup></sub>, λ<sub>&PSgr;<sup>+</sup></sub>, λ<sub>&PSgr;<sup>−</sup></sub>⩾0</math-text></inline-eqn> imply
<display-eqn id="nj308932eqn38" textype="equation" notation="LaTeX" eqnnum="38"></display-eqn>There is a solution for <inline-eqn><math-text>δ</math-text></inline-eqn> if and only if
<display-eqn id="nj308932eqn39" textype="equation" notation="LaTeX" eqnnum="39"></display-eqn>This condition is non-trivial if <inline-eqn></inline-eqn>.</p><p>When <inline-eqn></inline-eqn>, the extremal values of <inline-eqn><math-text>&thetas;</math-text></inline-eqn>, the solutions of <inline-eqn></inline-eqn>, correspond to <inline-eqn><math-text>λ<sub>&PHgr;<sup>+</sup></sub>=0</math-text></inline-eqn> or <inline-eqn><math-text>λ<sub>&PSgr;<sup>−</sup></sub>=0</math-text></inline-eqn>, and <inline-eqn><math-text>λ<sub>&PHgr;<sup>−</sup></sub>=0</math-text></inline-eqn> or <inline-eqn><math-text>λ<sub>&PSgr;<sup>+</sup></sub>=0</math-text></inline-eqn>. When both <inline-eqn><math-text>λ<sub>&PHgr;<sup>±</sup></sub>=0</math-text></inline-eqn> or both <inline-eqn><math-text>λ<sub>&PSgr;<sup>±</sup></sub>=0</math-text></inline-eqn>, <inline-eqn></inline-eqn> and one has equality in equation (<eqnref linkend="nj308932eqn35">35</eqnref>). In the other cases, <inline-eqn></inline-eqn> and inequality (<eqnref linkend="nj308932eqn35">35</eqnref>) is satisfied. Our strategy is to prove that when <inline-eqn></inline-eqn>, the maximum of <inline-eqn></inline-eqn> occurs when <inline-eqn></inline-eqn>, i.e. at the edge of the allowed domain for <inline-eqn><math-text>&thetas;</math-text></inline-eqn>. This will establish (<eqnref linkend="nj308932eqn35">35</eqnref>).</p><p>Let us start by finding the maximum of <inline-eqn><math-text><italic>F</italic></math-text></inline-eqn> for fixed <inline-eqn><math-text><italic>R</italic></math-text></inline-eqn> and <inline-eqn><math-text>&thetas;</math-text></inline-eqn>. To this end, we compute the derivative of <inline-eqn><math-text><italic>F</italic></math-text></inline-eqn> with respect to <inline-eqn><math-text>δ</math-text></inline-eqn>:
<display-eqn id="nj308932eqn40" textype="equation" notation="LaTeX" eqnnum="40"></display-eqn>The derivative with respect to <inline-eqn><math-text>δ</math-text></inline-eqn> vanishes if and only if <inline-eqn><math-text>λ<sub>&PHgr;<sup>+</sup></sub>λ<sub>&PSgr;<sup>−</sup></sub>=λ<sub>&PHgr;<sup>−</sup></sub>λ<sub>&PSgr;<sup>+</sup></sub></math-text></inline-eqn>, which is equivalent to
<display-eqn id="nj308932eqn41" textype="equation" notation="LaTeX" eqnnum="41"></display-eqn>Note that <inline-eqn><math-text>δ<sup>*</sup>(&thetas;)</math-text></inline-eqn> always belongs to the domain (<eqnref linkend="nj308932eqn38">38</eqnref>) for <inline-eqn><math-text>&thetas;</math-text></inline-eqn> satisfying (<eqnref linkend="nj308932eqn39">39</eqnref>), i.e. it is an extremum of <inline-eqn><math-text><italic>F</italic></math-text></inline-eqn>. We also have that
<display-eqn id="nj308932eqn42" textype="equation" notation="LaTeX" eqnnum="42"></display-eqn>which shows that <inline-eqn><math-text>δ<sup>*</sup>(&thetas;)</math-text></inline-eqn> is a maximum of <inline-eqn><math-text><italic>F</italic></math-text></inline-eqn> (not a minimum).</p><p>We have thus identified the unique maximum of <inline-eqn><math-text><italic>F</italic></math-text></inline-eqn> at fixed <inline-eqn><math-text>&thetas;</math-text></inline-eqn>. Let us now take the optimal value of <inline-eqn><math-text>δ=δ<sup>*</sup>(&thetas;)</math-text></inline-eqn>, and let <inline-eqn><math-text>&thetas;</math-text></inline-eqn> vary. We compute the derivative of <inline-eqn><math-text><italic>F</italic></math-text></inline-eqn> with respect to <inline-eqn><math-text>&thetas;</math-text></inline-eqn> along the curve <inline-eqn><math-text>δ=δ<sup>*</sup>(&thetas;)</math-text></inline-eqn>:
<display-eqn id="nj308932eqn43" textype="equation" notation="LaTeX" eqnnum="43" lines="multiline"></display-eqn>Now, when <inline-eqn><math-text>δ=δ<sup>*</sup></math-text></inline-eqn>, we have the identities
<display-eqn id="nj308932eqn44" textype="equation" notation="LaTeX" eqnnum="44"></display-eqn>and
<display-eqn id="nj308932eqn45" textype="equation" notation="LaTeX" eqnnum="45"></display-eqn>Using these relations, we obtain
<display-eqn id="nj308932eqn46" textype="equation" notation="LaTeX" eqnnum="46"></display-eqn>This quantity vanishes (i.e. we have an extremum) if and only if <inline-eqn><math-text><upright>cos</upright> &thetas;+<upright>sin</upright> &thetas;=0</math-text></inline-eqn> or <inline-eqn><math-text><upright>cos</upright> &thetas;−<upright>sin</upright> &thetas;=0</math-text></inline-eqn>, that is, <inline-eqn><math-text>&thetas;=±π/4, ±3π/4</math-text></inline-eqn>.</p><p>When <inline-eqn></inline-eqn> the points <inline-eqn><math-text>&thetas;=±π/4, ±3π/4</math-text></inline-eqn> lie outside the allowed domain for <inline-eqn><math-text>&thetas;</math-text></inline-eqn>. Hence the maximum of <inline-eqn><math-text><italic>G</italic></math-text></inline-eqn> occurs when <inline-eqn><math-text>&thetas;</math-text></inline-eqn> lies at the edge of its allowed domain. As discussed above, this proves our claim when <inline-eqn></inline-eqn>.</p><p>When <inline-eqn></inline-eqn>, the extrema can be reached. Note that <inline-eqn><math-text>&thetas;=±π/4, ±3π/4</math-text></inline-eqn> implies <inline-eqn><math-text>δ<sup>*</sup>=0</math-text></inline-eqn>. One then easily checks that the maximum of <inline-eqn><math-text><italic>F</italic></math-text></inline-eqn> occurs when <inline-eqn><math-text>&thetas;=π/4, −3π/4</math-text></inline-eqn>, whereupon <inline-eqn><math-text><italic>F</italic>=1</math-text></inline-eqn>. This establishes equation (<eqnref linkend="nj308932eqn36">36</eqnref>).</p></proclaim></sec-level4><sec-level4 id="nj308932s2.4.3.3" label="2.4.3.3"><heading>Step 3, part 3: violation of CHSH</heading><proclaim id="nj308932pro13" type="lemma" format="num" num="13" style="italic"><heading>Lemma 7.</heading><p indent="no"> The maximal violation <inline-eqn><math-text><italic>S</italic><sub>λ</sub></math-text></inline-eqn> of the CHSH inequality for a Bell-diagonal state <inline-eqn><math-text>ρ<sub>λ</sub></math-text></inline-eqn> given by (<eqnref linkend="nj308932eqn17">17</eqnref>) with eigenvalues ordered according to (<eqnref linkend="nj308932eqn18">18</eqnref>) is
<display-eqn id="nj308932eqn47" textype="equation" notation="LaTeX" eqnnum="47"></display-eqn></p></proclaim><proclaim id="nj308932pro14" type="proof" format="unnum" style="upright"><heading>Proof.</heading><p indent="no"> For any given two-qubit state <inline-eqn><math-text>ρ</math-text></inline-eqn>, the maximum value of the CHSH expression can be computed using the following recipe [<cite linkend="nj308932bib25">25</cite>]: let <inline-eqn><math-text><italic>T</italic></math-text></inline-eqn> be the tensor with entries <inline-eqn></inline-eqn>, and let <inline-eqn><math-text>τ<sub>1</sub></math-text></inline-eqn> and <inline-eqn><math-text>τ<sub>2</sub></math-text></inline-eqn> be the two largest eigenvalues of the symmetric matrix <inline-eqn><math-text><italic>T</italic><sup><italic>T</italic></sup><italic>T</italic></math-text></inline-eqn>. Then, for optimal measurement <inline-eqn></inline-eqn>.</p><p>We are working with the Bell-diagonal state (<eqnref linkend="nj308932eqn17">17</eqnref>), for which
<display-eqn id="nj308932eqn48" textype="equation" notation="LaTeX" eqnnum="48" lines="multiline"></display-eqn>Taking into account the order (<eqnref linkend="nj308932eqn18">18</eqnref>), one has <inline-eqn><math-text><italic>T</italic><sub><italic>zz</italic></sub>⩾|<italic>T</italic><sub><italic>xx</italic></sub>|</math-text></inline-eqn>. Hence either
<display-eqn id="nj308932eqn49" textype="equation" notation="LaTeX" eqnnum="49"></display-eqn>or
<display-eqn id="nj308932eqn50" textype="equation" notation="LaTeX" eqnnum="50"></display-eqn></p></proclaim><p>We can now provide the proof of lemma <textref linkend="nj308932pro8">4</textref>.</p><proclaim id="nj308932pro15" type="proof" format="unnum" style="upright"><heading>Proof of lemma 4.</heading><p indent="no">In the case that <inline-eqn><math-text><italic>S</italic><sub>λ</sub></math-text></inline-eqn> is equal to the first expression in (<eqnref linkend="nj308932eqn47">47</eqnref>), lemma <textref linkend="nj308932pro8">4</textref> immediately follows from combining lemmas <textref linkend="nj308932pro9">5</textref> and <textref linkend="nj308932pro11">6</textref>, since <inline-eqn></inline-eqn>. Note that the threshold <inline-eqn><math-text><italic>R</italic><sup>2</sup>=1/2</math-text></inline-eqn> in lemma <textref linkend="nj308932pro9">5</textref> corresponds to the threshold for violating the CHSH inequality.</p><p>In the other case, we once again combine lemmas <textref linkend="nj308932pro9">5</textref> and <textref linkend="nj308932pro11">6</textref>, and note that the function <inline-eqn><math-text><italic>F</italic></math-text></inline-eqn> in lemma <textref linkend="nj308932pro9">5</textref> is invariant under permutation of <inline-eqn><math-text>λ<sub>&PSgr;<sup>+</sup></sub></math-text></inline-eqn> and <inline-eqn><math-text>λ<sub>&PSgr;<sup>−</sup></sub></math-text></inline-eqn> with <inline-eqn><math-text>λ<sub>&PHgr;<sup>+</sup></sub></math-text></inline-eqn>, <inline-eqn><math-text>λ<sub>&PHgr;<sup>−</sup></sub></math-text></inline-eqn> fixed.</p></proclaim></sec-level4></sec-level3><sec-level3 id="nj308932s2.4.4" label="2.4.4"><heading>Step 4: convexity argument.</heading><p indent="no">To conclude the proof of the theorem, note that if Eve sends a mixture of Bell-diagonal states <inline-eqn></inline-eqn> and chooses the measurements to be in the <inline-eqn><math-text>(<italic>x</italic>, <italic>z</italic>)</math-text></inline-eqn> plane, then <inline-eqn></inline-eqn>. Using (<eqnref linkend="nj308932eqn25">25</eqnref>), we then find that <inline-eqn></inline-eqn>, where the last inequality holds because <inline-eqn><math-text><italic>F</italic></math-text></inline-eqn> is concave. But since the observed violation <inline-eqn><math-text><italic>S</italic></math-text></inline-eqn> of CHSH is necessarily such that <inline-eqn></inline-eqn> and since <inline-eqn><math-text><italic>F</italic></math-text></inline-eqn> is a monotonically decreasing function, we find that <inline-eqn><math-text>χ(<italic>B</italic><sub>1</sub>:<italic>E</italic>)⩽<italic>F</italic>(<italic>S</italic>)</math-text></inline-eqn>.</p></sec-level3></sec-level2><sec-level2 id="nj308932s2.5" label="2.5"><heading>Derivation of bound (<eqnref linkend="nj308932eqn13">13</eqnref>) in the standard scenario</heading><p indent="no">In the standard scenario, Alice and Bob know that they are measuring qubits and have set their measurement settings in the best possible way for the reference state <inline-eqn><math-text>|&PHgr;<sup>+</sup>⟩</math-text></inline-eqn>. We assume one such possible choice (all the others being equivalent), the one specified in section <secref linkend="nj308932s2.1">2.1</secref>: <inline-eqn><math-text><italic>A</italic><sub>0</sub>=<italic>B</italic><sub>1</sub>=σ<sub><italic>z</italic></sub></math-text></inline-eqn>, <inline-eqn></inline-eqn>, <inline-eqn></inline-eqn>, <inline-eqn><math-text><italic>B</italic><sub>2</sub>=σ<sub><italic>x</italic></sub></math-text></inline-eqn>. Thus the CHSH polynomial becomes
<display-eqn id="nj308932eqn51" textype="equation" notation="LaTeX" eqnnum="51"></display-eqn>The calculation of the unconditional security bound follows exactly the usual one, as presented for instance in appendix A of [<cite linkend="nj308932bib26">26</cite>]. As is well known, in the usual BB84 protocol, the measured parameters are the error rate in the <inline-eqn><math-text><italic>Z</italic></math-text></inline-eqn> and in the <inline-eqn><math-text><italic>X</italic></math-text></inline-eqn> basis, <inline-eqn><math-text>ϵ<sub><italic>z</italic>, <italic>x</italic></sub></math-text></inline-eqn>; if the <inline-eqn><math-text><italic>Z</italic></math-text></inline-eqn> basis is used for the key and the <inline-eqn><math-text><italic>X</italic></math-text></inline-eqn> basis for parameter estimation, Eve's information is bounded by
<display-eqn id="nj308932eqn52" textype="equation" notation="LaTeX" eqnnum="52"></display-eqn></p><p>In our case, <inline-eqn><math-text>ϵ<sub><italic>z</italic></sub>=<italic>Q</italic></math-text></inline-eqn>; but instead of <inline-eqn><math-text>ϵ<sub><italic>x</italic></sub></math-text></inline-eqn>, the parameter from which Eve's information is inferred is the average value <inline-eqn><math-text><italic>S</italic></math-text></inline-eqn> of the CHSH polynomial. Given (<eqnref linkend="nj308932eqn51">51</eqnref>), the evaluation of <inline-eqn><math-text><italic>S</italic></math-text></inline-eqn> on a Bell-diagonal state is straightforward: <inline-eqn></inline-eqn>. Now, with the parameterization <inline-eqn><math-text>λ<sub>1</sub>=(1−ϵ<sub><italic>z</italic></sub>)(1−<italic>u</italic>)</math-text></inline-eqn> and <inline-eqn><math-text>λ<sub>4</sub>=ϵ<sub><italic>z</italic></sub><italic>v</italic></math-text></inline-eqn>, we immediately obtain <inline-eqn><math-text>λ<sub>1</sub>−λ<sub>4</sub>=1−ϵ<sub><italic>z</italic></sub>−[(1−ϵ<sub><italic>z</italic></sub>)<italic>u</italic>+ϵ<sub><italic>z</italic></sub><italic>v</italic>]=1−ϵ<sub><italic>z</italic></sub>−ϵ<sub><italic>x</italic></sub></math-text></inline-eqn> because of equation (A7) of [<cite linkend="nj308932bib26">26</cite>]. Therefore <inline-eqn></inline-eqn>, i.e.
<display-eqn id="nj308932eqn53" textype="equation" notation="LaTeX" eqnnum="53"></display-eqn>Since <inline-eqn><math-text><italic>h</italic>(ϵ<sub><italic>x</italic></sub>)=<italic>h</italic>(1−ϵ<sub><italic>x</italic></sub>)</math-text></inline-eqn>, this leads immediately to (<eqnref linkend="nj308932eqn13">13</eqnref>).</p></sec-level2></sec-level1><sec-level1 id="nj308932s3" label="3"><heading>Loopholes in Bell experiments and DIQKD</heading><p indent="no">The security of our protocol, like the security of any DIQKD protocol, relies on the violation of a Bell inequality. All experimental tests of Bell inequalities that have been made so far, however, are subject to at least one of several loopholes and therefore admit in principle a local description. We discuss here how these loopholes can impact DIQKD protocols.</p><sec-level2 id="nj308932s3.1" label="3.1"><heading>Loopholes in Bell experiments</heading><p indent="no">Basically, a loophole-free Bell experiment requires two ingredients: (i) no information about the input of one party should be known to the other party before she has produced her output; and (ii) high enough detection efficiencies.</p><p>If the first requirement is not fulfilled, the premises of Bell's theorem are not satisfied and it is trivial for a classical model to account for the apparent non-locality of the observed correlations. In practice, this means that the measurements should be carried out sufficiently fast and far apart from each other so that no sub-luminal influence can propagate from the choice of measurement on one wing to the measurement outcome on the other wing. Additionally, the local choices of measurement should not be determined in advance, i.e. they should be truly random events. Failure to satisfy one of these two conditions is known as the locality loophole [<cite linkend="nj308932bib5">5</cite>].</p><p>The second requirement arises from the fact that in practice not all signals are detected by the measuring devices, either because of inefficiencies in the devices themselves, or because of particle losses on the path from the source to the detectors. The detection loophole [<cite linkend="nj308932bib27">27</cite>] exploits the idea that it is a local variable that determines whether a signal will be registered or not. The particle is detected only if the setting of the measuring device is in agreement with a predetermined scheme. In this way, apparently non-local correlations can be reproduced by a purely local model provided that the efficiency <inline-eqn><math-text>η</math-text></inline-eqn> of the detectors is below a certain threshold. In general the efficiency necessary to rule out a local description depends on the Bell inequality that is tested, and is quite high for Bell inequalities with low numbers of inputs and outputs (for the CHSH inequality, one must have <inline-eqn><math-text>η>82.8%</math-text></inline-eqn>). It is an open question whether there exist Bell inequalities (with reasonably many inputs and outputs) allowing significantly lower detection efficiencies (see e.g. [<cite linkend="nj308932bib28">28</cite>]–[<cite linkend="nj308932bib30">30</cite>]). From the point of view of the data analysis, to decide whether an experiment with an inefficient detector has produced a genuine violation of a Bell inequality, all measurement events, including no-detection events, should be taken into account in the non-locality test.</p><p>All Bell experiments performed so far suffer from (at least) one of the above two loopholes. On the one hand, photonic experiments can close the locality loophole [<cite linkend="nj308932bib31">31</cite>]–[<cite linkend="nj308932bib33">33</cite>], but cannot reach the desired detection efficiencies. On the other hand, experiments carried out on entangled ions [<cite linkend="nj308932bib34">34</cite>, <cite linkend="nj308932bib35">35</cite>] manage to close the detection loophole, but are unsatisfactory from the point of view of locality. Note that other loopholes or variants of the above loophole have also been identified, such as the coincidence-time loophole [<cite linkend="nj308932bib36">36</cite>], but these are not as problematic.</p></sec-level2><sec-level2 id="nj308932s3.2" label="3.2"><heading>Loopholes from the perspective of DIQKD</heading><p indent="no">When considering the implications of these loopholes for DIQKD, a first point to realize is that they are mainly a technological problem, but do not in any way undermine the concept of DIQKD itself. An eavesdropper trying to exploit one of the above loopholes would clearly have to tamper with Alice's and Bob's devices, but it is not necessary for Alice and Bob to ‘trust’ or characterize the inner working of their devices to be sure that all loopholes are closed. This can be decided solely by looking at the classical input–output relations produced by the quantum devices (and possibly their timing). In other words, we do not have to leave the paradigm of DIQKD to guarantee the security of the protocol (although of course with present-day technology it might be difficult to construct devices that pass such security tests).</p><p>A second important observation is that there is a fundamental difference between a Bell experiment whose aim is to establish the non-local character of Nature and a QKD scheme based on the violation of a Bell inequality. In the first case, we are trying to rule out a whole set of models of Nature (including models that can overcome the laws of physics as they are currently known), while in the second case, we are merely fighting an eavesdropper limited by the laws of quantum physics.</p><p>Seen in this light, the locality loophole is not problematic in our context. In usual Bell experiments, the locality loophole is dealt with by enforcing a space-like separation between Alice and Bob. This guarantees that no sub-luminal signals (including signals mediated by some yet-unknown theory) could have traveled between Alice's and Bob's devices. In the context of DIQKD, it is sufficient to guarantee that no quantum signals (e.g. no photon) can travel from Alice to Bob. This can be enforced by a proper isolation of Alice's and Bob's locations. As stated in section <secref linkend="nj308932s1.1">1.1</secref>, we make here the basic assumption, shared by usual QKD and without which cryptography would not make any sense, that Alice's and Bob's locations are secure, in the sense that no unwanted information can leak out to the outside. Whether this condition is fulfilled is an important question in practice, but it is totally alien to QKD, whose aim is to establish a secret key between two parties given that this assumption is satisfied. In a similar way, we assume here, as in usual QKD, that Alice and Bob choose their measuring settings with trusted random number generators whose outputs are unknown to Eve. The locality loophole is thus not a fundamental loophole in the context of DIQKD and can be dealt with using today's technology.</p><p>The detection loophole, on the other hand, is a much more complicated issue. Experimental tests of non-locality circumvent this problem by discarding no-detection events and recording only the events where both measuring devices have produced an answer. This amounts to performing a post-selection on the measurement data. This post-selection is usually justified by the fair sampling assumption, which says that the sample of detected particles is a fair sample of the set of all particles, i.e. that there are no correlations between the state of the particles and their detection probability. Although it may be very reasonable to expect such a condition to hold for any realistic model of Nature, it is clearly unjustified in the context of DIQKD, where we assume that the quantum devices are provided by an untrusted party [<cite linkend="nj308932bib37">37</cite>, <cite linkend="nj308932bib38">38</cite>]. In our context, it is thus crucial to close the detection loophole. This has already been done for some experiments [<cite linkend="nj308932bib34">34</cite>, <cite linkend="nj308932bib35">35</cite>] although not yet on distances relevant for QKD.</p><p>Note that a proper security analysis of DIQKD with inefficient detectors has to take into account all measurement outcomes produced by the devices, which in our case would include the outcomes ‘1’, ‘<inline-eqn><math-text>−1</math-text></inline-eqn>’, and the no-detection outcome ‘<inline-eqn><math-text>⊥</math-text></inline-eqn>’. A possible strategy to apply our proof to this new situation simply consists of viewing the absence of a click ‘<inline-eqn><math-text>⊥</math-text></inline-eqn>’ as a ‘<inline-eqn><math-text>−1</math-text></inline-eqn>’ outcome, thus replacing a three-output device by an effective two-output device. To give an idea of the amount of detection inefficiency that can be tolerated in this way, we have plotted in figure <figref linkend="nj308932fig3">3</figref> the key rate as a function of the efficiency of the detectors for the ideal set of quantum correlations that give the maximal violation of the CHSH inequality, obtained when measuring a <inline-eqn><math-text>|&phis;<sup>+</sup>⟩</math-text></inline-eqn> state. The key rate is given by equation (<eqnref linkend="nj308932eqn12">12</eqnref>) with <inline-eqn><math-text><italic>Q</italic>=η(1−η)</math-text></inline-eqn> and <inline-eqn></inline-eqn>.</p><figure id="nj308932fig3" parts="single" width="column" position="float" pageposition="top" printstyle="normal" orientation="port"><graphic position="indented"><graphic-file version="print" format="EPS" width="22.3pc" printcolour="no" filename="images/nj308932fig3.eps"></graphic-file><graphic-file version="ej" format="JPEG" printcolour="yes" filename="images/nj308932fig3.jpg"></graphic-file></graphic><caption type="figure" id="nj308932fc3" label="Figure 3"><p indent="no">Key rate as a function of detection efficiency for the ideal correlations coming from the maximally entangled state <inline-eqn><math-text>|&phis;<sup>+</sup>⟩</math-text></inline-eqn> and satisfying <inline-eqn><math-text><italic>Q</italic>=0</math-text></inline-eqn> and <inline-eqn></inline-eqn>, obtained by replacing the absence of a click by the outcome <inline-eqn><math-text>−1</math-text></inline-eqn>. The efficiency threshold above which a positive key rate can be extracted is <inline-eqn><math-text>η=0.924</math-text></inline-eqn>.</p></caption></figure></sec-level2><sec-level2 id="nj308932s3.3" label="3.3"><heading>Ideas for overcoming the detection loophole</heading><p indent="no">As mentioned above, the experiment of [<cite linkend="nj308932bib35">35</cite>], which is based on entanglement swapping between two ions separated by about 1 m, is immune to the detection loophole. A natural way to implement our DIQKD protocol would thus be to improve this experiment. This would require not only extending the distance between the ions, but also improving the visibility and significantly improving the data rate (currently one event every 39 s). This approach could of course in principle also be implemented with neutral atoms, quantum dots, etc. Here, we discuss ideas on how the problem of the detection loophole could be solved (at least partially) within an all photonic implementation, using heralded quantum memories and trusted detectors.</p><p>In a realistic QKD scenario there are basically two kinds of losses that should be studied separately: line losses and detector losses. Line losses are due (in practice) to the imperfections of the quantum channel between Alice and Bob. However, as far as the theoretical security analysis is concerned, these losses should be assumed to be the result of Eve's actions, since Alice and Bob do not control the quantum channel. One possibility for Alice and Bob to overcome this problem is to use heralded quantum memories. Using this technique, Alice and Bob can know whether their respective memory device is loaded or not, that is, whether a photon really arrived at their device or not. In the case where both memories are loaded, they release the photons and perform their measurements. This procedure thus implements a kind of quantum non-demolition measurement of the incoming states, which allows Alice and Bob to get rid of the losses of the quantum channel. This should be realizable within a few years, thanks to the development of quantum repeaters [<cite linkend="nj308932bib39">39</cite>, <cite linkend="nj308932bib40">40</cite>].</p><p>The second type of losses, the detector losses, is probably more crucial. We can, however, consider the situation where Alice's and Bob's detectors are not part of the uncharacterized quantum devices. That is, the quantum devices of Alice and Bob are viewed as black boxes that receive some classical input and produce an output signal which is later detected, and transformed into the final classical outcome, by a separate detector<fnref linkend="nj308932fn9"><sup>9</sup></fnref>. The detectors may be assumed to be trusted by and under the control of Alice and Bob or they can be tested independently from the rest of the quantum devices. Alice and Bob can for instance do a tomography of their quantum detectors [<cite linkend="nj308932bib41">41</cite>]–[<cite linkend="nj308932bib44">44</cite>], which consists of determining the measurement that these detectors actually perform. Such detector tomography, which has been recently demonstrated experimentally in [<cite linkend="nj308932bib44">44</cite>], clearly limits Eve's ability to exploit the detection loophole. This kind of analysis may require us to elaborate counter-measures against some sort of trojan-horse attacks on the detectors, in which Alice's device (manufactured by Eve) sometimes sends nothing and sometimes sends bright pulses in order to ensure that a detection occurs. We believe that the power of such attacks can be severely constrained by placing multiple detectors instead of one at each output mode of Alice's and Bob's devices [<cite linkend="nj308932bib45">45</cite>].</p><p>In the scenario that we outlined in the preceding paragraph, we have made a move to a situation that is intermediate between usual QKD, where all devices are assumed to be trusted, and DIQKD, where all quantum devices are untrusted. In this new situation, Alice and Bob either need to trust their detectors (in the same way as they trust their random number generators or the classical devices) or need to test them with a trusted calibration device (that they should get from a different provider than Eve). Whether this is a reasonable or practical scenario to consider depends on the respective difficulty of testing the detectors versus the entire quantum devices, and on the advantages that may follow from trusting part of the quantum devices (this may still allow us for instance to forget about side channels or imperfections in the measurement bases).</p></sec-level2></sec-level1><sec-level1 id="nj308932s4" label="4"><heading>Discussion and open questions</heading><p indent="no">Identifying the minimal set of physical assumptions allowing secure key distribution is a fascinating problem, from both a fundamental and an applied point of view. DIQKD possibly represents the ultimate step in this direction, since its security relies only on a fundamental set of basic assumptions: (i) access to secure locations, (ii) trusted randomness, (iii) trusted classical processing devices, (iv) an authenticated classical channel, (v) and finally the general validity of a physical theory, quantum theory. In this work, we have shown that for the restricted scenario of collective attacks, secure DIQKD is indeed possible. There remain, however, plenty of interesting open questions in the device-independent scenario.</p><p>From an applied point of view, the most relevant questions are related to loopholes in Bell tests, particularly the detection loophole, as discussed in section <secref linkend="nj308932s3">3</secref>. The detection loophole, usually seen mostly as a foundational problem, thus becomes a relevant issue from an applied perspective, with important implications for cryptography<fnref linkend="nj308932fn10"><sup>10</sup></fnref>. From a theoretical point of view, it would be highly desirable to extend the security proof presented here to other scenarios, the ultimate goal being a general security proof. We list below several possible directions to extend our results.</p><itemized-list id="list3" type="bullet" style="hanging"><list-item id="list3-i9"><p>As we have discussed, the violation of a Bell inequality represents a necessary condition for secure DIQKD. It would be interesting, then, to consider other protocols, based on different Bell inequalities, even under the additional assumption of collective attacks. Some interesting questions are: (i) How does the security of DIQKD change when using larger alphabets, especially when compared with standard QKD [<cite linkend="nj308932bib47">47</cite>]–[<cite linkend="nj308932bib49">49</cite>]? (ii) Can one establish more general relations bounding Eve's information from the amount of Bell inequality violation observed?</p></list-item><list-item id="list3-i10"><p>A key ingredient in our security proof is the fact that it is possible to reduce the whole analysis to a two-qubit optimization problem. This is because any pair of quantum binary measurements can be decomposed as the direct sum of pairs of measurements acting on two-dimensional spaces. Do similar results exist for more complex scenarios? More generally, are all possible bipartite quantum correlations for <inline-eqn><math-text><italic>m</italic></math-text></inline-eqn> measurements of <inline-eqn><math-text><italic>n</italic></math-text></inline-eqn> outcomes, for finite <inline-eqn><math-text><italic>m</italic></math-text></inline-eqn> and <inline-eqn><math-text><italic>n</italic></math-text></inline-eqn>, attainable by measuring finite-dimensional systems [<cite linkend="nj308932bib50">50</cite>]? Some progress on this question was recently obtained in [<cite linkend="nj308932bib51">51</cite>, <cite linkend="nj308932bib52">52</cite>], where it was shown that infinite dimensional systems are needed to generate all two-outcome (<inline-eqn><math-text><italic>n</italic>=2</math-text></inline-eqn>) quantum correlations, thus proving a conjecture made in [<cite linkend="nj308932bib53">53</cite>]. The proof of this result, however, is only valid when <inline-eqn></inline-eqn>.</p></list-item><list-item id="list3-i11"><p>Our security analysis works for the case of one-way reconciliation protocols. How is the security of the protocol modified when two-way reconciliation techniques are considered? Does then a Bell inequality violation represent a sufficient condition for security? In this direction, it was shown in [<cite linkend="nj308932bib54">54</cite>] that all correlations violating a Bell inequality contain some form of secrecy, although not necessarily distillable into a key.</p></list-item><list-item id="list3-i12"><p>In the spirit of removing the largest number of assumptions necessary for the security of QKD, an interesting extension has been anticipated by Kofler <italic>et al</italic> [<cite linkend="nj308932bib55">55</cite>]. They noticed that quantum cryptography may be secure even when one allows the eavesdropper to have partial information about the measurement settings. To illustrate this scenario on our protocol, we suppose that in each run Eve has some probability of making a correct guess on the choice of measurement settings. The best way to model this situation from the perspective of Eve is to have an additional bit <inline-eqn><math-text><italic>f</italic></math-text></inline-eqn> (‘flag’) such that <inline-eqn><math-text><italic>f</italic>=1</math-text></inline-eqn> guarantees her guess to be correct, while <inline-eqn><math-text><italic>f</italic>=0</math-text></inline-eqn> implies that her guess is uncorrelated with the real settings: indeed, any scenario with partial knowledge may be obtained by Eve forgetting the value of <inline-eqn><math-text><italic>f</italic></math-text></inline-eqn>. We suppose that the case <inline-eqn><math-text><italic>f</italic>=1</math-text></inline-eqn> happens with probability <inline-eqn><math-text><italic>q</italic></math-text></inline-eqn> and <inline-eqn><math-text><italic>f</italic>=0</math-text></inline-eqn> with probability <inline-eqn><math-text>1−<italic>q</italic></math-text></inline-eqn>. When Eve has full information on Bob's measurement choice, she can fix in advance Alice's and Bob's outcome while at the same time engineering a violation of CHSH up to the algebraic limit of 4. If Eve follows this strategy, the observed violation will then be <inline-eqn><math-text><italic>S</italic>=4<italic>q</italic>+(1−<italic>q</italic>)<italic>S</italic>′</math-text></inline-eqn> and the security bound will be given by
<display-eqn id="nj308932eqn54" textype="equation" notation="LaTeX" eqnnum="54"></display-eqn>This proves that there cannot be any security if <inline-eqn></inline-eqn>. It would be interesting to consider more elaborate situations, e.g. those in which Eve may have partial information about sequences of measurement settings.</p></list-item><list-item id="list3-i13"><p>In standard QKD, it is known that security against collective attacks implies security against the most general type of attacks. This follows from an application of the exponential quantum De Finetti theorem of [<cite linkend="nj308932bib56">56</cite>], but can also be proved through a direct argument [<cite linkend="nj308932bib16">16</cite>]. Does a similar result hold in the device-independent scenario? In particular can the exponential de Finetti theorem [<cite linkend="nj308932bib56">56</cite>] be extended to the device-independent scenario? If this was the case, our security proof would automatically be promoted to a general security proof. Some preliminary results in this direction have been obtained in [<cite linkend="nj308932bib57">57</cite>, <cite linkend="nj308932bib58">58</cite>], where two different versions of a de Finetti theorem for general no-signaling probability distributions were derived.</p><p>Or could it be that collective attacks are strictly weaker than general attacks in the device-independent scenario? Here the main difficulty of deriving a general security proof is that, contrary to standard QKD, the devices may behave in a way that depends on previous inputs and outputs. In particular, the measurement setting could be different in each round and depend on the results of previous measurements. It is not clear what role such memory effects play in the device-independent scenario, and whether it would be possible to find an explicit attack exploiting them that would outperform any collective (hence memoryless) attack.</p></list-item><list-item id="list3-i14"><p>A final possibility would be to adapt the techniques developed in [<cite linkend="nj308932bib13">13</cite>, <cite linkend="nj308932bib14">14</cite>], valid for the general case of no-signaling correlations, to the quantum scenario. The results of these works prove the security of QKD protocols against eavesdroppers limited only by the no-signaling principle. Unfortunately, the corresponding key rates and noise resistance are at present impractical when applied to correlations that can be obtained by measuring quantum states. A natural question then is: how can one incorporate the constraints associated with the quantum formalism into these techniques in order to obtain better key rates and better noise resistance for quantum correlations?</p></list-item></itemized-list></sec-level1><acknowledgment><heading>Acknowledgments</heading><p indent="no">We are grateful to C Branciard, I Cirac, A Ekert, A Kent, Ll Masanes, T Paterek, R Renner and C Simon for fruitful discussions. We acknowledge financial support from the Swiss NCCR ‘Quantum Photonics’ and National Science Foundation (SNSF), the EU Qubit Applications Project (QAP) contract number 015848, the Spanish MEC Consolider QOIT and FIS2007-60182 projects and a ‘Juan de la Cierva’ grant, ‘la Generalitat de Catalunya and Caixa Manresa’, the National Research Foundation and the Ministry of Education, Singapore, and the IAP project Photonics@be of the Belgian Science Policy.</p></acknowledgment></body><back><references><heading>References</heading><reference-list type="numeric"><journal-ref id="nj308932bib1" num="1"><authors><au><second-name>Bennett</second-name><first-names>C H</first-names></au><au><second-name>Brassard</second-name><first-names>G</first-names></au><au><second-name>Mermin</second-name><first-names>N D</first-names></au></authors><year>1992</year><jnl-title>Phys. Rev. Lett.</jnl-title><volume>68</volume><pages>557</pages><crossref><cr_doi>http://dx.doi.org/10.1103/PhysRevLett.68.557</cr_doi><cr_issn type="print">00319007</cr_issn><cr_issn type="electronic">10797114</cr_issn></crossref></journal-ref><conf-ref id="nj308932bib2" num="2"><authors><au><second-name>Bennett</second-name><first-names>C H</first-names></au><au><second-name>Brassard</second-name><first-names>G</first-names></au></authors><year>1984</year><conf-title>Proc. IEEE Int. Conf. on Computers, Systems and Signal Processing (Bangalore, India)</conf-title><pages>p 175</pages></conf-ref><book-ref id="nj308932bib3" num="3"><authors><au><second-name>Magniez</second-name><first-names>F</first-names></au><au><second-name>Mayers</second-name><first-names>D</first-names></au><au><second-name>Mosca</second-name><first-names>M</first-names></au><au><second-name>Ollivier</second-name><first-names>H</first-names></au></authors><year>2006</year><book-title>Proc. 33rd Int. Colloquium on Automata, Languages and Programming (Lecture Notes in Computer Science)</book-title><volume>vol 4051</volume><publication><place>Berlin</place><publisher>Springer</publisher></publication><pages>p 72</pages></book-ref><journal-ref id="nj308932bib4" num="4"><authors><au><second-name>Acín</second-name><first-names>A</first-names></au><au><second-name>Gisin</second-name><first-names>N</first-names></au><au><second-name>Masanes</second-name><first-names>L</first-names></au></authors><year>2006</year><jnl-title>Phys. Rev. Lett.</jnl-title><volume>97</volume><pages>120405</pages><crossref><cr_doi>http://dx.doi.org/10.1103/PhysRevLett.97.120405</cr_doi><cr_issn type="print">00319007</cr_issn><cr_issn type="electronic">10797114</cr_issn></crossref></journal-ref><book-ref id="nj308932bib5" num="5"><authors><au><second-name>Bell</second-name><first-names>J</first-names></au></authors><year>1987</year><book-title>Speakable and Unspeakable in Quantum Mechanics</book-title><publication><place>Cambridge</place><publisher>Cambridge University Press</publisher></publication></book-ref><journal-ref id="nj308932bib6" num="6"><authors><au><second-name>Ekert</second-name><first-names>A</first-names></au></authors><year>1991</year><jnl-title>Phys. Rev. Lett.</jnl-title><volume>67</volume><pages>661</pages><crossref><cr_doi>http://dx.doi.org/10.1103/PhysRevLett.67.661</cr_doi><cr_issn type="print">00319007</cr_issn><cr_issn type="electronic">10797114</cr_issn></crossref></journal-ref><journal-ref id="nj308932bib7" num="7"><authors><au><second-name>Mayers</second-name><first-names>D</first-names></au><au><second-name>Yao</second-name><first-names>A</first-names></au></authors><year>2004</year><jnl-title>Quantum Inf. Comput.</jnl-title><volume>4</volume><pages>273</pages></journal-ref><journal-ref id="nj308932bib8" num="8"><authors><au><second-name>Barrett</second-name><first-names>J</first-names></au><au><second-name>Hardy</second-name><first-names>L</first-names></au><au><second-name>Kent</second-name><first-names>A</first-names></au></authors><year>2005</year><jnl-title>Phys. Rev. Lett.</jnl-title><volume>95</volume><pages>010503</pages><crossref><cr_doi>http://dx.doi.org/10.1103/PhysRevLett.95.010503</cr_doi><cr_issn type="print">00319007</cr_issn><cr_issn type="electronic">10797114</cr_issn></crossref></journal-ref><journal-ref id="nj308932bib9" num="9"><authors><au><second-name>Barrett</second-name><first-names>J</first-names></au><au><second-name>Linden</second-name><first-names>N</first-names></au><au><second-name>Massar</second-name><first-names>S</first-names></au><au><second-name>Pironio</second-name><first-names>S</first-names></au><au><second-name>Popescu</second-name><first-names>S</first-names></au><au><second-name>Roberts</second-name><first-names>D</first-names></au></authors><year>2005</year><jnl-title>Phys. Rev.</jnl-title><part>A</part><volume>71</volume><pages>022101</pages><crossref><cr_doi>http://dx.doi.org/10.1103/PhysRevA.71.022101</cr_doi><cr_issn type="print">10502947</cr_issn><cr_issn type="electronic">10941622</cr_issn></crossref></journal-ref><journal-ref id="nj308932bib10" num="10"><authors><au><second-name>Barrett</second-name><first-names>J</first-names></au><au><second-name>Kent</second-name><first-names>A</first-names></au><au><second-name>Pironio</second-name><first-names>S</first-names></au></authors><year>2006</year><jnl-title>Phys. Rev. Lett.</jnl-title><volume>97</volume><pages>170409</pages><crossref><cr_doi>http://dx.doi.org/10.1103/PhysRevLett.97.170409</cr_doi><cr_issn type="print">00319007</cr_issn><cr_issn type="electronic">10797114</cr_issn></crossref></journal-ref><journal-ref id="nj308932bib11" num="11"><authors><au><second-name>Acín</second-name><first-names>A</first-names></au><au><second-name>Massar</second-name><first-names>S</first-names></au><au><second-name>Pironio</second-name><first-names>S</first-names></au></authors><year>2006</year><jnl-title>New J. Phys.</jnl-title><volume>8</volume><pages>126</pages><crossref><cr_doi>http://dx.doi.org/10.1088/1367-2630/8/8/126</cr_doi><cr_issn type="electronic">13672630</cr_issn></crossref></journal-ref><journal-ref id="nj308932bib12" num="12"><authors><au><second-name>Scarani</second-name><first-names>V</first-names></au><au><second-name>Gisin</second-name><first-names>N</first-names></au><au><second-name>Brunner</second-name><first-names>N</first-names></au><au><second-name>Masanes</second-name><first-names>Ll</first-names></au><au><second-name>Pino</second-name><first-names>S</first-names></au><au><second-name>Acín</second-name><first-names>A</first-names></au></authors><year>2006</year><jnl-title>Phys. Rev.</jnl-title><part>A</part><volume>74</volume><pages>042339</pages><crossref><cr_doi>http://dx.doi.org/10.1103/PhysRevA.74.042339</cr_doi><cr_issn type="print">10502947</cr_issn><cr_issn type="electronic">10941622</cr_issn></crossref></journal-ref><misc-ref id="nj308932bib13" num="13"><authors><au><second-name>Masanes</second-name><first-names>Ll</first-names></au><au><second-name>Winter</second-name><first-names>A</first-names></au><au><second-name>Renner</second-name><first-names>R</first-names></au><au><second-name>Barrett</second-name><first-names>J</first-names></au><au><second-name>Christandl</second-name><first-names>M</first-names></au></authors><year>2006</year><misc-text>arXiv:<arxiv url="quant-ph/0606049v3">quant-ph/0606049v3</arxiv></misc-text></misc-ref><misc-ref id="nj308932bib14" num="14"><authors><au><second-name>Masanes</second-name><first-names>Ll</first-names></au></authors><year>2008</year><misc-text>arXiv:<arxiv url="0807.2158">0807.2158</arxiv></misc-text></misc-ref><journal-ref id="nj308932bib15" num="15"><authors><au><second-name>Acín</second-name><first-names>A</first-names></au><au><second-name>Brunner</second-name><first-names>N</first-names></au><au><second-name>Gisin</second-name><first-names>N</first-names></au><au><second-name>Massar</second-name><first-names>S</first-names></au><au><second-name>Pironio</second-name><first-names>S</first-names></au><au><second-name>Scarani</second-name><first-names>V</first-names></au></authors><year>2007</year><jnl-title>Phys. Rev. Lett.</jnl-title><volume>98</volume><pages>230501</pages><crossref><cr_doi>http://dx.doi.org/10.1103/PhysRevLett.98.230501</cr_doi><cr_issn type="print">00319007</cr_issn><cr_issn type="electronic">10797114</cr_issn></crossref></journal-ref><journal-ref id="nj308932bib16" num="16"><authors><au><second-name>Christandl</second-name><first-names>M</first-names></au><au><second-name>König</second-name><first-names>R</first-names></au><au><second-name>Renner</second-name><first-names>R</first-names></au></authors><year>2009</year><jnl-title>Phys. Rev. Lett.</jnl-title><volume>102</volume><pages>020504</pages><crossref><cr_doi>http://dx.doi.org/10.1103/PhysRevLett.102.020504</cr_doi><cr_issn type="print">00319007</cr_issn><cr_issn type="electronic">10797114</cr_issn></crossref></journal-ref><journal-ref id="nj308932bib17" num="17"><authors><au><second-name>Clauser</second-name><first-names>J F</first-names></au><au><second-name>Horne</second-name><first-names>M A</first-names></au><au><second-name>Shimony</second-name><first-names>A</first-names></au><au><second-name>Holt</second-name><first-names>R A</first-names></au></authors><year>1969</year><jnl-title>Phys. Rev. Lett.</jnl-title><volume>23</volume><pages>880</pages><crossref><cr_doi>http://dx.doi.org/10.1103/PhysRevLett.23.880</cr_doi><cr_issn type="print">00319007</cr_issn><cr_issn type="electronic">10797114</cr_issn></crossref></journal-ref><journal-ref id="nj308932bib18" num="18"><authors><au><second-name>Tsirelson</second-name><first-names>B S</first-names></au></authors><year>1980</year><jnl-title>Lett. Math. Phys.</jnl-title><volume>4</volume><pages>83</pages></journal-ref><journal-ref id="nj308932bib19" num="19"><authors><au><second-name>Devetak</second-name><first-names>I</first-names></au><au><second-name>Winter</second-name><first-names>A</first-names></au></authors><year>2005</year><jnl-title>Proc. R. Soc.</jnl-title><part>A</part><volume>461</volume><pages>207</pages><crossref><cr_doi>http://dx.doi.org/10.1098/rspa.2004.1372</cr_doi><cr_issn type="print">13645021</cr_issn><cr_issn type="electronic">14712946</cr_issn></crossref></journal-ref><journal-ref id="nj308932bib20" num="20"><authors><au><second-name>Shor</second-name><first-names>P W</first-names></au><au><second-name>Preskill</second-name><first-names>J</first-names></au></authors><year>2000</year><jnl-title>Phys. Rev. Lett.</jnl-title><volume>85</volume><pages>441</pages><crossref><cr_doi>http://dx.doi.org/10.1103/PhysRevLett.85.441</cr_doi><cr_issn type="print">00319007</cr_issn><cr_issn type="electronic">10797114</cr_issn></crossref></journal-ref><journal-ref id="nj308932bib21" num="21"><authors><au><second-name>Verstraete</second-name><first-names>F</first-names></au><au><second-name>Wolf</second-name><first-names>M M</first-names></au></authors><year>2002</year><jnl-title>Phys. Rev. Lett.</jnl-title><volume>89</volume><pages>170401</pages><crossref><cr_doi>http://dx.doi.org/10.1103/PhysRevLett.89.170401</cr_doi><cr_issn type="print">00319007</cr_issn><cr_issn type="electronic">10797114</cr_issn></crossref></journal-ref><book-ref id="nj308932bib22" num="22"><authors><au><second-name>Nielsen</second-name><first-names>M A</first-names></au><au><second-name>Chuang</second-name><first-names>I L</first-names></au></authors><year>2000</year><book-title>Quantum Computation and Quantum Information</book-title><publication><place>Cambridge</place><publisher>Cambridge University Press</publisher></publication></book-ref><journal-ref id="nj308932bib23" num="23"><authors><au><second-name>Tsirelson</second-name><first-names>B</first-names></au></authors><year>1993</year><jnl-title>Hadronic J. Suppl.</jnl-title><volume>8</volume><pages>329</pages></journal-ref><journal-ref id="nj308932bib24" num="24"><authors><au><second-name>Masanes</second-name><first-names>Ll</first-names></au></authors><year>2006</year><jnl-title>Phys. Rev. Lett.</jnl-title><volume>97</volume><pages>050503</pages><crossref><cr_doi>http://dx.doi.org/10.1103/PhysRevLett.97.050503</cr_doi><cr_issn type="print">00319007</cr_issn><cr_issn type="electronic">10797114</cr_issn></crossref></journal-ref><journal-ref id="nj308932bib25" num="25"><authors><au><second-name>Horodecki</second-name><first-names>M</first-names></au><au><second-name>Horodecki</second-name><first-names>P</first-names></au><au><second-name>Horodecki</second-name><first-names>M</first-names></au></authors><year>1995</year><jnl-title>Phys. Lett.</jnl-title><part>A</part><volume>200</volume><pages>340</pages><crossref><cr_doi>http://dx.doi.org/10.1016/0375-9601(95)00214-N</cr_doi><cr_issn type="print">03759601</cr_issn></crossref></journal-ref><misc-ref id="nj308932bib26" num="26"><authors><au><second-name>Scarani</second-name><first-names>V</first-names></au><au><second-name>Bechmann-Pasquinucci</second-name><first-names>H</first-names></au><au><second-name>Cerf</second-name><first-names>N J</first-names></au><au><second-name>Dušek</second-name><first-names>M</first-names></au><au><second-name>Lütkenhaus</second-name><first-names>N</first-names></au><au><second-name>Peev</second-name><first-names>M</first-names></au></authors><year>2008</year><misc-text>arXiv:<arxiv url="0802.4155">0802.4155</arxiv></misc-text></misc-ref><journal-ref id="nj308932bib27" num="27"><authors><au><second-name>Pearle</second-name><first-names>P M</first-names></au></authors><year>1970</year><jnl-title>Phys. Rev.</jnl-title><part>D</part><volume>2</volume><pages>1418</pages><crossref><cr_doi>http://dx.doi.org/10.1103/PhysRevD.2.1418</cr_doi><cr_issn type="print">15507998</cr_issn><cr_issn type="electronic">10894918</cr_issn></crossref></journal-ref><journal-ref id="nj308932bib28" num="28"><authors><au><second-name>Massar</second-name><first-names>S</first-names></au><au><second-name>Pironio</second-name><first-names>S</first-names></au><au><second-name>Roland</second-name><first-names>J</first-names></au><au><second-name>Gisin</second-name><first-names>B</first-names></au></authors><year>2002</year><jnl-title>Phys. Rev.</jnl-title><part>A</part><volume>66</volume><pages>052112</pages><crossref><cr_doi>http://dx.doi.org/10.1103/PhysRevA.66.052112</cr_doi><cr_issn type="print">10502947</cr_issn><cr_issn type="electronic">10941622</cr_issn></crossref></journal-ref><journal-ref id="nj308932bib29" num="29"><authors><au><second-name>Brunner</second-name><first-names>N</first-names></au><au><second-name>Gisin</second-name><first-names>N</first-names></au></authors><year>2008</year><jnl-title>Phys. Lett.</jnl-title><part>A</part><volume>372</volume><pages>3162</pages><crossref><cr_doi>http://dx.doi.org/10.1016/j.physleta.2008.01.052</cr_doi><cr_issn type="print">03759601</cr_issn></crossref></journal-ref><journal-ref id="nj308932bib30" num="30"><authors><au><second-name>Pál</second-name><first-names>K</first-names></au><au><second-name>Vértesi</second-name><first-names>T</first-names></au></authors><year>2009</year><jnl-title>Phys. Rev.</jnl-title><part>A</part><volume>79</volume><pages>022120</pages><crossref><cr_doi>http://dx.doi.org/10.1103/PhysRevA.79.022120</cr_doi><cr_issn type="print">10502947</cr_issn><cr_issn type="electronic">10941622</cr_issn></crossref></journal-ref><journal-ref id="nj308932bib31" num="31"><authors><au><second-name>Aspect</second-name><first-names>A</first-names></au><au><second-name>Dalibard</second-name><first-names>J</first-names></au><au><second-name>Roger</second-name><first-names>G</first-names></au></authors><year>1982</year><jnl-title>Phys. Rev. Lett.</jnl-title><volume>49</volume><pages>1804</pages><crossref><cr_doi>http://dx.doi.org/10.1103/PhysRevLett.49.1804</cr_doi><cr_issn type="print">00319007</cr_issn><cr_issn type="electronic">10797114</cr_issn></crossref></journal-ref><journal-ref id="nj308932bib32" num="32"><authors><au><second-name>Weihs</second-name><first-names>G</first-names></au><au><second-name>Jennewein</second-name><first-names>T</first-names></au><au><second-name>Simon</second-name><first-names>C</first-names></au><au><second-name>Weinfurter</second-name><first-names>H</first-names></au><au><second-name>Zeilinger</second-name><first-names>A</first-names></au></authors><year>1998</year><jnl-title>Phys. Rev. Lett.</jnl-title><volume>81</volume><pages>5039</pages><crossref><cr_doi>http://dx.doi.org/10.1103/PhysRevLett.81.5039</cr_doi><cr_issn type="print">00319007</cr_issn><cr_issn type="electronic">10797114</cr_issn></crossref></journal-ref><journal-ref id="nj308932bib33" num="33"><authors><au><second-name>Tittel</second-name><first-names>W</first-names></au><au><second-name>Brendel</second-name><first-names>J</first-names></au><au><second-name>Zbinden</second-name><first-names>H</first-names></au><au><second-name>Gisin</second-name><first-names>N</first-names></au></authors><year>1998</year><jnl-title>Phys. Rev. Lett.</jnl-title><volume>81</volume><pages>3563</pages><crossref><cr_doi>http://dx.doi.org/10.1103/PhysRevLett.81.3563</cr_doi><cr_issn type="print">00319007</cr_issn><cr_issn type="electronic">10797114</cr_issn></crossref></journal-ref><journal-ref id="nj308932bib34" num="34"><authors><au><second-name>Rowe</second-name><first-names>M A</first-names></au><au><second-name>Kielpinski</second-name><first-names>D</first-names></au><au><second-name>Meyer</second-name><first-names>V</first-names></au><au><second-name>Sackett</second-name><first-names>C A</first-names></au><au><second-name>Itano</second-name><first-names>W M</first-names></au><au><second-name>Monroe</second-name><first-names>C</first-names></au><au><second-name>Wineland</second-name><first-names>D J</first-names></au></authors><year>2001</year><jnl-title>Nature</jnl-title><volume>409</volume><pages>791</pages><crossref><cr_doi>http://dx.doi.org/10.1038/35057215</cr_doi><cr_issn type="print">00280836</cr_issn><cr_issn type="electronic">14764687</cr_issn></crossref></journal-ref><journal-ref id="nj308932bib35" num="35"><authors><au><second-name>Matsukevich</second-name><first-names>D N</first-names></au><au><second-name>Maunz</second-name><first-names>P</first-names></au><au><second-name>Moehring</second-name><first-names>D L</first-names></au><au><second-name>Olmschenk</second-name><first-names>S</first-names></au><au><second-name>Monroe</second-name><first-names>C</first-names></au></authors><year>2008</year><jnl-title>Phys. Rev. Lett.</jnl-title><volume>100</volume><pages>150404</pages><crossref><cr_doi>http://dx.doi.org/10.1103/PhysRevLett.100.150404</cr_doi><cr_issn type="print">00319007</cr_issn><cr_issn type="electronic">10797114</cr_issn></crossref></journal-ref><journal-ref id="nj308932bib36" num="36"><authors><au><second-name>Larsson</second-name><first-names>J-Å</first-names></au><au><second-name>Gill</second-name><first-names>R D</first-names></au></authors><year>2004</year><jnl-title>Europhys. Lett.</jnl-title><volume>67</volume><pages>707</pages><crossref><cr_doi>http://dx.doi.org/10.1209/epl/i2004-10124-7</cr_doi><cr_issn type="print">02955075</cr_issn><cr_issn type="electronic">12864854</cr_issn></crossref></journal-ref><journal-ref id="nj308932bib37" num="37"><authors><au><second-name>Larsson</second-name><first-names>J-Å</first-names></au></authors><year>2002</year><jnl-title>Quantum Inf. Comput.</jnl-title><volume>2</volume><pages>434</pages></journal-ref><journal-ref id="nj308932bib38" num="38"><authors><au><second-name>Zhao</second-name><first-names>Y</first-names></au><au><second-name>Fred Fung</second-name><first-names>C-H</first-names></au><au><second-name>Qi</second-name><first-names>B</first-names></au><au><second-name>Chen</second-name><first-names>C</first-names></au><au><second-name>Lo</second-name><first-names>H-K</first-names></au></authors><year>2008</year><jnl-title>Phys. Rev.</jnl-title><part>A</part><volume>78</volume><pages>042333</pages><crossref><cr_doi>http://dx.doi.org/10.1103/PhysRevA.78.042333</cr_doi><cr_issn type="print">10502947</cr_issn><cr_issn type="electronic">10941622</cr_issn></crossref></journal-ref><misc-ref id="nj308932bib39" num="39"><authors><au><second-name>Tittel</second-name><first-names>W</first-names></au><au><second-name>Afzelius</second-name><first-names>M</first-names></au><au><second-name>Cone</second-name><first-names>R</first-names></au><au><second-name>Chanelière</second-name><first-names>T</first-names></au><au><second-name>Kröll</second-name><first-names>S</first-names></au><au><second-name>Moiseev</second-name><first-names>S A</first-names></au><au><second-name>Sellars</second-name><first-names>M</first-names></au></authors><year>2008</year><misc-text>arXiv:<arxiv url="0810.0172">0810.0172</arxiv></misc-text></misc-ref><journal-ref id="nj308932bib40" num="40"><authors><au><second-name>Kimble</second-name><first-names>J</first-names></au></authors><year>2008</year><jnl-title>Nature</jnl-title><volume>453</volume><pages>1023</pages><crossref><cr_doi>http://dx.doi.org/10.1038/nature07127</cr_doi><cr_issn type="print">00280836</cr_issn><cr_issn type="electronic">14764687</cr_issn></crossref></journal-ref><journal-ref id="nj308932bib41" num="41"><authors><au><second-name>Luis</second-name><first-names>A</first-names></au><au><second-name>Sanchez-Soto</second-name><first-names>L L</first-names></au></authors><year>1999</year><jnl-title>Phys. Rev. Lett.</jnl-title><volume>83</volume><pages>3573</pages><crossref><cr_doi>http://dx.doi.org/10.1103/PhysRevLett.83.3573</cr_doi><cr_issn type="print">00319007</cr_issn><cr_issn type="electronic">10797114</cr_issn></crossref></journal-ref><journal-ref id="nj308932bib42" num="42"><authors><au><second-name>Fiurasek</second-name><first-names>J</first-names></au></authors><year>2001</year><jnl-title>Phys. Rev.</jnl-title><part>A</part><volume>64</volume><pages>024102</pages><crossref><cr_doi>http://dx.doi.org/10.1103/PhysRevA.64.024102</cr_doi><cr_issn type="print">10502947</cr_issn><cr_issn type="electronic">10941622</cr_issn></crossref></journal-ref><journal-ref id="nj308932bib43" num="43"><authors><au><second-name>D'Ariano</second-name><first-names>G M</first-names></au><au><second-name>Maccone</second-name><first-names>L</first-names></au><au><second-name>Presti</second-name><first-names>P L</first-names></au></authors><year>2004</year><jnl-title>Phys. Rev. Lett.</jnl-title><volume>93</volume><pages>250407</pages><crossref><cr_doi>http://dx.doi.org/10.1103/PhysRevLett.93.250407</cr_doi><cr_issn type="print">00319007</cr_issn><cr_issn type="electronic">10797114</cr_issn></crossref></journal-ref><journal-ref id="nj308932bib44" num="44"><authors><au><second-name>Lundeen</second-name><first-names>J S</first-names></au><au><second-name>Feito</second-name><first-names>A</first-names></au><au><second-name>Coldenstrodt-Ronge</second-name><first-names>H</first-names></au><au><second-name>Pregnell</second-name><first-names>K L</first-names></au><au><second-name>Silberhorn</second-name><first-names>C</first-names></au><au><second-name>Ralph</second-name><first-names>T C</first-names></au><au><second-name>Eisert</second-name><first-names>J</first-names></au><au><second-name>Plenio</second-name><first-names>M B</first-names></au><au><second-name>Walmsley</second-name><first-names>I A</first-names></au></authors><year>2009</year><jnl-title>Nat. Phys.</jnl-title><volume>5</volume><pages>27</pages><crossref><cr_doi>http://dx.doi.org/10.1038/nphys1133</cr_doi><cr_issn type="print">14760000</cr_issn><cr_issn type="electronic">14764636</cr_issn></crossref></journal-ref><journal-ref id="nj308932bib45" num="45"><authors><au><second-name>Gisin</second-name><first-names>N</first-names></au><au><second-name>Fasel</second-name><first-names>S</first-names></au><au><second-name>Kraus</second-name><first-names>B</first-names></au><au><second-name>Zbinden</second-name><first-names>H</first-names></au><au><second-name>Ribordy</second-name><first-names>G</first-names></au></authors><year>2006</year><jnl-title>Phys. Rev.</jnl-title><part>A</part><volume>73</volume><pages>022320</pages><crossref><cr_doi>http://dx.doi.org/10.1103/PhysRevA.73.022320</cr_doi><cr_issn type="print">10502947</cr_issn><cr_issn type="electronic">10941622</cr_issn></crossref></journal-ref><misc-ref id="nj308932bib46" num="46"><authors><au><second-name>Ma</second-name><first-names>X</first-names></au><au><second-name>Moroder</second-name><first-names>T</first-names></au><au><second-name>Lütkenhaus</second-name><first-names>N</first-names></au></authors><year>2008</year><misc-text>arXiv:<arxiv url="0812.4301">0812.4301</arxiv></misc-text></misc-ref><journal-ref id="nj308932bib47" num="47"><authors><au><second-name>Bruss</second-name><first-names>D</first-names></au><au><second-name>Macchiavello</second-name><first-names>C</first-names></au></authors><year>2002</year><jnl-title>Phys. Rev. Lett.</jnl-title><volume>88</volume><pages>127901</pages><crossref><cr_doi>http://dx.doi.org/10.1103/PhysRevLett.88.127901</cr_doi><cr_issn type="print">00319007</cr_issn><cr_issn type="electronic">10797114</cr_issn></crossref></journal-ref><journal-ref id="nj308932bib48" num="48"><authors><au><second-name>Cerf</second-name><first-names>N J</first-names></au><au><second-name>Bourennane</second-name><first-names>M</first-names></au><au><second-name>Karlsson</second-name><first-names>A</first-names></au><au><second-name>Gisin</second-name><first-names>N</first-names></au></authors><year>2002</year><jnl-title>Phys. Rev. Lett.</jnl-title><volume>88</volume><pages>127902</pages><crossref><cr_doi>http://dx.doi.org/10.1103/PhysRevLett.88.127902</cr_doi><cr_issn type="print">00319007</cr_issn><cr_issn type="electronic">10797114</cr_issn></crossref></journal-ref><journal-ref id="nj308932bib49" num="49"><authors><au><second-name>Gisin</second-name><first-names>N</first-names></au><au><second-name>Linden</second-name><first-names>N</first-names></au><au><second-name>Massar</second-name><first-names>S</first-names></au><au><second-name>Popescu</second-name><first-names>S</first-names></au></authors><year>2005</year><jnl-title>Phys. Rev.</jnl-title><part>A</part><volume>72</volume><pages>012338</pages><crossref><cr_doi>http://dx.doi.org/10.1103/PhysRevA.72.012338</cr_doi><cr_issn type="print">10502947</cr_issn><cr_issn type="electronic">10941622</cr_issn></crossref></journal-ref><journal-ref id="nj308932bib50" num="50"><authors><au><second-name>Navascués</second-name><first-names>M</first-names></au><au><second-name>Pironio</second-name><first-names>S</first-names></au><au><second-name>Acín</second-name><first-names>A</first-names></au></authors><year>2008</year><jnl-title>New J. Phys.</jnl-title><volume>10</volume><pages>073013</pages><crossref><cr_doi>http://dx.doi.org/10.1088/1367-2630/10/7/073013</cr_doi><cr_issn type="electronic">13672630</cr_issn></crossref></journal-ref><misc-ref id="nj308932bib51" num="51"><authors><au><second-name>Vértesi</second-name><first-names>T</first-names></au><au><second-name>Pál</second-name><first-names>K F</first-names></au></authors><year>2008</year><misc-text>arXiv:<arxiv url="0812.1572">0812.1572</arxiv></misc-text></misc-ref><misc-ref id="nj308932bib52" num="52"><authors><au><second-name>Buhrman</second-name><first-names>H</first-names></au><au><second-name>Briet</second-name><first-names>J</first-names></au><au><second-name>Toner</second-name><first-names>B</first-names></au></authors><year>2009</year><misc-text>arXiv:<arxiv url="0901.2009">0901.2009</arxiv></misc-text></misc-ref><journal-ref id="nj308932bib53" num="53"><authors><au><second-name>Brunner</second-name><first-names>N</first-names></au><au><second-name>Pironio</second-name><first-names>S</first-names></au><au><second-name>Acin</second-name><first-names>A</first-names></au><au><second-name>Gisin</second-name><first-names>N</first-names></au><au><second-name>Methot</second-name><first-names>A A</first-names></au><au><second-name>Scarani</second-name><first-names>V</first-names></au></authors><year>2008</year><jnl-title>Phys. Rev. Lett.</jnl-title><volume>100</volume><pages>210503</pages><crossref><cr_doi>http://dx.doi.org/10.1103/PhysRevLett.100.210503</cr_doi><cr_issn type="print">00319007</cr_issn><cr_issn type="electronic">10797114</cr_issn></crossref></journal-ref><journal-ref id="nj308932bib54" num="54"><authors><au><second-name>Masanes</second-name><first-names>Ll</first-names></au><au><second-name>Acín</second-name><first-names>A</first-names></au><au><second-name>Gisin</second-name><first-names>N</first-names></au></authors><year>2006</year><jnl-title>Phys. Rev.</jnl-title><part>A</part><volume>73</volume><pages>012112</pages><crossref><cr_doi>http://dx.doi.org/10.1103/PhysRevA.73.012112</cr_doi><cr_issn type="print">10502947</cr_issn><cr_issn type="electronic">10941622</cr_issn></crossref></journal-ref><journal-ref id="nj308932bib55" num="55"><authors><au><second-name>Brukner</second-name><first-names>C</first-names></au><au><second-name>Kofler</second-name><first-names>J</first-names></au><au><second-name>Paterek</second-name><first-names>T</first-names></au></authors><year>2006</year><jnl-title>Phys. Rev.</jnl-title><part>A</part><volume>73</volume><pages>022104</pages><crossref><cr_doi>http://dx.doi.org/10.1103/PhysRevA.73.012110</cr_doi><cr_issn type="print">10502947</cr_issn><cr_issn type="electronic">10941622</cr_issn></crossref></journal-ref><journal-ref id="nj308932bib56" num="56"><authors><au><second-name>Renner</second-name><first-names>R</first-names></au></authors><year>2007</year><jnl-title>Nat. Phys.</jnl-title><volume>3</volume><pages>645</pages><crossref><cr_doi>http://dx.doi.org/10.1038/nphys684</cr_doi><cr_issn type="print">14760000</cr_issn><cr_issn type="electronic">14764636</cr_issn></crossref></journal-ref><misc-ref id="nj308932bib57" num="57"><authors><au><second-name>Christandl</second-name><first-names>M</first-names></au><au><second-name>Toner</second-name><first-names>B</first-names></au></authors><year>2007</year><misc-text>arXiv:<arxiv url="0712.0916">0712.0916</arxiv></misc-text></misc-ref><journal-ref id="nj308932bib58" num="58"><authors><au><second-name>Barrett</second-name><first-names>J</first-names></au><au><second-name>Leifer</second-name><first-names>M</first-names></au></authors><year>2009</year><jnl-title>New J. Phys.</jnl-title><volume>11</volume><pages>033024</pages><crossref><cr_doi>http://dx.doi.org/10.1088/1367-2630/11/3/033024</cr_doi><cr_issn type="electronic">13672630</cr_issn></crossref></journal-ref></reference-list></references><footnotes><footnote id="nj308932fn8" source="text" type="number" marker="8"><p>For instance, quantum physics might only break down at an energy scale that would remain inaccessible to human control for ages.</p></footnote><footnote id="nj308932fn9" source="text" type="number" marker="9"><p>Note, that we are not considering here the ‘detector’ as a complete measurement device, but only as the part of the device that clicks or not whenever it is hit by one or several photons. In particular, all the machinery that determines the choice of measurement bases (and which may include beam splitters, polarizers, etc) is still assumed to be part of the black-box device.</p></footnote><footnote id="nj308932fn10" source="text" type="number" marker="10"><p>Recently, the role of the detector efficiency loophole in standard QKD has been analyzed in [<cite linkend="nj308932bib46">46</cite>].</p></footnote></footnotes></back></article></istex:document></istex:metadataXml><mods version="3.6"><titleInfo lang="eng"><title>Device-independent quantum key distribution secure against collective attacks</title></titleInfo><titleInfo type="abbreviated"><title>Device-independent quantum key distribution secure against collective attacks</title></titleInfo><titleInfo type="alternative" lang="eng"><title>Device-independent quantum key distribution secure against collective attacks</title></titleInfo><name type="personal"><namePart type="given">Stefano</namePart><namePart type="family">Pironio</namePart><affiliation>Group of Applied Physics, University of Geneva, 1211 Geneva 4, Switzerland</affiliation><affiliation>Author to whom any correspondence should be addressed.</affiliation><affiliation>E-mail: stefano.pironio@unige.ch</affiliation><role><roleTerm type="text">author</roleTerm></role></name><name type="personal"><namePart type="given">Antonio</namePart><namePart type="family">Acn</namePart><affiliation>ICFO-Institut de Ciencies Fotoniques, 08860 Castelldefels, Spain</affiliation><affiliation>ICREA-InstituciCatalana de Recerca i Estudis Avanats, Pg. Lluis Companys 23, 08010 Barcelona, Spain</affiliation><role><roleTerm type="text">author</roleTerm></role></name><name type="personal"><namePart type="given">Nicolas</namePart><namePart type="family">Brunner</namePart><affiliation>H H Wills Physics Laboratory, University of Bristol, Tyndall Avenue, Bristol, BS8 1TL, UK</affiliation><role><roleTerm type="text">author</roleTerm></role></name><name type="personal"><namePart type="given">Nicolas</namePart><namePart type="family">Gisin</namePart><affiliation>Group of Applied Physics, University of Geneva, 1211 Geneva 4, Switzerland</affiliation><role><roleTerm type="text">author</roleTerm></role></name><name type="personal"><namePart type="given">Serge</namePart><namePart type="family">Massar</namePart><affiliation>Laboratoire d'Information Quantique, Universit Libre de Bruxelles, CP 225, Boulevard du Triomphe, B-1050 Bruxelles, Belgium</affiliation><role><roleTerm type="text">author</roleTerm></role></name><name type="personal"><namePart type="given">Valerio</namePart><namePart type="family">Scarani</namePart><affiliation>Centre for Quantum Technologies and Department of Physics, National University of Singapore, Singapore</affiliation><role><roleTerm type="text">author</roleTerm></role></name><typeOfResource>text</typeOfResource><genre type="research-article" displayLabel="paper">paper</genre><originInfo><publisher>IOP Publishing</publisher><dateIssued encoding="w3cdtf">2009</dateIssued><copyrightDate encoding="w3cdtf">2009</copyrightDate></originInfo><language><languageTerm type="code" authority="iso639-2b">eng</languageTerm><languageTerm type="code" authority="rfc3066">en</languageTerm></language><physicalDescription><internetMediaType>text/html</internetMediaType></physicalDescription><abstract>Device-independent quantum key distribution (DIQKD) represents a relaxation of the security assumptions made in usual quantum key distribution (QKD). As in usual QKD, the security of DIQKD follows from the laws of quantum physics, but contrary to usual QKD, it does not rely on any assumptions about the internal working of the quantum devices used in the protocol. In this paper, we present in detail the security proof for a DIQKD protocol introduced in Acn et al(2008Phys. Rev. Lett.98230501). This proof exploits the full structure of quantum theory (as opposed to other proofs that exploit only the no-signaling principle), but only holds against collective attacks, where the eavesdropper is assumed to act on the quantum systems of the honest parties independently and identically in each round of the protocol (although she can act coherently on her systems at any time). The security of any DIQKD protocol necessarily relies on the violation of a Bell inequality. We discuss the issue of loopholes in Bell experiments in this context.</abstract><relatedItem type="host"><titleInfo><title>New Journal of Physics</title></titleInfo><titleInfo type="abbreviated"><title>New J. Phys.</title></titleInfo><genre type="journal">journal</genre><identifier type="ISSN">1367-2630</identifier><identifier type="eISSN">1367-2630</identifier><identifier type="PublisherID">nj</identifier><identifier type="CODEN">NJOPFM</identifier><identifier type="URL">stacks.iop.org/NJP</identifier><part><date>2009</date><detail type="volume"><caption>vol.</caption><number>11</number></detail><detail type="issue"><caption>no.</caption><number>4</number></detail><extent unit="pages"><start>1</start><end>25</end><total>25</total></extent></part></relatedItem><identifier type="istex">3826DC738D18141428C804738D7E7ADBA9F46FC7</identifier><identifier type="DOI">10.1088/1367-2630/11/4/045021</identifier><identifier type="articleID">308932</identifier><identifier type="articleNumber">045021</identifier><accessCondition type="use and reproduction" contentType="copyright">IOP Publishing and Deutsche Physikalische Gesellschaft</accessCondition><recordInfo><recordContentSource>IOP</recordContentSource><recordOrigin>IOP Publishing and Deutsche Physikalische Gesellschaft</recordOrigin></recordInfo></mods></metadata><enrichments><json:item><type>multicat</type><uri>https://api.istex.fr/document/3826DC738D18141428C804738D7E7ADBA9F46FC7/enrichments/multicat</uri></json:item></enrichments><serie></serie></istex></record>Pour manipuler ce document sous Unix (Dilib)
EXPLOR_STEP=$WICRI_ROOT/Wicri/Belgique/explor/OpenAccessBelV2/Data/Istex/Corpus
HfdSelect -h $EXPLOR_STEP/biblio.hfd -nk 001A83 | SxmlIndent | more
Ou
HfdSelect -h $EXPLOR_AREA/Data/Istex/Corpus/biblio.hfd -nk 001A83 | SxmlIndent | more
Pour mettre un lien sur cette page dans le réseau Wicri
{{Explor lien
|wiki= Wicri/Belgique
|area= OpenAccessBelV2
|flux= Istex
|étape= Corpus
|type= RBID
|clé= ISTEX:3826DC738D18141428C804738D7E7ADBA9F46FC7
|texte= Device-independent quantum key distribution secure against collective attacks
}}
| This area was generated with Dilib version V0.6.25. |  |